last executing test programs: 25m18.027009188s ago: executing program 32 (id=258): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xc1842, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$TUNSETSNDBUF(r0, 0x400454d4, &(0x7f0000000080)=0xf) write$cgroup_devices(r0, &(0x7f00000000c0)=ANY=[@ANYRES8, @ANYRES32=r0], 0xffdd) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xc1842, 0x0) (async) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) (async) ioctl$TUNSETSNDBUF(r0, 0x400454d4, &(0x7f0000000080)=0xf) (async) write$cgroup_devices(r0, &(0x7f00000000c0)=ANY=[@ANYRES8, @ANYRES32=r0], 0xffdd) (async) 15m59.820939969s ago: executing program 1 (id=2937): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) preadv(0xffffffffffffffff, 0x0, 0x0, 0xfffffffa, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000800)={{0x14}, [@NFT_MSG_NEWRULE={0x14, 0x6, 0xa, 0x160b, 0x0, 0x0, {0x2, 0x0, 0x8}}], {0x14}}, 0x3c}, 0x1, 0x0, 0x0, 0x850}, 0x4040884) 15m59.481926752s ago: executing program 1 (id=2939): r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f00000002c0), r3) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r3, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f0000000740)={0x30, r4, 0x67f0cdb14570e865, 0x70bd25, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_MESH_ID={0xa}, @NL80211_ATTR_TX_RATES={0x8, 0x5a, 0x0, 0x1, [@NL80211_BAND_2GHZ={0x4, 0x500}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x4008001}, 0x10004) sendmsg$NL80211_CMD_SET_BEACON(r1, &(0x7f0000000dc0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000d80)={&(0x7f0000000680)={0x6f4, r4, 0x8, 0x70bd2b, 0x25dfdbfd, {{}, {@void, @val={0xc, 0x99, {0x2, 0x4c}}}}, [@NL80211_ATTR_IE_ASSOC_RESP={0x4f, 0x80, [@random_vendor={0xdd, 0x39, "2bfae7c89339a002d3793fa51bf1f2693b48b90baf7e428e4f3dcb6b9578e3a2e3b5f076f87b021e8566f1ab4ed8a9efe7f37c56472bf79a40"}, @cf={0x4, 0x6, {0x0, 0x10, 0x5, 0xfff}}, @ssid={0x0, 0x6, @default_ibss_ssid}]}, @NL80211_ATTR_IE_PROBE_RESP={0x118, 0x7f, [@mesh_chsw={0x76, 0x6, {0x81, 0x1, 0x3e, 0xb1}}, @measure_req={0x26, 0x83, {0xd2, 0x7, 0xd, "22088cdf411f3b2dc1c1e2ca7ad0718c87f356ba3070b2f391c8fe88302a632b4e303282f4acf8e3752a1539ed992f965adb71f4afa3317ae900cc547062fbf63ac6a9c840a4879b6453bbf3fda3a760a1b90ad9c07c5ab4fc4b7b0a189fd2306d8ec7994acf4dcc709fd5af77cdbfc60c996fa298e55f798f1c77459755cb92"}}, @mesh_config={0x71, 0x7, {0x0, 0x0, 0x0, 0x1, 0x2, 0x6, 0x21}}, @mic={0x8c, 0x10, {0xa9b, "c865493c56d3", @short="9b1f050a35badd8f"}}, @random={0x0, 0x4e, "84fb5a84df47b1931a0a32e515aaaad884d85186ac6a247cab198823f164e0797b8af79ca3061cbc2532486018f6b3affaf126b96b134c73571ab660e8cb2ff6e0c0227832f50d72fe671410fc2c"}, @mesh_id={0x72, 0x6}, @link_id={0x65, 0x12, {@from_mac, @device_b, @device_b}}]}, @NL80211_ATTR_BEACON_TAIL={0x123, 0xf, [@peer_mgmt={0x75, 0x14, {0x0, 0x5, @void, @void, @val="2222ca5388beec34da930e03f0570c60"}}, @fast_bss_trans={0x37, 0xff, {0x5, 0x7, "427d2b9b02726b1d04ca325d9c39e3cb", "5e6c3a402f41c07cb35f394b8e27f78fbde608830b16e3d7b546368b5ecc4b2c", "b5379c1be1305eda8a6fdbd10a339479055ed0ba2d191ae49c83047f3b06fe35", [{0x1}, {0x2, 0x28, "fcdcf6de0a9f4d4f5a2aff9131051c8370c8688208b7be7243a6776595cc985360125c998222e116"}, {0x4, 0x22, "380d89e20f2e512579df90205c64e81ccc88d801b0f43bdf311e676888bc68885864"}, {0x2, 0x11, "35a2224b09ac3af737793e375e7f7122c8"}, {0x2, 0x1e, "f3e69edb8e47d481c78447ffef0c891bc0b2eed3aac679131cb34930b219"}, {0x4}, {0x2, 0x26, "35f49588eb6a164d245a3842e26455682e5aab49ba14bc82d69bc037d0084f5f8645d2ab81fd"}]}}, @mesh_chsw={0x76, 0x6, {0x5, 0xc, 0x0, 0x2}}]}, @NL80211_ATTR_IE_ASSOC_RESP={0x52, 0x80, [@supported_rates={0x1, 0x7, [{0x18, 0x1}, {0xc, 0x1}, {0x48}, {0x2, 0x1}, {0x6c}, {0x60, 0x1}, {0xb}]}, @ibss={0x6, 0x2, 0x5}, @mesh_id={0x72, 0x6}, @supported_rates, @channel_switch={0x25, 0x3, {0x1, 0xaf}}, @challenge={0x10, 0x1, 0x47}, @ibss={0x6, 0x2, 0x5}, @mesh_config={0x71, 0x7, {0x0, 0x1, 0x1, 0xffffffffffffffff, 0x0, 0x2, 0x9}}, @ht={0x2d, 0x1a, {0x8, 0x3, 0x3, 0x0, {0x6, 0x0, 0x0, 0xf4, 0x0, 0x0, 0x0, 0x3, 0x1}, 0x8, 0x200, 0x8}}, @chsw_timing={0x68, 0x4, {0x6, 0x3}}]}, @NL80211_ATTR_PROBE_RESP={0x366, 0x91, "0632a1025cc72b722adacd9098b5d7c73410e00cbbf51efa99965c961e2cd612733750d853aeca4b9c46f6392e53a2115dadbbc4139e17c2682a1fb2708f79506566342336faa2dbf0f6a190a195e75e506e7132791d628cd237745be74a9ca830801bd8a46b6b9976c8cde00d31870371d05ad60af1d31b5f29ea65a44072620bbf928e099d61f0c63c4c55619c7f488eb9ac4d024ca572ef835db5c0b8bfa47c96a53fb332812b83bcf998912cd9582a42c99765e38900017fa9c0e57b1b1cf34b916ac5c001a028705667431c8d180d9b6e2b32d91252abee5cbbc9b31de1ad531d027a42b79aee4a599df5aad71fa11e97b2d08ff51f8ff403af03e654d1a6bd445d96d20cf6a20b9ff008c408f7104e31910fe5e2eb2518ad785611c8f37a7d409225aa21cc557a1f8198021249ff51c7e413bd54ff4031cfe1a444a1c66b95ef9d286907451d1374dac62c114feb269d042c865a2921c2a2228dd5bbf44e051e061dea48fc4c5ac874ef7c9338f79668ad9e25d455f376125553714fd652fba4c9ac0ddd4adbd94febb7fc161bb02772811a01b6a34a1f52827174bfd989297e9314743dac8770df387697de0d2cdc34b2db927b2fdd7f2ca71a1662a3b4cb207e698f8954f6ae3bb622dfcba04e12d45b23b0f8bb4982f5fc08820bf8750173ba3f73c3782cf0e5acf86578f513a961d81e10f9db4126c929ddcbb138d2f83212c19b55d9e833e2d0921150bd52e230dfe5576a5cf1a667a0b098f9a2b447452b73432968bf2479d83dd3eac3db5ebd510661117e70bdcca60daef7f6e87ba818a3d5ced7e127ae6fbe599064eaca62c6fc2b2573097fd46460f6b918828d28facc57f98403ee533ad7649def042e11dafc3ce5e293a9f1e6a0c58e0670486ebb5b6871709be9b041a9f682ac840dbfb768c3d04575fb8bbf7a314c7b81e54aa97cbddda699ebb0f41758d31048fa5bf8b077000fe4fbccc68312400f8d47b5d91d472cf2f7ab5f39d8a119d4740fa22b703caae97de114dff79441d760e1a0ddf985a0bef895d7579987cb9ab2224f7607e4e5b2fc89a6a665b70af58bb8e9140a9f3b7c983abf5b56b723dc7b9c8f97f64b9c565891f4c84bad2d4409e34df5a0e7f792cc480eaabd3db1073e237378048596d5571cdf438b5bb59717f9603893bdfcffc9ca5bc250e5cd9815802e78a899f45dcbe4d7b155122a36212f"}, @NL80211_ATTR_IE={0x89, 0x2a, [@ssid={0x0, 0x6, @default_ibss_ssid}, @mesh_config={0x71, 0x7, {0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0xffffffffffffffff, 0x4}}, @measure_req={0x26, 0x72, {0x7, 0x7, 0x1, "09ed58ead552ec8c8138a11fea7630d7e6fe693b0d3dcad34d2215670178e2f9734d6aad70bc42164b37a5f5f553fef29c1f690a00b3ab28786bcf18d84e384d8786c2ccccccdc0db0f2fed362bbdfaf28ebde4a1749cc596154c330b563ea44916c23dcc21c3d44c436d1c06ac4a7"}}]}]}, 0x6f4}}, 0x40) sendmsg$L2TP_CMD_SESSION_DELETE(r1, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="0100"], 0x34}}, 0x20) r6 = openat$comedi(0xffffff9c, &(0x7f0000000100)='/dev/comedi0\x00', 0x101001, 0x0) ioctl$COMEDI_DEVCONFIG(r6, 0x40946400, &(0x7f0000000140)={'dac02\x00', [0x290, 0x7, 0x7fffffff, 0x3, 0x27, 0x2006, 0xf2, 0x20008, 0x80ffa, 0x2, 0x0, 0x4, 0x0, 0x1000004, 0x1, 0x10000, 0xe44, 0x7ffffffd, 0x1ef, 0x8, 0x20000010, 0x55, 0x8, 0x4008, 0x746f, 0x9f, 0x6, 0x7, 0xee, 0x1, 0x8000]}) r7 = syz_open_dev$loop(&(0x7f0000000100), 0xf01c, 0x0) ioctl$LOOP_CONFIGURE(r7, 0x4c0a, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev/ttyUSB0\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./dev\x00', &(0x7f0000000300)='devtmpfs\x00', 0x0, 0x0) r8 = syz_usb_connect(0x0, 0x32, &(0x7f0000000400)=ANY=[@ANYBLOB="12010002000000405a0609000001000000010902200001010080320904000002ff00000007058102"], 0x0) r9 = socket$inet(0xa, 0x801, 0x84) mount(&(0x7f0000000240)=@nullb, &(0x7f0000000280)='./dev\x00', &(0x7f00000002c0)='coda\x00', 0x2000, &(0x7f0000000340)='\x00') connect$inet(r9, &(0x7f0000000140)={0x2, 0x0, @rand_addr=0x64010100}, 0x10) listen(r9, 0x6) r10 = accept4(r9, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r10, 0x84, 0x7b, &(0x7f00000000c0)={0x0, 0x2}, 0x8) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r10, 0x84, 0x7b, &(0x7f0000000180)={0x0, 0x2}, &(0x7f00000001c0)=0x8) openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/ttyUSB0\x00', 0x802, 0x0) syz_usb_disconnect(r8) 15m57.613894359s ago: executing program 1 (id=2944): r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x27, &(0x7f0000000000)={@multicast1, @dev={0xac, 0x14, 0x14, 0x30}}, 0xc) r1 = syz_open_procfs(0x0, &(0x7f0000002180)='net/mcfilter\x00') preadv(r1, &(0x7f0000001b80)=[{&(0x7f0000000040)=""/93, 0x5d}, {&(0x7f0000000500)=""/101, 0x65}], 0x2, 0x0, 0x0) socket$inet_sctp(0x2, 0x5, 0x84) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000001340)=ANY=[@ANYBLOB="2c2f00004700070125bd7001ffffffff01", @ANYBLOB], 0x2f2c}, 0x1, 0x0, 0x0, 0x2404c0d1}, 0xc000) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/sys/net/sctp/udp_port\x00', 0x1, 0x0) write(r3, 0x0, 0x0) mmap$IORING_OFF_SQES(0x0, 0x6, 0x4, 0x13, r3, 0x10000000) 15m57.41588124s ago: executing program 1 (id=2945): r0 = syz_open_dev$video4linux(&(0x7f0000000080), 0x0, 0x0) ioctl$VIDIOC_SUBSCRIBE_EVENT(r0, 0xc0085666, &(0x7f00000000c0)={0x3, 0x10980901, 0x1}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) r4 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000080), 0x1c0002, 0x0) write$vga_arbiter(r4, &(0x7f0000000280)=@other={'lock', ' ', 'mem'}, 0x9) sendmsg$NL80211_CMD_START_AP(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000480)={0x234, r2, 0x5, 0x70bd26, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x1ab, 0xe, {{{}, {}, @device_a, @device_a, @from_mac}, 0x8, @default, 0x8, @void, @val, @val={0x3, 0x1, 0xd}, @val={0x4, 0x6, {0xb3, 0x2, 0xd, 0x1ff}}, @void, @val={0x5, 0x3, {0x7, 0xc7, 0x6}}, @void, @val={0x2a, 0x1, {0x0, 0x1}}, @void, @val={0x2d, 0x1a, {0x2ff, 0x1, 0x7, 0x0, {0xa600000000000000, 0xf, 0x0, 0x3fe, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x9, 0x3}}, @val={0x72, 0x6}, @void, @void, [{0xdd, 0xc5, "d21cb76f942e241172d1fda5840abf29b6eeef3c2693e572badf59e93615f1de335e42572382674184d6edb362992d91169ea2538b553b89ee18d759ddc74f70b57cb3ce716fd8f120cc4e6d2ac222afb2f43bb687d8df37a97b19550de77ca303d951226a38eb4d21cdc56ca15c03c725149888c9c57c074981133ad3598480177a40c55683c44f06cc670ff20c14f3a8abbb0b85ae10d988c03c0a6c165ad5b0c5d3ace9fbc9c1b4db444a9d30776d1dd90943a020420fb448683498566d236367c835a5"}, {0xdd, 0x1a, "278042825d291c500e53b1d55860c371fae94dc1e107faa1f87f"}, {0xdd, 0x65, "3b907580de3be4e0a9358eca816208cabad842f2c9ef134fab9bfab432e975eb7b0f3ae9ce366e90435335a5e271935c471f53de8931e31a77e601018094cb2eb4a6c2b3d8e0973e944047ed58d3c34bb69bda7c2165551d1bd381f5f58d9ca7ecece66b62"}]}}, @NL80211_ATTR_FTM_RESPONDER={0x8, 0x10e, 0x0, 0x1, [@NL80211_FTM_RESP_ATTR_ENABLED={0x4}]}, @NL80211_ATTR_PROBE_RESP={0x4b, 0x91, "b24d0d3d384c0942fbc50fa868f1338e81703d6a7901d2b8d1f20dfc1357c064c7a102565c9a4dfc82cdbf0c70f34fc4d0f90bab0ee933f396c0c0559294147a1e2fe2c9e24973"}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}]}, 0x234}, 0x1, 0x0, 0x0, 0x24004851}, 0x20000014) 15m57.233538421s ago: executing program 1 (id=2946): add_key$keyring(&(0x7f0000000280), &(0x7f00000000c0)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) mkdir(&(0x7f0000000000)='./my_configfs\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./my_configfs\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000e00)='./my_configfs/dlm/cluster1/comms/1/local\x00', 0x2, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x42, 0x0) fsopen(&(0x7f0000000100)='ceph\x00', 0x0) socket$packet(0x11, 0x2, 0x300) socket$nl_route(0x10, 0x3, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0xa101, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000540), 0x400, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) syz_open_dev$tty1(0xc, 0x4, 0x1) openat$tun(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) syz_open_procfs(0x0, &(0x7f0000000300)='task\x00') ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r0, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000100)=[0x0], 0x40000012}) socketpair$unix(0x1, 0x2, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_ATOMIC(r0, 0xc03864bc, &(0x7f0000000180)={0x300, 0x1, &(0x7f0000000340)=[r1], &(0x7f0000000240)=[0x2], &(0x7f0000000200), &(0x7f0000000240), 0x0, 0x7f}) 15m57.088070771s ago: executing program 1 (id=2948): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./my_debugfs\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./my_debugfs\x00', &(0x7f0000000300)='debugfs\x00', 0x0, 0x0) r0 = openat2$dir(0xffffffffffffff9c, &(0x7f0000000080)='./my_debugfs/usb/devices\x00', &(0x7f00000000c0)={0x8000, 0x2c, 0x5}, 0x18) mknodat(r0, &(0x7f0000000100)='./my_debugfs\x00', 0x800, 0x100) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./my_debugfs/usb/devices\x00', 0x0, 0x0) ioctl$IOC_PR_PREEMPT_ABORT(r1, 0x401870cc, &(0x7f0000000040)={0x158, 0x0, 0x8, 0x1}) read(r1, &(0x7f0000000500)=""/100, 0x7ffe) 15m41.726863835s ago: executing program 33 (id=2948): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./my_debugfs\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./my_debugfs\x00', &(0x7f0000000300)='debugfs\x00', 0x0, 0x0) r0 = openat2$dir(0xffffffffffffff9c, &(0x7f0000000080)='./my_debugfs/usb/devices\x00', &(0x7f00000000c0)={0x8000, 0x2c, 0x5}, 0x18) mknodat(r0, &(0x7f0000000100)='./my_debugfs\x00', 0x800, 0x100) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./my_debugfs/usb/devices\x00', 0x0, 0x0) ioctl$IOC_PR_PREEMPT_ABORT(r1, 0x401870cc, &(0x7f0000000040)={0x158, 0x0, 0x8, 0x1}) read(r1, &(0x7f0000000500)=""/100, 0x7ffe) 13m14.897420372s ago: executing program 4 (id=3574): syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = mmap$KVM_VCPU(&(0x7f0000ffb000/0x2000)=nil, 0x930, 0x1000002, 0x4018831, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x80801) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000ffc000/0x3000)=nil, 0x3000}, 0x1}) syz_memcpy_off$KVM_EXIT_HYPERCALL(r0, 0x20, &(0x7f0000000180)="5e73663bf4082f7c6cbecbf09d6dd7be5a06dfd64563f329c16f799d1836bfc45a7badc8faed24bb77c848723a43602d1fe0d236c062e105ec77ffd00fb243c3111dda42112650cc", 0x0, 0xfe2a) mremap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1000, 0x4, &(0x7f0000fff000/0x1000)=nil) fanotify_init(0x3f, 0x0) mount(&(0x7f0000000000)=@nbd={'/dev/nbd', 0x0}, &(0x7f00000000c0)='./cgroup\x00', &(0x7f00000004c0)='hpfs\x00', 0xc4, 0x0) r2 = epoll_create1(0x0) r3 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x9, &(0x7f0000000040), 0x4) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000080)={0x10000000}) 13m13.963234923s ago: executing program 4 (id=3575): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) openat$vcsa(0xffffffffffffff9c, &(0x7f0000000080), 0x200, 0x0) syz_usb_connect(0x2, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000401e09030000000000000109022700010100c0320904000003ff0000000705810240000007050202400000070583034000"], &(0x7f0000001000)={0x0, 0x0, 0x0, 0x0}) mkdir(0x0, 0x1ff) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001f00), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_STRSET_GET(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x20, r3, 0x1, 0x70bd29, 0x25dfdbfd, {}, [@ETHTOOL_A_STRSET_HEADER={0x4}, @ETHTOOL_A_STRSET_STRINGSETS={0x8, 0x2, 0x0, 0x1, [{0x4, 0x26}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x41}, 0x4) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) r5 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r5, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x808000, 0x4, 0x20300, 0xfc}, 0x1c) setsockopt$packet_rx_ring(r5, 0x107, 0x5, &(0x7f0000000100)=@req3={0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x861}, 0x1c) rmdir(&(0x7f0000000040)='./file0\x00') ioctl$KVM_SET_SREGS(r4, 0x4138ae84, &(0x7f0000000480)={{0xc000, 0xf000, 0xc, 0x80, 0x84, 0x0, 0xa, 0x6, 0x0, 0xb, 0x6, 0xa4}, {0x0, 0x6000, 0xe, 0x8, 0x5f, 0x0, 0x0, 0x9, 0xf, 0x5, 0xee, 0xf}, {0x8000000, 0xb000, 0x4, 0x8, 0xf0, 0x1, 0x8c, 0x6, 0x7, 0x99, 0xfd, 0x1}, {0x100000, 0x5000, 0x8, 0xe, 0x7, 0x5, 0x1, 0x87, 0x5, 0x2}, {0x10000, 0x26000, 0xa, 0x0, 0x5, 0x4, 0xfa, 0x6b, 0x5, 0x0, 0xfd, 0x80}, {0xeeee8000, 0xeeef0000, 0xb, 0xf, 0x30, 0x3, 0x9, 0x8, 0x8, 0x7, 0xe, 0x8}, {0xe6ef8000, 0x0, 0x9, 0x3, 0x53, 0x4, 0x0, 0xb9, 0x7, 0x5, 0x6, 0x7}, {0xeeee0000, 0x1332b2000, 0x9, 0x7, 0xfe, 0x0, 0xc, 0x3, 0x0, 0x6, 0xf9, 0x6}, {0x3000, 0x6}, {0x1, 0x3}, 0x2, 0x0, 0x2000, 0x2, 0xd, 0x2000, 0x10000, [0xfffffffffffffffc, 0x4, 0x7, 0xa]}) 13m10.813685774s ago: executing program 4 (id=3586): r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x1200ec8, 0x2) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r1, &(0x7f0000000100)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x0, 0x0, @in6={0xa, 0x4e21, 0x9, @private0, 0x7ff}}}, 0x90) r2 = openat$audio1(0xffffffffffffff9c, &(0x7f0000000080), 0x129202, 0x0) r3 = openat$comedi(0xffffff9c, &(0x7f00000000c0)='/dev/comedi4\x00', 0x2c83, 0x0) ioctl$COMEDI_INSN(r3, 0x8028640c, &(0x7f0000000040)={0x8000001, 0x0, 0x0, 0x0, 0x3}) ioctl$SNDCTL_DSP_SETFMT(r2, 0xc0045005, &(0x7f0000002140)=0x20) mmap$dsp(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x100000f, 0x11, r2, 0x0) ioctl$SNDCTL_DSP_SETFMT(r2, 0xc0045005, &(0x7f0000000000)=0x4000) ioctl$vim2m_VIDIOC_S_FMT(r0, 0xc0d05605, &(0x7f00000000c0)={0x1, @pix={0x8, 0x4f, 0x32315559, 0x2, 0x1, 0x4, 0x9, 0xa6e, 0x0, 0x3, 0x0, 0x5}}) r4 = userfaultfd(0x80801) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_COPY(r4, 0xc028aa03, &(0x7f0000000100)={&(0x7f0000b6c000/0x3000)=nil, &(0x7f00001e0000/0x3000)=nil, 0x3000, 0xe8301691d6269744}) 13m10.540637537s ago: executing program 4 (id=3588): mkdir(&(0x7f0000001a80)='./file0\x00', 0x18b) mount$bpf(0x200000000000, &(0x7f0000000000)='./file0/../file0\x00', 0x0, 0x989046, 0x0) mount$bpf(0x0, &(0x7f00000000c0)='./file0/../file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x200000000000, &(0x7f0000000000)='.\x00', 0x0, 0x8b7848, 0x0) mount$bpf(0x200000002000, &(0x7f0000000100)='./file0/../file0\x00', 0x0, 0x80000, 0x0) mount$bpf(0x200000000000, &(0x7f0000000440)='./file0\x00', 0x0, 0x98d046, 0x0) mount$bpf(0x8cff, &(0x7f0000000040)='./file0\x00', 0x0, 0x84000, 0x0) 13m10.129573566s ago: executing program 4 (id=3589): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)=@arm64={0x3, 0x8, 0x80, '\x00', 0xe}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r5, 0x4008ae89, &(0x7f0000000000)={0x1, 0x0, [{0x1c4, 0x0, 0x80}]}) r6 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/keys\x00', 0x0, 0x0) preadv(r6, &(0x7f0000000340)=[{&(0x7f0000000540)=""/245, 0xf5}], 0x1, 0x40000004, 0x5) ioctl$TIOCGPTPEER(r6, 0x5441, 0xd) ioctl$KVM_SET_GUEST_DEBUG_x86(r2, 0x4048ae9b, &(0x7f0000000180)={0x160001, 0x0, {[0x4, 0x1f8, 0x2, 0xffffffffeffff715, 0xffffffffffffffff, 0x6, 0x1, 0x5eb]}}) r7 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009210008000122010009058103"], 0x0) syz_usb_control_io$hid(r7, &(0x7f0000000040)={0x24, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0}, 0x0) r8 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000100), r6) sendmsg$MPTCP_PM_CMD_REMOVE(r6, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, r8, 0x1, 0x70bd28, 0x25dfdbfc, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x20008040) 13m9.185615354s ago: executing program 4 (id=3592): r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_ATOMIC(r0, 0xc03864bc, &(0x7f0000000180)={0x201, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7e}) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fsopen(&(0x7f0000000080)='autofs\x00', 0x0) r3 = socket$packet(0x11, 0x3, 0x300) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000340)={0x1ac, 0x21, 0x600, 0x70bd2a, 0x25dfdbff, {0x18}, [@nested={0x195, 0xae, 0x0, 0x1, [@generic="a8f61e755f33a136eb2fb78ca6c5", @generic="c5d8f786c91f6f5685fc6ebfee6d8c5e0226cb", @typed={0x8, 0xba, 0x0, 0x0, @fd}, @generic="39f19bfbc24145800f53973b2d2ea0d6439ed6129110f732025546f7a6565e697f2fec64d3ebcc8b3d95550b2294d371b8d169747ce95b64c2c4f4ec05490a25b85fd928c79446b3492452ca37caa48ad64c862a873bc24ae2e2ce6400985a91c9ffd87c1564afc04e33ea33d6a4900a1f5d0a5758eec228b241f2aebaced21bc1181974291695a148ce10aa3cbf00219320a2f6f10cb29a683e665f5043df40c5821d770fbae0edd42acc5de0aeb2fbb395daef25b791141f8e76909c0e84ba64eb8eeff4e9defcccae9793955361ca386baede71e6289fd068fd52ff22a91afbbb37d926f8", @typed={0x4, 0x15f}, @generic="5f924b564c27ea17f4dec6322c8391377790610aa4e8f81382dbe36f21643a97d3ac4a037ff16bba8eb31aa4b03f21a3be627fed1dabf7198c945e0a85569b42aa3d717a9634dd3cec73168e3224488ce6c6af8a77729ac19766d5116c17cd44bdddd6f5b905ad00e108d99ed30c4b7fb30841ca0368c49c306745a76035"]}]}, 0x1ac}, 0x1, 0x0, 0x0, 0x40840}, 0x4000) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) setsockopt$packet_int(r3, 0x107, 0xf, &(0x7f0000000100)=0x9, 0x4) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'syz_tun\x00', 0x0}) sendto$packet(r3, &(0x7f0000000180)="0b0312002e0064000200475400f6a13bb1000000086086dd4803", 0x100a6, 0x0, &(0x7f0000000140)={0x11, 0x86dd, r4}, 0x14) r5 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000001c0), 0x4b301, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000240)=0xd) writev(r5, &(0x7f0000000080)=[{&(0x7f0000000280)='*', 0x1}], 0x1) fsconfig$FSCONFIG_SET_FD(r2, 0x5, &(0x7f00000005c0)='fd', 0x0, r1) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) r6 = fsmount(r2, 0x0, 0x2) r7 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) socket(0x23, 0x803, 0x10000) ioctl$vim2m_VIDIOC_ENUM_FRAMESIZES(r7, 0xc02c564a, &(0x7f00000001c0)={0x0, 0x20303159, 0x2, @stepwise={0x8, 0xb5, 0x40, 0x8d, 0x2, 0xfffffffb}}) symlinkat(&(0x7f0000000280)='./file0\x00', r6, &(0x7f00000000c0)='./file0\x00') unlinkat(r6, &(0x7f0000000000)='./file0/file0\x00', 0x0) 13m8.854088479s ago: executing program 34 (id=3592): r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_ATOMIC(r0, 0xc03864bc, &(0x7f0000000180)={0x201, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7e}) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fsopen(&(0x7f0000000080)='autofs\x00', 0x0) r3 = socket$packet(0x11, 0x3, 0x300) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000340)={0x1ac, 0x21, 0x600, 0x70bd2a, 0x25dfdbff, {0x18}, [@nested={0x195, 0xae, 0x0, 0x1, [@generic="a8f61e755f33a136eb2fb78ca6c5", @generic="c5d8f786c91f6f5685fc6ebfee6d8c5e0226cb", @typed={0x8, 0xba, 0x0, 0x0, @fd}, @generic="39f19bfbc24145800f53973b2d2ea0d6439ed6129110f732025546f7a6565e697f2fec64d3ebcc8b3d95550b2294d371b8d169747ce95b64c2c4f4ec05490a25b85fd928c79446b3492452ca37caa48ad64c862a873bc24ae2e2ce6400985a91c9ffd87c1564afc04e33ea33d6a4900a1f5d0a5758eec228b241f2aebaced21bc1181974291695a148ce10aa3cbf00219320a2f6f10cb29a683e665f5043df40c5821d770fbae0edd42acc5de0aeb2fbb395daef25b791141f8e76909c0e84ba64eb8eeff4e9defcccae9793955361ca386baede71e6289fd068fd52ff22a91afbbb37d926f8", @typed={0x4, 0x15f}, @generic="5f924b564c27ea17f4dec6322c8391377790610aa4e8f81382dbe36f21643a97d3ac4a037ff16bba8eb31aa4b03f21a3be627fed1dabf7198c945e0a85569b42aa3d717a9634dd3cec73168e3224488ce6c6af8a77729ac19766d5116c17cd44bdddd6f5b905ad00e108d99ed30c4b7fb30841ca0368c49c306745a76035"]}]}, 0x1ac}, 0x1, 0x0, 0x0, 0x40840}, 0x4000) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) setsockopt$packet_int(r3, 0x107, 0xf, &(0x7f0000000100)=0x9, 0x4) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'syz_tun\x00', 0x0}) sendto$packet(r3, &(0x7f0000000180)="0b0312002e0064000200475400f6a13bb1000000086086dd4803", 0x100a6, 0x0, &(0x7f0000000140)={0x11, 0x86dd, r4}, 0x14) r5 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000001c0), 0x4b301, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000240)=0xd) writev(r5, &(0x7f0000000080)=[{&(0x7f0000000280)='*', 0x1}], 0x1) fsconfig$FSCONFIG_SET_FD(r2, 0x5, &(0x7f00000005c0)='fd', 0x0, r1) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) r6 = fsmount(r2, 0x0, 0x2) r7 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) socket(0x23, 0x803, 0x10000) ioctl$vim2m_VIDIOC_ENUM_FRAMESIZES(r7, 0xc02c564a, &(0x7f00000001c0)={0x0, 0x20303159, 0x2, @stepwise={0x8, 0xb5, 0x40, 0x8d, 0x2, 0xfffffffb}}) symlinkat(&(0x7f0000000280)='./file0\x00', r6, &(0x7f00000000c0)='./file0\x00') unlinkat(r6, &(0x7f0000000000)='./file0/file0\x00', 0x0) 12m51.132921594s ago: executing program 6 (id=3594): mkdir(&(0x7f0000001a80)='./file0\x00', 0x18b) mount$bpf(0x200000000000, &(0x7f0000000000)='./file0/../file0\x00', 0x0, 0x989046, 0x0) mount$bpf(0x0, &(0x7f00000000c0)='./file0/../file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x200000000000, &(0x7f0000000000)='.\x00', 0x0, 0x8b7848, 0x0) mount$bpf(0x200000002000, &(0x7f0000000100)='./file0/../file0\x00', 0x0, 0x80000, 0x0) mount$bpf(0x200000000000, &(0x7f0000000440)='./file0\x00', 0x0, 0x98d046, 0x0) r0 = socket$kcm(0x10, 0x2, 0x0) write$cgroup_subtree(r0, &(0x7f0000000740)=ANY=[@ANYBLOB="563d00001500599c6d0e0000ded650492d"], 0xfe33) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x81, 0x0) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x4800) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(r3, 0x6, 0x1, &(0x7f00000000c0)=@gcm_256={{0x303}, '\x00', "5171bb672965593497418688ac68cb126474cd3660dab9e2086e246728d7a040", '\x00\x00=*', "1202000000040030"}, 0x38) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000340)={@in6={{0xa, 0x4e21, 0x9, @private2={0xfc, 0x2, '\x00', 0x9}, 0x5}}, 0x0, 0x0, 0x42, 0x0, "dedf2e3c20956e770008c07b4c65006b75df7b1467fc715d42efd35f802d90c180de0cacf0d5d8fb99bcbf788c6379b29193f703ddca22cf222767023fe1737a7f76b33cb4dac8cd895272e5cf2c4b33"}, 0xd8) setsockopt$inet6_tcp_int(r3, 0x6, 0x2000000000000020, &(0x7f0000000040)=0xa, 0x1959cc36) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000200)={@in6={{0xa, 0x4e21, 0x7fff, @loopback, 0x8}}, 0x0, 0x0, 0x16, 0x0, "5d9ed5ab7ede1bcf73742bc36c0ea13d3dec33e0b7cc1ff724fe1906cf9f7945230bc5d9dfea4ffd1e48aaf90000000000000000eb926f70f03d2df0bc37b96dea6c2f4ac1bf0bef969bcbd8e4700614"}, 0xd8) close_range(r2, 0xffffffffffffffff, 0x0) r4 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CAP_EXIT_HYPERCALL(r4, 0x4068aea3, &(0x7f0000000040)={0x79, 0x0, 0xc}) ioctl$KVM_SET_GSI_ROUTING(r4, 0x4008ae6a, &(0x7f0000000500)={0x1, 0x0, [{0x6, 0x4, 0x0, 0x0, @adapter={0xfffffffffffffdfd, 0xf, 0x2, 0x1, 0x4}}]}) mount$bpf(0x0, &(0x7f0000000040)='./file0\x00', 0x0, 0x84000, 0x0) 12m50.505155298s ago: executing program 6 (id=3634): r0 = accept(0xffffffffffffffff, &(0x7f0000000000)=@l2={0x1f, 0x0, @fixed}, &(0x7f0000000080)=0x80) getsockopt$inet_sctp_SCTP_STATUS(0xffffffffffffffff, 0x84, 0xe, &(0x7f0000000140)={0x0, 0x8, 0x58, 0x7, 0x9, 0xfe01, 0x4, 0x3, {0x0, @in={{0x2, 0x549c, @loopback}}, 0x8000, 0x94, 0x1, 0x4, 0x7fffffff}}, &(0x7f0000000200)=0xb0) setsockopt$inet_sctp_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f0000000280)={r1, 0x7ff, 0x3, [0x5000, 0xe, 0xb7]}, 0xe) prctl$PR_CAPBSET_DROP(0x18, 0x6) r2 = syz_usb_connect$uac3(0x0, 0xa0, &(0x7f00000000c0)=ANY=[@ANYBLOB="12011003000000403512100040000102030109028e000301002040080b0201012130c60904000000010130000a2401042a00ff0f0000132403050001020602028000000700100002000f240902020000000001"], &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac3(r2, 0x0, &(0x7f00000005c0)={0x44, &(0x7f0000000240)={0x20, 0x6}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 12m49.212256403s ago: executing program 6 (id=3639): setns(0xc9, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0x1}) ioctl$TUNSETLINK(r0, 0x400454cd, 0x10f) r1 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1}) write$tun(r0, &(0x7f0000000140)=ANY=[@ANYBLOB="00040805007a010b0a43b820a8e8c9"], 0x88) 12m48.595460098s ago: executing program 35 (id=3639): setns(0xc9, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0x1}) ioctl$TUNSETLINK(r0, 0x400454cd, 0x10f) r1 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1}) write$tun(r0, &(0x7f0000000140)=ANY=[@ANYBLOB="00040805007a010b0a43b820a8e8c9"], 0x88) 11m59.777456782s ago: executing program 2 (id=3740): setns(0xc9, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x2) dup(r0) mkdir(&(0x7f0000000400)='./my_sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./my_sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./my_sys/bus/pci/devices/0000:00:01.0/remove\x00', 0x1, 0x0) write(r1, &(0x7f0000000800)='1', 0x1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./my_sys/bus/pci/rescan\x00', 0x1, 0x0) write(r2, &(0x7f0000000a00)='1', 0x1) r3 = syz_usb_connect(0x0, 0x2d, &(0x7f00000012c0)=ANY=[@ANYBLOB="120100001ddf8208c007121522300000000109021b0001000000010904000001faf40d000905820349"], 0x0) syz_usb_control_io(r3, 0x0, 0x0) r4 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) getsockopt$nfc_llcp(r4, 0x118, 0x1, 0x0, 0x0) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$FS_IOC_RESVSP(r5, 0x40305828, 0x0) 11m57.889748541s ago: executing program 2 (id=3747): r0 = syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000480)={0x34, &(0x7f0000001500)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = memfd_create(&(0x7f00000000c0)='[\v\xdbX\xae[\x1a\xa9\xfd\xfa\xad\xd1md\xc8\x85HX\xa9%\f\x1ae\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xd6\x91%||\xa0\x8ez\xadT\xc8\f\xe5\x89\xbf3:\x99\x1e\xac`\xc3\xcf\xd3\xae\xd2\a\x11\xa9\xa5^\xff\xf5\x95\xd2q#\xc6\xca\x97\x9d\xcb\x1e\x80\xd6\xd5%N&\xf8#\x80z8Z\xd2}\xf5\xe4\x9f5\x9b\x01\xf9t\xbb\x1er\x14\xdb\xd3\xcd\xfd\xbdnC\xec', 0x3) write$binfmt_script(r1, &(0x7f0000000040), 0x4) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$HIDIOCGUSAGE(r2, 0xc0145b0e, &(0x7f0000000040)={0x1, 0x0, 0xfc, 0x0, 0x3, 0x80000}) 11m55.869690251s ago: executing program 2 (id=3753): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x26, [0x9, 0x0, 0x5, 0x6, 0x8, 0x155f, 0x10000006, 0x2, 0x25cd, 0x1, 0xb4, 0xd, 0xa2b9, 0x6, 0x8, 0xe4, 0x6, 0xfc000004, 0x402, 0xbbf, 0x4a732f64, 0x1, 0x1c0, 0xd, 0x0, 0x2a3, 0x4, 0x1, 0x2, 0xc3, 0x7, 0x81, 0x8a, 0x79, 0x2, 0x10000, 0x0, 0x91, 0x4, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x0, 0xf9a2, 0x80000001, 0xff, 0x2, 0x2, 0x2, 0x2, 0x7, 0x1, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x9, 0x4], [0x9, 0x40, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x20000073, 0x8e, 0xd50, 0x7, 0x5, 0x4, 0x809, 0x4, 0xa7, 0x1000, 0x0, 0x200b398, 0x400080, 0x1, 0x4, 0x1c, 0x7, 0x1, 0x2, 0x3, 0x8, 0xffffff7f, 0x400, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x80004, 0x46, 0xf1, 0x4, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x1, 0x1cb, 0x9, 0x80000004, 0x6, 0x43b, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x20000002, 0xffffeffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x8, 0x404, 0x6, 0xffff0000, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0x10, 0x5, 0x9, 0x7, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x9, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0xd, 0x7, 0x10010, 0x102, 0xdd81, 0x2, 0x7f, 0x9d27, 0x10000, 0x1, 0x100, 0x2, 0x6, 0x7ffd, 0x5, 0x7, 0xd500, 0x8, 0x77, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0x1], [0xa772, 0x6, 0xffffffff, 0x1afa, 0xbf8, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0x9, 0x1005, 0x1, 0x7, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x3, 0xfffffff7, 0x8, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x0, 0x100, 0xf, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x71c, 0x6, 0xf, 0xe, 0x1, 0x26e, 0x6, 0xc, 0x4, 0xfffffff9, 0x9, 0x5d9, 0x463f, 0x4, 0xb0, 0x6, 0x6, 0x14000, 0x1, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) sendmsg$NLBL_CIPSOV4_C_ADD(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="1c010000", @ANYBLOB="0702000000000000000001000005e400088024000780080006008d0000002000060069000000080005008395011708000610c30000000c00078008000600a78d0000040007800c00078008000500d3cb4e320c0007800800050085507e563400078008000600e3000000080006001c000000080005005131953508000500b9103d47080005008cc22742080006001100000014000780080005009a308465080005003f5f20463c00078008000500cd3ae82e08000500a17188b8ed2971ed22ad000008000600560000000800060010000000080006003a00000008000500d043317c0c000780080005002ac7423804000780140004800500030001"], 0x11c}}, 0x400c800) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x6, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0x7, 0x4, 0x5, 0x4, 0x8], 0x25000, 0x304}) sendmsg$netlink(0xffffffffffffffff, &(0x7f00000044c0)={0x0, 0x0, &(0x7f0000003f00)=[{&(0x7f0000000300)=ANY=[@ANYBLOB="200000001500040028bd7000fcdbdf2510005d800c00520004f80000000000cb"], 0x20}], 0x1, 0x0, 0x0, 0x20008801}, 0x40850) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x224000, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000180), 0x42, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000d40)={0x2c, 0x41, 0x107, 0xfffffffe, 0xfffffffe, {0x1, 0x7c}, [@nested={0x8, 0x142, 0x0, 0x1, [@typed={0x4, 0x8}]}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x00\x00'}]}, @nested={0x4, 0x2}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4048011}, 0xc0d4) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 11m54.704702995s ago: executing program 2 (id=3758): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) add_key$fscrypt_v1(&(0x7f0000000040), &(0x7f0000000080)={'fscrypt:', @desc2}, &(0x7f00000000c0)={0x0, "f1a1173fb9462d3589e67197f90be6e423ceb0ab4912f9f6a31854ec98e950cfed21fcad7ff0fbcb566a0982f8938caa52dd8d39af14c31ed56ad59300"}, 0x52ba, 0xffffffffffffffff) bind$inet6(0xffffffffffffffff, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$wireguard(&(0x7f0000000600), 0xffffffffffffffff) r1 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'wg2\x00', 0x0}) r3 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r3, &(0x7f0000000180)='`', 0x500, 0x0, &(0x7f0000000240)={0x2f, 0x0, r2, 0x1, 0x0, 0x6, @local}, 0x14) r4 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f00000003c0), r0) sendmsg$NLBL_CALIPSO_C_ADD(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000400)={0x14, r4, 0x301, 0x70bd27, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x40000}, 0x40044) r5 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nfc(&(0x7f0000000400), r6) capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000280)={0x0, 0x0, 0x3, 0x81, 0xffffffff}) keyctl$invalidate(0x15, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r5, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000d80)=ANY=[@ANYRES16, @ANYRES16=r7, @ANYBLOB="010426bd7000f8dbdf250200000008000100", @ANYRES32=r8], 0x1c}}, 0x4008054) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f0000000040)) r9 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r10 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) umount2(&(0x7f0000000040)='./file0/../file0\x00', 0xc) mount$bind(&(0x7f0000000300)='.\x00', &(0x7f00000002c0)='./file0\x00', 0x0, 0x185093, 0x0) r11 = syz_genetlink_get_family_id$nfc(&(0x7f0000000400), r10) ioctl$IOCTL_GET_NCIDEV_IDX(r9, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r10, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000d80)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r11, @ANYBLOB="010426bd7000f8dbdf250200000008000100", @ANYRES32=r12], 0x1c}}, 0x4008054) 11m51.237282119s ago: executing program 2 (id=3766): r0 = socket$kcm(0x10, 0x2, 0x0) (async) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000000), 0x505400, 0x0) ioctl$INCFS_IOC_PERMIT_FILL(r0, 0x40046721, &(0x7f0000000040)={r1}) (async) sendmsg$kcm(r0, &(0x7f00000000c0)={0x0, 0x3f, &(0x7f0000000080)=[{&(0x7f0000000300)="2e00000011008108090f9becdb4cb92e0a4831371400000069bd6efb2502eaf60d000300020400bf050005001201", 0x2e}], 0x1, 0x0, 0x0, 0xfeffffff}, 0x4) ioctl$sock_SIOCSIFVLAN_SET_VLAN_FLAG_CMD(r1, 0x8983, &(0x7f0000000100)={0x7, 'lo\x00', {0xfffffffe}, 0x81}) 11m50.42542134s ago: executing program 2 (id=3769): mkdirat(0xffffffffffffffff, 0x0, 0x1c0) (async, rerun: 64) ioctl$XFS_IOC_FD_TO_HANDLE(0xffffffffffffffff, 0xc038586a, &(0x7f0000000240)={0xffffffffffffffff, &(0x7f0000000100)='!\xc3\x00', 0xa8280, &(0x7f0000000180)={@_ha_fsid={[0x2, 0x7]}, {0x3, 0x3, 0x4, 0x6}}, 0x2, &(0x7f00000001c0)={@_ha_fsid}, &(0x7f0000000200)=0x5}) (rerun: 64) mkdirat(r0, &(0x7f0000000280)='./bus\x00', 0x2) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000000), 0x0, &(0x7f0000000040)={[{@userxattr}]}) r1 = socket$inet6(0xa, 0x1, 0x84) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000080)=0x2, 0x36) (async) sendto$inet6(r1, &(0x7f00000002c0)='\x00', 0x1, 0x24000800, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) r2 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_ASSERT(r2, 0x29, 0xcf, 0x0, 0x0) (async, rerun: 32) syz_init_net_socket$bt_l2cap(0x1f, 0x0, 0x2) (async, rerun: 32) setsockopt$inet6_mtu(r2, 0x29, 0x17, 0x0, 0x4c) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCSIFVLAN_SET_VLAN_INGRESS_PRIORITY_CMD(r3, 0x8983, &(0x7f0000000440)={0x2, 'vlan1\x00', {0xd}, 0x2b20}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) syz_open_procfs(r4, 0x0) ioctl$VHOST_SET_VRING_ADDR(0xffffffffffffffff, 0x4028af11, 0x0) (async) setsockopt$pppl2tp_PPPOL2TP_SO_LNSMODE(r2, 0x111, 0x4, 0x1, 0x4) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) (async) syz_kvm_add_vcpu$x86(0x0, 0x0) (async) r5 = socket(0x2, 0x2, 0x0) ioctl$sock_SIOCSIFVLAN_DEL_VLAN_CMD(r5, 0x8983, &(0x7f0000000000)={0x1, 'vlan1\x00', {}, 0x5832}) 11m49.995923004s ago: executing program 36 (id=3769): mkdirat(0xffffffffffffffff, 0x0, 0x1c0) (async, rerun: 64) ioctl$XFS_IOC_FD_TO_HANDLE(0xffffffffffffffff, 0xc038586a, &(0x7f0000000240)={0xffffffffffffffff, &(0x7f0000000100)='!\xc3\x00', 0xa8280, &(0x7f0000000180)={@_ha_fsid={[0x2, 0x7]}, {0x3, 0x3, 0x4, 0x6}}, 0x2, &(0x7f00000001c0)={@_ha_fsid}, &(0x7f0000000200)=0x5}) (rerun: 64) mkdirat(r0, &(0x7f0000000280)='./bus\x00', 0x2) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000000), 0x0, &(0x7f0000000040)={[{@userxattr}]}) r1 = socket$inet6(0xa, 0x1, 0x84) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000080)=0x2, 0x36) (async) sendto$inet6(r1, &(0x7f00000002c0)='\x00', 0x1, 0x24000800, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) r2 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_ASSERT(r2, 0x29, 0xcf, 0x0, 0x0) (async, rerun: 32) syz_init_net_socket$bt_l2cap(0x1f, 0x0, 0x2) (async, rerun: 32) setsockopt$inet6_mtu(r2, 0x29, 0x17, 0x0, 0x4c) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCSIFVLAN_SET_VLAN_INGRESS_PRIORITY_CMD(r3, 0x8983, &(0x7f0000000440)={0x2, 'vlan1\x00', {0xd}, 0x2b20}) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) syz_open_procfs(r4, 0x0) ioctl$VHOST_SET_VRING_ADDR(0xffffffffffffffff, 0x4028af11, 0x0) (async) setsockopt$pppl2tp_PPPOL2TP_SO_LNSMODE(r2, 0x111, 0x4, 0x1, 0x4) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) (async) syz_kvm_add_vcpu$x86(0x0, 0x0) (async) r5 = socket(0x2, 0x2, 0x0) ioctl$sock_SIOCSIFVLAN_DEL_VLAN_CMD(r5, 0x8983, &(0x7f0000000000)={0x1, 'vlan1\x00', {}, 0x5832}) 11m9.977243587s ago: executing program 7 (id=3865): r0 = syz_usb_connect(0x5, 0x46, &(0x7f0000000340)=ANY=[@ANYBLOB="12010000e75f9208c0070515c5b8010203010902340001000080000904ba00038e4ee2000905000000041a06010905010300001007c109050c04400006030f07059acbf5"], 0x0) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d80000001a0081044e81f782db4cb904021d08007b490d4f1e81f8d815000100ef05142603600e12080005007a010401a80016002000034004000000035c0461c9d67f6f940071342e875fab7cb6cec6cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b141993c034e653fe8efe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9ee5350db798262f3d40fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e", 0xd8}], 0x1}, 0x4000000) syz_usb_control_io$cdc_ncm(r0, &(0x7f0000000100)={0x14, 0x0, &(0x7f00000000c0)={0x0, 0x3, 0x1a, {0xa}}}, 0x0) r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) write$char_usb(r2, &(0x7f0000000000)="93", 0xf5) 11m6.60870194s ago: executing program 7 (id=3874): setsockopt$inet6_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000100)='cdg', 0x3) r0 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0xfffff34, 0x0, [{0xf88e470f, 0xed}]}) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x1, 0x9, 0xfffffffffffffffd, 0x77, 0xffffffffffffffff, 0x2, 0x4002004c4, 0x1004, 0x8000000000000000, 0xc595, 0x0, 0x1, 0xffffffffffffffff, 0x20004, 0x6, 0x8d], 0xeeee8000, 0x2010d3}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 11m6.212751718s ago: executing program 7 (id=3876): r0 = openat$vimc1(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$VIDIOC_G_SLICED_VBI_CAP(r0, 0xc0745645, &(0x7f0000000040)={0x8, [0x1, 0x7, 0x100, 0x52e, 0x9, 0x7, 0x2, 0x3, 0xffff, 0x1, 0x5, 0xf, 0x0, 0x0, 0xee, 0x1, 0x800, 0x1, 0x62, 0x3, 0x8, 0x5, 0xff, 0x3, 0x40, 0x3, 0x1, 0xb, 0x5, 0x8000, 0x400, 0x4, 0x0, 0x1, 0x2, 0x9, 0x7, 0x1, 0x2, 0x4, 0x40, 0x0, 0x6, 0x4, 0xfffc, 0x6, 0x5, 0xf], 0x7}) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wlan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_MESH_CONFIG(r1, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x44, r2, 0x100, 0x70bd27, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x3, 0x6a}}}}, [@NL80211_ATTR_IFINDEX={0x8, 0x3, r3}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x4}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r4}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x4, 0x73}}]}, 0x44}, 0x1, 0x0, 0x0, 0x8800}, 0x10) (async) fsetxattr$trusted_overlay_opaque(r1, &(0x7f00000002c0), &(0x7f0000000300), 0x2, 0x1) mprotect(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0xb) (async) sendmsg$NL80211_CMD_NEW_KEY(r1, &(0x7f0000000440)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000400)={&(0x7f0000000380)={0x60, 0x0, 0x400, 0x70bd28, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_KEY_DEFAULT={0x4}, @NL80211_ATTR_KEY_DEFAULT_TYPES={0x10, 0x6e, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}]}, @NL80211_ATTR_KEY_DEFAULT_TYPES={0x14, 0x6e, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}]}, @NL80211_ATTR_KEY_DEFAULT_TYPES={0x8, 0x6e, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}]}, @NL80211_ATTR_KEY_CIPHER={0x8, 0x9, 0xfac05}, @NL80211_ATTR_KEY_SEQ={0x14, 0xa, "fc594c30867201e1fc85e3fc9d6a0b6e"}]}, 0x60}, 0x1, 0x0, 0x0, 0x24000041}, 0x40010) (async) ioctl$VIDIOC_ENUM_FREQ_BANDS(r0, 0xc0405665, &(0x7f0000000480)={0x1, 0x5, 0x80000001, 0x80, 0x7f, 0x5, 0xc}) (async) ioctl$VIDIOC_G_JPEGCOMP(r0, 0x808c563d, &(0x7f00000004c0)) (async) r5 = syz_genetlink_get_family_id$fou(&(0x7f0000000580), r1) (async) ioctl$VIDIOC_ENUMINPUT(r0, 0xc050561a, &(0x7f00000005c0)={0x1, "b3e8b1ff235ec1aabc1ecd1153eee2df1c78009ef96182f95a8f39b81fee4938", 0x1, 0xfffffffe, 0x2, 0x0, 0x2080b01, 0x4}) (async) r6 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000640), 0x101000, 0x0) sendmsg$NL80211_CMD_JOIN_IBSS(r6, &(0x7f0000000780)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000740)={&(0x7f00000006c0)={0x64, r2, 0x1, 0x70bd27, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x8e, 0x1e}}}}, [@NL80211_ATTR_PRIVACY={0x4}, @NL80211_ATTR_MESH_CONFIG={0x3c, 0x23, 0x0, 0x1, [@NL80211_MESHCONF_ELEMENT_TTL={0x5, 0xf, 0x4}, @NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR={0x8, 0x15, 0x86}, @NL80211_MESHCONF_GATE_ANNOUNCEMENTS={0x5}, @NL80211_MESHCONF_TTL={0x5, 0x6, 0xc0}, @NL80211_MESHCONF_MAX_PEER_LINKS={0x6, 0x4, 0x29}, @NL80211_MESHCONF_PATH_REFRESH_TIME={0x8, 0x9, 0x6}, @NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT={0x6, 0xa, 0x8}]}, @NL80211_ATTR_HANDLE_DFS={0x4}]}, 0x64}, 0x1, 0x0, 0x0, 0x10}, 0x4000000) ioctl$VIDIOC_SUBSCRIBE_EVENT(r0, 0x4020565a, &(0x7f00000007c0)={0x3, 0x4}) (async) syz_80211_inject_frame(&(0x7f0000000800)=@broadcast, &(0x7f0000000840)=@data_frame={@msdu=@type01={{0x0, 0x2, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1}, {0x9}, @device_b, @random="80222beb066d", @broadcast, {0x3, 0x9}}, @a_msdu=[{@device_a, @device_b, 0x14, "7f3702f28c848c0f5d5a2464e81ac44a42a1e892"}]}, 0x3c) ioctl$XFS_IOC_FSGROWFSRT(r6, 0x40105870, &(0x7f00000008c0)={0x3, 0x9}) write(r6, &(0x7f0000000900)="b98f23847c661c6e97e3c802b8b9bca4ad3bc0e761ca4b07d2c951ce662e49c485d7fa4de1ddabadb910e8c5e59f5b19a333c284880d5b6c1b9ead1fbf1a683c3f232859c873d5571b9c3c00dec8326bbc6f849d923923b528a76a0d3dc6b96e4a4c75f316dbc3e0eaff0093a5838b2ea35484d12901e0b4bd32bca981725e718d0b7342e2c13340b171943ed5e0311adaa0386ae8a98032780cb71b219224d34d11f121ca3484acdefc6a0e36b803f91c1b7c36026040ae716816325744da6968d42a0f642f2ff479ca836e6ac8f3f403", 0xd1) (async) syz_80211_inject_frame(&(0x7f0000000a00), &(0x7f0000000a40)=@data_frame={@a_msdu=@type00={{0x0, 0x2, 0x4, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1}, {0x5f8d}, @broadcast, @broadcast, @initial, {0x4, 0x6}, "", @void, @value=@ver_80211n={0x0, 0xb7a, 0x3, 0x1, 0x0, 0x2, 0x0, 0x0, 0x1}}, @random="3768139dc8005734316f03404e13d43d6c675b209541f6c59d16be3cbf65c6886d22cdccdf52ace275445704e9aed157903fc3c4ffed411d9b2467a2343f5847c8882ea7995b303d7c039febffcc377654f4e1780abe6fda551711df916816346ad6a2016dc1cd73c0a16a904b99969b653f87cba3c84b342ea4614bfa74d00f377e037781841d7351848bf914097e5a2184ffb9235fed06c77ffd77d65db2e38b6acf8d279453dabc9c9580027158d510fea5899e2bbf41fdb103d7bd0b538d4cd17fdd64ccf9bb0ee10f0ad545efe4ce8177c9123268155371cb64ccaaee98d183e6bcb5b92398b0f850e2da1d68fca5df87d46d5a1242d250cea4aa1a17dbfa8e550f1565278b8acd49bf46386871773a5aa0215510b48f55d3eb5a125d17df54fa33428b78140293d502a7ae92adecf23d30a4fea5c492e780a54e7d3b32e9763f65bd76bffbadbea8e40850aef02a908ae6615600dd793cea01b64ad4093fa5c348a75482f5b25064f3bc3d15d044529b88a1c8da71a78226f29ea706b139125f46e50c048b5856fd29bfcfcbebac737fe23fb3f0dae3d5221e3238bfa6028c923d7fddce37523d7314529a3e9de38cfd7410b3c2f72e416ebf81e2251508cda727fbfd9d4d4d70f4e698f04b05fee11054be96e6d35c474bf7b3567767f0859d995c3706b526459396985056cd943c921d75b9b23fb32c2e52421bcbd965bc12de1847c47a16fc6032d3da0f91a67efdc0d709592b25ea10193264720b29665c3b76decf86a862c635dcf5b8146a6bdc11953fa507114127cebd6e395327f2a2e2c2c4a40a8cca0c62622c06af0b1377cc02b03e43d67ce10038fa90e6583d2e53e7b8"}, 0x282) (async) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r6, 0x89f2, &(0x7f0000000dc0)={'ip6_vti0\x00', &(0x7f0000000d40)={'syztnl1\x00', 0x0, 0x2f, 0x8, 0x8, 0x2, 0x28, @private2, @remote, 0x10, 0x7800, 0xffffffff, 0x200}}) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000000e80)={&(0x7f0000000d00)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000e40)={&(0x7f0000000e00)={0x38, r5, 0x200, 0x70bd28, 0x25dfdbfb, {}, [@FOU_ATTR_IFINDEX={0x8, 0xb, r7}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e21}, @FOU_ATTR_PEER_V6={0x14, 0x9, @mcast1}]}, 0x38}, 0x1, 0x0, 0x0, 0x20010090}, 0x48844) (async) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000ec0)={'wlan1\x00'}) sendmsg$IPSET_CMD_HEADER(r6, &(0x7f0000001000)={&(0x7f0000000f00)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000f40)={0x44, 0xc, 0x6, 0x5, 0x0, 0x0, {0x1, 0x0, 0x6}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x44}, 0x1, 0x0, 0x0, 0x4}, 0x9094) ioctl$SIOCPNGETOBJECT(r6, 0x89e0, &(0x7f0000001040)=0x8000) (async) r8 = socket$alg(0x26, 0x5, 0x0) listen(r8, 0x8) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000001080), r1) (async) ioctl$BTRFS_IOC_SNAP_CREATE_V2(0xffffffffffffffff, 0x50009417, &(0x7f00000015c0)={{}, 0x0, 0x0, @inherit={0x58, &(0x7f0000001140)={0x1, 0x2, 0x6, 0x2, {0x20, 0x0, 0x9, 0x2, 0x1}, [0x9, 0x71]}}, @devid}) 11m6.04966433s ago: executing program 7 (id=3877): mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000940)=ANY=[@ANYBLOB="5c0000000206010400000000000000000700000014000780080011400000000005001500810000000500010006000000050005000200000005000400030000000900020073797a30000000000d000300686173683a6e6574"], 0x5c}}, 0x20004000) chroot(&(0x7f0000000100)='./file0\x00') mount$bind(&(0x7f00000000c0)='.\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x21d000, 0x0) mount$bind(&(0x7f0000000280)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) pivot_root(&(0x7f0000000000)='./file0/../file0/../file0\x00', &(0x7f0000000140)='./file0/../file0/../file0\x00') 11m5.970233168s ago: executing program 7 (id=3878): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x26, [0x9, 0x0, 0x5, 0x6, 0x8, 0x155f, 0x10000006, 0x2, 0x25cd, 0x1, 0xb4, 0xd, 0xa2b9, 0x6, 0x8, 0xe4, 0x6, 0xfc000004, 0x402, 0xbbf, 0x4a732f64, 0x1, 0x1c0, 0xd, 0x0, 0x2a3, 0x4, 0x1, 0x2, 0xc3, 0x7, 0x81, 0x8a, 0x79, 0x2, 0x10000, 0x0, 0x91, 0x4, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x0, 0xf9a2, 0x80000001, 0xff, 0x2, 0x2, 0x2, 0x2, 0x7, 0x1, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x9, 0x4], [0x9, 0x40, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x20000073, 0x8e, 0xd50, 0x7, 0x5, 0x4, 0x809, 0x4, 0xa7, 0x1000, 0x0, 0x200b398, 0x400080, 0x1, 0x4, 0x1c, 0x7, 0x1, 0x2, 0x3, 0x8, 0xffffff7f, 0x400, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x80004, 0x46, 0xf1, 0x4, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x1, 0x1cb, 0x9, 0x80000004, 0x6, 0x43b, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x20000002, 0xffffeffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x8, 0x404, 0x6, 0xffff0000, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0x10, 0x5, 0x9, 0x7, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x9, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0xd, 0x7, 0x10010, 0x102, 0xdd81, 0x2, 0x7f, 0x9d27, 0x10000, 0x1, 0x100, 0x2, 0x6, 0x7ffd, 0x5, 0x7, 0xd500, 0x8, 0x77, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0x1], [0xa772, 0x6, 0xffffffff, 0x1afa, 0xbf8, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0x9, 0x1005, 0x1, 0x7, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x3, 0xfffffff7, 0x8, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x0, 0x100, 0xf, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x71c, 0x6, 0xf, 0xe, 0x1, 0x26e, 0x6, 0xc, 0x4, 0xfffffff9, 0x9, 0x5d9, 0x463f, 0x4, 0xb0, 0x6, 0x6, 0x14000, 0x1, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNGETFEATURES(r3, 0x800454cf, &(0x7f00000000c0)) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x6, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0x7, 0x4, 0x5, 0x4, 0x8], 0x25000, 0x304}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[], 0x7c}}, 0x0) sendmsg$netlink(0xffffffffffffffff, &(0x7f00000044c0)={0x0, 0x0, &(0x7f0000003f00)=[{&(0x7f0000000300)={0x60, 0x15, 0x4, 0x70bd28, 0x25dfdbfc, "", [@generic="5c81f5cb12e5f63ea2749715cbf9e3a287fecaa43c57bcd931507beda6b1280b4a628f1096afd9aa29d40ee7a00f17b924d1cdfacf92fe24bdcca215023e2249bf632248", @generic="351dbab429f1d8110e"]}, 0x60}], 0x1, 0x0, 0x0, 0x20008801}, 0x40850) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x224000, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) r5 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r6 = dup(r5) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r5, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) 11m4.565657947s ago: executing program 7 (id=3883): syz_usb_connect(0x0, 0x24, &(0x7f00000001c0)=ANY=[@ANYBLOB="120100002eab5a40401c3405cc6d010203010902120001000000000904"], 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='my_sys\x00', 0x2, 0x0) r1 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r1, &(0x7f0000000340)=@nameseq={0x1e, 0x1, 0x3, {0x43}}, 0x10) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000100)={0x43, 0x0, 0x3, 0x3}, 0x10) sendmsg$tipc(r1, &(0x7f0000000280)={&(0x7f00000002c0)=@nameseq={0x1e, 0x1, 0x0, {0x41, 0x2, 0x1}}, 0x10, 0x0}, 0x44010) socket(0x80000000000000a, 0x2, 0x0) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r2, 0x3ba0, &(0x7f0000000540)={0x48, 0x2, r3, 0x0, 0x0, 0x0, 0x0}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) close_range(r0, r1, 0x0) r5 = openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1/functions\x00', 0x8000, 0x1c1) mkdirat(r5, &(0x7f0000000240)='./config\x00', 0x1ff) ioctl$IOMMU_HWPT_ALLOC$TEST(r2, 0x3b89, &(0x7f0000000200)={0x28, 0x3, r4, r3, 0x0, 0x0, 0xdead, 0x4, &(0x7f0000000240)}) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) setreuid(0xffffffffffffffff, 0xee01) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r7, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) bind$inet6(r7, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @empty, 0xffffffff}, 0x1c) setsockopt$sock_int(r6, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) bind$inet6(r6, &(0x7f0000000300)={0xa, 0x4e27, 0x93, @empty, 0xfffffffb}, 0x1c) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000380)={'erspan0\x00', 0x0}) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r9, 0xae60) r10 = ioctl$KVM_CREATE_VCPU(r9, 0xae41, 0x0) ioctl$KVM_SET_REGS(r10, 0x4090ae82, &(0x7f0000000440)={[0x3ff, 0x2, 0x9, 0x8000000000000001, 0x59f24867, 0x0, 0x7f, 0x80000002, 0x9, 0xfffffffffffffffe, 0x6, 0x2, 0x6, 0x4, 0x8, 0x1], 0x54000, 0x340204}) ioctl$KVM_SET_VCPU_EVENTS(r10, 0x4400ae8f, &(0x7f0000000140)=@x86={0x3, 0xc, 0xc5, 0x0, 0x6, 0x9, 0x4, 0x6, 0x1, 0xf8, 0x0, 0x1, 0x0, 0x3, 0x439, 0x6, 0x9, 0x4, 0x8, '\x00', 0x4, 0x4}) 11m4.082792986s ago: executing program 37 (id=3883): syz_usb_connect(0x0, 0x24, &(0x7f00000001c0)=ANY=[@ANYBLOB="120100002eab5a40401c3405cc6d010203010902120001000000000904"], 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='my_sys\x00', 0x2, 0x0) r1 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r1, &(0x7f0000000340)=@nameseq={0x1e, 0x1, 0x3, {0x43}}, 0x10) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000100)={0x43, 0x0, 0x3, 0x3}, 0x10) sendmsg$tipc(r1, &(0x7f0000000280)={&(0x7f00000002c0)=@nameseq={0x1e, 0x1, 0x0, {0x41, 0x2, 0x1}}, 0x10, 0x0}, 0x44010) socket(0x80000000000000a, 0x2, 0x0) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r2, 0x3ba0, &(0x7f0000000540)={0x48, 0x2, r3, 0x0, 0x0, 0x0, 0x0}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) close_range(r0, r1, 0x0) r5 = openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1/functions\x00', 0x8000, 0x1c1) mkdirat(r5, &(0x7f0000000240)='./config\x00', 0x1ff) ioctl$IOMMU_HWPT_ALLOC$TEST(r2, 0x3b89, &(0x7f0000000200)={0x28, 0x3, r4, r3, 0x0, 0x0, 0xdead, 0x4, &(0x7f0000000240)}) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) setreuid(0xffffffffffffffff, 0xee01) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r7, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) bind$inet6(r7, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @empty, 0xffffffff}, 0x1c) setsockopt$sock_int(r6, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) bind$inet6(r6, &(0x7f0000000300)={0xa, 0x4e27, 0x93, @empty, 0xfffffffb}, 0x1c) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000380)={'erspan0\x00', 0x0}) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r9, 0xae60) r10 = ioctl$KVM_CREATE_VCPU(r9, 0xae41, 0x0) ioctl$KVM_SET_REGS(r10, 0x4090ae82, &(0x7f0000000440)={[0x3ff, 0x2, 0x9, 0x8000000000000001, 0x59f24867, 0x0, 0x7f, 0x80000002, 0x9, 0xfffffffffffffffe, 0x6, 0x2, 0x6, 0x4, 0x8, 0x1], 0x54000, 0x340204}) ioctl$KVM_SET_VCPU_EVENTS(r10, 0x4400ae8f, &(0x7f0000000140)=@x86={0x3, 0xc, 0xc5, 0x0, 0x6, 0x9, 0x4, 0x6, 0x1, 0xf8, 0x0, 0x1, 0x0, 0x3, 0x439, 0x6, 0x9, 0x4, 0x8, '\x00', 0x4, 0x4}) 2m28.881100301s ago: executing program 5 (id=5637): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) ioctl$KVM_SET_NESTED_STATE(0xffffffffffffffff, 0x4080aebf, &(0x7f00000002c0)=@svm={0x0, 0x1, 0x1080, {0xffff1000}, {"07131a42ac26094e83ea746ed9ee86e3b37f62d3e8933921bd1643538a10f67c683852f7ecf23daf42b8654bcc0265c79cb495d67c85f4d38024b39ed65d8373d743598605f0ba1c94c3bb65784b50b4a1c5645255fb00a132adf4593b5fe7e0c3daf7c573534ce1c1769f42f8ffe3caca563746c2260117c0d2d3a88c69069bde37a4478382a3f5489b80ac0c8a9ea18bd8b1c3bac3aaaf0711457472d75918957c0e6c52d9d971475fc98e342af312963fcd6d14e49eeed39e77a5b32a32b445599811c1a72b8149084c92810a62a0bbe4d21cee3d90587cef9f54c807daca93068a4cf40ff29cd5438aee36cb930297d07eec4ccedec32820d8b3a6094a480c105795d6f4499bae8851b876094af6110cb9a29661f507163007fb17f8b6ffd5b23f478c0925ea718ac5ac95c3a0c4a12617ccd46da48a9ac79dbdb359c6b055e19ffefac06f4f6cb15897c8007079d9e17f0904af844cd7c8a780838f7dc667516a6f73c39d5f3d5238b4463b7eeb87cf2aa9d3a9bdd35d4c03d8cf4e162bc0c46c550fe955698e12b8f047876361d705278cb901458d58dceee96b3505055d969987a959a138b9a8d5cd9059ced72b39db86721ec58ca1f6fd6770f60d0fc19a33bb9c4610f270d926e067364cc86fe3045edad5372f44f6c1e0b7085a6478d6aff0493c7fabbe622fba175a03cbc2e4f66de44efd0093e38d2c19163d5e5defab1ca5d83c5d615721c80321dc706d58dea71423f94023ec708e45c4cf2e41eca6cc57de99a5f5518715480c1e4ec59d31deefed5f526ebe553bba2f4063b066aeebfd50689779cda61e7b4e03d3557c4ea0c8a0b24ef82a49cb23e67b788cf3232b300efd08364b36816f0a733045ca245303ade55a7580a6c3c43db7e623d9c6179b1158ff8cc297d0da3416b3df569ae8db03bdd68d41b08f4dcafa3aa5318b2c7d741dda5013416734bceaa6cac2e9ef82a9fbd3e6ad01112d783992b122fe4ed9be0087034038f56653c0d866f9e0f5e19d5ed0c44381b34a6ed12b00132a87e17dcb80cbc5a2cd6a55a9e63c299a69b3f3ec86bd03d7a19271739948d0504947bebf455f5d72c2570d29d49d2b5dc00044c610fcd8fcd5f235d521ca0669a04f40a54248707ff298a7658b131309950ae836169495a54f1c22d7b15550ea26eee2893596f8ad8b064e32d8332e53fbbadc1391b852804c27c59610e4ac112595113c61d74ae2bfd46ddc8c844596b98d251514383d474e7a250949e38511b15c289856e43a2d3b866501580d3ba69b84409cf2c6297f4a29a1e56b957f5495a94b532988e5d97890be44d31b243a8fdb01c0f5a2f894c5f6b18351f835325db3200838261e61484cab63c061dcccd2f896925dd3061807447c7e819dd34ff0df3706ece37c33c93aadd0a83127a0e489270a235cb9ae0d036f5b077cd6b143c3542ca52f92d167fa61489ed32357c2670c4a603b5cc4e2b8641dea6ed0e7f906113636e922b9640b3ffe4405cf654476876fea38095036faf30bdd61c30352d28993f478c44fbda920ee9a954cbdcf74ece21c182325c7a244ac8fc7df4bf9d3f63974e8d91a836e03360468c25426488e51604d47d92784a49c1d782b12ee9826ca0b65c0528f5b9874cfe61463019ebc7b06153a75e86bc7c8b2bfbc27a3ebedd715c06d48fb982d743ae8e3201c365c994c54d1b1fc5f0b36d0c73f506b9ed909f641d97a04cf69e2c91c1d89350a987b7db9cce125860392879a28f367e350961f206ad6f33c5a305ed737bc2af49d0d942e940c819435e875dabc531d58a6015a379e21e3c9ed1626ca65c534edbe28125230a4ffdf34f3fac1d172308168944da174522a36783d83e44ec6c89765e2fa796bd504d2dc6afe58305746c141083bafdad7bb8ca4d94807fc2cb746be0f50f85065e22e1dba366be695058d3431417a8be67cd4cb1849bb24a04c3d9a07364de5af0cb94425010ad163a466eed19ad0cd3971cfe92fb03082c01cd6ce3d5fa00b0f6eb23249ca1fd13a51e328f111ffc2c67c369da0fce113b7e17ffe7f8f6740ba70c12f3d58e7f909b52e72bd71963690866a3b97bb165ef9dd91b3ed42338827f42ad8b2c54e2ecfe55ea3ef60b7e707688a875c9fc240c378a880435d49a0b4009421c6c5dd2bcd657547c7957a070c9d3fd809049a154c2f1e189ca353cc6317954d3f0f5bfcc27855f5f74f30b378f0aa43f555d78da46ac614c56753b97b96a7b5f9da56333fa6009e51c577ad3410b1a3859b25f814e06dcc6564f45ee8db2be7ab561eb93ff00c73633fe3cab7604377bc8d5ac2a9fd11d8956d9e3e6d9ee1f1b6861aa21ea65d74d0f0580649ba4cb8882ad06f16d92cd6d809a421033365dac7907334d592a56ac3b524f0c8b98fa0ccdf16dda0af3ec5450a34248a68c0e22d67dc2c0c8bd8b973686982c42874f833a61b3c20524480d20bb86f5e142a065810e6284c91045cbe53028518828d9ea899dab12f6ea2d9a9049a2dcf7230533a1b5ceae3ae65809603ca929b4d2e085caea9fd4803c20f931b672b036ba876a9d144ea80ea08280fdd7ccdd0338178165c2de432cd11d073b11b12d9fef43cca8f7dcaf588bb5c34e6d12aadb8f1d713d112125e33440e327f59842fc8459a19605879156d876e279d031641b2c9420d75bce4ee2caf3585b56f88c9979537717d5fccf22b65a52536e1f169a4171e759ad5e16bb50c406e4a5b2d0a1b97b6b6e15b27b6d71b341187e47bdc90d83f22cf8c9feb1b51b5bbbc068ad2f6d649d637c6ace22ee36f07bf951aa15e33d92be88c7c784a25dfefc04d188f7e6c99f93e787fe08640161aa3d9f2e12efe59b78992a745226041bc5e5e11f4cab5d769c76a1403139694eaa9c761aa0510d0501b2e13cb62ade410fd4485025d7c6c6143a8b2b3767680812952f7b16da74031bf2f3dc8119ef66a4266a4c1fa0c343d648afcca907000312b98237a648650dc8dcf40439e08ffba7e86862a41dab79cf1fddf78d47a0ba4ac8666216ea04f9eb375a5a8348623127a69672dd6ff095268727e5d4322a684b669e87874db8a8c490b0337b83f2b0d79f05d88115910f9ccce15876b535d06e6f8903dbcbf1d52dcd96f0723a4809906e5cd57077784954189cc90f88fb4f49f87beea166e92d630fa6fa9f40679dda6fd03b98250e960468aaa23d6bef6cf47c796d3db36f5c4caad8e590c5c1920bec4dd264708c6ea2abd683aea8d24f7e04e27cb846a81b67fa40bc341d8db9e1fce52c96be73d382d483a9fa31c204c798008ad7655af127d80c804f8f7498c3999b10cdc74ff5118e87bcfcc6d5c496dc87e274f99b4ce1815ba6b6c6a1a05cc586796abb7c16c3878b3eea81e9e02841022d3584a366645ef45e33be40d270bd88ad2c9e54921e29ef68fb15d95018f473a9aaf4e15657f4da44c6e1495589fc843e76db1a6190914018bf3157411dea39d1679e96de20bdf2c48cb7a86dd5f6a27588356d87dab55efdd8e92cb1e9c1c2780204a84fa512577f93f2d146a64275055804de01036fdec9a0f9a2cb0be9767a7d0a0c5833627f5602f172d412b75d2b26a92edd61ff1646674416ea0043aa06dfe862b9577caa9848ba048e0fd6a211ea2cd40b97c2c863aa7b1e09b343a6fb0fd441325c5aac184c4820be199920f861a0f4eed8afc604f450e11ec652b7bdf0a352b89e3c02d9e2f0d29bba87fbd48dc26027b392c19cd020054c3cd2d026da67b08dc9a4c43159c8d2e9c470a137f50c4ac7a0ef8a2bc59bb653779028af7790a1709502066072ea7c8d867330935a6e48c79ef7c1735bc6e45c0f0c343a76ebe8d33e949579f93f2cff39865cedff031855fdfeb5700c2d71e3264c68c96f9d3f58cf250fe2463b2a44587034afe7f299ced6cd082ba1be5b1cad44da0c4310ad9291c3934a5da3ba7a5a01c1f7801e19991524bae61b48d1d1339bbb38e7188e4c9b08ff9870af5da7486d291a8e4821b6c1e435aa2134094e767bb55378c34a471b4ecd57a40208e869937f3f101e6a459b06fce9743bb5253a93066eabd10d4189b18556dab5e2ecfb04251c2e8d01f56474cfa182b53040a0ad04a41b25edd821f44f05ba6dd9f74921ff66d55e3b43524d5ebe732bddaa81c4fb889d500d729fad6fd9ab3a2479ed12b0e666c795b30f2ccef32758af135a0e55a58ce5bb2a48fa9e7839fd77311195859ee5e2f2ac6ac9c38ffbe31f55403bb3927292797cb4e24ce93e5d0fe290bee99567b43f4d82ae8dfb081f9b3348dc29ef94d958f1b3a101cf0ceb13d519317350d76d724e33d1dc427bb4f4c85483e3299616fc3a5717e937adc3a6a7d7e601436e54a058f1f9f6c881ad5137690ae52b2f3697c6d91953d99cf27aaf90eb811d5856c45da6ea086e5146cd14d1d00dfc492c66ada81a6d0fdaf70fc7dc87be2d17caae7f30aff7ecaae19ff330a51af504913669620f0d086b8743402742beeec0ef3175aaea67e970c8678d3ae01d0f4b2690979dfe55ab06a3d9f733b2bd6d29923ee61265b2542a9c58eadca4d0a199b98023ff0206a1f409f469ab45e2e377ed1d6ebd1a977e983f39a413e1cc6ff69660cc513efb2d58deccd3c5e163a89ecd5a1a5c4f1e1274f4a07782c95e61360934d45f890f00d5849d11a6896f745ddda0f7e985246d95f13712e14d6bea3cc030b0d2c94bd581a8b42e5eb171d22cae7cea290c97f5651fa6dce430bf60d0adbd6f8df1ec4d03abf1b9b7adaacd2dc8f56e83d1450597f80f27e46af7c42e05e966114a3466120bb1171693d79e1a52c58bc252f07848bcc8435397b0a535961749883038789bf898e85059bfa94d2647f84da7a92e3c64d5c9bbdc9637b21b365cb468421bfb89b0c120ba2f2d1da57c3b9e8ad7d9e6bbc9048a3a11694e36d3c8a7a7cc8d1a0d7953fef1c0ff2e9bbee498beb38967345a9506aff9fe1955c53f630c1041dc722682d60358a1be31d9c319bffd7e4926795ea8c17a0108ac3ff9c7cc18c95ca97e8d9a33bfc528cbbc33f11e8c36698497f7200c3efc6a0907f9e287fd5e5b0d3258a876dc41dd3f7cab7a965947b890fe046a0243e474962b31cc75f5c64264f2478bcdd617251ffb300e1bfce45caedf3a85d18d4f9686bab91f959051e0abdd185967bbcf3190441d37fd8cb01b06d415ab09bd6da5068d1c93bb9aae3bef54903954db2ef9d5ef19337f08ba25ed2ff1f34584eedfd4ed1111a1714620a71476b53cf9fe8e8668ed46ccd69352c8ae82a12ea6685974532445fb9ab2d0e673a59c38672933ecb614689f84677eb9f0b9f919f6c580550510e3a5b72f10ba7471d7c59ecaed4adb6029dae5911a340f6162e30293c84ec967c17f6af412131dad01662e93a33782525f8a203355a5944b326ad5497eb8ffab45f7c070405dfe433d02ffa6e97767b5048a06959d94b1464a74d6d2e83e0bcdda75b3a2168574c3f5cdbae2b1ceb07770da886abae2ec7510ea3f0c1059e44ac91d1cd268f9b085b3f555eb2d477ea43e33f3364327bebe55b541f88f725126e683c30e68df2522d72cdbea1c21e0b6292bb0ffbde2bc48d0e8c5bbdcb7356d0b1fcc1c6617a6e7af9e02b2a7d54370f266b7093e2fdf08d1ad0117f477ec8a278b22e8af13efb51688bcc0cb1f0025874673d36f9939d74d4ced9cbf4b263e54a118206007925113b8c333ebd85d42c89cd3e383f684205e7dfd40d613a78fc86be6e12acb05201b92101049447a57f2a"}}) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x74, 0x0, 0x0) ioctl$KVM_GET_CPUID2(r2, 0xc008ae91, &(0x7f0000000280)) 2m28.63715968s ago: executing program 5 (id=5638): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f00000000c0)={'batadv0\x00', 0x0}) r2 = syz_genetlink_get_family_id$batadv(&(0x7f00000004c0), r0) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="05a300000000000000000d00000008000300", @ANYRES32=r1], 0x1c}}, 0x2000044) r3 = socket$inet6(0xa, 0x3, 0x88) r4 = socket(0x40000000015, 0x5, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) bind$inet(r4, &(0x7f00008a5ff0)={0x2, 0x0, @loopback}, 0x10) recvmmsg(r4, &(0x7f0000001380)=[{{0x0, 0x0, 0x0}, 0x4}], 0x1, 0x60010000, 0x0) sendto$inet(r4, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2, 0x0, @loopback}, 0x10) setsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000000980)={{{@in6=@mcast2, @in=@initdev={0xac, 0x1e, 0x3, 0x0}, 0x4e1f, 0x0, 0x0, 0x3, 0x2, 0x0, 0x0, 0x29}, {0xec, 0xfffffffffffffffd, 0xe9d6, 0x6811221d, 0x8, 0x39, 0x200000003, 0x9}, {0x7, 0xfffffffffffffffd, 0x4, 0xffffffffffffbffe}, 0x401, 0x0, 0x1, 0x0, 0x6}, {{@in6=@mcast1, 0x4d2, 0x6c}, 0xa, @in=@loopback, 0x3502, 0x0, 0x0, 0x0, 0x9, 0x1}}, 0xe8) 2m28.377259415s ago: executing program 5 (id=5639): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000700)=ANY=[@ANYBLOB="12010000000000408c0d220000000000000109022400010000000009040000010300000009210000000122050009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$sock_int(r2, 0x1, 0x28, &(0x7f0000000040)=0xfffffffc, 0x4) sendmsg$NL80211_CMD_GET_SCAN(r1, &(0x7f0000000f00)={0x0, 0x0, &(0x7f0000000ec0)={&(0x7f0000000380)={0x1c, 0x0, 0xf21, 0x0, 0x25dfdbfe, {{}, {@val={0x8}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x48010}, 0x200000000000000) syz_usb_control_io(r0, &(0x7f0000000740)={0x2c, &(0x7f0000000980)=ANY=[@ANYBLOB="00000001000000090090"], 0x0, 0x0, 0x0, 0x0}, 0x0) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000), 0x8001, 0x0) accept4$unix(r3, &(0x7f0000000080), &(0x7f0000000100)=0x6e, 0x9ae518cf40aa44d4) 2m26.637615526s ago: executing program 5 (id=5642): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x51) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='tracefs\x00', 0x0, 0x0) mount$bpf(0x0, &(0x7f0000000040)='./file0\x00', 0x0, 0x1e6062, &(0x7f0000000000)={[{@gid}]}) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$binfmt_misc(r0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) chroot(&(0x7f0000000100)='./file0\x00') mount$bind(&(0x7f00000000c0)='.\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x21d000, 0x0) pivot_root(&(0x7f0000000000)='./file0/../file0/../file0\x00', &(0x7f0000000140)='./file0/../file0/../file0\x00') 2m26.389607643s ago: executing program 5 (id=5644): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) syz_open_dev$vim2m(&(0x7f0000000080), 0x4, 0x2) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f00000000e0)='./sec/tomoyo/profile\x00', 0x1, 0x0) write(r2, 0x0, 0x0) fspick(r2, &(0x7f0000000040)='./file0\x00', 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_X86_SET_MCE(r5, 0x4040ae9e, &(0x7f0000000100)={0x0, 0x30000, 0x7, 0xa, 0x3}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r6 = open_tree(0xffffffffffffff9c, &(0x7f0000000100)='\x00', 0x89901) fchdir(r6) mount(0x0, &(0x7f0000000100)='.\x00', &(0x7f0000002280)='nfsd\x00', 0x0, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000200)={0x3, &(0x7f0000000100)=[{0x4, 0xff, 0x2}, {0x8, 0x9, 0x5, 0x8001}, {0x1, 0x7, 0xba, 0x5}]}) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_DEBUG_SET(r8, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000001500)={&(0x7f0000000000)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16, @ANYBLOB="0100000000000000000008000000180001801400020073797a5f74756e000000000000000000180002800800020011"], 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x8041) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text32={0x20, &(0x7f0000000180)="66b80e010f00d0b0060f21a20f01c40f009b2700000066b80c008ee00f3235008000000f30b80e0000000f23d80f21f835800000a00f23f8c9b9490300000f60b932c00a00b9730200000f32328fe858b660002fb90d090000b800680000ba000000000f30", 0x65}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) 2m24.064583676s ago: executing program 5 (id=5648): socket$inet6_sctp(0xa, 0x1, 0x84) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000200)={0x3, &(0x7f0000000100)=[{0x4, 0xff, 0x2}, {0x8, 0x9, 0x5, 0x8001}, {0x1, 0x7, 0xba, 0x5}]}) sendmsg$ETHTOOL_MSG_DEBUG_SET(0xffffffffffffffff, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000001500)={&(0x7f0000000000)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16, @ANYBLOB="0100000000000000000008000000180001801400020073797a5f74756e000000000000000000180002800800020011"], 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x408c0c0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text32={0x20, &(0x7f0000000180)="66b80e010f00d0b0060f21a20f01c40f009b2700000066b80c008ee00f3235008000000f30b80e0000000f23d80f21f835800000a00f23f8c9b9490300000f60b932c00a00b9730200000f32328fe858b660002fb90d090000b800680000ba000000000f30", 0x65}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x40000) socket$packet(0x11, 0x2, 0x300) 2m23.733066226s ago: executing program 38 (id=5648): socket$inet6_sctp(0xa, 0x1, 0x84) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000200)={0x3, &(0x7f0000000100)=[{0x4, 0xff, 0x2}, {0x8, 0x9, 0x5, 0x8001}, {0x1, 0x7, 0xba, 0x5}]}) sendmsg$ETHTOOL_MSG_DEBUG_SET(0xffffffffffffffff, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000001500)={&(0x7f0000000000)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16, @ANYBLOB="0100000000000000000008000000180001801400020073797a5f74756e000000000000000000180002800800020011"], 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x408c0c0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text32={0x20, &(0x7f0000000180)="66b80e010f00d0b0060f21a20f01c40f009b2700000066b80c008ee00f3235008000000f30b80e0000000f23d80f21f835800000a00f23f8c9b9490300000f60b932c00a00b9730200000f32328fe858b660002fb90d090000b800680000ba000000000f30", 0x65}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x40000) socket$packet(0x11, 0x2, 0x300) 37.141580862s ago: executing program 3 (id=5970): r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$igmp6(0xa, 0x3, 0x2) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_STATION(r2, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x801281}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x38, 0x0, 0x409, 0x70bd27, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x80000001, 0x80}}}}, [@NL80211_ATTR_STA_LISTEN_INTERVAL={0x6, 0x12, 0x8}, @NL80211_ATTR_REASON_CODE={0x6}, @NL80211_ATTR_LOCAL_MESH_POWER_MODE={0x8, 0xa4, 0x3}]}, 0x38}, 0x1, 0x0, 0x0, 0x24000000}, 0x80) ioctl$ifreq_SIOCGIFINDEX_wireguard(r1, 0x8933, &(0x7f0000000080)={'wg2\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)={0x68, r3, 0x1, 0x0, 0x0, {}, [@WGDEVICE_A_IFINDEX={0x8, 0x1, r4}, @WGDEVICE_A_PEERS={0x4c, 0x8, 0x0, 0x1, [{0x48, 0x0, 0x0, 0x1, [@WGPEER_A_ALLOWEDIPS={0x20, 0x9, 0x0, 0x1, [{0x1c, 0x0, 0x0, 0x1, [@ipv4={{0x6}, {0x8, 0x2, @empty}, {0x5, 0x3, 0xfd}}]}]}, @WGPEER_A_PUBLIC_KEY={0x24, 0x1, @a_g}]}]}]}, 0x68}}, 0x0) sendmsg$inet(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x2, 0x4e20, @multicast1}, 0x10, 0x0, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="170000000000000000000000070000004406fc5cad8c00001c000000000000000000000008000000", @ANYBLOB="ac"], 0x38}, 0x4000004) 36.997699861s ago: executing program 9 (id=5972): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='config\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='config\x00', &(0x7f00000000e0)='configfs\x00', 0x2008000, 0x0) chdir(&(0x7f0000000000)='\x00') r0 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) connect$can_bcm(r0, &(0x7f00000000c0)={0x1d, r1}, 0x10) sendmsg$can_bcm(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="0100000003ece1e40ad8871461ab0800", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRESDEC=r1, @ANYRES64=r1], 0x20000600}, 0x1, 0x0, 0x0, 0x40090}, 0x4c081) r2 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='.\x00', 0x0, 0x0) r3 = openat(r2, &(0x7f0000000180)='usb_gadget/g1\x00', 0x0, 0x0) openat(r3, &(0x7f00000004f3)='functions/uac2.usb0/c_ssize\x00', 0x2, 0x0) 36.973772004s ago: executing program 3 (id=5973): r0 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) r1 = fcntl$dupfd(r0, 0x0, r0) read$FUSE(r1, 0x0, 0x0) write$FUSE_INIT(r1, &(0x7f00000006c0)={0x50, 0x0, 0x0, {0x7, 0x2d, 0x94d, 0x20002080, 0x28, 0xc, 0xa, 0x6e, 0x0, 0x0, 0x20, 0x9}}, 0x50) mmap$IORING_OFF_SQ_RING(0x0, 0x4, 0x2000007, 0x11, 0xffffffffffffffff, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f0000000180)=0x100000001, 0x4) connect$inet6(r2, &(0x7f0000000440)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f0000000540), 0x28) setsockopt$inet6_tcp_TLS_TX(r2, 0x11a, 0x1, &(0x7f00000000c0)=@gcm_128={{0x304}, '\x00\x00\x00\x00{a\x00\a', "0fe57ac3a02500", "5cccf758", "0002000000f3ff00"}, 0x28) setsockopt$inet6_tcp_TLS_TX(r2, 0x11a, 0x1, &(0x7f0000000040)=@ccm_128={{0x303}, "57608966de207697", "a33d9d5bf5560b75476564aa785cb7a4", "2a027380", "34aad48ebbfb870f"}, 0x28) r3 = socket(0x23, 0x2, 0x9) sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={0x0, 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x4000000) r4 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2) r5 = memfd_create(0x0, 0x2) ftruncate(r5, 0xffff) r6 = mq_open(&(0x7f0000000080)='/dev/sg#\x00', 0x80, 0xd3, &(0x7f00000000c0)={0x5, 0x0, 0x6, 0x2}) r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000140)={0x7, &(0x7f0000000100)=[{0x1, 0x0, 0x5, 0x2}, {0x6, 0x9, 0x4, 0x6}, {0x9, 0x8, 0x2, 0x1000}, {0x9, 0x4, 0x0, 0x2}, {0x80, 0x9, 0xc6, 0x13}, {0x0, 0x5, 0x1, 0x8ca}, {0x7, 0x8, 0x0, 0xfffffffb}]}) ioctl$BTRFS_IOC_SNAP_CREATE(r6, 0x50009401, &(0x7f0000000740)={{r7}, "e9518bfd2c54798c53424e38cae6a4e4c07624588652b224b3095f6d7a9f7a4a96243def0cba4cdc88ebe626ac73dfd2e2a8f55e658dbcc52a4ec1d4f78433de6ac6a9d31899cffba21dbd12d0a3b0013883176fe8838625a1a7ba1ca90ad00e8972f3f620fd5f1ab4f453884821ada587db7e0120ec4409a857bd154bdd9810810e481eaf446b1fe19f27f93be9b15eb5d10729cf61e3838b3533d150b73fdf617ba89771cc9d09bcf44b1adecdeb25e51b837aa7b83ad970b618e21046555da412715f3727653612934ef84b8a86836de50be928da687eeb319a756757e1fd53d08bc500f9a373b3ac59c910c633c7e23ab45e896e15ca60ce3b1abd0655fc0bc17ae0f59c2a0c89e0b56c166dabaec44f13444f2e1e81e187c391b69b8acede6e3923f143d78f5f99a12cd47ce9bbf6b5afbadc457f9eaa71cf4e2159f14019fd6a5df9d14d02843527f5d1c87bd61e47e91bdeb6790b9cb86d4943f46dc508acf3516ac8614fef2f4f4578d7e4df5b96313ee539aef06e9e8bf0e43cce22e9108942a802374f7297e882061696f241ada3528883e104be485e19c9d53b5965b6ece04230ac9bc56915f432be855683649ddc43aea6277cb4179853ebf5e73cb55730b9e5f38490d51c1b5e7f932633962f03e463880a78323dfdef932621b1e3dadd5b4667a37304a1348e817ae2ae4be0d6d897c535e138a0bb6bfc3823a8e154f2742c75291317d4e34941f4689489248e397aacaab4ce9644f3f5b27662de0e5e1f34a277ad2d7544826600490507f749682980cbbee04fc82b85adda7a52db27eee9df2e96e7d25a9b10a60d5e1fa735a28ef6742d5a5ce9c7e8336528a94515705742cc4eebf1372fe7d82e3c2c0579a41ced14594f9dc9e4f2227b0398863ef8321636dc54c43863c40eb0cbde6fefcf64c8619d336cdf0639f401b8ea80bbec577e83227c5b2ebd79d673dc7c26d564c8554d428085befe02cd0fc8775bbed9a2c95b1ccf3d5fb901907dc2bab6771dfeef9bdb4deb67f8f69015347cb5de484f8369a99f2b79e6a0f1dbf3b80daa3f3ecaf2d8a6d6f2ebce61dc5d57e252a276a0822a2d537f8956221d3e2b5cfbabaf05e6e02bfae4299f9f997a06e85cb69eb0be3d02c6e1ce7978205c6ec8373988b38ea948a2dc9b6463531990cdf8430c9c347817aa608f5f4d90142fb1659503b340fdd1018f61f00cb1ced9009dd1cd9b8055e3c673577296f7b53bee94438ed82454117da7d3bab5b69c7550f6bd7bac4dadfa7c7246cdad1931b352638478d1c0a8aca2e591540428ae353b68c01d674c96c5283da782101349a2065e7266621b3c8fc59e222b3fde1fcfce909ec518457d91c5fd96e3e228a6fab541f8879338f9a7bf219c87247a8e4cfd5f7a544d6133c3d0f17e8fe9d1c2d8cf3d62295342b208b9f44e22f95691e0994fdaebd98f5bee9a08b07124e441fb332601499d1c3641c5a76a7f3d5fd3965c15e19e3396bcfc475864bdc5d22fa90acdbf3fa828f17a00b574f49a2a04374b237ea02b26924b7c305d1646129efa66a68f09417e6c19d2155cc782f571682226910a2dc757d1b54bd05559a03af36839187e774f4eeb27b96809e9f9d6c3990ec9e6068652c956ff0dd303bbbe94bfb8203d476a2efdc2a8f7f4a8286b0dda414d63a667a77a073ef638616248566bdef7b79194a6f3aff026dae738bd8eb776b5b533b1072dc7f585fb597b0a244973ad8bda71951b5baaefb95fe5c12d38ae730ebe708dbedf22e5aa38ef58fd3bcdc343b6eb949fa3d72b7290a2bb4394bb95e1ad76be0d36766d2495d6d3b7b5fd1830391c10e1ad990a7e80ed5b9cba0cc8caa4b9ec74a17fa8fbfc001a8a0e7a14d03a0fe4a764404ef4d2fa4ee488521c43a951c81cf3e65665cf8ee211e18b62499304cd693d68ffbef2a46a814c091c308b6babbf985c6c7fe5c121ce64cdd597f10df251b6deea70efd3a723501ed7c83db45114cdf632e12a46679efbd3977c75b0cef4a6f16471261d4b8b8d03c5bc72bf81d85d52074484bc571c736f4400a4a339a90a682f02e9303b48f43cab9237e7786d660663bdd29d74ab23fb058ed988c384d59aaf3bb1f6f15a1b06ee59d8876b118da2779dd291991390bc2644cf671c30a47176e9d3e6259466fcea2a8f4db0bcdd4b593b85da44c1a10622f7fcea0584ab59a1ac02b5a6a14853c33175b7aed5de447ceca727e810ddb2945b039e61ab953d07cc758b4c17e989cf61316ed3b498e2cf38c695d31d22ea7c70855b5a811042094fbc616e7b61bc773cd9eff26771eed923a3339f9da74d52ba4dc2ac716703dbaadeb9577de4456c082dad0a3aaa1b9cb0431e7db1f00f5d7ff12e2f52c942eacd0b2e7db3c27a73c3a308fc4b250308aa84c518b2311c0c063adfd854eeba1a8a3af6257943047a72c8fb75eef5dbbe88a32424a3810cbb22e185d3a027cf104db6a9600ebaede10c142b521984e36db2f6708bb1133b4435c406842eba85961fc53d9e7354de20ccac76e1246f9aaad84c1b3d90725db47cbf364060ad032641744269fc3757bb55a90417cd793154fb280cd9ef14f5df9da20ad20a7fcefddcd2685421be51c053cb905d41ce7be83fbcce8988e4adcc854cc50e768bc35560da81d867d9b7cb2ae6446990f77e669e268f19247979edb058e9d0a0017c6c5a11fed059aa6f18f77439364ef00fffd8aaf84365f8f815a71811546e7af9106eab920305030d5306d1b94a233920a8ba5cee405f3e24c307c770713ab324c2fa4eee4664bb4e4c9871e69f71b15a39ff4b5bc48a47189c6b80ba4d2bcddf4bad5c4a4874c258d4f8d7339aa1965ab03a931d485ce1526957bce320f80be85494d042fb18b5d8f8b6f546dfe281c1ca1adc1c5a12e399dfc46fe520ec8c9e9d9409886331cd1df0eb6337a4a66711c1f9dee8ee8cf73de695de6c88ed68286d06f21a67f5f6034fb7250e1c60acf76bcf6d6b7be5dee4958fbae8c001b34465bb26e262ef85cfd85cd2fd82ebc2e5ffda3a1f43796dfbafc814ecc815ea992b6853cc3161783daa636807bfafe47e681381f90fad0c3fcb1b95d5e5cc8bf8dc7563f60f2ceec7594716ebc6ed514931d6037eaf25f0807dd8622b3a5b654270641ccb69a11cb5609cf6bad8e2288d48652eee8ceeb20e08995a1e5706748c0418b9a3d9a8d0b421ca198af4f74769908eccd9fb39841fd8c626068564e38128bc6811d00ad655150c5fb92e45fc1393d959e8f42d35c1de3395ce9bcd9c9b4c041102969d175e0ba7c0e5d315c74b2741b82d2ce53d883fd17137d7cb75775e77a23ff6a979d949fac130850dd0d5db63767dcb7a303b3913beaa3dd6e54217300d0cdfd0c3feb142069c0c309c5d1db1d66373d44d394b9792125d2fefe827741da31b7bd1285158cc2cb942463e9553752dbb465757da4d6e3a113f7de15a3b7cd61acdffcd9397abf217b34873389843ec7ff4d9bb4ca60c246252b0a6aa0c58dbe589ddbbaa641dccbc32dacce096f335f0e31b0966b985c75bd95e95e75964fe48375eca057cd3916d48157464ae10fc08d1a1e65b39db6df96ef157d73b20d0dfff46d726a97f7129be848b3c84aba8700f2f9a5cdd7cd0f3e26abe0de2c79f4db07b815a5019343f4c27d69b9860d58cdeb6b3ca8b610e11a1f512f8848b01a2ee3e128116050bd86e2526b1f295ea9cd8fbe33006dee12890f5256aaca57195805328f12e599d8cbe98af5df44d681ec269a2c32127278899cf3af1263a3a9541f23d25afcf36b9c440b0e1065c0c3013b8b7bd2fc45519226ab344876ddd23b249a60f005c8a9abd36e8b1c8a7f7bbf9b2955d4d7f6cf4caf8ad2f5e7ba6dc04c3b1171fa38e0f2438b081e52b9b5552858c84be50e5e1a6cc0534346225976820c66ccec045763f57c7a9695373ac547729e69b52b85df840f1e9c8a52028f798fa2d7224a25a4ab8222edbb9d0f6cf7fc4b088d5bacd8f00f4ef584f154a8dc49036529755b21b6fb3243cd0548dffbe841bb56f703bb4d82cee543b397e5d92d77de3165606580a85a1c55d873b260e16d8a81d8a70bbef4de31a0366f5722d11f08fbf0c2725a389fec3949a9fca42325b87fdf46a2959e4b46ef6e406352075498406fb3d50e4f67baa54661fd2c9320f97e6a6012f3c9f28834553b6aaec02b27e604a62e9f74617ba05395853ed83b9cdaa9a6180004e19bed486c87ef764d764ea8c9d9127155f06c2ee7b293e0e49a93201beff0c5f249e894716277bd6e550ea0a2728e46159aa621e6beec0fb14da08d284f321b203253f6e41ab220ac1928e696ba66c788a2db4241502b2e5a1399687f40bf0632f86b79f5ad38b2a28cd5491eca75be18ae38d3ff865962a49bc1af22e11b1570c883a198ceccac400ef46dcb950293ddbff50430a1f43ee1059510fc5f7b0e2c0c2953c8782fd34c058194749f4472bd18ec37475240d89ee6d5fb2ee92e3b16bc663e14a1b4c9c8375bc3c4092fff57d144483c2bce9eb01ab92179c3262dd7a07abf6545de54b4814a3be152756ed91bd6ee22bb28d1d08906089da570e62f2bd2c9ab9ab7cdfb2136a3658f92f5e426727f3493121bb85fe8b73256ccb183c9940572f6d6764be18e0ebc6ffb0ee6581abb95acedf3906a9a5042c92dc29e9c68786d0b594cffb7065a38fbbdcd27aaa1dfb67f4417f5840ff833364539bd706d49129d8b4c90444c8a6ab2dbc71485b210df2df600fe979b33637b9ad9016ed0825a8182c03f90a01903286d85bc060fbe76e0315b06052a7a4d5f94212058120793ba31a706035fbac597e1adebe7a938c0c0746aebd9512e7d64ae8368321a40d0139b443dc86c212ce5e4507ed3c1af1e1099f6851f3e6f7f119beee49b84dc3e0559366ce1701996fa6b704a2d88fe61c6274bdf3669f137a047439089423635459c37dacc89d88ae7ee10d258757cc65fcddd866af08d560b2dee3cd394b2d286aa76a3f8cfac8c3096247c39000602af9a076fca4bfe21b029ed872abd5616447d091b867f307ed24d9f3e4ee00dfd9be384e9da50ac6239009f6914f31e57a5f5818e342cd9c145b79b3a199f44fbb68e7fd73374687a5b88ce110d1a237346eb64560d383db5e1c1b063b790b7413681440de02dc85845438db8000ce3c92900dd643eebb134a4272cd40baa5357ced88bbaaf6bcf0b849e149647519ed5f97316e7b1227ff8f322b721a11619c739864fe00f679f02380b552902856a6ddaccea05898d09f481a579aed9afc58e22343a4c01f26c7901f8978c6381516681a9734160dade807c12f46c8cb09998862e2b2ea0c7a8c1a922f4cd38869a1e8b298614d23ec49675fa75bf712bc0de91255a815d2a396fa26e6dd4f6f8654bd0f44e98b9f63d40971f03096e08d0014f164d92218f0ce5ffc86ccb01189b98b569dea6208dc63c053ef4c5db9427b179b1ade176fb6f208e074b54de2f123bd22cca51553220c8655a6f262bb8bfd0613a7bdef06d8b06e3a4604cdc2ffdc29a7380fb043a56c406127b2869efb3630d40f65174271ef779edd49d3144bcf0e30b78cff729c681d74bb29a485820cccc0a71ae82e485fb83cc2425f23360ab59f9b5e080187ac76fcdb75b28b0fc4a9f35d2ef3ff3ca5988b2d5c1b0e1437fbfc94a4dabccc8045aafe47f259c4211dafc854ca28f48432f0f8b3676cd90ad23da5bf38ac1f49ea5f991d89ed7a4baa881bea54331bde"}) fcntl$addseals(r5, 0x409, 0x7) r8 = ioctl$UDMABUF_CREATE(r4, 0x40187542, &(0x7f0000000000)={r5, 0x0, 0x0, 0x1000}) ioctl$VIDIOC_G_DV_TIMINGS(r1, 0xc0845658, &(0x7f0000000340)={0x0, @bt={0x7, 0x1, 0x0, 0x1, 0x7, 0x4, 0x500000, 0x2, 0x10001, 0xffffffff, 0x7437, 0x1, 0xf, 0xff, 0x4, 0x8, {0x9, 0x7}, 0x74, 0x4}}) ioctl$DMA_BUF_IOCTL_SYNC(r8, 0x40086200, 0x0) setsockopt$inet6_group_source_req(r1, 0x29, 0x2e, &(0x7f0000000180)={0xfffffff9, {{0xa, 0x4e21, 0x3, @loopback, 0xd6ab}}, {{0xa, 0x4e20, 0xbd7, @remote, 0x4}}}, 0x108) 36.527823888s ago: executing program 3 (id=5975): sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x953a, &(0x7f0000000100)=[{&(0x7f0000000000)="2c10", 0xffd0}], 0x1, 0x0, 0x0, 0x2c}, 0x44004) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_DELETE(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000040)=ANY=[@ANYBLOB="e40000000201010800000000000000000a000000d00001800c000280050001000000000014000180080001000021000008000200000000002c00018014000300ff01000000000000000000000000000114000400090200000000000000000000000000010c00028005000100000000004700028005000100010000000600040000000000060005"], 0xe4}, 0x1, 0x0, 0x0, 0x404c080}, 0x4008840) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x26, [0x9, 0x0, 0x5, 0x6, 0x8, 0x155f, 0x10000006, 0x2, 0x25cd, 0x1, 0xb4, 0xd, 0xa2b9, 0x6, 0x8, 0xe4, 0x6, 0xfc000004, 0x402, 0xbbf, 0x4a732f64, 0x1, 0x1c0, 0xd, 0x0, 0x2a3, 0x4, 0x1, 0x2, 0xc3, 0x7, 0x81, 0x8a, 0x79, 0x2, 0x10000, 0x0, 0x91, 0x4, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x0, 0xf9a2, 0x80000001, 0xff, 0x2, 0x2, 0x2, 0x2, 0x7, 0x1, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x9, 0x4], [0x9, 0x40, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x20000073, 0x8e, 0xd50, 0x7, 0x5, 0x4, 0x809, 0x4, 0xa7, 0x1000, 0x0, 0x200b398, 0x400080, 0x1, 0x4, 0x1c, 0x7, 0x1, 0x2, 0x3, 0x8, 0xffffff7f, 0x400, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x80004, 0x46, 0xf1, 0x4, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x1, 0x1cb, 0x9, 0x80000004, 0x6, 0x43b, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x20000002, 0xffffeffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x8, 0x404, 0x6, 0xffff0000, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0x10, 0x5, 0x9, 0x7, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x9, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0xd, 0x7, 0x10010, 0x102, 0xdd81, 0x2, 0x7f, 0x9d27, 0x10000, 0x1, 0x100, 0x2, 0x6, 0x7ffd, 0x5, 0x7, 0xd500, 0x8, 0x77, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0x1], [0xa772, 0x6, 0xffffffff, 0x1afa, 0xbf8, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0x9, 0x1005, 0x1, 0x7, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x3, 0xfffffff7, 0x8, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x0, 0x100, 0xf, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x71c, 0x6, 0xf, 0xe, 0x1, 0x26e, 0x6, 0xc, 0x4, 0xfffffff9, 0x9, 0x5d9, 0x463f, 0x4, 0xb0, 0x6, 0x6, 0x14000, 0x1, 0x9]}, 0x45c) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_usb_connect$uac1(0x2, 0x87, &(0x7f0000000440)=ANY=[@ANYBLOB="12010f6a000000106307312040000102030109027500030109a0030904000000010100000a240104000a0002"], &(0x7f0000000a00)={0x0, 0x0, 0x0, 0x0}) syz_usb_connect$uac2(0x6, 0xa5, 0x0, &(0x7f00000007c0)={0xa, &(0x7f0000000300)={0xa, 0x6, 0x250, 0xd, 0x8, 0x7c, 0x8, 0x64}, 0x5, 0x0}) r5 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffb) keyctl$describe(0x1d, r5, &(0x7f0000000300)=""/182, 0xb6) clock_settime(0xfffffffb, &(0x7f0000000140)) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000180)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x6, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0x7, 0x4, 0x5, 0x4, 0x8], 0x25000, 0x304}) sendmsg$netlink(0xffffffffffffffff, &(0x7f00000044c0)={0x0, 0x0, &(0x7f0000003f00)=[{&(0x7f00000003c0)=ANY=[@ANYBLOB="700000001500040028bd7000fcdbdf255c81f5cb12e5f63ea2749715cbf9e3a287fecaa43c57bcd931507beda6b1280b4a628f1096afd9aa29d40ee7a00f17b924d1cdfacf92fe24bdcca215023e2249bf63224853f7c7e7a7191b37efe5772912cdd088f77cfab87c8271733a0000009df401ba3d0f1d9c72eda3b3c7bb3c6a5552d77be4281ae744e564662212cf9a2df21f06f217"], 0x70}], 0x1, 0x0, 0x0, 0x20008801}, 0x40850) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x224000, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) r6 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r7 = dup(r6) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r8, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r6, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r8, 0xae80, 0x0) 33.605798492s ago: executing program 3 (id=5979): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='config\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='config\x00', &(0x7f00000000e0)='configfs\x00', 0x0, 0x0) chdir(&(0x7f00000000c0)='config\x00') r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='.\x00', 0x0, 0x100) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f00000000c0), 0x80040, 0x0) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000040)="ee952104a92837ccefaba2be0cc65c9fe658c79e519d5d0b4eb294556329757c8bf93a6dbb4e30919fa980203ed922c048e6d0bf43b7734330f22a38bf8b174b4ec7585f284173a0e906d20a9db8d5", 0x4f}], 0x1, 0x0, 0x0, 0x2c}, 0x4004845) sendmmsg$inet6(0xffffffffffffffff, &(0x7f00000008c0)=[{{0x0, 0x0, &(0x7f0000000cc0)=[{&(0x7f00000000c0)='O', 0x1}], 0x1}}], 0x1, 0x0) r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) openat$adsp1(0xffffffffffffff9c, 0x0, 0x0, 0x0) ptrace(0x10, r2) ptrace$setregs(0xf, r2, 0x3ffff, &(0x7f0000000180)) ptrace$cont(0x21, r2, 0x80000001, 0x4) r3 = openat(r0, &(0x7f0000000180)='usb_gadget/g1\x00', 0x0, 0x0) r4 = openat(r3, &(0x7f0000000000)='usb_gadget/g1\x00', 0x84482, 0x1cd) write(r4, &(0x7f00000004e2)='2', 0x1) 33.460734652s ago: executing program 3 (id=5981): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) mkdir(&(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000140)='./config/cluster/mycluster\x00', 0x1ff) mkdir(&(0x7f0000000180)='./config/cluster/mycluster/node/mynode\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config\x00', 0x1, 0x1c5) write(r1, &(0x7f0000000200)='127.0.0.1', 0x9) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/cluster/mycluster/node/mynode/ipv4_port\x00', 0x1, 0x0) write(r2, &(0x7f0000000280)='7', 0x1) r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/cluster/mycluster/node/mynode/local\x00', 0x1, 0x0) write(r3, &(0x7f0000000380)='1', 0x1) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = syz_clone(0x10042180, &(0x7f0000000440)="04e244985bcbdfa2e6a12581feb7117aff0ac28260cc7775f523e13239d5989195466be9a3589f73a95ae92f36c81ce41c3ecb6b524d5d1113b4b87eab0cac2fcac39de101b28cedcd20750ec5adef61797d7618671a4c9590974bdf7baf0478fd0955f3215cc76358c72e1a4aa8de79cc8b52bb3a13f351bbf9aca3f0c9c7059c69f47259e7c6de4a309c1eaea7578fa5d4b3b410d9a4b95684ac68813e07e3d79e47b2c8c604cacff0c5b2514466d930e50f68fb3e6031132c339fb05d97f00bd70ea0c0d5ea1d8a5eccb333ae2a0f443267bc78c395416933cc6c80e3da9de5e03cde2c805c73c0c55ff4cae5344f899a2ec1da554c7b71", 0xf9, &(0x7f0000000580), &(0x7f0000000600), &(0x7f0000000700)="d30634a7df9d268b521fb4dd7ac92f39cc243e07c5dd32658539417729166ffc61d2b2d4845282955f2a7c8f0c7cabd343680a41a9ff069ae8943c30787dfd14567ec54b4d44be610a75") ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) r6 = fanotify_init(0x0, 0x0) writev(r6, &(0x7f0000000780)=[{&(0x7f00000005c0)="546317a78c13ac7c", 0x8}], 0x1) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000400)={0x0, 0x1, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r7 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYRESDEC=r5], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) ioctl$KVM_SET_VAPIC_ADDR(r7, 0x4008ae93, &(0x7f0000000040)=0x4) syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) r8 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000540)={'wlan0\x00'}) sendmsg$NL80211_CMD_NEW_KEY(r8, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f00000002c0)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRESDEC=r1, @ANYRES64=r3, @ANYRES64=r4, @ANYBLOB="28005080"], 0x44}}, 0x0) ioctl$KVM_XEN_HVM_CONFIG(0xffffffffffffffff, 0x4038ae7a, &(0x7f0000000080)={0x3, 0xbde, 0x0, &(0x7f0000000180)="a1984ec3aec3fc2e025f90eda6dbc903939aac644fd36f1e65174cae030c42cbacc392851a695f247112e91f059460a2c031929dc0515ac7cd20775ff9da9c2b6cb48968dcd6d8d982c492932c572f084d3af58650d207eec0794b3e47c5678c36b99eed61e1dbac68ce8a79aa21a51202018bdc4a51489844f785887083841d65c129992bbe5a51c71b95a9847d2bdede66c6e3184c386faf938fd6db888e73a5c0dcc69c3de7458e68ed33226a8d1c8e17", 0x0, 0xb2}) mount(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r7, 0x4400ae8f, &(0x7f0000000140)=@x86={0x7, 0xc, 0xc5, 0x0, 0x6, 0x9, 0x4, 0x6, 0x1, 0x40, 0xa8, 0x1, 0x0, 0x3, 0x5, 0x6, 0x9, 0x4, 0x2, '\x00', 0x4, 0x4}) write$cgroup_subtree(r2, &(0x7f0000000300)={[{0x2d, 'devices'}]}, 0x9) ioctl$KVM_RUN(r7, 0xae80, 0x0) 31.932074577s ago: executing program 3 (id=5983): mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x1, @remote, 'ip6gre0\x00'}}, 0x1e) ioctl$PPPOEIOCSFWD(r0, 0x40047452, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f00000000c0)={0x3, 0x1000}, 0x4) r3 = socket$packet(0x11, 0x3, 0x300) (async) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000400)={'erspan0\x00', 0x0}) getpid() (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x181) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x140) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f0000000440), 0x8, &(0x7f0000000080)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './cgroup'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) (async) chdir(&(0x7f00000001c0)='./bus\x00') r5 = creat(&(0x7f0000000240)='./file1\x00', 0x0) fcntl$setstatus(r5, 0x4, 0x6000) (async) io_setup(0x200, &(0x7f0000000140)=0x0) io_submit(r6, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x2, 0x1, 0x0, r5, &(0x7f0000000000), 0x4000}]) (async) setsockopt$packet_int(r3, 0x107, 0xf, &(0x7f0000000080)=0xf3f, 0x4) sendto$packet(r3, &(0x7f00000000c0)="3f031c000302140006001e0089e9aaa911d7c2290f0086dd1327c9167c643c4a1b7880610cc96655b1b141ab059b24d0fbc50df71548a3f6c5609063382a0c1511fdf9435e3ffe46", 0xe90c, 0x0, &(0x7f0000000540)={0xc9, 0x0, r4, 0x1, 0x0, 0x6, @multicast}, 0x14) 31.363469302s ago: executing program 39 (id=5983): mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x1, @remote, 'ip6gre0\x00'}}, 0x1e) ioctl$PPPOEIOCSFWD(r0, 0x40047452, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f00000000c0)={0x3, 0x1000}, 0x4) r3 = socket$packet(0x11, 0x3, 0x300) (async) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000400)={'erspan0\x00', 0x0}) getpid() (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x181) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x140) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f0000000440), 0x8, &(0x7f0000000080)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './cgroup'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) (async) chdir(&(0x7f00000001c0)='./bus\x00') r5 = creat(&(0x7f0000000240)='./file1\x00', 0x0) fcntl$setstatus(r5, 0x4, 0x6000) (async) io_setup(0x200, &(0x7f0000000140)=0x0) io_submit(r6, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x2, 0x1, 0x0, r5, &(0x7f0000000000), 0x4000}]) (async) setsockopt$packet_int(r3, 0x107, 0xf, &(0x7f0000000080)=0xf3f, 0x4) sendto$packet(r3, &(0x7f00000000c0)="3f031c000302140006001e0089e9aaa911d7c2290f0086dd1327c9167c643c4a1b7880610cc96655b1b141ab059b24d0fbc50df71548a3f6c5609063382a0c1511fdf9435e3ffe46", 0xe90c, 0x0, &(0x7f0000000540)={0xc9, 0x0, r4, 0x1, 0x0, 0x6, @multicast}, 0x14) 21.653312764s ago: executing program 0 (id=6015): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_XEN_HVM_CONFIG(r1, 0x4038ae7a, &(0x7f0000000100)={0x2, 0x40000000, 0x0, 0x0}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text64={0x40, &(0x7f0000000300)="b8180000000f01c10f01d9c3", 0xc}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 20.796858194s ago: executing program 8 (id=6017): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x802, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) ioctl$FE_READ_SIGNAL_STRENGTH(r1, 0x80026f47, 0x0) 20.417341954s ago: executing program 8 (id=6018): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) mkdir(&(0x7f0000000100)='mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000300)='mnt\x00', &(0x7f0000000400)='devtmpfs\x00', 0x0, 0x0) r0 = syz_usb_connect(0x2, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ff000040a00e58684000010203010902270001010080320904000003ff00000007058102400000070502024000000705830308"], &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0}) openat(0xffffffffffffff9c, &(0x7f0000000400)='mnt/ttyUSB0\x00', 0x2, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x8, 0x4, 0x8b, 0xfffa}, 0x1d, [0x7ffe, 0xc95a, 0x1, 0x9, 0x80, 0x2, 0x3, 0x7f, 0x6, 0x4d, 0x9, 0x5f, 0x9, 0x5, 0xffff2d37, 0xffffff01, 0x6, 0x3, 0x0, 0x6, 0x4, 0x8, 0x4, 0x3c5b, 0x1, 0x3, 0x9, 0x1, 0x1f461e2c, 0x0, 0xe660, 0x4, 0x7, 0x101, 0x7fff, 0x1, 0x80000000, 0x4, 0x3, 0xe, 0xfffffffb, 0x71, 0xfffffff8, 0x7, 0x0, 0x0, 0x4, 0x80003e, 0x8f, 0xceb8, 0x10000006, 0x0, 0x5, 0x4, 0x8, 0x0, 0x2, 0x0, 0x5, 0x6, 0x8, 0x6, 0x1, 0x40], [0x1, 0xffff, 0x134, 0x7ffe, 0x9, 0xfffffff3, 0x129432e6, 0xcb, 0x6, 0xd, 0x2bf, 0x6c9, 0x9, 0x6, 0x3, 0x0, 0x7, 0x5, 0x0, 0xe, 0x312, 0x74, 0xea4, 0x0, 0x4, 0x4, 0x8000, 0x3, 0x400, 0x5, 0x6, 0x7, 0xff, 0x5, 0x5, 0x5f31, 0x4, 0x0, 0x2, 0x100002, 0xa, 0x4, 0x9, 0x8, 0x800, 0x6, 0x7, 0x8002, 0x1, 0xfe000000, 0xff7f, 0x2, 0x7f, 0x9, 0x2, 0xffffffff, 0x9, 0x1, 0x7, 0x80000003, 0x9, 0x48c93690, 0x42, 0x7], [0x400, 0x4, 0x0, 0x5, 0xfffffffe, 0xfffff76b, 0x8d2, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0x1, 0x4, 0x5, 0x5, 0x0, 0x1ef, 0x5, 0x8, 0x83, 0x80000003, 0x200009, 0x100003e7, 0x9, 0x5, 0x3, 0x2, 0xf38, 0x8, 0x4, 0x6d01, 0x5, 0x38, 0x800003, 0x200, 0x80, 0xf, 0xd, 0x2950bfaf, 0x1000, 0xa2, 0x207, 0x53cf697b, 0x4, 0x6, 0x9, 0x7, 0x2, 0x3, 0x7ff, 0xfffffffc, 0x2, 0x4, 0xffff, 0x0, 0x1a, 0x1c, 0x120000, 0x3, 0x8, 0x8aaed, 0x4, 0x65], [0x9, 0xbb31, 0x3, 0xb, 0x5, 0x938, 0x6, 0x6, 0x0, 0x5, 0x20000ce7, 0x1ff, 0x2, 0xf58, 0x5, 0x3, 0x101, 0x10000, 0x6, 0x7ffe, 0x80000000, 0x200a620, 0x2, 0xc, 0x1, 0x4, 0x14c, 0x60a7, 0xe, 0x6, 0x2, 0x80000000, 0x405, 0x8, 0x5, 0xee1, 0xfffff000, 0xffff, 0x3, 0x7f, 0x104, 0x9606, 0x7, 0x2, 0x4, 0x8006, 0x1, 0x0, 0x4, 0x8, 0x30b1d693, 0xa1f, 0x8, 0x7, 0x1, 0x6c1b, 0x2, 0x4, 0xb0b2748, 0x1, 0x1, 0x200, 0xffbf2441, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) 20.169648715s ago: executing program 0 (id=6019): r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280), 0x68081, 0x0) ioctl$SNAPSHOT_FREE(r0, 0x3305) 19.910318778s ago: executing program 0 (id=6020): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000200)={0x2, 0x4e20, @multicast2}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000000)='scalable', 0x8) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000000040)=0xce, 0x4) connect$inet(r0, &(0x7f00000001c0)={0x2, 0x4e20, @loopback}, 0x10) sendmsg$inet(r0, &(0x7f00000015c0)={0x0, 0x14, &(0x7f0000001600)=[{&(0x7f0000000240)=' ', 0x100120}], 0x1}, 0x0) 19.6175849s ago: executing program 0 (id=6021): mkdir(&(0x7f0000000000)='./my_configfs\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./my_configfs\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000200)='./my_configfs/usb_gadget/g1\x00', 0x1ff) mkdir(&(0x7f0000000300)='./my_configfs/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ff) mkdir(&(0x7f0000000400)='./my_configfs/target/usb_gadget\x00', 0x1ff) mkdir(&(0x7f0000000500)='./my_configfs/target/usb_gadget/naa.1234567890abcdef\x00', 0x1ff) mkdir(&(0x7f0000000700)='./my_configfs/target/core/rd_mcp_0\x00', 0x1ff) mkdir(&(0x7f0000000800)='./my_configfs/target/core/rd_mcp_0/dev0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./my_configfs/target/core/rd_mcp_0/dev0/control\x00', 0x1, 0x0) write(r0, &(0x7f0000000a00)='rd_pages=8', 0xa) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000b00)='./my_configfs/target/core/rd_mcp_0/dev0/enable\x00', 0x1, 0x0) write(r1, &(0x7f0000000c00), 0x0) close(r1) mkdir(&(0x7f0000000d00)='./my_configfs/target/usb_gadget/naa.1234567890abcdef/tpgt_1/lun/lun_0\x00', 0x1ff) symlink(&(0x7f0000000e00)='./my_configfs/target/core/rd_mcp_0/dev0\x00', &(0x7f0000000f00)='./my_configfs/target/usb_gadget/naa.1234567890abcdef/tpgt_1/lun/lun_0/virtual_lun\x00') 4.39696492s ago: executing program 9 (id=5974): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) fcntl$setpipe(r0, 0x407, 0xfffffffffffffff9) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) socket$packet(0x11, 0x3, 0x300) socket$inet6_tcp(0xa, 0x1, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$inet6(0xa, 0x2, 0x0) socket$igmp(0x2, 0x3, 0x2) r2 = socket$key(0xf, 0x3, 0x2) syz_usb_connect$uac1(0x3, 0xdc, &(0x7f00000017c0)=ANY=[@ANYBLOB="12010000000000106b1d01014000010203010902ca0003010070000904000000010100000a24010800000201020d24060000030800000000000000240803960c03112d9cd2ce0c240208000103000000ff000924060506020100000924030003030005490c240206", @ANYRES8=r2, @ANYBLOB='\a'], 0x0) 4.353015182s ago: executing program 0 (id=6028): r0 = syz_usb_connect(0x3, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b00000009040000022a3e740009058bff7f0000100109050b362f"], 0x0) r1 = syz_open_dev$midi(&(0x7f0000000000), 0x3, 0x189e42) syz_usb_disconnect(r0) r2 = dup2(r1, r1) ioctl$DMA_BUF_IOCTL_SYNC(r2, 0x40086200, 0x0) 4.350094801s ago: executing program 8 (id=6029): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x4, 0x7fff7ffc}]}) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x2840, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x64, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_SET_SREGS(r3, 0x4138ae84, &(0x7f00000001c0)={{0x2000, 0x30000, 0x8, 0xd, 0x3, 0xe4, 0x40, 0xfd, 0x0, 0x38, 0x1b}, {0xfec00000, 0x70000, 0xe, 0x0, 0x40, 0x5, 0x7d, 0x9, 0x58, 0x3, 0x3, 0x1}, {0x2000, 0xe000, 0xe, 0x5, 0x3, 0x7, 0xfe, 0x89, 0x22, 0xab, 0x5, 0x46}, {0x30000, 0x7000, 0x3, 0x1, 0x4, 0x43, 0x9, 0xfb, 0x80, 0x7, 0xd}, {0xa000, 0x9000, 0x10, 0x2, 0x3, 0x7, 0xab, 0x7f, 0x4a, 0x83, 0x2, 0xe}, {0xdddd1000, 0x80a0000, 0x8, 0x20, 0xb1, 0x8, 0x1, 0xd, 0x88, 0xfb, 0x1, 0xfd}, {0x100000, 0x1, 0xf, 0x5, 0x7, 0xff, 0xb, 0x0, 0x5, 0x81, 0x1}, {0x5000, 0xb000, 0xe, 0x5, 0xf, 0x7, 0x1, 0x18, 0x5, 0x3, 0x7, 0x19}, {0xb000, 0x2d}, {0xf000, 0x7fff}, 0xc0040065, 0x0, 0x54000, 0x42224, 0xb, 0x1, 0x3000, [0x683ffffffffffffe, 0x3, 0x80000004, 0x5b3]}) close_range(r0, 0xffffffffffffffff, 0x0) 2.705677191s ago: executing program 9 (id=6022): r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x800, 0x2) ioctl$VIDIOC_CROPCAP(r0, 0xc02c563a, &(0x7f00000000c0)={0xa, {0x4, 0x10, 0x1, 0x401}, {0x0, 0x2, 0x4, 0x1000}, {0xa47, 0x5}}) 2.702829769s ago: executing program 8 (id=6031): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) mkdir(&(0x7f0000000100)='mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000300)='mnt\x00', &(0x7f0000000400)='devtmpfs\x00', 0x0, 0x0) syz_usb_connect(0x2, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ff000040a00e58684000010203010902270001010080320904000003ff00000007058102400000070502024000000705830308"], &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0}) 2.44140346s ago: executing program 9 (id=6023): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x100, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_TSC_KHZ_vm(r1, 0xaea2, 0xfffffffffffffffd) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) 1.877584882s ago: executing program 9 (id=6024): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x802, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) ioctl$FE_READ_SIGNAL_STRENGTH(r1, 0x80026f47, 0x0) 1.300655474s ago: executing program 8 (id=6025): r0 = socket$packet(0x11, 0x2, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000080)={'batadv0\x00', 0x0}) sendto$packet(r0, &(0x7f0000000100)="f257a8", 0x3, 0x80, &(0x7f0000000200)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @link_local}, 0x14) 230.947892ms ago: executing program 9 (id=6026): r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280), 0x68081, 0x0) ioctl$SNAPSHOT_FREE(r0, 0x3305) 229.112855ms ago: executing program 0 (id=6036): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x802, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) ioctl$FE_READ_SIGNAL_STRENGTH(r1, 0x80026f47, 0x0) 0s ago: executing program 8 (id=6027): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x101000, 0x0) syz_genetlink_get_family_id$wireguard(&(0x7f00000000c0), 0xffffffffffffffff) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000001c0)={0x205, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x43, &(0x7f0000000140)=0xffffffff, 0x4) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000280)={0x0, 0x0, @pic={0x4, 0x7, 0xe1, 0x81, 0x9, 0xd9, 0x40, 0x41, 0xfb, 0x1, 0xc, 0x2, 0x2, 0x41, 0x1, 0xf0}}) r3 = socket(0x1d, 0x2, 0x6) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) bind$can_j1939(r3, &(0x7f0000000100)={0x1d, r4, 0x2, {0x2, 0x0, 0x1}, 0xfe}, 0x18) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000000)={[0xffffffffffffffff, 0x0, 0x5, 0x20, 0x3, 0x2, 0x106c, 0x100, 0x1, 0x80000004000080, 0x380000, 0x8, 0x8, 0x0, 0x0, 0x8000], 0x1, 0x3c4210}) ioctl$KVM_RUN(r2, 0xae80, 0x0) kernel console output (not intermixed with test programs): -1: SerialNumber: syz [ 1573.764605][ T32] usb 9-1: 0:2 : does not exist [ 1573.896375][ T32] usb 9-1: 5:0: failed to get current value for ch 0 (-22) [ 1574.249382][ T32] usb 9-1: USB disconnect, device number 21 [ 1574.435774][T15629] usb 10-1: new full-speed USB device number 119 using dummy_hcd [ 1574.548023][T22837] udevd[22837]: error opening ATTR{/sys/devices/platform/dummy_hcd.8/usb9/9-1/9-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1574.587711][T15629] usb 10-1: not running at top speed; connect to a high speed hub [ 1574.589252][T15629] usb 10-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1574.592274][T15629] usb 10-1: New USB device found, idVendor=06cd, idProduct=0131, bcdDevice= 1.00 [ 1574.592308][T15629] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1574.592332][T15629] usb 10-1: Product: syz [ 1574.592348][T15629] usb 10-1: Manufacturer: syz [ 1574.592364][T15629] usb 10-1: SerialNumber: syz [ 1574.694355][T15629] keyspan 10-1:1.0: Keyspan 4 port adapter converter detected [ 1574.694661][T15629] keyspan 10-1:1.0: found no endpoint descriptor for endpoint 81 [ 1574.694730][T15629] keyspan 10-1:1.0: found no endpoint descriptor for endpoint 88 [ 1574.764873][T15629] keyspan 10-1:1.0: found no endpoint descriptor for endpoint 1 [ 1574.785465][T15629] usb 10-1: Keyspan 4 port adapter converter now attached to ttyUSB0 [ 1574.805157][T15629] keyspan 10-1:1.0: found no endpoint descriptor for endpoint 2 [ 1574.837857][T15629] usb 10-1: Keyspan 4 port adapter converter now attached to ttyUSB1 [ 1574.860208][T15629] keyspan 10-1:1.0: found no endpoint descriptor for endpoint 4 [ 1574.874833][T15629] usb 10-1: Keyspan 4 port adapter converter now attached to ttyUSB2 [ 1574.892922][T15629] keyspan 10-1:1.0: found no endpoint descriptor for endpoint 6 [ 1574.911176][T15629] usb 10-1: Keyspan 4 port adapter converter now attached to ttyUSB3 [ 1575.570467][ T5723] usb 10-1: USB disconnect, device number 119 [ 1575.659660][ T5723] keyspan_4 ttyUSB0: Keyspan 4 port adapter converter now disconnected from ttyUSB0 [ 1575.828502][ T5723] keyspan_4 ttyUSB1: Keyspan 4 port adapter converter now disconnected from ttyUSB1 [ 1575.865717][T15629] usb 9-1: new high-speed USB device number 22 using dummy_hcd [ 1575.882189][ T5723] keyspan_4 ttyUSB2: Keyspan 4 port adapter converter now disconnected from ttyUSB2 [ 1575.932597][ T5723] keyspan_4 ttyUSB3: Keyspan 4 port adapter converter now disconnected from ttyUSB3 [ 1575.947433][ T5723] keyspan 10-1:1.0: device disconnected [ 1576.076412][T15629] usb 9-1: Using ep0 maxpacket: 16 [ 1576.085301][T15629] usb 9-1: unable to get BOS descriptor or descriptor too short [ 1576.087256][T15629] usb 9-1: config 1 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1576.087290][T15629] usb 9-1: config 1 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1576.091598][T15629] usb 9-1: string descriptor 0 read error: -22 [ 1576.091725][T15629] usb 9-1: New USB device found, idVendor=fc08, idProduct=0101, bcdDevice= 0.40 [ 1576.091744][T15629] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1576.099490][T25148] raw-gadget.0 gadget.8: fail, usb_ep_enable returned -22 [ 1576.181506][T15629] usb 9-1: Quirk or no altset; falling back to MIDI 1.0 [ 1576.181555][T15629] usb 9-1: MIDIStreaming interface descriptor not found [ 1576.684389][T15629] usb 9-1: USB disconnect, device number 22 [ 1576.715852][ T5723] usb 10-1: new high-speed USB device number 120 using dummy_hcd [ 1576.877446][ T5723] usb 10-1: Using ep0 maxpacket: 32 [ 1576.943270][ T5723] usb 10-1: New USB device found, idVendor=055f, idProduct=d001, bcdDevice=88.92 [ 1576.943306][ T5723] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1577.090747][ T5723] gspca_main: nw80x-2.14.0 probing 055f:d001 [ 1577.374246][T25155] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1577.386598][T25155] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1577.952049][T15629] usb 9-1: new high-speed USB device number 23 using dummy_hcd [ 1578.175713][T15629] usb 9-1: Using ep0 maxpacket: 16 [ 1578.185208][T15629] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1578.185247][T15629] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1578.221016][T15629] usb 9-1: New USB device found, idVendor=041e, idProduct=3100, bcdDevice= 0.00 [ 1578.221050][T15629] usb 9-1: New USB device strings: Mfr=34, Product=0, SerialNumber=0 [ 1578.221073][T15629] usb 9-1: Manufacturer: syz [ 1578.234783][T15629] usb 9-1: config 0 descriptor?? [ 1578.895308][T15629] usbhid 9-1:0.0: can't add hid device: -71 [ 1578.895475][T15629] usbhid 9-1:0.0: probe with driver usbhid failed with error -71 [ 1578.919453][T15629] usb 9-1: USB disconnect, device number 23 [ 1579.394727][T24921] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 1579.505143][ T32] usb 10-1: USB disconnect, device number 120 [ 1579.568322][T24921] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1579.580072][T24921] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 1579.800375][T24921] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1579.820072][T24921] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 1580.131452][T25204] vivid-007: ================= START STATUS ================= [ 1580.131681][T25204] vivid-007: Generate PTS: true [ 1580.131779][T25204] vivid-007: Generate SCR: true [ 1580.131835][T25204] tpg source WxH: 320x240 (Y'CbCr) [ 1580.131873][T25204] tpg field: 1 [ 1580.131894][T25204] tpg crop: (0,0)/320x240 [ 1580.131909][T25204] tpg compose: (0,0)/320x240 [ 1580.131923][T25204] tpg colorspace: 8 [ 1580.131932][T25204] tpg transfer function: 0/0 [ 1580.131943][T25204] tpg Y'CbCr encoding: 0/0 [ 1580.131954][T25204] tpg quantization: 0/0 [ 1580.131964][T25204] tpg RGB range: 0/2 [ 1580.131975][T25204] vivid-007: ================== END STATUS ================== [ 1580.278000][T24921] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1580.280211][T24921] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 1580.390578][T24921] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1580.631262][ T9] usb 9-1: new high-speed USB device number 24 using dummy_hcd [ 1580.789854][ T9] usb 9-1: Using ep0 maxpacket: 16 [ 1580.793925][ T9] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1580.793955][ T9] usb 9-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1580.830051][ T9] usb 9-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1580.830086][ T9] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1580.830102][ T9] usb 9-1: Product: syz [ 1580.830113][ T9] usb 9-1: Manufacturer: syz [ 1580.830125][ T9] usb 9-1: SerialNumber: syz [ 1580.911486][ T9] usb 9-1: 0:2 : does not exist [ 1581.016365][T24921] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1581.094973][ T9] usb 9-1: 5:0: failed to get current value for ch 0 (-22) [ 1581.170731][T24921] 8021q: adding VLAN 0 to HW filter on device team0 [ 1581.191364][T17194] bridge0: port 1(bridge_slave_0) entered blocking state [ 1581.192258][T17194] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1581.251871][T24111] bridge0: port 2(bridge_slave_1) entered blocking state [ 1581.252058][T24111] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1581.348745][ T9] usb 9-1: USB disconnect, device number 24 [ 1581.602368][T22837] udevd[22837]: error opening ATTR{/sys/devices/platform/dummy_hcd.8/usb9/9-1/9-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1583.660457][T24921] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1583.815749][ T5679] usb 10-1: new high-speed USB device number 121 using dummy_hcd [ 1583.998075][ T5679] usb 10-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 1583.998107][ T5679] usb 10-1: config 220 has 1 interface, different from the descriptor's value: 3 [ 1583.998150][ T5679] usb 10-1: config 220 interface 0 has no altsetting 0 [ 1584.000564][ T5679] usb 10-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 1584.000595][ T5679] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1584.000615][ T5679] usb 10-1: Product: syz [ 1584.000634][ T5679] usb 10-1: Manufacturer: syz [ 1584.000646][ T5679] usb 10-1: SerialNumber: syz [ 1584.128110][T24921] veth0_vlan: entered promiscuous mode [ 1584.218037][T24921] veth1_vlan: entered promiscuous mode [ 1584.315638][ T5679] uvcvideo 10-1:220.0: Found UVC 7.01 device syz (8086:0b07) [ 1584.315676][ T5679] uvcvideo 10-1:220.0: No valid video chain found. [ 1584.339542][ T5679] usb 10-1: USB disconnect, device number 121 [ 1584.355188][T22837] udevd[22837]: setting owner of /dev/bus/usb/010/121 to uid=0, gid=0 failed: No such file or directory [ 1584.429212][T24921] veth0_macvtap: entered promiscuous mode [ 1584.452106][T24921] veth1_macvtap: entered promiscuous mode [ 1584.453655][ T5723] usb 9-1: new high-speed USB device number 25 using dummy_hcd [ 1584.528800][T24921] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1584.661881][ T5723] usb 9-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 1584.661946][ T5723] usb 9-1: New USB device found, idVendor=041e, idProduct=4007, bcdDevice=5d.18 [ 1584.661964][ T5723] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1584.728313][ T5723] gspca_main: stv0680-2.14.0 probing 041e:4007 [ 1584.737585][T24921] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1584.776516][T17582] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1584.782942][T17582] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1584.782996][T17582] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1584.783038][T17582] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1585.383787][T25278] netlink: 1688 bytes leftover after parsing attributes in process `syz.9.5714'. [ 1585.972835][T17194] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1585.972860][T17194] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1586.305356][ T5723] gspca_stv0680: usb_control_msg error 0, request = 0x80, error = -110 [ 1586.305386][ T5723] stv0680 9-1:4.0: last error: 2, command = 0x4 [ 1586.527509][T17583] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1586.527534][T17583] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1587.618205][ T5723] usb 9-1: USB disconnect, device number 25 [ 1588.205817][T23277] usb 4-1: new high-speed USB device number 22 using dummy_hcd [ 1588.205980][ T5723] usb 10-1: new high-speed USB device number 122 using dummy_hcd [ 1588.282819][ T5699] usb 9-1: new high-speed USB device number 26 using dummy_hcd [ 1588.356132][ T5723] usb 10-1: Using ep0 maxpacket: 16 [ 1588.356311][T23277] usb 4-1: Using ep0 maxpacket: 16 [ 1588.362147][T23277] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1588.362334][T23277] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1588.363082][ T5723] usb 10-1: unable to get BOS descriptor or descriptor too short [ 1588.365299][ T5723] usb 10-1: config 255 has an invalid descriptor of length 0, skipping remainder of the config [ 1588.365326][ T5723] usb 10-1: config 255 has 1 interface, different from the descriptor's value: 4 [ 1588.441659][T23277] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1588.441756][T23277] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1588.441779][T23277] usb 4-1: Product: syz [ 1588.441794][T23277] usb 4-1: Manufacturer: syz [ 1588.441811][T23277] usb 4-1: SerialNumber: syz [ 1588.483983][ T5699] usb 9-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 1588.484006][ T5699] usb 9-1: config 220 has 1 interface, different from the descriptor's value: 3 [ 1588.484801][ T5699] usb 9-1: config 220 interface 0 has no altsetting 0 [ 1588.523468][ T5699] usb 9-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 1588.523493][ T5699] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1588.523508][ T5699] usb 9-1: Product: syz [ 1588.523519][ T5699] usb 9-1: Manufacturer: syz [ 1588.523530][ T5699] usb 9-1: SerialNumber: syz [ 1588.585218][ T5723] usb 10-1: New USB device found, idVendor=2899, idProduct=012c, bcdDevice=d3.b7 [ 1588.585252][ T5723] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1588.585273][ T5723] usb 10-1: Product: syz [ 1588.585289][ T5723] usb 10-1: Manufacturer: syz [ 1588.585304][ T5723] usb 10-1: SerialNumber: syz [ 1588.742571][T23277] usb 4-1: 0:2 : does not exist [ 1588.940413][T23277] usb 4-1: 5:0: failed to get current value for ch 0 (-22) [ 1589.051170][ T5699] uvcvideo 9-1:220.0: Found UVC 7.01 device syz (8086:0b07) [ 1589.051208][ T5699] uvcvideo 9-1:220.0: No valid video chain found. [ 1589.090069][T25323] FAULT_INJECTION: forcing a failure. [ 1589.090069][T25323] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1589.090112][T25323] CPU: 1 UID: 0 PID: 25323 Comm: syz.0.5719 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1589.090146][T25323] Tainted: [L]=SOFTLOCKUP [ 1589.090155][T25323] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1589.090169][T25323] Call Trace: [ 1589.090178][T25323] [ 1589.090188][T25323] dump_stack_lvl+0xe8/0x150 [ 1589.090224][T25323] should_fail_ex+0x467/0x600 [ 1589.090261][T25323] _copy_to_user+0x31/0xb0 [ 1589.090287][T25323] simple_read_from_buffer+0xe1/0x170 [ 1589.090319][T25323] proc_fail_nth_read+0x1be/0x230 [ 1589.090349][T25323] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1589.090386][T25323] ? rw_verify_area+0x250/0x4d0 [ 1589.090416][T25323] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1589.090441][T25323] vfs_read+0x219/0xa90 [ 1589.090477][T25323] ? __pfx_vfs_read+0x10/0x10 [ 1589.090506][T25323] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1589.090530][T25323] ? lockdep_hardirqs_on+0x7a/0x110 [ 1589.090553][T25323] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1589.090576][T25323] ? mutex_lock_nested+0x152/0x1d0 [ 1589.090607][T25323] ? fdget_pos+0x252/0x320 [ 1589.090640][T25323] ksys_read+0x156/0x270 [ 1589.090669][T25323] ? __pfx_ksys_read+0x10/0x10 [ 1589.090710][T25323] do_syscall_64+0x17b/0x530 [ 1589.090733][T25323] ? irqentry_exit+0x10f/0x8f0 [ 1589.090756][T25323] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1589.090781][T25323] ? clear_bhb_loop+0x40/0x90 [ 1589.090809][T25323] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1589.090833][T25323] RIP: 0033:0x7fbbbf67e84e [ 1589.090854][T25323] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1589.090873][T25323] RSP: 002b:00007fbbbd915fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1589.090898][T25323] RAX: ffffffffffffffda RBX: 00007fbbbd9166c0 RCX: 00007fbbbf67e84e [ 1589.090917][T25323] RDX: 000000000000000f RSI: 00007fbbbd9160a0 RDI: 0000000000000003 [ 1589.090932][T25323] RBP: 00007fbbbd916090 R08: 0000000000000000 R09: 0000000000000000 [ 1589.090947][T25323] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1589.090961][T25323] R13: 00007fbbbf946038 R14: 00007fbbbf945fa0 R15: 00007ffda5b57258 [ 1589.090997][T25323] [ 1589.510299][ T5699] usb 9-1: USB disconnect, device number 26 [ 1589.688335][ T5723] gspca_main: spca500-2.14.0 probing 2899:012c [ 1589.796955][T23277] usb 4-1: USB disconnect, device number 22 [ 1589.960365][ T5723] usb 10-1: USB disconnect, device number 122 [ 1590.057406][ T5699] usb 9-1: new full-speed USB device number 27 using dummy_hcd [ 1590.092313][T22837] udevd[22837]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1590.207992][ T5699] usb 9-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 1590.208028][ T5699] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1590.380998][ T5699] pvrusb2: Hardware description: Terratec Grabster AV400 [ 1590.381072][ T5699] pvrusb2: ********** [ 1590.381083][ T5699] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 1590.381099][ T5699] pvrusb2: Important functionality might not be entirely working. [ 1590.381109][ T5699] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 1590.381124][ T5699] pvrusb2: ********** [ 1590.593245][T25346] netlink: 1688 bytes leftover after parsing attributes in process `syz.3.5723'. [ 1590.757171][ T49] usb 10-1: new high-speed USB device number 123 using dummy_hcd [ 1590.779127][ T2397] pvrusb2: Invalid write control endpoint [ 1590.935862][ T49] usb 10-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 1590.935926][ T49] usb 10-1: New USB device found, idVendor=041e, idProduct=4007, bcdDevice=5d.18 [ 1590.935951][ T49] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1590.999774][ T49] gspca_main: stv0680-2.14.0 probing 041e:4007 [ 1591.292459][ T2397] pvrusb2: Invalid write control endpoint [ 1591.292479][ T2397] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 1591.292526][ T2397] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 1591.292536][ T2397] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 1591.292573][ T2397] pvrusb2: Device being rendered inoperable [ 1591.350066][ T2397] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 1591.350169][ T2397] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_a) [ 1591.415824][ T822] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 1591.449303][ T2397] pvrusb2: Attached sub-driver cx25840 [ 1591.449324][ T2397] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 1591.449403][ T2397] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 1591.557201][ T822] usb 4-1: device descriptor read/64, error -71 [ 1591.795784][ T822] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 1591.967068][ T822] usb 4-1: device descriptor read/64, error -71 [ 1592.076297][ T822] usb usb4-port1: attempt power cycle [ 1592.425901][ T822] usb 4-1: new high-speed USB device number 25 using dummy_hcd [ 1592.447887][ T49] gspca_stv0680: usb_control_msg error 2, request = 0x6, error = -71 [ 1592.448220][ T49] gspca_stv0680: usb_control_msg error 0, request = 0x80, error = -71 [ 1592.448234][ T49] stv0680 10-1:4.0: last error: 86, command = 0x78 [ 1592.480072][ T49] usb 10-1: USB disconnect, device number 123 [ 1592.484829][ T822] usb 4-1: device descriptor read/8, error -71 [ 1592.725769][ T822] usb 4-1: new high-speed USB device number 26 using dummy_hcd [ 1592.750343][ T822] usb 4-1: device descriptor read/8, error -71 [ 1592.847057][ T5699] usb 9-1: USB disconnect, device number 27 [ 1592.856455][ T822] usb usb4-port1: unable to enumerate USB device [ 1593.606115][ T5699] usb 9-1: new high-speed USB device number 28 using dummy_hcd [ 1593.755830][ T5699] usb 9-1: Using ep0 maxpacket: 16 [ 1593.757874][ T5699] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1593.757910][ T5699] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1593.759139][ T5699] usb 9-1: New USB device found, idVendor=041e, idProduct=3100, bcdDevice= 0.00 [ 1593.759170][ T5699] usb 9-1: New USB device strings: Mfr=34, Product=0, SerialNumber=0 [ 1593.759195][ T5699] usb 9-1: Manufacturer: syz [ 1593.763423][ T5699] usb 9-1: config 0 descriptor?? [ 1594.384632][ T5699] usbhid 9-1:0.0: can't add hid device: -71 [ 1594.384764][ T5699] usbhid 9-1:0.0: probe with driver usbhid failed with error -71 [ 1594.428403][ T5699] usb 9-1: USB disconnect, device number 28 [ 1594.516578][ T49] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 1594.695736][ T49] usb 4-1: Using ep0 maxpacket: 16 [ 1594.696463][ T5679] usb 10-1: new high-speed USB device number 124 using dummy_hcd [ 1594.712502][ T49] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1594.712538][ T49] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1594.715120][ T49] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1594.715150][ T49] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1594.715171][ T49] usb 4-1: Product: syz [ 1594.715191][ T49] usb 4-1: Manufacturer: syz [ 1594.715201][ T49] usb 4-1: SerialNumber: syz [ 1594.810099][ T49] usb 4-1: 0:2 : does not exist [ 1594.855804][ T5679] usb 10-1: Using ep0 maxpacket: 8 [ 1594.858312][ T5679] usb 10-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1594.861007][ T5679] usb 10-1: New USB device found, idVendor=16d0, idProduct=10a9, bcdDevice=30.52 [ 1594.861030][ T5679] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1594.861095][ T5679] usb 10-1: Product: syz [ 1594.861108][ T5679] usb 10-1: Manufacturer: syz [ 1594.861119][ T5679] usb 10-1: SerialNumber: syz [ 1594.943172][ T5679] usb 10-1: config 0 descriptor?? [ 1595.065082][ T49] usb 4-1: 5:0: failed to get current value for ch 0 (-22) [ 1595.145702][ T49] usb 4-1: USB disconnect, device number 27 [ 1595.195260][ T822] usb 10-1: USB disconnect, device number 124 [ 1595.269243][T22837] udevd[22837]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1595.326495][ T5699] usb 9-1: new high-speed USB device number 29 using dummy_hcd [ 1595.475677][ T5699] usb 9-1: Using ep0 maxpacket: 16 [ 1595.477676][ T5699] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1595.477706][ T5699] usb 9-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1595.480164][ T5699] usb 9-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1595.480186][ T5699] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1595.480202][ T5699] usb 9-1: Product: syz [ 1595.480212][ T5699] usb 9-1: Manufacturer: syz [ 1595.480224][ T5699] usb 9-1: SerialNumber: syz [ 1595.556727][ T5699] usb 9-1: 0:2 : does not exist [ 1595.777847][ T5699] usb 9-1: 5:0: failed to get current value for ch 0 (-22) [ 1595.840578][T25409] netlink: 1688 bytes leftover after parsing attributes in process `syz.3.5734'. [ 1595.866735][ T5699] usb 9-1: USB disconnect, device number 29 [ 1595.949228][T22837] udevd[22837]: error opening ATTR{/sys/devices/platform/dummy_hcd.8/usb9/9-1/9-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1596.351192][T25417] FAULT_INJECTION: forcing a failure. [ 1596.351192][T25417] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1596.351234][T25417] CPU: 1 UID: 0 PID: 25417 Comm: syz.3.5737 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1596.351267][T25417] Tainted: [L]=SOFTLOCKUP [ 1596.351276][T25417] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1596.351290][T25417] Call Trace: [ 1596.351303][T25417] [ 1596.351314][T25417] dump_stack_lvl+0xe8/0x150 [ 1596.351351][T25417] should_fail_ex+0x467/0x600 [ 1596.351388][T25417] _copy_to_user+0x31/0xb0 [ 1596.351413][T25417] simple_read_from_buffer+0xe1/0x170 [ 1596.351444][T25417] proc_fail_nth_read+0x1be/0x230 [ 1596.351473][T25417] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1596.351502][T25417] ? rw_verify_area+0x250/0x4d0 [ 1596.351531][T25417] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1596.351555][T25417] vfs_read+0x219/0xa90 [ 1596.351590][T25417] ? __pfx_vfs_read+0x10/0x10 [ 1596.351620][T25417] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1596.351654][T25417] ? lockdep_hardirqs_on+0x7a/0x110 [ 1596.351678][T25417] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1596.351702][T25417] ? mutex_lock_nested+0x152/0x1d0 [ 1596.351730][T25417] ? fdget_pos+0x252/0x320 [ 1596.351763][T25417] ksys_read+0x156/0x270 [ 1596.351793][T25417] ? __pfx_ksys_read+0x10/0x10 [ 1596.351829][T25417] do_syscall_64+0x17b/0x530 [ 1596.351852][T25417] ? irqentry_exit+0x10f/0x8f0 [ 1596.351874][T25417] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1596.351897][T25417] ? clear_bhb_loop+0x40/0x90 [ 1596.351924][T25417] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1596.351947][T25417] RIP: 0033:0x7fb18852e84e [ 1596.351967][T25417] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1596.351987][T25417] RSP: 002b:00007fb1867c5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1596.352011][T25417] RAX: ffffffffffffffda RBX: 00007fb1867c66c0 RCX: 00007fb18852e84e [ 1596.352028][T25417] RDX: 000000000000000f RSI: 00007fb1867c60a0 RDI: 0000000000000004 [ 1596.352042][T25417] RBP: 00007fb1867c6090 R08: 0000000000000000 R09: 0000000000000000 [ 1596.352055][T25417] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1596.352069][T25417] R13: 00007fb1887f6038 R14: 00007fb1887f5fa0 R15: 00007fff0c3f4db8 [ 1596.352103][T25417] [ 1597.370395][T25431] netlink: 'syz.3.5742': attribute type 14 has an invalid length. [ 1597.537768][ T49] usb 9-1: new high-speed USB device number 30 using dummy_hcd [ 1597.726003][ T49] usb 9-1: Using ep0 maxpacket: 16 [ 1597.728386][ T49] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1597.728422][ T49] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1597.730326][ T49] usb 9-1: New USB device found, idVendor=041e, idProduct=3100, bcdDevice= 0.00 [ 1597.730361][ T49] usb 9-1: New USB device strings: Mfr=34, Product=0, SerialNumber=0 [ 1597.730378][ T49] usb 9-1: Manufacturer: syz [ 1597.787726][ T49] usb 9-1: config 0 descriptor?? [ 1598.289538][ T49] creative-sb0540 0003:041E:3100.003B: unknown main item tag 0x0 [ 1598.289583][ T49] creative-sb0540 0003:041E:3100.003B: unknown main item tag 0x0 [ 1598.289613][ T49] creative-sb0540 0003:041E:3100.003B: unknown main item tag 0x0 [ 1598.289642][ T49] creative-sb0540 0003:041E:3100.003B: unknown main item tag 0x0 [ 1598.289670][ T49] creative-sb0540 0003:041E:3100.003B: unknown main item tag 0x0 [ 1598.391697][ T49] creative-sb0540 0003:041E:3100.003B: hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.8-1/input0 [ 1598.473605][ T49] usb 9-1: USB disconnect, device number 30 [ 1598.727746][T25456] fido_id[25456]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.8/usb9/report_descriptor': No such file or directory [ 1598.780897][T25454] Flush: task=syz.9.5747[25454] dev=loop5 state=2 [ 1598.872900][T25454] Teardown: task=syz.9.5747[25454] dev=loop5 state=2 [ 1599.126503][T23277] usb 4-1: new high-speed USB device number 28 using dummy_hcd [ 1599.278091][T23277] usb 4-1: config 220 has an invalid interface number: 76 but max is 2 [ 1599.278124][T23277] usb 4-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 1599.278147][T23277] usb 4-1: config 220 has 2 interfaces, different from the descriptor's value: 3 [ 1599.278171][T23277] usb 4-1: config 220 has no interface number 1 [ 1599.278217][T23277] usb 4-1: config 220 interface 0 has no altsetting 0 [ 1599.278239][T23277] usb 4-1: config 220 interface 76 has no altsetting 0 [ 1599.281795][T23277] usb 4-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 1599.281920][T23277] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1599.282443][T23277] usb 4-1: Product: syz [ 1599.282462][T23277] usb 4-1: Manufacturer: syz [ 1599.282479][T23277] usb 4-1: SerialNumber: syz [ 1599.405773][ T5679] usb 9-1: new high-speed USB device number 31 using dummy_hcd [ 1599.608104][ T5679] usb 9-1: Using ep0 maxpacket: 16 [ 1599.629115][ T5679] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1599.629137][ T5679] usb 9-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1599.651870][ T5679] usb 9-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1599.651905][ T5679] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1599.651927][ T5679] usb 9-1: Product: syz [ 1599.651944][ T5679] usb 9-1: Manufacturer: syz [ 1599.651959][ T5679] usb 9-1: SerialNumber: syz [ 1599.706182][T23277] uvcvideo 4-1:220.0: Found UVC 7.01 device syz (8086:0b07) [ 1599.706221][T23277] uvcvideo 4-1:220.0: No valid video chain found. [ 1599.715068][ T5679] usb 9-1: 0:2 : does not exist [ 1599.738453][T23277] usb 4-1: USB disconnect, device number 28 [ 1599.877863][ T49] usb 10-1: new high-speed USB device number 125 using dummy_hcd [ 1599.910914][ T5679] usb 9-1: 5:0: failed to get current value for ch 0 (-22) [ 1599.961276][ T5679] usb 9-1: USB disconnect, device number 31 [ 1600.025834][ T49] usb 10-1: Using ep0 maxpacket: 16 [ 1600.030689][ T49] usb 10-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 1600.030726][ T49] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1600.039431][ T49] usb 10-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1600.039525][ T49] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1600.039581][ T49] usb 10-1: Product: syz [ 1600.039624][ T49] usb 10-1: Manufacturer: syz [ 1600.039675][ T49] usb 10-1: SerialNumber: syz [ 1600.102835][T22837] udevd[22837]: error opening ATTR{/sys/devices/platform/dummy_hcd.8/usb9/9-1/9-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1600.104977][ T49] usb 10-1: config 0 descriptor?? [ 1600.139903][ T49] em28xx 10-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 1600.140616][ T49] em28xx 10-1:0.0: Audio interface 0 found (Vendor Class) [ 1600.416377][T25478] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5751'. [ 1600.712598][ T49] em28xx 10-1:0.0: unknown em28xx chip ID (255) [ 1600.747768][T25490] netlink: 16 bytes leftover after parsing attributes in process `syz.3.5756'. [ 1601.019210][ T49] em28xx 10-1:0.0: Config register raw data: 0xfffffffb [ 1601.021741][ T49] em28xx 10-1:0.0: AC97 chip type couldn't be determined [ 1601.021764][ T49] em28xx 10-1:0.0: No AC97 audio processor [ 1601.077993][ T49] usb 10-1: USB disconnect, device number 125 [ 1601.085344][ T49] em28xx 10-1:0.0: Disconnecting em28xx [ 1601.105822][T23277] usb 4-1: new high-speed USB device number 29 using dummy_hcd [ 1601.241585][T25498] Invalid logical block size (264) [ 1601.255741][T23277] usb 4-1: Using ep0 maxpacket: 16 [ 1601.259497][T23277] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1601.259676][T23277] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1601.262044][T23277] usb 4-1: New USB device found, idVendor=041e, idProduct=3100, bcdDevice= 0.00 [ 1601.262075][T23277] usb 4-1: New USB device strings: Mfr=34, Product=0, SerialNumber=0 [ 1601.262098][T23277] usb 4-1: Manufacturer: syz [ 1601.324596][ T49] em28xx: Freeing device [ 1601.388513][T23277] usb 4-1: config 0 descriptor?? [ 1601.800439][T23277] creative-sb0540 0003:041E:3100.003C: unknown main item tag 0x0 [ 1601.800483][T23277] creative-sb0540 0003:041E:3100.003C: unknown main item tag 0x0 [ 1601.800504][T23277] creative-sb0540 0003:041E:3100.003C: unknown main item tag 0x0 [ 1601.800523][T23277] creative-sb0540 0003:041E:3100.003C: unknown main item tag 0x0 [ 1601.800543][T23277] creative-sb0540 0003:041E:3100.003C: unknown main item tag 0x0 [ 1601.803236][T23277] creative-sb0540 0003:041E:3100.003C: hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.3-1/input0 [ 1601.985938][ T49] usb 9-1: new high-speed USB device number 32 using dummy_hcd [ 1602.045219][ T5679] usb 4-1: USB disconnect, device number 29 [ 1602.176276][ T49] usb 9-1: Using ep0 maxpacket: 16 [ 1602.179109][ T49] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1602.179138][ T49] usb 9-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1602.179528][T25510] netlink: 8 bytes leftover after parsing attributes in process `syz.9.5764'. [ 1602.182248][ T49] usb 9-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1602.182278][ T49] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1602.182302][ T49] usb 9-1: Product: syz [ 1602.182318][ T49] usb 9-1: Manufacturer: syz [ 1602.182332][ T49] usb 9-1: SerialNumber: syz [ 1602.282801][ T49] usb 9-1: 0:2 : does not exist [ 1602.501758][ T49] usb 9-1: 5:0: failed to get current value for ch 0 (-22) [ 1602.561732][ T49] usb 9-1: USB disconnect, device number 32 [ 1602.567413][ T9] usb 10-1: new high-speed USB device number 126 using dummy_hcd [ 1602.650325][T22837] udevd[22837]: error opening ATTR{/sys/devices/platform/dummy_hcd.8/usb9/9-1/9-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1602.752490][ T9] usb 10-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 1602.752526][ T9] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1602.752549][ T9] usb 10-1: Product: syz [ 1602.752565][ T9] usb 10-1: Manufacturer: syz [ 1602.752582][ T9] usb 10-1: SerialNumber: syz [ 1602.888160][ T9] usb 10-1: config 0 descriptor?? [ 1603.310662][ T9] usb 10-1: Firmware: major: 212, minor: 98, hardware type: UNKNOWN (32) [ 1603.512086][ T9] usb 10-1: failed to fetch extended address, random address set [ 1603.512121][ T9] usb 10-1: atusb_probe: initialization failed, error = -524 [ 1603.512546][ T9] atusb 10-1:0.0: probe with driver atusb failed with error -524 [ 1603.565768][ T9] usb 10-1: USB disconnect, device number 126 [ 1603.688044][T23277] usb 9-1: new high-speed USB device number 33 using dummy_hcd [ 1603.839380][T23277] usb 9-1: unable to get BOS descriptor or descriptor too short [ 1603.840636][T23277] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1603.840663][T23277] usb 9-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 1603.840714][T23277] usb 9-1: too many endpoints for config 1 interface 1 altsetting 76: 188, using maximum allowed: 30 [ 1603.840758][T23277] usb 9-1: config 1 interface 1 altsetting 76 has 0 endpoint descriptors, different from the interface descriptor's value: 188 [ 1603.840789][T23277] usb 9-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 1603.840808][T23277] usb 9-1: config 1 interface 1 has no altsetting 0 [ 1603.844190][T23277] usb 9-1: string descriptor 0 read error: -22 [ 1603.844326][T23277] usb 9-1: New USB device found, idVendor=21b4, idProduct=0081, bcdDevice= 0.40 [ 1603.844364][T23277] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1604.099091][ T5723] usb 4-1: new high-speed USB device number 30 using dummy_hcd [ 1604.470112][ T5723] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1604.470212][ T5723] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 1604.470242][ T5723] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1604.475431][ T5723] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 1604.475633][ T5723] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 1604.475658][ T5723] usb 4-1: Product: syz [ 1604.475735][ T5723] usb 4-1: Manufacturer: syz [ 1604.475753][ T5723] usb 4-1: SerialNumber: syz [ 1604.857899][ T5723] usblp 4-1:1.0: usblp0: USB Unidirectional printer dev 30 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 1605.044893][ T5679] usb 4-1: USB disconnect, device number 30 [ 1605.057319][T25528] nfs4: Unknown parameter 'ramfs' [ 1605.160829][ T5679] usblp0: removed [ 1605.185640][ T49] usb 10-1: new high-speed USB device number 127 using dummy_hcd [ 1605.356169][ T49] usb 10-1: Using ep0 maxpacket: 16 [ 1605.358613][ T49] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1605.358649][ T49] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1605.360597][ T49] usb 10-1: New USB device found, idVendor=041e, idProduct=3100, bcdDevice= 0.00 [ 1605.360628][ T49] usb 10-1: New USB device strings: Mfr=34, Product=0, SerialNumber=0 [ 1605.360650][ T49] usb 10-1: Manufacturer: syz [ 1605.428698][ T49] usb 10-1: config 0 descriptor?? [ 1605.718589][T23277] usb 9-1: 2:0: failed to get current value for ch 1 (-71) [ 1605.894375][ T49] creative-sb0540 0003:041E:3100.003D: unknown main item tag 0x0 [ 1605.894431][ T49] creative-sb0540 0003:041E:3100.003D: unknown main item tag 0x0 [ 1605.894458][ T49] creative-sb0540 0003:041E:3100.003D: unknown main item tag 0x0 [ 1605.894485][ T49] creative-sb0540 0003:041E:3100.003D: unknown main item tag 0x0 [ 1605.894511][ T49] creative-sb0540 0003:041E:3100.003D: unknown main item tag 0x0 [ 1605.962144][ T49] creative-sb0540 0003:041E:3100.003D: hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.9-1/input0 [ 1606.055848][ T49] usb 10-1: USB disconnect, device number 127 [ 1606.206892][T23277] usb 9-1: USB disconnect, device number 33 [ 1606.293334][T25567] netlink: 1752 bytes leftover after parsing attributes in process `syz.3.5775'. [ 1606.312462][T25565] fido_id[25565]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.9/usb10/report_descriptor': No such file or directory [ 1606.600979][T25572] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1606.825781][T23277] usb 9-1: new high-speed USB device number 34 using dummy_hcd [ 1606.975794][T23277] usb 9-1: Using ep0 maxpacket: 16 [ 1606.977914][T23277] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1606.977941][T23277] usb 9-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1606.980557][T23277] usb 9-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1606.980592][T23277] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1606.980608][T23277] usb 9-1: Product: syz [ 1606.980618][T23277] usb 9-1: Manufacturer: syz [ 1606.980630][T23277] usb 9-1: SerialNumber: syz [ 1607.062103][T23277] usb 9-1: 0:2 : does not exist [ 1607.075764][ T5723] usb 10-1: new high-speed USB device number 2 using dummy_hcd [ 1607.105843][ T9] usb 4-1: new high-speed USB device number 31 using dummy_hcd [ 1607.227969][ T5723] usb 10-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 1607.228089][ T5723] usb 10-1: New USB device found, idVendor=041e, idProduct=4007, bcdDevice=5d.18 [ 1607.228112][ T5723] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1607.268222][ T9] usb 4-1: config 220 has an invalid interface number: 76 but max is 2 [ 1607.268255][ T9] usb 4-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 1607.268278][ T9] usb 4-1: config 220 has 2 interfaces, different from the descriptor's value: 3 [ 1607.268366][ T9] usb 4-1: config 220 has no interface number 1 [ 1607.268415][ T9] usb 4-1: config 220 interface 0 has no altsetting 0 [ 1607.268437][ T9] usb 4-1: config 220 interface 76 has no altsetting 0 [ 1607.323005][ T9] usb 4-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 1607.323038][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1607.323060][ T9] usb 4-1: Product: syz [ 1607.323077][ T9] usb 4-1: Manufacturer: syz [ 1607.323166][ T9] usb 4-1: SerialNumber: syz [ 1607.416505][T23277] usb 9-1: 5:0: failed to get current value for ch 0 (-22) [ 1607.457389][ T5723] gspca_main: stv0680-2.14.0 probing 041e:4007 [ 1607.567651][ T1339] ieee802154 phy0 wpan0: encryption failed: -22 [ 1607.654312][ T9] uvcvideo 4-1:220.0: Found UVC 7.01 device syz (8086:0b07) [ 1607.654340][ T9] uvcvideo 4-1:220.0: No valid video chain found. [ 1607.685042][ T9] usb 4-1: USB disconnect, device number 31 [ 1607.723108][T23277] usb 9-1: USB disconnect, device number 34 [ 1607.834191][T22837] udevd[22837]: error opening ATTR{/sys/devices/platform/dummy_hcd.8/usb9/9-1/9-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1607.952719][T25580] netlink: 32 bytes leftover after parsing attributes in process `syz.0.5781'. [ 1608.190578][T25591] comedi comedi4: comedi_config --init_data is deprecated [ 1608.297477][T25593] MTD: Attempt to mount non-MTD device "/dev/loop3" [ 1608.814566][T25593] smbdirect: ib_dev[syz1] renamed to [syz0] [ 1608.997105][ T5723] gspca_stv0680: usb_control_msg error 2, request = 0x6, error = -110 [ 1608.998498][ T5723] gspca_stv0680: usb_control_msg error 0, request = 0x80, error = -32 [ 1608.998522][ T5723] stv0680 10-1:4.0: last error: 86, command = 0x78 [ 1609.174649][ T5723] usb 10-1: USB disconnect, device number 2 [ 1609.635996][ T822] usb 9-1: new high-speed USB device number 35 using dummy_hcd [ 1609.786769][ T822] usb 9-1: Using ep0 maxpacket: 8 [ 1609.791031][ T822] usb 9-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1609.791063][ T822] usb 9-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1609.791090][ T822] usb 9-1: config 16 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 1609.791134][ T822] usb 9-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1609.791159][ T822] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1609.874369][ T822] usbtmc 9-1:16.0: bulk endpoints not found [ 1609.916054][ T5679] usb 4-1: new full-speed USB device number 32 using dummy_hcd [ 1610.205711][ T822] usb 10-1: new high-speed USB device number 3 using dummy_hcd [ 1610.355668][ T822] usb 10-1: Using ep0 maxpacket: 16 [ 1610.357985][ T822] usb 10-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1610.358023][ T822] usb 10-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1610.360558][ T822] usb 10-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1610.360593][ T822] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1610.360620][ T822] usb 10-1: Product: syz [ 1610.360631][ T822] usb 10-1: Manufacturer: syz [ 1610.360642][ T822] usb 10-1: SerialNumber: syz [ 1610.445886][ T822] usb 10-1: 0:2 : does not exist [ 1610.652354][ T822] usb 10-1: 5:0: failed to get current value for ch 0 (-22) [ 1610.712808][ T822] usb 10-1: USB disconnect, device number 3 [ 1610.782973][T22837] udevd[22837]: error opening ATTR{/sys/devices/platform/dummy_hcd.9/usb10/10-1/10-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1611.245801][ T5679] usb 4-1: new high-speed USB device number 33 using dummy_hcd [ 1611.398979][ T5679] usb 4-1: config 220 has an invalid interface number: 76 but max is 2 [ 1611.399011][ T5679] usb 4-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 1611.399034][ T5679] usb 4-1: config 220 has 2 interfaces, different from the descriptor's value: 3 [ 1611.399056][ T5679] usb 4-1: config 220 has no interface number 1 [ 1611.399088][ T5679] usb 4-1: config 220 interface 0 has no altsetting 0 [ 1611.399101][ T5679] usb 4-1: config 220 interface 76 has no altsetting 0 [ 1611.401801][ T5679] usb 4-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 1611.401832][ T5679] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1611.401854][ T5679] usb 4-1: Product: syz [ 1611.401871][ T5679] usb 4-1: Manufacturer: syz [ 1611.401888][ T5679] usb 4-1: SerialNumber: syz [ 1611.677806][T25631] netlink: 1752 bytes leftover after parsing attributes in process `syz.9.5794'. [ 1611.721468][ T5679] uvcvideo 4-1:220.0: Found UVC 7.01 device syz (8086:0b07) [ 1611.721497][ T5679] uvcvideo 4-1:220.0: No valid video chain found. [ 1611.755212][ T5679] usb 4-1: USB disconnect, device number 33 [ 1611.961441][T25635] netlink: 5 bytes leftover after parsing attributes in process `syz.9.5795'. [ 1612.518901][ T5723] usb 9-1: USB disconnect, device number 35 [ 1612.665724][ T5699] usb 4-1: new high-speed USB device number 34 using dummy_hcd [ 1612.791706][ T37] audit: type=1800 audit(2000000136.630:327): pid=25646 uid=0 auid=4294967295 ses=4294967295 op=collect_data cause=failed(directio) comm="syz.8.5800" name="file0" dev="overlay" ino=1203 res=0 errno=0 [ 1612.877879][ T5699] usb 4-1: unable to get BOS descriptor or descriptor too short [ 1612.879254][ T5699] usb 4-1: config 3 has an invalid interface number: 73 but max is 1 [ 1612.879281][ T5699] usb 4-1: config 3 has no interface number 1 [ 1612.879341][ T5699] usb 4-1: config 3 interface 73 altsetting 14 endpoint 0x2 has an invalid bInterval 136, changing to 7 [ 1612.879369][ T5699] usb 4-1: config 3 interface 0 has no altsetting 0 [ 1612.879387][ T5699] usb 4-1: config 3 interface 73 has no altsetting 0 [ 1612.895278][T25646] overlay: filesystem on ./file1 not supported as upperdir [ 1612.940374][ T5699] usb 4-1: string descriptor 0 read error: -22 [ 1612.940509][ T5699] usb 4-1: New USB device found, idVendor=07ca, idProduct=2835, bcdDevice=eb.e7 [ 1612.940536][ T5699] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1613.028914][ T5699] usb 4-1: dvb_usb_v2: usb_bulk_msg() failed=-22 [ 1613.029153][ T5699] dvb_usb_af9035 4-1:3.0: probe with driver dvb_usb_af9035 failed with error -22 [ 1614.415059][T25669] bridge0: entered promiscuous mode [ 1615.095764][ T9] usb 9-1: new high-speed USB device number 36 using dummy_hcd [ 1615.248820][ T9] usb 9-1: config 220 has an invalid interface number: 76 but max is 2 [ 1615.248843][ T9] usb 9-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 1615.248859][ T9] usb 9-1: config 220 has no interface number 2 [ 1615.248898][ T9] usb 9-1: too many endpoints for config 220 interface 1 altsetting 5: 255, using maximum allowed: 30 [ 1615.248926][ T9] usb 9-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 255 [ 1615.248946][ T9] usb 9-1: config 220 interface 0 has no altsetting 0 [ 1615.248959][ T9] usb 9-1: config 220 interface 76 has no altsetting 0 [ 1615.248973][ T9] usb 9-1: config 220 interface 1 has no altsetting 0 [ 1615.251987][ T9] usb 9-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 1615.252020][ T9] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1615.252042][ T9] usb 9-1: Product: syz [ 1615.252058][ T9] usb 9-1: Manufacturer: syz [ 1615.252074][ T9] usb 9-1: SerialNumber: syz [ 1615.392429][ T5723] usb 4-1: USB disconnect, device number 34 [ 1615.599522][ T9] uvcvideo 9-1:220.0: Found UVC 7.01 device syz (8086:0b07) [ 1615.599550][ T9] uvcvideo 9-1:220.0: No valid video chain found. [ 1615.627387][ T9] usb 9-1: USB disconnect, device number 36 [ 1615.825826][ T5723] usb 4-1: new high-speed USB device number 35 using dummy_hcd [ 1615.976738][ T5723] usb 4-1: Using ep0 maxpacket: 8 [ 1615.978903][ T5723] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1615.978934][ T5723] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1615.978953][ T5723] usb 4-1: config 16 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 1615.978986][ T5723] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1615.979004][ T5723] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1616.054324][ T5723] usbtmc 4-1:16.0: bulk endpoints not found [ 1616.386316][T25656] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1616.960244][T25693] FAULT_INJECTION: forcing a failure. [ 1616.960244][T25693] name failslab, interval 1, probability 0, space 0, times 0 [ 1616.960286][T25693] CPU: 1 UID: 0 PID: 25693 Comm: syz.8.5813 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1616.960319][T25693] Tainted: [L]=SOFTLOCKUP [ 1616.960328][T25693] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1616.960341][T25693] Call Trace: [ 1616.960351][T25693] [ 1616.960361][T25693] dump_stack_lvl+0xe8/0x150 [ 1616.960397][T25693] should_fail_ex+0x467/0x600 [ 1616.960433][T25693] should_failslab+0xa8/0x100 [ 1616.960458][T25693] __kvmalloc_node_noprof+0x176/0x880 [ 1616.960493][T25693] ? __kmalloc_cache_noprof+0x3cd/0x670 [ 1616.960529][T25693] ? io_alloc_cache_init+0x42/0x140 [ 1616.960559][T25693] ? io_alloc_cache_init+0x42/0x140 [ 1616.960597][T25693] io_alloc_cache_init+0x42/0x140 [ 1616.960631][T25693] io_ring_ctx_alloc+0x57a/0xba0 [ 1616.960666][T25693] io_uring_create+0x50/0x990 [ 1616.960694][T25693] __se_sys_io_uring_setup+0x2a8/0x2c0 [ 1616.960731][T25693] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 1616.960772][T25693] ? __pfx___se_sys_io_uring_setup+0x10/0x10 [ 1616.960822][T25693] ? __pfx_ksys_write+0x10/0x10 [ 1616.960862][T25693] do_syscall_64+0x17b/0x530 [ 1616.960885][T25693] ? irqentry_exit+0x10f/0x8f0 [ 1616.960911][T25693] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1616.960935][T25693] ? clear_bhb_loop+0x40/0x90 [ 1616.960964][T25693] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1616.960988][T25693] RIP: 0033:0x7f1162f3e019 [ 1616.961010][T25693] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1616.961030][T25693] RSP: 002b:00007f1161195ee8 EFLAGS: 00000206 ORIG_RAX: 00000000000001a9 [ 1616.961055][T25693] RAX: ffffffffffffffda RBX: 0000200000000a88 RCX: 00007f1162f3e019 [ 1616.961072][T25693] RDX: 0000200000000b08 RSI: 0000200000000a88 RDI: 00000000000003c9 [ 1616.961087][T25693] RBP: 0000200000000a80 R08: 0000000000000000 R09: 0000000000000000 [ 1616.961101][T25693] R10: 0000200000000b10 R11: 0000000000000206 R12: 0000200000000b08 [ 1616.961117][T25693] R13: 0000200000000b10 R14: 00007f1161195fd8 R15: 0000000000000000 [ 1616.961151][T25693] [ 1617.545887][ T822] usb 9-1: new high-speed USB device number 37 using dummy_hcd [ 1617.705685][ T822] usb 9-1: Using ep0 maxpacket: 16 [ 1617.709453][ T822] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1617.709481][ T822] usb 9-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1617.714368][ T822] usb 9-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1617.714531][ T822] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1617.714555][ T822] usb 9-1: Product: syz [ 1617.714572][ T822] usb 9-1: Manufacturer: syz [ 1617.714589][ T822] usb 9-1: SerialNumber: syz [ 1617.822822][ T822] usb 9-1: 0:2 : does not exist [ 1618.055026][ T822] usb 9-1: 5:0: failed to get current value for ch 0 (-22) [ 1618.171420][ T822] usb 9-1: USB disconnect, device number 37 [ 1618.233825][T22837] udevd[22837]: error opening ATTR{/sys/devices/platform/dummy_hcd.8/usb9/9-1/9-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1618.304068][ T37] audit: type=1326 audit(2000000142.140:328): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=25700 comm="syz.9.5816" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fe22ce4e019 code=0x0 [ 1618.524600][ T5679] usb 4-1: USB disconnect, device number 35 [ 1618.915816][T23277] usb 9-1: new high-speed USB device number 38 using dummy_hcd [ 1619.026316][ T5679] usb 4-1: new high-speed USB device number 36 using dummy_hcd [ 1619.087725][T23277] usb 9-1: config 220 has an invalid interface number: 76 but max is 2 [ 1619.087756][T23277] usb 9-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 1619.087778][T23277] usb 9-1: config 220 has no interface number 2 [ 1619.087833][T23277] usb 9-1: too many endpoints for config 220 interface 1 altsetting 5: 255, using maximum allowed: 30 [ 1619.087861][T23277] usb 9-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 255 [ 1619.087882][T23277] usb 9-1: config 220 interface 0 has no altsetting 0 [ 1619.087895][T23277] usb 9-1: config 220 interface 76 has no altsetting 0 [ 1619.087909][T23277] usb 9-1: config 220 interface 1 has no altsetting 0 [ 1619.090881][T23277] usb 9-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 1619.090912][T23277] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1619.090949][T23277] usb 9-1: Product: syz [ 1619.090960][T23277] usb 9-1: Manufacturer: syz [ 1619.090972][T23277] usb 9-1: SerialNumber: syz [ 1619.275906][ T5679] usb 4-1: Using ep0 maxpacket: 16 [ 1619.280450][ T5679] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 241, changing to 7 [ 1619.280503][ T5679] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 121, changing to 7 [ 1619.283655][ T5679] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1619.283685][ T5679] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1619.283708][ T5679] usb 4-1: Product: é¤îµŽï½‘ [ 1619.283723][ T5679] usb 4-1: Manufacturer: êµìŽ¹í‚¾ê©²î€­é‚¬á§‹ [ 1619.283739][ T5679] usb 4-1: SerialNumber: 〠[ 1619.401798][T23277] uvcvideo 9-1:220.0: Found UVC 7.01 device syz (8086:0b07) [ 1619.401842][T23277] uvcvideo 9-1:220.0: No valid video chain found. [ 1619.474490][T23277] usb 9-1: USB disconnect, device number 38 [ 1619.594840][T25707] netlink: 'syz.3.5817': attribute type 21 has an invalid length. [ 1619.595179][T25707] netlink: 13 bytes leftover after parsing attributes in process `syz.3.5817'. [ 1619.641490][ T5679] usb 4-1: 1:1: invalid format type 0x1002 is detected, processed as PCM [ 1619.641525][ T5679] usb 4-1: 1:1 : sample bitwidth 192 in over sample bytes 2 [ 1619.641551][ T5679] usb 4-1: 1:1 : invalid UAC_FORMAT_TYPE desc [ 1619.642103][ T5679] usb 4-1: 2:1: invalid format type 0x1002 is detected, processed as PCM [ 1619.642150][ T5679] usb 4-1: 2:1 : invalid UAC_FORMAT_TYPE desc [ 1619.732182][ T5679] usb 4-1: USB disconnect, device number 36 [ 1619.798025][T22837] udevd[22837]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1619.961781][T25716] netlink: 'syz.8.5821': attribute type 4 has an invalid length. [ 1620.043805][T25718] FAULT_INJECTION: forcing a failure. [ 1620.043805][T25718] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1620.043844][T25718] CPU: 1 UID: 0 PID: 25718 Comm: syz.0.5822 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1620.043875][T25718] Tainted: [L]=SOFTLOCKUP [ 1620.043884][T25718] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1620.043906][T25718] Call Trace: [ 1620.043915][T25718] [ 1620.043925][T25718] dump_stack_lvl+0xe8/0x150 [ 1620.043961][T25718] should_fail_ex+0x467/0x600 [ 1620.043995][T25718] _copy_from_user+0x2d/0xb0 [ 1620.044019][T25718] input_event_from_user+0xb1/0x290 [ 1620.044049][T25718] ? __pfx_input_event_from_user+0x10/0x10 [ 1620.044081][T25718] ? rt_spin_unlock+0x163/0x200 [ 1620.044115][T25718] evdev_write+0x2ca/0x4c0 [ 1620.044138][T25718] ? __lock_acquire+0x6df/0x2e40 [ 1620.044165][T25718] ? __pfx_evdev_write+0x10/0x10 [ 1620.044190][T25718] ? bpf_lsm_file_permission+0x9/0x20 [ 1620.044223][T25718] ? security_file_permission+0x68/0x220 [ 1620.044251][T25718] ? rw_verify_area+0x209/0x4d0 [ 1620.044280][T25718] ? __pfx_evdev_write+0x10/0x10 [ 1620.044302][T25718] vfs_write+0x29f/0xbb0 [ 1620.044338][T25718] ? __pfx_vfs_write+0x10/0x10 [ 1620.044366][T25718] ? __fget_files+0x2a/0x420 [ 1620.044393][T25718] ? __fget_files+0x2a/0x420 [ 1620.044415][T25718] ? __fget_files+0x3a8/0x420 [ 1620.044437][T25718] ? __fget_files+0x2a/0x420 [ 1620.044475][T25718] ksys_write+0x156/0x270 [ 1620.044504][T25718] ? __pfx_ksys_write+0x10/0x10 [ 1620.044542][T25718] do_syscall_64+0x17b/0x530 [ 1620.044564][T25718] ? irqentry_exit+0x10f/0x8f0 [ 1620.044586][T25718] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1620.044610][T25718] ? clear_bhb_loop+0x40/0x90 [ 1620.044638][T25718] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1620.044661][T25718] RIP: 0033:0x7fbbbf6be019 [ 1620.044682][T25718] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1620.044702][T25718] RSP: 002b:00007fbbbd916028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1620.044727][T25718] RAX: ffffffffffffffda RBX: 00007fbbbf945fa0 RCX: 00007fbbbf6be019 [ 1620.044744][T25718] RDX: 0000000000002250 RSI: 0000200000000040 RDI: 0000000000000003 [ 1620.044760][T25718] RBP: 00007fbbbd916090 R08: 0000000000000000 R09: 0000000000000000 [ 1620.044775][T25718] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1620.044790][T25718] R13: 00007fbbbf946038 R14: 00007fbbbf945fa0 R15: 00007ffda5b57258 [ 1620.044825][T25718] [ 1620.334496][T25720] FAULT_INJECTION: forcing a failure. [ 1620.334496][T25720] name failslab, interval 1, probability 0, space 0, times 0 [ 1620.334538][T25720] CPU: 1 UID: 0 PID: 25720 Comm: syz.8.5823 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1620.334569][T25720] Tainted: [L]=SOFTLOCKUP [ 1620.334578][T25720] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1620.334593][T25720] Call Trace: [ 1620.334602][T25720] [ 1620.334612][T25720] dump_stack_lvl+0xe8/0x150 [ 1620.334649][T25720] should_fail_ex+0x467/0x600 [ 1620.334694][T25720] should_failslab+0xa8/0x100 [ 1620.334719][T25720] __kmalloc_noprof+0xfb/0x790 [ 1620.334755][T25720] ? xprt_alloc+0x30/0x910 [ 1620.334789][T25720] ? xprt_alloc+0x30/0x910 [ 1620.334830][T25720] xprt_alloc+0x30/0x910 [ 1620.334864][T25720] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1620.334888][T25720] ? lockdep_hardirqs_on+0x7a/0x110 [ 1620.334914][T25720] xs_setup_xprt+0x9e/0x390 [ 1620.334943][T25720] xs_setup_tcp+0xdf/0x920 [ 1620.334976][T25720] ? __pfx_xs_setup_tcp+0x10/0x10 [ 1620.335007][T25720] ? rt_spin_unlock+0x157/0x200 [ 1620.335043][T25720] ? rt_spin_unlock+0x163/0x200 [ 1620.335077][T25720] xprt_create_transport+0x166/0x5f0 [ 1620.335118][T25720] rpc_create+0x4ff/0x900 [ 1620.335158][T25720] ? __pfx_rpc_create+0x10/0x10 [ 1620.335234][T25720] ? net_generic+0x1e/0x240 [ 1620.335257][T25720] ? net_generic+0x1e/0x240 [ 1620.335277][T25720] ? nfs_create_rpc_client+0x2e9/0x780 [ 1620.335308][T25720] nfs_create_rpc_client+0x571/0x780 [ 1620.335336][T25720] ? __pfx_nfs_create_rpc_client+0x10/0x10 [ 1620.335382][T25720] ? __rt_spin_lock_init+0x3e/0x50 [ 1620.335413][T25720] ? __init_waitqueue_head+0xad/0x160 [ 1620.335458][T25720] nfs4_alloc_client+0x85d/0xcc0 [ 1620.335487][T25720] ? __pfx_nfs4_alloc_client+0x10/0x10 [ 1620.335518][T25720] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 1620.335556][T25720] ? rt_spin_unlock+0x157/0x200 [ 1620.335591][T25720] ? rt_spin_unlock+0x163/0x200 [ 1620.335630][T25720] nfs_get_client+0xbf7/0xfc0 [ 1620.335664][T25720] ? timer_init_key+0x161/0x2c0 [ 1620.335708][T25720] nfs4_set_client+0x365/0x560 [ 1620.335737][T25720] nfs4_create_server+0x538/0x1120 [ 1620.335769][T25720] ? __pfx_nfs4_create_server+0x10/0x10 [ 1620.335799][T25720] ? rt_read_unlock+0x173/0x340 [ 1620.335848][T25720] ? nfs_get_tree+0x11a9/0x1650 [ 1620.335878][T25720] nfs4_try_get_tree+0x49/0x110 [ 1620.335906][T25720] vfs_get_tree+0x92/0x2a0 [ 1620.335938][T25720] vfs_cmd_create+0xa2/0x200 [ 1620.335975][T25720] __se_sys_fsconfig+0x6bf/0x810 [ 1620.336014][T25720] ? __pfx___se_sys_fsconfig+0x10/0x10 [ 1620.336045][T25720] ? ksys_write+0x248/0x270 [ 1620.336075][T25720] ? __pfx_ksys_write+0x10/0x10 [ 1620.336108][T25720] ? __x64_sys_fsconfig+0x20/0xc0 [ 1620.336143][T25720] do_syscall_64+0x17b/0x530 [ 1620.336166][T25720] ? irqentry_exit+0x10f/0x8f0 [ 1620.336188][T25720] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1620.336212][T25720] ? clear_bhb_loop+0x40/0x90 [ 1620.336241][T25720] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1620.336264][T25720] RIP: 0033:0x7f1162f3e019 [ 1620.336286][T25720] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1620.336305][T25720] RSP: 002b:00007f1161196028 EFLAGS: 00000246 ORIG_RAX: 00000000000001af [ 1620.336328][T25720] RAX: ffffffffffffffda RBX: 00007f11631c5fa0 RCX: 00007f1162f3e019 [ 1620.336346][T25720] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000004 [ 1620.336359][T25720] RBP: 00007f1161196090 R08: 0000000000000000 R09: 0000000000000000 [ 1620.336373][T25720] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1620.336386][T25720] R13: 00007f11631c6038 R14: 00007f11631c5fa0 R15: 00007fff40733928 [ 1620.336423][T25720] [ 1620.867205][T25723] netlink: 20 bytes leftover after parsing attributes in process `syz.3.5824'. [ 1621.288982][T25730] netlink: 20 bytes leftover after parsing attributes in process `syz.3.5824'. [ 1621.295487][T25730] nbd: nbd64 already in use [ 1621.449991][T22903] usb 9-1: new high-speed USB device number 39 using dummy_hcd [ 1621.674028][T22903] usb 9-1: config 220 has an invalid interface number: 76 but max is 2 [ 1621.674063][T22903] usb 9-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 1621.674087][T22903] usb 9-1: config 220 has no interface number 2 [ 1621.674176][T22903] usb 9-1: too many endpoints for config 220 interface 1 altsetting 5: 255, using maximum allowed: 30 [ 1621.674234][T22903] usb 9-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 255 [ 1621.674266][T22903] usb 9-1: config 220 interface 0 has no altsetting 0 [ 1621.674287][T22903] usb 9-1: config 220 interface 76 has no altsetting 0 [ 1621.674308][T22903] usb 9-1: config 220 interface 1 has no altsetting 0 [ 1621.781599][T22903] usb 9-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 1621.781638][T22903] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1621.781663][T22903] usb 9-1: Product: syz [ 1621.781682][T22903] usb 9-1: Manufacturer: syz [ 1621.781700][T22903] usb 9-1: SerialNumber: syz [ 1622.067920][T22903] uvcvideo 9-1:220.0: Found UVC 7.01 device syz (8086:0b07) [ 1622.067959][T22903] uvcvideo 9-1:220.0: No valid video chain found. [ 1622.111283][T22903] usb 9-1: USB disconnect, device number 39 [ 1622.291495][T25743] max out of range [ 1622.786008][T22903] usb 4-1: new high-speed USB device number 37 using dummy_hcd [ 1622.965641][T22903] usb 4-1: Using ep0 maxpacket: 16 [ 1622.967736][T22903] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1622.967761][T22903] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1622.969938][T22903] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1622.969965][T22903] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1622.969983][T22903] usb 4-1: Product: syz [ 1622.969996][T22903] usb 4-1: Manufacturer: syz [ 1622.970010][T22903] usb 4-1: SerialNumber: syz [ 1623.062029][T22903] usb 4-1: 0:2 : does not exist [ 1623.309586][T22903] usb 4-1: 5:0: failed to get current value for ch 0 (-22) [ 1623.598518][T22903] usb 4-1: USB disconnect, device number 37 [ 1623.681768][T25757] nbd: illegal input index -639123611 [ 1623.754123][T22837] udevd[22837]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1624.771081][ T5679] usb 10-1: new high-speed USB device number 4 using dummy_hcd [ 1625.085719][ T5679] usb 10-1: Using ep0 maxpacket: 16 [ 1625.088436][ T5679] usb 10-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1625.088470][ T5679] usb 10-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1625.093016][ T5679] usb 10-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1625.093056][ T5679] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1625.093077][ T5679] usb 10-1: Product: syz [ 1625.093093][ T5679] usb 10-1: Manufacturer: syz [ 1625.093109][ T5679] usb 10-1: SerialNumber: syz [ 1625.180137][ T5679] usb 10-1: 0:2 : does not exist [ 1625.315739][T22903] usb 9-1: new high-speed USB device number 40 using dummy_hcd [ 1625.374986][ T5679] usb 10-1: 5:0: failed to get current value for ch 0 (-22) [ 1625.435333][ T5679] usb 10-1: USB disconnect, device number 4 [ 1625.468723][T22903] usb 9-1: config 220 has an invalid interface number: 76 but max is 2 [ 1625.468757][T22903] usb 9-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 1625.468780][T22903] usb 9-1: config 220 has no interface number 2 [ 1625.468850][T22903] usb 9-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 1625.468880][T22903] usb 9-1: config 220 interface 0 has no altsetting 0 [ 1625.468898][T22903] usb 9-1: config 220 interface 76 has no altsetting 0 [ 1625.468918][T22903] usb 9-1: config 220 interface 1 has no altsetting 0 [ 1625.472103][T22903] usb 9-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 1625.472137][T22903] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1625.472158][T22903] usb 9-1: Product: syz [ 1625.472174][T22903] usb 9-1: Manufacturer: syz [ 1625.472189][T22903] usb 9-1: SerialNumber: syz [ 1625.638986][T22837] udevd[22837]: error opening ATTR{/sys/devices/platform/dummy_hcd.9/usb10/10-1/10-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1625.850613][T22903] uvcvideo 9-1:220.0: Found UVC 7.01 device syz (8086:0b07) [ 1625.850653][T22903] uvcvideo 9-1:220.0: No valid video chain found. [ 1625.930678][T22903] usb 9-1: USB disconnect, device number 40 [ 1626.295809][ T5679] usb 4-1: new high-speed USB device number 38 using dummy_hcd [ 1626.447480][ T5679] usb 4-1: Using ep0 maxpacket: 8 [ 1626.450604][ T5679] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8D has an invalid bInterval 42, changing to 9 [ 1626.450635][ T5679] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1626.450652][ T5679] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1626.450669][ T5679] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 173 [ 1626.450862][ T5679] usb 4-1: New USB device found, idVendor=05ac, idProduct=8215, bcdDevice=8f.58 [ 1626.450890][ T5679] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1626.455370][ T5679] usb 4-1: config 0 descriptor?? [ 1626.529810][T25786] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 1626.700375][T25405] usb 9-1: new high-speed USB device number 41 using dummy_hcd [ 1626.931143][ T5602] Bluetooth: hci4: Opcode 0x0c03 failed: -71 [ 1626.961899][ T5679] usb 4-1: USB disconnect, device number 38 [ 1626.975815][T25405] usb 9-1: Using ep0 maxpacket: 16 [ 1626.984989][T25405] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1626.985026][T25405] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1627.015720][T25405] usb 9-1: New USB device found, idVendor=041e, idProduct=3100, bcdDevice= 0.00 [ 1627.015756][T25405] usb 9-1: New USB device strings: Mfr=34, Product=0, SerialNumber=0 [ 1627.015779][T25405] usb 9-1: Manufacturer: syz [ 1627.029379][T25405] usb 9-1: config 0 descriptor?? [ 1627.502523][T25405] creative-sb0540 0003:041E:3100.003E: unknown main item tag 0x0 [ 1627.505607][T25405] creative-sb0540 0003:041E:3100.003E: unknown main item tag 0x0 [ 1627.505642][T25405] creative-sb0540 0003:041E:3100.003E: unknown main item tag 0x0 [ 1627.505670][T25405] creative-sb0540 0003:041E:3100.003E: unknown main item tag 0x0 [ 1627.505697][T25405] creative-sb0540 0003:041E:3100.003E: unknown main item tag 0x0 [ 1627.515734][ T5723] usb 10-1: new high-speed USB device number 5 using dummy_hcd [ 1627.552889][T25405] creative-sb0540 0003:041E:3100.003E: hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.8-1/input0 [ 1627.715390][T25405] usb 9-1: USB disconnect, device number 41 [ 1627.780823][ T5723] usb 10-1: Using ep0 maxpacket: 16 [ 1627.784745][ T5723] usb 10-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1627.784775][ T5723] usb 10-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1627.830553][ T5723] usb 10-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1627.830588][ T5723] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1627.830611][ T5723] usb 10-1: Product: syz [ 1627.830627][ T5723] usb 10-1: Manufacturer: syz [ 1627.830643][ T5723] usb 10-1: SerialNumber: syz [ 1627.888878][ T5723] usb 10-1: 0:2 : does not exist [ 1627.961969][T25796] fido_id[25796]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.8/usb9/report_descriptor': No such file or directory [ 1628.110560][T25795] tmpfs: Bad value for 'size' [ 1628.130152][ T5723] usb 10-1: 5:0: failed to get current value for ch 0 (-22) [ 1628.211060][ T5723] usb 10-1: USB disconnect, device number 5 [ 1628.339962][T22837] udevd[22837]: error opening ATTR{/sys/devices/platform/dummy_hcd.9/usb10/10-1/10-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1628.707295][T25405] usb 4-1: new high-speed USB device number 39 using dummy_hcd [ 1628.865754][T25405] usb 4-1: Using ep0 maxpacket: 16 [ 1628.868211][T25405] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1628.868247][T25405] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1628.869541][T25405] usb 4-1: New USB device found, idVendor=041e, idProduct=3100, bcdDevice= 0.00 [ 1628.869571][T25405] usb 4-1: New USB device strings: Mfr=34, Product=0, SerialNumber=0 [ 1628.869594][T25405] usb 4-1: Manufacturer: syz [ 1628.875365][T25405] usb 4-1: config 0 descriptor?? [ 1629.312564][T25405] creative-sb0540 0003:041E:3100.003F: unknown main item tag 0x0 [ 1629.312603][T25405] creative-sb0540 0003:041E:3100.003F: unknown main item tag 0x0 [ 1629.312628][T25405] creative-sb0540 0003:041E:3100.003F: unknown main item tag 0x0 [ 1629.312654][T25405] creative-sb0540 0003:041E:3100.003F: unknown main item tag 0x0 [ 1629.312681][T25405] creative-sb0540 0003:041E:3100.003F: unknown main item tag 0x0 [ 1629.320667][T25405] creative-sb0540 0003:041E:3100.003F: hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.3-1/input0 [ 1629.426009][ T5723] usb 9-1: new high-speed USB device number 42 using dummy_hcd [ 1629.503828][ T9] usb 4-1: USB disconnect, device number 39 [ 1629.598429][ T5723] usb 9-1: config 220 has an invalid interface number: 76 but max is 2 [ 1629.598462][ T5723] usb 9-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 1629.598485][ T5723] usb 9-1: config 220 has no interface number 2 [ 1629.598549][ T5723] usb 9-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 1629.598570][ T5723] usb 9-1: config 220 interface 0 has no altsetting 0 [ 1629.598584][ T5723] usb 9-1: config 220 interface 76 has no altsetting 0 [ 1629.598598][ T5723] usb 9-1: config 220 interface 1 has no altsetting 0 [ 1629.606749][ T5723] usb 9-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 1629.606786][ T5723] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1629.606810][ T5723] usb 9-1: Product: syz [ 1629.606827][ T5723] usb 9-1: Manufacturer: syz [ 1629.606844][ T5723] usb 9-1: SerialNumber: syz [ 1629.782606][T25822] nfs: Unknown parameter 'smackfsflŸ®§— ¨' [ 1629.922436][T25819] binder: 25818:25819 ioctl c0306201 200000000680 returned -14 [ 1630.025831][ T5723] uvcvideo 9-1:220.0: Found UVC 7.01 device syz (8086:0b07) [ 1630.025870][ T5723] uvcvideo 9-1:220.0: No valid video chain found. [ 1630.063446][ T5723] usb 9-1: USB disconnect, device number 42 [ 1630.445823][ T5679] usb 10-1: new high-speed USB device number 6 using dummy_hcd [ 1630.601903][ T5679] usb 10-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 1630.601963][ T5679] usb 10-1: New USB device found, idVendor=041e, idProduct=4007, bcdDevice=5d.18 [ 1630.601982][ T5679] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1630.641328][ T5679] gspca_main: stv0680-2.14.0 probing 041e:4007 [ 1631.863599][ T5723] usb 4-1: new high-speed USB device number 40 using dummy_hcd [ 1631.920849][T25836] netlink: 'syz.8.5868': attribute type 37 has an invalid length. [ 1632.029333][ T5723] usb 4-1: Using ep0 maxpacket: 16 [ 1632.034878][ T5723] usb 4-1: New USB device found, idVendor=0483, idProduct=1234, bcdDevice=ff.76 [ 1632.034913][ T5723] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1632.034937][ T5723] usb 4-1: Product: syz [ 1632.034954][ T5723] usb 4-1: Manufacturer: syz [ 1632.034979][ T5723] usb 4-1: SerialNumber: syz [ 1632.082072][ T5723] usb 4-1: config 0 descriptor?? [ 1632.180358][ T5679] gspca_stv0680: usb_control_msg error 2, request = 0x6, error = -71 [ 1632.180810][ T5679] gspca_stv0680: usb_control_msg error 0, request = 0x80, error = -71 [ 1632.180830][ T5679] stv0680 10-1:4.0: last error: 86, command = 0x78 [ 1632.209305][ T5679] usb 10-1: USB disconnect, device number 6 [ 1632.299440][T25833] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1632.302375][T25833] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1632.605681][ T5699] usb 9-1: new high-speed USB device number 43 using dummy_hcd [ 1632.793024][ T5723] usb_8dev 4-1:0.0 can0: sending command message failed [ 1632.793045][ T5723] usb_8dev 4-1:0.0 can0: can't get firmware version [ 1632.806487][ T5699] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1632.806538][ T5699] usb 9-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 1632.806560][ T5699] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1632.819695][ T5699] usb 9-1: config 0 descriptor?? [ 1633.076992][ T5723] usb_8dev 4-1:0.0: probe with driver usb_8dev failed with error -22 [ 1633.077147][ T5699] usbhid 9-1:0.0: can't add hid device: -71 [ 1633.077241][ T5699] usbhid 9-1:0.0: probe with driver usbhid failed with error -71 [ 1633.082692][ T5699] usb 9-1: USB disconnect, device number 43 [ 1633.136009][ T5723] usb 4-1: USB disconnect, device number 40 [ 1633.196942][ T5679] usb 10-1: new high-speed USB device number 7 using dummy_hcd [ 1633.355708][ T5679] usb 10-1: Using ep0 maxpacket: 16 [ 1633.358508][ T5679] usb 10-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1633.358531][ T5679] usb 10-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1633.363583][ T5679] usb 10-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1633.363618][ T5679] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1633.363642][ T5679] usb 10-1: Product: syz [ 1633.363658][ T5679] usb 10-1: Manufacturer: syz [ 1633.363674][ T5679] usb 10-1: SerialNumber: syz [ 1633.454112][ T5679] usb 10-1: 0:2 : does not exist [ 1633.545570][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 1633.565577][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 1633.575573][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 1633.585580][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 1633.595574][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 1633.605567][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 1633.615558][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 1633.625561][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 1633.635562][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 1633.645558][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 1633.851276][ T5699] usb 9-1: new high-speed USB device number 44 using dummy_hcd [ 1633.863386][ T5679] usb 10-1: 5:0: failed to get current value for ch 0 (-22) [ 1633.920907][ T5679] usb 10-1: USB disconnect, device number 7 [ 1633.953769][T25854] CIFS: bad ip= option (127®0.0.1) [ 1633.954342][T25854] CIFS: Attempting to mount (null) [ 1634.104233][T25854] CIFS: VFS: Error connecting to socket. Aborting operation. [ 1634.104299][T25854] CIFS: VFS: cifs_mount failed w/return code = -111 [ 1634.125134][ T5699] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1634.125173][ T5699] usb 9-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.40 [ 1634.125191][ T5699] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1634.171259][ T5699] usb 9-1: config 0 descriptor?? [ 1634.235190][T22837] udevd[22837]: error opening ATTR{/sys/devices/platform/dummy_hcd.9/usb10/10-1/10-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1634.832596][T25845] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1634.833290][T25845] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1635.026626][ T5699] aiptek 9-1:0.0: Aiptek using 400 ms programming speed [ 1635.034197][ T5699] input: Aiptek as /devices/platform/dummy_hcd.8/usb9/9-1/9-1:0.0/input/input65 [ 1635.925742][ C0] aiptek 9-1:0.0: aiptek_irq - usb_submit_urb failed with result -19 [ 1635.926013][ T5679] usb 9-1: USB disconnect, device number 44 [ 1637.635814][T23277] usb 10-1: new high-speed USB device number 8 using dummy_hcd [ 1637.717431][T25909] netlink: 48 bytes leftover after parsing attributes in process `syz.3.5891'. [ 1637.786546][T23277] usb 10-1: Using ep0 maxpacket: 16 [ 1637.789454][T23277] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1637.789488][T23277] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1637.815848][T23277] usb 10-1: New USB device found, idVendor=041e, idProduct=3100, bcdDevice= 0.00 [ 1637.815881][T23277] usb 10-1: New USB device strings: Mfr=34, Product=0, SerialNumber=0 [ 1637.815905][T23277] usb 10-1: Manufacturer: syz [ 1637.845419][T23277] usb 10-1: config 0 descriptor?? [ 1637.845735][ T5699] usb 9-1: new full-speed USB device number 45 using dummy_hcd [ 1638.012679][ T5699] usb 9-1: too many configurations: 253, using maximum allowed: 8 [ 1638.014216][ T5699] usb 9-1: config 0 has no interfaces? [ 1638.032931][ T5699] usb 9-1: config 0 has no interfaces? [ 1638.034594][ T5699] usb 9-1: config 0 has no interfaces? [ 1638.047691][ T5699] usb 9-1: config 0 has no interfaces? [ 1638.068022][ T5699] usb 9-1: config 0 has no interfaces? [ 1638.071360][ T5699] usb 9-1: config 0 has no interfaces? [ 1638.073751][ T5699] usb 9-1: config 0 has no interfaces? [ 1638.078021][ T5699] usb 9-1: config 0 has no interfaces? [ 1638.078061][ T5699] usb 9-1: New USB device found, idVendor=046d, idProduct=c293, bcdDevice= 0.00 [ 1638.078151][ T5699] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1638.164508][ T5699] usb 9-1: config 0 descriptor?? [ 1638.277936][T23277] creative-sb0540 0003:041E:3100.0040: unknown main item tag 0x0 [ 1638.277976][T23277] creative-sb0540 0003:041E:3100.0040: unknown main item tag 0x0 [ 1638.278006][T23277] creative-sb0540 0003:041E:3100.0040: unknown main item tag 0x0 [ 1638.278034][T23277] creative-sb0540 0003:041E:3100.0040: unknown main item tag 0x0 [ 1638.282546][T23277] creative-sb0540 0003:041E:3100.0040: hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.9-1/input0 [ 1638.494266][T23277] usb 10-1: USB disconnect, device number 8 [ 1639.265813][ T49] usb 4-1: new high-speed USB device number 41 using dummy_hcd [ 1639.375765][T22903] usb 10-1: new high-speed USB device number 9 using dummy_hcd [ 1639.418535][ T49] usb 4-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 1639.418596][ T49] usb 4-1: New USB device found, idVendor=041e, idProduct=4007, bcdDevice=5d.18 [ 1639.418615][ T49] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1639.462436][ T49] gspca_main: stv0680-2.14.0 probing 041e:4007 [ 1639.536302][T22903] usb 10-1: Using ep0 maxpacket: 16 [ 1639.538522][T22903] usb 10-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1639.538577][T22903] usb 10-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1639.541265][T22903] usb 10-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1639.541299][T22903] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1639.541321][T22903] usb 10-1: Product: syz [ 1639.541337][T22903] usb 10-1: Manufacturer: syz [ 1639.541352][T22903] usb 10-1: SerialNumber: syz [ 1639.664510][ T5679] usb 9-1: USB disconnect, device number 45 [ 1639.677285][T22903] usb 10-1: 0:2 : does not exist [ 1639.851361][T22903] usb 10-1: 5:0: failed to get current value for ch 0 (-22) [ 1639.904033][T22903] usb 10-1: USB disconnect, device number 9 [ 1639.950039][T22837] udevd[22837]: error opening ATTR{/sys/devices/platform/dummy_hcd.9/usb10/10-1/10-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1640.009205][T12896] wlan0: Trigger new scan to find an IBSS to join [ 1640.483981][T25937] netlink: 'syz.8.5900': attribute type 1 has an invalid length. [ 1640.603215][T25937] netlink: 20 bytes leftover after parsing attributes in process `syz.8.5900'. [ 1640.603241][T25937] netlink: 24 bytes leftover after parsing attributes in process `syz.8.5900'. [ 1640.604880][T25940] loop5: detected capacity change from 0 to 7 [ 1640.701594][ T49] gspca_stv0680: usb_control_msg error 2, request = 0x6, error = -71 [ 1640.702084][ T49] gspca_stv0680: usb_control_msg error 0, request = 0x80, error = -71 [ 1640.702105][ T49] stv0680 4-1:4.0: last error: 86, command = 0x78 [ 1640.735220][ T49] usb 4-1: USB disconnect, device number 41 [ 1640.879808][T25940] Dev loop5: unable to read RDB block 7 [ 1640.879862][T25940] loop5: unable to read partition table [ 1640.880083][T25940] loop5: partition table beyond EOD, truncated [ 1640.916814][T25940] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 1641.026571][T25936] Flush: task=syz.8.5900[25936] dev=loop5 state=2 [ 1641.091686][T25947] netlink: 128 bytes leftover after parsing attributes in process `syz.0.5903'. [ 1641.092027][T25947] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1641.135166][T25936] Teardown: task=syz.8.5900[25936] dev=loop5 state=2 [ 1641.465637][ T9] usb 9-1: new high-speed USB device number 46 using dummy_hcd [ 1641.617592][ T9] usb 9-1: Using ep0 maxpacket: 16 [ 1641.629916][ T9] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1641.629962][ T9] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1641.631628][ T9] usb 9-1: New USB device found, idVendor=041e, idProduct=3100, bcdDevice= 0.00 [ 1641.631659][ T9] usb 9-1: New USB device strings: Mfr=34, Product=0, SerialNumber=0 [ 1641.631681][ T9] usb 9-1: Manufacturer: syz [ 1641.658040][ T5723] usb 10-1: new high-speed USB device number 10 using dummy_hcd [ 1641.673134][T25960] Mount JFS Failure: -5 [ 1641.673151][T25960] jfs_mount failed w/return code = -5 [ 1641.723635][ T9] usb 9-1: config 0 descriptor?? [ 1641.835793][ T5723] usb 10-1: Using ep0 maxpacket: 16 [ 1641.840073][ T5723] usb 10-1: unable to get BOS descriptor or descriptor too short [ 1641.842377][ T5723] usb 10-1: config 127 has an invalid interface number: 124 but max is 0 [ 1641.842407][ T5723] usb 10-1: config 127 has no interface number 0 [ 1641.842442][ T5723] usb 10-1: config 127 interface 124 has no altsetting 0 [ 1641.883769][ T5723] usb 10-1: New USB device found, idVendor=0cf3, idProduct=1010, bcdDevice=36.87 [ 1641.884036][ T5723] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1641.884061][ T5723] usb 10-1: Product: syz [ 1641.884077][ T5723] usb 10-1: Manufacturer: syz [ 1641.884093][ T5723] usb 10-1: SerialNumber: syz [ 1642.308505][ T9] creative-sb0540 0003:041E:3100.0041: unknown main item tag 0x0 [ 1642.308543][ T9] creative-sb0540 0003:041E:3100.0041: unknown main item tag 0x0 [ 1642.308572][ T9] creative-sb0540 0003:041E:3100.0041: unknown main item tag 0x0 [ 1642.308603][ T9] creative-sb0540 0003:041E:3100.0041: unknown main item tag 0x0 [ 1642.316355][ T9] creative-sb0540 0003:041E:3100.0041: hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.8-1/input0 [ 1642.412873][T25965] FAULT_INJECTION: forcing a failure. [ 1642.412873][T25965] name failslab, interval 1, probability 0, space 0, times 0 [ 1642.412915][T25965] CPU: 1 UID: 0 PID: 25965 Comm: syz.3.5909 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1642.412946][T25965] Tainted: [L]=SOFTLOCKUP [ 1642.412954][T25965] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1642.412969][T25965] Call Trace: [ 1642.412978][T25965] [ 1642.412988][T25965] dump_stack_lvl+0xe8/0x150 [ 1642.413024][T25965] should_fail_ex+0x467/0x600 [ 1642.413060][T25965] should_failslab+0xa8/0x100 [ 1642.413085][T25965] __kmalloc_node_track_caller_noprof+0xfb/0x7b0 [ 1642.413120][T25965] ? __pfx_snprintf+0x10/0x10 [ 1642.413151][T25965] ? xs_format_peer_addresses+0x3e7/0x530 [ 1642.413179][T25965] ? xs_format_peer_addresses+0x3e7/0x530 [ 1642.413212][T25965] kstrdup+0x42/0x100 [ 1642.413239][T25965] xs_format_peer_addresses+0x3e7/0x530 [ 1642.413264][T25965] ? __pfx_xs_format_peer_addresses+0x10/0x10 [ 1642.413303][T25965] ? timer_init_key+0x161/0x2c0 [ 1642.413343][T25965] xs_setup_tcp+0x751/0x920 [ 1642.413374][T25965] ? __pfx_xs_setup_tcp+0x10/0x10 [ 1642.413403][T25965] ? rt_spin_unlock+0x157/0x200 [ 1642.413437][T25965] ? rt_spin_unlock+0x163/0x200 [ 1642.413470][T25965] xprt_create_transport+0x166/0x5f0 [ 1642.413509][T25965] rpc_create+0x4ff/0x900 [ 1642.413543][T25965] ? __pfx_rpc_create+0x10/0x10 [ 1642.413615][T25965] ? net_generic+0x1e/0x240 [ 1642.413638][T25965] ? net_generic+0x1e/0x240 [ 1642.413659][T25965] ? nfs_create_rpc_client+0x2e9/0x780 [ 1642.413688][T25965] nfs_create_rpc_client+0x571/0x780 [ 1642.413716][T25965] ? __pfx_nfs_create_rpc_client+0x10/0x10 [ 1642.413760][T25965] ? __rt_spin_lock_init+0x3e/0x50 [ 1642.413792][T25965] ? __init_waitqueue_head+0xad/0x160 [ 1642.413838][T25965] nfs4_alloc_client+0x85d/0xcc0 [ 1642.413868][T25965] ? __pfx_nfs4_alloc_client+0x10/0x10 [ 1642.413901][T25965] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 1642.413940][T25965] ? rt_spin_unlock+0x157/0x200 [ 1642.413975][T25965] ? rt_spin_unlock+0x163/0x200 [ 1642.414008][T25965] nfs_get_client+0xbf7/0xfc0 [ 1642.414045][T25965] ? timer_init_key+0x161/0x2c0 [ 1642.414091][T25965] nfs4_set_client+0x365/0x560 [ 1642.414119][T25965] nfs4_create_server+0x538/0x1120 [ 1642.414151][T25965] ? __pfx_nfs4_create_server+0x10/0x10 [ 1642.414181][T25965] ? rt_read_unlock+0x173/0x340 [ 1642.414229][T25965] ? nfs_get_tree+0x11a9/0x1650 [ 1642.414260][T25965] nfs4_try_get_tree+0x49/0x110 [ 1642.414287][T25965] vfs_get_tree+0x92/0x2a0 [ 1642.414319][T25965] vfs_cmd_create+0xa2/0x200 [ 1642.414354][T25965] __se_sys_fsconfig+0x6bf/0x810 [ 1642.414394][T25965] ? __pfx___se_sys_fsconfig+0x10/0x10 [ 1642.414426][T25965] ? ksys_write+0x248/0x270 [ 1642.414456][T25965] ? __pfx_ksys_write+0x10/0x10 [ 1642.414497][T25965] ? __x64_sys_fsconfig+0x20/0xc0 [ 1642.414534][T25965] do_syscall_64+0x17b/0x530 [ 1642.414557][T25965] ? irqentry_exit+0x10f/0x8f0 [ 1642.414579][T25965] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1642.414603][T25965] ? clear_bhb_loop+0x40/0x90 [ 1642.414632][T25965] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1642.414655][T25965] RIP: 0033:0x7fb18856e019 [ 1642.414677][T25965] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1642.414698][T25965] RSP: 002b:00007fb186784028 EFLAGS: 00000246 ORIG_RAX: 00000000000001af [ 1642.414724][T25965] RAX: ffffffffffffffda RBX: 00007fb1887f6180 RCX: 00007fb18856e019 [ 1642.414741][T25965] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000003 [ 1642.414756][T25965] RBP: 00007fb186784090 R08: 0000000000000000 R09: 0000000000000000 [ 1642.414771][T25965] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1642.414785][T25965] R13: 00007fb1887f6218 R14: 00007fb1887f6180 R15: 00007fff0c3f4db8 [ 1642.414827][T25965] [ 1642.741540][ T5679] usb 9-1: USB disconnect, device number 46 [ 1642.946637][ T5723] usb 10-1: reset high-speed USB device number 10 using dummy_hcd [ 1643.112253][ T5723] usb 10-1: unable to get BOS descriptor or descriptor too short [ 1643.152070][T25966] fido_id[25966]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.8/usb9/report_descriptor': No such file or directory [ 1643.338324][T25955] netlink: 'syz.9.5906': attribute type 10 has an invalid length. [ 1643.561349][T25955] team0: Cannot enslave team device to itself [ 1643.565470][ T5723] usb 10-1: failed to restore interface 124 altsetting 11 (error=-71) [ 1643.591596][ T5723] usb 10-1: USB disconnect, device number 10 [ 1643.765815][T22903] usb 9-1: new high-speed USB device number 47 using dummy_hcd [ 1643.938503][T22903] usb 9-1: Using ep0 maxpacket: 16 [ 1643.942033][T22903] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1643.942062][T22903] usb 9-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1643.976608][T22903] usb 9-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1643.976642][T22903] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1643.976665][T22903] usb 9-1: Product: syz [ 1643.976681][T22903] usb 9-1: Manufacturer: syz [ 1643.976698][T22903] usb 9-1: SerialNumber: syz [ 1644.033804][T22903] usb 9-1: 0:2 : does not exist [ 1644.247679][T22903] usb 9-1: 5:0: failed to get current value for ch 0 (-22) [ 1644.364982][T22903] usb 9-1: USB disconnect, device number 47 [ 1644.438036][T25975] FAULT_INJECTION: forcing a failure. [ 1644.438036][T25975] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1644.438076][T25975] CPU: 1 UID: 0 PID: 25975 Comm: syz.3.5913 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1644.438108][T25975] Tainted: [L]=SOFTLOCKUP [ 1644.438117][T25975] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1644.438130][T25975] Call Trace: [ 1644.438140][T25975] [ 1644.438150][T25975] dump_stack_lvl+0xe8/0x150 [ 1644.438184][T25975] should_fail_ex+0x467/0x600 [ 1644.438220][T25975] prepare_alloc_pages+0x223/0x650 [ 1644.438260][T25975] __alloc_frozen_pages_noprof+0x193/0x5b0 [ 1644.438301][T25975] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 1644.438344][T25975] ? __pfx_policy_nodemask+0x10/0x10 [ 1644.438370][T25975] ? __lock_acquire+0x6df/0x2e40 [ 1644.438400][T25975] alloc_pages_mpol+0xd4/0x280 [ 1644.438431][T25975] folio_alloc_mpol_noprof+0x3b/0x1e0 [ 1644.438460][T25975] vma_alloc_folio_noprof+0xe1/0x1e0 [ 1644.438487][T25975] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 1644.438511][T25975] ? lock_acquire+0x115/0x350 [ 1644.438556][T25975] do_pte_missing+0x835/0x28f0 [ 1644.438601][T25975] ? handle_mm_fault+0xeb/0x28d0 [ 1644.438636][T25975] handle_mm_fault+0xf95/0x28d0 [ 1644.438669][T25975] ? mt_find+0x186/0x630 [ 1644.438698][T25975] ? handle_mm_fault+0xeb/0x28d0 [ 1644.438739][T25975] ? __pfx_handle_mm_fault+0x10/0x10 [ 1644.438793][T25975] ? __lock_acquire+0x6df/0x2e40 [ 1644.438819][T25975] ? lock_mm_and_find_vma+0xa7/0x340 [ 1644.438858][T25975] do_user_addr_fault+0x744/0x1340 [ 1644.438907][T25975] exc_page_fault+0x6a/0xc0 [ 1644.438930][T25975] asm_exc_page_fault+0x26/0x30 [ 1644.438953][T25975] RIP: 0010:rep_movs_alternative+0x4a/0xa0 [ 1644.438986][T25975] Code: cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 db 83 f9 08 73 e8 eb c5 a4 e9 bf 33 05 00 48 8b 06 48 89 07 48 8d 47 08 48 83 e0 f8 48 [ 1644.439006][T25975] RSP: 0018:ffffc900070ff4f8 EFLAGS: 00050206 [ 1644.439027][T25975] RAX: ffffffff84cae401 RBX: ffff888039fc8000 RCX: 0000000000000eb8 [ 1644.439045][T25975] RDX: 0000000000000000 RSI: ffff888039fc8000 RDI: 0000200000001bc0 [ 1644.439061][T25975] RBP: ffffc900070ff670 R08: ffff888039fc8eb7 R09: 1ffff110073f91d6 [ 1644.439078][T25975] R10: dffffc0000000000 R11: ffffed10073f91d7 R12: dffffc0000000000 [ 1644.439096][T25975] R13: 0000000000000000 R14: ffffc900070ffd10 R15: 0000000000000eb8 [ 1644.439120][T25975] ? _copy_to_iter+0x3c1/0x1810 [ 1644.439159][T25975] _copy_to_iter+0x49d/0x1810 [ 1644.439207][T25975] ? __pfx__copy_to_iter+0x10/0x10 [ 1644.439249][T25975] ? rt_spin_unlock+0x157/0x200 [ 1644.439284][T25975] __skb_datagram_iter+0xf8/0x980 [ 1644.439322][T25975] ? __pfx_simple_copy_to_iter+0x10/0x10 [ 1644.439369][T25975] skb_copy_datagram_iter+0xb5/0x240 [ 1644.439410][T25975] netlink_recvmsg+0x2b9/0xa50 [ 1644.439455][T25975] ? __pfx_netlink_recvmsg+0x10/0x10 [ 1644.439495][T25975] ? __lock_acquire+0x6df/0x2e40 [ 1644.439524][T25975] ? __pfx_netlink_recvmsg+0x10/0x10 [ 1644.439561][T25975] sock_recvmsg_nosec+0x130/0x170 [ 1644.439590][T25975] ____sys_recvmsg+0x242/0x4f0 [ 1644.439636][T25975] ? __pfx_____sys_recvmsg+0x10/0x10 [ 1644.439688][T25975] ? import_iovec+0x73/0xa0 [ 1644.439728][T25975] ___sys_recvmsg+0x213/0x5a0 [ 1644.439777][T25975] ? __pfx____sys_recvmsg+0x10/0x10 [ 1644.439818][T25975] ? lock_acquire+0x115/0x350 [ 1644.439884][T25975] do_recvmmsg+0x320/0x7f0 [ 1644.439929][T25975] ? __pfx_do_recvmmsg+0x10/0x10 [ 1644.439964][T25975] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1644.439996][T25975] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 1644.440039][T25975] __x64_sys_recvmmsg+0x198/0x250 [ 1644.440077][T25975] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 1644.440124][T25975] do_syscall_64+0x17b/0x530 [ 1644.440147][T25975] ? irqentry_exit+0x10f/0x8f0 [ 1644.440168][T25975] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1644.440191][T25975] ? clear_bhb_loop+0x40/0x90 [ 1644.440219][T25975] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1644.440242][T25975] RIP: 0033:0x7fb18856e019 [ 1644.440263][T25975] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1644.440281][T25975] RSP: 002b:00007fb1867c6028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 1644.440304][T25975] RAX: ffffffffffffffda RBX: 00007fb1887f5fa0 RCX: 00007fb18856e019 [ 1644.440321][T25975] RDX: 0000000000000003 RSI: 0000200000002e80 RDI: 0000000000000003 [ 1644.440335][T25975] RBP: 00007fb1867c6090 R08: 0000000000000000 R09: 0000000000000000 [ 1644.440350][T25975] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1644.440364][T25975] R13: 00007fb1887f6038 R14: 00007fb1887f5fa0 R15: 00007fff0c3f4db8 [ 1644.440398][T25975] [ 1644.482035][T22837] udevd[22837]: error opening ATTR{/sys/devices/platform/dummy_hcd.8/usb9/9-1/9-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1645.048745][T17582] wlan0: Creating new IBSS network, BSSID ee:d9:b4:3c:73:aa [ 1645.590220][ T822] usb 10-1: new high-speed USB device number 11 using dummy_hcd [ 1645.735653][ T822] usb 10-1: Using ep0 maxpacket: 16 [ 1645.755207][ T822] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1645.755242][ T822] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1645.778608][ T822] usb 10-1: New USB device found, idVendor=041e, idProduct=3100, bcdDevice= 0.00 [ 1645.778639][ T822] usb 10-1: New USB device strings: Mfr=34, Product=0, SerialNumber=0 [ 1645.778661][ T822] usb 10-1: Manufacturer: syz [ 1645.888203][ T822] usb 10-1: config 0 descriptor?? [ 1646.202882][T26007] netlink: 'syz.8.5924': attribute type 1 has an invalid length. [ 1646.202908][T26007] netlink: 224 bytes leftover after parsing attributes in process `syz.8.5924'. [ 1646.202928][T26007] nbd: illegal input index 2147483646 [ 1646.269711][T26007] input: syz1 as /devices/virtual/input/input66 [ 1646.383406][ T822] creative-sb0540 0003:041E:3100.0042: unknown main item tag 0x0 [ 1646.383445][ T822] creative-sb0540 0003:041E:3100.0042: unknown main item tag 0x0 [ 1646.383471][ T822] creative-sb0540 0003:041E:3100.0042: unknown main item tag 0x0 [ 1646.383499][ T822] creative-sb0540 0003:041E:3100.0042: unknown main item tag 0x0 [ 1646.441405][ T822] creative-sb0540 0003:041E:3100.0042: hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.9-1/input0 [ 1646.719468][ T5699] usb 10-1: USB disconnect, device number 11 [ 1647.905670][ T5723] usb 4-1: new high-speed USB device number 42 using dummy_hcd [ 1648.055667][ T5723] usb 4-1: Using ep0 maxpacket: 16 [ 1648.058266][ T5723] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1648.058297][ T5723] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1648.060955][ T5723] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1648.060985][ T5723] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1648.061011][ T5723] usb 4-1: Product: syz [ 1648.061023][ T5723] usb 4-1: Manufacturer: syz [ 1648.061034][ T5723] usb 4-1: SerialNumber: syz [ 1648.086006][ T5679] usb 10-1: new high-speed USB device number 12 using dummy_hcd [ 1648.151264][ T5723] usb 4-1: 0:2 : does not exist [ 1648.195701][ T822] usb 9-1: new high-speed USB device number 48 using dummy_hcd [ 1648.251005][ T5679] usb 10-1: Using ep0 maxpacket: 8 [ 1648.294151][ T5679] usb 10-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1648.294213][ T5679] usb 10-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1648.294239][ T5679] usb 10-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 1648.294267][ T5679] usb 10-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 1648.359413][ T822] usb 9-1: device descriptor read/64, error -71 [ 1648.378019][ T5679] usb 10-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1648.378053][ T5679] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1648.378078][ T5679] usb 10-1: Product: syz [ 1648.378094][ T5679] usb 10-1: Manufacturer: syz [ 1648.378111][ T5679] usb 10-1: SerialNumber: syz [ 1648.425134][ T5679] cdc_ether 10-1:1.0: Descriptor too short [ 1648.480128][ T5723] usb 4-1: 5:0: failed to get current value for ch 0 (-22) [ 1648.591747][ T5723] usb 4-1: USB disconnect, device number 42 [ 1648.595710][ T822] usb 9-1: new high-speed USB device number 49 using dummy_hcd [ 1648.653122][T22837] udevd[22837]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1648.674216][T23277] usb 10-1: USB disconnect, device number 12 [ 1648.726055][ T822] usb 9-1: device descriptor read/64, error -71 [ 1648.836086][ T822] usb usb9-port1: attempt power cycle [ 1649.176634][ T822] usb 9-1: new high-speed USB device number 50 using dummy_hcd [ 1649.196542][ T822] usb 9-1: device descriptor read/8, error -71 [ 1649.438343][ T822] usb 9-1: new high-speed USB device number 51 using dummy_hcd [ 1649.456922][ T822] usb 9-1: device descriptor read/8, error -71 [ 1649.545878][ T5679] usb 4-1: new high-speed USB device number 43 using dummy_hcd [ 1649.584410][ T822] usb usb9-port1: unable to enumerate USB device [ 1649.695676][ T5679] usb 4-1: Using ep0 maxpacket: 16 [ 1649.699033][ T5679] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1649.699055][ T5679] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1649.701444][ T5679] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1649.701474][ T5679] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1649.701498][ T5679] usb 4-1: Product: syz [ 1649.701508][ T5679] usb 4-1: Manufacturer: syz [ 1649.701520][ T5679] usb 4-1: SerialNumber: syz [ 1649.784344][ T5679] usb 4-1: 0:2 : does not exist [ 1649.983224][ T5679] usb 4-1: 5:0: failed to get current value for ch 0 (-22) [ 1650.035984][ T5679] usb 4-1: USB disconnect, device number 43 [ 1650.131327][T22837] udevd[22837]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1650.288394][T26056] FAULT_INJECTION: forcing a failure. [ 1650.288394][T26056] name failslab, interval 1, probability 0, space 0, times 0 [ 1650.288426][T26056] CPU: 0 UID: 0 PID: 26056 Comm: syz.9.5944 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1650.288449][T26056] Tainted: [L]=SOFTLOCKUP [ 1650.288455][T26056] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1650.288465][T26056] Call Trace: [ 1650.288472][T26056] [ 1650.288479][T26056] dump_stack_lvl+0xe8/0x150 [ 1650.288504][T26056] should_fail_ex+0x467/0x600 [ 1650.288529][T26056] should_failslab+0xa8/0x100 [ 1650.288547][T26056] __kmalloc_noprof+0xfb/0x790 [ 1650.288571][T26056] ? tomoyo_realpath_from_path+0xef/0x640 [ 1650.288597][T26056] ? tomoyo_realpath_from_path+0xef/0x640 [ 1650.288628][T26056] tomoyo_realpath_from_path+0xef/0x640 [ 1650.288660][T26056] ? tomoyo_path_number_perm+0x219/0x5f0 [ 1650.288681][T26056] tomoyo_path_number_perm+0x246/0x5f0 [ 1650.288704][T26056] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1650.288726][T26056] ? do_raw_spin_lock+0x12b/0x2f0 [ 1650.288758][T26056] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1650.288775][T26056] ? lockdep_hardirqs_on+0x7a/0x110 [ 1650.288803][T26056] ? __fget_files+0x2a/0x420 [ 1650.288823][T26056] ? __fget_files+0x3a8/0x420 [ 1650.288839][T26056] ? __fget_files+0x2a/0x420 [ 1650.288858][T26056] security_file_ioctl+0xb9/0x260 [ 1650.288879][T26056] __se_sys_ioctl+0x47/0x170 [ 1650.288903][T26056] do_syscall_64+0x17b/0x530 [ 1650.288920][T26056] ? irqentry_exit+0x10f/0x8f0 [ 1650.288934][T26056] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1650.288951][T26056] ? clear_bhb_loop+0x40/0x90 [ 1650.288971][T26056] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1650.288988][T26056] RIP: 0033:0x7fe22ce4e019 [ 1650.289002][T26056] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1650.289017][T26056] RSP: 002b:00007fe22b0a6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1650.289034][T26056] RAX: ffffffffffffffda RBX: 00007fe22d0d5fa0 RCX: 00007fe22ce4e019 [ 1650.289046][T26056] RDX: 0000200000000100 RSI: 0000000000008b1a RDI: 0000000000000003 [ 1650.289057][T26056] RBP: 00007fe22b0a6090 R08: 0000000000000000 R09: 0000000000000000 [ 1650.289067][T26056] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1650.289077][T26056] R13: 00007fe22d0d6038 R14: 00007fe22d0d5fa0 R15: 00007ffe3e516a58 [ 1650.289102][T26056] [ 1650.289109][T26056] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1651.418290][T26074] netlink: 132 bytes leftover after parsing attributes in process `syz.9.5951'. [ 1651.915834][T23277] usb 10-1: new high-speed USB device number 13 using dummy_hcd [ 1651.925849][T22903] usb 9-1: new high-speed USB device number 52 using dummy_hcd [ 1652.045771][T23277] usb 10-1: device descriptor read/64, error -71 [ 1652.085893][T22903] usb 9-1: Using ep0 maxpacket: 16 [ 1652.096199][T22903] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1652.096228][T22903] usb 9-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1652.098686][T22903] usb 9-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1652.098716][T22903] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1652.098737][T22903] usb 9-1: Product: syz [ 1652.098758][T22903] usb 9-1: Manufacturer: syz [ 1652.098769][T22903] usb 9-1: SerialNumber: syz [ 1652.179366][T22903] usb 9-1: 0:2 : does not exist [ 1652.275744][ T5679] usb 4-1: new high-speed USB device number 44 using dummy_hcd [ 1652.295807][T23277] usb 10-1: new high-speed USB device number 14 using dummy_hcd [ 1652.320959][T22903] usb 9-1: 5:0: failed to get current value for ch 0 (-22) [ 1652.369480][T22903] usb 9-1: USB disconnect, device number 52 [ 1652.411343][T22837] udevd[22837]: setting mode of /dev/bus/usb/009/052 to 020664 failed: No such file or directory [ 1652.411495][T22837] udevd[22837]: setting owner of /dev/bus/usb/009/052 to uid=0, gid=0 failed: No such file or directory [ 1652.435684][T23277] usb 10-1: device descriptor read/64, error -71 [ 1652.445621][ T5679] usb 4-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 1652.445655][ T5679] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1652.504105][ T5679] usb 4-1: config 0 descriptor?? [ 1652.516785][T22837] udevd[22837]: error opening ATTR{/sys/devices/platform/dummy_hcd.8/usb9/9-1/9-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1652.550205][T23277] usb usb10-port1: attempt power cycle [ 1652.885735][T23277] usb 10-1: new high-speed USB device number 15 using dummy_hcd [ 1652.906528][T23277] usb 10-1: device descriptor read/8, error -71 [ 1652.952223][ T5679] udl 4-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 1652.952728][ T5679] [drm:udl_init] *ERROR* Selecting channel failed [ 1653.049381][T20813] wlan0: Trigger new scan to find an IBSS to join [ 1653.103976][T26101] netlink: 92 bytes leftover after parsing attributes in process `syz.8.5962'. [ 1653.152938][T23277] usb 10-1: new high-speed USB device number 16 using dummy_hcd [ 1653.172606][ T5679] [drm] Initialized udl 0.0.1 for 4-1:0.0 on minor 2 [ 1653.172637][ T5679] [drm] Initialized udl on minor 2 [ 1653.173286][T23277] usb 10-1: device descriptor read/8, error -71 [ 1653.251080][ T5679] udl 4-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 1653.277298][T23277] usb usb10-port1: unable to enumerate USB device [ 1653.434660][ T5679] udl 4-1:0.0: [drm] Cannot find any crtc or sizes [ 1653.493306][ T5679] usb 4-1: USB disconnect, device number 44 [ 1653.529019][ T822] udl 4-1:0.0: [drm] Cannot find any crtc or sizes [ 1653.905642][ T822] usb 9-1: new high-speed USB device number 53 using dummy_hcd [ 1654.038145][ T822] usb 9-1: device descriptor read/64, error -71 [ 1654.278740][ T822] usb 9-1: new high-speed USB device number 54 using dummy_hcd [ 1654.406639][ T822] usb 9-1: device descriptor read/64, error -71 [ 1654.520656][ T822] usb usb9-port1: attempt power cycle [ 1654.875834][ T822] usb 9-1: new high-speed USB device number 55 using dummy_hcd [ 1654.909303][ T822] usb 9-1: device descriptor read/8, error -71 [ 1655.154291][ T822] usb 9-1: new high-speed USB device number 56 using dummy_hcd [ 1655.196364][ T822] usb 9-1: device descriptor read/8, error -71 [ 1655.306210][ T822] usb usb9-port1: unable to enumerate USB device [ 1655.442382][T26135] netlink: 44 bytes leftover after parsing attributes in process `syz.3.5975'. [ 1655.442412][T26135] netlink: 43 bytes leftover after parsing attributes in process `syz.3.5975'. [ 1655.442431][T26135] netlink: 'syz.3.5975': attribute type 5 has an invalid length. [ 1655.442446][T26135] netlink: 43 bytes leftover after parsing attributes in process `syz.3.5975'. [ 1655.824732][ T4910] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 1655.902669][T22903] usb 4-1: new full-speed USB device number 45 using dummy_hcd [ 1655.972211][ T4910] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 1655.975294][ T4910] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 1655.986439][ T4910] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 1655.987605][ T4910] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 1656.240128][T22903] usb 4-1: unable to get BOS descriptor or descriptor too short [ 1656.245833][T22903] usb 4-1: not running at top speed; connect to a high speed hub [ 1656.313734][T22903] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1656.313765][T22903] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1656.328724][T22903] usb 4-1: New USB device found, idVendor=0763, idProduct=2031, bcdDevice= 0.40 [ 1656.328759][T22903] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1656.328782][T22903] usb 4-1: Product: syz [ 1656.328798][T22903] usb 4-1: Manufacturer: syz [ 1656.328825][T22903] usb 4-1: SerialNumber: syz [ 1657.576450][T26150] exfat: Deprecated parameter 'debug' [ 1657.641682][T22903] usb 4-1: USB disconnect, device number 45 [ 1657.767452][T22837] udevd[22837]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1658.006507][T20812] wlan0: Trigger new scan to find an IBSS to join [ 1658.162609][T26150] exFAT-fs (nullb0): invalid boot record signature [ 1658.162633][T26150] exFAT-fs (nullb0): failed to read boot sector [ 1658.162646][T26150] exFAT-fs (nullb0): failed to recognize exfat type [ 1658.328229][ T5602] Bluetooth: hci4: command tx timeout [ 1658.395214][T24921] do_umount: task=syz-executor[24921] propagate_mount_busy()!=0 [ 1658.403839][T24921] do_umount: task=syz-executor[24921] propagate_mount_busy()!=0 [ 1658.533095][T26165] vxcan0: tx address claim with dest, not broadcast [ 1658.650366][T26137] xfrm0 speed is unknown, defaulting to 1000 [ 1658.815864][T15629] usb 9-1: new high-speed USB device number 57 using dummy_hcd [ 1658.975734][T15629] usb 9-1: Using ep0 maxpacket: 32 [ 1658.977643][T15629] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1658.977677][T15629] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1658.977719][T15629] usb 9-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 1658.977737][T15629] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1658.987522][T15629] usb 9-1: config 0 descriptor?? [ 1659.060328][T15629] hub 9-1:0.0: USB hub found [ 1659.372889][T15629] hub 9-1:0.0: 1 port detected [ 1660.038177][T15629] hub 9-1:0.0: activate --> -90 [ 1660.194383][T26137] bridge0: port 1(bridge_slave_0) entered blocking state [ 1660.194752][T26137] bridge0: port 1(bridge_slave_0) entered disabled state [ 1660.195109][T26137] bridge_slave_0: entered allmulticast mode [ 1660.222519][T26137] bridge_slave_0: entered promiscuous mode [ 1660.244351][T26137] bridge0: port 2(bridge_slave_1) entered blocking state [ 1660.248740][T26137] bridge0: port 2(bridge_slave_1) entered disabled state [ 1660.249424][T26137] bridge_slave_1: entered allmulticast mode [ 1660.283032][T26137] bridge_slave_1: entered promiscuous mode [ 1660.406158][ T5602] Bluetooth: hci4: command tx timeout [ 1660.412089][ T5699] hub 9-1:0.0: hub_ext_port_status failed (err = -71) [ 1660.430655][ T5699] usb 9-1: USB disconnect, device number 57 [ 1660.550908][T20813] usb 9-1: Failed to suspend device, error -19 [ 1660.682034][T26137] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1660.713049][T26137] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1660.780175][T20813] wlan0: Creating new IBSS network, BSSID 76:62:32:b7:59:0d [ 1661.207338][ T4910] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1661.275761][ T4910] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1661.311790][ T4910] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1661.456931][ T4910] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1661.462021][ T4910] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1661.946233][T26188] overlayfs: failed to resolve './file1/file0': -2 [ 1662.173162][T26191] gadgetfs: bound to dummy_udc driver [ 1662.487021][ T5602] Bluetooth: hci4: command tx timeout [ 1662.757969][T26199] netlink: 8 bytes leftover after parsing attributes in process `syz.8.5993'. [ 1663.403471][T17193] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1663.618676][T26137] team0: Port device team_slave_0 added [ 1663.636458][T26137] team0: Port device team_slave_1 added [ 1663.709216][T26137] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1663.709237][T26137] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1663.709270][T26137] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1663.713158][T26137] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1663.713175][T26137] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1663.713205][T26137] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1663.850227][ T5602] Bluetooth: hci0: command tx timeout [ 1663.998834][T26137] hsr_slave_0: entered promiscuous mode [ 1664.021989][T26137] hsr_slave_1: entered promiscuous mode [ 1664.024161][T26137] debugfs: 'hsr0' already exists in 'hsr' [ 1664.024191][T26137] Cannot create hsr debugfs directory [ 1664.576303][ T5602] Bluetooth: hci4: command tx timeout [ 1665.001321][T17193] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1665.075307][T26223] CIFS: VFS: bad security option: krb5iý [ 1665.574297][T17193] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1665.939759][ T5602] Bluetooth: hci0: command tx timeout [ 1666.601993][T26137] netdevsim netdevsim9 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1667.034581][T17193] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1667.109787][T26176] xfrm0 speed is unknown, defaulting to 1000 [ 1667.499035][T26137] netdevsim netdevsim9 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1667.974771][T26242] gadgetfs: bound to dummy_udc driver [ 1668.039333][ T5602] Bluetooth: hci0: command tx timeout [ 1668.312806][T26137] netdevsim netdevsim9 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1668.347050][T26249] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1668.347850][T26249] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1668.981973][ T1339] ieee802154 phy0 wpan0: encryption failed: -22 [ 1669.042939][T26253] random: crng reseeded on system resumption [ 1669.043342][T26137] netdevsim netdevsim9 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1669.093790][T26253] Restarting kernel threads ... [ 1669.142302][T26253] Done restarting kernel threads. [ 1670.096303][ T5602] Bluetooth: hci0: command tx timeout [ 1670.221690][T26266] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=2142054965 (4284109930 ns) > initial count (2850433972 ns). Using initial count to start timer. [ 1670.500379][T17193] bridge_slave_1: left allmulticast mode [ 1670.500420][T17193] bridge_slave_1: left promiscuous mode [ 1670.500739][T17193] bridge0: port 2(bridge_slave_1) entered disabled state [ 1670.687020][T17193] bridge_slave_0: left allmulticast mode [ 1670.687049][T17193] bridge_slave_0: left promiscuous mode [ 1670.687351][T17193] bridge0: port 1(bridge_slave_0) entered disabled state [ 1671.163840][T26279] gadgetfs: bound to dummy_udc driver [ 1671.759152][T26284] random: crng reseeded on system resumption [ 1671.863412][T22903] usb 9-1: new full-speed USB device number 58 using dummy_hcd [ 1672.027361][T22903] usb 9-1: not running at top speed; connect to a high speed hub [ 1672.028956][T22903] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 10 [ 1672.032110][T22903] usb 9-1: New USB device found, idVendor=0ea0, idProduct=6858, bcdDevice= 0.40 [ 1672.032141][T22903] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1672.032166][T22903] usb 9-1: Product: syz [ 1672.032182][T22903] usb 9-1: Manufacturer: syz [ 1672.032198][T22903] usb 9-1: SerialNumber: syz [ 1672.122326][T22903] oti6858 9-1:1.0: oti6858 converter detected [ 1672.155872][T22903] usb 9-1: oti6858 converter now attached to ttyUSB0 [ 1672.342779][T17193] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1672.416777][T17193] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1672.439352][T17193] bond0 (unregistering): Released all slaves [ 1672.795402][T26176] bridge0: port 1(bridge_slave_0) entered blocking state [ 1672.798555][T26176] bridge0: port 1(bridge_slave_0) entered disabled state [ 1672.799235][T26176] bridge_slave_0: entered allmulticast mode [ 1672.814719][T26176] bridge_slave_0: entered promiscuous mode [ 1672.829903][T26176] bridge0: port 2(bridge_slave_1) entered blocking state [ 1672.830944][T26176] bridge0: port 2(bridge_slave_1) entered disabled state [ 1672.831229][T26176] bridge_slave_1: entered allmulticast mode [ 1672.834584][T26176] bridge_slave_1: entered promiscuous mode [ 1672.886827][T22903] usb 9-1: USB disconnect, device number 58 [ 1672.907130][T22903] oti6858 ttyUSB0: oti6858 converter now disconnected from ttyUSB0 [ 1672.912773][T22903] oti6858 9-1:1.0: device disconnected [ 1673.121352][T26176] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1673.347049][T20813] wlan0: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 1673.612513][T26176] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1674.412535][T26176] team0: Port device team_slave_0 added [ 1674.503518][ T5256] 8021q: adding VLAN 0 to HW filter on device eth1 [ 1674.540122][T26176] team0: Port device team_slave_1 added [ 1674.601129][T26176] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1674.601145][T26176] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1674.601171][T26176] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1674.604516][T26176] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1674.604530][T26176] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1674.604556][T26176] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1675.116615][T26137] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 1675.161012][T26137] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1675.199242][T26137] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 1675.259617][T26137] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1675.324805][T26137] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 1675.355147][T26137] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1675.389615][T26176] hsr_slave_0: entered promiscuous mode [ 1675.392821][T26176] hsr_slave_1: entered promiscuous mode [ 1675.395172][T26176] debugfs: 'hsr0' already exists in 'hsr' [ 1675.395200][T26176] Cannot create hsr debugfs directory [ 1675.422793][T26137] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 1675.462525][T26137] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1676.006909][T17193] hsr_slave_0: left promiscuous mode [ 1676.057862][T17193] hsr_slave_1: left promiscuous mode [ 1676.059933][T17193] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1676.059962][T17193] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1676.122554][T17193] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1676.122586][T17193] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1676.221478][T17193] veth1_macvtap: left promiscuous mode [ 1676.221560][T17193] veth0_macvtap: left promiscuous mode [ 1676.221771][T17193] veth1_vlan: left promiscuous mode [ 1676.221915][T17193] veth0_vlan: left promiscuous mode [ 1677.179341][T17193] team0 (unregistering): Port device team_slave_1 removed [ 1677.228253][T17193] team0 (unregistering): Port device team_slave_0 removed [ 1677.565345][ T5256] 8021q: adding VLAN 0 to HW filter on device eth2 [ 1678.780399][T26137] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1678.977073][T26137] 8021q: adding VLAN 0 to HW filter on device team0 [ 1679.061134][T17194] bridge0: port 1(bridge_slave_0) entered blocking state [ 1679.061410][T17194] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1679.115377][T24111] bridge0: port 2(bridge_slave_1) entered blocking state [ 1679.190253][T24111] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1680.243933][ T5256] 8021q: adding VLAN 0 to HW filter on device eth3 [ 1682.063930][ T5256] 8021q: adding VLAN 0 to HW filter on device eth4 [ 1682.989025][T26137] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1683.547138][T26176] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 1683.603794][T26176] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1683.640981][T26176] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 1683.716432][T26176] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1683.723312][T26176] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 1683.782047][T26176] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1683.821190][T26176] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 1683.913206][T26176] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1684.125370][T26137] veth0_vlan: entered promiscuous mode [ 1684.201326][T26137] veth1_vlan: entered promiscuous mode [ 1684.494714][T26137] veth0_macvtap: entered promiscuous mode [ 1684.543188][T26137] veth1_macvtap: entered promiscuous mode [ 1684.597139][T26176] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1684.701291][T26137] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1684.717791][T26176] 8021q: adding VLAN 0 to HW filter on device team0 [ 1684.830037][T26137] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1684.834840][T17193] bridge0: port 1(bridge_slave_0) entered blocking state [ 1684.835083][T17193] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1684.924601][T17194] bridge0: port 2(bridge_slave_1) entered blocking state [ 1684.924879][T17194] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1684.948404][T12891] netdevsim netdevsim9 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1684.988710][T17193] netdevsim netdevsim9 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1684.991243][T17193] netdevsim netdevsim9 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1685.026820][T17193] netdevsim netdevsim9 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1686.388391][T12891] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1686.388415][T12891] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1686.826658][T12895] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1686.826682][T12895] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1687.815770][ T199] usb 10-1: new high-speed USB device number 17 using dummy_hcd [ 1687.965684][ T199] usb 10-1: Using ep0 maxpacket: 16 [ 1687.969129][ T199] usb 10-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1687.969168][ T199] usb 10-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1687.974277][ T199] usb 10-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1687.974302][ T199] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1687.974317][ T199] usb 10-1: Product: syz [ 1687.974328][ T199] usb 10-1: Manufacturer: syz [ 1687.974339][ T199] usb 10-1: SerialNumber: syz [ 1688.080943][ T199] usb 10-1: 0:2 : does not exist [ 1688.304895][ T199] usb 10-1: 5:0: failed to get current value for ch 0 (-22) [ 1688.681773][ T199] usb 10-1: USB disconnect, device number 17 [ 1688.834903][T26443] udevd[26443]: error opening ATTR{/sys/devices/platform/dummy_hcd.9/usb10/10-1/10-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1688.954551][T26176] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1689.224228][T26176] veth0_vlan: entered promiscuous mode [ 1689.333760][T26176] veth1_vlan: entered promiscuous mode [ 1689.535972][ T199] usb 9-1: new full-speed USB device number 59 using dummy_hcd [ 1689.687336][ T199] usb 9-1: not running at top speed; connect to a high speed hub [ 1689.699027][ T199] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 10 [ 1689.702617][ T199] usb 9-1: New USB device found, idVendor=0ea0, idProduct=6858, bcdDevice= 0.40 [ 1689.702669][ T199] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1689.702692][ T199] usb 9-1: Product: syz [ 1689.702708][ T199] usb 9-1: Manufacturer: syz [ 1689.702725][ T199] usb 9-1: SerialNumber: syz [ 1689.781970][ T199] oti6858 9-1:1.0: oti6858 converter detected [ 1689.802447][ T199] usb 9-1: oti6858 converter now attached to ttyUSB0 [ 1689.803514][T26176] veth0_macvtap: entered promiscuous mode [ 1689.895297][T26176] veth1_macvtap: entered promiscuous mode [ 1689.993991][T26176] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1689.996067][ T5723] usb 9-1: USB disconnect, device number 59 [ 1690.063337][ T5723] oti6858 ttyUSB0: oti6858 converter now disconnected from ttyUSB0 [ 1690.068334][ T5723] oti6858 9-1:1.0: device disconnected [ 1690.226642][T26176] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1690.329842][T17583] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1690.351820][T17583] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1690.400069][T17582] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1690.414696][T17582] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1690.616294][T26486] gadgetfs: bound to dummy_udc driver [ 1690.800450][T17194] wlan0: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 1692.612823][T26497] gadgetfs: bound to dummy_udc driver [ 1692.672563][T26503] random: crng reseeded on system resumption [ 1693.156270][T26500] ================================================================== [ 1693.156287][T26500] BUG: KASAN: slab-use-after-free in mutex_lock_interruptible_nested+0x5a/0x1d0 [ 1693.156325][T26500] Read of size 1 at addr ffff88806f7acc58 by task syz.0.6036/26500 [ 1693.156354][T26500] [ 1693.156370][T26500] CPU: 1 UID: 0 PID: 26500 Comm: syz.0.6036 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1693.156400][T26500] Tainted: [L]=SOFTLOCKUP [ 1693.156409][T26500] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1693.156424][T26500] Call Trace: [ 1693.156433][T26500] [ 1693.156443][T26500] dump_stack_lvl+0xe8/0x150 [ 1693.156471][T26500] print_address_description+0x55/0x1e0 [ 1693.156504][T26500] ? mutex_lock_interruptible_nested+0x5a/0x1d0 [ 1693.156532][T26500] print_report+0x58/0x70 [ 1693.156561][T26500] kasan_report+0x117/0x150 [ 1693.156582][T26500] ? mutex_lock_interruptible_nested+0x5a/0x1d0 [ 1693.156613][T26500] ? ep_open+0x4e/0x270 [ 1693.156636][T26500] __kasan_check_byte+0x2a/0x40 [ 1693.156670][T26500] lock_acquire+0x7d/0x350 [ 1693.156705][T26500] ? ep_open+0x4e/0x270 [ 1693.156732][T26500] ? ep_open+0x4e/0x270 [ 1693.156753][T26500] mutex_lock_interruptible_nested+0x5a/0x1d0 [ 1693.156782][T26500] ? ep_open+0x4e/0x270 [ 1693.156806][T26500] ep_open+0x4e/0x270 [ 1693.156831][T26500] ? do_dentry_open+0x83a/0x1420 [ 1693.156865][T26500] ? __pfx_ep_open+0x10/0x10 [ 1693.156889][T26500] do_dentry_open+0x849/0x1420 [ 1693.156925][T26500] vfs_open+0x3b/0x350 [ 1693.156961][T26500] ? path_openat+0x2e4d/0x3850 [ 1693.156988][T26500] path_openat+0x2e64/0x3850 [ 1693.157019][T26500] ? __kasan_slab_alloc+0x6c/0x80 [ 1693.157049][T26500] ? do_sys_openat2+0xcc/0x200 [ 1693.157089][T26500] do_file_open+0x23e/0x4a0 [ 1693.157113][T26500] ? lockdep_hardirqs_on+0x7a/0x110 [ 1693.157135][T26500] ? __pfx_do_file_open+0x10/0x10 [ 1693.157173][T26500] ? alloc_fd+0x654/0x6d0 [ 1693.157198][T26500] do_sys_openat2+0x115/0x200 [ 1693.157232][T26500] ? __pfx_do_sys_openat2+0x10/0x10 [ 1693.157264][T26500] ? rcu_is_watching+0x15/0xb0 [ 1693.157289][T26500] ? kfree+0x4d/0x6c0 [ 1693.157327][T26500] __x64_sys_openat+0x138/0x170 [ 1693.157370][T26500] do_syscall_64+0x17b/0x530 [ 1693.157392][T26500] ? irqentry_exit+0x10f/0x8f0 [ 1693.157413][T26500] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1693.157436][T26500] ? clear_bhb_loop+0x40/0x90 [ 1693.157461][T26500] entry_SYSCALL_64_after_hwframe+0x77/0x7f SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 1693.157484][T26500] RIP: 0033:0x7fbbbf6be019 [ 1693.157506][T26500] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1693.157527][T26500] RSP: 002b:00007fbbbd8f5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 1693.157552][T26500] RAX: ffffffffffffffda RBX: 00007fbbbf946090 RCX: 00007fbbbf6be019 [ 1693.157570][T26500] RDX: 0000000000000002 RSI: 0000200000000600 RDI: ffffffffffffff9c [ 1693.157587][T26500] RBP: 00007fbbbf75500c R08: 0000000000000000 R09: 0000000000000000 [ 1693.157602][T26500] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1693.157616][T26500] R13: 00007fbbbf946128 R14: 00007fbbbf946090 R15: 00007ffda5b57258 [ 1693.157643][T26500] [ 1693.157653][T26500] [ 1693.157673][T26500] Allocated by task 26497: [ 1693.157685][T26500] kasan_save_track+0x3e/0x80 [ 1693.157714][T26500] __kasan_kmalloc+0x93/0xb0 [ 1693.157739][T26500] __kmalloc_cache_noprof+0x3cd/0x670 [ 1693.157763][T26500] gadgetfs_bind+0x27a/0xae0 [ 1693.157781][T26500] gadget_bind_driver+0x2ca/0x9e0 [ 1693.157798][T26500] really_probe+0x254/0xae0 [ 1693.157819][T26500] __driver_probe_device+0x1e8/0x360 [ 1693.157841][T26500] driver_probe_device+0x4f/0x240 [ 1693.157862][T26500] __driver_attach+0x339/0x600 [ 1693.157880][T26500] bus_for_each_dev+0x23e/0x2c0 [ 1693.157905][T26500] bus_add_driver+0x348/0x670 [ 1693.157929][T26500] driver_register+0x23a/0x320 [ 1693.157954][T26500] usb_gadget_register_driver_owner+0xf9/0x270 [ 1693.157986][T26500] dev_config+0xe4e/0x12c0 [ 1693.158007][T26500] vfs_write+0x29f/0xbb0 [ 1693.158027][T26500] ksys_write+0x156/0x270 [ 1693.158048][T26500] do_syscall_64+0x17b/0x530 [ 1693.158066][T26500] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1693.158086][T26500] [ 1693.158091][T26500] Freed by task 26497: [ 1693.158102][T26500] kasan_save_track+0x3e/0x80 [ 1693.158131][T26500] kasan_save_free_info+0x40/0x50 [ 1693.158153][T26500] __kasan_slab_free+0x5c/0x80 [ 1693.158182][T26500] kfree+0x1c5/0x6c0 [ 1693.158207][T26500] destroy_ep_files+0x29f/0x330 [ 1693.158230][T26500] gadgetfs_unbind+0x112/0x2c0 [ 1693.158251][T26500] gadget_unbind_driver+0x1cb/0x410 [ 1693.158272][T26500] device_release_driver_internal+0x48b/0x880 [ 1693.158298][T26500] driver_detach+0x1f3/0x2d0 [ 1693.158320][T26500] bus_remove_driver+0x229/0x320 [ 1693.158375][T26500] usb_gadget_unregister_driver+0x4e/0x70 [ 1693.158407][T26500] dev_release+0x86/0x210 [ 1693.158429][T26500] __fput+0x42a/0xa80 [ 1693.158446][T26500] task_work_run+0x1d9/0x270 [ 1693.158474][T26500] get_signal+0x1181/0x12c0 [ 1693.158493][T26500] arch_do_signal_or_restart+0xbb/0x860 [ 1693.158517][T26500] exit_to_user_mode_loop+0x104/0x730 [ 1693.158546][T26500] do_syscall_64+0x33d/0x530 [ 1693.158563][T26500] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1693.158581][T26500] [ 1693.158588][T26500] The buggy address belongs to the object at ffff88806f7acc00 [ 1693.158588][T26500] which belongs to the cache kmalloc-512 of size 512 [ 1693.158678][T26500] The buggy address is located 88 bytes inside of [ 1693.158678][T26500] freed 512-byte region [ffff88806f7acc00, ffff88806f7ace00) [ 1693.158701][T26500] [ 1693.158707][T26500] The buggy address belongs to the physical page: [ 1693.158749][T26500] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x6f7ac [ 1693.158770][T26500] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 1693.158789][T26500] flags: 0x80000000000040(head|node=0|zone=1) [ 1693.158807][T26500] page_type: f5(slab) [ 1693.158827][T26500] raw: 0080000000000040 ffff88813fe37c80 dead000000000100 dead000000000122 [ 1693.158848][T26500] raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 1693.158869][T26500] head: 0080000000000040 ffff88813fe37c80 dead000000000100 dead000000000122 [ 1693.158889][T26500] head: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 1693.158909][T26500] head: 0080000000000002 ffffffffffffff01 00000000ffffffff 00000000ffffffff [ 1693.158930][T26500] head: ffff88806f7adb00 0000000000000000 00000000ffffffff 0000000000000004 [ 1693.158941][T26500] page dumped because: kasan: bad access detected [ 1693.158960][T26500] page_owner tracks the page as allocated [ 1693.158968][T26500] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 56, tgid 56 (kworker/u8:3), ts 914663118733 [ 1693.159005][T26500] post_alloc_hook+0x1f9/0x250 [ 1693.159034][T26500] get_page_from_freelist+0x264c/0x26c0 [ 1693.159068][T26500] __alloc_frozen_pages_noprof+0x222/0x5b0 [ 1693.159101][T26500] allocate_slab+0x7c/0x5e0 [ 1693.159124][T26500] refill_objects+0x2d8/0x350 [ 1693.159148][T26500] __pcs_replace_empty_main+0x330/0x690 [ 1693.159169][T26500] __kmalloc_cache_noprof+0x467/0x670 [ 1693.159201][T26500] batadv_forw_packet_alloc+0x178/0x370 [ 1693.159225][T26500] batadv_iv_ogm_queue_add+0x8a6/0xd80 [ 1693.159255][T26500] batadv_iv_ogm_schedule+0x835/0xf90 [ 1693.159284][T26500] batadv_iv_send_outstanding_bat_ogm_packet+0x622/0x740 [ 1693.159316][T26500] process_one_work+0xaaf/0x1480 [ 1693.159345][T26500] worker_thread+0xb05/0x10d0 [ 1693.159366][T26500] kthread+0x388/0x470 [ 1693.159391][T26500] ret_from_fork+0x514/0xb70 [ 1693.159418][T26500] ret_from_fork_asm+0x1a/0x30 [ 1693.159446][T26500] page last free pid 17399 tgid 17399 ts 897712197518 stack trace: [ 1693.159465][T26500] __free_frozen_pages+0x1185/0x1270 [ 1693.159490][T26500] __slab_free+0x252/0x2a0 [ 1693.159514][T26500] qlist_free_all+0x99/0x100 [ 1693.159536][T26500] kasan_quarantine_reduce+0x148/0x160 [ 1693.159558][T26500] __kasan_slab_alloc+0x22/0x80 [ 1693.159583][T26500] kmem_cache_alloc_noprof+0x358/0x680 [ 1693.159606][T26500] do_getname+0x2e/0x250 [ 1693.159630][T26500] vfs_fstatat+0x45/0x170 [ 1693.159655][T26500] __x64_sys_newfstatat+0x151/0x200 [ 1693.159681][T26500] do_syscall_64+0x17b/0x530 [ 1693.159699][T26500] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1693.159720][T26500] [ 1693.159725][T26500] Memory state around the buggy address: [ 1693.159737][T26500] ffff88806f7acb00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1693.159752][T26500] ffff88806f7acb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1693.159767][T26500] >ffff88806f7acc00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1693.159779][T26500] ^ [ 1693.159833][T26500] ffff88806f7acc80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1693.159849][T26500] ffff88806f7acd00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1693.159860][T26500] ================================================================== [ 1693.421509][T26503] PM: hibernation: Marking nosave pages: [mem 0x00000000-0x00000fff] [ 1693.421541][T26503] PM: hibernation: Marking nosave pages: [mem 0x0009f000-0x000fffff] [ 1693.421571][T26503] PM: hibernation: Marking nosave pages: [mem 0xbfffd000-0xffffffff] [ 1693.421592][T26503] PM: hibernation: Basic memory bitmaps created [ 1693.430152][T26500] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 1693.430190][T26500] CPU: 0 UID: 0 PID: 26500 Comm: syz.0.6036 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1693.430226][T26500] Tainted: [L]=SOFTLOCKUP [ 1693.430235][T26500] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1693.430250][T26500] Call Trace: [ 1693.430260][T26500] [ 1693.430270][T26500] vpanic+0x56c/0xa60 [ 1693.430300][T26500] ? __pfx_vpanic+0x10/0x10 [ 1693.430323][T26500] ? __pfx___schedule+0x10/0x10 [ 1693.430361][T26500] panic+0xc5/0xd0 [ 1693.430382][T26500] ? __pfx_panic+0x10/0x10 [ 1693.430405][T26500] ? preempt_schedule_thunk+0x16/0x40 [ 1693.430433][T26500] ? mutex_lock_interruptible_nested+0x5a/0x1d0 [ 1693.430463][T26500] check_panic_on_warn+0x89/0xb0 [ 1693.430495][T26500] ? mutex_lock_interruptible_nested+0x5a/0x1d0 [ 1693.430525][T26500] end_report+0x73/0x170 [ 1693.430546][T26500] ? mutex_lock_interruptible_nested+0x5a/0x1d0 [ 1693.430576][T26500] kasan_report+0x128/0x150 [ 1693.430599][T26500] ? mutex_lock_interruptible_nested+0x5a/0x1d0 [ 1693.430635][T26500] ? ep_open+0x4e/0x270 [ 1693.430660][T26500] __kasan_check_byte+0x2a/0x40 [ 1693.430697][T26500] lock_acquire+0x7d/0x350 [ 1693.430734][T26500] ? ep_open+0x4e/0x270 [ 1693.430762][T26500] ? ep_open+0x4e/0x270 [ 1693.430787][T26500] mutex_lock_interruptible_nested+0x5a/0x1d0 [ 1693.430878][T26500] ? ep_open+0x4e/0x270 [ 1693.430952][T26500] ep_open+0x4e/0x270 [ 1693.431030][T26500] ? do_dentry_open+0x83a/0x1420 [ 1693.431064][T26500] ? __pfx_ep_open+0x10/0x10 [ 1693.431090][T26500] do_dentry_open+0x849/0x1420 [ 1693.431121][T26500] vfs_open+0x3b/0x350 [ 1693.431146][T26500] ? path_openat+0x2e4d/0x3850 [ 1693.431169][T26500] path_openat+0x2e64/0x3850 [ 1693.431205][T26500] ? __kasan_slab_alloc+0x6c/0x80 [ 1693.431233][T26500] ? do_sys_openat2+0xcc/0x200 [ 1693.431270][T26500] do_file_open+0x23e/0x4a0 [ 1693.431291][T26500] ? lockdep_hardirqs_on+0x7a/0x110 [ 1693.431312][T26500] ? __pfx_do_file_open+0x10/0x10 [ 1693.431344][T26500] ? alloc_fd+0x654/0x6d0 [ 1693.431364][T26500] do_sys_openat2+0x115/0x200 [ 1693.431394][T26500] ? __pfx_do_sys_openat2+0x10/0x10 [ 1693.431421][T26500] ? rcu_is_watching+0x15/0xb0 [ 1693.431442][T26500] ? kfree+0x4d/0x6c0 [ 1693.431473][T26500] __x64_sys_openat+0x138/0x170 [ 1693.431506][T26500] do_syscall_64+0x17b/0x530 [ 1693.431525][T26500] ? irqentry_exit+0x10f/0x8f0 [ 1693.431544][T26500] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1693.431564][T26500] ? clear_bhb_loop+0x40/0x90 [ 1693.431591][T26500] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1693.431611][T26500] RIP: 0033:0x7fbbbf6be019 [ 1693.431631][T26500] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1693.431648][T26500] RSP: 002b:00007fbbbd8f5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 1693.431670][T26500] RAX: ffffffffffffffda RBX: 00007fbbbf946090 RCX: 00007fbbbf6be019 [ 1693.431687][T26500] RDX: 0000000000000002 RSI: 0000200000000600 RDI: ffffffffffffff9c [ 1693.431703][T26500] RBP: 00007fbbbf75500c R08: 0000000000000000 R09: 0000000000000000 [ 1693.431717][T26500] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1693.431729][T26500] R13: 00007fbbbf946128 R14: 00007fbbbf946090 R15: 00007ffda5b57258 [ 1693.431753][T26500] [ 1693.440260][T26500] Kernel Offset: disabled