last executing test programs: 20m35.436384024s ago: executing program 0 (id=1049): r0 = syz_usb_connect(0x4, 0x24, &(0x7f0000000000)=ANY=[@ANYRESHEX], 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000240)={0x1c, &(0x7f0000000080)=ANY=[], 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000300)={0x1c, &(0x7f0000000340)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000280)={0x1c, &(0x7f0000000140)={0x0, 0x14}, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000700)={0x84, &(0x7f00000007c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000680)={0x44, &(0x7f00000004c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) newfstatat(0xffffffffffffff9c, 0x0, 0x0, 0x100) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text32={0x20, &(0x7f0000000340)="0f014706c744240064b70000c744240200000000c7442406000000000f0114240f35672ef3ad26660f3880180f015ff2c4e17a7f060f18939d000000b9040a00000f32ea008800000a00", 0x4a}], 0x1, 0x74, 0x0, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, &(0x7f0000000000)={0x1, 0x0, [{0x2ff, 0x0, 0x7ee69d08}]}) statx(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x2000, 0xffff4a9c0080ffff, 0xffffffffffffffff) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000000c0), 0x62181) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r4, 0xc08c5332, &(0x7f00000001c0)={0x0, 0x0, 0x0, 'queue0\x00'}) write$sndseq(r4, &(0x7f0000000000)=[{0x84, 0x77, 0x0, 0x0, @tick=0x1f4, {}, {}, @raw32={[0x2600]}}], 0xffc8) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x62181) write$sndseq(r5, &(0x7f0000000080)=[{0x1e, 0x0, 0x8, 0xfd, @tick=0x3, {}, {}, @result={0x1f00}}], 0x1c) bind$inet6(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$uac2(r0, 0x0, &(0x7f0000001080)={0x44, &(0x7f0000000e00)={0x0, 0x15}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 20m33.724111733s ago: executing program 0 (id=1059): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000023c0)={0x0, 'virt_wifi0\x00', {0x3}, 0xef}) ioctl$FS_IOC_GETVERSION(r0, 0x80087601, &(0x7f0000000000)) 20m33.055451096s ago: executing program 0 (id=1063): r0 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup(r5) syz_ublk_setup_queues(r6, r4, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x257, 0x0, r6}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x100, 0x1000000, 0x10000004}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xfffffffc, 0x2, 0x0, 0x146, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x8000, 0x1, 0xffffffff}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x700, 0x0, {}, 0x0, 0x0, '\x00', {0xfff9, 0x5, 0x0, 0x0}}, 0x0) (fail_nth: 16) ioctl$VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05640, &(0x7f0000000340)={0x0, @pix={0x0, 0x3, 0x41495043, 0x6, 0x2, 0x7fffffff, 0x3, 0xc2d, 0x0, 0x4, 0x1, 0x6}}) 20m32.784801446s ago: executing program 0 (id=1065): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000880)="5c00000012006bab9a3fe3d86e17aa0a046b876c1d0048007ea60864160af36504001a0038001d0019feffe69ee517d34460bc06000000a705251e6182949a3651f60a84c9f4d4938037e70e4509c5bb46c4c0a285057e3061b9781e", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) recvmsg(r0, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000400)=[{&(0x7f00000003c0)=""/62, 0x3e}, {&(0x7f0000000200)=""/154, 0x9a}, {&(0x7f0000001c40)=""/4151, 0x1037}, {&(0x7f00000006c0)=""/194, 0xc2}, {&(0x7f0000000300)=""/155, 0x9b}, {&(0x7f00000004c0)=""/184, 0xb8}, {&(0x7f0000000600)=""/172, 0xac}, {&(0x7f0000000900)=""/191, 0xbf}, {&(0x7f0000000040)=""/13, 0xd}], 0x9}, 0x0) recvmsg$kcm(r0, &(0x7f0000000bc0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5000000}, 0x0) 20m32.432782126s ago: executing program 0 (id=1067): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000fddbdf250200000008000300", @ANYRES32=r2, @ANYBLOB="080026007f17"], 0x2c}, 0x1, 0x0, 0x0, 0x4011}, 0x20004810) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, 0x0, 0x4000000) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r5 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) r6 = fcntl$dupfd(r3, 0x0, r5) ioctl$SG_IO(r6, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffc, 0x1, 0x0, @buffer={0x2, 0x0, 0x0}, &(0x7f0000000380)='%', 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$VIDIOC_SUBDEV_ENUM_FRAME_INTERVAL(r6, 0xc040564b, &(0x7f00000000c0)={0xe, 0x0, 0x3013, 0xfffffff8, 0x284c, {0xfffffff7, 0x9}, 0x1}) r7 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x203}) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x2) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x8010, r8, 0x0) open_by_handle_at(r8, &(0x7f00000002c0)=@reiserfs_5={0x14, 0x5, {0x4, 0x2, 0x1, 0xf1, 0x3}}, 0x400080) close_range(r7, r4, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(0xffffffffffffffff, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$KVM_RUN(r8, 0xae80, 0x0) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_DEL_ADDR(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)={0x1c, r9, 0x200, 0x70bd28, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8c1}, 0x4000045) 20m31.840534416s ago: executing program 0 (id=1068): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0xa8442, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x145080, 0x0) close(r1) r2 = socket$netlink(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000001200)={&(0x7f0000001080)={0x38, 0x1403, 0x1, 0x0, 0x0, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'syzkaller0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040000}, 0x100) 20m16.674330583s ago: executing program 32 (id=1068): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0xa8442, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x145080, 0x0) close(r1) r2 = socket$netlink(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000001200)={&(0x7f0000001080)={0x38, 0x1403, 0x1, 0x0, 0x0, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'syzkaller0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040000}, 0x100) 19m9.092021529s ago: executing program 4 (id=1393): sendmsg$DEVLINK_CMD_RATE_NEW(0xffffffffffffffff, &(0x7f0000002780)={0x0, 0x0, &(0x7f0000002740)={&(0x7f0000000180)=ANY=[@ANYBLOB="14038000", @ANYRES16], 0x14}}, 0x4000040) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000300)={0xa, 0x4e23, 0x0, @ipv4={'\x00', '\xff\xff', @loopback}}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x3) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000100)=0x1, 0x4) sendmsg$NFNL_MSG_CTHELPER_NEW(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[], 0x14}, 0x1, 0x0, 0x0, 0x60048040}, 0xc040445) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f0000000000)=@gcm_256={{0x303, 0x36}, "00000007e4008000", "8b3de2aabceef22f419e59f30000001504000000000200", "e73400", "000000d900"}, 0x38) 19m8.900596655s ago: executing program 4 (id=1395): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x80, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r3 = accept4(r2, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{0x0}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed88", 0x3a}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a", 0x47}], 0x3}], 0x1, 0x40800) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f00000000c0)="650f340f3566b842000f00d8b805000000b9a00000000f01c13e0f070fde460b0f0130670f01c2f2360f217a0f07", 0x2e}], 0x1, 0x11, 0x0, 0x0) write$tun(r0, &(0x7f0000000100)=ANY=[@ANYBLOB="034886dd010000003a001400000060"], 0xfdef) 19m8.338075846s ago: executing program 4 (id=1400): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) sendmmsg$inet6(r0, &(0x7f0000000140)=[{{&(0x7f0000000200)={0xa, 0x4e20, 0x4db, @local, 0x3}, 0x1c, &(0x7f0000000240)=[{&(0x7f0000000400)="fc", 0x1}], 0x1}, 0x60}], 0x1, 0x4c040) 19m8.054290891s ago: executing program 4 (id=1401): mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file0\x00', 0x31) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000100)='devtmpfs\x00', 0x1214040, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f00000000c0), 0x108000, &(0x7f0000000240)={[], [{@obj_type={'obj_type', 0x3d, 'lowerdir'}}, {@appraise}, {@subj_user={'subj_user', 0x3d, 'overlay\x00'}}, {@obj_type={'obj_type', 0x3d, 'devtmpfs\x00'}}], 0x2f}) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x4, 0x80) getdents64(r0, 0x0, 0x0) r1 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) wait4(r1, &(0x7f0000000000), 0x1, 0x0) socket$kcm(0x2, 0x3, 0x2) syz_open_dev$vim2m(&(0x7f0000000180), 0x29d9c896, 0x2) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = socket$inet(0x2, 0x1, 0x0) getsockopt$inet_mreqsrc(r3, 0x0, 0x53, &(0x7f0000000000)={@initdev, @empty, @remote}, &(0x7f0000000040)=0x6) close(r2) socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r2, 0x8) recvmsg(r2, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x40) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) r4 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080), 0x802, 0x0) ioctl$UI_SET_SNDBIT(r4, 0x4004556a, 0x1) r5 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r5, 0x107, 0x12, &(0x7f0000000140)={0x1, 0x6}, 0x4) r6 = socket$netlink(0x10, 0x3, 0x4) write(r6, &(0x7f0000005c00)="2700000014000707030e0000120f0a0011000100f5fe0012ff000000078a151f75080039000500", 0x27) socket$nl_generic(0x10, 0x3, 0x10) socket(0x10, 0x3, 0x0) syz_emit_vhci(0x0, 0x7) socket$inet(0x2, 0x80000, 0xffffffd2) syz_emit_vhci(&(0x7f0000000640)=ANY=[@ANYBLOB="04101b000310bb"], 0xf) 19m7.540222337s ago: executing program 4 (id=1405): syz_usb_connect(0x5, 0x24, &(0x7f00000038c0)={{0x12, 0x1, 0x200, 0xd1, 0x25, 0x6f, 0x8, 0xb48, 0x1008, 0x2, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x4, 0x3, 0xc0, 0x81, "", [{{0x9, 0x4, 0xcf, 0x1c, 0x0, 0x48, 0x1d, 0x3a, 0x6}}]}}]}}, 0x0) r0 = syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000780)={0x84, &(0x7f00000004c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x6) ioctl$EVIOCGMASK(r1, 0x40015b19, 0x0) 19m4.427764863s ago: executing program 4 (id=1419): r0 = socket$kcm(0xa, 0x1, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=ANY=[@ANYBLOB="40003f002f00090073cc72e16accbe0a040000002a00118031f9e05e2f", @ANYRES8=r1, @ANYBLOB="a9681a9653d9d42b346bb6903e08ff571f527bc5e79f605dea797d4edf5c5da8b03011ce033225e16d4545bcdaa053d995a5aabbb969d0617cdb31bf06509ea44b529a3550d92f5eab86fbc7648c09725b33475ca953bf1baf6b3e23cb0d7c9603", @ANYRES32=r0], 0x40}, 0x1, 0x0, 0x0, 0x2004e884}, 0x0) 19m3.82865787s ago: executing program 33 (id=1419): r0 = socket$kcm(0xa, 0x1, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=ANY=[@ANYBLOB="40003f002f00090073cc72e16accbe0a040000002a00118031f9e05e2f", @ANYRES8=r1, @ANYBLOB="a9681a9653d9d42b346bb6903e08ff571f527bc5e79f605dea797d4edf5c5da8b03011ce033225e16d4545bcdaa053d995a5aabbb969d0617cdb31bf06509ea44b529a3550d92f5eab86fbc7648c09725b33475ca953bf1baf6b3e23cb0d7c9603", @ANYRES32=r0], 0x40}, 0x1, 0x0, 0x0, 0x2004e884}, 0x0) 17m41.222492836s ago: executing program 5 (id=1761): r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x2000000000032, 0xffffffffffffffff, 0xffffa000) write$vhost_msg_v2(r0, &(0x7f0000000200)={0x2, 0x0, {&(0x7f00000000c0)=""/245, 0xf5, &(0x7f00000001c0), 0x2, 0x2}}, 0x48) setsockopt$inet_mreqn(r1, 0x0, 0x20, &(0x7f0000000040)={@remote, @rand_addr=0x64010101}, 0xc) syz_usb_connect$uac1(0x7, 0x71, &(0x7f0000000040)=ANY=[], 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x401) write$tun(r2, &(0x7f0000000040)=ANY=[@ANYBLOB="00009914a9b1", @ANYRES64=r2], 0xb2) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f00000021c0)={0x3}) syz_usb_connect(0x0, 0x24, &(0x7f0000000980)=ANY=[@ANYBLOB="1201000011620140480b05101e8c00000001090212000100000000090401"], 0x0) 17m40.392616531s ago: executing program 5 (id=1765): r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000540)='/sys/power/reserved_size', 0x101a02, 0x0) sendfile(r0, r0, 0x0, 0x101) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) 17m40.329231986s ago: executing program 5 (id=1767): r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000580), 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(r0, 0xc02c5341, &(0x7f0000000040)) openat$nvram(0xffffffffffffff9c, &(0x7f0000001300), 0x10102, 0x0) r1 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x10, 0x1b1c, 0x1b2a, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x30, 0x9, "", [{{0x9, 0x4, 0x0, 0x4, 0xfe, 0x3, 0x0, 0x1, 0x0, {0x9, 0x21, 0x5, 0xfc, 0x1, {0x22, 0x28}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff, 0x3, 0x81, 0x2}}}}}]}}]}}, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpuset.effective_cpus\x00', 0x275a, 0x0) fcntl$lock(r2, 0x40f, &(0x7f0000001040)={0x0, 0x3, 0x0, 0x2}) write$UHID_INPUT(r2, &(0x7f0000000000)={0x9, {"a2e3ad214fc752f91b5d090930f70e0dd038e7ff7fc6e5539b324c078b089b3434076d1a0890e0878f0e1ac6e7049b076d959b669a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b353b0d076d0936cd3b78130daa61d8e809ea889b5802b77f07227227b7ba67e0e78669a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae19397d696d0d758f2dc7d1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000002335875271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1fe90a56c71b1931870262f5e801119242ca026bfc821e7e01000000138e645bb80c617601000000be70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d595a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9980000000b3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6c82fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c2021d653a5520000008213b704a5000000000000008ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc94681359bad8deff4b05f60cea0da7710a80000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4e38a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12d3099dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2bed9e53803edf1a4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4ceb360c7e658828563e2d25c4aa348561f927e88f6dc7bcbf2a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b4bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034e00000000ca509301815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827466cfa5c478b095b68441a34cb51682a8ae4d24ad92f243941ed274549b79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdbe6c4579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93ae62fccfcbb2b75a2183c46eb65ca8124e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43e4fb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e01feffffffffffff83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d951061ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369d75f2e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aa01b20f7694a00f16e2d0174035a2c22656dc00880acebdbe8ddbd75c2f998d8ac2dfad2ba3a50200000045a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe2907ac0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf463661c953fcad6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7cd419e037f3e3ad038f2211f1033095563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaeecf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6ea94f88a4facfd4c735a20307c737afae5136651b1b9bd522dcb399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a37684f4113c48859465c3b415c3432f81db87195358bfee2916580dacae008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463183b4b87c105000000302a808d7f5251440613d17ca51055f2f416a44fe180d2d50c312cca7cb14a20dc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb40100000006376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab83c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7ceec7dc808bf653639d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a602000000000000007007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00303000000000000007fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2df086dc746b0827cbf6529006c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6522fb5f6ffcdd56fed88935fcb75912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae233a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a5bd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08008897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b80c1c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57fa9c0fe662a46b7f71cd47744db86c50b704c98ad90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36ffffffff00000000b77940b5f07722e47a08d3679507000000000000934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1062dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1df0d07b3d5bd3b01faffd0addbed2881a9700af561ac8c7e36bb2fc4c40e9c766c06817b97c9ede7885d94ffb0759be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c1484d2f9c55f4901203a9a8a2c3e90f39c3dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d00000f4ff000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000600", 0x1000}}, 0x1006) syz_usb_connect$uac2(0x2, 0x10e, &(0x7f0000001080)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x10, 0x2b53, 0x23, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xfc, 0x3, 0x1, 0x7, 0xc0, 0x1, {0x8, 0xb, 0x0, 0x2, 0x1, 0x0, 0x20, 0x7}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x7ff, 0xa, 0x59, 0x40}, [@input_terminal={0x10, 0x24, 0x2, 0x6, 0x404, 0x5, 0x4, 0x2, 0xfffffffa, 0x9, 0x3, 0xf7}, @sample_rate={0x13, 0x24, 0xd, 0x4, 0x2, 0x6, [0x0, 0x1, 0x2, 0x2, 0x0, 0x2]}, @mixer_unit={0x5, 0x24, 0x4, 0x6, 0xc0}, @input_terminal={0x10, 0x24, 0x2, 0x6, 0x206, 0x4, 0xe8, 0xc9, 0x1ff, 0x9, 0x52, 0x5a}, @feature_unit={0x9, 0x24, 0x6, 0x4, 0x6, [0x5, 0x6]}, @sample_rate={0xf, 0x24, 0xd, 0x5, 0x1, 0x6, [0x1, 0x1, 0x1, 0x0]}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {[@format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0x8da2, 0x101, 0x81, 0xc}, @format_type_i_discrete={0x11, 0x24, 0x2, 0x1, 0x81, 0x1, 0x2, 0x56, "1cf81c8465d61061dd"}, @format_type_i_discrete={0x10, 0x24, 0x2, 0x1, 0x7, 0x4, 0x3, 0x4, "d62daccfa586d4a0"}, @format_type_i_continuous={0xe, 0x24, 0x2, 0x1, 0xf, 0x1, 0xa, 0x6, "ef5b93", "3e6fb6"}]}, {{0x9, 0x5, 0x1, 0x9, 0x10, 0x2, 0x7, 0xe1, {0x8, 0x25, 0x1, 0x1, 0x30, 0xff, 0xc0}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {[@format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0x6, 0x5dc0, 0xfa, 0x3}]}, {{0x9, 0x5, 0x82, 0x9, 0x10, 0x0, 0x40, 0x7, {0x8, 0x25, 0x1, 0x2, 0x30, 0x8, 0x2}}}}}}}}]}}, &(0x7f00000012c0)={0xa, &(0x7f00000011c0)={0xa, 0x6, 0x250, 0x4, 0x6a, 0xb7, 0x40, 0x80}, 0x5, &(0x7f0000001200)={0x5, 0xf, 0x5}, 0x2, [{0x4, &(0x7f0000001240)=@lang_id={0x4, 0x3, 0x405}}, {0x4, &(0x7f0000001280)=@lang_id={0x4, 0x3, 0x42d}}]}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000002c0), r3) sendmsg$IEEE802154_LLSEC_DEL_SECLEVEL(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000540)={0x28, r4, 0x1, 0x70bd27, 0x25dfdbfb, {}, [@IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x6}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x40}, 0x4000000) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io(r1, &(0x7f0000000080)={0x2c, &(0x7f00000000c0)=ANY=[@ANYBLOB="200928000000280883efb930f018a14c0c20b20300c00df7"], 0x0, 0x0, 0x0, 0x0}, 0x0) 17m38.518000672s ago: executing program 5 (id=1781): r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) syz_genetlink_get_family_id$smc(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r3 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r3, 0x40086602, &(0x7f00000002c0)=0x20) mknod$loop(&(0x7f0000001280)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x2000, 0x0) unlink(&(0x7f0000000200)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') r4 = syz_genetlink_get_family_id$smc(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$SMC_PNETID_DEL(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB="14074a00", @ANYRES16=r4, @ANYBLOB="010000000000fedbdf2502020200"], 0x14}, 0x1, 0x40030000000000, 0x0, 0x20040841}, 0x8000) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f0000000340)={[{@lowerdir={'lowerdir', 0x3d, './file0/file0'}, 0x3a}, {@verity_on}, {@nfs_export_off}, {@redirect_dir_on}, {@index_off}, {@metacopy_on}], [], 0x2f}) r5 = open$dir(&(0x7f0000000040)='./file0\x00', 0x20, 0x80) r6 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000700)=ANY=[@ANYBLOB="140100002000010000000000fbdbdf25030117800c0016a02c66659839503d904ea3250006ac0f006f359a2cac383f71de92d801e48162000000001400010000000000000000000000f422412756a5d727e97b7fffff0000000050bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126ffffd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029de71da46cf26fbe816b89f7cb81bff81a8b"], 0x114}], 0x1, 0x0, 0x0, 0x1}, 0x0) ioctl$FS_IOC_GETFLAGS(r5, 0x80086601, 0x0) r7 = syz_genetlink_get_family_id$smc(&(0x7f00000000c0), r1) sendmsg$SMC_PNETID_ADD(r1, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x5c, r7, 0x1, 0x70bd2d, 0x25dfdbff, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz2\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz2\x00'}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x2}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'bond_slave_0\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'geneve0\x00'}]}, 0x5c}, 0x1, 0x0, 0x0, 0x6081}, 0x8080) sendmsg$SMC_PNETID_DEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x14, r4, 0x1, 0x0, 0x25dfdbfe, {0x2, 0x2, 0x2}}, 0x14}, 0x1, 0x40030000000000, 0x0, 0x24040841}, 0x8000) 17m37.94844543s ago: executing program 5 (id=1787): r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 17m36.100922506s ago: executing program 5 (id=1794): ftruncate(0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x200}, 0x1c) listen(r1, 0x0) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000026c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xa}}, [@NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2}, [@NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x24, 0x4, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_CT_DREG={0x8, 0x1, 0x1, 0x0, 0x13}, @NFTA_CT_KEY={0x8, 0x2, 0x1, 0x0, 0x10}]}}}]}]}], {0x14}}, 0x78}, 0x1, 0x0, 0x0, 0x40000}, 0x8044) ioctl$NILFS_IOCTL_SET_SUINFO(r0, 0x40186e8d, &(0x7f00000001c0)={&(0x7f00000000c0)=[{0x7, 0x1, 0x0, {0x6, 0xfffffffb, 0x2}}, {0x7, 0x2, 0x0, {0x400, 0x5e, 0x2}}, {0xff, 0x0, 0x0, {0x0, 0x1ff, 0x1}}], 0x3, 0x20, 0x2, 0x528}) r3 = accept(r1, 0x0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) r4 = syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) ioctl$FE_GET_EVENT(r4, 0x80286f4e, &(0x7f0000000140)) ioctl$FE_SET_FRONTEND(r4, 0x40246f4c, &(0x7f0000000080)={0x30a32c0, 0x1, @qam={0x3, 0xb, 0xa}}) sendmsg$TEAM_CMD_OPTIONS_SET(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000004c0)=ANY=[], 0xfffffdef}, 0x1, 0x0, 0x0, 0x2400c840}, 0x0) r5 = socket$netlink(0x10, 0x3, 0xc) setsockopt$sock_int(r5, 0x1, 0x10, &(0x7f0000000200)=0xffffffff, 0x4) connect$unix(r3, &(0x7f0000000140)=@file={0x0, './file0\x00'}, 0x6e) 17m35.628103411s ago: executing program 34 (id=1794): ftruncate(0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x200}, 0x1c) listen(r1, 0x0) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000026c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xa}}, [@NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2}, [@NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x24, 0x4, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_CT_DREG={0x8, 0x1, 0x1, 0x0, 0x13}, @NFTA_CT_KEY={0x8, 0x2, 0x1, 0x0, 0x10}]}}}]}]}], {0x14}}, 0x78}, 0x1, 0x0, 0x0, 0x40000}, 0x8044) ioctl$NILFS_IOCTL_SET_SUINFO(r0, 0x40186e8d, &(0x7f00000001c0)={&(0x7f00000000c0)=[{0x7, 0x1, 0x0, {0x6, 0xfffffffb, 0x2}}, {0x7, 0x2, 0x0, {0x400, 0x5e, 0x2}}, {0xff, 0x0, 0x0, {0x0, 0x1ff, 0x1}}], 0x3, 0x20, 0x2, 0x528}) r3 = accept(r1, 0x0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) r4 = syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) ioctl$FE_GET_EVENT(r4, 0x80286f4e, &(0x7f0000000140)) ioctl$FE_SET_FRONTEND(r4, 0x40246f4c, &(0x7f0000000080)={0x30a32c0, 0x1, @qam={0x3, 0xb, 0xa}}) sendmsg$TEAM_CMD_OPTIONS_SET(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000004c0)=ANY=[], 0xfffffdef}, 0x1, 0x0, 0x0, 0x2400c840}, 0x0) r5 = socket$netlink(0x10, 0x3, 0xc) setsockopt$sock_int(r5, 0x1, 0x10, &(0x7f0000000200)=0xffffffff, 0x4) connect$unix(r3, &(0x7f0000000140)=@file={0x0, './file0\x00'}, 0x6e) 3m45.475702525s ago: executing program 1 (id=7199): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x181041, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, 0x0) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000040)={0x28, 0x5, 0x0, 0x0, &(0x7f0000000000)="7f", 0x1, 0xfffffffffffffffe}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000100)={0x48, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) 3m45.368276456s ago: executing program 1 (id=7201): r0 = syz_open_dev$dri(&(0x7f0000000000), 0x1ff, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$netlink(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000007d00)=[{&(0x7f0000000340)={0x1c, 0x6a, 0x15, 0x8000000, 0xffffffff, "", [@nested={0xc, 0x4e, 0x0, 0x1, [@nested={0x4, 0x94}, @nested={0x4, 0x146}]}]}, 0x1c}], 0x1}, 0x8000) (async) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='environ\x00') read$fb(r2, &(0x7f00000000c0)=""/78, 0x4e) ioctl$DRM_IOCTL_MODE_LIST_LESSEES(r0, 0xc01064d1, &(0x7f0000000040)={0x2, 0x0, &(0x7f0000000100)=[0x0, 0x0]}) 3m44.874342363s ago: executing program 1 (id=7207): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000005ec0), 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000080)={'wlan1\x00', 0x0}) syz_open_dev$radio(&(0x7f0000000040), 0x0, 0x2) syz_open_procfs(0x0, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan0\x00'}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000006000)={0x0, 0x0, &(0x7f0000005fc0)={&(0x7f0000000000)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01002dbd0600ffdbdb252100000008000300", @ANYRES32=r3, @ANYBLOB="0600eb00000800000400ec000a00060008021100000500000600f70000ff000008009e"], 0x44}}, 0x28000) 3m44.805573105s ago: executing program 1 (id=7210): socket$inet6_tcp(0xa, 0x1, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x400000000000000) r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r0, 0xfffffffc) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(0x0, 0xffffffffffffffff) socket$inet_mptcp(0x2, 0x1, 0x106) socket(0x10, 0x3, 0x0) syz_open_dev$ndb(&(0x7f00000012c0), 0x0, 0x820000) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) r8 = dup(r7) syz_usb_control_io$lan78xx(0xffffffffffffffff, 0x0, &(0x7f0000000540)={0x34, 0x0, 0x0, &(0x7f0000000440)={0x0, 0x8, 0x1, 0x6}, 0x0, 0x0, 0x0}) syz_ublk_setup_queues(r8, r6, &(0x7f0000000480)={0x0, 0x0, 0x1000, 0x0, 0x257}, &(0x7f0000000580)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x880700, 0x20, 0x1000000, 0x4, 0x0, r8}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffffff, 0x4000, 0x0, 0x180, 0x0, r8}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x0, 0x1, 0x4, 0x0, r8}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x2, 0x1, 0x9d7c}}], 0x1, &(0x7f0000001000)={0x2e, 0x4c, 0x0, r8, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, r5, '\x00', {0xfffd, 0x5, 0x0, 0x0}}, 0x0) 3m42.773679055s ago: executing program 1 (id=7227): socket(0x2, 0x3, 0xff) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl(r0, 0x8b1a, &(0x7f0000000040)) r1 = socket$kcm(0x10, 0x2, 0x4) r2 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000), 0x8502, 0x0) write$sndseq(r2, &(0x7f0000001380)=[{0x6, 0x0, 0x0, 0x0, @time={0x9, 0x9}, {0x5, 0x20}, {0x20, 0x4}, @connect={{0x40}}}, {0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @result}, {0x10, 0x0, 0x0, 0x0, @time={0x0, 0x7}, {0x7}, {0x0, 0x80}, @control}, {0x0, 0x4, 0x0, 0x0, @tick=0xdf, {}, {}, @time}], 0x70) sendmsg$kcm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000100)="4c000000150097f87059ae08060c040002ff0f020000000000000187ac1414aaa69d35a2cca84708f7abca1bac1414aabd7c493872f750375ed08a560400000003c48f93b82a03000000461e", 0x4c}], 0x1}, 0x4004800) r3 = openat$dsp(0xffffffffffffff9c, 0x0, 0x40281, 0x0) ioctl$SNDCTL_DSP_SUBDIVIDE(r3, 0xc0045009, 0x0) syz_open_dev$vcsa(&(0x7f0000000040), 0xfffffffffffffffd, 0x14280) 3m42.204106745s ago: executing program 1 (id=7231): r0 = socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)={0x28, r2, 0x1, 0x70bd2b, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_MESH_CONFIG={0xc, 0x23, 0x0, 0x1, [@NL80211_MESHCONF_HT_OPMODE={0x6, 0x16, 0x14}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x24002005}, 0x4000) (async) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)={0x28, r2, 0x1, 0x70bd2b, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_MESH_CONFIG={0xc, 0x23, 0x0, 0x1, [@NL80211_MESHCONF_HT_OPMODE={0x6, 0x16, 0x14}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x24002005}, 0x4000) creat(&(0x7f0000000180)='./file0\x00', 0x40) (async) r4 = creat(&(0x7f0000000180)='./file0\x00', 0x40) recvmmsg(r4, 0x0, 0x0, 0x100, 0x0) pipe2(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) mount$9p_fd(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000080), 0x0, &(0x7f0000000200)={'trans=fd,', {'rfdno', 0x3d, r5}, 0x2c, {'wfdno', 0x3d, r6}, 0x2c, {[{@noxattr}]}}) (async) mount$9p_fd(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000080), 0x0, &(0x7f0000000200)={'trans=fd,', {'rfdno', 0x3d, r5}, 0x2c, {'wfdno', 0x3d, r6}, 0x2c, {[{@noxattr}]}}) 3m26.252523396s ago: executing program 35 (id=7231): r0 = socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)={0x28, r2, 0x1, 0x70bd2b, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_MESH_CONFIG={0xc, 0x23, 0x0, 0x1, [@NL80211_MESHCONF_HT_OPMODE={0x6, 0x16, 0x14}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x24002005}, 0x4000) (async) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)={0x28, r2, 0x1, 0x70bd2b, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_MESH_CONFIG={0xc, 0x23, 0x0, 0x1, [@NL80211_MESHCONF_HT_OPMODE={0x6, 0x16, 0x14}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x24002005}, 0x4000) creat(&(0x7f0000000180)='./file0\x00', 0x40) (async) r4 = creat(&(0x7f0000000180)='./file0\x00', 0x40) recvmmsg(r4, 0x0, 0x0, 0x100, 0x0) pipe2(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) mount$9p_fd(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000080), 0x0, &(0x7f0000000200)={'trans=fd,', {'rfdno', 0x3d, r5}, 0x2c, {'wfdno', 0x3d, r6}, 0x2c, {[{@noxattr}]}}) (async) mount$9p_fd(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000080), 0x0, &(0x7f0000000200)={'trans=fd,', {'rfdno', 0x3d, r5}, 0x2c, {'wfdno', 0x3d, r6}, 0x2c, {[{@noxattr}]}}) 2m31.223536749s ago: executing program 2 (id=7654): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_generic(0x10, 0x3, 0x10) bind$alg(0xffffffffffffffff, &(0x7f00000002c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'lrw(camellia)\x00'}, 0xfffffd85) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="280000003f0009000000000000080000030000000400000010000180"], 0x28}, 0x1, 0x0, 0x0, 0x4080}, 0x4) r2 = socket$packet(0x11, 0x3, 0x300) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000d23180000000000000100000a20000000000a05000000000000000000010000000900010073797a30000000002c000000030a01020000000000000000010000000900010073797a30000000000900030073797a300000000070000000030a0500000000000000000002000002080005"], 0xe4}, 0x1, 0x0, 0x0, 0x11}, 0x0) r4 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) getsockopt$WPAN_WANTACK(r4, 0x0, 0x0, &(0x7f0000000240), &(0x7f0000000040)=0x4) setsockopt$packet_int(r2, 0x107, 0xf, &(0x7f0000000100)=0x4000004, 0x4) r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) r6 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x1, 0x0) sendmsg$NFT_MSG_GETCHAIN(r3, &(0x7f0000000480)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x44, 0x4, 0xa, 0x401, 0x0, 0x0, {0x7, 0x0, 0x7}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}, @NFTA_CHAIN_FLAGS={0x8, 0xa, 0x1, 0x0, 0x1}, @NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x4}, @NFTA_CHAIN_FLAGS={0x8}, @NFTA_CHAIN_POLICY={0x8, 0x5, 0x1, 0x0, 0xfffffffffffffffe}]}, 0x44}, 0x1, 0x0, 0x0, 0x24000005}, 0x0) r7 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r7, &(0x7f0000000040)={0xa, 0x4001, 0x0, @empty}, 0x1c) setsockopt$SO_TIMESTAMP(r7, 0x1, 0x23, &(0x7f0000000000)=0x8, 0x4) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r6, 0x40405515, 0x0) ioctl$BLKTRACESTART(r5, 0x1274, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'ip6gretap0\x00', 0x0}) sendto$packet(r2, &(0x7f0000000180)="0b036c00e0ff64000200475400f6a13bb10000000800894f4803", 0x100a6, 0x0, &(0x7f0000000140)={0x11, 0x0, r8}, 0x14) 2m30.441520161s ago: executing program 2 (id=7659): r0 = socket$kcm(0x10, 0x3, 0x0) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, 0x0) ioctl$IOMMU_IOAS_MAP$PAGES(r1, 0x3b85, 0x0) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r1, 0x3ba0, &(0x7f0000000100)={0x48}) write$cgroup_subtree(r0, &(0x7f0000000100)=ANY=[@ANYBLOB="0007000042009103"], 0xfe33) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x89f1, &(0x7f0000000340)={'ip6gre0\x00', &(0x7f0000000f00)=@ethtool_per_queue_op={0x4b, 0xe, [0xf68f, 0x8, 0x9, 0x1ff, 0x4, 0x4, 0xe97, 0x4, 0x6, 0xecbf, 0xff, 0x101, 0x4007, 0x200, 0xfffffff7, 0x5e, 0x1000, 0xffff, 0xf557, 0x2, 0x5, 0x7c, 0xce, 0x2, 0xffffff6b, 0xe52c, 0xaa8, 0x7ffffffc, 0xd, 0xe9c4, 0xcd8, 0x6e, 0x200006, 0x7, 0x8000, 0x8a, 0x3, 0x6, 0x3, 0x3, 0x3, 0xfffffffc, 0xfd2, 0x6, 0x8, 0x401, 0xfffffffe, 0x2b, 0xa, 0x0, 0x7, 0x8, 0x5, 0x3, 0x6, 0x8, 0x23, 0x2, 0x3, 0x10, 0x3, 0xffffffff, 0x6, 0x5fffffd, 0xd1, 0xf, 0x4, 0xa, 0xfffffffe, 0x400, 0x80000000, 0x8000, 0x3, 0x5, 0x2, 0x0, 0x2, 0x1, 0x80, 0x4, 0x2, 0x0, 0xd, 0x2000006, 0x4, 0x8, 0x0, 0x1, 0xfffffffc, 0x0, 0x1000, 0x7, 0x2, 0xbde, 0x37, 0x3, 0x4, 0x1, 0xa, 0x6, 0x7fff, 0x1, 0x3, 0x33e3, 0x9, 0x6, 0x7fff, 0x6, 0x104, 0x3, 0xfffffffd, 0x2, 0x6, 0x8, 0x6, 0x7, 0x200, 0x9, 0xe, 0x81, 0x0, 0x4, 0x105, 0x5, 0x8, 0x3, 0x1, 0xfffffffa]}}) 2m30.165567718s ago: executing program 2 (id=7661): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x84042, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000080), 0x100d, 0xde8bef52389a5434) ioctl$LOOP_CONFIGURE(r1, 0x4c0a, &(0x7f0000000280)={r0, 0x0, {0x0, 0x0, 0x0, 0xffffffffffffffff, 0x4000000000000004, 0x0, 0x0, 0xb, 0x14, "996a78edc5cac93c3e473f65d9eb5297f0ca82d56dcddb164e29606b4f2cf0b60d72deb3cf1597f6b7ff9c4fbf4726f66eccdbf05411d4a42e798491c50e3e6f", "3c54d63cef61aa187f941933694c882f48359819ddc15edb9ca42b19126327fbe58f617cc4717f53d6a395cace0534365db4d55dace1d4e9d5526fa40100", "fd0000e7744b74eaa2317fdd9db2fea7e7d63f9a007866063c8c162b99d845fb", [0x61, 0x4]}}) 2m29.943698032s ago: executing program 2 (id=7662): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5021900000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000030000000000000a6c000000060a09040000000000000000020000000900020073797a32000000000900010073797a3000000000400004803c0001800b00010065787468647200002c000280080007400000000c0500020000000000080003405700004a080006"], 0x94}, 0x1, 0x0, 0x0, 0x80}, 0x20000000) 2m29.691408624s ago: executing program 2 (id=7663): r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) r1 = getpid() syz_usb_connect(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120110037f1ce808000000a3f30a010203010902240001020010110904630702584200080905fe0f100008000909050203"], &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0}) r2 = syz_pidfd_open(r1, 0x0) fcntl$lock(r0, 0x26, &(0x7f0000000000)={0x0, 0x4, 0x3, 0x826a, r1}) r3 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x0, 0x0) ioctl$COMEDI_DEVCONFIG(r3, 0x40946400, &(0x7f00000000c0)={'rti802\x00', [0x5, 0x4, 0x4, 0x4, 0x0, 0x10005, 0x79, 0x8, 0x8000b, 0x3ff, 0x2, 0x6c, 0x5, 0x2, 0x6, 0x100, 0x6, 0x9, 0x4, 0x7fffffff, 0x6, 0xca9f, 0x9, 0x20001e58, 0x3, 0xf39e, 0x7ff, 0x0, 0x4, 0x801, 0x2]}) close(r2) 2m28.103992102s ago: executing program 2 (id=7666): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) r1 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$UHID_CREATE(r1, 0x0, 0x0) mprotect(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x6) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)) (async) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff}) pipe2$9p(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000004500), 0x0, &(0x7f0000000100)={'trans=fd,', {'rfdno', 0x3d, r3}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[{@version_9p2000}]}}) (async) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000004500), 0x0, &(0x7f0000000100)={'trans=fd,', {'rfdno', 0x3d, r3}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[{@version_9p2000}]}}) write$P9_RVERSION(r4, &(0x7f0000000080)=ANY=[@ANYBLOB="150000006bffff", @ANYRES16=r3, @ANYRESHEX=r4], 0x15) (async) write$P9_RVERSION(r4, &(0x7f0000000080)=ANY=[@ANYBLOB="150000006bffff", @ANYRES16=r3, @ANYRESHEX=r4], 0x15) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(0xffffffffffffffff, 0xc018937c, &(0x7f0000000200)={{0x1, 0x1, 0x18, r3, {0x2}}, './file0\x00'}) (async) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(0xffffffffffffffff, 0xc018937c, &(0x7f0000000200)={{0x1, 0x1, 0x18, r3, {0x2}}, './file0\x00'}) write$UHID_INPUT(r1, &(0x7f0000000540)={0x8, {"5e070e236ad9f8f91e55cf81621100111715b9fa3cb3cbd3e77c57b9009a5d15d07672840b3c4a07ae89454f211cc53330fd6d4d77b9ac204fc32f0eb01d88a224ec2885b35f297c1e6f995e1604e7144b819bad6c7d63a977387d6e6b3a4e733cf8b9f8f73063d7ca111986cb180ea0de975d1430ba8c7212e57bf011ff9c35b947f9d76027e6304f01093113fac9e835aeed20395ae74df0068f6cf06680487e79f7d5d971edbbd382da6a6063269cd15e59ee4651a2100f4ccad8e52d6a290185865729bcee3e643b5739ac54d0bfa6ba64ea71250aab7a3e67bd35388b2e4b2f2b3cf891cdb94195aca709a28fdeaf7465382041384fd1092f120aaeaf928921ec610e07e14cc8ea747e8459a5af9b49534abde0f59ea876b1ef64427acca328d76cda6c4f8335fcbb534eb8aeb3614c1703fd37ab61d821c91d9fa23896e8831aabdced019c80c3a4dee4f9a4b66059b71f28203df2d2b9e990c46a00d6e07d04b959ee4777ed612cf434268003533efa0000b691d3eb25b830c028105e4fa8899a0ab0c3f608de785dd3d40843835e890f9b5d29033e36e0c1001ba8c83eefcd23430e68dd4471e9f27c39c5ac5f398bf77096558e3f5a01ecd8740acbdafe1d315893fef0b7d9b7cdc1cdd7c2662703d611fa0a3f1bcdbc109447b93b9353f0acd5b4289b6a5ca1854f96696d01d2f340e377f45c04ac371ff9362a6b089bf15bc25d39b3124dee88df2e0c2ba0971879b45d9b6de83c68cb1140b7a66418c4b380498acce83c8ce391881f78af698aa03a45aa9b7f9b7d765131d1fac67e3a15ce6c6ac71b3745b3bf2f4c14c1fb4be4e56a19abc6f62d73eb57c103be6f7d21f8211a5b48a13a4ca1c47c17ec9a78416c24c12ff4441b2c8f923c507ac6ce7c884dbd3f5c3075da4d855c405bbdf60153b7d012ba37ec287b5c772c2fabe43d6fc4d94773b5e9f7c6e730f34ad99c3aa0a6b7df15c2df542ccbac02a419318228d46e20a058e0cd05e714e96338124dece40511d632c9c8cd5d0390095fff64fdf72b594025ffcf0a5e2feeea81742a07bc0118a1fac892ecd0dfe7e7f8a8cdb2d132c7dfdf17978320d2fcca628937ac646e49ffdd25d4b649570db126ef4235a39bffa93f751520e1ff5d61c80235d98bf5050b50f9c21c1db66ba7dba6823208feec302c438719e110806f2cb65a5607bb3cd14b494f616fc1d535ae5d59ebc6b7e2953a74b2cc91065d4d12ba3a02eebfc2d1f9919f8f1b911f40c30752aebca7f72baf9869e43d459d9d91c9cbb433af9561264e157c851c44c37668d3ee555351d65e15d1222012d885e6ca0c5eacb7ac005d45ad61c6be10714e93f628e81da54141b7147baccf004c16653438b9a759465888a1f516456391edd21dfdafda0def4e909d9dd5a086ef936f9bc126fb699020e7ffebb2266edeb7a4b7396f9a468a8bec45ccb17c3f2173ef1963075f7122e0ccf00b8eecadfae793e1cbab552622b6aae7a28e0cbd35b5fc003c3fe2b6cd654f0a5cd91d92b15275d8ea01265f61add64959858bb73e9b1c89f926640398684b3cbd444d181c600000000000000000d3287d6e9b616d4e2712b687349f1efe0685f283386a7512c53a838dbba8fe5ddd2227ae944189ca64419758572793a926ea9ab5380c1bd7a698381ffbcbcca6d90e44c899de400f5a4d3d07001a4803d10128e324d1470208c32e7807ff4e3ba9e772dddeaaaae990ff1bea1711e95c6d46a6b7fd49c71b93ee82f6f8048abb32d5275156a12087ee26d4cdc29444dc770cf91501d032d3d0de609b6e6f1f7918ade71ca670477bf2455df14faf0969e0181079b4215953f517edd128ffc903add2d71f774fe60d3580c5d0bc2b58ec7f7845a51f161d3519faf8689822dccc355a698bc80714257d7c95ec19c85a2a40c219396d73b0e668ce5a2bee43e3b0ffcf5d9041177aa69834de26d8baabae948972d57b4d885c915cb55286dddf94132667f1e19a3377479ec57892c6f9f820f940dd193c1d2f4d974a96458853d63140cbaa36a738d231fda0f45bcd1616f53b7e069ecf8c9d694514f4e99655bcb59e922f4071e4013c0ab2ed3ad8f9dfda380204fd1e6eb13c3ebcc3e243c182c65284ec549adb91e74821328b5a2ad8d0af5b43961a17895add7b281f98f25aae992c0ced87b7fde02f8a17486fcc64277973a62c18bfda711a2d7b9691f1c17e5bc4df7a0037be882ed1952a6e5852a4a3e81d83093db82b3230a0deac7ae9891c4de62b0ea98cd0db21f3d22843c3cc210d8ff9a6bfb8dcb6ec2f33a453466f0c7495798ee69fffcbd6ba9d1124b0a00a5d493e3cff0e8763df334dfb71569636177e93b102855dcd9c980953422f9f6f00858492eca950329fecd8f474cf41797ecb9557d739b947beae9addf09f13ee8418c35208c04bea8d5ac2e58dea3e73a91a680c1eb4af20cd489408945b42a821cb99b683a93cc0986d163936d60202e6974686e9d3f3d49713ea75ede76c6007bcf96f7282291f671dfd570004e71578f521d62a71d798e47b43679cc45cd67d51de3489c0c00ea7921796aa754c99575151d7024fda8c04458c80ee5e072412c229411bcbac0a24c99ab4298b28cbf53fbea3902cdf0000f2342388f1f583314fb65de27a6b30779063f1a25b70b33db3004121b1fd39a73cdf3c0e335e7f8628b6d2e1dcb7ed9dfeba6714d282782ad5992449358e4d349c5fa6e7f0cedbd33694b1e61b80553635bbe520788908fbc88d98b76926e51eb9b4331eb4925ab3eb3e453d40081373acf27e8eef6e707fc6303df9a1f4291166146e942173b1492567f069af1165725325749da782aa990365cc2ecb4802392a34903156d042df00d363b5366a3d6bdc9c3e4b1e27370b3e643141a480c913c3eb136df63f651b17c5ae7493b7eb8dce1198245262ee06bec2c236c6cb72fce26b107685ae4e9e5470bf883e8e9650e6894e02b4b18c11675c05d20213ce3caf24c48df93b830e8b5ad62ceb095a281f8a277e368a228f1fd66e5ac2a9f647bfff2f56c9d5e35969ccc01c92cc2bb43dcdd0fd8c8f235f0029ee906a0a8883c86c12b9b8756a95added6dd7467beee1348da8f700d1cc107453e3eb6f7a149085effa8ec999698f56e4d51931f1214525e08798ec106f02c7a24e53d0cdfcd10be172e2ffaccb9be02304c8005d45d5e6186c42a588b2fddd66975c67dadfe7ba768a33c1782301e9552767efee8ee121fa80372d04f0e7557ab9d6e7d29ec06ba8cdd5f0dac4fce916df28d8e0d24d5a978fdac69e9808323e36224b3853322d7a6f477fa84ba9f74466c728663e0931ba1e7788794e6e4da59937c1325aa3b5c76356f14b8480ad7ce87fc227bec3a0724c9740fb478306284480384eed66c8627ecda0d08736e54602e1bd251885f56a9a5a2632c35aa41ce10f61fd07141bdbc2f05b1a1e6884145b93d742f521d7d969ee1846baa54506f02bc7567b12336d0cb84f43f6c786427b9a9e66e31acf9005a189fd64a98378fff4fcdc74ff48e6c3cd80d472ea6fe5c019d2aa9dd8777d2e9b1a724a152e24b65dbce3970bc044876930633c2c48ebc85f51cb3e2b960c7e02d45134abdb74cbc9c631da2a3453d5cf2cd833b4dba95eca582f0d6df84497c4ccf8d72800c8a0ee7b69fa308443d9a715db30ee7748c05738a26d85996744e771194871f6ca212b574c08d14234cf8b7bb6695ba489090feb97e024679a7945da720f7ac3c197207c6353ed74e751b08da2acb3dded61800ef11bce805ab794ec913c635308a27f98ecd33f470cc2e53f10181a66ac90c9e8d6fb7fa8fc070e091c208428d1448cd0cb1df77e20a8fd96492f6042b7d5b0b179d873c4ab40756a7835e43e6bfea63a02e2e30db50c930fcf94016585322cb7b810430c48cf9cbfc6d4757958fc60b26ad724a9a318b5f1c3dd28029c0c0cc9abc4cb99793b984b0c73a0803cc727d9765bc40b809b37ac4dd08b90a08e0dcae786f00acbfcb1df8bdb0b572a0d3f885500194f6b3787719894b74b0580b13bb13fed4bf0868f2fd8d90e451ea53102088a280c23ab166fa41b21d71e220109e63d2acbc84bfc907cadcec66e5ff0e27a684bdd35706a209f7ee89192ea60115ea0be84f4c2285f15aaeef2141facc852334948ff91173d383b23a7c9dfdae5c6e614e965745b6e7d7e65c00fe461fc437ab1371c5308599dacce01115106a48f8ece79cab7f9f8eddc358887381dff9ee0a0e63368e145e1af2b2a415dabbb4298d84da80f22c5c32a381e5684a429cecc3c2d9f392aa6de2f5899c4fcd3b3b79cbefe038120fcac69223ef2b7c35344bdf838a6218adc31d3f9f2fbc7659ebc912b640132153510e763f480a58ada3fe6dfe6de897d9642764af11733efea262d87866df64209cbbdb2ec01533da4d2cd0021d369c6e25c0521ea1d7e06fc402420347a367f67944fe6a692d7e842e400618ea18768d4d42179782528b82fffd8509064fa4d62f7c77fa1328155ca188234f25eabd7f38ff42227cb4b484f25e7dca08dd7123085ba21fdc8f52716eea82849b8e0f011c7d922eed90fc009ec77e24bb0622d7a5908708f9841dd69f87d03a5cb7b35ac95a1ba22ea17370f1b6d70fb9dc8557272550223dcb0f6989e71dfe5109d4e3e7528349d4236c7625839de41dd9ed1af0adf9701277a2c1cabda04a3794d3bb872a3791b9bf312260265f1a1f168719f9ed060a441e4c9125cf936bd5d32fa71b318a66b39446ac7efa3fd87e64ab14ad72a9f23e805e6e3b05ee81e1cd969ae56796d7ba4d3560c855eb145477d48043fb0cfb1d6bd481fe09734a0a2dfd9d41b2d7b6366f4bfdf88937564a10d200927bbc7ec7bd5f7af027521f3cd1709f5de2588edcbb0cc8e4940dcfc5d50d94de3f04ba436b64bb781401fd9ff0d409973f085a5817cbf969f814ec9f24a62384517cc2a82ccf941aa0379f8532c0ab6f20867f3ca5b578493de3296df993254a6609cb5059dbda5fccc03a796cd7ea36b35696bfbcbb143ad80c9111cc0f5d675818b3cf6dfe39563798ad4f65d2d9018c58790fa15565195330222a3182decaeb61c6a518da24d5053c39d5d43f159ed46ef836a150f0130b38ddad72c0f26af5251d1020773c361b490c13badd76038dabbc010947f0912b306bb71618761d70caaf857e6a7500f812616d4040e637830f2e4f6f3a4ac14714cbf7ad2c6a9baf9b6f8f9b96b0ad0afc7554ed73ab79f95b219f63783ba9b13c86f989fe41a17b18f5fc027b5be7856bed3e89d74f9725e36cb1bcb06325e2428082cd31db5982577fe8a559e290ec4aa06f9e222c2c8aa12098d8a9468e2dc94dfc26bae4fa950a44fe74a5f89bc5f198ad5f5710f053437aee58b47ef93c5b12abe8575a6ed1426698dc394d4327690991b0938e81225f3b8b71fe85424fbbb684efeda3135e430cd4d9fb710848f5a4931be759ed83c7e71ecd3d2a4612d04ba35ebc5d13efde43dc657f28ff5ffc3fb55fc5a744ed3ff9407d979cbfd30066e601d4cd24fdfebe34a3ca12ad327568ff8bd2a0a15501846eb7a0cb9c5f123178f5593ad43d8d534c9c01601955b2e99e2655479c26154e03d64815aaece27bdaff24211d23eb9aa1fdd1b34097321e539024e4a93852d342326244b4d399c065130a1b4aa42101d0493eae6d982c4cae7f6b738e30388eef33a3516cc84295b1429eb4a8e80968ddf852996de14d0500", 0x1000}}, 0xffffff9b) r5 = socket(0x1e, 0x1, 0x0) getsockopt$WPAN_SECURITY(r5, 0x0, 0x1, 0x0, &(0x7f0000000500)) r6 = epoll_create1(0x0) ioctl$XFS_IOC_FREE_EOFBLOCKS(r6, 0x8080583a, &(0x7f0000000180)={0x4, 0x0, 0x8, 0x7, 0x8000, 0x0, 0x3}) (async) ioctl$XFS_IOC_FREE_EOFBLOCKS(r6, 0x8080583a, &(0x7f0000000180)={0x4, 0x0, 0x8, 0x7, 0x8000, 0x0, 0x3}) openat$full(0xffffffffffffff9c, &(0x7f0000000280), 0x620003, 0x0) syz_emit_vhci(&(0x7f0000001040)=@HCI_EVENT_PKT={0x4, @hci_ev_le_meta={{0x3e, 0x6}, @hci_evt_le_ext_adv_set_term={{}, {0x0, 0x0, 0xc8, 0xc}}}}, 0x9) (async) syz_emit_vhci(&(0x7f0000001040)=@HCI_EVENT_PKT={0x4, @hci_ev_le_meta={{0x3e, 0x6}, @hci_evt_le_ext_adv_set_term={{}, {0x0, 0x0, 0xc8, 0xc}}}}, 0x9) setsockopt$MRT_DONE(r5, 0x0, 0xc9, 0x0, 0x0) ioctl$NILFS_IOCTL_CHANGE_CPMODE(r0, 0x40106e80, &(0x7f0000000240)={0x7}) 2m12.975121901s ago: executing program 36 (id=7666): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) r1 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$UHID_CREATE(r1, 0x0, 0x0) mprotect(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x6) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)) (async) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff}) pipe2$9p(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000004500), 0x0, &(0x7f0000000100)={'trans=fd,', {'rfdno', 0x3d, r3}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[{@version_9p2000}]}}) (async) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000004500), 0x0, &(0x7f0000000100)={'trans=fd,', {'rfdno', 0x3d, r3}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[{@version_9p2000}]}}) write$P9_RVERSION(r4, &(0x7f0000000080)=ANY=[@ANYBLOB="150000006bffff", @ANYRES16=r3, @ANYRESHEX=r4], 0x15) (async) write$P9_RVERSION(r4, &(0x7f0000000080)=ANY=[@ANYBLOB="150000006bffff", @ANYRES16=r3, @ANYRESHEX=r4], 0x15) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(0xffffffffffffffff, 0xc018937c, &(0x7f0000000200)={{0x1, 0x1, 0x18, r3, {0x2}}, './file0\x00'}) (async) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(0xffffffffffffffff, 0xc018937c, &(0x7f0000000200)={{0x1, 0x1, 0x18, r3, {0x2}}, './file0\x00'}) write$UHID_INPUT(r1, &(0x7f0000000540)={0x8, {"5e070e236ad9f8f91e55cf81621100111715b9fa3cb3cbd3e77c57b9009a5d15d07672840b3c4a07ae89454f211cc53330fd6d4d77b9ac204fc32f0eb01d88a224ec2885b35f297c1e6f995e1604e7144b819bad6c7d63a977387d6e6b3a4e733cf8b9f8f73063d7ca111986cb180ea0de975d1430ba8c7212e57bf011ff9c35b947f9d76027e6304f01093113fac9e835aeed20395ae74df0068f6cf06680487e79f7d5d971edbbd382da6a6063269cd15e59ee4651a2100f4ccad8e52d6a290185865729bcee3e643b5739ac54d0bfa6ba64ea71250aab7a3e67bd35388b2e4b2f2b3cf891cdb94195aca709a28fdeaf7465382041384fd1092f120aaeaf928921ec610e07e14cc8ea747e8459a5af9b49534abde0f59ea876b1ef64427acca328d76cda6c4f8335fcbb534eb8aeb3614c1703fd37ab61d821c91d9fa23896e8831aabdced019c80c3a4dee4f9a4b66059b71f28203df2d2b9e990c46a00d6e07d04b959ee4777ed612cf434268003533efa0000b691d3eb25b830c028105e4fa8899a0ab0c3f608de785dd3d40843835e890f9b5d29033e36e0c1001ba8c83eefcd23430e68dd4471e9f27c39c5ac5f398bf77096558e3f5a01ecd8740acbdafe1d315893fef0b7d9b7cdc1cdd7c2662703d611fa0a3f1bcdbc109447b93b9353f0acd5b4289b6a5ca1854f96696d01d2f340e377f45c04ac371ff9362a6b089bf15bc25d39b3124dee88df2e0c2ba0971879b45d9b6de83c68cb1140b7a66418c4b380498acce83c8ce391881f78af698aa03a45aa9b7f9b7d765131d1fac67e3a15ce6c6ac71b3745b3bf2f4c14c1fb4be4e56a19abc6f62d73eb57c103be6f7d21f8211a5b48a13a4ca1c47c17ec9a78416c24c12ff4441b2c8f923c507ac6ce7c884dbd3f5c3075da4d855c405bbdf60153b7d012ba37ec287b5c772c2fabe43d6fc4d94773b5e9f7c6e730f34ad99c3aa0a6b7df15c2df542ccbac02a419318228d46e20a058e0cd05e714e96338124dece40511d632c9c8cd5d0390095fff64fdf72b594025ffcf0a5e2feeea81742a07bc0118a1fac892ecd0dfe7e7f8a8cdb2d132c7dfdf17978320d2fcca628937ac646e49ffdd25d4b649570db126ef4235a39bffa93f751520e1ff5d61c80235d98bf5050b50f9c21c1db66ba7dba6823208feec302c438719e110806f2cb65a5607bb3cd14b494f616fc1d535ae5d59ebc6b7e2953a74b2cc91065d4d12ba3a02eebfc2d1f9919f8f1b911f40c30752aebca7f72baf9869e43d459d9d91c9cbb433af9561264e157c851c44c37668d3ee555351d65e15d1222012d885e6ca0c5eacb7ac005d45ad61c6be10714e93f628e81da54141b7147baccf004c16653438b9a759465888a1f516456391edd21dfdafda0def4e909d9dd5a086ef936f9bc126fb699020e7ffebb2266edeb7a4b7396f9a468a8bec45ccb17c3f2173ef1963075f7122e0ccf00b8eecadfae793e1cbab552622b6aae7a28e0cbd35b5fc003c3fe2b6cd654f0a5cd91d92b15275d8ea01265f61add64959858bb73e9b1c89f926640398684b3cbd444d181c600000000000000000d3287d6e9b616d4e2712b687349f1efe0685f283386a7512c53a838dbba8fe5ddd2227ae944189ca64419758572793a926ea9ab5380c1bd7a698381ffbcbcca6d90e44c899de400f5a4d3d07001a4803d10128e324d1470208c32e7807ff4e3ba9e772dddeaaaae990ff1bea1711e95c6d46a6b7fd49c71b93ee82f6f8048abb32d5275156a12087ee26d4cdc29444dc770cf91501d032d3d0de609b6e6f1f7918ade71ca670477bf2455df14faf0969e0181079b4215953f517edd128ffc903add2d71f774fe60d3580c5d0bc2b58ec7f7845a51f161d3519faf8689822dccc355a698bc80714257d7c95ec19c85a2a40c219396d73b0e668ce5a2bee43e3b0ffcf5d9041177aa69834de26d8baabae948972d57b4d885c915cb55286dddf94132667f1e19a3377479ec57892c6f9f820f940dd193c1d2f4d974a96458853d63140cbaa36a738d231fda0f45bcd1616f53b7e069ecf8c9d694514f4e99655bcb59e922f4071e4013c0ab2ed3ad8f9dfda380204fd1e6eb13c3ebcc3e243c182c65284ec549adb91e74821328b5a2ad8d0af5b43961a17895add7b281f98f25aae992c0ced87b7fde02f8a17486fcc64277973a62c18bfda711a2d7b9691f1c17e5bc4df7a0037be882ed1952a6e5852a4a3e81d83093db82b3230a0deac7ae9891c4de62b0ea98cd0db21f3d22843c3cc210d8ff9a6bfb8dcb6ec2f33a453466f0c7495798ee69fffcbd6ba9d1124b0a00a5d493e3cff0e8763df334dfb71569636177e93b102855dcd9c980953422f9f6f00858492eca950329fecd8f474cf41797ecb9557d739b947beae9addf09f13ee8418c35208c04bea8d5ac2e58dea3e73a91a680c1eb4af20cd489408945b42a821cb99b683a93cc0986d163936d60202e6974686e9d3f3d49713ea75ede76c6007bcf96f7282291f671dfd570004e71578f521d62a71d798e47b43679cc45cd67d51de3489c0c00ea7921796aa754c99575151d7024fda8c04458c80ee5e072412c229411bcbac0a24c99ab4298b28cbf53fbea3902cdf0000f2342388f1f583314fb65de27a6b30779063f1a25b70b33db3004121b1fd39a73cdf3c0e335e7f8628b6d2e1dcb7ed9dfeba6714d282782ad5992449358e4d349c5fa6e7f0cedbd33694b1e61b80553635bbe520788908fbc88d98b76926e51eb9b4331eb4925ab3eb3e453d40081373acf27e8eef6e707fc6303df9a1f4291166146e942173b1492567f069af1165725325749da782aa990365cc2ecb4802392a34903156d042df00d363b5366a3d6bdc9c3e4b1e27370b3e643141a480c913c3eb136df63f651b17c5ae7493b7eb8dce1198245262ee06bec2c236c6cb72fce26b107685ae4e9e5470bf883e8e9650e6894e02b4b18c11675c05d20213ce3caf24c48df93b830e8b5ad62ceb095a281f8a277e368a228f1fd66e5ac2a9f647bfff2f56c9d5e35969ccc01c92cc2bb43dcdd0fd8c8f235f0029ee906a0a8883c86c12b9b8756a95added6dd7467beee1348da8f700d1cc107453e3eb6f7a149085effa8ec999698f56e4d51931f1214525e08798ec106f02c7a24e53d0cdfcd10be172e2ffaccb9be02304c8005d45d5e6186c42a588b2fddd66975c67dadfe7ba768a33c1782301e9552767efee8ee121fa80372d04f0e7557ab9d6e7d29ec06ba8cdd5f0dac4fce916df28d8e0d24d5a978fdac69e9808323e36224b3853322d7a6f477fa84ba9f74466c728663e0931ba1e7788794e6e4da59937c1325aa3b5c76356f14b8480ad7ce87fc227bec3a0724c9740fb478306284480384eed66c8627ecda0d08736e54602e1bd251885f56a9a5a2632c35aa41ce10f61fd07141bdbc2f05b1a1e6884145b93d742f521d7d969ee1846baa54506f02bc7567b12336d0cb84f43f6c786427b9a9e66e31acf9005a189fd64a98378fff4fcdc74ff48e6c3cd80d472ea6fe5c019d2aa9dd8777d2e9b1a724a152e24b65dbce3970bc044876930633c2c48ebc85f51cb3e2b960c7e02d45134abdb74cbc9c631da2a3453d5cf2cd833b4dba95eca582f0d6df84497c4ccf8d72800c8a0ee7b69fa308443d9a715db30ee7748c05738a26d85996744e771194871f6ca212b574c08d14234cf8b7bb6695ba489090feb97e024679a7945da720f7ac3c197207c6353ed74e751b08da2acb3dded61800ef11bce805ab794ec913c635308a27f98ecd33f470cc2e53f10181a66ac90c9e8d6fb7fa8fc070e091c208428d1448cd0cb1df77e20a8fd96492f6042b7d5b0b179d873c4ab40756a7835e43e6bfea63a02e2e30db50c930fcf94016585322cb7b810430c48cf9cbfc6d4757958fc60b26ad724a9a318b5f1c3dd28029c0c0cc9abc4cb99793b984b0c73a0803cc727d9765bc40b809b37ac4dd08b90a08e0dcae786f00acbfcb1df8bdb0b572a0d3f885500194f6b3787719894b74b0580b13bb13fed4bf0868f2fd8d90e451ea53102088a280c23ab166fa41b21d71e220109e63d2acbc84bfc907cadcec66e5ff0e27a684bdd35706a209f7ee89192ea60115ea0be84f4c2285f15aaeef2141facc852334948ff91173d383b23a7c9dfdae5c6e614e965745b6e7d7e65c00fe461fc437ab1371c5308599dacce01115106a48f8ece79cab7f9f8eddc358887381dff9ee0a0e63368e145e1af2b2a415dabbb4298d84da80f22c5c32a381e5684a429cecc3c2d9f392aa6de2f5899c4fcd3b3b79cbefe038120fcac69223ef2b7c35344bdf838a6218adc31d3f9f2fbc7659ebc912b640132153510e763f480a58ada3fe6dfe6de897d9642764af11733efea262d87866df64209cbbdb2ec01533da4d2cd0021d369c6e25c0521ea1d7e06fc402420347a367f67944fe6a692d7e842e400618ea18768d4d42179782528b82fffd8509064fa4d62f7c77fa1328155ca188234f25eabd7f38ff42227cb4b484f25e7dca08dd7123085ba21fdc8f52716eea82849b8e0f011c7d922eed90fc009ec77e24bb0622d7a5908708f9841dd69f87d03a5cb7b35ac95a1ba22ea17370f1b6d70fb9dc8557272550223dcb0f6989e71dfe5109d4e3e7528349d4236c7625839de41dd9ed1af0adf9701277a2c1cabda04a3794d3bb872a3791b9bf312260265f1a1f168719f9ed060a441e4c9125cf936bd5d32fa71b318a66b39446ac7efa3fd87e64ab14ad72a9f23e805e6e3b05ee81e1cd969ae56796d7ba4d3560c855eb145477d48043fb0cfb1d6bd481fe09734a0a2dfd9d41b2d7b6366f4bfdf88937564a10d200927bbc7ec7bd5f7af027521f3cd1709f5de2588edcbb0cc8e4940dcfc5d50d94de3f04ba436b64bb781401fd9ff0d409973f085a5817cbf969f814ec9f24a62384517cc2a82ccf941aa0379f8532c0ab6f20867f3ca5b578493de3296df993254a6609cb5059dbda5fccc03a796cd7ea36b35696bfbcbb143ad80c9111cc0f5d675818b3cf6dfe39563798ad4f65d2d9018c58790fa15565195330222a3182decaeb61c6a518da24d5053c39d5d43f159ed46ef836a150f0130b38ddad72c0f26af5251d1020773c361b490c13badd76038dabbc010947f0912b306bb71618761d70caaf857e6a7500f812616d4040e637830f2e4f6f3a4ac14714cbf7ad2c6a9baf9b6f8f9b96b0ad0afc7554ed73ab79f95b219f63783ba9b13c86f989fe41a17b18f5fc027b5be7856bed3e89d74f9725e36cb1bcb06325e2428082cd31db5982577fe8a559e290ec4aa06f9e222c2c8aa12098d8a9468e2dc94dfc26bae4fa950a44fe74a5f89bc5f198ad5f5710f053437aee58b47ef93c5b12abe8575a6ed1426698dc394d4327690991b0938e81225f3b8b71fe85424fbbb684efeda3135e430cd4d9fb710848f5a4931be759ed83c7e71ecd3d2a4612d04ba35ebc5d13efde43dc657f28ff5ffc3fb55fc5a744ed3ff9407d979cbfd30066e601d4cd24fdfebe34a3ca12ad327568ff8bd2a0a15501846eb7a0cb9c5f123178f5593ad43d8d534c9c01601955b2e99e2655479c26154e03d64815aaece27bdaff24211d23eb9aa1fdd1b34097321e539024e4a93852d342326244b4d399c065130a1b4aa42101d0493eae6d982c4cae7f6b738e30388eef33a3516cc84295b1429eb4a8e80968ddf852996de14d0500", 0x1000}}, 0xffffff9b) r5 = socket(0x1e, 0x1, 0x0) getsockopt$WPAN_SECURITY(r5, 0x0, 0x1, 0x0, &(0x7f0000000500)) r6 = epoll_create1(0x0) ioctl$XFS_IOC_FREE_EOFBLOCKS(r6, 0x8080583a, &(0x7f0000000180)={0x4, 0x0, 0x8, 0x7, 0x8000, 0x0, 0x3}) (async) ioctl$XFS_IOC_FREE_EOFBLOCKS(r6, 0x8080583a, &(0x7f0000000180)={0x4, 0x0, 0x8, 0x7, 0x8000, 0x0, 0x3}) openat$full(0xffffffffffffff9c, &(0x7f0000000280), 0x620003, 0x0) syz_emit_vhci(&(0x7f0000001040)=@HCI_EVENT_PKT={0x4, @hci_ev_le_meta={{0x3e, 0x6}, @hci_evt_le_ext_adv_set_term={{}, {0x0, 0x0, 0xc8, 0xc}}}}, 0x9) (async) syz_emit_vhci(&(0x7f0000001040)=@HCI_EVENT_PKT={0x4, @hci_ev_le_meta={{0x3e, 0x6}, @hci_evt_le_ext_adv_set_term={{}, {0x0, 0x0, 0xc8, 0xc}}}}, 0x9) setsockopt$MRT_DONE(r5, 0x0, 0xc9, 0x0, 0x0) ioctl$NILFS_IOCTL_CHANGE_CPMODE(r0, 0x40106e80, &(0x7f0000000240)={0x7}) 22.039246605s ago: executing program 3 (id=8394): sendmsg$IPCTNL_MSG_TIMEOUT_DELETE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="90000000020803000000000000000000050000043c000480080002400000000608000140000000040800024000000004080001400000000b0800014000000fff0800014000000d940800024000004664050003000002400000000e080002407fffffff0800014000000fff08000240000000000800024000007fff0900010073797a3100000000"], 0x90}}, 0x8000) (async) socket$kcm(0x10, 0x2, 0x4) (async) r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./file1\x00', 0x42, 0x0) write$P9_RREADLINK(r0, &(0x7f0000000000)={0x10, 0x17, 0x2, {0x7, './file0'}}, 0xfffffdab) (async) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) (async) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) (async) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'veth0_macvtap\x00', 0x2000}) (async) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) (async) write$tun(r1, &(0x7f0000000280)=ANY=[@ANYBLOB="00200000ffffffffffffbbbbbbbbbbbb080045000024000000000029"], 0x36) clock_adjtime(0x17, &(0x7f0000000640)={0x7, 0xb, 0x380000, 0x5, 0xfffffffffffffff9, 0xfffffffffffffff7, 0x200000, 0xfff, 0xae, 0x5, 0xa, 0xc, 0xfffffffffffff04d, 0x10002, 0x81, 0xbba, 0x0, 0x5, 0x80000000000000, 0x100, 0x4, 0x2, 0x21, 0xffffffffffffffff, 0xc, 0x8}) (async) clock_adjtime(0x2, &(0x7f0000002300)={0x41e8, 0x5, 0xffffffff, 0x6, 0x8, 0xfffffffffffffffe, 0x2da, 0x8, 0x5c7, 0x5, 0x400, 0x4bca, 0x9, 0x5, 0x7, 0x0, 0x8001, 0x1, 0xa500, 0x800, 0x3, 0x5, 0xe, 0xd1, 0x8, 0x2}) syz_genetlink_get_family_id$nl80211(&(0x7f0000002840), r0) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000540)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_KEY(r3, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f00000000c0)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16, @ANYBLOB="0108170000000000000b00000400000013c4", @ANYRES32=r4, @ANYBLOB="30005080110001004abee33908f8eef16f162471f4000000050009000100000005000200020000000800030005ac0f00"], 0x4c}, 0x1, 0x0, 0x0, 0x48001}, 0x24000080) lseek(r0, 0x4, 0x300) (async) syz_genetlink_get_family_id$nfc(&(0x7f0000000100), 0xffffffffffffffff) (async) sendmmsg$sock(0xffffffffffffffff, &(0x7f0000002680)=[{{&(0x7f0000000240)=@generic={0x21, "1aee2c4f6843c6782466293e62d4f664c2efa8906f0d97822ac0d88ecdd9d47e182b3b523c6243022c1be9fd662325c023ac48a28ae996c41561bb7e9903c408613b4d29da0b9d5af499caa7759c17c667af8acea6dc52148f1233494efd8f08aaab6382d5e33471a107ec47df5b5312764e134c68842fd1a2078151812e"}, 0x80, &(0x7f00000009c0)}}, {{&(0x7f0000002780)=@rxrpc=@in4={0x21, 0x1, 0x2, 0xfffffffffffffdf0, {0x2, 0x4e24, @broadcast}}, 0x80, &(0x7f0000000600)=[{0x0}, {&(0x7f0000000ac0)="3eb85e3024a2953147f5444738e1388e15fef01893884c2eeb5c559f4a030ee6b08fca1e38ee56dbc9cbbea3d6d43e34d9daf81d45289d2bc841e2c4c7072582b15ce7ff3e22b0f19d8a2643280daeb9791b2d0f9b216a0fda4f30804b739da3cce1691d6d88ff52d3e43b26d935d69e99673e", 0x73}, {&(0x7f0000000580)="8f966bd94d169820f6b844307d323b8c13deaeff91", 0x15}], 0x3, &(0x7f0000000cc0)=[@mark={{0x14, 0x1, 0x24, 0x9a9}}, @mark={{0x14, 0x1, 0x24, 0x4}}, @timestamping={{0x14, 0x1, 0x25, 0x101}}, @txtime={{0x18, 0x1, 0x3d, 0x2}}, @mark], 0x78}}, {{&(0x7f0000000d80)=@ieee802154={0x24, @short={0x2, 0x1, 0xaaa0}}, 0x80, 0x0}}, {{&(0x7f0000002400)=@pptp={0x18, 0x2, {0x2, @multicast2}}, 0x80, &(0x7f0000002540)=[{&(0x7f0000002480)="cfcc3c117b247c8982031dc34b16124a5ff05941d4b9d6a2ecb8f048a03a6d8f1a645c8e262a2089cf255f4b3fbab4c4c6ee406c96831ecb372326bb8a58197b05f2f16dbacdcfc6d0d058d26dbd8305d492f46965d7298b9d85ff9977ab536c44709219ea133fea49f8758b0d5ae0d0e791a9d9149220389b6b5e41d0f5541720815360cf2b280d44228aaff9077c8876fd8d72aead12e0a2dca62fe0ffb6f25e755339662757816f74748bc69628a189fd8e23eaeba3fe2802e16dfbb075", 0xbf}], 0x1, &(0x7f0000002580)=[@txtime={{0x18, 0x1, 0x3d, 0x5}}, @timestamping={{0x14, 0x1, 0x25, 0x3285}}, @timestamping={{0x14, 0x1, 0x25, 0x8}}, @mark={{0x14, 0x1, 0x24, 0x6}}, @txtime={{0x18, 0x1, 0x3d, 0x77}}, @timestamping={{0x14, 0x1, 0x25, 0x3}}, @mark={{0x14, 0x1, 0x24, 0xfffffff9}}, @timestamping={{0x14, 0x1, 0x25, 0x8}}, @txtime={{0x18}}], 0xd8}}], 0x4, 0x20040045) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) (async) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3be", 0x6) r6 = accept4(r5, 0x0, 0x0, 0x800) sendmmsg$alg(r6, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) (async) r7 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f00000013c0)={'wlan1\x00'}) (async) sendmsg$NL80211_CMD_FRAME(r7, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000002800)=ANY=[@ANYBLOB="bf3ff6ff2b2f216800", @ANYRES16, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32, @ANYRESDEC=r1], 0x6f4}}, 0x0) (async) read$FUSE(r0, &(0x7f00000002c0)={0x2020}, 0x2020) 21.763755904s ago: executing program 3 (id=8396): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e21, @broadcast}, 0x2f) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000080)='nv', 0xc38) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) r1 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000840)="89000000120081ae08060cdc030003fe7f030000000000000001ffca1b1f0000000024c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec00150c00014003080c00bdad446b31007a46e3988285dcdf12f21308f868fece01955fed0009d78f0a947e", 0x75}, {&(0x7f0000000140)="11d6cb557c8496a2fe7a81f38210bfa9b70ee09c", 0x14}], 0x2}, 0x4000000) 21.539094406s ago: executing program 3 (id=8398): openat$cgroup(0xffffffffffffffff, &(0x7f0000000000)='syz1\x00', 0x200002, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000000180)=ANY=[@ANYBLOB="12010100ab51a0407b0500000000000000010902120001200000000904"], 0x0) (async) syz_usb_connect(0x0, 0x24, &(0x7f0000000180)=ANY=[@ANYBLOB="12010100ab51a0407b0500000000000000010902120001200000000904"], 0x0) 20.191659201s ago: executing program 3 (id=8402): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000940), 0x2, 0x0) r1 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) capset(&(0x7f00000003c0)={0x19980330}, &(0x7f0000000400)) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x18, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000040)={{0x1, 0x1, 0x18, r1}, './file0\x00'}) ioctl$SIOCPNGETOBJECT(r2, 0x89e0, &(0x7f00000000c0)=0x1) r3 = fcntl$dupfd(r1, 0x406, r1) write$tun(r3, 0x0, 0x42) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000080)={0xffffffffffffffff}, 0x106, 0x6}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000180)={0xe, 0x18, 0xfa00, @id_tos={&(0x7f0000000000)=0x1f, r4, 0x0, 0x0, 0x1}}, 0x20) 20.028552453s ago: executing program 3 (id=8405): socket$inet_tcp(0x2, 0x1, 0x0) openat$tun(0xffffff9c, &(0x7f0000000040), 0x0, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, 0x0, 0x0) r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x100, 0x2, 0x1e5}, &(0x7f0000000000)=0x0, 0x0, 0x0) syz_ublk_add_dev(r1, r2, 0x0, 0x0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80, 0x0) openat$tun(0xffffff9c, &(0x7f0000000040), 0x0, 0x0) socket$netlink(0x10, 0x3, 0xc) r3 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000340)={0x0, 0x0, 0x1000, 0x40002, 0x393}, &(0x7f0000000000)=0x0, &(0x7f0000000040)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(0xffffffffffffffff, r4, r5, r6, &(0x7f0000000400)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000000c0)=@any_dev={0x3, 0x603, 0x0, 0x0, 0x1000, 0xb6a4, 0x0, 0x0, 0xa8}}}, &(0x7f0000000180)=0x0) socket$kcm(0x10, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$inet6_sctp(0xa, 0x5, 0x84) socket(0x1d, 0x2, 0x6) socket$inet6_sctp(0xa, 0x5, 0x84) sendto$packet(0xffffffffffffffff, &(0x7f00000000c0)="37031c00", 0x4, 0x4000800, 0x0, 0x47) r9 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x82042, 0x0) syz_ublk_setup_queues(r9, r8, &(0x7f0000000480)={0x0, 0x18e2, 0x10000, 0xfffffffd, 0x1d2}, &(0x7f0000002680)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xb656, 0x200, 0x5, 0x41}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x216, 0x0, 0x2, 0x199}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xb6d4, 0x1, 0x1, 0x252}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xeaff, 0x800, 0x0, 0x231}}], 0x4, &(0x7f0000003900)={0x2e, 0x62, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, r7, '\x00', {0x3, 0xb66, 0x0, 0x0}}, 0x0) syz_ublk_setup_queues(r3, r8, &(0x7f0000000200)={0x0, 0x1463, 0x10f00, 0x2, 0xb6}, &(0x7f0000000d40)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4485, 0x10002, 0x401, 0x31c, 0x0, r3}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7682, 0x2000, 0x1, 0x2000008, 0x0, r3}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x68ea, 0x10, 0x0, 0x90, 0x0, r3}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x16e7, 0x20, 0x2, 0x40021a, 0x0, r3}}], 0x4, &(0x7f0000001540)={0x2e, 0x6, 0x0, 0xffffffffffffffff, 0xc0107520, 0x40000000, 0x0, 0x0, 0x72ccfb459c83c565, {0x6}, 0x0, 0x0, '\x00', {0x3, 0x48b, 0x0, 0x0}}, 0x0) 18.863470761s ago: executing program 3 (id=8410): r0 = socket$kcm(0x10, 0x3, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x1c) sendmmsg$sock(r1, &(0x7f0000002ac0)=[{{0x0, 0x0, &(0x7f00000016c0)=[{&(0x7f0000000340)="8ca16f83", 0x4}], 0x1}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=[@txtime={{0x18}}], 0x18}}], 0x2, 0x4000804) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r2, 0x3b85, 0x0) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r2, 0x3ba0, &(0x7f0000000100)={0x48, 0x2, r3}) pipe(&(0x7f0000000080)={0xffffffffffffffff}) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) tee(r4, r5, 0xfffffffffffffffd, 0x0) syz_clone(0xb44040, 0x0, 0x0, 0x0, 0x0, 0x0) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r6, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff}) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000004500), 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r8, @ANYBLOB=',wfdno=', @ANYRESHEX=r7, @ANYBLOB="2c76657273696f6e3d3970323030302e752cbab6f0856c6a4ccc00889ebe5118b034f42bfbb655172ea6fda9e0094f229f93da2a828faa54d3cc610a7ce5269e5d3c72ab8965c5fa9387f0afb7dce00f3ad46c3916cde9cab7743fccda9edc29e109e248a55064a0f9252c46a642662a178fb22260f2668a20d57ab073b827c954f6a613df40edc1ad59fc39ee6b9f92c9ee661936c8b173c63bec481f79416fe8e4805f439be8bc272eff0e8f1b643c7aaf3fe9a2a2fa"]) write$P9_RVERSION(r9, &(0x7f0000000080)=ANY=[@ANYBLOB="150000006bffff", @ANYRES16=r8, @ANYRESHEX=r9], 0x15) ioctl$AUTOFS_IOC_EXPIRE_MULTI(r0, 0x40049366, &(0x7f0000000000)=0x1) write$cgroup_subtree(r0, &(0x7f00000003c0)=ANY=[@ANYRES64=r2], 0xd6cc) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x89f1, 0x0) ioctl$KVM_GET_STATS_FD_vm(0xffffffffffffffff, 0xaece) r10 = syz_genetlink_get_family_id$devlink(&(0x7f0000000100), 0xffffffffffffffff) r11 = socket$nl_generic(0x10, 0x3, 0x10) r12 = open(&(0x7f00000001c0)='./file1\x00', 0x14da7e, 0x20) pwritev2(r12, &(0x7f0000000700)=[{&(0x7f0000000180)='B', 0x1}], 0x100000000000032e, 0x9, 0x9, 0x3c) lsetxattr$trusted_overlay_upper(&(0x7f0000000040)='./file0\x00', &(0x7f00000002c0), &(0x7f0000000380)={0x0, 0xfb, 0x36, 0x0, 0x1, "5b9f8a9a641479a9cc5749c61d0c247f", "3bd6ef432537802640916e1bb7f917bec72638dbf5d65ef2a46f30c6e5244af9b0"}, 0x36, 0x1) sendmsg$DEVLINK_CMD_PORT_GET(r11, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x14, r10, 0x1, 0x70bd2b, 0x100008, {0x54}}, 0x14}}, 0xc804) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) 12.830505008s ago: executing program 7 (id=8437): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r0, 0x29, 0x41, &(0x7f0000000180)=ANY=[], 0x58) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="58000000020603000000000000000000000000000c000300686173683a69700005000400000000000900020073797a31000000001400078008001340000017e5080012400000000905000500020000000500010006"], 0x58}}, 0x4080) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000940), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000080)={0xffffffffffffffff}, 0x106, 0x6}}, 0x20) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000200)=ANY=[@ANYRES32=r0], 0x58}, 0x1, 0x0, 0x0, 0x40280d5}, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(r2, &(0x7f0000000180)={0xe, 0x18, 0xfa00, @id_tos={0x0, r3, 0x1000000}}, 0x20) syz_usb_connect(0x3, 0x24, &(0x7f0000000100)=ANY=[@ANYBLOB="120100027d939308450c8e62e7da010203010902633015553070c4736f600a120001082a60b50904be0800b5042a0c"], 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(r2, &(0x7f00000000c0)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000040)=0x1, r3, 0x0, 0x2, 0x4}}, 0x20) r5 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000), 0x8502, 0x0) r6 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r6, 0x6, 0x10, &(0x7f0000000040)=0x5, 0x4) write$sndseq(r5, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x0, @tick, {0x1}, {}, @time=@time={0x7}}, {0x0, 0x0, 0x2, 0x0, @time={0x0, 0x2}, {}, {0x0, 0x80}, @result={0x0, 0x6}}, {0x40, 0xe, 0x0, 0x0, @time={0x8000, 0x101}, {0x0, 0xfc}, {}, @control}, {0x0, 0x0, 0x5, 0x0, @time, {0x0, 0xfd}, {0x1}, @quote={{0x0, 0x4}, 0x8001}}], 0x70) ioctl$SNDCTL_DSP_SETTRIGGER(r5, 0x40045010, &(0x7f0000000000)=0x5) 12.58541085s ago: executing program 8 (id=8439): creat(&(0x7f0000001380)='./file0\x00', 0x4) mount(&(0x7f0000000040)=@sg0, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='ubifs\x00', 0x2, 0x0) (fail_nth: 17) 12.579556716s ago: executing program 6 (id=8440): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x84042, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000080), 0x100d, 0xde8bef52389a5434) ioctl$LOOP_CONFIGURE(r1, 0x4c0a, &(0x7f0000000280)={r0, 0x0, {0x0, 0x0, 0x0, 0xffffffffffffffff, 0x4000000000000004, 0x0, 0x0, 0xb, 0x14, "996a78edc5cac93c3e473f65d9eb5297f0ca82d56dcddb164e29606b4f2cf0b60d72deb3cf1597f6b7ff9c4fbf4726f66eccdbf05411d4a42e798491c50e3e6f", "3c54d63cef61aa187f941933694c882f48359819ddc15edb9ca42b19126327fbe58f617cc4717f53d6a395cace0534365db4d55dace1d4e9d5526fa401000012", "fd0000e7744b74eaa2317fdd9db2fea7e7d63f9a007866063c8c162b99d845fb", [0x61, 0x4]}}) 3.610112737s ago: executing program 37 (id=8410): r0 = socket$kcm(0x10, 0x3, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0x0, @mcast2={0xff, 0x3}}, 0x1c) sendmmsg$sock(r1, &(0x7f0000002ac0)=[{{0x0, 0x0, &(0x7f00000016c0)=[{&(0x7f0000000340)="8ca16f83", 0x4}], 0x1}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=[@txtime={{0x18}}], 0x18}}], 0x2, 0x4000804) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r2, 0x3b85, 0x0) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r2, 0x3ba0, &(0x7f0000000100)={0x48, 0x2, r3}) pipe(&(0x7f0000000080)={0xffffffffffffffff}) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) tee(r4, r5, 0xfffffffffffffffd, 0x0) syz_clone(0xb44040, 0x0, 0x0, 0x0, 0x0, 0x0) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r6, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff}) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000004500), 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r8, @ANYBLOB=',wfdno=', @ANYRESHEX=r7, @ANYBLOB="2c76657273696f6e3d3970323030302e752cbab6f0856c6a4ccc00889ebe5118b034f42bfbb655172ea6fda9e0094f229f93da2a828faa54d3cc610a7ce5269e5d3c72ab8965c5fa9387f0afb7dce00f3ad46c3916cde9cab7743fccda9edc29e109e248a55064a0f9252c46a642662a178fb22260f2668a20d57ab073b827c954f6a613df40edc1ad59fc39ee6b9f92c9ee661936c8b173c63bec481f79416fe8e4805f439be8bc272eff0e8f1b643c7aaf3fe9a2a2fa"]) write$P9_RVERSION(r9, &(0x7f0000000080)=ANY=[@ANYBLOB="150000006bffff", @ANYRES16=r8, @ANYRESHEX=r9], 0x15) ioctl$AUTOFS_IOC_EXPIRE_MULTI(r0, 0x40049366, &(0x7f0000000000)=0x1) write$cgroup_subtree(r0, &(0x7f00000003c0)=ANY=[@ANYRES64=r2], 0xd6cc) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x89f1, 0x0) ioctl$KVM_GET_STATS_FD_vm(0xffffffffffffffff, 0xaece) r10 = syz_genetlink_get_family_id$devlink(&(0x7f0000000100), 0xffffffffffffffff) r11 = socket$nl_generic(0x10, 0x3, 0x10) r12 = open(&(0x7f00000001c0)='./file1\x00', 0x14da7e, 0x20) pwritev2(r12, &(0x7f0000000700)=[{&(0x7f0000000180)='B', 0x1}], 0x100000000000032e, 0x9, 0x9, 0x3c) lsetxattr$trusted_overlay_upper(&(0x7f0000000040)='./file0\x00', &(0x7f00000002c0), &(0x7f0000000380)={0x0, 0xfb, 0x36, 0x0, 0x1, "5b9f8a9a641479a9cc5749c61d0c247f", "3bd6ef432537802640916e1bb7f917bec72638dbf5d65ef2a46f30c6e5244af9b0"}, 0x36, 0x1) sendmsg$DEVLINK_CMD_PORT_GET(r11, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x14, r10, 0x1, 0x70bd2b, 0x100008, {0x54}}, 0x14}}, 0xc804) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) 2.59084246s ago: executing program 6 (id=8442): socket$inet_icmp_raw(0x2, 0x3, 0x1) (async, rerun: 64) socket$inet_icmp_raw(0x2, 0x3, 0x1) (rerun: 64) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/raw\x00') preadv(r0, &(0x7f00000013c0)=[{&(0x7f0000000380)=""/4095, 0xfff}], 0x1, 0x4007d, 0x80000000) (async) r1 = syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x8, 0x458, 0x87, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0xe0, 0xb, "", [{{0x9, 0x4, 0x0, 0xf, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x90d, 0xfc, 0x1, {0x22, 0x28}}, {{{0x9, 0x5, 0x81, 0x3, 0x420, 0xb0, 0x81, 0xfe}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) (async) syz_usb_control_io(r1, &(0x7f0000000b00)={0x2c, &(0x7f0000000980)={0x0, 0x31, 0x28, {0xffc1, 0x9, "1ba57fb04d4f1e07d695f268e872852798b2974b1fc634f26cda14d95e6688adb139e26a4779"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) 2.589794517s ago: executing program 7 (id=8443): r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000003140)=ANY=[@ANYBLOB="c01800002000010a00000000000000000a0000002c01018028014880ed00a90013466820cd76bb221fbb4acd690c6a8b9c760a61eeec7793b579aefdb936d00f403d3f04637cdb9ac70e28c5dd66ddedde2d0930650e6821f9a26a4a193c1d06a3e75523f901e44fe087ae32c836c6d6ddba3af8e9a2beae8936168f9fa38c395f5cf7408df69c60bf584bee86a6312e9ce866e456c3eda6f2924082d78a2f385bdbd0c9afb54758c102bf13094645fb6aa34d424ec776691fee3d25307f61fed2752babf7c686e8a3d9b59a8343bcf4121bf5cf400a0c1070855fac565cad8968a97ce0a12a1161054d82d0a240b7dedf9ba3cc63e9d1c3b9a8402f7d5b4caf", @ANYRES32=r0, @ANYBLOB="08001a20", @ANYRES32=0x0, @ANYBLOB="08001b"], 0x18c0}, 0x1, 0x0, 0x81000000, 0x880}, 0x840) 2.588833533s ago: executing program 8 (id=8444): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000240)={0x73622a85, 0x0, 0x8000000000002}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x800, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000280)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x10000000000) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0xb}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f00000005c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x1058, 0x1000000, 0x30, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000300)={@ptr={0x70742a85, 0xffffffff, 0x0, 0x0, 0x1, 0x1a}, @ptr={0x70742a85, 0x80002, 0x0, 0x0, 0x1, 0x31}, @ptr={0x70742a85, 0x1, 0x0, 0x0, 0x1, 0xca}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}, 0x400}], 0x0, 0x0, 0x0}) 2.430891918s ago: executing program 7 (id=8445): mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2000002, 0x200000005c832, 0xffffffffffffffff, 0x0) socket$xdp(0x2c, 0x3, 0x0) r0 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000080), 0xc2a41, 0x0) r1 = openat$cgroup_ro(r0, &(0x7f0000000140)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x26e1, 0x0) close(r1) ioctl$SIOCSIFHWADDR(r1, 0x8b32, &(0x7f0000000000)={'virt_wifi0\x00', @random='Z\x00'}) setsockopt$XDP_UMEM_REG(r1, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/74, 0x133000, 0x1000, 0x80000000, 0x2}, 0x20) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$IOCTL_VMCI_NOTIFICATIONS_RECEIVE(r0, 0x7a6, &(0x7f0000000100)={0x0, 0x44, 0x9, 0x9, 0x6, 0x4}) 2.379792443s ago: executing program 8 (id=8446): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x101040, 0x0) r1 = socket(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f0000000440)={0x7, 0x0, 0x0, 0x1993}, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="1c0000001a000100000000000000002080", @ANYRES32=r0], 0x84}, 0x1, 0x0, 0x0, 0x8000}, 0x20048010) 2.187601573s ago: executing program 8 (id=8447): mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mount(0x0, &(0x7f0000000240)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x2, &(0x7f0000000300)='usrquota') chdir(&(0x7f0000000180)='./file1\x00') r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000440)='blkio.bfq.io_service_bytes\x00', 0x275a, 0x0) r1 = openat$adsp1(0xffffffffffffff9c, &(0x7f00000000c0), 0x721000, 0x0) close_range(r1, 0xffffffffffffffff, 0x2) r2 = getpgid(0x0) r3 = syz_pidfd_open(r2, 0x0) pidfd_getfd(r3, r3, 0x0) newfstatat(0xffffffffffffff9c, &(0x7f00000000c0)='.\x00', &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x6000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0xfdffa000) prlimit64(0x0, 0x9, &(0x7f0000000080)={0xfffffffffffffffb, 0xfffffffffffffffb}, 0x0) mremap(&(0x7f000016c000/0x4000)=nil, 0x4000, 0x40000000, 0x3, &(0x7f000063c000/0x3000)=nil) r5 = userfaultfd(0x1) ioctl$VIDIOC_S_AUDOUT(r0, 0x40345632, &(0x7f0000000140)={0x1000, "138dacd893df696a379f43373e2e7dcf346f9aab8b56a9e193ccb97b6f146390", 0x2, 0x1}) ioctl$UFFDIO_API(r5, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x270}) ioctl$UFFDIO_REGISTER(r5, 0xc020aa00, &(0x7f00000000c0)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x1}) r6 = userfaultfd(0x80801) ioctl$UFFDIO_API(r6, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x145}) ioctl$UFFDIO_REGISTER(r6, 0xc020aa00, &(0x7f0000000100)={{&(0x7f0000ffe000/0x2000)=nil, 0x2000}, 0x1}) setresuid(0xee01, r4, r4) quotactl_fd$Q_SETQUOTA(r0, 0xffffffff00001000, r4, 0x0) 2.135437623s ago: executing program 6 (id=8448): r0 = socket$netlink(0x10, 0x3, 0xf) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r0, 0x10e, 0xb, &(0x7f0000000080)=0x800000, 0x4) syz_usb_connect(0x3, 0x46, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000005b1710720500cbc9bb000203010902340001fb0000000904ca010338e880060905012a1000060002090500000002f803070905061000041c0d090705c17a"], 0x0) syz_genetlink_get_family_id$tipc(&(0x7f00000001c0), r0) r1 = socket(0x2b, 0x80801, 0x1) listen(r1, 0x10) accept4$vsock_stream(r1, 0x0, 0x0, 0x80800) sendmsg$IPCTNL_MSG_EXP_DELETE(r1, &(0x7f0000000340)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000300)={&(0x7f0000000200)={0xfc, 0x2, 0x2, 0x801, 0x0, 0x0, {0x2, 0x0, 0x9}, [@CTA_EXPECT_TIMEOUT={0x8, 0x4, 0x1, 0x0, 0x7fff}, @CTA_EXPECT_FN={0x8, 0xb, 'sip\x00'}, @CTA_EXPECT_MASTER={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @loopback}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x88}}]}, @CTA_EXPECT_FLAGS={0x8, 0x8, 0x1, 0x0, 0x2}, @CTA_EXPECT_ID={0x8, 0x5, 0x1, 0x0, 0xc6}, @CTA_EXPECT_NAT={0x94, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_EXPECT_NAT_TUPLE={0x68, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @broadcast}, {0x8, 0x2, @broadcast}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x1}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @rand_addr=0x64010100}, {0x8, 0x2, @multicast2}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3a}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast2}, {0x8, 0x2, @local}}}]}, @CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_EXPECT_NAT_TUPLE={0x18, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x21}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}]}]}, @CTA_EXPECT_ID={0x8, 0x5, 0x1, 0x0, 0x9}, @CTA_EXPECT_ID={0x8, 0x5, 0x1, 0x0, 0x79e8}]}, 0xfc}, 0x1, 0x0, 0x0, 0x10}, 0x20000804) 1.961727295s ago: executing program 7 (id=8449): r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) connect$inet(0xffffffffffffffff, 0x0, 0x0) pipe2(0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r1, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) openat$iommufd(0xffffffffffffff9c, 0x0, 0x8000, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="ebe3a0e9796cfd1647e299", 0xb}], 0x1, 0x0, 0x0, 0x40}], 0x1, 0x40800) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r1, 0xc01064b5, &(0x7f0000000140)={0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, 0x0) syz_open_dev$amidi(&(0x7f0000000140), 0x2, 0x181) r2 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) ioctl$FE_SET_PROPERTY(r2, 0x40106f52, &(0x7f0000000580)={0x13, &(0x7f00000004c0)=[{0x6, '\x00', @data=0x80, 0x3}]}) close_range(r0, 0xffffffffffffffff, 0x0) 1.603327108s ago: executing program 7 (id=8450): r0 = socket$rds(0x15, 0x5, 0x0) setsockopt$RDS_GET_MR(r0, 0x114, 0x2, &(0x7f00000015c0)={{0x0}, 0x0, 0x24}, 0x20) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000500)={0x26, 'hash\x00', 0x0, 0x0, 'sha3-256\x00'}, 0x58) r2 = accept4(r1, 0x0, 0x0, 0x800) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_xfrm(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=ANY=[@ANYBLOB="3c0200001900010000000000fddbdf25e0000001000000000000000000000000ac1414bb0000000000000000000000000000000bffff00000a00800000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000084010500e0000002000000000000000000000000000000003c00000000000000ffffffff000000000000000000000000ff34000000020000000000000000000000000000ac1414aa000000000000000000000000000000003c0000000a000000fc01000000000000000000000000000102000000000000000008000000080000fcffffff000000000000000000000000000000000000000032000000000000007f0000010000000000000000000000000335000003000000000000000002000000000000fe80000000000000000000000000002f0000000033000000000000000a010101000000000000000000000000043500000000010000000000bf0a00000000000100000000000000000000000000000001000004d43c00000000000000e00000010000000000000000000000000300000000010800090000000000000000040000fc0000000000000000000000000000010000000033"], 0x23c}}, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2) 1.353916308s ago: executing program 7 (id=8451): socketpair(0x26, 0x5, 0xfffffffe, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) ioctl$KVM_GET_VCPU_MMAP_SIZE(0xffffffffffffffff, 0xae04) syz_open_dev$tty1(0xc, 0x4, 0x1) r0 = open(0x0, 0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) fcntl$lock(r0, 0x7, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, r0, 0xa9525000) fcntl$setsig(r0, 0xa, 0x21) symlink(&(0x7f0000000dc0)='./file0\x00', 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120110010000000843554700000000000001090224000100000000"], 0x0) sched_setscheduler(0x0, 0x2, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc000000000000000100000000000000ac1e000100000000000000000000000000000000000000000a0060", @ANYRESOCT], 0xb8}}, 0x20040014) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300000100000000fbdbdf25fc000000000000000000000000000001ac1414040c000000000000000000000000000004000000000a0060803b", @ANYRES32=0x0, @ANYRES32=0xee01], 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x50) sendmsg$nl_xfrm(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc0000000000000001"], 0xb8}}, 0x20004000) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9990000020000000000fc0000000000000000"], 0xb8}, 0x1, 0x0, 0x0, 0x80c0}, 0x0) sendmsg$nl_xfrm(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000800)=ANY=[@ANYBLOB="b80080ff1300e9990500000000000000fc000000000000000000000000000000fc00000000000000000000000000000000000000000000000a0030"], 0xb8}}, 0x4000) 683.246162ms ago: executing program 6 (id=8452): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000300)={0xffffffffffffffff}, 0x106, 0x8}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000000340)={0x15, 0x110, 0xfa00, {r1, 0x73c, 0x30, 0x30, 0x0, @in6={0x1b, 0x4e20, 0x5, @empty, 0xbff}, @ib={0x1b, 0xf, 0x6, {"509163000000000000000007ff9d00"}, 0x8000000000000001, 0x8, 0x3ff}}}, 0x118) 502.428953ms ago: executing program 6 (id=8453): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000500)={0x0, 0x18, 0xfa00, {0x2, &(0x7f00000004c0)={0xffffffffffffffff}, 0x111, 0x5}}, 0x20) write$RDMA_USER_CM_CMD_QUERY(r1, &(0x7f0000000540)={0x13, 0x10, 0xfa00, {&(0x7f00000002c0), r2, 0x1}}, 0x18) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000000c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWSET={0x68, 0x9, 0xa, 0x401, 0x0, 0x0, {0x5, 0x0, 0x2}, [@NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x24}, @NFTA_SET_EXPRESSIONS={0x24, 0x12, 0x0, 0x1, [{0x14, 0x20, 0x0, 0x1, @last={{0x9}, @val={0x4}}}, {0xc, 0x1, 0x0, 0x1, @dup_ipv4={{0x8}, @void}}]}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x130}]}], {0x14}}, 0x90}, 0x1, 0x0, 0x0, 0x4044050}, 0x200400d0) socket$nl_netfilter(0x10, 0x3, 0xc) 313.097033ms ago: executing program 8 (id=8454): mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2000009, 0x200000005c832, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x200000b, 0x204031, 0xffffffffffffffff, 0xec776000) r0 = userfaultfd(0x801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000001200)={0xaa, 0x4}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000100)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x4}) ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000000)={&(0x7f0000800000/0x800000)=nil, &(0x7f0000199000/0x800000)=nil, 0x800000, 0x0, 0x1000000}) 175.697856ms ago: executing program 6 (id=8455): r0 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$inet6_int(r0, 0x29, 0x4c, &(0x7f0000000040)=0xfff, 0x4) (async) syz_usb_connect$midi(0x2, 0x40, &(0x7f0000000000)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0x40, 0xe41, 0x5044, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2e, 0x1, 0x1, 0x1, 0x40, 0x3, "", {{{0x9, 0x4, 0x0, 0x0, 0x1, 0x1, 0x3, 0x0, 0x6, [@midi_out_jack={0x7, 0x24, 0x3, 0x0, 0xa, 0x0, [], 0x5}, @ms_header={0x7, 0x24, 0x1, 0xf, 0x7}], [{{0x9, 0x5, 0xe, 0x2, 0x20, 0x2, 0x9, 0xff, {0x5, 0x25, 0x1, 0x1, 'Z'}}}]}}}}}]}}, &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0}) (async) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x80102, 0x0) (async) r2 = memfd_create(&(0x7f0000000040)='[\v\xdbX\xae[\x1a\xa9\xfd\xfa\xad\xd1md\xc8\x85HX\xa9%\f\x00e\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\x7f\xffT\xeb8F\xcba=\xd6\x9a\x16\x0e\xc9\x8f\xa4\x9f\xf4\xb8\xb9\xc8T\xde\a\x95\n\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xd6\x91%||\xa0\x8e\x00\x00\x00\x00\f\xe5\x89^\xff\xf5\x95\xd2q#\xc6\xca\x97\x9d\xcb\x1e\x80\xd6\xd5%N&\xf8#\xa9\xec\x9b\xad\x8e\xea\xe4)#\x87k\xb3\xdf\x1e\xb6o\xee&AH\xa9!\xdc\xd6\\\x05\xf4]F\x83\xc8\xd0\xc6\xf2n\x8a\x10\xd2\xe2\xc4\x1d\x17\xf21\x03\xb6\x13w\xe8\x1d]b\xdf\xcb\x10C\x17\x9c,-\xe5\a\x95\x15]\xfa\xb7\xb0\x97\xfaf#j\x82\xca\xfc\x05a\xca\xd4\xd2\xfa\xe7\xa7m\xa1\xa2Z(0\x8f\xc1N\x10\xf2\xb3\x8c\xaa5\xd9\xc8 \xb7t\x190\x1f\xae\xc9\x1c\xc5\xa9pO\xc4\x1a\xed\xca\xbc\x11\a!\x1ew\x96B\xdd\x933d\x97\n\x00'/266, 0x3) syz_clone(0x600, 0x0, 0x0, 0x0, 0x0, 0x0) (async, rerun: 32) execveat(r2, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) (async, rerun: 32) r3 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_GET_DIRTY_LOG(r3, 0x4010ae42, &(0x7f0000000000)={0x101fe, 0x0, &(0x7f0000ffa000/0x4000)=nil}) (async, rerun: 32) fanotify_init(0x30, 0x40000) (rerun: 32) 0s ago: executing program 8 (id=8456): r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0x2, 0x862b01) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000480)={0x0, 0x0, 0x0, {0x0, 0x1}, {0x38, 0x2}, @cond=[{0x2, 0x5, 0x40, 0x9, 0x8001, 0xfc01}, {0x9, 0x6, 0x401, 0x3, 0x1225, 0x8}]}) write$char_usb(r0, &(0x7f0000000040)="e2", 0x2250) (fail_nth: 54) kernel console output (not intermixed with test programs): 00007fc3f95cce59 [ 1481.579910][T29660] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000011 [ 1481.579920][T29660] RBP: 00007fc3f7826090 R08: 0000000000000000 R09: 0000000000000000 [ 1481.579930][T29660] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000002 [ 1481.579940][T29660] R13: 00007fc3f9846038 R14: 00007fc3f9845fa0 R15: 00007ffcf22138c8 [ 1481.579979][T29660] [ 1482.159784][T29670] netlink: 140 bytes leftover after parsing attributes in process `syz.8.7975'. [ 1482.204416][ T5774] IPVS: starting estimator thread 0... [ 1482.287696][T29673] IPVS: using max 12 ests per chain, 28800 per kthread [ 1482.558658][T29681] netlink: 4 bytes leftover after parsing attributes in process `syz.8.7977'. [ 1482.590787][T29672] hsr0: entered promiscuous mode [ 1482.817856][T20035] usb 7-1: new high-speed USB device number 58 using dummy_hcd [ 1482.857614][ T5774] usb 8-1: new high-speed USB device number 25 using dummy_hcd [ 1482.978525][T20035] usb 7-1: Using ep0 maxpacket: 16 [ 1483.003734][T20035] usb 7-1: unable to get BOS descriptor or descriptor too short [ 1483.008507][T20035] usb 7-1: config 8 has an invalid interface number: 15 but max is 1 [ 1483.008579][T20035] usb 7-1: config 8 has an invalid interface number: 202 but max is 1 [ 1483.008622][T20035] usb 7-1: config 8 has no interface number 0 [ 1483.008670][T20035] usb 7-1: config 8 has no interface number 1 [ 1483.008903][T20035] usb 7-1: config 8 interface 202 altsetting 5 has a duplicate endpoint with address 0xA, skipping [ 1483.008963][T20035] usb 7-1: config 8 interface 202 altsetting 5 has an endpoint descriptor with address 0xFD, changing to 0x8D [ 1483.009075][T20035] usb 7-1: config 8 interface 202 altsetting 5 endpoint 0x8D has invalid maxpacket 21348, setting to 1024 [ 1483.009151][T20035] usb 7-1: config 8 interface 202 altsetting 5 bulk endpoint 0x8D has invalid maxpacket 1024 [ 1483.009237][T20035] usb 7-1: config 8 interface 202 altsetting 5 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 1483.009320][T20035] usb 7-1: config 8 interface 15 has no altsetting 0 [ 1483.009362][T20035] usb 7-1: config 8 interface 202 has no altsetting 0 [ 1483.018423][ T5774] usb 8-1: Using ep0 maxpacket: 32 [ 1483.093238][ T5774] usb 8-1: config 0 has an invalid interface number: 35 but max is 0 [ 1483.093470][ T5774] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1483.093928][ T5774] usb 8-1: config 0 has no interface number 0 [ 1483.157271][T20035] usb 7-1: New USB device found, idVendor=0bb4, idProduct=0a10, bcdDevice=a7.d9 [ 1483.157303][T20035] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1483.157325][T20035] usb 7-1: Product: syz [ 1483.157343][T20035] usb 7-1: Manufacturer: syz [ 1483.157360][T20035] usb 7-1: SerialNumber: syz [ 1483.228694][ T5774] usb 8-1: config 0 interface 35 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1483.248324][ T5774] usb 8-1: New USB device found, idVendor=10c4, idProduct=818a, bcdDevice=7d.ad [ 1483.248355][ T5774] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1483.268725][ T5774] usb 8-1: Product: syz [ 1483.268748][ T5774] usb 8-1: Manufacturer: syz [ 1483.268766][ T5774] usb 8-1: SerialNumber: syz [ 1483.336174][ T5774] usb 8-1: config 0 descriptor?? [ 1483.377786][ T5774] radio-si470x 8-1:0.35: could not find interrupt in endpoint [ 1483.378100][ T5774] radio-si470x 8-1:0.35: probe with driver radio-si470x failed with error -5 [ 1483.543560][T29701] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1483.640881][T20035] usb 7-1: USB disconnect, device number 58 [ 1483.920877][ T5774] radio-raremono 8-1:0.35: this is not Thanko's Raremono. [ 1483.921485][ T5774] usbhid 8-1:0.35: couldn't find an input interrupt endpoint [ 1484.112167][T29714] netlink: 'syz.6.7983': attribute type 1 has an invalid length. [ 1484.128329][T29712] netlink: 32 bytes leftover after parsing attributes in process `syz.8.7982'. [ 1484.377287][T29726] netlink: 140 bytes leftover after parsing attributes in process `syz.6.7986'. [ 1484.476058][T20035] IPVS: starting estimator thread 0... [ 1484.566892][T29728] IPVS: using max 8 ests per chain, 19200 per kthread [ 1485.257532][ T1009] usb 8-1: USB disconnect, device number 25 [ 1485.421600][T29759] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1485.755771][ T5774] usb 7-1: new high-speed USB device number 59 using dummy_hcd [ 1485.905922][ T5774] usb 7-1: Using ep0 maxpacket: 8 [ 1485.910168][ T5774] usb 7-1: unable to get BOS descriptor or descriptor too short [ 1485.910259][ T5774] usb 7-1: too many configurations: 252, using maximum allowed: 8 [ 1485.911492][ T5774] usb 7-1: config index 0 descriptor too short (expected 65535, got 27) [ 1485.911520][ T5774] usb 7-1: invalid descriptor for config index 0: type = 0x2, length = 8 [ 1485.911552][ T5774] usb 7-1: can't read configurations, error -22 [ 1486.025717][ T1009] usb 8-1: new high-speed USB device number 26 using dummy_hcd [ 1486.046904][ T5774] usb 7-1: new high-speed USB device number 60 using dummy_hcd [ 1486.162700][T29783] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1486.163315][T29783] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1486.184182][ T1009] usb 8-1: Using ep0 maxpacket: 8 [ 1486.193430][ T1009] usb 8-1: unable to get BOS descriptor or descriptor too short [ 1486.196343][ T5774] usb 7-1: Using ep0 maxpacket: 8 [ 1486.209439][ T1009] usb 8-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 140, changing to 7 [ 1486.223344][ T5774] usb 7-1: unable to get BOS descriptor or descriptor too short [ 1486.223430][ T5774] usb 7-1: too many configurations: 252, using maximum allowed: 8 [ 1486.225370][ T5774] usb 7-1: config index 0 descriptor too short (expected 65535, got 27) [ 1486.225397][ T5774] usb 7-1: invalid descriptor for config index 0: type = 0x2, length = 8 [ 1486.225430][ T5774] usb 7-1: can't read configurations, error -22 [ 1486.270487][ T5774] usb usb7-port1: attempt power cycle [ 1486.279462][ T1009] usb 8-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1486.279493][ T1009] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1486.279514][ T1009] usb 8-1: Product: syz [ 1486.279529][ T1009] usb 8-1: Manufacturer: syz [ 1486.279542][ T1009] usb 8-1: SerialNumber: syz [ 1486.419097][T20035] usb 4-1: new low-speed USB device number 42 using dummy_hcd [ 1486.519917][ T1338] ieee802154 phy0 wpan0: encryption failed: -22 [ 1486.520036][ T1338] ieee802154 phy1 wpan1: encryption failed: -22 [ 1486.569035][ T1009] usb 8-1: 1:1 : invalid UAC_FORMAT_TYPE desc [ 1486.569066][ T1009] usb 8-1: 1:1 : invalid channels 0 [ 1486.569586][ T1009] usb 8-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 1486.619815][T20035] usb 4-1: unable to get BOS descriptor or descriptor too short [ 1486.621407][T20035] usb 4-1: config 9 has an invalid descriptor of length 0, skipping remainder of the config [ 1486.659654][T20035] usb 4-1: string descriptor 0 read error: -22 [ 1486.659806][T20035] usb 4-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice=92.6a [ 1486.659833][T20035] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1486.666065][ T5774] usb 7-1: new high-speed USB device number 61 using dummy_hcd [ 1486.694377][ T5774] usb 7-1: Using ep0 maxpacket: 8 [ 1486.709135][ T5774] usb 7-1: unable to get BOS descriptor or descriptor too short [ 1486.709202][ T5774] usb 7-1: too many configurations: 252, using maximum allowed: 8 [ 1486.711249][ T5774] usb 7-1: config index 0 descriptor too short (expected 65535, got 27) [ 1486.711268][ T5774] usb 7-1: invalid descriptor for config index 0: type = 0x2, length = 8 [ 1486.711291][ T5774] usb 7-1: can't read configurations, error -22 [ 1486.761205][ T1009] usb 8-1: USB disconnect, device number 26 [ 1486.774857][T20035] lan78xx 4-1:9.0 (unnamed net_device) (uninitialized): USB bus speed not supported [ 1486.775137][T20035] lan78xx 4-1:9.0: probe with driver lan78xx failed with error -5 [ 1486.835819][ T5774] usb 7-1: new high-speed USB device number 62 using dummy_hcd [ 1486.867637][ T5774] usb 7-1: Using ep0 maxpacket: 8 [ 1486.870192][ T5774] usb 7-1: unable to get BOS descriptor or descriptor too short [ 1486.870279][ T5774] usb 7-1: too many configurations: 252, using maximum allowed: 8 [ 1486.871499][ T5774] usb 7-1: config index 0 descriptor too short (expected 65535, got 27) [ 1486.871526][ T5774] usb 7-1: invalid descriptor for config index 0: type = 0x2, length = 8 [ 1486.871562][ T5774] usb 7-1: can't read configurations, error -22 [ 1486.873772][ T5774] usb usb7-port1: unable to enumerate USB device [ 1486.887962][ T5976] udevd[5976]: error opening ATTR{/sys/devices/platform/dummy_hcd.7/usb8/8-1/8-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1486.905988][ T32] usb 9-1: new high-speed USB device number 6 using dummy_hcd [ 1486.963214][T29782] netlink: 12 bytes leftover after parsing attributes in process `syz.3.8003'. [ 1486.963312][T29782] openvswitch: netlink: Missing key (keys=40, expected=80) [ 1487.051069][ T5774] usb 4-1: USB disconnect, device number 42 [ 1487.088978][ T32] usb 9-1: unable to get BOS descriptor or descriptor too short [ 1487.090189][ T32] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1487.090214][ T32] usb 9-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1487.092681][ T32] usb 9-1: New USB device found, idVendor=1235, idProduct=0010, bcdDevice= 0.40 [ 1487.092708][ T32] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1487.092723][ T32] usb 9-1: Product: syz [ 1487.092734][ T32] usb 9-1: Manufacturer: syz [ 1487.092745][ T32] usb 9-1: SerialNumber: syz [ 1487.213427][T29791] FAULT_INJECTION: forcing a failure. [ 1487.213427][T29791] name failslab, interval 1, probability 0, space 0, times 0 [ 1487.213465][T29791] CPU: 0 UID: 0 PID: 29791 Comm: syz.3.8006 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1487.213494][T29791] Tainted: [L]=SOFTLOCKUP [ 1487.213502][T29791] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1487.213515][T29791] Call Trace: [ 1487.213523][T29791] [ 1487.213533][T29791] dump_stack_lvl+0xe8/0x150 [ 1487.213571][T29791] should_fail_ex+0x46b/0x600 [ 1487.213606][T29791] should_failslab+0xa8/0x100 [ 1487.213632][T29791] kmem_cache_alloc_noprof+0xa4/0x6c0 [ 1487.213667][T29791] ? ptlock_alloc+0x20/0x70 [ 1487.213688][T29791] ? ptlock_alloc+0x20/0x70 [ 1487.213734][T29791] ptlock_alloc+0x20/0x70 [ 1487.213757][T29791] pte_alloc_one+0x7e/0x380 [ 1487.213792][T29791] __pte_alloc+0x25/0x1a0 [ 1487.213824][T29791] copy_pmd_range+0x4c75/0x5550 [ 1487.213859][T29791] ? __lock_acquire+0x6b5/0x2d10 [ 1487.213912][T29791] ? __pfx_copy_pmd_range+0x10/0x10 [ 1487.213940][T29791] ? __lock_acquire+0x6b5/0x2d10 [ 1487.213977][T29791] ? __lock_acquire+0x6b5/0x2d10 [ 1487.214016][T29791] copy_page_range+0xb3f/0x1150 [ 1487.214065][T29791] ? __pfx_copy_page_range+0x10/0x10 [ 1487.214102][T29791] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1487.214131][T29791] ? lockdep_hardirqs_on+0x7a/0x110 [ 1487.214160][T29791] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1487.214192][T29791] dup_mmap+0xf5a/0x1d70 [ 1487.214242][T29791] ? __pfx_dup_mmap+0x10/0x10 [ 1487.214267][T29791] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 1487.214302][T29791] ? copy_mm+0x10f/0x480 [ 1487.214337][T29791] ? copy_mm+0x10f/0x480 [ 1487.214387][T29791] copy_mm+0x11a/0x480 [ 1487.214425][T29791] copy_process+0x1e65/0x42e0 [ 1487.214469][T29791] ? copy_process+0xd4e/0x42e0 [ 1487.214524][T29791] ? __pfx_copy_process+0x10/0x10 [ 1487.214565][T29791] ? __lock_acquire+0x6b5/0x2d10 [ 1487.214605][T29791] kernel_clone+0x2d7/0x940 [ 1487.214635][T29791] ? __pfx_kernel_clone+0x10/0x10 [ 1487.214679][T29791] __x64_sys_clone+0x1b6/0x230 [ 1487.214701][T29791] ? ktime_get+0x45/0x220 [ 1487.214730][T29791] ? __pfx___x64_sys_clone+0x10/0x10 [ 1487.214784][T29791] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1487.214810][T29791] do_syscall_64+0x174/0x580 [ 1487.214841][T29791] ? clear_bhb_loop+0x40/0x90 [ 1487.214870][T29791] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1487.214893][T29791] RIP: 0033:0x7fc3f95cce59 [ 1487.214915][T29791] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1487.214935][T29791] RSP: 002b:00007fc3f7825fd8 EFLAGS: 00000206 ORIG_RAX: 0000000000000038 [ 1487.214960][T29791] RAX: ffffffffffffffda RBX: 00007fc3f9845fa0 RCX: 00007fc3f95cce59 [ 1487.214977][T29791] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000011 [ 1487.214992][T29791] RBP: 00007fc3f7826090 R08: 0000000000000000 R09: 0000000000000000 [ 1487.215006][T29791] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000002 [ 1487.215020][T29791] R13: 00007fc3f9846038 R14: 00007fc3f9845fa0 R15: 00007ffcf22138c8 [ 1487.215056][T29791] [ 1487.215368][ T32] usb 9-1: selecting invalid altsetting 1 [ 1487.221283][ T32] usb 9-1: unit 6 not found! [ 1488.193855][ T32] usb 9-1: 2:0: sticky mixer values (0/123/1 => 0), disabling [ 1488.193891][ T32] usb 9-1: check MIXER_GET_CUR_BROKEN if you believe the mixer is non-sticky [ 1488.401161][ T32] usb 9-1: USB disconnect, device number 6 [ 1488.447624][ T5976] udevd[5976]: error opening ATTR{/sys/devices/platform/dummy_hcd.8/usb9/9-1/9-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1488.755456][ T5721] usb 8-1: new full-speed USB device number 27 using dummy_hcd [ 1488.790573][T29806] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1488.910182][ T5721] usb 8-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 1488.910224][ T5721] usb 8-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 23 [ 1488.913157][ T5721] usb 8-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1488.913273][ T5721] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 1488.913344][ T5721] usb 8-1: SerialNumber: syz [ 1489.009393][ T5721] hub 8-1:1.0: bad descriptor, ignoring hub [ 1489.009437][ T5721] hub 8-1:1.0: probe with driver hub failed with error -5 [ 1489.020645][ T5721] cdc_acm 8-1:1.0: Control and data interfaces are not separated! [ 1489.498131][ T1009] usb 9-1: new high-speed USB device number 7 using dummy_hcd [ 1489.655211][ T1009] usb 9-1: Using ep0 maxpacket: 8 [ 1489.658137][ T1009] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 252, changing to 11 [ 1489.658190][ T1009] usb 9-1: New USB device found, idVendor=0e8f, idProduct=0003, bcdDevice= 0.00 [ 1489.658218][ T1009] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1489.709023][ T1009] usb 9-1: config 0 descriptor?? [ 1490.475312][T29820] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1490.479479][T29820] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1491.425814][ T1009] usbhid 9-1:0.0: can't add hid device: -71 [ 1491.425936][ T1009] usbhid 9-1:0.0: probe with driver usbhid failed with error -71 [ 1491.464201][ T1009] usb 9-1: USB disconnect, device number 7 [ 1491.746611][ T5721] cdc_acm 8-1:1.0: ttyACM0: USB ACM device [ 1491.849087][ T5721] usb 8-1: USB disconnect, device number 27 [ 1491.916521][T29833] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1492.602263][T29850] binder: 29849:29850 ioctl c0306201 200000000080 returned -14 [ 1492.613767][T29850] binder: 29849:29850 ioctl c0306201 2000000003c0 returned -14 [ 1492.988685][T29861] netlink: 4 bytes leftover after parsing attributes in process `syz.6.8032'. [ 1493.007095][ T5721] usb 4-1: new high-speed USB device number 43 using dummy_hcd [ 1493.007255][T29862] netlink: 28 bytes leftover after parsing attributes in process `syz.7.8033'. [ 1493.078339][T29864] FAULT_INJECTION: forcing a failure. [ 1493.078339][T29864] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1493.078378][T29864] CPU: 0 UID: 0 PID: 29864 Comm: syz.7.8035 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1493.078409][T29864] Tainted: [L]=SOFTLOCKUP [ 1493.078418][T29864] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1493.078433][T29864] Call Trace: [ 1493.078443][T29864] [ 1493.078452][T29864] dump_stack_lvl+0xe8/0x150 [ 1493.078490][T29864] should_fail_ex+0x46b/0x600 [ 1493.078527][T29864] _copy_from_user+0x2d/0xb0 [ 1493.078553][T29864] iommufd_fops_ioctl+0x461/0x5d0 [ 1493.078584][T29864] ? __pfx_iommufd_fops_ioctl+0x10/0x10 [ 1493.078617][T29864] ? __fget_files+0x2a/0x420 [ 1493.078646][T29864] ? __fget_files+0x2a/0x420 [ 1493.078672][T29864] ? bpf_lsm_file_ioctl+0x9/0x20 [ 1493.078699][T29864] ? __pfx_iommufd_fops_ioctl+0x10/0x10 [ 1493.078727][T29864] __se_sys_ioctl+0xff/0x170 [ 1493.078756][T29864] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1493.078800][T29864] do_syscall_64+0x174/0x580 [ 1493.078829][T29864] ? trace_irq_disable+0x3b/0x140 [ 1493.078857][T29864] ? clear_bhb_loop+0x40/0x90 [ 1493.078887][T29864] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1493.078918][T29864] RIP: 0033:0x7f276520ce59 [ 1493.078940][T29864] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1493.078961][T29864] RSP: 002b:00007f276345e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1493.078986][T29864] RAX: ffffffffffffffda RBX: 00007f2765485fa0 RCX: 00007f276520ce59 [ 1493.079005][T29864] RDX: 0000200000000100 RSI: 0000000000003ba0 RDI: 0000000000000003 [ 1493.079020][T29864] RBP: 00007f276345e090 R08: 0000000000000000 R09: 0000000000000000 [ 1493.079035][T29864] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1493.079050][T29864] R13: 00007f2765486038 R14: 00007f2765485fa0 R15: 00007ffd7efe45e8 [ 1493.079086][T29864] [ 1493.158697][ T5721] usb 4-1: Using ep0 maxpacket: 16 [ 1493.183732][ T5721] usb 4-1: unable to get BOS descriptor or descriptor too short [ 1493.326817][ T5721] usb 4-1: New USB device found, idVendor=17cc, idProduct=1011, bcdDevice= 0.40 [ 1493.326853][ T5721] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1493.326869][ T5721] usb 4-1: Product: syz [ 1493.326880][ T5721] usb 4-1: Manufacturer: syz [ 1493.326890][ T5721] usb 4-1: SerialNumber: syz [ 1493.373371][T29866] netlink: 'syz.8.8034': attribute type 21 has an invalid length. [ 1493.373472][T29866] netlink: 132 bytes leftover after parsing attributes in process `syz.8.8034'. [ 1493.423043][T29867] netlink: 'syz.8.8034': attribute type 21 has an invalid length. [ 1493.423192][T29867] netlink: 132 bytes leftover after parsing attributes in process `syz.8.8034'. [ 1493.522469][T29870] netlink: 8 bytes leftover after parsing attributes in process `syz.7.8036'. [ 1493.624040][ T5721] usb 4-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 1493.636465][ T5721] usb 4-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 1493.641719][ T5721] usb 4-1: unable to issue vendor read request (ret = -71) [ 1493.642329][ T5721] usb 4-1: unable to issue vendor read request (ret = -71) [ 1493.643294][ T5721] usb 4-1: unable to issue vendor read request (ret = -71) [ 1493.646762][ T5721] usb 4-1: unable to issue vendor read request (ret = -71) [ 1493.695639][T11697] Bluetooth: hci3: command 0x0406 tx timeout [ 1493.770162][T29874] netlink: 312 bytes leftover after parsing attributes in process `syz.8.8037'. [ 1493.770202][T29874] netlink: 'syz.8.8037': attribute type 1 has an invalid length. [ 1493.866469][ T5721] usb 4-1: USB disconnect, device number 43 [ 1493.943633][ T5976] udevd[5976]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1493.993558][T29879] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1494.029403][T29879] netlink: 128 bytes leftover after parsing attributes in process `syz.7.8039'. [ 1494.058804][T29879] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1494.322732][T29887] netlink: 32 bytes leftover after parsing attributes in process `syz.6.8042'. [ 1494.377856][T29889] IPVS: ovf: FWM 3 0x00000003 - no destination available [ 1494.784943][ T5721] usb 8-1: new high-speed USB device number 28 using dummy_hcd [ 1494.955328][ T5721] usb 8-1: Using ep0 maxpacket: 16 [ 1494.957985][ T5721] usb 8-1: config 0 has an invalid descriptor of length 90, skipping remainder of the config [ 1494.958041][ T5721] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1494.958074][ T5721] usb 8-1: config 0 interface 0 altsetting 0 has a duplicate endpoint with address 0x2, skipping [ 1494.958099][ T5721] usb 8-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1494.959836][ T5721] usb 8-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1494.959867][ T5721] usb 8-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1494.959891][ T5721] usb 8-1: Manufacturer: syz [ 1495.062337][ T5721] usb 8-1: config 0 descriptor?? [ 1495.822551][T29926] netlink: 'syz.3.8056': attribute type 21 has an invalid length. [ 1495.822642][T29926] netlink: 'syz.3.8056': attribute type 6 has an invalid length. [ 1495.822659][T29926] netlink: 132 bytes leftover after parsing attributes in process `syz.3.8056'. [ 1495.974455][ T5344] usb 9-1: new high-speed USB device number 8 using dummy_hcd [ 1496.104538][ T5344] usb 9-1: device descriptor read/64, error -71 [ 1496.344475][ T5344] usb 9-1: new high-speed USB device number 9 using dummy_hcd [ 1496.386537][T29934] nfs: Bad value for 'source' [ 1496.434433][T28084] usb 4-1: new high-speed USB device number 44 using dummy_hcd [ 1496.474459][ T5344] usb 9-1: device descriptor read/64, error -71 [ 1496.586097][ T5344] usb usb9-port1: attempt power cycle [ 1496.595460][T28084] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023 [ 1496.595496][T28084] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A [ 1496.595527][T28084] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8A has invalid maxpacket 121 [ 1496.626699][T28084] usb 4-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 1496.626732][T28084] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1496.626755][T28084] usb 4-1: Product: syz [ 1496.626772][T28084] usb 4-1: Manufacturer: syz [ 1496.626788][T28084] usb 4-1: SerialNumber: syz [ 1496.675172][T28084] usb 4-1: config 0 descriptor?? [ 1496.682982][T29930] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 1496.683143][T29930] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 1496.700358][T28084] usb 4-1: ucan: probing device on interface #0 [ 1496.984364][ T5721] usb 7-1: new high-speed USB device number 63 using dummy_hcd [ 1497.014370][ T5344] usb 9-1: new high-speed USB device number 10 using dummy_hcd [ 1497.035757][ T5344] usb 9-1: device descriptor read/8, error -71 [ 1497.138736][ T5721] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1497.138824][ T5721] usb 7-1: config 1 interface 0 altsetting 0 has an endpoint descriptor with address 0x7F, changing to 0xF [ 1497.138855][ T5721] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 1497.141674][ T5721] usb 7-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1497.141706][ T5721] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1497.141729][ T5721] usb 7-1: Product: syz [ 1497.141745][ T5721] usb 7-1: Manufacturer: syz [ 1497.141760][ T5721] usb 7-1: SerialNumber: syz [ 1497.266915][T28084] usb 4-1: ucan: could not read protocol version, ret=-71 [ 1497.266944][T28084] usb 4-1: ucan: probe failed; try to update the device firmware [ 1497.339918][T28084] usb 4-1: USB disconnect, device number 44 [ 1497.353669][ T5344] usb 9-1: new high-speed USB device number 11 using dummy_hcd [ 1497.365068][ T5344] usb 9-1: device descriptor read/8, error -71 [ 1497.463477][ T5720] usb 8-1: USB disconnect, device number 28 [ 1497.474608][ T5344] usb usb9-port1: unable to enumerate USB device [ 1498.046285][T29941] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1498.046958][T29941] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1498.252300][ T5721] cdc_ncm 7-1:1.0: bind() failure [ 1498.267396][ T5721] usbtest 7-1:1.1: probe with driver usbtest failed with error -71 [ 1498.274761][ T5721] usb 7-1: USB disconnect, device number 63 [ 1498.494173][ T5774] usb 4-1: new high-speed USB device number 45 using dummy_hcd [ 1498.647345][ T5774] usb 4-1: unable to get BOS descriptor or descriptor too short [ 1498.648534][ T5774] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1498.648590][ T5774] usb 4-1: config 1 interface 0 altsetting 13 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1498.648623][ T5774] usb 4-1: config 1 interface 0 has no altsetting 0 [ 1498.651203][ T5774] usb 4-1: New USB device found, idVendor=05ac, idProduct=0245, bcdDevice= 0.40 [ 1498.651248][ T5774] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1498.651271][ T5774] usb 4-1: Product: syz [ 1498.651287][ T5774] usb 4-1: Manufacturer: syz [ 1498.651302][ T5774] usb 4-1: SerialNumber: syz [ 1498.934107][T29955] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1498.939330][T29955] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1499.000057][T29963] IPVS: ovf: FWM 3 0x00000003 - no destination available [ 1499.016587][ T5774] input: bcm5974 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/input/input120 [ 1499.034892][ T4963] bcm5974 4-1:1.0: could not read from device [ 1499.072685][ T5774] usb 4-1: USB disconnect, device number 45 [ 1499.449025][T29974] netlink: 36 bytes leftover after parsing attributes in process `syz.7.8077'. [ 1500.731373][T29991] IPVS: ovf: FWM 3 0x00000003 - no destination available [ 1500.734420][T29994] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1501.246520][T28084] usb 9-1: new full-speed USB device number 12 using dummy_hcd [ 1501.384016][T30009] veth0_to_team: entered promiscuous mode [ 1501.419316][T28084] usb 9-1: config 0 has an invalid interface number: 107 but max is 0 [ 1501.419346][T28084] usb 9-1: config 0 has no interface number 0 [ 1501.419396][T28084] usb 9-1: config 0 interface 107 altsetting 0 endpoint 0x88 has invalid wMaxPacketSize 0 [ 1501.422098][T28084] usb 9-1: New USB device found, idVendor=06cd, idProduct=0131, bcdDevice=16.60 [ 1501.422131][T28084] usb 9-1: New USB device strings: Mfr=175, Product=2, SerialNumber=3 [ 1501.422173][T28084] usb 9-1: Product: syz [ 1501.422190][T28084] usb 9-1: Manufacturer: syz [ 1501.422207][T28084] usb 9-1: SerialNumber: syz [ 1501.494400][T28084] usb 9-1: config 0 descriptor?? [ 1501.522378][T30012] usb usb8: usbfs: process 30012 (syz.3.8092) did not claim interface 0 before use [ 1501.591586][T30014] FAULT_INJECTION: forcing a failure. [ 1501.591586][T30014] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1501.591626][T30014] CPU: 1 UID: 0 PID: 30014 Comm: syz.6.8093 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1501.591658][T30014] Tainted: [L]=SOFTLOCKUP [ 1501.591667][T30014] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1501.591680][T30014] Call Trace: [ 1501.591689][T30014] [ 1501.591699][T30014] dump_stack_lvl+0xe8/0x150 [ 1501.591739][T30014] should_fail_ex+0x46b/0x600 [ 1501.591783][T30014] _copy_to_user+0x31/0xb0 [ 1501.591830][T30014] simple_read_from_buffer+0xe1/0x170 [ 1501.591860][T30014] proc_fail_nth_read+0x1be/0x230 [ 1501.591889][T30014] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1501.591916][T30014] ? rw_verify_area+0x2ac/0x4e0 [ 1501.591943][T30014] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1501.591969][T30014] vfs_read+0x212/0xa80 [ 1501.592006][T30014] ? __pfx_vfs_read+0x10/0x10 [ 1501.592037][T30014] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1501.592068][T30014] ? lockdep_hardirqs_on+0x7a/0x110 [ 1501.592098][T30014] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1501.592127][T30014] ? mutex_lock_nested+0x152/0x1d0 [ 1501.592164][T30014] ? fdget_pos+0x252/0x320 [ 1501.592198][T30014] ksys_read+0x156/0x270 [ 1501.592229][T30014] ? __pfx_ksys_read+0x10/0x10 [ 1501.592265][T30014] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1501.592292][T30014] do_syscall_64+0x174/0x580 [ 1501.592322][T30014] ? trace_irq_disable+0x3b/0x140 [ 1501.592351][T30014] ? clear_bhb_loop+0x40/0x90 [ 1501.592379][T30014] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1501.592403][T30014] RIP: 0033:0x7f8e6707d68e [ 1501.592423][T30014] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1501.592445][T30014] RSP: 002b:00007f8e65315fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1501.592470][T30014] RAX: ffffffffffffffda RBX: 00007f8e653166c0 RCX: 00007f8e6707d68e [ 1501.592488][T30014] RDX: 000000000000000f RSI: 00007f8e653160a0 RDI: 000000000000000c [ 1501.592504][T30014] RBP: 00007f8e65316090 R08: 0000000000000000 R09: 0000000000000000 [ 1501.592517][T30014] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1501.592531][T30014] R13: 00007f8e67336038 R14: 00007f8e67335fa0 R15: 00007ffd89d92588 [ 1501.592566][T30014] [ 1501.834859][T28084] keyspan 9-1:0.107: Keyspan 4 port adapter converter detected [ 1501.835437][T28084] keyspan 9-1:0.107: found no endpoint descriptor for endpoint 81 [ 1501.837759][T28084] keyspan 9-1:0.107: found no endpoint descriptor for endpoint 1 [ 1501.840984][T28084] usb 9-1: Keyspan 4 port adapter converter now attached to ttyUSB0 [ 1501.924076][T28084] keyspan 9-1:0.107: found no endpoint descriptor for endpoint 2 [ 1501.938675][T28084] usb 9-1: Keyspan 4 port adapter converter now attached to ttyUSB1 [ 1501.941264][T28084] keyspan 9-1:0.107: found no endpoint descriptor for endpoint 4 [ 1501.960110][T28084] usb 9-1: Keyspan 4 port adapter converter now attached to ttyUSB2 [ 1501.962781][T28084] keyspan 9-1:0.107: found no endpoint descriptor for endpoint 6 [ 1502.019322][T28084] usb 9-1: Keyspan 4 port adapter converter now attached to ttyUSB3 [ 1502.041642][T28084] usb 9-1: USB disconnect, device number 12 [ 1502.095832][T28084] keyspan_4 ttyUSB0: Keyspan 4 port adapter converter now disconnected from ttyUSB0 [ 1502.134168][T28084] keyspan_4 ttyUSB1: Keyspan 4 port adapter converter now disconnected from ttyUSB1 [ 1502.157165][T28084] keyspan_4 ttyUSB2: Keyspan 4 port adapter converter now disconnected from ttyUSB2 [ 1502.192605][T28084] keyspan_4 ttyUSB3: Keyspan 4 port adapter converter now disconnected from ttyUSB3 [ 1502.240479][T28084] keyspan 9-1:0.107: device disconnected [ 1502.336405][T29375] usb 4-1: new high-speed USB device number 46 using dummy_hcd [ 1502.457076][T30022] netlink: 'syz.6.8097': attribute type 29 has an invalid length. [ 1502.461533][T30022] netlink: 'syz.6.8097': attribute type 29 has an invalid length. [ 1502.482413][T30022] netlink: 'syz.6.8097': attribute type 29 has an invalid length. [ 1502.486079][T29375] usb 4-1: Using ep0 maxpacket: 16 [ 1502.536855][T29375] usb 4-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1502.536892][T29375] usb 4-1: config 0 interface 0 altsetting 8 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1502.536915][T29375] usb 4-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 1502.536941][T29375] usb 4-1: config 0 interface 0 has no altsetting 0 [ 1502.536976][T29375] usb 4-1: New USB device found, idVendor=1e7d, idProduct=2db4, bcdDevice= 0.00 [ 1502.536999][T29375] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1502.611862][T29375] usb 4-1: config 0 descriptor?? [ 1503.062868][T29375] konepure 0003:1E7D:2DB4.002E: unknown main item tag 0x0 [ 1503.062907][T29375] konepure 0003:1E7D:2DB4.002E: unexpected long global item [ 1503.080258][T29375] konepure 0003:1E7D:2DB4.002E: parse failed [ 1503.080452][T29375] konepure 0003:1E7D:2DB4.002E: probe with driver konepure failed with error -22 [ 1503.312181][T30032] usb usb8: check_ctrlrecip: process 30032 (syz.6.8100) requesting ep 01 but needs 81 [ 1504.195457][T30047] FAULT_INJECTION: forcing a failure. [ 1504.195457][T30047] name failslab, interval 1, probability 0, space 0, times 0 [ 1504.195500][T30047] CPU: 1 UID: 0 PID: 30047 Comm: syz.6.8106 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1504.195533][T30047] Tainted: [L]=SOFTLOCKUP [ 1504.195543][T30047] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1504.195559][T30047] Call Trace: [ 1504.195568][T30047] [ 1504.195579][T30047] dump_stack_lvl+0xe8/0x150 [ 1504.195612][T30047] should_fail_ex+0x46b/0x600 [ 1504.195653][T30047] should_failslab+0xa8/0x100 [ 1504.195684][T30047] __kmalloc_noprof+0xfe/0x7e0 [ 1504.195710][T30047] ? io_cache_alloc_new+0x40/0x100 [ 1504.195737][T30047] ? io_cache_alloc_new+0x40/0x100 [ 1504.195773][T30047] io_cache_alloc_new+0x40/0x100 [ 1504.195802][T30047] io_uring_cmd_prep+0x3ab/0x5d0 [ 1504.195834][T30047] io_submit_sqes+0xbd3/0x22e0 [ 1504.195898][T30047] __se_sys_io_uring_enter+0x34a/0x1c40 [ 1504.195951][T30047] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 1504.195985][T30047] ? __pfx___se_sys_io_uring_enter+0x10/0x10 [ 1504.196023][T30047] ? __fget_files+0x2a/0x420 [ 1504.196052][T30047] ? fput+0xa0/0xd0 [ 1504.196080][T30047] ? __x64_sys_io_uring_enter+0x21/0xf0 [ 1504.196115][T30047] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1504.196142][T30047] do_syscall_64+0x174/0x580 [ 1504.196173][T30047] ? trace_irq_disable+0x3b/0x140 [ 1504.196203][T30047] ? clear_bhb_loop+0x40/0x90 [ 1504.196233][T30047] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1504.196257][T30047] RIP: 0033:0x7f8e670bce59 [ 1504.196278][T30047] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1504.196299][T30047] RSP: 002b:00007f8e65315f38 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 1504.196324][T30047] RAX: ffffffffffffffda RBX: 0000200000000340 RCX: 00007f8e670bce59 [ 1504.196342][T30047] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000009 [ 1504.196357][T30047] RBP: 0000000000000009 R08: 0000000000000000 R09: 0000000000000008 [ 1504.196372][T30047] R10: 0000000000000000 R11: 0000000000000246 R12: 0000200000000800 [ 1504.196388][T30047] R13: 0000200000000808 R14: 00000000000003c9 R15: 0000000000000000 [ 1504.196423][T30047] [ 1504.537542][ T5721] usb 4-1: USB disconnect, device number 46 [ 1504.919068][T30062] netlink: 'syz.8.8111': attribute type 21 has an invalid length. [ 1504.946991][T30062] netlink: 128 bytes leftover after parsing attributes in process `syz.8.8111'. [ 1504.958417][T30062] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1505.063487][ T5721] usb 7-1: new high-speed USB device number 64 using dummy_hcd [ 1505.103111][T30064] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8112'. [ 1505.223693][ T5721] usb 7-1: Using ep0 maxpacket: 32 [ 1505.255037][T30066] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1505.279308][ T5721] usb 7-1: config 0 interface 0 altsetting 16 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1505.279344][ T5721] usb 7-1: config 0 interface 0 altsetting 16 endpoint 0x2 has an invalid bInterval 69, changing to 10 [ 1505.279375][ T5721] usb 7-1: config 0 interface 0 altsetting 16 endpoint 0x2 has invalid maxpacket 57379, setting to 1024 [ 1505.279406][ T5721] usb 7-1: config 0 interface 0 altsetting 16 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 1505.279438][ T5721] usb 7-1: config 0 interface 0 has no altsetting 0 [ 1505.279477][ T5721] usb 7-1: New USB device found, idVendor=044f, idProduct=b65d, bcdDevice= 0.00 [ 1505.279504][ T5721] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1505.400414][ T5721] usb 7-1: config 0 descriptor?? [ 1505.610606][T30070] comedi comedi3: rti802: I/O base address not correctly aligned [ 1505.636980][T30072] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8115'. [ 1505.847320][ T5721] hid-thrustmaster 0003:044F:B65D.002F: unknown main item tag 0x0 [ 1505.847361][ T5721] hid-thrustmaster 0003:044F:B65D.002F: unknown main item tag 0x0 [ 1505.847442][ T5721] hid-thrustmaster 0003:044F:B65D.002F: unknown main item tag 0x0 [ 1505.895701][ T5721] hid-thrustmaster 0003:044F:B65D.002F: hidraw0: USB HID v0.00 Device [HID 044f:b65d] on usb-dummy_hcd.6-1/input0 [ 1506.040937][ T5721] hid-thrustmaster 0003:044F:B65D.002F: setup data couldn't be sent [ 1506.041267][ C1] hid-thrustmaster 0003:044F:B65D.002F: URB to get model id failed with error -71 [ 1506.071784][ T5721] usb 7-1: USB disconnect, device number 64 [ 1506.114292][T30078] fido_id[30078]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.6/usb7/7-1/report_descriptor': No such file or directory [ 1506.356353][ T1009] hid-generic 0000:0003:0004.0030: unknown main item tag 0x3 [ 1506.356408][ T1009] hid-generic 0000:0003:0004.0030: unknown main item tag 0x3 [ 1506.356436][ T1009] hid-generic 0000:0003:0004.0030: unknown main item tag 0x3 [ 1506.356464][ T1009] hid-generic 0000:0003:0004.0030: unknown main item tag 0x7 [ 1506.410528][ T1009] hid-generic 0000:0003:0004.0030: hidraw0: HID v80.01 Device [syz0] on syz1 [ 1506.443210][ T5721] usb 7-1: new high-speed USB device number 65 using dummy_hcd [ 1506.503243][T28084] usb 4-1: new high-speed USB device number 47 using dummy_hcd [ 1506.531328][T30085] fido_id[30085]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 1506.663160][T28084] usb 4-1: Using ep0 maxpacket: 16 [ 1506.665486][T28084] usb 4-1: config 1 has an invalid interface number: 105 but max is 0 [ 1506.665520][T28084] usb 4-1: config 1 has no interface number 0 [ 1506.665569][T28084] usb 4-1: config 1 interface 105 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 16 [ 1506.665598][T28084] usb 4-1: config 1 interface 105 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 64 [ 1506.665627][T28084] usb 4-1: config 1 interface 105 has no altsetting 0 [ 1506.669120][T28084] usb 4-1: New USB device found, idVendor=20f4, idProduct=e05a, bcdDevice=6c.6d [ 1506.669151][T28084] usb 4-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 1506.669175][T28084] usb 4-1: Product: syz [ 1506.669192][T28084] usb 4-1: Manufacturer: syz [ 1506.669268][T28084] usb 4-1: SerialNumber: syz [ 1506.689713][T30081] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 1506.691675][T30081] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 1506.942376][T30081] netlink: 'syz.3.8120': attribute type 29 has an invalid length. [ 1506.957159][T30081] netlink: 'syz.3.8120': attribute type 29 has an invalid length. [ 1507.000114][T30081] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1507.017565][T30081] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1507.253418][ T5721] usb 7-1: unable to get BOS descriptor or descriptor too short [ 1507.255633][ T5721] usb 7-1: unable to read config index 0 descriptor/start: -71 [ 1507.255671][ T5721] usb 7-1: can't read configurations, error -71 [ 1507.616340][ T38] audit: type=1326 audit(2000004738.393:2906): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30103 comm="syz.6.8129" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f8e670bce59 code=0x0 [ 1507.721010][T30105] netlink: 'syz.6.8129': attribute type 40 has an invalid length. [ 1508.435204][T30122] syz_tun: entered allmulticast mode [ 1508.687178][T30125] misc userio: Invalid payload size [ 1509.242923][ T5774] usb 7-1: new high-speed USB device number 67 using dummy_hcd [ 1509.273205][T28084] aqc111 4-1:1.105: probe with driver aqc111 failed with error -71 [ 1509.314976][T28084] usb 4-1: USB disconnect, device number 47 [ 1509.392837][ T5774] usb 7-1: Using ep0 maxpacket: 8 [ 1509.395942][ T5774] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1509.395968][ T5774] usb 7-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1509.396004][ T5774] usb 7-1: New USB device found, idVendor=5543, idProduct=0047, bcdDevice= 0.00 [ 1509.396029][ T5774] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1509.450439][ T5774] usb 7-1: config 0 descriptor?? [ 1509.675372][ T5774] usb 7-1: USB disconnect, device number 67 [ 1509.982709][T29375] usb 4-1: new full-speed USB device number 48 using dummy_hcd [ 1510.122847][ T5774] usb 9-1: new high-speed USB device number 13 using dummy_hcd [ 1510.146319][T29375] usb 4-1: unable to get BOS descriptor or descriptor too short [ 1510.146946][T29375] usb 4-1: not running at top speed; connect to a high speed hub [ 1510.149126][T29375] usb 4-1: config 0 has an invalid interface number: 212 but max is 0 [ 1510.149154][T29375] usb 4-1: config 0 has no interface number 0 [ 1510.151888][T29375] usb 4-1: New USB device found, idVendor=05c6, idProduct=908b, bcdDevice=85.4f [ 1510.151919][T29375] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1510.151944][T29375] usb 4-1: Product: syz [ 1510.151962][T29375] usb 4-1: Manufacturer: syz [ 1510.151979][T29375] usb 4-1: SerialNumber: syz [ 1510.220286][T29375] usb 4-1: config 0 descriptor?? [ 1510.230056][T29375] option 4-1:0.212: GSM modem (1-port) converter detected [ 1510.300655][ T5774] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1510.300725][ T5774] usb 9-1: config 1 interface 0 altsetting 0 has an endpoint descriptor with address 0x7F, changing to 0xF [ 1510.300763][ T5774] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 1510.344045][ T5774] usb 9-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1510.344096][ T5774] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1510.344120][ T5774] usb 9-1: Product: syz [ 1510.344136][ T5774] usb 9-1: Manufacturer: syz [ 1510.344154][ T5774] usb 9-1: SerialNumber: syz [ 1510.426915][T30143] netlink: 12 bytes leftover after parsing attributes in process `syz.3.8141'. [ 1510.443419][ T821] usb 4-1: USB disconnect, device number 48 [ 1510.451997][ T821] option 4-1:0.212: device disconnected [ 1510.755773][T30154] netlink: 516 bytes leftover after parsing attributes in process `syz.6.8145'. [ 1510.938367][T30159] FAULT_INJECTION: forcing a failure. [ 1510.938367][T30159] name failslab, interval 1, probability 0, space 0, times 0 [ 1510.938471][T30159] CPU: 1 UID: 0 PID: 30159 Comm: syz.6.8147 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1510.938505][T30159] Tainted: [L]=SOFTLOCKUP [ 1510.938515][T30159] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1510.938530][T30159] Call Trace: [ 1510.938540][T30159] [ 1510.938550][T30159] dump_stack_lvl+0xe8/0x150 [ 1510.938589][T30159] should_fail_ex+0x46b/0x600 [ 1510.938638][T30159] should_failslab+0xa8/0x100 [ 1510.938669][T30159] kmem_cache_alloc_noprof+0xa4/0x6c0 [ 1510.938707][T30159] ? vm_area_alloc+0x24/0x140 [ 1510.938739][T30159] ? vm_area_alloc+0x24/0x140 [ 1510.938774][T30159] vm_area_alloc+0x24/0x140 [ 1510.938803][T30159] mmap_region+0x1262/0x2220 [ 1510.938839][T30159] ? __schedule+0x1741/0x5550 [ 1510.938878][T30159] ? __lock_acquire+0x6b5/0x2d10 [ 1510.938908][T30159] ? __pfx_mmap_region+0x10/0x10 [ 1510.938944][T30159] ? mas_ascend+0x304/0x890 [ 1510.938990][T30159] ? mas_prev_node+0xbe8/0xe50 [ 1510.939026][T30159] ? mas_prev_slot+0xb7e/0xc00 [ 1510.939110][T30159] ? do_raw_spin_lock+0x12b/0x2f0 [ 1510.939153][T30159] ? lockdep_hardirqs_on+0x7a/0x110 [ 1510.939203][T30159] ? cap_mmap_addr+0xaf/0x100 [ 1510.939238][T30159] ? bpf_lsm_mmap_addr+0x9/0x50 [ 1510.939264][T30159] ? security_mmap_addr+0x71/0x240 [ 1510.939301][T30159] ? shmem_mapping+0xd/0x50 [ 1510.939333][T30159] ? memfd_check_seals_mmap+0xcb/0x210 [ 1510.939362][T30159] do_mmap+0xc2f/0x10c0 [ 1510.939404][T30159] ? lockdep_hardirqs_on+0x7a/0x110 [ 1510.939435][T30159] ? __pfx_do_mmap+0x10/0x10 [ 1510.939469][T30159] ? rwbase_write_lock+0x568/0x730 [ 1510.939514][T30159] vm_mmap_pgoff+0x2cc/0x4f0 [ 1510.939556][T30159] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 1510.939598][T30159] ? __fget_files+0x2a/0x420 [ 1510.939622][T30159] ? __fget_files+0x3a6/0x420 [ 1510.939652][T30159] ? __fget_files+0x2a/0x420 [ 1510.939682][T30159] ksys_mmap_pgoff+0x4e8/0x720 [ 1510.939720][T30159] ? __x64_sys_mmap+0x7f/0x140 [ 1510.939751][T30159] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1510.939778][T30159] do_syscall_64+0x174/0x580 [ 1510.939812][T30159] ? clear_bhb_loop+0x40/0x90 [ 1510.939842][T30159] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1510.939867][T30159] RIP: 0033:0x7f8e670bcbc2 [ 1510.939888][T30159] Code: 4f 01 00 0f 1f 44 00 00 41 f7 c1 ff 0f 00 00 75 27 55 89 cd 53 48 89 fb 48 85 ff 74 3b 41 89 ea 48 89 df b8 09 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 6e 5b 5d c3 0f 1f 00 48 c7 c0 e8 ff ff ff 64 [ 1510.939909][T30159] RSP: 002b:00007f8e65315ed8 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 1510.939934][T30159] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f8e670bcbc2 [ 1510.939951][T30159] RDX: 0000000000000003 RSI: 0000000000020000 RDI: 0000000000000000 [ 1510.939966][T30159] RBP: 0000000000008001 R08: 0000000000000009 R09: 0000000010000000 [ 1510.939982][T30159] R10: 0000000000008001 R11: 0000000000000246 R12: 0000200000000888 [ 1510.939998][T30159] R13: 0000200000000890 R14: 00007f8e65315fd8 R15: 0000000000000000 [ 1510.940034][T30159] [ 1511.226470][T28084] usb 4-1: new full-speed USB device number 49 using dummy_hcd [ 1511.297815][T30161] FAULT_INJECTION: forcing a failure. [ 1511.297815][T30161] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1511.297853][T30161] CPU: 1 UID: 0 PID: 30161 Comm: syz.6.8148 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1511.297884][T30161] Tainted: [L]=SOFTLOCKUP [ 1511.297893][T30161] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1511.297908][T30161] Call Trace: [ 1511.297917][T30161] [ 1511.297927][T30161] dump_stack_lvl+0xe8/0x150 [ 1511.297958][T30161] should_fail_ex+0x46b/0x600 [ 1511.297997][T30161] _copy_from_user+0x2d/0xb0 [ 1511.298024][T30161] input_event_from_user+0xb1/0x290 [ 1511.298050][T30161] ? __pfx_input_event_from_user+0x10/0x10 [ 1511.298079][T30161] ? rt_spin_unlock+0x160/0x200 [ 1511.298097][T30161] evdev_write+0x2ca/0x4c0 [ 1511.298112][T30161] ? __lock_acquire+0x6b5/0x2d10 [ 1511.298135][T30161] ? __pfx_evdev_write+0x10/0x10 [ 1511.298156][T30161] ? rw_verify_area+0x25b/0x4e0 [ 1511.298176][T30161] ? __pfx_evdev_write+0x10/0x10 [ 1511.298193][T30161] vfs_write+0x2a3/0xba0 [ 1511.298218][T30161] ? __pfx_vfs_write+0x10/0x10 [ 1511.298238][T30161] ? __fget_files+0x2a/0x420 [ 1511.298256][T30161] ? __fget_files+0x2a/0x420 [ 1511.298271][T30161] ? __fget_files+0x3a6/0x420 [ 1511.298286][T30161] ? __fget_files+0x2a/0x420 [ 1511.298308][T30161] ksys_write+0x156/0x270 [ 1511.298329][T30161] ? __pfx_ksys_write+0x10/0x10 [ 1511.298354][T30161] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1511.298372][T30161] do_syscall_64+0x174/0x580 [ 1511.298391][T30161] ? trace_irq_disable+0x3b/0x140 [ 1511.298411][T30161] ? clear_bhb_loop+0x40/0x90 [ 1511.298431][T30161] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1511.298447][T30161] RIP: 0033:0x7f8e670bce59 [ 1511.298461][T30161] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1511.298476][T30161] RSP: 002b:00007f8e65316028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1511.298492][T30161] RAX: ffffffffffffffda RBX: 00007f8e67335fa0 RCX: 00007f8e670bce59 [ 1511.298504][T30161] RDX: 0000000000002250 RSI: 0000200000000040 RDI: 0000000000000003 [ 1511.298514][T30161] RBP: 00007f8e65316090 R08: 0000000000000000 R09: 0000000000000000 [ 1511.298525][T30161] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1511.298535][T30161] R13: 00007f8e67336038 R14: 00007f8e67335fa0 R15: 00007ffd89d92588 [ 1511.298564][T30161] [ 1511.486493][T28084] usb 4-1: New USB device found, idVendor=13d8, idProduct=0001, bcdDevice= e.22 [ 1511.486552][T28084] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1511.486577][T28084] usb 4-1: Product: syz [ 1511.486611][T28084] usb 4-1: Manufacturer: syz [ 1511.486660][T28084] usb 4-1: SerialNumber: syz [ 1511.511965][T30147] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1511.515010][T30147] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1511.607313][ T5774] cdc_ncm 9-1:1.0: bind() failure [ 1511.627637][ T5774] cdc_ncm 9-1:1.1: CDC Union missing and no IAD found [ 1511.627686][ T5774] cdc_ncm 9-1:1.1: bind() failure [ 1511.646742][T28084] usb 4-1: config 0 descriptor?? [ 1511.651463][ T5774] usb 9-1: USB disconnect, device number 13 [ 1511.741647][T28084] usb 4-1: selecting invalid altsetting 3 [ 1511.741681][T28084] comedi comedi5: could not set alternate setting 3 in high speed [ 1511.741699][T28084] usbdux 4-1:0.0: driver 'usbdux' failed to auto-configure device. [ 1511.760064][T28084] usbdux 4-1:0.0: probe with driver usbdux failed with error -22 [ 1511.857475][ T1009] usb 4-1: USB disconnect, device number 49 [ 1512.052747][ T821] usb 7-1: new high-speed USB device number 68 using dummy_hcd [ 1512.232535][ T821] usb 7-1: Using ep0 maxpacket: 32 [ 1512.238960][ T821] usb 7-1: unable to get BOS descriptor or descriptor too short [ 1512.240391][ T821] usb 7-1: config 14 has an invalid interface number: 52 but max is 0 [ 1512.240418][ T821] usb 7-1: config 14 has no interface number 0 [ 1512.240453][ T821] usb 7-1: config 14 interface 52 has no altsetting 0 [ 1512.280238][ T821] usb 7-1: New USB device found, idVendor=2c7c, idProduct=0122, bcdDevice=a6.69 [ 1512.280270][ T821] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1512.280292][ T821] usb 7-1: Product: syz [ 1512.280308][ T821] usb 7-1: Manufacturer: syz [ 1512.280325][ T821] usb 7-1: SerialNumber: syz [ 1512.410058][T30169] netlink: 16 bytes leftover after parsing attributes in process `syz.7.8153'. [ 1512.531858][ T821] qmi_wwan 7-1:14.52: probe with driver qmi_wwan failed with error -22 [ 1512.551212][ T821] usb 7-1: USB disconnect, device number 68 [ 1512.775077][T30179] pim6reg: entered allmulticast mode [ 1512.776638][T30179] pim6reg: left allmulticast mode [ 1513.344316][T30197] netlink: 28 bytes leftover after parsing attributes in process `syz.7.8159'. [ 1513.928791][T30218] Invalid source name [ 1513.928812][T30218] UBIFS error (pid: 30218): cannot open "/dev/sg0", error -22 [ 1514.172780][T30226] netlink: 72 bytes leftover after parsing attributes in process `syz.8.8167'. [ 1514.221529][T30231] ublk_ctrl_add_dev: dev id not match 4294967295 2 [ 1514.493469][T28084] usb 9-1: new high-speed USB device number 14 using dummy_hcd [ 1514.528634][T30237] Bluetooth: MGMT ver 1.23 [ 1514.642375][T28084] usb 9-1: Using ep0 maxpacket: 16 [ 1514.648362][T28084] usb 9-1: unable to get BOS descriptor or descriptor too short [ 1514.651700][T28084] usb 9-1: config 3 has an invalid interface number: 199 but max is 0 [ 1514.651729][T28084] usb 9-1: config 3 has no interface number 0 [ 1514.651764][T28084] usb 9-1: config 3 interface 199 has no altsetting 0 [ 1514.699005][T28084] usb 9-1: New USB device found, idVendor=07a6, idProduct=0986, bcdDevice=57.9c [ 1514.699040][T28084] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1514.699064][T28084] usb 9-1: Product: syz [ 1514.699081][T28084] usb 9-1: Manufacturer: syz [ 1514.699097][T28084] usb 9-1: SerialNumber: syz [ 1515.066608][T30255] netlink: 8 bytes leftover after parsing attributes in process `syz.7.8175'. [ 1515.066637][T30255] netlink: 8 bytes leftover after parsing attributes in process `syz.7.8175'. [ 1515.243590][T30261] : renamed from bond_slave_0 (while UP) [ 1515.511879][T28084] pegasus 9-1:3.199: Missing or invalid endpoints [ 1515.530281][ T821] usb 4-1: new high-speed USB device number 50 using dummy_hcd [ 1515.552929][T28084] usb 9-1: USB disconnect, device number 14 [ 1515.693650][ T821] usb 4-1: Using ep0 maxpacket: 32 [ 1515.699138][ T821] usb 4-1: config 0 has an invalid interface number: 184 but max is 0 [ 1515.699167][ T821] usb 4-1: config 0 has no interface number 0 [ 1515.699219][ T821] usb 4-1: config 0 interface 184 has no altsetting 0 [ 1515.705474][ T821] usb 4-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 1515.705503][ T821] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1515.705523][ T821] usb 4-1: Product: syz [ 1515.705537][ T821] usb 4-1: Manufacturer: syz [ 1515.705552][ T821] usb 4-1: SerialNumber: syz [ 1515.737974][ T821] usb 4-1: config 0 descriptor?? [ 1516.016363][T30274] FAULT_INJECTION: forcing a failure. [ 1516.016363][T30274] name failslab, interval 1, probability 0, space 0, times 0 [ 1516.016403][T30274] CPU: 1 UID: 0 PID: 30274 Comm: syz.7.8181 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1516.016433][T30274] Tainted: [L]=SOFTLOCKUP [ 1516.016445][T30274] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1516.016459][T30274] Call Trace: [ 1516.016469][T30274] [ 1516.016479][T30274] dump_stack_lvl+0xe8/0x150 [ 1516.016511][T30274] should_fail_ex+0x46b/0x600 [ 1516.016549][T30274] should_failslab+0xa8/0x100 [ 1516.016577][T30274] kmem_cache_alloc_noprof+0xa4/0x6c0 [ 1516.016613][T30274] ? skb_clone+0x212/0x3a0 [ 1516.016641][T30274] ? skb_clone+0x212/0x3a0 [ 1516.016670][T30274] ? rt_read_unlock+0x14f/0x220 [ 1516.016698][T30274] skb_clone+0x212/0x3a0 [ 1516.016725][T30274] ? netlink_broadcast_filtered+0x5e4/0xf10 [ 1516.016757][T30274] netlink_broadcast_filtered+0x5f2/0xf10 [ 1516.016805][T30274] netlink_broadcast+0x37/0x50 [ 1516.016834][T30274] kobject_uevent_net_broadcast+0x37b/0x560 [ 1516.016866][T30274] kobject_uevent_env+0x55f/0x9e0 [ 1516.016899][T30274] device_add+0x557/0xb90 [ 1516.016931][T30274] device_create+0x269/0x300 [ 1516.016964][T30274] ? string+0x279/0x2b0 [ 1516.016985][T30274] ? widen_string+0x3b/0x2a0 [ 1516.017007][T30274] ? string+0x279/0x2b0 [ 1516.017029][T30274] ? __pfx_device_create+0x10/0x10 [ 1516.017079][T30274] bdi_register_va+0x9c/0x7d0 [ 1516.017117][T30274] super_setup_bdi_name+0xf8/0x210 [ 1516.017154][T30274] ? __pfx_super_setup_bdi_name+0x10/0x10 [ 1516.017185][T30274] ? fuse_dax_conn_alloc+0x340/0x9e0 [ 1516.017213][T30274] ? __rt_spin_lock_init+0x3e/0x50 [ 1516.017239][T30274] ? __init_waitqueue_head+0xae/0x160 [ 1516.017270][T30274] fuse_fill_super_common+0x64a/0x1120 [ 1516.017313][T30274] ? __pfx_fuse_fill_super_common+0x10/0x10 [ 1516.017347][T30274] ? __pfx_set_anon_super_fc+0x10/0x10 [ 1516.017379][T30274] ? __pfx_sget_fc+0x10/0x10 [ 1516.017415][T30274] fuse_fill_super+0x98/0x120 [ 1516.017448][T30274] ? __pfx_fuse_fill_super+0x10/0x10 [ 1516.017484][T30274] get_tree_nodev+0xbb/0x150 [ 1516.017515][T30274] fuse_get_tree+0x2a0/0x3a0 [ 1516.017551][T30274] vfs_get_tree+0x92/0x2a0 [ 1516.017583][T30274] do_new_mount+0x341/0xd30 [ 1516.017604][T30274] ? apparmor_capable+0x126/0x170 [ 1516.017639][T30274] ? __pfx_do_new_mount+0x10/0x10 [ 1516.017663][T30274] ? ns_capable+0x89/0xe0 [ 1516.017699][T30274] ? path_mount+0x690/0x10e0 [ 1516.017721][T30274] ? user_path_at+0xd4/0x160 [ 1516.017752][T30274] ? user_path_at+0xd4/0x160 [ 1516.017799][T30274] __se_sys_mount+0x31d/0x420 [ 1516.017830][T30274] ? __pfx___se_sys_mount+0x10/0x10 [ 1516.017862][T30274] ? __x64_sys_mount+0x20/0xc0 [ 1516.017886][T30274] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1516.017914][T30274] do_syscall_64+0x174/0x580 [ 1516.017943][T30274] ? trace_irq_disable+0x3b/0x140 [ 1516.017972][T30274] ? clear_bhb_loop+0x40/0x90 [ 1516.018002][T30274] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1516.018027][T30274] RIP: 0033:0x7f276520ce59 [ 1516.018048][T30274] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1516.018069][T30274] RSP: 002b:00007f276345e028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 1516.018103][T30274] RAX: ffffffffffffffda RBX: 00007f2765485fa0 RCX: 00007f276520ce59 [ 1516.018121][T30274] RDX: 0000200000002100 RSI: 00002000000020c0 RDI: 0000000000000000 [ 1516.018137][T30274] RBP: 00007f276345e090 R08: 0000200000002140 R09: 0000000000000000 [ 1516.018153][T30274] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1516.018167][T30274] R13: 00007f2765486038 R14: 00007f2765485fa0 R15: 00007ffd7efe45e8 [ 1516.018204][T30274] [ 1516.414599][ T821] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -61 [ 1516.414635][ T821] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 1516.465062][T30277] FAULT_INJECTION: forcing a failure. [ 1516.465062][T30277] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1516.465100][T30277] CPU: 0 UID: 0 PID: 30277 Comm: syz.6.8182 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1516.465129][T30277] Tainted: [L]=SOFTLOCKUP [ 1516.465137][T30277] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1516.465151][T30277] Call Trace: [ 1516.465160][T30277] [ 1516.465170][T30277] dump_stack_lvl+0xe8/0x150 [ 1516.465202][T30277] should_fail_ex+0x46b/0x600 [ 1516.465237][T30277] _copy_to_user+0x31/0xb0 [ 1516.465262][T30277] rng_dev_read+0x3ed/0x7c0 [ 1516.465315][T30277] ? __pfx_rng_dev_read+0x10/0x10 [ 1516.465356][T30277] ? rw_verify_area+0x2ac/0x4e0 [ 1516.465384][T30277] ? __pfx_rng_dev_read+0x10/0x10 [ 1516.465417][T30277] vfs_read+0x212/0xa80 [ 1516.465452][T30277] ? __pfx_vfs_read+0x10/0x10 [ 1516.465481][T30277] ? __fget_files+0x2a/0x420 [ 1516.465507][T30277] ? __fget_files+0x2a/0x420 [ 1516.465530][T30277] ? __fget_files+0x3a6/0x420 [ 1516.465553][T30277] ? __fget_files+0x2a/0x420 [ 1516.465593][T30277] ksys_read+0x156/0x270 [ 1516.465623][T30277] ? __pfx_ksys_read+0x10/0x10 [ 1516.465659][T30277] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1516.465685][T30277] do_syscall_64+0x174/0x580 [ 1516.465714][T30277] ? trace_irq_disable+0x3b/0x140 [ 1516.465741][T30277] ? clear_bhb_loop+0x40/0x90 [ 1516.465772][T30277] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1516.465795][T30277] RIP: 0033:0x7f8e670bce59 [ 1516.465817][T30277] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1516.465838][T30277] RSP: 002b:00007f8e65316028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1516.465863][T30277] RAX: ffffffffffffffda RBX: 00007f8e67335fa0 RCX: 00007f8e670bce59 [ 1516.465881][T30277] RDX: 00000000fffffce2 RSI: 0000200000006540 RDI: 0000000000000003 [ 1516.465897][T30277] RBP: 00007f8e65316090 R08: 0000000000000000 R09: 0000000000000000 [ 1516.465912][T30277] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1516.465926][T30277] R13: 00007f8e67336038 R14: 00007f8e67335fa0 R15: 00007ffd89d92588 [ 1516.465961][T30277] [ 1516.803329][T30280] sg_write: data in/out 443356/178 bytes for SCSI command 0x0-- guessing data in; [ 1516.803329][T30280] program syz.8.8183 not setting count and/or reply_len properly [ 1516.809940][ T821] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 1516.809985][ T821] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -71 [ 1516.810007][ T821] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_reset [ 1516.810030][ T821] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -71 [ 1516.810338][ T821] smsc75xx 4-1:0.184: probe with driver smsc75xx failed with error -71 [ 1516.863413][T30280] FAULT_INJECTION: forcing a failure. [ 1516.863413][T30280] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1516.863737][T30280] CPU: 0 UID: 0 PID: 30280 Comm: syz.8.8183 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1516.863843][T30280] Tainted: [L]=SOFTLOCKUP [ 1516.863864][T30280] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1516.863904][T30280] Call Trace: [ 1516.863927][T30280] [ 1516.863955][T30280] dump_stack_lvl+0xe8/0x150 [ 1516.864062][T30280] should_fail_ex+0x46b/0x600 [ 1516.864160][T30280] _copy_from_iter+0x1d3/0x1670 [ 1516.864282][T30280] ? pfn_valid+0x125/0x4c0 [ 1516.864335][T30280] ? pfn_valid+0x440/0x4c0 [ 1516.864413][T30280] ? __pfx__copy_from_iter+0x10/0x10 [ 1516.864485][T30280] ? bvec_try_merge_page+0x1d4/0x280 [ 1516.864566][T30280] ? bio_add_page+0x2e9/0x6f0 [ 1516.864651][T30280] copy_page_from_iter+0x220/0x2d0 [ 1516.864790][T30280] blk_rq_map_user_iov+0xa14/0x1790 [ 1516.864912][T30280] ? __pfx_blk_rq_map_user_iov+0x10/0x10 [ 1516.865041][T30280] ? import_ubuf+0xfb/0x1d0 [ 1516.865099][T30280] blk_rq_map_user_io+0x2ae/0x440 [ 1516.865192][T30280] ? __pfx_blk_rq_map_user_io+0x10/0x10 [ 1516.865290][T30280] ? do_raw_spin_lock+0x12b/0x2f0 [ 1516.865381][T30280] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1516.865496][T30280] ? lockdep_hardirqs_on+0x7a/0x110 [ 1516.865567][T30280] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1516.865638][T30280] ? rt_mutex_slowunlock+0x1cb/0x300 [ 1516.865697][T30280] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 1516.865798][T30280] sg_common_write+0xcff/0x13e0 [ 1516.865905][T30280] ? __pfx_sg_common_write+0x10/0x10 [ 1516.865974][T30280] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1516.866049][T30280] ? ___ratelimit+0x58c/0x8d0 [ 1516.866109][T30280] sg_write+0xafb/0xf00 [ 1516.866188][T30280] ? __pfx_sg_write+0x10/0x10 [ 1516.866243][T30280] ? __pfx_aa_file_perm+0x10/0x10 [ 1516.866394][T30280] ? rw_verify_area+0x25b/0x4e0 [ 1516.866465][T30280] ? __pfx_sg_write+0x10/0x10 [ 1516.866537][T30280] vfs_write+0x2a3/0xba0 [ 1516.866629][T30280] ? __pfx_vfs_write+0x10/0x10 [ 1516.866724][T30280] ? __fget_files+0x2a/0x420 [ 1516.866761][T30280] ? __fget_files+0x2a/0x420 [ 1516.866813][T30280] ? __fget_files+0x3a6/0x420 [ 1516.866871][T30280] ? __fget_files+0x2a/0x420 [ 1516.866953][T30280] ksys_write+0x156/0x270 [ 1516.867034][T30280] ? __pfx_ksys_write+0x10/0x10 [ 1516.867123][T30280] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1516.867191][T30280] do_syscall_64+0x174/0x580 [ 1516.867261][T30280] ? trace_irq_disable+0x3b/0x140 [ 1516.867331][T30280] ? clear_bhb_loop+0x40/0x90 [ 1516.867431][T30280] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1516.867491][T30280] RIP: 0033:0x7ff11b3dce59 [ 1516.867554][T30280] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1516.867624][T30280] RSP: 002b:00007ff11962e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1516.867655][T30280] RAX: ffffffffffffffda RBX: 00007ff11b655fa0 RCX: 00007ff11b3dce59 [ 1516.867704][T30280] RDX: 00000000000000dc RSI: 0000200000000240 RDI: 0000000000000004 [ 1516.867743][T30280] RBP: 00007ff11962e090 R08: 0000000000000000 R09: 0000000000000000 [ 1516.867783][T30280] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1516.867857][T30280] R13: 00007ff11b656038 R14: 00007ff11b655fa0 R15: 00007ffd4e6eae98 [ 1516.867939][T30280] [ 1517.080100][ T821] usb 4-1: USB disconnect, device number 50 [ 1517.917475][T30307] openvswitch: netlink: Message has 8 unknown bytes. [ 1518.731930][T30320] FAULT_INJECTION: forcing a failure. [ 1518.731930][T30320] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1518.731968][T30320] CPU: 0 UID: 0 PID: 30320 Comm: syz.8.8196 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1518.731998][T30320] Tainted: [L]=SOFTLOCKUP [ 1518.732007][T30320] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1518.732031][T30320] Call Trace: [ 1518.732039][T30320] [ 1518.732048][T30320] dump_stack_lvl+0xe8/0x150 [ 1518.732079][T30320] should_fail_ex+0x46b/0x600 [ 1518.732112][T30320] prepare_alloc_pages+0x22a/0x6b0 [ 1518.732142][T30320] __alloc_frozen_pages_noprof+0x12f/0x380 [ 1518.732171][T30320] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 1518.732198][T30320] ? __pfx_policy_nodemask+0x10/0x10 [ 1518.732221][T30320] ? filemap_get_entry+0x378/0x3f0 [ 1518.732241][T30320] ? lockdep_hardirqs_on+0x7a/0x110 [ 1518.732268][T30320] ? __pfx_filemap_get_entry+0x10/0x10 [ 1518.732287][T30320] ? rt_mutex_slowunlock+0x4a7/0x8b0 [ 1518.732310][T30320] alloc_pages_mpol+0xd1/0x380 [ 1518.732338][T30320] folio_alloc_mpol_noprof+0x3b/0x1e0 [ 1518.732365][T30320] shmem_get_folio_gfp+0x647/0x1ad0 [ 1518.732417][T30320] ? __pfx_shmem_get_folio_gfp+0x10/0x10 [ 1518.732446][T30320] ? filemap_map_pages+0x1de/0x1c70 [ 1518.732478][T30320] shmem_fault+0x170/0x380 [ 1518.732501][T30320] ? do_pte_missing+0x12b5/0x2940 [ 1518.732525][T30320] __do_fault+0x138/0x2a0 [ 1518.732547][T30320] ? do_pte_missing+0x12b5/0x2940 [ 1518.732571][T30320] do_pte_missing+0x179c/0x2940 [ 1518.732601][T30320] ? handle_mm_fault+0xed/0x14d0 [ 1518.732625][T30320] handle_mm_fault+0xdc2/0x14d0 [ 1518.732649][T30320] ? handle_mm_fault+0xed/0x14d0 [ 1518.732672][T30320] ? __pfx_handle_mm_fault+0x10/0x10 [ 1518.732727][T30320] ? lock_mm_and_find_vma+0xa7/0x340 [ 1518.732756][T30320] do_user_addr_fault+0x75b/0x1340 [ 1518.732815][T30320] exc_page_fault+0x6a/0xc0 [ 1518.732860][T30320] asm_exc_page_fault+0x26/0x30 [ 1518.732900][T30320] RIP: 0010:rep_movs_alternative+0x4a/0xa0 [ 1518.732925][T30320] Code: cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 db 83 f9 08 73 e8 eb c5 a4 c3 cc cc cc cc 48 8b 06 48 89 07 48 8d 47 08 48 83 e0 f8 48 [ 1518.732946][T30320] RSP: 0018:ffffc9000c1a7640 EFLAGS: 00050206 [ 1518.732967][T30320] RAX: 00007ffffffff001 RBX: 0000000000001000 RCX: 0000000000001000 [ 1518.732984][T30320] RDX: 0000000000000001 RSI: 00002000001ba000 RDI: ffff88814c421000 [ 1518.733001][T30320] RBP: 0000000000000001 R08: ffff88814c421fff R09: 1ffff110298843ff [ 1518.733018][T30320] R10: dffffc0000000000 R11: ffffed1029884400 R12: 00000000000001de [ 1518.733035][T30320] R13: ffff88814c421000 R14: ffff88814c421000 R15: 00002000001ba000 [ 1518.733071][T30320] _copy_from_user+0x7a/0xb0 [ 1518.733099][T30320] copy_folio_from_user+0x1e3/0x320 [ 1518.733131][T30320] mfill_atomic_copy+0xf37/0x15b0 [ 1518.733190][T30320] ? __pfx_mfill_atomic_copy+0x10/0x10 [ 1518.733233][T30320] userfaultfd_ioctl+0x257a/0x86c0 [ 1518.733275][T30320] ? stack_depot_save_flags+0x33/0x810 [ 1518.733314][T30320] ? kasan_save_track+0x4f/0x80 [ 1518.733335][T30320] ? kasan_save_track+0x3e/0x80 [ 1518.733356][T30320] ? kasan_save_free_info+0x46/0x50 [ 1518.733386][T30320] ? __kasan_slab_free+0x5c/0x80 [ 1518.733408][T30320] ? kfree+0x1c5/0x6c0 [ 1518.733441][T30320] ? tomoyo_path_number_perm+0x501/0x630 [ 1518.733475][T30320] ? security_file_ioctl+0xc3/0x2a0 [ 1518.733507][T30320] ? __se_sys_ioctl+0x47/0x170 [ 1518.733535][T30320] ? do_syscall_64+0x174/0x580 [ 1518.733564][T30320] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1518.733590][T30320] ? __pfx_userfaultfd_ioctl+0x10/0x10 [ 1518.733662][T30320] ? kasan_quarantine_put+0xbb/0x1f0 [ 1518.733708][T30320] ? tomoyo_path_number_perm+0x219/0x630 [ 1518.733752][T30320] ? do_vfs_ioctl+0x117b/0x1540 [ 1518.733785][T30320] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 1518.733863][T30320] ? __fget_files+0x2a/0x420 [ 1518.733890][T30320] ? __fget_files+0x2a/0x420 [ 1518.733913][T30320] ? __fget_files+0x3a6/0x420 [ 1518.733935][T30320] ? __fget_files+0x2a/0x420 [ 1518.733963][T30320] ? bpf_lsm_file_ioctl+0x9/0x20 [ 1518.734002][T30320] ? __pfx_userfaultfd_ioctl+0x10/0x10 [ 1518.734032][T30320] __se_sys_ioctl+0xff/0x170 [ 1518.734071][T30320] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1518.734094][T30320] do_syscall_64+0x174/0x580 [ 1518.734129][T30320] ? trace_irq_disable+0x3b/0x140 [ 1518.734153][T30320] ? clear_bhb_loop+0x40/0x90 [ 1518.734178][T30320] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1518.734198][T30320] RIP: 0033:0x7ff11b3dce59 [ 1518.734215][T30320] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1518.734232][T30320] RSP: 002b:00007ff11962e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1518.734252][T30320] RAX: ffffffffffffffda RBX: 00007ff11b655fa0 RCX: 00007ff11b3dce59 [ 1518.734267][T30320] RDX: 0000200000000000 RSI: 00000000c028aa03 RDI: 0000000000000003 [ 1518.734280][T30320] RBP: 00007ff11962e090 R08: 0000000000000000 R09: 0000000000000000 [ 1518.734299][T30320] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1518.734311][T30320] R13: 00007ff11b656038 R14: 00007ff11b655fa0 R15: 00007ffd4e6eae98 [ 1518.734342][T30320] [ 1520.141508][ T5721] usb 9-1: new high-speed USB device number 15 using dummy_hcd [ 1520.291623][ T5721] usb 9-1: Using ep0 maxpacket: 8 [ 1520.313523][ T5721] usb 9-1: unable to get BOS descriptor or descriptor too short [ 1520.315303][ T5721] usb 9-1: config index 0 descriptor too short (expected 2656, got 96) [ 1520.315332][ T5721] usb 9-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 1520.315354][ T5721] usb 9-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 1520.315376][ T5721] usb 9-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 1520.315400][ T5721] usb 9-1: config 1 has no interface number 1 [ 1520.404211][ T5721] usb 9-1: string descriptor 0 read error: -22 [ 1520.404262][ T5721] usb 9-1: New USB device found, idVendor=0ccd, idProduct=00b1, bcdDevice= 0.40 [ 1520.404286][ T5721] usb 9-1: New USB device strings: Mfr=1, Product=0, SerialNumber=0 [ 1520.672476][ T5721] snd-usb-audio 9-1:1.0: probe with driver snd-usb-audio failed with error -71 [ 1520.703788][ T5721] usb 9-1: USB disconnect, device number 15 [ 1521.372974][ T5721] usb 4-1: new high-speed USB device number 51 using dummy_hcd [ 1521.524243][ T5721] usb 4-1: config 0 interface 0 has no altsetting 0 [ 1521.524290][ T5721] usb 4-1: New USB device found, idVendor=046d, idProduct=0a0e, bcdDevice=94.75 [ 1521.524317][ T5721] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1521.530154][ T5721] usb 4-1: config 0 descriptor?? [ 1522.280787][T30373] IPVS: sync thread started: state = MASTER, mcast_ifn = veth0_to_team, syncid = 3, id = 0 [ 1522.366764][ T5721] video4linux radio48: keene_cmd_main failed (-71) [ 1522.366794][ T5721] radio-keene 4-1:0.0: V4L2 device registered as radio48 [ 1522.564070][ T1009] usb 7-1: new high-speed USB device number 69 using dummy_hcd [ 1522.624203][ T5721] usb 4-1: USB disconnect, device number 51 [ 1522.908146][ T1009] usb 7-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 1522.908182][ T1009] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1522.950358][ T1009] usb 7-1: config 0 descriptor?? [ 1523.025100][ T1009] cp210x 7-1:0.0: cp210x converter detected [ 1523.320506][T30387] netlink: 4548 bytes leftover after parsing attributes in process `syz.3.8222'. [ 1523.455984][T30391] IPVS: set_ctl: invalid protocol: 60 172.20.20.21:20002 [ 1523.481407][ T1009] cp210x 7-1:0.0: failed to get vendor val 0x000e size 3: -71 [ 1523.481896][ T1009] cp210x 7-1:0.0: failed to get vendor val 0x3711 size 2: -71 [ 1523.481921][ T1009] cp210x 7-1:0.0: GPIO initialisation failed: -71 [ 1523.564021][ T1009] usb 7-1: cp210x converter now attached to ttyUSB0 [ 1523.582430][ T1009] usb 7-1: USB disconnect, device number 69 [ 1523.655021][ T1009] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 1523.655542][ T1009] cp210x 7-1:0.0: device disconnected [ 1523.804533][T30398] vhci_hcd vhci_hcd.0: pdev(7) rhport(0) sockfd(3) [ 1523.804561][T30398] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 1523.804681][T30398] vhci_hcd vhci_hcd.0: Device attached [ 1523.981171][T28084] vhci_hcd vhci_hcd.7: vhci_device speed not set [ 1524.041119][T28084] usb 47-1: new full-speed USB device number 2 using vhci_hcd [ 1524.185788][T30409] Bluetooth: MGMT ver 1.23 [ 1524.470719][T30424] netlink: 56 bytes leftover after parsing attributes in process `syz.8.8234'. [ 1524.861096][ T32] usb 9-1: new high-speed USB device number 16 using dummy_hcd [ 1525.027847][ T32] usb 9-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 1525.027891][ T32] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1525.027915][ T32] usb 9-1: Product: syz [ 1525.027932][ T32] usb 9-1: Manufacturer: syz [ 1525.027949][ T32] usb 9-1: SerialNumber: syz [ 1525.067067][ T32] usb 9-1: config 0 descriptor?? [ 1525.273658][ T32] usb 9-1: Firmware version (0.0) predates our first public release. [ 1525.273687][ T32] usb 9-1: Please update to version 0.2 or newer [ 1525.344701][ T32] usb 9-1: USB disconnect, device number 16 [ 1525.788412][ T5720] usb 7-1: new high-speed USB device number 70 using dummy_hcd [ 1525.983867][ T5720] usb 7-1: Using ep0 maxpacket: 8 [ 1525.985751][ T5720] usb 7-1: config 0 interface 0 altsetting 32 endpoint 0x81 has invalid maxpacket 2047, setting to 1024 [ 1525.985789][ T5720] usb 7-1: config 0 interface 0 altsetting 32 endpoint 0x2 has an invalid bInterval 107, changing to 10 [ 1525.985821][ T5720] usb 7-1: config 0 interface 0 altsetting 32 has 2 endpoint descriptors, different from the interface descriptor's value: 9 [ 1525.985853][ T5720] usb 7-1: config 0 interface 0 has no altsetting 0 [ 1525.985906][ T5720] usb 7-1: New USB device found, idVendor=056a, idProduct=00db, bcdDevice= 0.00 [ 1525.985924][ T5720] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1525.995925][ T5720] usb 7-1: config 0 descriptor?? [ 1525.999862][T30438] raw-gadget.1 gadget.6: fail, usb_ep_enable returned -22 [ 1526.230526][T30448] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8245'. [ 1526.380673][ T32] usb 9-1: new high-speed USB device number 17 using dummy_hcd [ 1526.530797][ T32] usb 9-1: Using ep0 maxpacket: 32 [ 1526.534041][ T32] usb 9-1: unable to get BOS descriptor or descriptor too short [ 1526.535558][ T32] usb 9-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 127, changing to 7 [ 1526.563602][ T32] usb 9-1: New USB device found, idVendor=041e, idProduct=3020, bcdDevice= 0.40 [ 1526.563635][ T32] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1526.563658][ T32] usb 9-1: Product: syz [ 1526.563674][ T32] usb 9-1: Manufacturer: syz [ 1526.563691][ T32] usb 9-1: SerialNumber: syz [ 1526.848986][ T32] usb 9-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 1526.863236][ T32] usb 9-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 1526.897111][T30400] vhci_hcd: connection reset by peer [ 1526.900276][ T6247] vhci_hcd vhci_hcd.7: stop threads [ 1526.900303][ T6247] vhci_hcd vhci_hcd.7: release socket [ 1526.908277][ T6247] vhci_hcd vhci_hcd.7: disconnect device [ 1526.941524][ T5720] usbhid 7-1:0.0: can't add hid device: -71 [ 1526.941633][ T5720] usbhid 7-1:0.0: probe with driver usbhid failed with error -71 [ 1527.014770][ T5720] usb 7-1: USB disconnect, device number 70 [ 1527.110991][ T32] usb 9-1: USB disconnect, device number 17 [ 1527.633914][T30466] netlink: 104 bytes leftover after parsing attributes in process `syz.6.8251'. [ 1527.754295][T30469] netlink: 168 bytes leftover after parsing attributes in process `syz.7.8252'. [ 1527.967689][T30476] FAULT_INJECTION: forcing a failure. [ 1527.967689][T30476] name failslab, interval 1, probability 0, space 0, times 0 [ 1527.967729][T30476] CPU: 1 UID: 0 PID: 30476 Comm: syz.3.8257 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1527.967760][T30476] Tainted: [L]=SOFTLOCKUP [ 1527.967770][T30476] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1527.967784][T30476] Call Trace: [ 1527.967794][T30476] [ 1527.967804][T30476] dump_stack_lvl+0xe8/0x150 [ 1527.967837][T30476] should_fail_ex+0x46b/0x600 [ 1527.967874][T30476] should_failslab+0xa8/0x100 [ 1527.967902][T30476] __kmalloc_noprof+0xfe/0x7e0 [ 1527.967925][T30476] ? rcu_is_watching+0x15/0xb0 [ 1527.967958][T30476] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 1527.967984][T30476] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 1527.968018][T30476] tomoyo_realpath_from_path+0xe3/0x5d0 [ 1527.968048][T30476] ? tomoyo_domain+0xd7/0x130 [ 1527.968081][T30476] ? tomoyo_path_number_perm+0x219/0x630 [ 1527.968117][T30476] tomoyo_path_number_perm+0x246/0x630 [ 1527.968156][T30476] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1527.968191][T30476] ? __lock_acquire+0x6b5/0x2d10 [ 1527.968223][T30476] ? do_raw_spin_lock+0x12b/0x2f0 [ 1527.968281][T30476] ? __fget_files+0x2a/0x420 [ 1527.968308][T30476] ? __fget_files+0x2a/0x420 [ 1527.968331][T30476] ? __fget_files+0x3a6/0x420 [ 1527.968353][T30476] ? __fget_files+0x2a/0x420 [ 1527.968389][T30476] security_file_ioctl+0xc3/0x2a0 [ 1527.968425][T30476] __se_sys_ioctl+0x47/0x170 [ 1527.968456][T30476] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1527.968485][T30476] do_syscall_64+0x174/0x580 [ 1527.968515][T30476] ? trace_irq_disable+0x3b/0x140 [ 1527.968545][T30476] ? clear_bhb_loop+0x40/0x90 [ 1527.968574][T30476] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1527.968598][T30476] RIP: 0033:0x7fc3f95cce59 [ 1527.968620][T30476] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1527.968641][T30476] RSP: 002b:00007fc3f7826028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1527.968666][T30476] RAX: ffffffffffffffda RBX: 00007fc3f9845fa0 RCX: 00007fc3f95cce59 [ 1527.968684][T30476] RDX: 0000200000001580 RSI: 00000000c014563b RDI: 0000000000000003 [ 1527.968700][T30476] RBP: 00007fc3f7826090 R08: 0000000000000000 R09: 0000000000000000 [ 1527.968716][T30476] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1527.968730][T30476] R13: 00007fc3f9846038 R14: 00007fc3f9845fa0 R15: 00007ffcf22138c8 [ 1527.968766][T30476] [ 1527.968920][T30476] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1528.532259][T30480] vxcan1: tx address claim with dlc 0 [ 1528.830525][ T32] usb 4-1: new high-speed USB device number 52 using dummy_hcd [ 1528.960481][ T32] usb 4-1: device descriptor read/64, error -71 [ 1529.054243][T30500] netlink: 60 bytes leftover after parsing attributes in process `syz.8.8264'. [ 1529.204100][T28084] vhci_hcd vhci_hcd.7: vhci_device speed not set [ 1529.220547][ T32] usb 4-1: new high-speed USB device number 53 using dummy_hcd [ 1529.255045][T30507] netlink: 4 bytes leftover after parsing attributes in process `syz.6.8267'. [ 1529.360483][ T32] usb 4-1: device descriptor read/64, error -71 [ 1529.470772][ T32] usb usb4-port1: attempt power cycle [ 1529.840449][ T32] usb 4-1: new high-speed USB device number 54 using dummy_hcd [ 1529.874405][ T32] usb 4-1: device descriptor read/8, error -71 [ 1530.081799][T30514] netlink: 20 bytes leftover after parsing attributes in process `syz.8.8270'. [ 1530.133585][T30516] netlink: 72 bytes leftover after parsing attributes in process `syz.6.8269'. [ 1530.152370][ T32] usb 4-1: new high-speed USB device number 55 using dummy_hcd [ 1530.171146][ T32] usb 4-1: device descriptor read/8, error -71 [ 1530.237948][T30519] ublk_ctrl_add_dev: dev id not match 4294967295 2 [ 1530.280802][ T32] usb usb4-port1: unable to enumerate USB device [ 1530.494376][T28084] usb 7-1: new high-speed USB device number 71 using dummy_hcd [ 1530.640338][T28084] usb 7-1: Using ep0 maxpacket: 16 [ 1530.644899][T28084] usb 7-1: unable to get BOS descriptor or descriptor too short [ 1530.683509][T28084] usb 7-1: config 3 has an invalid interface number: 199 but max is 0 [ 1530.683532][T28084] usb 7-1: config 3 has no interface number 0 [ 1530.683556][T28084] usb 7-1: config 3 interface 199 has no altsetting 0 [ 1530.689528][T28084] usb 7-1: New USB device found, idVendor=07a6, idProduct=0986, bcdDevice=57.9c [ 1530.689560][T28084] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1530.689588][T28084] usb 7-1: Product: syz [ 1530.689600][T28084] usb 7-1: Manufacturer: syz [ 1530.689611][T28084] usb 7-1: SerialNumber: syz [ 1530.862797][ T5720] usb 9-1: new high-speed USB device number 18 using dummy_hcd [ 1531.012265][ T5720] usb 9-1: Using ep0 maxpacket: 8 [ 1531.017357][ T5720] usb 9-1: New USB device found, idVendor=07ca, idProduct=a868, bcdDevice=c4.d4 [ 1531.017451][ T5720] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1531.048255][T30527] FAULT_INJECTION: forcing a failure. [ 1531.048255][T30527] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1531.048295][T30527] CPU: 1 UID: 0 PID: 30527 Comm: syz.7.8274 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1531.048328][T30527] Tainted: [L]=SOFTLOCKUP [ 1531.048336][T30527] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1531.048351][T30527] Call Trace: [ 1531.048360][T30527] [ 1531.048370][T30527] dump_stack_lvl+0xe8/0x150 [ 1531.048403][T30527] should_fail_ex+0x46b/0x600 [ 1531.048442][T30527] _copy_from_user+0x2d/0xb0 [ 1531.048469][T30527] kvm_arch_vm_ioctl+0xa6b/0x1a20 [ 1531.048502][T30527] ? __pfx_kvm_arch_vm_ioctl+0x10/0x10 [ 1531.048530][T30527] ? __lock_acquire+0x6b5/0x2d10 [ 1531.048561][T30527] ? __lock_acquire+0x6b5/0x2d10 [ 1531.048613][T30527] ? unwind_next_frame+0xa6/0x2550 [ 1531.048653][T30527] ? unwind_next_frame+0xa6/0x2550 [ 1531.048699][T30527] ? is_bpf_text_address+0x26/0x2b0 [ 1531.048743][T30527] ? is_bpf_text_address+0x292/0x2b0 [ 1531.048794][T30527] ? is_bpf_text_address+0x26/0x2b0 [ 1531.048831][T30527] ? kernel_text_address+0xa5/0xe0 [ 1531.048863][T30527] ? __kernel_text_address+0xd/0x30 [ 1531.048894][T30527] ? unwind_get_return_address+0x4d/0x90 [ 1531.048926][T30527] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 1531.048956][T30527] ? arch_stack_walk+0xfb/0x150 [ 1531.049002][T30527] ? stack_trace_save+0xa9/0x100 [ 1531.049030][T30527] ? __pfx_stack_trace_save+0x10/0x10 [ 1531.049056][T30527] ? kasan_save_free_info+0x46/0x50 [ 1531.049091][T30527] ? stack_depot_save_flags+0x33/0x810 [ 1531.049136][T30527] ? kasan_save_track+0x4f/0x80 [ 1531.049164][T30527] ? kasan_save_track+0x3e/0x80 [ 1531.049185][T30527] ? kasan_save_free_info+0x46/0x50 [ 1531.049215][T30527] ? __kasan_slab_free+0x5c/0x80 [ 1531.049237][T30527] ? kfree+0x1c5/0x6c0 [ 1531.049269][T30527] ? tomoyo_path_number_perm+0x501/0x630 [ 1531.049304][T30527] ? security_file_ioctl+0xc3/0x2a0 [ 1531.049336][T30527] ? __se_sys_ioctl+0x47/0x170 [ 1531.049366][T30527] ? do_syscall_64+0x174/0x580 [ 1531.049394][T30527] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1531.049435][T30527] kvm_vm_ioctl+0x908/0xd50 [ 1531.049470][T30527] ? __pfx_kvm_vm_ioctl+0x10/0x10 [ 1531.049518][T30527] ? kasan_quarantine_put+0xbb/0x1f0 [ 1531.049565][T30527] ? tomoyo_path_number_perm+0x219/0x630 [ 1531.049602][T30527] ? tomoyo_path_number_perm+0x219/0x630 [ 1531.049643][T30527] ? do_vfs_ioctl+0x117b/0x1540 [ 1531.049676][T30527] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 1531.049743][T30527] ? __fget_files+0x2a/0x420 [ 1531.049771][T30527] ? __fget_files+0x2a/0x420 [ 1531.049795][T30527] ? __fget_files+0x3a6/0x420 [ 1531.049818][T30527] ? __fget_files+0x2a/0x420 [ 1531.049845][T30527] ? bpf_lsm_file_ioctl+0x9/0x20 [ 1531.049873][T30527] ? __pfx_kvm_vm_ioctl+0x10/0x10 [ 1531.049902][T30527] __se_sys_ioctl+0xff/0x170 [ 1531.049934][T30527] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1531.049972][T30527] do_syscall_64+0x174/0x580 [ 1531.049999][T30527] ? trace_irq_disable+0x3b/0x140 [ 1531.050025][T30527] ? clear_bhb_loop+0x40/0x90 [ 1531.050052][T30527] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1531.050076][T30527] RIP: 0033:0x7f276520ce59 [ 1531.050097][T30527] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1531.050116][T30527] RSP: 002b:00007f276345e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1531.050139][T30527] RAX: ffffffffffffffda RBX: 00007f2765485fa0 RCX: 00007f276520ce59 [ 1531.050164][T30527] RDX: 0000200000000080 RSI: 00000000c048aec8 RDI: 0000000000000004 [ 1531.050180][T30527] RBP: 00007f276345e090 R08: 0000000000000000 R09: 0000000000000000 [ 1531.050195][T30527] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1531.050209][T30527] R13: 00007f2765486038 R14: 00007f2765485fa0 R15: 00007ffd7efe45e8 [ 1531.050244][T30527] [ 1531.066490][ T5720] usb 9-1: config 0 descriptor?? [ 1531.097250][ T5720] dvb-usb: found a 'AVerMedia AVerTVHD Volar (A868R)' in warm state. [ 1531.281611][ T5720] cxusb: set interface failed [ 1531.286572][ T5720] dvb-usb: bulk message failed: -22 (1/0) [ 1531.809720][ T5720] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1531.817394][ T5720] dvbdev: DVB: registering new adapter (AVerMedia AVerTVHD Volar (A868R)) [ 1531.818463][ T5720] usb 9-1: media controller created [ 1532.336190][ T5720] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1532.524746][T28084] pegasus 7-1:3.199: Missing or invalid endpoints [ 1532.556679][T28084] usb 7-1: USB disconnect, device number 71 [ 1532.628827][ T5720] DVB: Unable to find symbol lgdt330x_attach() [ 1532.628841][ T5720] dvb-usb: no frontend was attached by 'AVerMedia AVerTVHD Volar (A868R)' [ 1532.634823][ T5720] dvb-usb: bulk message failed: -22 (1/0) [ 1532.634889][ T5720] dvb-usb: AVerMedia AVerTVHD Volar (A868R) successfully initialized and connected. [ 1532.674243][ T5720] usb 9-1: USB disconnect, device number 18 [ 1532.759566][ T5720] dvb-usb: AVerMedia AVerTVHD Volar (A868R) successfully deinitialized and disconnected. [ 1533.065015][T30545] binder_alloc: 30543: binder_alloc_buf size 16384 failed, no address space [ 1533.065041][T30545] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 1533.070211][ T5720] usb 9-1: new low-speed USB device number 19 using dummy_hcd [ 1533.252075][ T5720] usb 9-1: config 168 descriptor has 1 excess byte, ignoring [ 1533.258046][ T5720] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 1533.258080][ T5720] usb 9-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1533.258107][ T5720] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 1533.258135][ T5720] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 1533.259303][ T5720] usb 9-1: config 168 descriptor has 1 excess byte, ignoring [ 1533.259366][ T5720] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 1533.259398][ T5720] usb 9-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1533.259428][ T5720] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 1533.259474][ T5720] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 1533.261581][ T5720] usb 9-1: config 168 descriptor has 1 excess byte, ignoring [ 1533.261633][ T5720] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 1533.261664][ T5720] usb 9-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1533.261692][ T5720] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 1533.261722][ T5720] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 1533.299193][ T5720] usb 9-1: string descriptor 0 read error: -22 [ 1533.299598][ T5720] usb 9-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 1533.299670][ T5720] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1533.356218][T30554] FAULT_INJECTION: forcing a failure. [ 1533.356218][T30554] name failslab, interval 1, probability 0, space 0, times 0 [ 1533.356306][T30554] CPU: 0 UID: 0 PID: 30554 Comm: syz.6.8283 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1533.356381][T30554] Tainted: [L]=SOFTLOCKUP [ 1533.356402][T30554] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1533.356439][T30554] Call Trace: [ 1533.356459][T30554] [ 1533.356485][T30554] dump_stack_lvl+0xe8/0x150 [ 1533.356583][T30554] should_fail_ex+0x46b/0x600 [ 1533.356683][T30554] should_failslab+0xa8/0x100 [ 1533.356755][T30554] kmem_cache_alloc_noprof+0xa4/0x6c0 [ 1533.356816][T30554] ? anon_vma_fork+0x83/0x570 [ 1533.356836][T30554] ? anon_vma_fork+0x83/0x570 [ 1533.356864][T30554] anon_vma_fork+0x83/0x570 [ 1533.356888][T30554] ? dup_userfaultfd+0xaf/0x650 [ 1533.356924][T30554] ? __vm_enough_memory+0x11b/0x380 [ 1533.357055][T30554] dup_mmap+0x997/0x1d70 [ 1533.357191][T30554] ? __pfx_dup_mmap+0x10/0x10 [ 1533.357252][T30554] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 1533.357351][T30554] ? copy_mm+0x10f/0x480 [ 1533.357441][T30554] ? copy_mm+0x10f/0x480 [ 1533.357563][T30554] copy_mm+0x11a/0x480 [ 1533.357655][T30554] copy_process+0x1e65/0x42e0 [ 1533.357766][T30554] ? copy_process+0xd4e/0x42e0 [ 1533.357894][T30554] ? __pfx_copy_process+0x10/0x10 [ 1533.357985][T30554] ? get_pid_task+0x20/0x1f0 [ 1533.358043][T30554] ? get_pid_task+0x20/0x1f0 [ 1533.358124][T30554] kernel_clone+0x2d7/0x940 [ 1533.358197][T30554] ? __pfx_kernel_clone+0x10/0x10 [ 1533.358248][T30554] ? do_raw_spin_lock+0x12b/0x2f0 [ 1533.358330][T30554] __x64_sys_clone+0x1b6/0x230 [ 1533.358371][T30554] ? __pfx___x64_sys_clone+0x10/0x10 [ 1533.358504][T30554] ? __pfx_ksys_write+0x10/0x10 [ 1533.358603][T30554] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1533.358665][T30554] do_syscall_64+0x174/0x580 [ 1533.358736][T30554] ? trace_irq_disable+0x3b/0x140 [ 1533.358823][T30554] ? clear_bhb_loop+0x40/0x90 [ 1533.358894][T30554] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1533.358957][T30554] RIP: 0033:0x7f8e670bce59 [ 1533.359020][T30554] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1533.359072][T30554] RSP: 002b:00007f8e65315fd8 EFLAGS: 00000206 ORIG_RAX: 0000000000000038 [ 1533.359135][T30554] RAX: ffffffffffffffda RBX: 00007f8e67335fa0 RCX: 00007f8e670bce59 [ 1533.359178][T30554] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000011 [ 1533.359218][T30554] RBP: 00007f8e65316090 R08: 0000000000000000 R09: 0000000000000000 [ 1533.359258][T30554] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000002 [ 1533.359292][T30554] R13: 00007f8e67336038 R14: 00007f8e67335fa0 R15: 00007ffd89d92588 [ 1533.359384][T30554] [ 1533.450533][T30553] netlink: 4 bytes leftover after parsing attributes in process `syz.7.8284'. [ 1533.620828][ T5720] adutux 9-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 1533.783783][ T5720] usb 9-1: USB disconnect, device number 19 [ 1534.138866][T30565] Invalid logical block size (4194304) [ 1534.403037][T30567] netlink: 72 bytes leftover after parsing attributes in process `syz.7.8288'. [ 1534.432933][T30568] ublk_ctrl_add_dev: dev id not match 4294967295 2 [ 1534.886987][T30574] netlink: 244 bytes leftover after parsing attributes in process `syz.6.8290'. [ 1535.189774][ T5774] usb 7-1: new high-speed USB device number 72 using dummy_hcd [ 1535.349672][ T5774] usb 7-1: Using ep0 maxpacket: 16 [ 1535.352383][ T5774] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1535.352410][ T5774] usb 7-1: config 0 has no interfaces? [ 1535.352441][ T5774] usb 7-1: New USB device found, idVendor=6161, idProduct=4d15, bcdDevice= 0.00 [ 1535.352467][ T5774] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1535.406751][ T5774] usb 7-1: config 0 descriptor?? [ 1535.722794][T30582] 9p: Bad value for 'rfdno' [ 1535.875468][T30585] netlink: 'syz.8.8295': attribute type 1 has an invalid length. [ 1536.469879][T30598] vcan0: tx drop: invalid sa for name 0x0000000000000001 [ 1536.846747][T30610] FAULT_INJECTION: forcing a failure. [ 1536.846747][T30610] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1536.846788][T30610] CPU: 0 UID: 0 PID: 30610 Comm: syz.8.8305 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1536.846819][T30610] Tainted: [L]=SOFTLOCKUP [ 1536.846828][T30610] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1536.846843][T30610] Call Trace: [ 1536.846853][T30610] [ 1536.846863][T30610] dump_stack_lvl+0xe8/0x150 [ 1536.846896][T30610] should_fail_ex+0x46b/0x600 [ 1536.846935][T30610] _copy_from_user+0x2d/0xb0 [ 1536.846962][T30610] __se_sys_io_uring_setup+0x1b4/0x2c0 [ 1536.846994][T30610] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 1536.847018][T30610] ? __pfx___se_sys_io_uring_setup+0x10/0x10 [ 1536.847069][T30610] ? rcu_is_watching+0x15/0xb0 [ 1536.847113][T30610] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1536.847139][T30610] do_syscall_64+0x174/0x580 [ 1536.847168][T30610] ? trace_irq_disable+0x3b/0x140 [ 1536.847196][T30610] ? clear_bhb_loop+0x40/0x90 [ 1536.847225][T30610] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1536.847248][T30610] RIP: 0033:0x7ff11b3dce59 [ 1536.847269][T30610] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1536.847291][T30610] RSP: 002b:00007ff11962dee8 EFLAGS: 00000206 ORIG_RAX: 00000000000001a9 [ 1536.847317][T30610] RAX: ffffffffffffffda RBX: 0000200000000a88 RCX: 00007ff11b3dce59 [ 1536.847334][T30610] RDX: 0000200000000b08 RSI: 0000200000000a88 RDI: 0000000000000e26 [ 1536.847350][T30610] RBP: 0000200000000a80 R08: 0000200000000340 R09: 0000000000000000 [ 1536.847367][T30610] R10: 0000200000000b10 R11: 0000000000000206 R12: 0000200000000b08 [ 1536.847383][T30610] R13: 0000200000000b10 R14: 00007ff11962dfd8 R15: 0000000000000000 [ 1536.847416][T30610] [ 1537.391472][T30615] netlink: 4 bytes leftover after parsing attributes in process `syz.8.8306'. [ 1537.391525][T30615] openvswitch: netlink: Missing key (keys=40, expected=10000000) [ 1537.947117][ T821] usb 7-1: USB disconnect, device number 72 [ 1541.257268][T30631] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1541.730359][T30673] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1541.738471][T30673] netlink: 28 bytes leftover after parsing attributes in process `syz.3.8326'. [ 1541.829035][T28084] usb 7-1: new high-speed USB device number 73 using dummy_hcd [ 1541.859738][ T32] usb 9-1: new high-speed USB device number 20 using dummy_hcd [ 1541.978962][T28084] usb 7-1: Using ep0 maxpacket: 16 [ 1541.981483][T28084] usb 7-1: unable to get BOS descriptor or descriptor too short [ 1541.985060][T28084] usb 7-1: New USB device found, idVendor=10d2, idProduct=887b, bcdDevice=7c.62 [ 1541.985088][T28084] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1541.985114][T28084] usb 7-1: Product: syz [ 1541.985125][T28084] usb 7-1: Manufacturer: syz [ 1541.985136][T28084] usb 7-1: SerialNumber: syz [ 1542.035873][ T32] usb 9-1: Using ep0 maxpacket: 16 [ 1542.052068][ T32] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0xF has invalid maxpacket 33437, setting to 1024 [ 1542.052105][ T32] usb 9-1: config 0 interface 0 altsetting 0 bulk endpoint 0xF has invalid maxpacket 1024 [ 1542.052133][ T32] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1542.052157][ T32] usb 9-1: config 0 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 1542.123670][ T32] usb 9-1: New USB device found, idVendor=054c, idProduct=06c1, bcdDevice=c2.87 [ 1542.123706][ T32] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1542.123730][ T32] usb 9-1: Product: syz [ 1542.123746][ T32] usb 9-1: Manufacturer: syz [ 1542.123762][ T32] usb 9-1: SerialNumber: syz [ 1542.144314][ T32] usb 9-1: config 0 descriptor?? [ 1542.147148][T30671] raw-gadget.2 gadget.8: fail, usb_ep_enable returned -22 [ 1542.212831][ C1] port100 9-1:0.0: NFC: Urb failure (status -71) [ 1542.227670][ T32] port100 9-1:0.0: NFC: Could not get supported command types [ 1542.269691][T28084] usblcd 7-1:6.0: USBLCD model not supported. [ 1542.287316][T28084] usb 7-1: USB disconnect, device number 73 [ 1542.382776][ T5720] usb 9-1: USB disconnect, device number 20 [ 1543.568768][ T32] usb 7-1: new high-speed USB device number 74 using dummy_hcd [ 1543.734013][ T32] usb 7-1: unable to get BOS descriptor or descriptor too short [ 1543.736447][ T32] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1543.736475][ T32] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1543.771456][ T32] usb 7-1: New USB device found, idVendor=1235, idProduct=0010, bcdDevice= 0.40 [ 1543.771504][ T32] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1543.771526][ T32] usb 7-1: Product: syz [ 1543.771542][ T32] usb 7-1: Manufacturer: syz [ 1543.771558][ T32] usb 7-1: SerialNumber: syz [ 1543.829806][ T32] usb 7-1: selecting invalid altsetting 1 [ 1543.832299][ T32] usb 7-1: unit 6 not found! [ 1544.180160][T30691] comedi comedi0: 8255: I/O base address not correctly aligned [ 1544.814839][T30700] FAULT_INJECTION: forcing a failure. [ 1544.814839][T30700] name failslab, interval 1, probability 0, space 0, times 0 [ 1544.814881][T30700] CPU: 0 UID: 0 PID: 30700 Comm: syz.3.8337 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1544.814913][T30700] Tainted: [L]=SOFTLOCKUP [ 1544.814922][T30700] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1544.814937][T30700] Call Trace: [ 1544.814946][T30700] [ 1544.814957][T30700] dump_stack_lvl+0xe8/0x150 [ 1544.814990][T30700] should_fail_ex+0x46b/0x600 [ 1544.815030][T30700] should_failslab+0xa8/0x100 [ 1544.815061][T30700] kmem_cache_alloc_noprof+0xa4/0x6c0 [ 1544.815097][T30700] ? vm_area_dup+0x2b/0x670 [ 1544.815122][T30700] ? vm_area_dup+0x2b/0x670 [ 1544.815156][T30700] vm_area_dup+0x2b/0x670 [ 1544.815188][T30700] dup_mmap+0x8ba/0x1d70 [ 1544.815237][T30700] ? __pfx_dup_mmap+0x10/0x10 [ 1544.815261][T30700] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 1544.815296][T30700] ? copy_mm+0x10f/0x480 [ 1544.815333][T30700] ? copy_mm+0x10f/0x480 [ 1544.815383][T30700] copy_mm+0x11a/0x480 [ 1544.815420][T30700] copy_process+0x1e65/0x42e0 [ 1544.815463][T30700] ? copy_process+0xd4e/0x42e0 [ 1544.815519][T30700] ? __pfx_copy_process+0x10/0x10 [ 1544.815568][T30700] kernel_clone+0x2d7/0x940 [ 1544.815598][T30700] ? __pfx_kernel_clone+0x10/0x10 [ 1544.815642][T30700] __se_sys_clone3+0x33c/0x360 [ 1544.815670][T30700] ? __pfx___se_sys_clone3+0x10/0x10 [ 1544.815730][T30700] ? native_tss_update_io_bitmap+0x353/0x540 [ 1544.815777][T30700] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1544.815803][T30700] do_syscall_64+0x174/0x580 [ 1544.815833][T30700] ? trace_irq_disable+0x3b/0x140 [ 1544.815863][T30700] ? clear_bhb_loop+0x40/0x90 [ 1544.815892][T30700] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1544.815915][T30700] RIP: 0033:0x7fc3f95cce59 [ 1544.815936][T30700] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1544.815958][T30700] RSP: 002b:00007fc3f7825ef8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b3 [ 1544.815983][T30700] RAX: ffffffffffffffda RBX: 0000000000000058 RCX: 00007fc3f95cce59 [ 1544.816000][T30700] RDX: 00007fc3f7825f10 RSI: 0000000000000058 RDI: 00007fc3f7825f10 [ 1544.816017][T30700] RBP: 00007fc3f7826090 R08: 0000000000000000 R09: 0000000000000058 [ 1544.816032][T30700] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1544.816047][T30700] R13: 00007fc3f9846038 R14: 00007fc3f9845fa0 R15: 00007ffcf22138c8 [ 1544.816083][T30700] [ 1544.834909][ T32] usb 7-1: 2:0: failed to get current value for ch 0 (-71) [ 1545.149452][ T32] snd-usb-audio 7-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 1545.152622][ T32] usb 7-1: USB disconnect, device number 74 [ 1545.578507][T30718] netlink: 244 bytes leftover after parsing attributes in process `syz.8.8341'. [ 1545.942691][T30726] binder: 30725:30726 ioctl c0306201 200000000080 returned -14 [ 1545.946566][T30726] binder: 30725:30726 ioctl c0306201 2000000003c0 returned -14 [ 1546.582281][T30747] FAULT_INJECTION: forcing a failure. [ 1546.582281][T30747] name failslab, interval 1, probability 0, space 0, times 0 [ 1546.582314][T30747] CPU: 1 UID: 0 PID: 30747 Comm: syz.8.8353 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1546.582356][T30747] Tainted: [L]=SOFTLOCKUP [ 1546.582363][T30747] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1546.582375][T30747] Call Trace: [ 1546.582383][T30747] [ 1546.582391][T30747] dump_stack_lvl+0xe8/0x150 [ 1546.582418][T30747] should_fail_ex+0x46b/0x600 [ 1546.582448][T30747] should_failslab+0xa8/0x100 [ 1546.582470][T30747] __kmalloc_cache_noprof+0xa0/0x6d0 [ 1546.582490][T30747] ? iommufd_test+0x44c/0x6160 [ 1546.582517][T30747] ? iommufd_test+0x44c/0x6160 [ 1546.582560][T30747] iommufd_test+0x44c/0x6160 [ 1546.582596][T30747] ? __lock_acquire+0x6b5/0x2d10 [ 1546.582619][T30747] ? __pfx_iommufd_test+0x10/0x10 [ 1546.582654][T30747] ? tomoyo_path_number_perm+0x219/0x630 [ 1546.582683][T30747] ? tomoyo_path_number_perm+0x219/0x630 [ 1546.582714][T30747] ? __might_fault+0xaf/0x130 [ 1546.582733][T30747] ? __might_fault+0xaf/0x130 [ 1546.582771][T30747] iommufd_fops_ioctl+0x4b8/0x5d0 [ 1546.582796][T30747] ? __pfx_iommufd_fops_ioctl+0x10/0x10 [ 1546.582822][T30747] ? __fget_files+0x2a/0x420 [ 1546.582845][T30747] ? __fget_files+0x2a/0x420 [ 1546.582866][T30747] ? bpf_lsm_file_ioctl+0x9/0x20 [ 1546.582887][T30747] ? __pfx_iommufd_fops_ioctl+0x10/0x10 [ 1546.582909][T30747] __se_sys_ioctl+0xff/0x170 [ 1546.582932][T30747] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1546.582953][T30747] do_syscall_64+0x174/0x580 [ 1546.582976][T30747] ? trace_irq_disable+0x3b/0x140 [ 1546.582999][T30747] ? clear_bhb_loop+0x40/0x90 [ 1546.583021][T30747] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1546.583041][T30747] RIP: 0033:0x7ff11b3dce59 [ 1546.583059][T30747] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1546.583075][T30747] RSP: 002b:00007ff11962e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1546.583095][T30747] RAX: ffffffffffffffda RBX: 00007ff11b655fa0 RCX: 00007ff11b3dce59 [ 1546.583108][T30747] RDX: 0000200000000100 RSI: 0000000000003ba0 RDI: 0000000000000003 [ 1546.583120][T30747] RBP: 00007ff11962e090 R08: 0000000000000000 R09: 0000000000000000 [ 1546.583132][T30747] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1546.583142][T30747] R13: 00007ff11b656038 R14: 00007ff11b655fa0 R15: 00007ffd4e6eae98 [ 1546.583170][T30747] [ 1547.302153][T30756] netlink: 16 bytes leftover after parsing attributes in process `syz.6.8357'. [ 1547.360793][T30757] FAULT_INJECTION: forcing a failure. [ 1547.360793][T30757] name failslab, interval 1, probability 0, space 0, times 0 [ 1547.360832][T30757] CPU: 0 UID: 0 PID: 30757 Comm: syz.7.8358 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1547.360861][T30757] Tainted: [L]=SOFTLOCKUP [ 1547.360870][T30757] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1547.360883][T30757] Call Trace: [ 1547.360891][T30757] [ 1547.360900][T30757] dump_stack_lvl+0xe8/0x150 [ 1547.360930][T30757] should_fail_ex+0x46b/0x600 [ 1547.360966][T30757] should_failslab+0xa8/0x100 [ 1547.360993][T30757] __kmalloc_cache_noprof+0xa0/0x6d0 [ 1547.361019][T30757] ? vidtv_channel_s302m_init+0x7e/0x880 [ 1547.361046][T30757] ? vidtv_channel_s302m_init+0x7e/0x880 [ 1547.361080][T30757] vidtv_channel_s302m_init+0x7e/0x880 [ 1547.361127][T30757] ? __kmalloc_node_track_caller_noprof+0x3c5/0x820 [ 1547.361154][T30757] ? vidtv_mux_init+0x3b1/0x19b0 [ 1547.361193][T30757] vidtv_channels_init+0x45/0xa0 [ 1547.361222][T30757] vidtv_mux_init+0x4d9/0x19b0 [ 1547.361263][T30757] vidtv_start_feed+0x36b/0x5a0 [ 1547.361306][T30757] ? __pfx_vidtv_start_feed+0x10/0x10 [ 1547.361340][T30757] ? __pfx_vidtv_bridge_on_new_pkts_avail+0x10/0x10 [ 1547.361385][T30757] ? lockdep_hardirqs_on+0x7a/0x110 [ 1547.361414][T30757] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1547.361443][T30757] ? mutex_lock_interruptible_nested+0x152/0x1d0 [ 1547.361485][T30757] ? dmx_ts_feed_start_filtering+0x52/0x240 [ 1547.361514][T30757] dmx_ts_feed_start_filtering+0x135/0x240 [ 1547.361544][T30757] dvb_dmxdev_filter_start+0x447/0x10e0 [ 1547.361593][T30757] dvb_demux_do_ioctl+0x48e/0x540 [ 1547.361630][T30757] dvb_usercopy+0x199/0x2e0 [ 1547.361661][T30757] ? __pfx_dvb_demux_do_ioctl+0x10/0x10 [ 1547.361695][T30757] ? __pfx_dvb_usercopy+0x10/0x10 [ 1547.361739][T30757] ? __fget_files+0x3a6/0x420 [ 1547.361761][T30757] ? __fget_files+0x2a/0x420 [ 1547.361788][T30757] ? __pfx_dvb_demux_ioctl+0x10/0x10 [ 1547.361821][T30757] dvb_demux_ioctl+0x29/0x40 [ 1547.361855][T30757] __se_sys_ioctl+0xff/0x170 [ 1547.361885][T30757] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1547.361911][T30757] do_syscall_64+0x174/0x580 [ 1547.361940][T30757] ? trace_irq_disable+0x3b/0x140 [ 1547.361969][T30757] ? clear_bhb_loop+0x40/0x90 [ 1547.361997][T30757] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1547.362021][T30757] RIP: 0033:0x7f276520ce59 [ 1547.362041][T30757] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1547.362061][T30757] RSP: 002b:00007f276345e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1547.362085][T30757] RAX: ffffffffffffffda RBX: 00007f2765485fa0 RCX: 00007f276520ce59 [ 1547.362102][T30757] RDX: 00002000000000c0 RSI: 0000000040146f2c RDI: 0000000000000003 [ 1547.362117][T30757] RBP: 00007f276345e090 R08: 0000000000000000 R09: 0000000000000000 [ 1547.362132][T30757] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1547.362146][T30757] R13: 00007f2765486038 R14: 00007f2765485fa0 R15: 00007ffd7efe45e8 [ 1547.362181][T30757] [ 1547.718252][T30759] netlink: 'syz.7.8361': attribute type 29 has an invalid length. [ 1547.720030][T30759] netlink: 'syz.7.8361': attribute type 29 has an invalid length. [ 1547.720841][T30759] netlink: 'syz.7.8361': attribute type 29 has an invalid length. [ 1547.934075][ T1338] ieee802154 phy0 wpan0: encryption failed: -22 [ 1547.934192][ T1338] ieee802154 phy1 wpan1: encryption failed: -22 [ 1548.466272][T30762] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1548.488502][T30762] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8359'. [ 1548.672852][T30773] input input124: cannot allocate more than FF_MAX_EFFECTS effects [ 1548.730212][ T32] usb 4-1: new high-speed USB device number 56 using dummy_hcd [ 1548.881216][ T32] usb 4-1: config 114 has an invalid interface number: 231 but max is 0 [ 1548.881247][ T32] usb 4-1: config 114 has no interface number 0 [ 1548.881295][ T32] usb 4-1: config 114 interface 231 altsetting 232 has an endpoint descriptor with address 0xCA, changing to 0x8A [ 1548.881325][ T32] usb 4-1: config 114 interface 231 altsetting 232 bulk endpoint 0x8A has invalid maxpacket 16 [ 1548.881373][ T32] usb 4-1: config 114 interface 231 has no altsetting 0 [ 1548.899565][ T32] usb 4-1: New USB device found, idVendor=0f3d, idProduct=68a3, bcdDevice=36.cf [ 1548.899598][ T32] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1548.899622][ T32] usb 4-1: Product: syz [ 1548.899639][ T32] usb 4-1: Manufacturer: syz [ 1548.899656][ T32] usb 4-1: SerialNumber: syz [ 1548.984980][T30762] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 1549.202172][ T32] sierra 4-1:114.231: Sierra USB modem converter detected [ 1549.209938][T28084] usb 7-1: new high-speed USB device number 75 using dummy_hcd [ 1549.228578][ T32] usb 4-1: Sierra USB modem converter now attached to ttyUSB0 [ 1549.264259][ T32] usb 4-1: USB disconnect, device number 56 [ 1549.292126][ T32] sierra ttyUSB0: Sierra USB modem converter now disconnected from ttyUSB0 [ 1549.295879][ T32] sierra 4-1:114.231: device disconnected [ 1549.399250][T28084] usb 7-1: Using ep0 maxpacket: 8 [ 1549.406753][T28084] usb 7-1: config 2 has an invalid interface number: 72 but max is 0 [ 1549.406785][T28084] usb 7-1: config 2 has no interface number 0 [ 1549.406825][T28084] usb 7-1: config 2 interface 72 has no altsetting 0 [ 1549.440817][T28084] usb 7-1: New USB device found, idVendor=1004, idProduct=61aa, bcdDevice=cf.6f [ 1549.440850][T28084] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1549.440865][T28084] usb 7-1: Product: syz [ 1549.440875][T28084] usb 7-1: Manufacturer: syz [ 1549.440887][T28084] usb 7-1: SerialNumber: syz [ 1549.682016][T30780] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1549.682914][T30780] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1549.687529][T30780] netlink: 256 bytes leftover after parsing attributes in process `syz.6.8368'. [ 1549.687556][T30780] netlink: 'syz.6.8368': attribute type 10 has an invalid length. [ 1549.859529][ T32] usb 9-1: new high-speed USB device number 21 using dummy_hcd [ 1550.008366][ T32] usb 9-1: Using ep0 maxpacket: 16 [ 1550.023949][ T32] usb 9-1: config 0 interface 0 has no altsetting 0 [ 1550.023992][ T32] usb 9-1: New USB device found, idVendor=146b, idProduct=0902, bcdDevice= 0.00 [ 1550.024020][ T32] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1550.087358][ T32] usb 9-1: config 0 descriptor?? [ 1550.088655][T26583] Bluetooth: hci5: command 0x0406 tx timeout [ 1550.185401][T30790] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1550.368065][T28084] usb 7-1: No union descriptors [ 1550.399288][T28084] usb 7-1: USB disconnect, device number 75 [ 1550.757556][ T32] bigben 0003:146B:0902.0031: unexpected rdesc, please submit for review [ 1550.767527][ T32] bigben 0003:146B:0902.0031: unexpected long global item [ 1550.776590][ T32] bigben 0003:146B:0902.0031: parse failed [ 1550.776709][ T32] bigben 0003:146B:0902.0031: probe with driver bigben failed with error -22 [ 1551.132802][ T5344] usb 9-1: USB disconnect, device number 21 [ 1551.221630][T30801] IPVS: ovf: FWM 3 0x00000003 - no destination available [ 1552.361463][T30825] netlink: 4 bytes leftover after parsing attributes in process `syz.8.8386'. [ 1552.483657][T30826] bridge0: port 2(bridge_slave_1) entered disabled state [ 1552.737634][ T1367] bridge0: port 2(bridge_slave_1) entered blocking state [ 1552.737790][ T1367] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1553.147595][ T5344] usb 9-1: new high-speed USB device number 22 using dummy_hcd [ 1553.300962][ T5344] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1553.301032][ T5344] usb 9-1: config 1 interface 0 altsetting 0 has an endpoint descriptor with address 0x7F, changing to 0xF [ 1553.301062][ T5344] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 1553.310142][ T5344] usb 9-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1553.310239][ T5344] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1553.310302][ T5344] usb 9-1: Product: syz [ 1553.310332][ T5344] usb 9-1: Manufacturer: syz [ 1553.310374][ T5344] usb 9-1: SerialNumber: syz [ 1553.327816][ T5720] usb 7-1: new high-speed USB device number 76 using dummy_hcd [ 1553.499998][ T5720] usb 7-1: Using ep0 maxpacket: 8 [ 1553.522486][ T5720] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 13 [ 1553.542448][ T5720] usb 7-1: New USB device found, idVendor=046d, idProduct=08ae, bcdDevice=11.58 [ 1553.542471][ T5720] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1553.542486][ T5720] usb 7-1: Product: syz [ 1553.542497][ T5720] usb 7-1: Manufacturer: syz [ 1553.542508][ T5720] usb 7-1: SerialNumber: syz [ 1553.601962][ T5720] usb 7-1: config 0 descriptor?? [ 1553.642198][ T5720] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08ae [ 1553.741129][T30863] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1553.741881][T30863] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1553.967435][ T5774] usb 4-1: new high-speed USB device number 57 using dummy_hcd [ 1554.131542][ T5774] usb 4-1: New USB device found, idVendor=057b, idProduct=0000, bcdDevice= 0.00 [ 1554.131590][ T5774] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1554.165502][ T5774] usb-storage 4-1:32.0: USB Mass Storage device detected [ 1554.180039][ T5774] usb-storage 4-1:32.0: Quirks match for vid 057b pid 0000: 1 [ 1554.239039][T30839] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1554.241216][T30839] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1554.363855][ T5774] usb 4-1: USB disconnect, device number 57 [ 1554.451998][ T5720] gspca_zc3xx: reg_w_i err -71 [ 1554.453705][ T5344] cdc_ncm 9-1:1.0: bind() failure [ 1554.480807][ T5344] usbtest 9-1:1.1: probe with driver usbtest failed with error -71 [ 1554.491765][ T5344] usb 9-1: USB disconnect, device number 22 [ 1554.731799][T30870] netlink: 36 bytes leftover after parsing attributes in process `syz.7.8400'. [ 1555.037324][ T5720] gspca_zc3xx: Unknown sensor - set to TAS5130C [ 1555.037430][ T5720] gspca_zc3xx 7-1:0.0: probe with driver gspca_zc3xx failed with error -71 [ 1555.041519][ T5720] usb 7-1: USB disconnect, device number 76 [ 1555.158827][T30876] ucma_write: process 663 (syz.3.8402) changed security contexts after opening file descriptor, this is not allowed. [ 1555.675596][T30886] XFS (nullb0): Invalid superblock magic number [ 1555.688623][ T5720] usb 7-1: new high-speed USB device number 77 using dummy_hcd [ 1555.884666][ T5720] usb 7-1: New USB device found, idVendor=0547, idProduct=0201, bcdDevice=11.64 [ 1555.884696][ T5720] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1555.884716][ T5720] usb 7-1: Product: syz [ 1555.884730][ T5720] usb 7-1: Manufacturer: syz [ 1555.884745][ T5720] usb 7-1: SerialNumber: syz [ 1555.891120][ T5720] usb 7-1: config 0 descriptor?? [ 1555.898236][ T5720] dvb-usb: found a 'Nebula Electronics uDigiTV DVB-T USB2.0)' in warm state. [ 1555.906958][ T5720] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1555.911189][ T5720] dvbdev: DVB: registering new adapter (Nebula Electronics uDigiTV DVB-T USB2.0)) [ 1555.911243][ T5720] usb 7-1: media controller created [ 1555.961399][ T5720] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1556.122751][T30887] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1556.125775][T30887] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1556.487314][ T5720] DVB: Unable to find symbol mt352_attach() [ 1556.574355][ T5720] DVB: Unable to find symbol nxt6000_attach() [ 1556.574375][ T5720] dvb-usb: no frontend was attached by 'Nebula Electronics uDigiTV DVB-T USB2.0)' [ 1556.579571][ T5720] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.6/usb7/7-1/input/input125 [ 1556.718193][ T5720] dvb-usb: schedule remote query interval to 1000 msecs. [ 1556.718219][ T5720] dvb-usb: Nebula Electronics uDigiTV DVB-T USB2.0) successfully initialized and connected. [ 1556.718239][ T5720] dvb-usb: bulk message failed: -22 (7/0) [ 1556.718258][ T5720] dvb-usb: bulk message failed: -22 (7/0) [ 1556.718388][T30902] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1556.919328][ T32] usb 7-1: USB disconnect, device number 77 [ 1557.001839][T30913] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 1557.184903][T30915] debugfs: '1^!hS+4k>WR{`]y}N\]' already exists in 'ieee80211' [ 1557.224997][ T32] dvb-usb: Nebula Electronics uDigiTV DVB-T USB2.0 successfully deinitialized and disconnected. [ 1557.380727][T30919] netlink: 'syz.7.8416': attribute type 2 has an invalid length. [ 1558.207458][T30929] netlink: 24 bytes leftover after parsing attributes in process `syz.8.8420'. [ 1558.474864][T30933] netlink: 'syz.6.8421': attribute type 29 has an invalid length. [ 1558.512912][ T821] usb 9-1: new full-speed USB device number 23 using dummy_hcd [ 1558.703020][ T821] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1558.703068][ T821] usb 9-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1558.705641][ T821] usb 9-1: New USB device found, idVendor=0c72, idProduct=0013, bcdDevice=ba.be [ 1558.705671][ T821] usb 9-1: New USB device strings: Mfr=175, Product=2, SerialNumber=3 [ 1558.705693][ T821] usb 9-1: Product: syz [ 1558.705713][ T821] usb 9-1: Manufacturer: syz [ 1558.705724][ T821] usb 9-1: SerialNumber: syz [ 1558.770645][ T821] usb 9-1: config 0 descriptor?? [ 1558.941958][T30934] netlink: 'syz.6.8421': attribute type 29 has an invalid length. [ 1558.942533][T30935] netlink: 'syz.6.8421': attribute type 29 has an invalid length. [ 1559.033964][T30937] binder: 30936:30937 ioctl c018620c 200000000240 returned -22 [ 1560.245803][ T821] usb 7-1: new high-speed USB device number 78 using dummy_hcd [ 1560.398883][ T821] usb 7-1: Using ep0 maxpacket: 8 [ 1560.403333][ T821] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 253, changing to 11 [ 1560.403389][ T821] usb 7-1: New USB device found, idVendor=1e7d, idProduct=2db4, bcdDevice= 0.00 [ 1560.403422][ T821] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1560.441036][ T821] usb 7-1: config 0 descriptor?? [ 1560.856467][ T821] konepure 0003:1E7D:2DB4.0032: unknown main item tag 0x0 [ 1560.856508][ T821] konepure 0003:1E7D:2DB4.0032: unknown main item tag 0x0 [ 1560.856537][ T821] konepure 0003:1E7D:2DB4.0032: unknown main item tag 0x0 [ 1560.856575][ T821] konepure 0003:1E7D:2DB4.0032: unknown main item tag 0x0 [ 1560.856604][ T821] konepure 0003:1E7D:2DB4.0032: unknown main item tag 0x0 [ 1560.856633][ T821] konepure 0003:1E7D:2DB4.0032: unknown main item tag 0x0 [ 1560.856662][ T821] konepure 0003:1E7D:2DB4.0032: unknown main item tag 0x0 [ 1560.856690][ T821] konepure 0003:1E7D:2DB4.0032: unknown main item tag 0x0 [ 1560.950123][ T821] konepure 0003:1E7D:2DB4.0032: hidraw0: USB HID v0.00 Device [HID 1e7d:2db4] on usb-dummy_hcd.6-1/input0 [ 1561.065264][ T32] usb 7-1: USB disconnect, device number 78 [ 1561.184804][ T821] usb 9-1: USB disconnect, device number 23 [ 1562.059311][T30964] netlink: 8 bytes leftover after parsing attributes in process `syz.7.8434'. [ 1562.176965][T30969] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1562.195684][T30969] FAULT_INJECTION: forcing a failure. [ 1562.195684][T30969] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1562.195724][T30969] CPU: 1 UID: 0 PID: 30969 Comm: syz.6.8435 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1562.195773][T30969] Tainted: [L]=SOFTLOCKUP [ 1562.195782][T30969] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1562.195798][T30969] Call Trace: [ 1562.195807][T30969] [ 1562.195816][T30969] dump_stack_lvl+0xe8/0x150 [ 1562.195851][T30969] should_fail_ex+0x46b/0x600 [ 1562.195890][T30969] _copy_from_user+0x2d/0xb0 [ 1562.196034][T30969] ___sys_recvmsg+0x175/0x5a0 [ 1562.196077][T30969] ? __pfx____sys_recvmsg+0x10/0x10 [ 1562.196113][T30969] ? __fget_files+0x2a/0x420 [ 1562.196155][T30969] ? __fget_files+0x3a6/0x420 [ 1562.196189][T30969] __x64_sys_recvmsg+0x1b4/0x290 [ 1562.196225][T30969] ? __pfx___x64_sys_recvmsg+0x10/0x10 [ 1562.196276][T30969] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1562.196304][T30969] do_syscall_64+0x174/0x580 [ 1562.196334][T30969] ? trace_irq_disable+0x3b/0x140 [ 1562.196365][T30969] ? clear_bhb_loop+0x40/0x90 [ 1562.196395][T30969] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1562.196431][T30969] RIP: 0033:0x7f8e670bce59 [ 1562.196455][T30969] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1562.196477][T30969] RSP: 002b:00007f8e65316028 EFLAGS: 00000246 ORIG_RAX: 000000000000002f [ 1562.196502][T30969] RAX: ffffffffffffffda RBX: 00007f8e67335fa0 RCX: 00007f8e670bce59 [ 1562.196520][T30969] RDX: 0000000040000100 RSI: 0000200000003b40 RDI: 0000000000000003 [ 1562.196537][T30969] RBP: 00007f8e65316090 R08: 0000000000000000 R09: 0000000000000000 [ 1562.196552][T30969] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1562.196567][T30969] R13: 00007f8e67336038 R14: 00007f8e67335fa0 R15: 00007ffd89d92588 [ 1562.196603][T30969] [ 1562.499825][T30971] comedi comedi3: rti802: I/O base address not correctly aligned [ 1562.719104][T30980] Invalid source name [ 1562.719123][T30980] UBIFS error (pid: 30980): cannot open "/dev/sg0", error -22 [ 1562.719214][T30980] FAULT_INJECTION: forcing a failure. [ 1562.719214][T30980] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1562.719251][T30980] CPU: 0 UID: 0 PID: 30980 Comm: syz.8.8439 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1562.719282][T30980] Tainted: [L]=SOFTLOCKUP [ 1562.719291][T30980] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1562.719306][T30980] Call Trace: [ 1562.719315][T30980] [ 1562.719326][T30980] dump_stack_lvl+0xe8/0x150 [ 1562.719358][T30980] should_fail_ex+0x46b/0x600 [ 1562.719398][T30980] _copy_to_user+0x31/0xb0 [ 1562.719428][T30980] simple_read_from_buffer+0xe1/0x170 [ 1562.719459][T30980] proc_fail_nth_read+0x1be/0x230 [ 1562.719488][T30980] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1562.719515][T30980] ? rw_verify_area+0x2ac/0x4e0 [ 1562.719542][T30980] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1562.719569][T30980] vfs_read+0x212/0xa80 [ 1562.719605][T30980] ? __pfx_vfs_read+0x10/0x10 [ 1562.719640][T30980] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1562.719671][T30980] ? lockdep_hardirqs_on+0x7a/0x110 [ 1562.719700][T30980] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1562.719731][T30980] ? mutex_lock_nested+0x152/0x1d0 [ 1562.719766][T30980] ? fdget_pos+0x252/0x320 [ 1562.719800][T30980] ksys_read+0x156/0x270 [ 1562.719832][T30980] ? __pfx_ksys_read+0x10/0x10 [ 1562.719876][T30980] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1562.719903][T30980] do_syscall_64+0x174/0x580 [ 1562.719933][T30980] ? trace_irq_disable+0x3b/0x140 [ 1562.719964][T30980] ? clear_bhb_loop+0x40/0x90 [ 1562.719993][T30980] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1562.720018][T30980] RIP: 0033:0x7ff11b39d68e [ 1562.720040][T30980] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1562.720073][T30980] RSP: 002b:00007ff11962dfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1562.720098][T30980] RAX: ffffffffffffffda RBX: 00007ff11962e6c0 RCX: 00007ff11b39d68e [ 1562.720116][T30980] RDX: 000000000000000f RSI: 00007ff11962e0a0 RDI: 0000000000000004 [ 1562.720131][T30980] RBP: 00007ff11962e090 R08: 0000000000000000 R09: 0000000000000000 [ 1562.720146][T30980] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1562.720161][T30980] R13: 00007ff11b656038 R14: 00007ff11b655fa0 R15: 00007ffd4e6eae98 [ 1562.720196][T30980] [ 1571.989323][T26583] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 1572.010030][T26583] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 1572.025127][T26583] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 1572.058496][T26583] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 1572.060766][T26583] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 1573.470754][ T32] usb 7-1: new high-speed USB device number 79 using dummy_hcd [ 1573.621435][ T32] usb 7-1: Using ep0 maxpacket: 16 [ 1573.623949][ T32] usb 7-1: config 251 has an invalid interface number: 202 but max is 0 [ 1573.623978][ T32] usb 7-1: config 251 has no interface number 0 [ 1573.624029][ T32] usb 7-1: config 251 interface 202 altsetting 1 bulk endpoint 0x1 has invalid maxpacket 16 [ 1573.624058][ T32] usb 7-1: config 251 interface 202 altsetting 1 has an invalid descriptor for endpoint zero, skipping [ 1573.624083][ T32] usb 7-1: config 251 interface 202 altsetting 1 endpoint 0x6 has invalid maxpacket 1024, setting to 64 [ 1573.624112][ T32] usb 7-1: config 251 interface 202 altsetting 1 has an endpoint descriptor with address 0xC1, changing to 0x81 [ 1573.624140][ T32] usb 7-1: config 251 interface 202 altsetting 1 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1573.624165][ T32] usb 7-1: config 251 interface 202 altsetting 1 bulk endpoint 0x81 has invalid maxpacket 0 [ 1573.624192][ T32] usb 7-1: config 251 interface 202 altsetting 1 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 1573.624220][ T32] usb 7-1: config 251 interface 202 has no altsetting 0 [ 1573.670458][ T32] usb 7-1: New USB device found, idVendor=0572, idProduct=cb00, bcdDevice=bb.c9 [ 1573.670550][ T32] usb 7-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3 [ 1573.670603][ T32] usb 7-1: Product: syz [ 1573.670644][ T32] usb 7-1: SerialNumber: syz [ 1573.787775][T31011] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 1574.021017][ T32] cxacru 7-1:251.202: submit of read urb for cm 0x90 failed (-90) [ 1574.021054][ T32] cxacru 7-1:251.202: usbatm_usb_probe: invalid endpoint 02! [ 1574.021263][ T32] cxacru 7-1:251.202: probe with driver cxacru failed with error -22 [ 1574.145224][ T32] usb 7-1: USB disconnect, device number 79 [ 1574.394622][T26583] Bluetooth: hci6: command tx timeout [ 1574.705392][T30983] bridge0: port 1(bridge_slave_0) entered blocking state [ 1574.715404][T30983] bridge0: port 1(bridge_slave_0) entered disabled state [ 1574.725908][T30983] bridge_slave_0: entered allmulticast mode [ 1574.748166][T30983] bridge_slave_0: entered promiscuous mode [ 1574.843998][T30983] bridge0: port 2(bridge_slave_1) entered blocking state [ 1574.850974][T30983] bridge0: port 2(bridge_slave_1) entered disabled state [ 1574.857269][T30983] bridge_slave_1: entered allmulticast mode [ 1574.875099][T30983] bridge_slave_1: entered promiscuous mode [ 1575.117681][T30983] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1575.134173][T30983] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1575.226348][ T5720] [ 1575.226361][ T5720] ====================================================== [ 1575.226371][ T5720] WARNING: possible circular locking dependency detected [ 1575.226396][ T5720] syzkaller #0 Tainted: G L [ 1575.226410][ T5720] ------------------------------------------------------ [ 1575.226420][ T5720] kworker/0:5/5720 is trying to acquire lock: [ 1575.226431][ T5720] ffff88801aea00b0 (&buf->lock){+.+.}-{4:4}, at: tty_buffer_flush+0x74/0x2b0 [ 1575.226488][ T5720] SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 1575.226488][ T5720] but task is already holding lock: [ 1575.226497][ T5720] ffffffff8e3bd300 (console_lock){+.+.}-{0:0}, at: vc_SAK+0x28/0x220 [ 1575.226542][ T5720] [ 1575.226542][ T5720] which lock already depends on the new lock. [ 1575.226542][ T5720] [ 1575.226551][ T5720] [ 1575.226551][ T5720] the existing dependency chain (in reverse order) is: [ 1575.226561][ T5720] [ 1575.226561][ T5720] -> #2 (console_lock){+.+.}-{0:0}: [ 1575.226591][ T5720] console_lock+0x76/0x90 [ 1575.226611][ T5720] con_flush_chars+0x9d/0xd0 [ 1575.226646][ T5720] n_tty_write+0xeea/0x11e0 [ 1575.226674][ T5720] file_tty_write+0x511/0x990 [ 1575.226694][ T5720] vfs_write+0x629/0xba0 [ 1575.226716][ T5720] ksys_write+0x156/0x270 [ 1575.226740][ T5720] do_syscall_64+0x174/0x580 [ 1575.226766][ T5720] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1575.226788][ T5720] [ 1575.226788][ T5720] -> #1 (&tty->termios_rwsem){++++}-{4:4}: [ 1575.226819][ T5720] down_read+0x97/0x200 [ 1575.226846][ T5720] n_tty_receive_buf_common+0x84/0x12f0 [ 1575.226886][ T5720] tiocsti+0x218/0x2a0 [ 1575.226907][ T5720] tty_ioctl+0x62c/0xde0 [ 1575.226927][ T5720] __se_sys_ioctl+0xff/0x170 [ 1575.226952][ T5720] do_syscall_64+0x174/0x580 [ 1575.226977][ T5720] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1575.226997][ T5720] [ 1575.226997][ T5720] -> #0 (&buf->lock){+.+.}-{4:4}: [ 1575.227027][ T5720] __lock_acquire+0x15a5/0x2d10 [ 1575.227052][ T5720] lock_acquire+0x106/0x350 [ 1575.227078][ T5720] mutex_lock_nested+0x5a/0x1d0 [ 1575.227132][ T5720] tty_buffer_flush+0x74/0x2b0 [ 1575.227157][ T5720] tty_ldisc_flush+0x6b/0xc0 [ 1575.227179][ T5720] __do_SAK+0x127/0x690 [ 1575.227204][ T5720] vc_SAK+0x78/0x220 [ 1575.227222][ T5720] process_one_work+0x98b/0x1630 [ 1575.227253][ T5720] worker_thread+0xb49/0x1140 [ 1575.227285][ T5720] kthread+0x388/0x470 [ 1575.227307][ T5720] ret_from_fork+0x514/0xb70 [ 1575.227332][ T5720] ret_from_fork_asm+0x1a/0x30 [ 1575.227362][ T5720] [ 1575.227362][ T5720] other info that might help us debug this: [ 1575.227362][ T5720] [ 1575.227371][ T5720] Chain exists of: [ 1575.227371][ T5720] &buf->lock --> &tty->termios_rwsem --> console_lock [ 1575.227371][ T5720] [ 1575.227409][ T5720] Possible unsafe locking scenario: [ 1575.227409][ T5720] [ 1575.227417][ T5720] CPU0 CPU1 [ 1575.227425][ T5720] ---- ---- [ 1575.227433][ T5720] lock(console_lock); [ 1575.227449][ T5720] lock(&tty->termios_rwsem); [ 1575.227467][ T5720] lock(console_lock); [ 1575.227483][ T5720] lock(&buf->lock); [ 1575.227498][ T5720] [ 1575.227498][ T5720] *** DEADLOCK *** [ 1575.227498][ T5720] [ 1575.227505][ T5720] 4 locks held by kworker/0:5/5720: [ 1575.227517][ T5720] #0: ffff88813fe57938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x897/0x1630 [ 1575.227579][ T5720] #1: ffffc90004d17c40 ((work_completion)(&vc_cons[currcons].SAK_work)){+.+.}-{0:0}, at: process_one_work+0x8be/0x1630 [ 1575.227657][ T5720] #2: ffffffff8e3bd300 (console_lock){+.+.}-{0:0}, at: vc_SAK+0x28/0x220 [ 1575.227706][ T5720] #3: ffff88802bb4a0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_flush+0x20/0xc0 [ 1575.227759][ T5720] [ 1575.227759][ T5720] stack backtrace: [ 1575.227776][ T5720] CPU: 0 UID: 0 PID: 5720 Comm: kworker/0:5 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1575.227807][ T5720] Tainted: [L]=SOFTLOCKUP [ 1575.227816][ T5720] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1575.227831][ T5720] Workqueue: events vc_SAK [ 1575.227851][ T5720] Call Trace: [ 1575.227860][ T5720] [ 1575.227871][ T5720] dump_stack_lvl+0xe8/0x150 [ 1575.227897][ T5720] print_circular_bug+0x2e1/0x300 [ 1575.227933][ T5720] check_noncircular+0x12e/0x150 [ 1575.227970][ T5720] __lock_acquire+0x15a5/0x2d10 [ 1575.228011][ T5720] ? tty_buffer_flush+0x74/0x2b0 [ 1575.228038][ T5720] lock_acquire+0x106/0x350 [ 1575.228065][ T5720] ? tty_buffer_flush+0x74/0x2b0 [ 1575.228095][ T5720] ? tty_buffer_flush+0x74/0x2b0 [ 1575.228133][ T5720] ? tty_buffer_flush+0x74/0x2b0 [ 1575.228159][ T5720] mutex_lock_nested+0x5a/0x1d0 [ 1575.228193][ T5720] ? tty_buffer_flush+0x74/0x2b0 [ 1575.228218][ T5720] ? __pfx_ldsem_down_read_trylock+0x10/0x10 [ 1575.228256][ T5720] tty_buffer_flush+0x74/0x2b0 [ 1575.228291][ T5720] tty_ldisc_flush+0x6b/0xc0 [ 1575.228316][ T5720] __do_SAK+0x127/0x690 [ 1575.228344][ T5720] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1575.228374][ T5720] ? process_one_work+0x8be/0x1630 [ 1575.228406][ T5720] vc_SAK+0x78/0x220 [ 1575.228428][ T5720] ? process_one_work+0x8be/0x1630 [ 1575.228460][ T5720] process_one_work+0x98b/0x1630 [ 1575.228504][ T5720] ? __pfx_process_one_work+0x10/0x10 [ 1575.228536][ T5720] ? do_raw_spin_lock+0x12b/0x2f0 [ 1575.228569][ T5720] worker_thread+0xb49/0x1140 [ 1575.228623][ T5720] kthread+0x388/0x470 [ 1575.228666][ T5720] ? __pfx_worker_thread+0x10/0x10 [ 1575.228699][ T5720] ? __pfx_kthread+0x10/0x10 [ 1575.228725][ T5720] ret_from_fork+0x514/0xb70 [ 1575.228752][ T5720] ? __pfx_ret_from_fork+0x10/0x10 [ 1575.228777][ T5720] ? __switch_to+0xc79/0x1410 [ 1575.228800][ T5720] ? __pfx_kthread+0x10/0x10 [ 1575.228826][ T5720] ret_from_fork_asm+0x1a/0x30 [ 1575.228862][ T5720] [ 1575.232548][T31040] FAULT_INJECTION: forcing a failure. [ 1575.232548][T31040] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1575.232582][T31040] CPU: 0 UID: 0 PID: 31040 Comm: syz.8.8456 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1575.232622][T31040] Tainted: [L]=SOFTLOCKUP [ 1575.232631][T31040] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1575.232646][T31040] Call Trace: [ 1575.232655][T31040] [ 1575.232664][T31040] dump_stack_lvl+0xe8/0x150 [ 1575.232690][T31040] should_fail_ex+0x46b/0x600 [ 1575.232724][T31040] _copy_from_user+0x2d/0xb0 [ 1575.232749][T31040] input_event_from_user+0xb1/0x290 [ 1575.232775][T31040] ? __pfx_input_event_from_user+0x10/0x10 [ 1575.232802][T31040] ? rt_spin_unlock+0x160/0x200 [ 1575.232825][T31040] evdev_write+0x2ca/0x4c0 [ 1575.232846][T31040] ? __lock_acquire+0x6b5/0x2d10 [ 1575.232877][T31040] ? __pfx_evdev_write+0x10/0x10 [ 1575.232901][T31040] ? rw_verify_area+0x25b/0x4e0 [ 1575.232927][T31040] ? __pfx_evdev_write+0x10/0x10 [ 1575.232950][T31040] vfs_write+0x2a3/0xba0 [ 1575.232980][T31040] ? __pfx_vfs_write+0x10/0x10 [ 1575.233007][T31040] ? __fget_files+0x2a/0x420 [ 1575.233031][T31040] ? __fget_files+0x2a/0x420 [ 1575.233053][T31040] ? __fget_files+0x3a6/0x420 [ 1575.233074][T31040] ? __fget_files+0x2a/0x420 [ 1575.233110][T31040] ksys_write+0x156/0x270 [ 1575.233138][T31040] ? __pfx_ksys_write+0x10/0x10 [ 1575.233169][T31040] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1575.233193][T31040] do_syscall_64+0x174/0x580 [ 1575.233221][T31040] ? trace_irq_disable+0x3b/0x140 [ 1575.233248][T31040] ? clear_bhb_loop+0x40/0x90 [ 1575.233274][T31040] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1575.233297][T31040] RIP: 0033:0x7ff11b3dce59 [ 1575.233317][T31040] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1575.233338][T31040] RSP: 002b:00007ff11962e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1575.233362][T31040] RAX: ffffffffffffffda RBX: 00007ff11b655fa0 RCX: 00007ff11b3dce59 [ 1575.233380][T31040] RDX: 0000000000002250 RSI: 0000200000000040 RDI: 0000000000000003 [ 1575.233395][T31040] RBP: 00007ff11962e090 R08: 0000000000000000 R09: 0000000000000000 [ 1575.233409][T31040] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1575.233423][T31040] R13: 00007ff11b656038 R14: 00007ff11b655fa0 R15: 00007ffd4e6eae98 [ 1575.233448][T31040] [ 1575.235374][ T5720] tty tty1: SAK: killed process 31018 (syz.7.8451): by fd#3 [ 1575.599104][ T5776] usb 7-1: new full-speed USB device number 80 using dummy_hcd [ 1575.614586][T30983] team0: Port device team_slave_0 added [ 1575.679342][T30983] team0: Port device team_slave_1 added [ 1576.147921][T30983] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1576.147939][T30983] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1576.147970][T30983] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1576.482551][T26583] Bluetooth: hci6: command tx timeout [ 1577.127014][T27842] syz_tun (unregistering): left allmulticast mode [ 1577.810750][ T5907] netdevsim netdevsim8 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1578.321309][ T5907] netdevsim netdevsim8 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1578.604624][ T5907] netdevsim netdevsim8 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1578.883558][ T5907] netdevsim netdevsim8 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1579.334658][ T5907] bridge_slave_1: left allmulticast mode [ 1579.334688][ T5907] bridge_slave_1: left promiscuous mode [ 1579.334937][ T5907] bridge0: port 2(bridge_slave_1) entered disabled state [ 1579.497955][ T5907] bridge_slave_0: left allmulticast mode [ 1579.497988][ T5907] bridge_slave_0: left promiscuous mode [ 1579.498191][ T5907] bridge0: port 1(bridge_slave_0) entered disabled state [ 1580.297732][ T5907] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1580.377942][ T5907] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1580.420948][ T5907] bond0 (unregistering): Released all slaves [ 1580.759242][ T5907] IPVS: stopping master sync thread 30373 ... [ 1581.682370][ T5907] hsr_slave_0: left promiscuous mode [ 1581.723945][ T5907] hsr_slave_1: left promiscuous mode [ 1581.724742][ T5907] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1581.724763][ T5907] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1581.763720][ T5907] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1581.763746][ T5907] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1581.843361][ T5907] veth1_macvtap: left promiscuous mode [ 1581.843428][ T5907] veth0_macvtap: left promiscuous mode [ 1581.843627][ T5907] veth1_vlan: left promiscuous mode [ 1581.843737][ T5907] veth0_vlan: left promiscuous mode [ 1582.546159][ T5907] team0 (unregistering): Port device team_slave_1 removed [ 1582.587138][ T5907] team0 (unregistering): Port device team_slave_0 removed [ 1584.103173][ T5907] IPVS: stop unused estimator thread 0... [ 1584.404196][ T5907] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1584.695185][ T5907] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1584.978883][ T5907] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0