last executing test programs: 2m38.447598949s ago: executing program 0 (id=1523): getresuid(0x0, 0x0, &(0x7f0000000280)) unshare(0x2a020400) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000640)=ANY=[@ANYBLOB="2000000069000b000000000000000000000000150000000008000180"], 0x20}}, 0x0) socket$inet6(0xa, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xfffff000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x101302, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r4, 0xc00caee0, &(0x7f0000000100)={0x4, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r5, 0x4018aee1, &(0x7f00000001c0)=@attr_other={0x0, 0x1, 0x2, 0x0}) socket$inet6_udp(0xa, 0x2, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000300)=ANY=[@ANYBLOB="3800000010000104fcffffffffdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="03150000000000001800128008000100707070000c00028008000100", @ANYRES32, @ANYBLOB="79ae826f905cf73d3a7fdeb9c657a180f90aa691ee2516e9676bd1ac804f42c77c6a195cd066988948d2492bc306acb7671f3df69663075f9755cb11a5372c9501d779bdd8572471851c2865de176085b34fccf8919eb96db23b487aa549b9c0aef1cc87ae410a209d01341db753f2bdfa8714cf2e4b22b4ee500d5ca17e8f429be6a7114c5d03077cc7633a4e30250de83370a3f9ca46ef3401d674ff1f91f9b4f940967cc66a46c08a47bebb5927d26ad15adbfd14d1a633c8e990968bf75594d3"], 0x38}, 0x1, 0x0, 0x0, 0x2004d808}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000500)=@newlink={0x68, 0x10, 0x1, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x48, 0x12, 0x0, 0x1, @ip6gretap={{0xe}, {0x34, 0x2, 0x0, 0x1, [@IFLA_GRE_REMOTE={0x14, 0x7, @local}, @IFLA_GRE_LOCAL={0x14, 0x6, @dev={0xfe, 0x80, '\x00', 0x15}}, @IFLA_GRE_LINK={0x8, 0x1, r8}]}}}]}, 0x68}}, 0x0) 2m36.399789437s ago: executing program 0 (id=1533): openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) (async) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f0000000000), 0x0, 0x40010021, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0x6, 0xfffffffb, 0xffffffff}, 0x0) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x1, 0x400) ioctl$DRM_IOCTL_WAIT_VBLANK(r2, 0xc018643a, &(0x7f0000000040)={0x4000000, 0x400000}) (async) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f0000000140)={0x1, [0x0]}, &(0x7f0000000240)=0x8) sendmsg$inet_sctp(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f00000001c0)='F', 0x34000}], 0x1, &(0x7f00000011c0)=ANY=[@ANYBLOB="200000000000000084000000020000000a000400280000000b000002c8dbc96498c1fbcb3c4e8da619f154b87676ed60485774443b8effcdfe6f7bc2a51839bbd11688627422c1dcad2cecff56c79965", @ANYRES32=r3], 0x20, 0x2400e044}, 0x0) (async) syz_clone3(&(0x7f0000000400)={0x0, 0x0, 0x0, &(0x7f0000000140), {0x37}, 0x0, 0x0, 0x0, 0x0}, 0x58) (async) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r4, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, '\x00', 0x1c}, 0xd}, 0x1c) (async) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r4, 0x4048587b, &(0x7f0000000580)={{r2, &(0x7f0000000000)='\x00', 0x200000, &(0x7f0000000300)={@_ha_fsid={[0x4c4158af, 0x1fef8d7d]}, {0x8, 0x5, 0x3ff, 0xd}}, 0x5, &(0x7f0000000340), &(0x7f0000000380)=0x5}, 0x2, &(0x7f0000000540)=[{0x2, 0x1, &(0x7f00000003c0)='/\x00', &(0x7f0000001240)="e0add01e5351e59be6708a1a598838c7db049c62d74fdf6c77d827c2bcaf774f6a114051e31dca7954a9df485e23e641a4b1773a21e89749bb453991981e76447c934ccb770cae7cdf24816bf26bf2147e00c87a16762f8b565b9457e90668ec46b80a20c9d0af07ca843956b88a15eae77fd199fd2fe250e0c138b13ea146c52c5105caded30f32c3341630a4112771a76ace7340485bd6c9b3a98cfa619a9e6c386d24b6ce95d65382f819636d939fdb9330b4abe67fffcb3f524b290812805796add557c3059bbee28af32e5cfd0bbe1812f7f87918ab2ee622baf810048eb3347a0acf53a1eea8db531bf6d4b4d4ffc81f99b23abc44fedd5f3d3e7c301ce78ef0940169661c37d5f557bb47fb14a9835f62fd5f5f0550028ed30dfb3fb86e484aacf5c76a174f758a9083903e28ef613597311218067ea7c0c5407062af76f6f026f140ce678d065ef1a05232bd5d03412f2a1b38a6306a11c361752f6feaf152b79f009b4371071663bff71ee4301074ee1162efa76479d818f905fd4c5db85ac534d11b33853757d1eda10686883b11397f4e5a5888a881c5b7094e2f4a6870bbb757b9953b0adc49611d962ebfa2c281d1968a980049a999a532421e9b9ea0cc5ea857079d8435b38fe7cbede9abb4702e13329fb5c87ff575751c020aa8dc9cbba941d79211653c751f41dba1925303667051b635b0a95f29118fb953bea912c842f4d7f58f9641d02c43078d2db76df952b5c41c6886e81915757495abaaee63fc36bb102a870c56daa0eafb1c280047dc8050c00f83f5eb46648d6e005d42911e31e2c03261e53783d828c3e98a0a161a772b7928857dea2701136a2e2294800fb61e17bb846b4c993c0a7387542a077e6d121c99c9d213364789f67161570bdcdc435144c2373cdf47a2fdd4f27cadcc1ad778bfc9f0ef63e58219d50788452ecb397c0a137330a91dcd2f12e38732e6e20ff0d062c54fc909dce7c9c28b51809e551c39a06124bb1d2a9d6c389dfc41f838c9d6367354d6adf83eef7693433e46f5d4ccf823069ce6c36cd81c1ce5167f0b8a3c9e5f9d10beae140fb70ad1fb47a4392dc90cccbdb06a4d847254f84742c01648dbc04ae3ad9b9e3a020e31ffee73a7a65bb5441721338da7a3a3687ba864a132e4801d5a69541f7627f753e8ca292c142a7acaa01a63568d9a0f7c4e622fc01f70a06168a0c0b6b47e8b737c37af016e8040c4e53cab96ca9020f4e0150721a58f92678b52ab53be3349f17296bd87a6294d63515f37ea2c09926a24e35aeb120903a79f8ebd98eefbe4bd7c34a8ded6b06943212143865b0431a37ed5fba38ecd74e85f1908be82ca8288cd2a5416063422bd6eae3aed5bb8d4ee402802cff552996722077ae2f8326d6e18747e6f20a723145b5c36334f29f5e29d96ce9d5591b02c55cb312cdd94d3749eabbb166786ff7c333e7d50d69088a05c9348eee2c76f3f0fdc4c09ed50d1fc4f4fdf454cfc6aa716d0974753ab3122639fa43b269cd02a60192cdc6a435e4daa523a76066f5a9f5f360ae672798d68a49fffdad573548b595a6e21ffa06252702558be566140cca5702ded6e2177de29405317885799563a59d15641b8f41c2a9b2531a9b1e66c07764dc87bbe7a2572c257cc0b9c1593c7dfcd37486e9bb19b07a38d4cf8418780c752a623f911fe34a8aed164549a9144358b71a9f084415a9decb728fa1a0e246a8d8f12acd101f6df46ede0d9475905f7a5ac4eb3c3b0cb847a47912c8f79aec4054fd575df3a89f0ed3d38119687fade760b3ad86f23add713d8b1c9c25a4922fb441065c6b957ad9b8b782dd5c9861025471262e1083eb2af828e44eb2a5d3a7ab9428a4d12f58818b67bbf5041550e0f87bee6ee6f69587370344aa36d10248605f8862874cdb5dd7714660c6a5d0d4a199d7c4b89b049d82da3e23f113cc3a7f2935498aa94313ca19917ab237a410e68ef7d5277cd9ce7fa723d9bb1786de779f9e4206fc48f3c581629cf41d55c95c3f0731163f09cef6bf68666b5ae2a355bd258eae914cbc7c2feec5aa927407e0625af6c8d35e3a91c51a41880cdefcb5602c9e4645762be9147ba61a561d0bd4bc25c9e4397b367ed172d3d99b83ce2d1b5e11de893266f8d5194d42e086c5df44aba325c6e32cec4eea254b8a93d65d20f6c7cedf8a87ba2a626b1217352e17e0e93ee94e4abc4a2c09bea4477c0fd81ffe75122314181a4d428ac0e32d71c72ebaff9668773f7395d9fd4ac9d8b425eb0b4c88c0638f6c902e576f83841516499cbfbc71f89cb44fd13e340a8db5d21aa261da71cf837bbf413224fee88cd95436451e8f97476899d04bfc1f41288611321a0b61771d80e964367fbcaa44a51bc5731cac2ff0542c770c82e77df43083d7edcb602f076c5de4b11bf101c4c35fb34aa5b0f6c891d233eb90019542ded289c8e95cd89fa3273ebfb52da9f460c0ef6e60eff7d9367432d27691bae9839093d811106ef7f73892cc0057986742a3f5092b9ef36b3bc85921b54f65a1381ed5bb967041c033218893398ee35af0ec294aed78be460a39cc034d68c01e1f42be094e4742b98a47c07f4f03c1d6d4b34c3971ca7ac8812d164a15bd33826f2e8cbe9825674b1304af427ce8a14977d3720d875641a11a893c43fc01b348561c960855274bb144471d3dc6950ce2270848b2f5b59cc7ac600df3e7f8968420f1f90774670122af148ee4514d0039947480290090f8be20d583ab0782051a942d8e5ccff809f761aa9d4da263bc2f9e18588078cffdb1d1aa71e5d4e83b70edf8994de3f8c4c0e2335cf62344128bd1d6b7b145b32b5836d6f0f9c73c0c1183ff12f66aa9d3bd5a990126efcc5b17288ad1ba171adf55a76f9efe26f30aee146832a39a684b6f9b1a9df3b42947561383159e8ef4aae3954d730090188b98bb2d8a6f805394976a75efd6695a74a4ca450ca242c97db18afd2b9a1ad2d1fee222c52ab2a421639d9a6a593a9c7302d71ad1b2758b42538a0d29eadd00cefe7a6e9b30dd11edfbcb7ce44e5b312fcb394f4b7f469fe395dd4e05c17542a4e4f2157d5ae609cda714fefacee7057a6db2dbe19f6feba684b87901c9be3a012624afb108f97410554e4f2cf32e9ba71b5420ed3aceb884ce4732d8c14830198e4a307a23023853796112dca6e4bd7514d5144da7dd8b303d5ac28f4915646ca89d03e0b312bcd0bc31ab0d70b67170a12d49723fa28aaa37e9d1a5940e5dc08b9b00689d1a46223ba38c10baff28b7ce4dd7a2d8649130ed41df062e05597c26389d5bfefb67845e0ad3fd283e4a0cec699a8beb5f882cdb1bad4856682443f8355e1d1db2a1b164fa2dc93be1a33a14a2d72bf0b9a61f6d2be6cc1fa8a04dab21acc66822b75b857502906369b05bcfea93b988a98b67f835978021b72b4f4f0de74899b689497dedadcd44d5471979a84e5eef2550c25ed42b39108c1a97e99c3f8a89b4d736b98957cb8eb25f8378f996ad386f3b152ade7a8318f4d1d40d37ea2932621a79d9156460af565512308682f36fe8af000fe96f16b49f8b319606de2bb21edebddf41e9a6e08615ae011d1d2cf1541b6af181c5460502bb8c04deaba63227ac820bd2771f4807ba8d6e93f380d15d07f7f3d62571e5a33aa995b6e72596c1295223109ec5397217d54e0ce04e91b226cfcb250bcdb4643a5b80eb8c80f695233587742cc42822c33b7c8307182438820758d4992bf02eec915e7cd58ac668f515ba87c9ea7048fff6513e374b455cdd9ae0c2f813307be54906ed750339dc4e22c26e157df98c2bc009840a899b53344ad47b0937d817a7360b9c7d69019346c46ff93e8473bcff1d6ef46de20015072ab0c6b332988f815dfde794d78a4a4d36d0a7b2c8ee5a249d0d4c73696fd255a057271b35e5f20b3a1455f3ede969a64614fed43dfdca19e8e471f86d9badb563665853b3551a874bc2b0ce2616656460b930beb87490a9d6e035bbd674faac7ad94ebb3867781148c79f0e168319b0815916b2cc5693185f8eba048ef3220156bce5afd7eaadeeb07241ed93615e82d30176328c7425d4eb78da6dbc23813f6b2f5919c0d285e34ed67ceba4226a6acdbae4e5442b28d6aadf362fbdef57a9d267899df7efd9c5162eee8a2646bce12ba5c4b020517a88d1b2a1696052b209194e6fb67bd61dc024056791284c3d14a934f24445198b51bbd8e2c86e12b7b2b3f056b55e3d13faaa4f1bbad614c7608cafc35716ac48db414891911d7115a2356c7837e480099963aaf4950d2ff91bc39df4e4600b2d1b74e252a4e3033a3c052a4037f4ca0861f385240c822262d47eecce13d265b4adf035696df685518a9f4f33c3d7bd5674a70eda6efe489f7475804dbf5a9ebc9a51df5a927dff2219b06ac82d776bd1d4be565cd5c6add1dfd0a8968c806df04bffcd9f7eeee77cc98464c6cc378f3fb1e9ba2480afe3d0134b3d967851c89d1341e2c9fdccf13a625e93e066dae755c27c61b65bc67f18b9ccf3065ec76a07bf03131f3d2be86d7cac50a18274848bc619bd4f325ff585f7808d7b33ee9ea9593ca71c7fc560ce446d7dce1e3464061ca038ae6d9ed707dd6d3bba3135972d1a5be876670022e262515f97e697929191e22ebda4caf9cf4864a371e62160bbd9a2e7b57e20605433e04ea72ccc87a25317115fbbb68659feac0e58c4abb1c925d0f7f3160c97298d95359ff0bc61e712abd7ca30f840d2886b47020ca221e1f381f38233cec09e4fcbac9b73955c99f6beb7d3387be7a5782eaf4f062b3175cac9205eba7164533546390c49e1aae53c1ea09bc595545bed72b5237f30d83906922f75faf59a904aec99e8dedfd9e9d5dae0f0e080e6a1bbcb7556bcbd7e0fa5513676454ef8806f66a2a2ee396548c8215500a2ae7a7b407e12833e06aa69674ef41b0b65e134e116e9973c067471f83fa992b0a23fcb9c0f526312395d4ab0ebd6585c4cf670ea34e6c9a2210f5c33494a62acadcd040e08161fb838022b635493881df78cf2d896d469edcc4f20efdf0a88ddca6d74fd68e282ec4647d95e3c09d9cdde6e390dfef2b3a6f1cfac6364ecb2c92ac407b63d589cb6acf53d385b3d78e7b20de317e4d37ef69cabcb459e76988f63c7ec61ddb080fb7ec2681ed9015cb63bb613ba926ee743c023a3794ffd2cd0dcd438d222045cdebfa648e571781e924ae6defb3cb678fb3c974ce0156c8e7443951f15cb2a49437d9c743ba535836edfa2f062268392ce188f42be0bae0c3ce320c861180d3f234c39b14895c0d3ef9a2b33ffa544eecabd466c53216384baef35f4802ebd51f9049387c3daf9a75fb1dc922a2fefb93e099f2fc712a2322edb65a03ded3b35911c38ce6f5658778e851b49b06eb9a8844cc3d8351093c5e8138d8473660208487c65a86d86eb8a5e4e88b1e27b3700b7504c547986ea677894e63ba649a933f94e2eda084beb43c2ec0d365905c54f24493e972f5718d243d1715657bb66b9a05748856e3d43f4c8efb7fbdca074ed5d7311158f2028cd034c95b4bfb8fb3392f589597461330339780661ce07c2050930a6b8f4cd3ba906d32d7f3a324eb32b2d1e8acee397a05d34d1d4dab2669dee90078322f3786e0f46852b2f017599be0f9e5a1bde6a688d9146660e9a144720de3175dfe921866933e608b6b4d8c41fa2e64cfe72a76e8a558f80d11a079c31c2ee7962b4dbda284663985d9f86ac76ac094470fd88e", 0x1000, 0x2}, {0x3, 0x6, &(0x7f0000000480)='/dev/dri/card#\x00', &(0x7f00000004c0)="9005bb7c2f1e7bf3ea63b17393b9f2bc9587e9b5d0d4e1ebcfe5de81729ac2c9e1a14b134de493a149afd405fef46b46f05c0708d035b5508aa521342be87f18ff01b3e7f158d772664a1ebb2ef26d9c0c459ed3c154475ff88285478c621bf3", 0x60, 0x30}]}) (async) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000680)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000640)={0xffffffffffffffff}, 0x111, 0x9}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r5, &(0x7f00000006c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000600), 0x0, r6, 0x10, 0x1, @ib={0x1b, 0xd8, 0x96e, {"21ca108166c34403ea9c56a3fbd9df8b"}, 0x6, 0xfffffffffffffff9, 0x2}}}, 0xa0) (async) recvmmsg(r4, &(0x7f00000002c0), 0x220, 0x100, 0x0) (async) r7 = openat$kvm(0x0, &(0x7f00000002c0), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) ioctl$KVM_CAP_X2APIC_API(r8, 0x4068aea3, &(0x7f0000000140)={0x81, 0x0, 0x1}) ioctl$KVM_CAP_SPLIT_IRQCHIP(r8, 0x4068aea3, &(0x7f00000000c0)={0x79, 0x0, 0x1}) (async) r9 = eventfd2(0x200202, 0x0) capset(&(0x7f0000000080)={0x20080522}, &(0x7f0000000040)={0xffff, 0x10ffff, 0xfffffffd}) (async) prctl$PR_CAP_AMBIENT(0x2f, 0x2, 0x0) (async) ioctl$KVM_IRQFD(r8, 0x4020ae76, &(0x7f0000000080)={0xffffffffffffffff, 0x6, 0x0, r5}) (async) select(0x40, &(0x7f0000000400)={0x9, 0x3, 0x80000000, 0x0, 0x7, 0x201}, 0x0, 0x0, &(0x7f0000000100)={0x0, 0xea60}) (async) close(0x3) (async) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) (async) write$eventfd(r9, &(0x7f0000000080)=0x430f, 0x8) 2m36.007645427s ago: executing program 0 (id=1534): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000006c0)=@newlink={0x44, 0x10, 0x437, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x40409, 0x21000}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @gtp={{0x8}, {0x18, 0x2, 0x0, 0x1, [@IFLA_GTP_LOCAL6={0x14, 0x8, @ipv4={'\x00', '\xff\xff', @empty}}]}}}]}, 0x44}}, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000ac0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=ANY=[@ANYBLOB="3c0200001900010000000000fbdbdf25e0000001000000000000000000000000ac1414bb00ffffff80000000000000000000000bffff00000a00800000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000008401050064010100000000000000000000000000000000003c00000000000000ffffffff000000000000000000000000ff34000000000000000000000000000000000000ac1414aa000000000000000000000000000000003c00000000000000fe800000000000000000000000000000010000000000000000080000000800000000000000000000000000000000000000000001000000003200000000000000e00000010000000000000000000000000335000003000000000000000000000000000000ff0100000000000000000000000000010000000033000000000000000a010101000000000000000000000000073500000000010002000000bf0a00000000000000000000000000000000000000000001000004d433"], 0x23c}}, 0x0) 2m35.883391429s ago: executing program 0 (id=1535): syz_usb_connect(0x0, 0x4a, &(0x7f0000000040)=ANY=[@ANYBLOB="120100005520f010402038b1420104000001090238000100000000090400000300000000090526eb"], 0x0) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x20d036, 0x0, 0x0, 0x0, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x2) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, 0x0, 0x41) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000003c0)=ANY=[@ANYBLOB="400000009d3e94fefb350e3c80000000021810000000fd010000000008000100ac411400080005000a01fe48b5bba2a7ad6eef73ef143601020c00168008c2608e351faee1b351861c000100022dd48bc6b19edc6a8228894b0dc8e7f10000000600"], 0x40}, 0x1, 0x0, 0x0, 0x4}, 0x0) mount$fuse(0x0, &(0x7f0000000280)='./file0\x00', 0x0, 0x100000, 0x0) pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f0000000340)='./file0\x00') ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(r0, 0xc0189374, &(0x7f0000000180)={{0x1, 0x1, 0x18, r2, {0x2}}, './file0\x00'}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r1, 0x89f3, &(0x7f0000000300)={'syztnl2\x00', &(0x7f00000001c0)={'ip6gre0\x00', 0x0, 0x29, 0xa8, 0x8, 0x2, 0x3, @ipv4={'\x00', '\xff\xff', @local}, @loopback, 0x8711, 0x8, 0x6, 0x310}}) setsockopt$inet6_mreq(r3, 0x29, 0x13, &(0x7f0000000380)={@ipv4={'\x00', '\xff\xff', @multicast2}, r4}, 0x14) r5 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000), 0x800, 0x0) setsockopt$inet6_tcp_TCP_ULP(r5, 0x6, 0x1f, &(0x7f0000000080), 0x3) 2m33.952036642s ago: executing program 0 (id=1543): modify_ldt$write(0x1, &(0x7f0000000200)={0x5, 0xffffffffffffffff, 0x4000, 0x1, 0x0, 0x1, 0x1}, 0x10) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000040)={0x3, 0x8003}, 0x4) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000000)=0x9, 0x4) r2 = add_key$keyring(&(0x7f0000000100), &(0x7f00000001c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) add_key(&(0x7f0000000080)='encrypted\x00', &(0x7f00000000c0)={'syz', 0x2}, 0x0, 0x0, r2) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'ip6_vti0\x00', 0x0}) sendto$packet(r1, &(0x7f0000000180)="10030600e0ff020004004788aa96a13bb100001100007fca1a00", 0x10608, 0x0, &(0x7f0000000140)={0x11, 0x0, r3}, 0x14) 2m31.163780229s ago: executing program 0 (id=1555): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) (async) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) (async) pivot_root(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000400)='./file0\x00') (async) ioctl$SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, &(0x7f0000000080)={0x1, "0600000000000000c64c3b6e6ff82a75e5318fca4288c2ffbdbec772020acd2c"}) (async) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB="500000000308010100000000000000000000000006000240000000002c5411"], 0x50}}, 0x0) syz_emit_ethernet(0x6e, &(0x7f0000000040)=ANY=[@ANYBLOB="0180c2000002aaaaaaaaaaaa08004500006000000000002f9078640101000000000024806558000000000000000010000800000086dd"], 0x0) (async) r2 = socket$kcm(0x10, 0x2, 0x10) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000040900010073797a30000000009c000000090a010400000000000000000700000308000a40000000000900020073797a30000000000900010073797a3000000000080005400000000d58001280200001800e000100636f6e6e6c696d69740000000c0002800800014000000008200001800e000100636f6e6e6c696d69740000000c00028008000140000000001400017b090001006cdbf80789f3f947dd000280080003"], 0xe4}, 0x1, 0x0, 0x0, 0x48041}, 0x20050881) (async) sendmsg$kcm(r2, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704020180fc5409000c00", 0x33fe0}], 0x1}, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x27159a6a, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xea11, 0xffffffff}, 0x0) (async) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r3, 0x107, 0xd, &(0x7f0000000380)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) (async) sendmmsg(r3, &(0x7f0000001d40)=[{{&(0x7f0000001980)=@llc={0x1a, 0x305, 0x3c, 0x0, 0x0, 0x8, @broadcast}, 0x80, 0x0}}], 0x1, 0x9d27540c657c8cc4) (async) r4 = openat$vimc1(0xffffff9c, 0x0, 0x2, 0x0) ioctl$VIDIOC_TRY_FMT(r4, 0xc0cc5640, &(0x7f00000000c0)={0x2, @sdr={0x32314d54, 0x4010001}}) (async) r5 = syz_open_dev$dri(&(0x7f0000000000), 0x1ff, 0x0) r6 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=@gettaction={0x5c, 0x32, 0x1, 0x70bd29, 0x25dfdbfe, {}, [@action_gd=@TCA_ACT_TAB={0x20, 0x1, [{0xc, 0x1, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x5}}, {0x10, 0x5, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'csum\x00'}}]}, @action_gd=@TCA_ACT_TAB={0x28, 0x1, [{0xc, 0x1, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x5}}, {0xc, 0x8, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x10001}}, {0xc, 0x22, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x9}}]}]}, 0x5c}}, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000200)={0x8000, 0x2f, 0x4}) syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) (async) r7 = socket$inet6(0xa, 0x2, 0x0) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$sock_timeval(r8, 0x1, 0x3c, &(0x7f0000000100), &(0x7f0000000140)=0x10) (async) close(0x3) (async) socket$l2tp6(0xa, 0x2, 0x73) (async) setsockopt$inet6_int(r7, 0x29, 0x1000000000021, 0x0, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) 2m30.363863864s ago: executing program 32 (id=1555): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) (async) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) (async) pivot_root(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000400)='./file0\x00') (async) ioctl$SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, &(0x7f0000000080)={0x1, "0600000000000000c64c3b6e6ff82a75e5318fca4288c2ffbdbec772020acd2c"}) (async) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB="500000000308010100000000000000000000000006000240000000002c5411"], 0x50}}, 0x0) syz_emit_ethernet(0x6e, &(0x7f0000000040)=ANY=[@ANYBLOB="0180c2000002aaaaaaaaaaaa08004500006000000000002f9078640101000000000024806558000000000000000010000800000086dd"], 0x0) (async) r2 = socket$kcm(0x10, 0x2, 0x10) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000040900010073797a30000000009c000000090a010400000000000000000700000308000a40000000000900020073797a30000000000900010073797a3000000000080005400000000d58001280200001800e000100636f6e6e6c696d69740000000c0002800800014000000008200001800e000100636f6e6e6c696d69740000000c00028008000140000000001400017b090001006cdbf80789f3f947dd000280080003"], 0xe4}, 0x1, 0x0, 0x0, 0x48041}, 0x20050881) (async) sendmsg$kcm(r2, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704020180fc5409000c00", 0x33fe0}], 0x1}, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x27159a6a, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xea11, 0xffffffff}, 0x0) (async) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r3, 0x107, 0xd, &(0x7f0000000380)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) (async) sendmmsg(r3, &(0x7f0000001d40)=[{{&(0x7f0000001980)=@llc={0x1a, 0x305, 0x3c, 0x0, 0x0, 0x8, @broadcast}, 0x80, 0x0}}], 0x1, 0x9d27540c657c8cc4) (async) r4 = openat$vimc1(0xffffff9c, 0x0, 0x2, 0x0) ioctl$VIDIOC_TRY_FMT(r4, 0xc0cc5640, &(0x7f00000000c0)={0x2, @sdr={0x32314d54, 0x4010001}}) (async) r5 = syz_open_dev$dri(&(0x7f0000000000), 0x1ff, 0x0) r6 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=@gettaction={0x5c, 0x32, 0x1, 0x70bd29, 0x25dfdbfe, {}, [@action_gd=@TCA_ACT_TAB={0x20, 0x1, [{0xc, 0x1, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x5}}, {0x10, 0x5, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'csum\x00'}}]}, @action_gd=@TCA_ACT_TAB={0x28, 0x1, [{0xc, 0x1, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x5}}, {0xc, 0x8, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x10001}}, {0xc, 0x22, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x9}}]}]}, 0x5c}}, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000200)={0x8000, 0x2f, 0x4}) syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) (async) r7 = socket$inet6(0xa, 0x2, 0x0) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$sock_timeval(r8, 0x1, 0x3c, &(0x7f0000000100), &(0x7f0000000140)=0x10) (async) close(0x3) (async) socket$l2tp6(0xa, 0x2, 0x73) (async) setsockopt$inet6_int(r7, 0x29, 0x1000000000021, 0x0, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) 1m5.08035542s ago: executing program 1 (id=1836): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000006c0)=@newlink={0x44, 0x10, 0x437, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x40409, 0x21000}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @gtp={{0x8}, {0x18, 0x2, 0x0, 0x1, [@IFLA_GTP_LOCAL6={0x14, 0x8, @ipv4={'\x00', '\xff\xff', @empty}}]}}}]}, 0x44}}, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000ac0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=ANY=[@ANYBLOB="3c0200001900010000000000fbdbdf25e0000001000000000000000000000000ac1414bb0000000003000000000000000000000bffff00000a00800000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000008401050064010100000000000000000000000000000000003c00000000000000ffffffff000000000000000000000000ff34000000000000000000000000000000000000ac1414aa000000000000000000000000000000003c00000000000000fe800000000000000000000000000000010000000000000000080000000800000000000000000000000000000000000000000001000000003200000000000000e00000010000000000000000000000000335000003000000000000000000000000000000ff0100000000000000000000000000010000000033000000000000000a010101000000000000000000000000073500000000010002000000bf0a00000000000000000000000000000000000000000001000004d433"], 0x23c}}, 0x0) 1m4.926596218s ago: executing program 1 (id=1837): r0 = socket$nl_generic(0x10, 0x3, 0x10) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) r1 = socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_tcp_int(r4, 0x6, 0x24, &(0x7f0000000000)=0x1, 0x4) connect$inet6(r4, &(0x7f0000000180)={0xa, 0x4001, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0xd}, 0x1c) recvmmsg(r4, &(0x7f0000002340)=[{{0x0, 0x0, 0x0}, 0x4}], 0x1, 0x10001, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x8, 0x81, 0x0, 0x9, 0xfffffffffffffffd, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000380)=@IORING_OP_SENDMSG={0x9, 0x0, 0x0, r6, 0x0, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[], 0xc48}, 0x0, 0xe3d08660d3cd4684}) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4044001}, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r7, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="041620488823354f841e0000000201014600b4c0447c00e5ffffff00baf11b01321d302b5068206d"], 0x14}}, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)={0x3c, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0xc, 0x3, 'hash:ip\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x1}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4004000}, 0x40080) socket$nl_netfilter(0x10, 0x3, 0xc) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r9, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)={0x4b, 0x4, 0x6, 0x301}, 0x1c}}, 0x0) r10 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r10, 0x1, &(0x7f0000000000)='source', &(0x7f0000000100)='0..:\x00', 0x0) r11 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), r0) r12 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r12, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03400000000000000000010000000900010073797a300000000040000000160a07000000000000000000010000000900010073797a30000000000900020073797a3000000000140003800800024000000000080001400000000038000000160a09010000000000000000010000000900020073797a30000000000900010073797a300000000008000740000000000400038014000000110001"], 0xc0}}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r12, 0x8933, &(0x7f0000000040)={'wlan0\x00'}) sendmsg$NL80211_CMD_NEW_INTERFACE(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r11, @ANYBLOB="090d2000000000f0ff000700000008000300", @ANYRES32=r5, @ANYBLOB="0800051d000000001400060076657468115f746f5f7465616d0000000400cc000800050007000000140004"], 0x58}}, 0x0) 1m3.085357166s ago: executing program 1 (id=1845): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000280)={'vcan0\x00', 0x0}) bind$can_j1939(r1, &(0x7f0000000100)={0x1d, r2, 0x0, {}, 0xfd}, 0x18) connect$can_j1939(r1, &(0x7f0000000080)={0x1d, r2, 0x0, {0x0, 0x0, 0x2}, 0xfe}, 0x18) sendmmsg(r1, &(0x7f0000007e00)=[{{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f0000000680)="72e78ed8ea182f07e208020b94c5a565b5b75c239f24de2af2254e6801ad10a504c9673fe476206c42f9c293c8f4685e969bb14f8d51f465f9700fe718eff6a8110229780c815ed8bde7744fcaf616ec9ef272db0d2fcbb4cc8e4ad0b0afbfc10e1e360f596953b71c3001e22b97f9fd4acaadf57b7c414cff804d49d6783fd2ac9b8e8e6ba440ef7a996c0a240ec4c8c25149e0cbb654cb449bb8c7ea5567ef6883bcd8bc04c4838d2211ca2687dd1ad29a1bcb8a479536c5d7163fd8530d51fedbb9f0", 0xc4}, {&(0x7f0000000780)="f9d82cd2e772d7c6f108a70819599a6596bb07740de6d7f52390ac4a6ab4d1afeddc05796108b0eb836a97384551c03245e859401bbb52d854edb339880134fd66e3b63a0359d016cc0a914e509eafad001e", 0x52}, {&(0x7f00000002c0)="4c7a59a69f736a0223eb082806d90a0545d8c07547421f564fccb02a59b5643a8ac6847500", 0x25}, {&(0x7f0000000800)="e5014e2bd2e809712aff71c8d6d9e430c0fb011744bf2a03a54319fc28ba5a5b459d62a1e3c871909ef8bc0ab372164efb9d72cdaba898571888a4f9ab33e67d27f16b848e92c4ab8e77f8a4aee2c5ba00f14447168477da7f46cec78ba1ba82afa722f98ef9786a5bc94acec93122d3b8bf00c49ff2f09958bd4efeb0adad7dc5b3b8ee27a79ba1baf07276499ec5aca13e69a14892ecc62ce4163811d461389a43e561bc24e2ca52cc094ed6f69f97675a8c8e4b3967e582e43066b8ce80315d1c312ea8cbbdca08a866d1d65e4236d49c8e7283e10a169cd68242e3565ce176f3b42c594a", 0xe6}, {&(0x7f0000000900)="26fa1d33094c7d4f25dc8ee678ff7e07f8c2514844273470a181f5ca8a5d9f4986bffb1ed03a497aed7b9fbf22d9cee4118e4ab2ef08eb13c9fd0dac0a658fb95c9f3c9b4d99844e6bebcaa391d81694685ffcef29928290f56006959f11f6edb339f387fd274c779800529c7e896cbc90a171b030419e77e76694120d9a637971b9a9d5bb6c6f4e3df2f2aa3db93a78790059273285d9efe8c1e3f036eceee4226a437a2ceffa7c460002c49fe76d4e557e00e1eddfb5273aaa74c55657b4897e2df604c8292c7c35fbad4c128cd133d689e20adaba23248a6c56b5d21782b71c00fcf0ff64b6f734337006fcd80ec8e46257ed2b3410442696679e55c97dee62c78ae9eb6fb67bdb897034cd571c71b6498bc97e74004efe12b99460da072ff37c2de9818a78f4a2e7694e0ba518f221daacaf57593c7e78535e55f925329efadd98dc013fa69bc0ca1ca9d42fb20a13033faf064fbc6f5693f1a4ae961eef55dea73f0e80e14f4120babbfada9bbd72293aaae0e30d4dc6c3d23ba6efb36c2e58774a9561019979ffab543c113fa7926ee2642f16b20cb0dfd6ba1cce58323484b3cb3e81817762b66c8b898e0476891c167661aa16ebe7ca8f95894b75e447fa2de2a6a7dfa76c82c1f83c31d6fb5746b997be4ad8d49f2e8aa6c47ce79a7ea552132cad72e3254f0b49a56c6f3f061bb0a99e7c296aaf225a18a19e93fe3b5bacf5b3d7d54eaec7dffa8b1cf561049bd95f4b230af9603d46941698aae97a041f816915db5bdb8c5df3fc455cec5f5934fc6ab2e89525d090350bd6aec158f3b00bf18d2dd80dead640600fc109213cc0ef38e2b59a4fed2366df6ef0d804303648fc839ee14ce57a6aa32c9d17b2a726eb6642f083d136ea44199923217d6d470be42a5efac96583f51474d3c5fa790b67528174cb9786acb5bacccb9c46cf092ffdb4641df87b8268933262c1923173dd5ec11276d8694c0c9c807cb7b07ca3149eae22afeb3a670d1ff6080586b8ab5d24451fc70d0094cf929fab47b4011b74042e9816c792d9c760fef5619bd8cc8599069d5ba408404235935092aa4996dd9998f9706bb2e7f9ff0eece87d3c3c99d468ff10f9228c35513fa6748ffaa0a28877a03ff50d895821e7cc81725d0ffa3b8c3a66c83142300b7efd79ec5c4a336020a91dc896d68d0e1a9f9224afe0db3f02d2536e74892c0addfd24d1ab26ac5eee5e9124bf22f1befbe0a6228ffab5bcfdd29df4067adb45ab5b9093df90a776df37926b3b85f6e9328c45fc291d9e6420a8d74e27bb7c1a4713cea293550ca6f91c3596b32f80e56cd6de9f867e107fba23bbb1e91f30feb122b89f3970815e40105396922446e6383eeee1ea2783f7abfce873be750efdd262375efe0240be25de98c7b854d1e0d1463db596664b8ab63a49f69e4cf595b83129e54fa30b061a7eff111094c9d0390ad9aec1c0f887b083e13bfb47714575f334e3aa1fe341b40f6b92ba1ac967273afeba48915eec614c406e7fb44ed508824a26c5703ba8ae6f60b5d37be79c7bbd04959d05e8b08a8b594022ae782ca119daedd0a593b31550801b4d6e1449003f02c0ab0b71d069e8bfce6a54388a69e45aab411164ca9859ae2a52f97621a197bbeac7dbfb5a5e745c63fb7091cc98f4e438ac350e2c92f8b5c125681b8cdb50340b63828eef5c946b23b91a0eefd545db0fd6cf7a941e9c70a02c54c35d9cc8d45fc625d6c44fc4e18a", 0x4d9}], 0x5}}], 0x1, 0x10000000) r3 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120100009f187620ef170372362e010203010902240001000010000904bc00029e8833000905020200020200000905820220"], 0x0) syz_usb_control_io$rtl8150(r3, 0x0, 0x0) syz_usb_control_io$rtl8150(r3, 0x0, &(0x7f00000029c0)={0x2c, &(0x7f0000000080)=ANY=[@ANYBLOB="200302"], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r3, 0x0, &(0x7f0000002640)={0x44, &(0x7f00000000c0)=ANY=[@ANYBLOB="080e02"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r3, 0x0, &(0x7f0000000a80)={0x44, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000840)={0x40, 0xb, 0x2, "31fb"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r3, 0x0, &(0x7f0000000000)={0x34, &(0x7f0000000040)=ANY=[@ANYBLOB="001602"], 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NFNL_MSG_COMPAT_GET(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000340)={0x28, 0x0, 0xb, 0x201, 0x0, 0x0, {0xa, 0x0, 0x9}, [@NFTA_COMPAT_NAME={0x11, 0x1, 'sched_switch\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x80}, 0x4040) 59.506831316s ago: executing program 1 (id=1855): bpf$MAP_CREATE(0x0, 0x0, 0x50) socket(0x23, 0x6, 0x1000) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x20d036, 0x0, 0x0, 0x0, 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) move_mount(r3, &(0x7f0000000140)='.\x00', r2, &(0x7f0000000300)='./file0\x00', 0x41) move_mount(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', r3, &(0x7f0000000100)='./file0\x00', 0x220) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, 0x0) ioctl$sock_FIOGETOWN(r0, 0x8903, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x100000001, 0xfffffe0000000001, 0xfa11, 0x65aa}, 0x0) r5 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000540)=@newtfilter={0x1c0, 0x2c, 0xf3f, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {0x2, 0xfff3}, {0x0, 0xfff3}, {0xb, 0x10}}, [@filter_kind_options=@f_basic={{0xa}, {0x190, 0x2, [@TCA_BASIC_ACT={0x18c, 0x3, [@m_vlan={0xe0, 0x1f, 0x0, 0x0, {{0x9}, {0x34, 0x2, 0x0, 0x1, [@TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x7b9}, @TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x88a8}, @TCA_VLAN_PUSH_VLAN_PRIORITY={0x5, 0x6, 0x3}, @TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x88a8}, @TCA_VLAN_PUSH_VLAN_PRIORITY={0x5, 0x6, 0x6}, @TCA_VLAN_PUSH_VLAN_PRIORITY={0x5, 0x6, 0x7}]}, {0x84, 0x6, "5a0ca25b7438c93246018f7c82a55b68a84eb3c64c14f5bdb3e75689c3512fcad0130f85654dca4d3e84da923d3cb1a96373aded8a837044fe3fd52e5a2690c87d84ab8c90fef034383b9bb884867930aa980cac9377b78749f1f1fed0ea5b718a4858ed29e37e4f6aa3f09976e62961c07626f5f240935fd35064c82087568a"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1, 0x1}}}}, @m_simple={0xa8, 0x2, 0x0, 0x0, {{0xb}, {0x1c, 0x2, 0x0, 0x1, [@TCA_DEF_PARMS={0x18, 0x2, {0x9, 0x78, 0x7, 0xffff5da7, 0x51}}]}, {0x63, 0x6, "59db8befdd5ced65b75df50bc3298588152f96f14a73a773260d8a9af71b6f9029a4f507cd500b433b3e12a7f4a3748b52dc45e5c4a00737edbf8a7c88e083e912a80e8caf88a1fb76f3e4753d1fe6e9f5c454778fc21232004c70a09d8c95"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3, 0x2}}}}]}]}}]}, 0x1c0}, 0x1, 0x0, 0x0, 0x20041090}, 0x0) r7 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) ioctl$AUTOFS_IOC_READY(r7, 0x541b, 0x20000000) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$KVM_GET_SUPPORTED_HV_CPUID_sys(r8, 0xc008aec1, &(0x7f0000000380)={0x6, 0x0, [{0x80000007, 0x8, 0x7, 0x8, 0x4256, 0xc3, 0xd7}, {0x4, 0x6, 0x6, 0x700000, 0x100, 0x2, 0x1ff}, {0x1, 0x56454c21, 0x3, 0x9, 0x81, 0x9, 0x7fff}, {0xd, 0x9, 0x4, 0xd76, 0x1000, 0x43b, 0x4e20}, {0x40000007, 0x0, 0x6, 0x3, 0x200040, 0x61f, 0x3cc3}, {0x40000001, 0x5, 0x0, 0xecb6, 0x3, 0x9, 0x3ff}]}) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0x0) execveat(0xffffffffffffff9c, &(0x7f0000000280)='./file2\x00', 0x0, 0x0, 0x0) syz_io_uring_setup(0x4955, &(0x7f0000000300)={0x0, 0xe1d6, 0x2, 0x2, 0x144}, 0x0, 0x0) r9 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r9, 0x29, 0x40, &(0x7f0000000f80)=@mangle={'mangle\x00', 0x2, 0x6, 0x5c0, 0x0, 0x190, 0x260, 0x420, 0x260, 0x4f0, 0x4f0, 0x4f0, 0x4f0, 0x4f0, 0x6, 0x0, {[{{@ipv6={@mcast1, @private1, [], [], 'bond_slave_0\x00', 'vlan1\x00', {}, {0xff}, 0x21}, 0x0, 0x168, 0x190, 0x0, {0x7a00000010000000}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @empty, @mcast2, @private2, [], [0xff000000, 0xffffffff, 0x0, 0xffffff00], [], 0x0, 0x10}}, @common=@inet=@dccp={{0x30}, {[0x4e21, 0x4e24], [0x4e23, 0x4e24], 0xd, 0x0, 0x4, 0x7}}]}, @HL={0x28}}, {{@ipv6={@mcast2, @dev={0xfe, 0x80, '\x00', 0x2}, [], [0x0, 0x0, 0x0, 0xffffff00], 'veth0_macvtap\x00', 'veth1_vlan\x00', {}, {}, 0x0, 0x0, 0x5}, 0x0, 0xa8, 0xd0}, @common=@inet=@TCPMSS={0x28}}, {{@ipv6={@ipv4, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [], [], 'bridge0\x00', 'sit0\x00', {0xff}}, 0x0, 0xa8, 0xd0, 0x48000000}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffc}}, {{@ipv6={@empty, @local, [0xff, 0x0, 0xff, 0xff000000], [0xff000000, 0xff000000, 0xffffffff, 0xffffff00], 'macvlan0\x00', 'veth1_to_bridge\x00', {}, {0xff}, 0x8, 0x81, 0x1, 0x36}, 0x0, 0xa8, 0xf0}, @SNPT={0x48, 'SNPT\x00', 0x0, {@ipv4, @ipv6=@private1, 0x0, 0x37}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @inet=@TOS={0x28, 'TOS\x00', 0x0, {0x50, 0x1}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x620) 58.386993924s ago: executing program 1 (id=1861): r0 = socket$inet6(0xa, 0x1, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000080)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x0}) request_key(&(0x7f0000000480)='keyring\x00', &(0x7f00000004c0)={'syz', 0x0}, 0x0, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f00000002c0)={@loopback={0xffffffffffffffa4}, 0x0, 0x0, 0x1, 0x3, 0x40, 0x8}, 0x20) 55.070322164s ago: executing program 1 (id=1875): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r1, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r1, 0xc04064a0, &(0x7f0000000d80)={0x0, 0x0, &(0x7f0000000d00)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(r1, 0xc05064a7, &(0x7f0000001000)={&(0x7f0000000e80)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000001140)=[{}, {}], &(0x7f0000000f80)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000fc0)=[0x0], 0x55, 0x6, 0x4, 0x0, r2}) sendmsg$nl_route(r0, &(0x7f0000000c80)={0x0, 0x0, &(0x7f0000000c40)={&(0x7f00000000c0)=@setlink={0x50, 0x13, 0x5, 0x70bd27, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0x0, 0x40601}, [@IFLA_IFNAME={0x14, 0x3, 'veth0_vlan\x00'}, @IFLA_VFINFO_LIST={0x1c, 0x16, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, [@IFLA_VF_IB_PORT_GUID={0x14, 0xb, {0xfffffff5, 0x6}}]}]}]}, 0x50}}, 0x48000) 54.915721496s ago: executing program 33 (id=1875): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r1, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r1, 0xc04064a0, &(0x7f0000000d80)={0x0, 0x0, &(0x7f0000000d00)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(r1, 0xc05064a7, &(0x7f0000001000)={&(0x7f0000000e80)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000001140)=[{}, {}], &(0x7f0000000f80)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000fc0)=[0x0], 0x55, 0x6, 0x4, 0x0, r2}) sendmsg$nl_route(r0, &(0x7f0000000c80)={0x0, 0x0, &(0x7f0000000c40)={&(0x7f00000000c0)=@setlink={0x50, 0x13, 0x5, 0x70bd27, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0x0, 0x40601}, [@IFLA_IFNAME={0x14, 0x3, 'veth0_vlan\x00'}, @IFLA_VFINFO_LIST={0x1c, 0x16, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, [@IFLA_VF_IB_PORT_GUID={0x14, 0xb, {0xfffffff5, 0x6}}]}]}]}, 0x50}}, 0x48000) 10.142081826s ago: executing program 2 (id=2019): r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x2c, &(0x7f0000000080)={[{0x28, 0x4e00, "1b338f1c68dd9d006cc5b6ca617122c0d2653759a91e87156bd276dbcb2babc086adbf26b2bef645"}]}) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x8c, &(0x7f00000000c0)={[{0x87, 0x4e00, "7e4bab97e74d81b01863da6e9d2f8e83b87812674133946b9495c2106f8265f2a6d24eb3dc395abcd0633fcdd8712fd1abb4b5e6dd9c7301a262ae228e28c26cbdc152e46aff255c3d9597ceb1ad93f3b6f0360cb7f8100c62563ab9994dd7dbad664fa2294b0c3256763822d75a121f57ea82d30f9c3151fdf0c53ac46b12992c489746520d35"}]}) syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x54, &(0x7f0000000180)=@generic={0x6, 0x0, 0x4c, "97532c97", "765bd8440240bf4126f4651d9258f0405ee8cb38f21b0c985a0d6f7202a47206172215464b8b50025567f5afdb6be3f9ee97f9c53b74c0e6cc60b2c66378c797843995d30608571841095e24"}) syz_usb_ep_read(r0, 0x8, 0x21, &(0x7f0000000200)=""/33) get_robust_list(0x0, &(0x7f0000000380)=&(0x7f0000000340)={&(0x7f0000000280)={&(0x7f0000000240)}, 0x0, &(0x7f0000000300)={&(0x7f00000002c0)}}, &(0x7f00000003c0)=0x18) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x110, &(0x7f0000000400)={[{0xcc, 0x4e00, "67c5392389420ac9ed11883f4f8848c341a8e0c693dea101c58924a4c49303787caf7541d225dda7e4723f6728c4409ee1a20c7d7cad3f141eef5ce5b2fabb3f3c83e85975c76f2241c8aedffa1ce8c4865919feae3555b35c259054027c32451ff061148bd47680bcb6526853489c515300ff001b050a17d17ff00b4e604ddfc049ee55c08b609ad915ca089d2785de29cb37bb498b53777a60feaf73f8026d6824c470eb6400be4faf93c7a235079063ac946bf66bda4213eedb47c8221f14ab4487efd9f009b3cd86a892"}, {0x3b, 0x4e00, "33e752082acd5d88abae7915ed52a86e0bfb7831d33a0e8377a19fdb9ff0b20032e5f1b5f3f31b8425fc1eb3ca5b91a7331d02183dcad1995fe918"}]}) r1 = syz_usb_connect$cdc_ecm(0x3, 0xf1, &(0x7f0000000540)={{0x12, 0x1, 0x310, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xdf, 0x1, 0x1, 0x3, 0x0, 0x6, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x2, 0x6, 0x0, 0x7, {{0x9, 0x24, 0x6, 0x0, 0x0, "261e0ab7"}, {0x5, 0x24, 0x0, 0x9}, {0xd, 0x24, 0xf, 0x1, 0x9, 0x2, 0x20d9, 0xff}, [@dmm={0x7, 0x24, 0x14, 0x7ff, 0x4}, @mdlm_detail={0x99, 0x24, 0x13, 0x87, "1683302eedfd03482b706b3945f0bb9ef3b6af228e44c876d592d2d5754d86aa1c55e1bd076d1f5350c94cd6c0953892418005f05596632f25e1afa0d9be0535c3de5ce74846761f16393267d73e67588d5472cf30627d746f5c852299d55890f633ed9c3a056946874ab48f656fe0a1fb51a07efaf425c1daf070c597abafca3d9f263857a1dc67e1fec36b28a41c3e7d4bc36365"}]}, {[], {{0x9, 0x5, 0x82, 0x2, 0x10, 0x70, 0x0, 0x7}}, {{0x9, 0x5, 0x3, 0x2, 0x400, 0x2, 0x6d, 0x4}}}}}]}}]}}, &(0x7f0000000780)={0xa, &(0x7f0000000640)={0xa, 0x6, 0x200, 0x6, 0x8, 0xf2, 0x40, 0x6}, 0x19, &(0x7f0000000680)={0x5, 0xf, 0x19, 0x1, [@ss_container_id={0x14, 0x10, 0x4, 0x7f, "10e01fcce33190c3e799016e430463f9"}]}, 0x1, [{0xae, &(0x7f00000006c0)=@string={0xae, 0x3, "39e2af090f315fd17ed338d734b4539f8bc40254caa5e8bb6bd793fe868e9d4000342ccfce58e666317884cf318dc32d05ae56847690601cffa846f3a959bfec5a7eb325ab4ac054b635b21d0b03252525f3e7bbbfc632d569a286b0748fbb598d558ed43a794ff46068d382e6b418dae589ae289b9f425b515351b7eb4e0a6d320de90a4e6c9f22d89fe3be991818ee020f129c57602b1775c665a1303580ea11b7bace40613d86de7d9e02"}}]}) syz_usb_ep_read(r1, 0x0, 0x0, &(0x7f00000007c0)) r2 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000800)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) r3 = openat2(0xffffffffffffffff, &(0x7f0000000880)='./file0\x00', &(0x7f00000008c0)={0x101080, 0x12}, 0x18) io_uring_register$IORING_REGISTER_BUFFERS(r3, 0x0, &(0x7f0000000a80)=[{&(0x7f0000000900)=""/217, 0xd9}, {&(0x7f0000000a00)=""/108, 0x6c}], 0x2) syz_usb_ep_write$ath9k_ep1(r2, 0x82, 0x4e4, &(0x7f0000000ac0)={[{0x7c, 0x4e00, "1a65a883985cb44c968581a3ff4629cb30803a2efa8d545dfdb2093edd7cc117f15de095ea50012445844b9de4628a5da6fbd9686b1af615ca75a3feb1dc0885ede4c0f3a3efc8f967eef4fb19a85554e0e4bf07f2a240a3e7766b12837109afe4d29db14fe1c735de210991d16ebba2901c47eff00ba72813e6f07e"}, {0x8a, 0x4e00, "722362806d7d9180d27978a1c3cedcf74ae95858137677654add9da30888c3d55de0e71c4cb5d0990c0017735a52e712b644815f8ccae71c7d1afed0fd4d19e7cdb93488d6bf43d4b76f6c0be2995c0c38da5bb13246136d5b7cb845fe6a22c185e7ed4c8aaf65ec2b7bcb56b9b9e3e86751ea47eab45b5a9ec708f9226959d9f1d26ed44436e3ee77f6"}, {0x39, 0x4e00, "0a07ed43ec43e3ac3565f5384b954657098d33945906bd9618dc00c776335fa342d71e84450d29809aac90c817110565512fcf752672f7a76a"}, {0x6d, 0x4e00, "ce1320b3336696fbebbfb88efc161fc421c201d19ca3489aa46c57a8ab89a8c25d79d4a16d05095383a6367eb22b831880594b050faeccbed71d122607aca80befb4ee1cbd40b06aea0926490dca2dd247b6849784a4e9f402ea32a5171e454ce007d08d1233c3e2502aebb522"}, {0x9b, 0x4e00, "a93001e083fe28732ccc9c646c1cfece253970ced2e91f07ba4cf4b7c383f476e11b739a2e0623fb885e1b4a76b3125e5d8933c11de97b7f5534793fb62eadc7354369ca7d8d4798818a2fc1746da7bc7de6f3ffe4b317b997941385846b3d297d8dc3d729e65777198e47fc99c1dea4fd06c8ec7772fc7f4fb81b8766d4f9ce329cf0f0b99467d3be3df5dff29bf8ee957559daf04aaebee97892"}, {0x4c, 0x4e00, "fbced7dda0212a36da52e0816c67da1d377faf7c796e5987523fa38ec46f9dd8e2d9843517bb7787aaace385149b97935f4716d319a59fd050ad932f4934c30e007017c301047e63c0bbf18c"}, {0x6f, 0x4e00, "f60b09006d1d9b411d738b7fbe914956cb16641f10e78d84ef46f925b635ebff0ebe52d4e57c7066df018d8ffae1e86e2d80b40beedacd6283b5c268ae922d6f5637310086f6b395ec3cf2d400f2d34773a2892a89c4a866d16525713e54b214615b03e37e604243803ed8df2eab38"}, {0xb1, 0x4e00, "2000378fd9fb01f1d0e20031a0644d480e5a2a80fd35fd2fe20c80b4835168a3aecc08f2115982813176dd1f41d5a009d4f0845eba5e18bb47734d4bbc258edf27dc4f5349343c62d313b30797da4a00159031b2c55597386341e240246daf4a86529d74e7c70eb5b191e07337e7ca2d34f0bfda4bac4a1a1bc982ca67cb21c4182d0bd8dfeb2aaa04227f7c0955bb2b6b791ddde5d722b8b2ca56b6dd4b2bfef22229c58fe09d13b916d41a63fea1ff76"}, {0xd, 0x4e00, "e16e6161255d4c02783adb227e"}, {0xe9, 0x4e00, "d6ec66d6bc6befb0594dd1fefa95342d5d16de8ebc7e40f572d3999b53b963015fd3cead382c71e1dbc902dc05ec8bc0cf7669cc78f3e398e9548f7e9dca83f29e8daf6222c77e664b0cfb479c3bcd1ece5dc849cad3dbefeabb7e951b11cb02d10c9c71d02c35060709129f9cdf57c02a667c441a9f6aadf53253bb14563782b8b9a2232896488f0bcfd6ece7024dcf99cd393c342116ebcc4b9bab5fce6b52baaf3f892cc01fbbb8fbce6c6a480c65f69b7ab0b38628ae10302b536e31012dbef1773b9d03af839d41085daa1460101ca14e38c51af4b2e069f59b9607263a50fa7d0701589305aa"}]}) mlock(&(0x7f0000ffe000/0x1000)=nil, 0x1000) syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x10, &(0x7f0000000fc0)=@ready={0x0, 0x0, 0x8, "9c79e250", {0x1, 0x7, 0xd26, 0x7f, 0xcc}}) syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x10, &(0x7f0000001000)=@ready={0x0, 0x0, 0x8, "1f3efce7", {0x1, 0x7, 0x1, 0x2, 0x1}}) syz_usb_connect(0x2, 0x4e9, &(0x7f0000001040)={{0x12, 0x1, 0x300, 0xb9, 0xd, 0x75, 0x10, 0xc52, 0x2433, 0x2589, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x4d7, 0x2, 0x3, 0x36, 0x0, 0x8, "", [{{0x9, 0x4, 0x31, 0x6, 0x5, 0xc9, 0x37, 0x6a, 0x62, [@uac_as={[@format_type_i_discrete={0xc, 0x24, 0x2, 0x1, 0x4, 0x3, 0x0, 0x0, "1c6cafe8"}, @format_type_ii_discrete={0xd, 0x24, 0x2, 0x2, 0x1000, 0x2, 0xe, "5708f4fd"}]}, @generic={0x87, 0x0, "05cb5c4222858c784f8ff7e577fcce5a67963dd2f1b06465d58b9b992ea8b97743409bab9858ec164f1440649a7545cf45d28eac9bd2e7b96c4db3ebb5476df04aa800d06aa12b6fef4344f5b353d49753af9a8be3eae1de9530b679af3b194cdf52322d82b2822af73b9bbfea95b2c44b71078581eb29fe5c0c2384c28c0b036cb4581ebc"}], [{{0x9, 0x5, 0x8d, 0x2, 0x3ff, 0x3, 0x5, 0x80, [@generic={0x2e, 0x4, "9eff38f8b3bb86d6f918af317ac98233a062f8a7af7b1ead23cdba35b9ffa4e06b26d1e326bd930e0af4efd2"}, @generic={0x26, 0xe, "6f28b569ef15d5a982dce91666d93f7ad34c0f9c9d92f237210d1a2293c4da3f2f9c7725"}]}}, {{0x9, 0x5, 0xe, 0x3, 0x200, 0x4, 0xa4, 0x3e}}, {{0x9, 0x5, 0xb, 0x3, 0x200, 0x6, 0x71, 0x9}}, {{0x9, 0x5, 0x2, 0x0, 0x3ff, 0x2, 0x3}}, {{0x9, 0x5, 0x5, 0x8, 0x8, 0x9, 0x1, 0x8}}]}}, {{0x9, 0x4, 0xa1, 0x9, 0x6, 0x2e, 0xb8, 0x90, 0x8, [@generic={0x96, 0x5, "0e606e18ec56459e494967483ccd1737f239edf9944e8f6d09cf4408e70a5c075d41aa9c69b4c31e0f6740a317bf8d67e6627efe9949d0effba17746c30167ce710956de50f83a14a5c5bd4101312ee72a2374c2d144347a0f518a12a44e936bba88ed1e3c8cf9c362a086c187f91cce85dcf0287fe8222f89b6628f627a7e3c1b892a8b7caec5f23b1541de9469323ad349e455"}], [{{0x9, 0x5, 0x6, 0x2, 0x20, 0x9, 0x2, 0xd}}, {{0x9, 0x5, 0x3, 0x10, 0x0, 0x3, 0x6, 0x5, [@generic={0xdf, 0x10, "aa006561bab2f47854e507e84e8320f3b153eafc14715c2ea30a64b2a8971d5510de0cfdb5b181e6d0eb6c3992d6d898db9a5091c8aee70237f6d3ccbdfbfafbd737243479ffe0f778e66316456b1a7c47d0b964446b03f27cbd2052ce49301d55ddc27a1c8ac565a3ca90d39bba9cbaf8d50f0761b59051b382f2c9d318a424443c77056045ee15af8c61121a231d0c1e3420b1f7f99987ac66cb84f72f3d72de2d50385aff55af82cd26a568248f27b7e0d6eb0f8c5ca711abf9069ebccbee7456756d59c364ac4e9eec39782a4f7c6ef425bbdae7dc03a09a3c696f"}, @generic={0x8d, 0x22, "d148a178a8106ca760b1a1702a3de771fb3a99c2188727988734c1d5c7ba3d5a57e3e541bcecf2490cbd723f289f086c67637973483a2a8b5d8a1d46b97f8a78ead17b81141d9f62c4322fe77e41771e888d1bad4884b0f36cd8d7c06f3cfb1e0fa26052ccd3c8ca80f697fb63673c8fc4ab0d871df54b8ba0c4814ff4d0eb5dd899c887e99229c4898727"}]}}, {{0x9, 0x5, 0x1, 0x0, 0x10, 0xec, 0x1, 0xb4, [@generic={0x2c, 0x24, "2ce77f9a0014b86c9b8c3ef0f600e0a3e3b4c30d2f9399f136fc3db779fd16153deab4882366bdd8f7a7"}, @generic={0x5a, 0xd, "1c035c7c0cc32888fc3a2b9bc595da35c910ad3afc94b0e8047646ec8b2b970c55c5578d74637af7a1e0ba635942be462eed5dcfdf99c49fb3f349005eb517ff3411512303e286c803d07e39ec4c187b9035d69fa9cf713e"}]}}, {{0x9, 0x5, 0x2, 0x0, 0x200, 0x1, 0x6, 0x57, [@generic={0x84, 0x0, "6e82c6c6e851ef67606262516e9e8fcd93a7fec746fb9b35a19861c521ef843dfff38e0544cfab9375d439f0e45cb9073dd2eb9b3bc0e2de97067de3fb709334e52e4ecc463db461d0a6eb2c2227e1b2d2a961f74e4d32e7db338e1600c04ea0fba390fec4051a90ff3c55f1825bfaf25d61040792575fb1eecff87759423e63bae0"}, @generic={0x4b, 0x22, "07af3d2ef3a703e001a8f01b01a15100a08e5c801ab175213b48e433cb471ac9d19afc70df74389163904cf495005390ca30fbdf0f13dc0fe4ec9611ecf7977a9a8ac380a6a86f6011"}]}}, {{0x9, 0x5, 0x80, 0x10, 0x20, 0x2, 0x6, 0x2}}, {{0x9, 0x5, 0x0, 0x2, 0x200, 0x8, 0x35, 0x6, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0x91, 0x3}, @uac_iso={0x7, 0x25, 0x1, 0x4, 0x0, 0x4}]}}]}}]}}]}}, &(0x7f0000001840)={0xa, &(0x7f0000001540)={0xa, 0x6, 0x200, 0xc, 0x8, 0x60, 0x0, 0x2}, 0x19, &(0x7f0000001580)={0x5, 0xf, 0x19, 0x1, [@ss_container_id={0x14, 0x10, 0x4, 0x4, "c941059e7c29c2ce44cae33e9acba6c4"}]}, 0x4, [{0xa4, &(0x7f00000015c0)=@string={0xa4, 0x3, "8965c99be0f30c404e5bf5c27a46f42dcb1bde8622d416b889a75781444d94359a1837ccbc510781a9edc8a6352f7154e1dc1ffc0b348761fb0502d6de5ca1d548f8eb37e3a607c190fc518358ec5471c0e08e873650ce82a9f9f52551c6c46c10fdcfc5ef3e5612ed18d003b74e7d146250dae03a00353662f95878bf70b41461435cbbccffc80e4037ebe116c61b1c9be8257b96c10a0c3eaa136d634ca808da4b"}}, {0xce, &(0x7f0000001680)=@string={0xce, 0x3, "c9b253fa03d61abc1b3f82736837062bec1fe6b2ce8e89e0c9c7b1fb887fb439af45aca37f188b33a6f92c3882b72bd43ba76d5bff3f9926587528f4d5a947f6e70828dd6d30a9f49b50af1a76ee84915185dafe5ce90365c2255d04e5624503bcba2b026b4eb51eddab35f83f701ae4f19d0762339566e22feeadf9768da0b811291cdb3caf921adb734f7a0772a77e2aa88aa09a509626bfa214c3fb309a4b872249a5fd7a6e5a66db6389ea7438988a1d8aefaee45cf3e6c81f917c572fc727c5e85cb005208413afd01e"}}, {0x3d, &(0x7f0000001780)=@string={0x3d, 0x3, "41e1c0d3e4b9f76d2f63f12be0db8e92b67caace9afbb998482c8a77849e9ac57f20ab23727957681131e8790c61f106ec4ebeef7d47383f19c742"}}, {0x46, &(0x7f00000017c0)=@string={0x46, 0x3, "4958fc6964e72090e85c94eba1333d888002cbedb8923ee92aeecd134c16ae830ffb2b5d456fd08e57114802eae4b01cf5d21260795a17a12011f459e27faf498457e7f9"}}]}) r4 = syz_usb_connect$cdc_ncm(0x6, 0x98, &(0x7f00000018c0)={{0x12, 0x1, 0x110, 0x2, 0x0, 0x0, 0xff, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x86, 0x2, 0x1, 0xf0, 0x50, 0x8, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5, 0x24, 0x0, 0x200}, {0xd, 0x24, 0xf, 0x1, 0xfffffff8, 0x100, 0x2, 0x81}, {0x6, 0x24, 0x1a, 0xc, 0x16}, [@dmm={0x7, 0x24, 0x14, 0xc, 0x7e4}, @mbim_extended={0x8, 0x24, 0x1c, 0x15, 0x33, 0x8001}, @mbim={0xc, 0x24, 0x1b, 0x100, 0x5, 0x81, 0x8, 0x2, 0x2}, @mbim_extended={0x8, 0x24, 0x1c, 0x3, 0xfb, 0x1}, @network_terminal={0x7, 0x24, 0xa, 0x5, 0x3, 0x0, 0x2a}]}, {{0x9, 0x5, 0x81, 0x3, 0x40, 0x6, 0xf, 0x1}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x8, 0x81, 0x6, 0x7}}, {{0x9, 0x5, 0x3, 0x2, 0x10, 0xc, 0x1, 0xfb}}}}}}}]}}, &(0x7f0000001c00)={0xa, &(0x7f0000001980)={0xa, 0x6, 0x110, 0x2, 0xff, 0x5, 0x40, 0xb3}, 0x18, &(0x7f00000019c0)={0x5, 0xf, 0x18, 0x2, [@ssp_cap={0x10, 0x10, 0xa, 0x6, 0x1, 0x8000, 0x0, 0x6, [0xcf]}, @ptm_cap={0x3}]}, 0x4, [{0x4, &(0x7f0000001a00)=@lang_id={0x4, 0x3, 0x41c}}, {0x4, &(0x7f0000001a40)=@lang_id={0x4}}, {0x6f, &(0x7f0000001a80)=@string={0x6f, 0x3, "c4e47084c37216ee4946e3cfd708786cfc1d3354097e116caa5919331775c96ea7ed108255a5202122a3d98b2915afec0d4b9097aaef5fd43cb6cdf785a1ac65191ed8a7b6167db6b17f886003aeb336d91b0f4f9102a9835c92792f3a5563195a6fff296c9a7e5f5ced406daf"}}, {0xc7, &(0x7f0000001b00)=@string={0xc7, 0x3, "ef1daa7b691f1b2ca714871805f0ccb7fe2d38addaa30e661e50bc7ac89c9d5ff79941b5fbdd3d85f8bebee5607cb92f08f6aeee2691ba9ae7bfa534423e33696ae0cb9c527746efb78e70d57670aaf624b301dc6c58f10c46d1b10f747b7924ba729aae60f658ce7c44d69b4dfe77fd7d99e7b6cd41f5ca6c8935fdb208b7ea029ed44616bd1cf3677b319e16a5c4b20c7ad99d73cc2c4601ad70f0e470fb1a975334621132e12b34cc69c0b8375a2bbba909e9c415383767c37ac5f1035349443465111e"}}]}) syz_usb_control_io$cdc_ncm(r4, &(0x7f0000001d80)={0x14, &(0x7f0000001c80)={0x20, 0x24, 0xae, {0xae, 0x22, "83fc59209cfc90031a7461eac2b05add8d6c7c36e1d0c5ecfd8f1285598249b736467ba1031c88e852f0967b88997b47cf4f85e70501d86fb4d250581a952331261cb998d89c74b26a2e17a792103c557ec0732550fabfb195aeff722e9d65466086fcec6bc2ab164e9fa1a2b622016f3957b7353cd350c07a16fb1875a3f7549137c825cb2754cf4e69323d7bebf905047e678b9d27ff98452965398d39c7be82db3c2f186abf5188803b8a"}}, &(0x7f0000001d40)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000002040)={0x44, &(0x7f0000001dc0)={0x40, 0x13, 0xae, "08785a3eb72b9c3b63229254b5b98840949357c02783d0969635e8cc4daca8b8784727c15b1193c22cc687a788cd32ce2277a77bad5312660c0b26c15a62a2717b36315936610ba1c4e11bb989e86c8b03d238853135d407c0cc368b46d7e7ea4c69632eac7711e175fb484e7a1f0531a7884fc72a37c7b99c20c2243e2cc1dd1aac2b75a7c6d766fa7547d93d8f3cac57f10580af4209cdd3d0168e4df43bca32c65ac9ea5864ce5176cfd35751"}, &(0x7f0000001e80)={0x0, 0xa, 0x1, 0x6}, &(0x7f0000001ec0)={0x0, 0x8, 0x1, 0x4}, &(0x7f0000001f00)={0x20, 0x80, 0x1c, {0x6, 0x0, 0x4, 0x7, 0x7, 0x59, 0x8, 0xc, 0x401, 0x8, 0x0, 0xf851}}, &(0x7f0000001f40)={0x20, 0x85, 0x4, 0x3b49}, &(0x7f0000001f80)={0x20, 0x83, 0x2}, &(0x7f0000001fc0)={0x20, 0x87, 0x2, 0x2}, &(0x7f0000002000)={0x20, 0x89, 0x2, 0x1}}) r5 = syz_open_dev$evdev(&(0x7f00000020c0), 0x1, 0x40000) ioctl$EVIOCGKEYCODE_V2(r5, 0x80284504, &(0x7f0000002100)=""/69) r6 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x12) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) syz_usb_connect$uac3(0x2, 0xe8, &(0x7f0000002180)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0x40, 0xe41, 0x4642, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xd6, 0x3, 0x1, 0x3, 0xa0, 0x0, {0x8, 0xb, 0x1, 0x1, 0x1, 0x1, 0x30, 0xf}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0xc, 0x1c, 0x40}, [@source_unit={0xc, 0x24, 0xb, 0x1, 0x0, 0x1, 0x2, 0x1}, @cluster_info_segment={0x6, 0x20, 0x6, 0x8e, 0x9}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {[@format_type_ii_discrete={0xe, 0x24, 0x2, 0x2, 0x4, 0x0, 0x9, "37b1770c16"}, @as_header={0x17, 0x24, 0x1, 0x4, 0x1, 0x8000, 0x5, 0x2, 0x2, 0x8, 0x1}, @format_type_i_descriptor={0x6, 0x24, 0x2, 0x1, 0x0, 0x1}, @format_type_i_discrete={0xe, 0x24, 0x2, 0x1, 0xfc, 0x3, 0x2c, 0xc, "2bd9e0f356b8"}]}, {{0x9, 0x5, 0x1, 0x9, 0x3ff, 0x3, 0x84, 0x12, {0xa, 0x25, 0x25, 0x7, 0x1, 0x1}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {[@format_type_ii_discrete={0xb, 0x24, 0x2, 0x2, 0xb2, 0xf, 0x57, "cfee"}, @format_type_ii_discrete={0x12, 0x24, 0x2, 0x2, 0xe, 0x800, 0x6, "7c7bb7b478839e5b86"}]}, {{0x9, 0x5, 0x82, 0x9, 0x40, 0x5, 0x65, 0xe, {0xa, 0x25, 0x25, 0x1, 0x8, 0x80}}}}}}}}]}}, &(0x7f00000024c0)={0xa, &(0x7f0000002280)={0xa, 0x6, 0x310, 0x8c, 0x8, 0x1, 0x8, 0x4}, 0x4c, &(0x7f00000022c0)={0x5, 0xf, 0x4c, 0x6, [@ext_cap={0x7, 0x10, 0x2, 0x0, 0x2, 0x5, 0x7890}, @ext_cap={0x7, 0x10, 0x2, 0x2, 0x9, 0x5, 0x4}, @ss_container_id={0x14, 0x10, 0x4, 0x7, "4305410f97a49d0895bc050e1baed892"}, @generic={0xa, 0x10, 0x4, "7fd7dc90f84a8d"}, @ss_container_id={0x14, 0x10, 0x4, 0x0, "e43ff9762f93bf60becb2330e4021d6d"}, @ext_cap={0x7, 0x10, 0x2, 0x18, 0x5, 0x7, 0x200}]}, 0x4, [{0x8a, &(0x7f0000002340)=@string={0x8a, 0x3, "47950e8356ed608dc31c337fa48e4caddba4166a933915b6df86e1dc7186d57a69a346e8d0528fa5217eda76fd7be8e809839c0335313e958887157b5193c8fe303d47c3c751c5b49c4e49325ae75815c3a5d02e3db28d21c9febba7d67d8a4cd12574eecd08a496457c21513d1a71c3f4b27102422bf827dc79d1ea248d8f5bef8dd1384704a71b"}}, {0x4, &(0x7f0000002400)=@lang_id={0x4, 0x3, 0x425}}, {0x4, &(0x7f0000002440)=@lang_id={0x4, 0x3, 0xc04}}, {0x4, &(0x7f0000002480)=@lang_id={0x4, 0x3, 0xc868c8c8496385a1}}]}) r7 = syz_usb_connect$uac3(0x5, 0xef, &(0x7f0000002540)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x8, 0x2b53, 0x24, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xdd, 0x3, 0x1, 0x80, 0x40, 0x6, {0x8, 0xb, 0x0, 0x2, 0x1, 0x26, 0x30, 0xde}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0xb, 0x5f, 0x6}, [@output_terminal={0x13, 0x24, 0x3, 0x3, 0x2f8, 0x4, 0x2, 0x8d, 0x3, 0x8, 0x3, 0x20c}, @cluster_info_segment={0x6, 0x20, 0x2, 0x0, 0x80}, @feature_unit={0x1d, 0x24, 0x7, 0x6, 0x3, [0x5, 0x8, 0xff, 0xd, 0x8, 0x1]}, @power_domain={0xb, 0x24, 0x10, 0x6, 0x1, 0x1, 0x4, "9c3d"}, @input_terminal={0x14, 0x24, 0x2, 0x5, 0x105, 0x4, 0x2, 0x400000, 0x7, 0xfff9, 0x3, 0x401}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {[@format_type_i_descriptor={0x6, 0x24, 0x2, 0x1, 0x3, 0x3}]}, {{0x9, 0x5, 0x1, 0x9, 0x8, 0x1f, 0xa, 0x0, {0xa, 0x25, 0x25, 0xa, 0x81, 0x5}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {[@format_type_i_discrete={0x8, 0x24, 0x2, 0x1, 0xb, 0x1, 0x8, 0x5}, @format_type_i_descriptor={0x6, 0x24, 0x2, 0x1, 0x4, 0x8}, @format_type_i_descriptor={0x6, 0x24, 0x2, 0x1, 0x2, 0x3a}]}, {{0x9, 0x5, 0x82, 0x9, 0x8, 0x40, 0x5, 0x0, {0xa, 0x25, 0x25, 0x2, 0xed, 0x8}}}}}}}}]}}, &(0x7f0000002a00)={0xa, &(0x7f0000002640)={0xa, 0x6, 0x50, 0xba, 0x8, 0x0, 0x8, 0x7}, 0x20, &(0x7f0000002680)={0x5, 0xf, 0x20, 0x3, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x2, 0x9, 0x8f}, @ext_cap={0x7, 0x10, 0x2, 0x10, 0x1, 0xd, 0x7}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0xa, 0x4, 0x59, 0x8}]}, 0x6, [{0x4, &(0x7f00000026c0)=@lang_id={0x4, 0x3, 0x808}}, {0x4, &(0x7f0000002700)=@lang_id={0x4, 0x3, 0x843}}, {0x62, &(0x7f0000002740)=@string={0x62, 0x3, "1007d933a9d8e07ff05b1a1748d6ae5a8d27fd8be00d9a76b9801d3ae82c09db3de3e3a585da5ff66a2eb9134c66801d04b708936a686cc112bc667b8c9f3f3e6051389b34716990d33ec918660ad9bd4f327d657d077ac9c7d4ccf520702b7b"}}, {0x8b, &(0x7f00000027c0)=@string={0x8b, 0x3, "900e8324584caa8e4579f8a4cbbc1b56eacfd51369c8fa58e9ffb9355852f93861add159a2736b2329b7021b8f534f0e105f50a3d9963a1542f996c905e28002f8c198c589affe2710d10281e88f8a49e9f31dfaf8f3ae316a176d5f0287d28645d6bc0a3ee9a60598287f8242db85ef9c4ec9fa6eebb7e2e26b148f3051ecb8a1163afc82188eb70c"}}, {0xd1, &(0x7f0000002880)=@string={0xd1, 0x3, "663708d3838cb75f243d96603641c370c71ef7a963576d81515d2516227fbc9b1c294b996e535d916687205bb18a5b6bef78ea293856ece14a6cb42886f5766d279b7529626844b1580c41d79ad73f94700ef62d936ca08dbc78c871342376de4bf769609113e03534d72618e15ba9e1bb3494658e48337240d689cb4711d88e19c6b8be9324df58ff138705ceff72b0e471ce337b9a224afe68409c1086179dec2e284c657f400d2add7411ce147e0e2888daa42db962a96764a29634a1d693372880bb96bfa4ef8f3f47eef10c0a"}}, {0x7b, &(0x7f0000002980)=@string={0x7b, 0x3, "6869654f43c8bd34a8e7b476b6b24d546e695651ec4a4a91840cab5bcdfd414778f3ec780dfab238cca19d70da9ddc93485a08821bc05b97302baa30b2bbb0df1f9567602e133cef0a7d7d0c9ca1a13db338cc502e7877495e5c2c4b6e63ee9c84b4cf1c23d7369b7db5dee4d9aa8e7d65e85a9df9f4b1d5d6"}}]}) syz_usb_disconnect(r7) fcntl$setstatus(r6, 0x4, 0x4800) r8 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000002a80), 0x32bc80, 0x0) syz_kvm_setup_syzos_vm$x86(r8, &(0x7f0000c00000/0x400000)=nil) syz_usb_ep_write(r0, 0x29, 0xbb, &(0x7f0000002ac0)="db4ee669d5886399b5f5527ed742447eeb8b64b08c8e05e11ff68037755c8512c2b0e42e79f3b98e3fba18f09a1d84c1e695d8c748bd146d3d7ccf183e21a634611d0cc8afebaf0140c3f9c5576e734987273baf1d0c51a7c996c60f480ff531626ba3525ba0d555e01f92311ae76b6833ac92bf3d0499d23d8f5f54dd44a60677dd80946f27e7146f430b39d47e1071dddf6f27f4538beb4dae3d07daba190692440e35c5622f94a0e5dcb687abbdabad34164a90f6b2e137fbe3") 8.398404214s ago: executing program 3 (id=2026): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x10, 0x54c, 0x24b, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x9, 0x3, 0x0, 0x92c9e49492020fca, 0x0, {0x9, 0x21, 0x8, 0xb, 0x1, {0x22, 0x29}}, {{{0x9, 0x5, 0x81, 0x3, 0x400, 0x4, 0x0, 0x8}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x22, 0x371, {0x9}}}, &(0x7f0000000080)={0xffffffffffffffeb, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_usb_connect(0x5, 0x207, &(0x7f0000009a00)=ANY=[@ANYBLOB="12011003a9372540f30c1010db26010203010902f50101030250070904"], &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0}) syz_usb_disconnect(r1) syz_usb_control_io$uac1(r1, &(0x7f0000000180)={0x14, &(0x7f0000000100)={0x20, 0xb, 0x74, {0x74, 0x5, "1ebf93a25e820fdec1dfe3616e4d7587e5707202998bacf817b63e9c55e98fa1939b42bd26a598868e2fcc295ab8a8220984e8ddc025c1cc0fbdf984193eb012ab9ae3009e07eb436a15edfc2e6366ffed5206733e51abd4954deb4fc957cc4c871bb9cc44916484d21513ce3e6ef7b62068"}}, &(0x7f0000000000)={0x0, 0x3, 0x26, @string={0x26, 0x3, "23a90c567960deef094ed3b8da7564a84c92359546db038b8a31aba9fb09d0c1f9dbe5b6"}}}, &(0x7f00000004c0)={0x44, &(0x7f0000000200)={0x40, 0x18, 0xf6, "468e6f6874cccd0a696d89d631fa40280cfaa104e0eeb1cf471391e4fd7ea6e6d982c5a8dd74b0ff270ece6b3435de9d5e0f233b09c5de69751a453d84e4e15ab27acb873b5a4a985ad8a08a31b7ac51ab8830b1c5bec15ad3af1018d9da273953d6f10ba5c1e9fb57fa6e6dddf24130bbbbcfbf13962ba482fcbc702da635b8f4e977f799e568b9a48945f2db6cd181ac2cf5e0fc74654dea7db700da808de5539e7a9a2acc2c99f7702263a5c3c24a58fcb34231d2c90fb502e4132449777c3949912ed95c84b284608ca333831b010e33bc8d878e0cfab0fa45cf396f87dbdf5363db2b836f4a314f18ac4d9eded51c48e6aa15ad"}, &(0x7f0000000300)={0x0, 0xa, 0x1, 0x1}, &(0x7f0000000340)={0x0, 0x8, 0x1}, &(0x7f0000000380)={0x20, 0x81, 0x2, "7cfc"}, &(0x7f00000003c0)={0x20, 0x82, 0x2, '\"\x00'}, &(0x7f0000000400)={0x20, 0x83, 0x1, '4'}, &(0x7f0000000440)={0x20, 0x84, 0x4, "897fbb20"}, &(0x7f0000000480)={0x20, 0x85, 0x3, "1b2cb5"}}) 8.271449501s ago: executing program 5 (id=2027): syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000500)=ANY=[@ANYBLOB], 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001800)=ANY=[@ANYBLOB="180000002500010324bd7002ffdbdf25010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x4008}, 0x0) recvmmsg(r0, &(0x7f0000003780)=[{{0x0, 0x0, 0x0}, 0xaf}, {{0x0, 0x0, 0x0}, 0x8}, {{0x0, 0x0, &(0x7f0000001840)=[{&(0x7f0000000040)=""/108, 0x6c}, {&(0x7f0000000680)=""/4096, 0x1000}], 0x2}, 0x7}], 0x3, 0x2000, 0x0) r1 = syz_io_uring_setup(0xbdc, &(0x7f0000000640)={0x0, 0xec25, 0x400, 0x0, 0x40000333}, &(0x7f00000006c0)=0x0, &(0x7f00000001c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, &(0x7f0000000100)=[{&(0x7f0000000240)=""/216, 0xd8}], 0x1}) io_uring_enter(r1, 0x847ba, 0x0, 0xe, 0x0, 0x0) 6.495338164s ago: executing program 4 (id=2035): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, 0x0, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={0x0, 0x84}, 0x1, 0x0, 0x0, 0x8890}, 0x24000000) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_MSFILTER(r1, 0x0, 0x30, &(0x7f0000000600)={0x2, {{0x2, 0x4e24, @multicast2}}, 0x0, 0x3, [{{0x2, 0xffff, @remote}}, {{0x2, 0x0, @local}}, {{0x2, 0x4e24, @local}}]}, 0x210) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000080)={'vxcan0\x00', 0x0}) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r3, &(0x7f00000021c0)={0x2020, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r3, &(0x7f0000000100)={0x50, 0x0, r4, {0x7, 0x2b, 0x0, 0x68c50012, 0x4, 0x0, 0x7, 0xa15, 0x0, 0x0, 0x1}}, 0x50) syz_fuse_handle_req(r3, &(0x7f000000a200)="c1fd43b601662701272af37a7deda072caa09faa11b0a4ef2825e87f09fb6bc3dfd84ddd853b18203bbf08b1af6066c78b4714a789a8f3605f5920e7afc5b0a04271cebce72a797abd5b9e4a44fdcc150e6ef0e8c3d4360e74275818df26243f28cac3d84e264fd0c77d4bccbc466e7244b247d9dcee026df89aefc958d84a55d4d6922d96ce0349fe28efd6b83d15b7b08143a721c4a677b72362a49eeb15ec5b5f8569bad585e30a62ab149e7e4c7f49af9560fd52ea5730135dc3ea3f6a9a3ae6286e99e1520a43b8813ca6aad1adbb30b2459f90699e2ba3a6335ddcace3737ed8f5f21e027ac2b224389bf0c8c005ac8d8c3ae188679d34da0a2c20a910487d3c91b18770fa5ee483a3f09b882960f12e7d2eb9015895ce80b37f74a305a50deb146b1c3430f31d28e6f827b9c7070bc880d251ddb09e0e70a0512ed2600256332c43a5deaecb01f089333fc3b6721f6ed5b41f9971b7c63f57b5afa8042f5beb1ac1274676dc5406b5828247123bb7be795baee59d779bbde227c90d0a5d863936d434f2ce7a45f9b650600f32827b92e2d828915f0411f765ed82dd012561ed29b09950b96f8e490f1448dbd5e45bdc92a2a36aa67e5e9396b6376f82aa6915eac4144a102de786563e4482f0917698bc70776f8c7aad3346e18ee295af54f3c1658f9b124116a2fdac79353b095cf667dd941c3cba141b3ac8982eed42e7db649c9d49a59378216bf4323ff4c2f2992994d4144b74866a2426e19a2dc8dbf4643f97a214fc9c448512316d76c4116c3ae600dfb98cf85472da661745b638438dbf15d8dd87a8ba35205a65ba5bf79cf941454f8c788dc2eeccea412add734798c82e9c86122a91dff778edcd309c05fdca66176e9bc4d410b0ee4627eb889443b574ce205c7f4d6d428e909952712ec3dfc89552279b2da87b010051a451377a0c51a34ebba25c3b62ba98eb6f1549b0fee6a7c5e0c7a72835388803a0a8342bb9f2733224c92a50dd25a9b335f243f2d8c68142aa1db1de2f899a56c623a32f8a74c16db56983eb83f6469316f2fc14860c075236a3ba40e8c265909b8fc6b03c6378269f6629bab81418789cd748d8b786f47ab8f13b0caa5ecd79dbea61330be6de5804f5c211cef78f555e7b2093f4a836cdb8a2cfa261be14e0f59d075f58e97ba16cb130f062a2261df244c57d6f477d761262b2e755c96bad3898894e80b23fae71fc31b2895513a11b0cf07551ca87325592dd10549b7d92da1cb07119fe970b8cc3aacc386ab64d32b308679593256d2fcd1f9e9b15ee93ef859e7268be776053182460e83fb873711226ec9aa5c35b15fbfa12ea0abfc7465b300bd8445c831ae77d2aab7d4bc3ba5f218fda9e90eacde1ac5119eb30073a6f291727cb94fc87a3d3013f3ebb1cd259067c571bd3c57eacce716e61f86bf4041bacadd6c676e17fb3cf89c4984aec78216854a60af68533fcdff12897c3e1b2c10cec019722623f477a512c4e5eef74a6d1ab7a735905373ca3a0b18c3eaa523c86238fba77e45aa07c1b96fa1e3ceb04e5f4742536b687ebf989918f6805cda9611ab9ed10ee33cda71a95be2da0d2c21d2295fdb334dc2057942382dc7d0f70300df3df84cf9a18f042c11243a347569771f9b82404e13684324fb06d867641c87d6d70ad15e90240f901d04a8b8c7fdfb8b84aefee1606f14a2a6995e6b8aaee1b372cd586a6daf28ad7d8ef644c58fa72f0b2f847eef72e18f1a4374c4fa3d604a9bfec6a1a4fefdfaa848279693208dfbc1dbb97b44c4f034090606e0ad312cdfb6a8f68dae7312b064c68813eb41992559ca63d88a8e90711c838f220a4da5bc7d82ec0af83da059bdccdb524a59ad26e43413f131e7703eb82158293a331456ce728c28923bf9ae644a331a667c2932ae1f11a9f9b893f802796ad029c40496c9bc49cdf41a40da1092b404da660e80f33a6012a407805e70f9a180105cd0401ed01a9f6edef4e2479e1579ea365d843c197279e3c79ae56a107dfaba6af80ed9a24d535d19827596ca2b14bf4b110fae4820fc8d0570a64ae08e315da0091f766bceb1fc990465ecb84a2d72efcb9a269816863b72f8d0869b20c14bd72f909fc3ebbf2ba2f98ce3fd7eb54b738692916eeb98ab9ea04ce3e740817dc9ac6561c71d3bc15358ebbb3027294f66eb890577f8a63ecd23beacd93c3b1498d5eefd8b68ebab3536653d5839713b07f79ebb2a6106c009cc535a2173cde3ccc65676bcae513145db5bf08546e8810fb4d193266d491fb9121935138a74c52149959a0c270cd6e244dd7cb140fcf6bf0e7536220f798bf32cda564ebde025a92617f3195e549a491a45446ff0ebfd3b047775af339e59a8da0db6223339325c6f493baa5f2c71b5710a975def3e3919a24a52351acc12e5a2ab6c171705bad0e6afd0ad2b6dd6feaedc9924fdba533fc958fab9a980b775eb4c93a499413073cf09826381b8054f9f09f4a0dfa63ac2f6cb22d001ff277ec7f493bc54d2d1d34a6dad62cd7bccab2ecd419c90087f6945311460b87daad605ff8519aba1d8311a5e565dd26655577aa13da31e01cacbb7e10e720a486e9cc450b8a21d23aeab42838d81dc05f5be0474ab81b806fe71b888323037f3262179e451f765e419bddf7b7a99b40bcc226986efbd3765b66e56a3500de4b18b676361510bd35b3a9c6b8c08222cf7a73c4cda972190f839c2d01a4c171a803c0a77d2769c892b2f0191d2fa01d7d5ca53573e47e93ca9b56b8f0d684d5458d505ad8383f22e19024da06bf6abf30ed663cfb33e202be17bb951e9ea30cfcf65675d2fc64aa51e07237fe8391549185fac5822daa92e73778e080b1304dd757f9035092a729b9a0122d1c07d60336f18a9e46ebeced1041de2e2e8a5de6f4a814d5179bddfcdeda88888cb9ce322a516af3be2b7cf371e9193cb40e66cd41dd94e37f14c6e6469e8fa6c57a4fa3125fb6819b84e276768a7354dd3e2692a77a4a60af85bec0325d0aae72a5f4f7bf9468f1d35147910a55af546e4e3634fe2d8efe116606bf84c0e9c4d442ec8f99fe6c1cc90b99a8d1e53322b26b66928fd01738fa70c0aff84b4f02946c6fa684bd617667857cd751a3ad3d324f9574af78eec6c8c51c25e01cb0ef129199f5a3b3b29e32a34c4ef14c810c2e69e06158f02033e15f1ec00419a91c1450338956a188fac918fb73692491baaf5976ca392c139ba0e551de260dfd6c733b572215f2af0aacc5709b0d4a3b36d23f5882c5644bb455075c5c48bd50492b395d14c36393019fa9eab8a211d71d173754663ea2af1ebdf9751006792609d4db47824d95d68583c922c04af3cdfb58f37b6f958a4b35cbd74a30a393be192fb46bfe4e722c3634c94fbf4829f25dc0b8b07cd16cf4c7e924eb02ae8d675539d32b5d9a54a43811eb98e2db317c67d5bc62901582cbb128542d6be3bc9a5b5b8a8827f2eab15e82b28b411edf67d786b76feed9e7d5ffbc86fbdb19ed80a4f5dcebd631719f8734c398938047011a251370e40d5929e9b4426081029b1339ccb08bb0dbcbb4eedd53792e43a046abc1d5c1dc8c1749052233e18e25593daee94f77f327de61867f1e791b797cc5ee43f8109cb0654d8742ece8512c322442f63dff88702ba047e8370a1b7304536ee7cf465a0a19d965fd03543b991449d6a1a98be5ec3867314c688c5c487e59a6bb05291fda479827172bf3db615c20ea022ff7b16020299220b7c45a7181c1eda48c9a5fa7624843d112c52d99d0b27e168eeadbcd3c60b3f366175decc8c91c64a0a16d3a2e38244dd8d2de806ad741e2256075efcb0466360acaa3f65611789a821c30a13d4b60e44173be9e288dda7d7aae2f8341d9a85104170631c942eef22c10e903bf70b0ed36831d536a0cd65c11a209e37a76f3f54deb326735bec5a532431a81f303af5e9d03717a93a3da18317c459aee8db08b9f0b3331d29770fe7fc4266c15a4294c9c435a38296cd880dcedb34f63037f2a8e3ada9ead3e52abd69e5779905f82a607f70e351d2167bf1b599cfb9314a37df876bd5f2acff82f1773c512ffd308179e47b26946ebcce112273e12895145ec88c701269c93f32a5ab2bc16acd57e997d140d18c2cbed2601a05ec33a63e7edbcca673f71eecab66af5287d7d5a1dad68771ed612d29ef8ab23ef0211b4bbed6f981cd24d652f355d94f6003b01cf3d803a6e36b470402c05816aa2cd747f293300bbe891854d932df7809c7809c2cc3d06c693981e7bc21e89aa3ea8f8829c85185e4ecfd2e293bfa2b88cae2c9e4722b9cfee01911a502d59360532528661eadf2150e26a2992871f562d6fed4a36867b2521b1778c4ce955f5980b9dd9ede42fc4a1394491ebf1c1fb0d794cb8c28b103d76b2e70b0337877a222d7f3cd61f353baf7bc9e23d80f8e5b4459937d75f869c179dd9b948a70b9ba37386532790bac12f2f342fc4f2afd8a45f109331d5daf3344ade893029e322e8b7f3bdb5a49987116b31b2bd6d5bab789ca061ea42f7647c88488f734150e161e5aea78639c5bf9c2fb88da321cbfd379b38cbe6e14af979f238685e2c0ff51629cd228602dbaceff8a214cdc66528cdea114691ef619a8c9a0f9cdb7e08c5bcfc2bfd29e39af38f5db4821c648cc3d976cc455a6e6498c92511b407f3349284901562a912c5af25ff792b9c6c5dfb73519336c7d4a87e49debce7a441b7a29706173e4e4e8dacee63a06ab85dd359b508bc8a0f7002832fae10a0a38efaa475846c4205aebe777334788c3e4652086e26dcdddad991b0ce5256e113bac692d442f524d7e292b86eaf0dd8380ccd78b1489dd2ef6beaf2eb9b08b50bb2a5ff3ba8df3b226baf79a0739d8a60cf815cb347399ac4adb2cea533d3f0ce160a563f8d401e5a6100578e4c8178a7e70663e135edc645cdec2f0588fc99a0cb60dd8788e02554ade370960ce562c210e826a1eba767a09b10f46ebbe6c9166e24286331d2ff025c57a10c7b64c506d0a68642171ad965a001700561fcac2e3f548fd58d32bab5f38b36e62f5546129cea35ce856052e3e480fc639640a5301dd700c8e8d0bd6ac790910fcf2b4f159cc1531aa1c9e37b541520450dde638942081201ae8a580f28cf50530190a45f45468753a122b364be7dad79044ec8b9977d583bc0ac3ec7b9fae192397ce8693310f301c18c2cab5208b369e63c5ac18d0266834e218bb71f308c2c2f2df4a6ccadb3788860a2c733a9252b877ea1c1e849a38a328310bafae9614a6e161170c6fcbe9bd8c4177de1fd18f56805c91fb382aad767891556ff8e1b5f3ab8c18b4fa3053c981c12fa2ea017bb7596158ca533d0dd95a95d0b392222609f6ea336711a9dc50393bc41fac0d429540ad70757f2086bf1bea0132a609ea0bdeea0cef93d8b2a0d59189bffec05281e97b4722291005e9ca7e755be9070f405ab0d6c9546a5ebda2e62adcc621c2b1f6b07cd1e617d50469ef2c71647a47ef98ffbc71505e188cef3e5c774c0987664b6989794d7ca186804ccc6296da3adf22feb351792f1a9cff77413703744bf4f21212920d6a8fa1800da7a38fef7160a50f5b895e7b76f3fd830fcb9a25f3b3ccfd082a1712237e4ca665085aa1c5aa413bce813f1b7ca66105de94babb7b4a05029cc3759d00191fd9bfa0f996cc703403dd6ed2b33f2743a788041f279b767efc373314edfae1bd33f7eaaa7418a59fff7e40d02e618172f6e0abe08c855348f3cba40c8592a0521ed1e41524f20abccb2bf0ebb933e59b7036eff5a66279d578e6b2fd6c4140b33adc67f7083110d815ac55b4833ec0504488265b3ff2bdacec17c91bea9d6bdd931bf056d6e9790e472d874a5a3946b200493c9874d057aa6be3a1ca4da6fbb88a9d853aaa7c8ccabc83582caa65078bbe7b04625d139ed9860080d185bd9798d613ca3014713eb9e36bdeb73f14ac3fc7b2f8f594404f56dd937c0a7e865fa98e858cb0af661cbe12f15c928c4c45a982e24cd322320a96ccd54656b2c7876a5d717e42d3df13189b95ddc2b5a928dbda9ee02c30352045d02cbd854af821300f198b1ce1ea8e45c969020e5c7670fbd9b7227cfd3c809fac1df2eb18c199b27e969f32052376b450003b7ff6332ee1d9fce1b5947b72575ec6541b992fbc76f0e03fc1bb9a0df5ee3de0f34125c311d2ddb67962cf9a8230efff82c25c896621082a587139e997e0532962e84ad697a1a2b80d997c2a268ecca8b7d1095530b332ef368270bf31a75b777a7cfe8c8d324a8c558d3c65f801deac6822842f85f10a641b71ad7e5fb05f64eb3033507dc3a2e9ec02d667ef36c551f69c438e8b6c3927733d83e94f035ef3da230b759df5f5d1964815b176478c4ed94402dc8265e589171df165094a2e4e75614fc6febb8484f28ec8c1252b2d933852573926837e1edf9da0da3f91697b290c3ee5a44fcab3b10095b78b5df3701431cab31750e211d442a77dbc5e2d4d0e67bf329f9103414abd4f3879511375c8800f52f8a17ae6887214bf8634bd99075ab073540f04ff675d32190a3d1152ceee32e30719cd883a82185f89f071c02df443cf7046dce8a6ddc472ed63945faef588acf57985c7ecffa438f5427fb851ebc6a4c577a33895a8fc4628286a48d3bbcda1b769aa3194869e148ba457932fa6f2e4640e2755940e2f5a6a67796b5f88ac10f389b409c0c57bd4bf0cbe0fac2fd2f58ec498d19c43952e4522b51931712eb4002b7b208c02c4e06df99fa8e93e4b9e8b0d7a57e63aacdafb19db0fd422f8e89d1275b49963bd82b490f9e4d24cfe9700e98c73b31fdcf7b7d30d73e9bf6bd86439dc8b63171d53ca7caa860c60777436099db544164d4e4a81a483ffd5ef2980110f461529c057c40f2ee63b71a8eb2d87919726bda25a8fa2f242d3ff7bf0726d8a11d141eb87d2733f1faf456f2eccbe4c3a856702a80ba7e36cd8ef8e064e16e61eedda4478d2edaf0445e2247a76e25b4b5c68720b87bba69b4171983d95a5a764f42fa6f23466096d9a097edf84952023a4541110456b93ea558c2059156c287fc6cde7c74abd90ec539a5f43c2a641b1a34cffa2538ba565d0b57513b8c1b3df541d02d6d5a0aa2f96200dbbf64ab7c0adb868cce23ca607db6d6dd18f956185c983a90c8b4a7ec630178376ac400c61c77fcbacb979e2e07115db8a034a00ffb136f91c0b16c6d796f524f9ce6a0b72c378c8939b56bb83ca0f3d09da2b82b4d3457b568878d019f54f9cddd514a601d4edfae582f1a2674892bacf6eaba66124c797e1ebf91e1b5f12e520404d213b12770966d5c5f3435169f8867faed0107d2cd4cf0638e4f1c488122da7516820cc3d12cdc9f663778455352d2be1d8d3cd611808304554bde601e4ec4c9aa50ec22648b12f45c8d84bdcfc85f95ba0afe254df5d8b40d53adf1d4fe1dc3744bd486e3eb14775f4f4c333f751975a4a8b5bfa497850633aff3ff98deb53d1b515a08c4c474bcce46149dfd5bece51d1dfb6eaf593f8ee037404a5ce5edc2887006059cd3743448ab977899f10540b5a5eac1b9d4346654e4eb0200858b5b92525399a87859859269d3b0fa4c2159dc807548368ff701076606378b44cee2839f05ad94f659270af868cd674b44729bbb8eb2f697101bf4fb4f96d07dabaeb5b6a1cc884423fcac3d3805bffb3c8de3e801d641436ca6b1f50aabce4c7b3b1a24eb6977d5a8c84d6cce8ec9ee93d3062a4bd78ff916fbba7ab228838bd61f25759c6ac8650adbe2b346e65681dbafbb934358ca2b1b854bf42f42404a15caf99b785f132b9a20413b2d9d353220656ae271883ca9733430db09b5e8578e9d4fff032b0ee792f429791089d93876a30100a35c420a0686c125005242551df27673e0826a1c38bc028c104e0f958ae1ffb2d5221fd1a36e598065eed6a449567b41c027b6faa461d3aeee8dfb6285661af7fdcfa484fee654b633342eb122fe72d5d68ea4cfc988cabb0df39b8cbd064d489fcbc90bf313f3a29797d479a8fc12cf5b9ead0907a2dca568bc0f40d0fa4a9c3758f9bfd1ac3662a9f04260ef0d2b86a02d23759b210f38830c4a224649186b6e4b87c6b457217c86f502521940caf1e5b2eadb72951a790c94dd74b929232947b01cefd5a1483e127b1b6d216317b581455f9cf96876af837e5f88cc38a46eb2fb6cd7fcc6fce1a264167b86723829ffffc413bb0000000000000032dd6219a95418314b1e071dd59d0e96083e02cb8778069ed54137ce98bd702dead8fc74992d7743d1450faf7de44c2d59ff2dd339b80d3449e9bda5b3a564f01aeefe300165bf3b00d811c7ae866cb1a0a1b87400c2941841cd2d6953308f1a963f1c6d4486e7e45daabf0b066ad8884f4577534d3c9f3d3f3bbe8a1a3088d9b95da1fc901573e26f5b86c7a868429b9b634c9e35dfd0534563160912a43c64bacc8ea1ced7bc1b77a28716700e501905c9e81e190241e0edbf4f894aee4047c5b5fb58a3db4afaf76790690fdc1289236fbfc5f6cff540eb82de8044d17658fb054b198cc288cc43aa5d805a51cadac3e75c8fd82ad015a04932cb6f6b53aa4e8d9d84018ff8db0f756d6b5db4e06a689b52fe8471b9230c2dd14d042c1fea45c3d2452351a4222421366610d80785f7e47474d4ad58116313813d4db3176d93c4e29e5c7562806879ddc75b9cfcf38d6aed015c0f4d52302a51215187bfe254d6065bd142cc9b9e03f32ebc9686ad0d0cb3fcf0afa320a15f37cf591600636a4ef84c756c0d42ab98bc2479f0d5d230359f622447101844430a7555a4cbc702b55a4a6ed964cf399a1a493e40555f622da1643073a786a3425d95090b9b0e20521187e9e20d35f4e061e6201e67e844d88457f751e5519dd30df9251f1ce2836e0bf61eef8fc6ed22e4887186316566278bec46af3823ed53e3e18ca5741124dc53cadb5ff0846cc1c6b9c072be6dea187e8336eb6b6b7029ef79ff3b2999938cc59aafa1618fc4556ce3c81f99414d5d79538a83ee9d8a9ad0b9e57060d4be9c53266f418455d760f423a1642e9edfccede29d21891d7421ad0f1cefe472d0ef84965575419871374727bf5f1dc72057a18ed4d7e0a2ddd6d105eb2cc3718609814c2968f27465b00fb4b4a64359629722320583a05644693e6fcadde0efc12e66a0c8e48311f0550ab8fbc1556b69bb2a5a0c03f1a59d67046d7acd5beb9f7f9ae6eb18580431624d63ffe294ea5497a65ec3891f4c70b26b7b17a9f82145e5d5156d6b3355ad249bb66168bbb745d00c40d6ef42d52a032cf62caeeaec31f4c85ac403cbb0c6756953f0ddbf79da0cfa6ccc1c40de43bc4a10a700b98322e671225e80e663d30192ff5611c44c095351bb69a4e14c11a3d5b0b53e78954699760516134f3148e71a2b0bb04b24bb1a2c2b503f56249e0a2c638ff40e7c2c7d50ef7196fc9893e18c0ac3fc5a4c0d23ee08080f984dc643854b54df4a638af29dc5df79f905c4133ce263f3b2bb55fa7d56fa82795687e6ee5c68cc13d71e44367ea8670409cf2231990cc6d06e5aae2fc3af1537b33b42775b40bba3aa417016fb9dd89f90a89196c104017a68f7527b8b958e38f9646832a7790045fe394ce41bcbd1cbcbe52cd7e56cec7b2856e448fa5d7e837798b899f05a2c2fbe6d9f1a7b193bbf7c70444d6a37810d4d19d359f9cd6b8a6ef2230b735f8bebe0ccec94e44ed95234bfa4a36a2f0ee9fd5ca73d697344d28436e0fab81e73f447bb144a70aaf96acf6ff52c4737e7a4debcd285bdb54e363d842bc9a7d180c16f010fe4078b41c4c3e565c3edd64e61f995ab0086dbdc026dc1825b8c45ed96edd8d2bd9daa699e5da333274d6bee2097c004462848cd16849f95cd2252c4c87058a821ed977ed751b77b0a8fc0966bf3a30c26d49f3185782a7d314e89f039a15ede458538f1ada8eb836a36bb5d82c402e3feebd37e7b7c667a1c82edc8720072789fa5f388039daa731ce74dbd5aa8965b7ee99f6c271035239ca1c34cdc3c57bd8510dee08f74cda37095b1b098997998fa267e0be15de474b2c737936cacccb4ba44112570bbd13f870b55f3763f77724b586d6e26c3e72b20bb13272f2ee331bcabd4a79980a8d2965c20da2a3918c855215fecce95d29bec58f522d3d6d2852c4ac080fffcb3ee7fb98591f99b7cfb7bb124cc20078030756aee8fd284df06cd5f07c13fd56e5381b19e0a3a9f412a8d27428cb6af0078e4dc8ce4836630360a5c3b98ff5e6cbac1d9d29de9838a84d4722ceea3765be3df9984cf139770f3fb986b9cc9185ab787f54be33d46c54de74d94d13f74ec70cfbe1605c00db79fa8de64cd834090a35c80759f83c8fbefcf9a276dde8a8498d084b4619578eccdda2651a475f73367bda96894bb36eb868035251694cbb745feb150555ada09909497ff1d9c8aee7a35b7c8b2fc64ff483f4fd3491ed52304e6010b9bf2af8c5b8e162a383a0bf0bf108ca78f5086132b2b1a29581f323841c2f189509898d932436e5c1e693ed91f0524da026fecaa2b7efab54aeef120be61de457171c58811e0ca8a7600e0ac249aa579d78d2e2b1d6f41a3da4676b6690ca0249251f5b48b9a3820ac5b25a52cc01bc331c24039b6f4bfab72d5838a35629259930dea936f8c60b4f1b189db1fd1b5e7e6c8a842707ad6756d098a9ab543cde3e1d1161983ea91b7322ee2a713be3bad369d8112fdc7f1ac7b5122d55dc5ae443e10db711ddd6619ffbf96068e28911b1f54388413a17958d61ca07465b54699a1351915300cb826d3bf7f4f217bba0ed3195cbd077b67167b9a03040afc237f3bb36edd9fed33d7d6e7c9493fec34be6543880b0b442d8351496f2e8d60d4d984cca743983c0afab9cdedd5a9d774a121e91230d359c27a3d7b4db38ce73db747af3ca06470901f2605c031a7c9b7d1bbb1e838d36a4d39b039e80bcddfaecca906705fe8c844e93d5aee494dc62c7b4fcb6abe09acf925ef422dc09185b53e960795c56500b43faa6e89720aeee724532f89e60e20b12cd4f832b95189bf45b96aa7af10cf8298b44278de1c67e2d71d811240a7aa2d1d6de22e5b8cef4a1f309de3b81c5a028aabdabddc9637974c2dc19b60458f0954bc751b7ae628ac602eb7c52c7fac0c1621ee7757fc5b002ad7e8fb66fc7da0896547abf01ee091c0cfe1d0fc66e6e03599bb2aa7608a72c30203af5eac3915a0b6616b6119c4a09654de2f56e53296d1f8487cd7ec36c86894bab72ec3ce61208f848432d45a27cafcfbf2a2c56b58e017c76ac7e943aff0b4acaf84dfb343d93efb29c518a9d552c36a3e44c6ea948673bc2aa71c5a873d1d301a9c8b02f19c086f922f0b3e4f7d14e8a59c017809188e2e1b4dc6b55fb8ad82b1c04460b5ff2e9b8f47d3e833599519b79ac6d9ab282db4a55654f60396d2e72bf8e2ebbc8c742913359edadfcbda00", 0x2000, &(0x7f0000000a00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000b80)={0x90, 0x0, 0x6, {0x1, 0xfffffffffffffffd, 0xfffffffffffffffe, 0x20006, 0x3c2, 0x100080, {0x6, 0x9, 0x400000000003ffff, 0xfe2925a, 0x2, 0x6, 0x3ff, 0x6, 0x0, 0x6000, 0x7, r5, 0x0, 0x100008, 0xdffffffe}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000000280)={{{@in6=@ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x3a}}, @in6=@ipv4={'\x00', '\xff\xff', @local}, 0x4e22, 0x0, 0x4e22, 0x2, 0x2, 0xa0, 0x20, 0x0, r2, r5}, {0x3, 0x80000001, 0x0, 0x400, 0x9, 0x2, 0xffffffff, 0x800}, {0x1, 0x4b6, 0x2762, 0x8}, 0x0, 0x6e6bb7, 0x0, 0x1, 0x2, 0x3}, {{@in=@dev={0xac, 0x14, 0x14, 0x3f}, 0x4d5, 0x2b}, 0xa, @in=@local, 0x34ff, 0x0, 0x0, 0x41, 0x0, 0x3, 0x1}}, 0xe8) 6.448055208s ago: executing program 4 (id=2037): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) io_uring_setup(0xd71, &(0x7f0000000080)={0x0, 0x0, 0x2, 0x2}) add_key$user(&(0x7f0000000100), &(0x7f0000000200)={'syz', 0x3}, &(0x7f0000000240)="12d44d5b6127ff92f5cb0320728236cb4eace768cbeed4702a30f0fab00ec378f7923d52d93eb810eb20f23d2a6f667e56e58a85efb70fb40951d896972f7f1fd7389176afea05de3495ea67372e79649f5fc0a0ab59a7efea87e29434cf7d", 0x5f, 0x0) r2 = add_key$user(&(0x7f0000000000), &(0x7f0000000100)={'syz', 0x2}, &(0x7f0000000080)="01", 0x1, 0xffffffffffffffff) r3 = add_key$user(&(0x7f0000000140), &(0x7f0000002840)={'syz', 0x0}, &(0x7f0000002880)="f40fc24077021c9b084c60ffc26f26db12b9e78d629870bb26edb4a5e1cc0942ed8c58ca4fe84b94a0e31ea64089ee9ca1efb52945ffebbfea11dd3d0df936a10285eccab940ab5c96cb5d81dac1ad2243d878dde6cfd6ea08d5abcb00bb35436929ddabce530b63fab525337057438cf64a506d54d5c83e3e593d1d53ad0e6a44168fe8cfc6ad98b653d80636e4ddc1f2ab58762b3494250b9557f5b606a43e50874c90143034142cd5f7bd9b4dd876b97b7feb75b9138dde818a3c6b96dd80", 0xc0, 0xfffffffffffffffb) keyctl$dh_compute(0x17, &(0x7f0000000500)={r3, r3, r2}, &(0x7f0000000b40)=""/4111, 0x100f, 0x0) add_key$user(&(0x7f0000000380), &(0x7f00000003c0)={'syz', 0x3}, &(0x7f0000003980)="fd43dd287c48e8a44edea1d42eeb51a511512eacf85b0f06df6f176b3c0a49f4eccea8a039b09071e43f4aad5705154c549b2578a0c8029617f140cdaa3a505ed6ad7f4a36b5f68a798f836c3db82645f6ea6023f3d975b34f70d83205dceaee59a43a5d16852665e861545e329349d07c36a83ccc1928b6f159506b25c6defe4d91fb8a0b1ab476604b6ba0a56f5fd54b6b9543c535f8d075ff0b4f4ad46f432a71a5801f7b5f3d997fbec94521f04f355647375b0a29ba8dd79f4dcd5b3dfb95f1d3eba7a63328dc5e1316fdbbe71cc71eed786d93ab5910be470fe34ba6b746a7253125c9a1263422c53c01b07e4dde780edb537fb552caca22c6ae7f3d7e55ae061bed2e2d0ca3040228a67a979dd3f9089dcbfab8a1593eda90f39f716e98c31eb521c51e257323e136b584bfa5ddf483e9582fcd4efe4cfd896fc4153ce647112f315f559ea48c3a771efc1954d561104852b820d9f6488b4fdddf5a4807397919d80720b3a67ecb5581df786013e30a190d65484496ecf6c96397177c82ea8ed17d6b30541d14ab4dd4fc08deb18951296dc5a59956c3fd3bf418325b6b2f915f402ab35fb82c310cae7d576c6a0fe52614734a4a234df2e08fc9860e5dd8817b7be6b72d92b0847251bfa0184fa246ef81a9acb1e2ba138717770b64b663f1a72347df90580b98c9fafc84848b75210d22490c20a90c3a92fea6f707224820abc251af1ba41e9746ef4ef6a6ea2094852f86672a8e0aac917f031479339e70a99a991488d96c2cf2bd2ac28503a5ebe79c21bee67c346b63fa3b3d59c1c7cf24ab2ad1f75f5b95c77e66b857b178226ae2964494f1eaa8cf9e0f231091c281456df27a8092a07f434c20bc83c54f211d67b6a9f5e192cf7067d20d24596ef211f97d7db481a135eab53240b8b6327a00b5bdb5deab222af8a17022817e7a8ce7405e06734490135b12a1977d9120261bd8d0ae209c7053760399dd7b6043849975854c7c4f0038e03a3303e425e2fee763dc3a166026fa55ee8767dde5682d520a35200cfc4d5ab8f7774c57cf4ba7b6dd1c17558f635ae39e693faef530f540888186a69f68d680b4eff62d5e697f7cb6ec0b3c12456b65a22d4a8c98bd0c3c2c63ae4489a120a94c6620db972116de3d46f22546217c0f3e631658aa54878ab7ac23ac6a1f394b2aece1082c29d711b03e48f30942716c1379891bd1cfa223a4607d9bc281214346bce40e06b8930f980fa2e799f4134f4935adf70999604c3f2693d4bf6c3172e3be8f5546e30543e385dc1c18c2c885f42777eb18dc584b41c7cb7b007e2aa5aecb6e27ffc862ab5f0b5b596ae69a48f5bbc4f7e38fc2dea06038fdbccfdff13a6ce99eb70b39ff23f983559e68c6d5567cf9f05f6b5d92febec9e26945c99b7751b086ceb3b47c529431582b0c73ce52f766196737929a17b0cf76d0f9894fd02ad2b78661aae7e1917bd082c1700960f6d5a9bedb5609b4d2cca9f3914966493afe5405dfe4fa626e1a9eed77b6bd254246992fdead8de5d81491fe9c29382158cbd63f88c939261dd64b30deeb760bc2e86c7d4d36f95abd5ef2ff44d46f130b81ab64f27b6574537b21b95ac810923d62ce2f9b3dc396003a30f2458593525dafe1957a43fbe554ae6d41ec5eee9ca54392fa32caa165a26c59508426c3c1318039b2e800037612be2ad69545a90b6723209f22324441a49f4d4413b5395818cb55ba64d530d11be1ca9e3b132c12f7efafeed928a1b6ccef64e76ed82ea764a0535f527c56107c724a839e307fceb70966b948b469390873dc7b5504153f7478e593f31fd3f81e231406e3559bf067a864d8ad7d83b78fb11841d63874a23e7236ed4274cb8e004f1ba92c71839a4d1f233604c748d79d847ac4e7cca4458d202b025c30b7c306e510df595521b06daf9b22e63fa7553d7266af8bc28adf4a71dd9c728ebf7be063fd5bd6c4885f0a38df15e46e315180906e6525bf6a3eddcafa8c3bd76a264444c4d212efd2fa72394602ab598141d87af58fbdfb9c527ead6fbcd2437be0ad95759bc2f1393d4a4d5208540ba464f3ae80acf8d98c65f07529d83332cb54e48c39415862ff6e050fd5ef1ab1155665efa137cfaef6eaa14c3692f31d0c2693e90727b0f3cc561f50b92fb89dbe1edbf773c8ae44de4a3dde092f1bf414759462ddc2159df9d0036c5c7456d2bf34301bdfe4e6d58f08da065f7012aca07d3be4508007ab8ff09c2fd1a14ad5738a57e2b86173c7e9d54ad3eed7ea8119dd09f6af8738b61f9baba7876395f64867937cb60a68a8254b822536fccdcd2138d10ef52820942280b5f42fb9f37c4291478a578fa43c0ec35d5e3ebffaded19f6c1f7ee61ce2e4ad8476f9d939c9bd433bd64361fc4a102ac54978cfcbe57f9e1724abd47b33075f3aea2bbdf2cc9d383e9f95b96f310545bef6b14484ba80f8e01567da75086cc9c8bfa4c416f6c8ff7f0000000000005d1ee6a4503315976a05d2308d96be4a9b2d3447685d9582ae93ec3a8c4d74b4fed75802a22fbc14d0dc06ce090e574f456d5d7e2c626036b815e1a6f1784ef5129c5926c14a86a3da15fbb91bf812e787f889f43998b3626d6c9fccbe593652f391ef8e231ea1e5effca2655791f296a1dfb18d378b54ba2250e571058c4df69314913a7a8268ef678ba883995f04998df4e7fee3795185b0eaea4fcb61953660faebe1722dbf0b42e16334830128d75be38095438642b66e24e7e366b3c02872cdb079550af08dc3294cb59cb61efa7eda606c5f0f723bbd117ed43696051252d018879e4bb2477d9b3cfb6b7ef8900f7d9d0b95b3b60c00894e7b8d9adf474993c34be09c801d0d1054e7906d99e6289664e950a9b4566fe4fa62ed893311c9499df01aabd87530430887fc7d87b1ff4b296157add420077f5db2c6e39abd3fbb9735b15f2db51a444e23ff5477bdfb21724940725fdd09cab73389c9eefd88d42e1ce856a5daf65774c77db2258c72434b1e46c1dcbfc1e7706a149b703dd380e9e0a82b9fc94f842da887a2861efa007005914d419c1f826a8c6a6fef0c7493545710901acfc0953a6b5776f086d38fc48d2b47a14963259ac5a74beafd212fd15780c4a01fc064d46e1c1cd25cd31955130e4b53582040df561e45dc697da4105c3a2c30ab0ccb06a6f5cbb985c84600d17b1a8d438f08f3cb9fa88cbced6dbc5c05748456781f073597707f8dcbc08c9d84a959c458e453b5e3db7ec4ab720f34b53628536e9490cfdd2191924bb3745ae3e64910b4d0d8c2f62e82cc6ff5fc6ee6112ecc001de73827cf4f6385ff605c4ca727f9442fc3cceaeb0ad5dbe1c6c27d5609c9e3dcfb45ca48148a2abd1c97797ed9536de2910014f1662363ca46ed4e03d5ad9bc7b579786bebb6ab30fe1542096258de312b1f20d69898bb5426325018f11cb21b3c86847d567604fd888df0c4f3873b5f62f8c48ec9e318c21ee8abcc2d9046058bf2579ae18bdcd2bc08e3d47ec26fa5d6d9fa691366716454cf95773bbae3c8c379b622de695e65a2f3d68bb1e195f71ad1078a021978b32872ff3a25d025f33c76ccc77fe79f6e02ffe3482bf27a60036de85898f15b7b3ae2a775361ceda499ef6c01d6fc9e0bdf6e432771e564ec69c765e233e363643b13a5952ec6acf0cb4441efbf914a0d0192219c1e2f564f9874d3071699f7494a40f8cdc435099916533a84d1336c40cb176c31ac79aedd3ee8cffd59ddd4c8ad364351f4099676698e7e9ca3666f8d2c9d9b2223dd2cf97a7b5c12282b724266af7470be7c9d2d542a73989393ba2d9d67a4aff5fae66a4fc64f737adf4a331971e4959ee9dfb027e0aae91a3b2763e165a9888cee77b66f9f8dc8d8b40bc5b36434839ece469d4e5d7c81880d66e16ae51dd7145a3d4e552ee8a52e52fdb2bdb384f05b7276cf627248f811d5a93c4054baa18389f5bfb8e4c1b7c5a11770c682c38367eb574fce632bbb716c0ab08f492efbcd575dccfbb835486b54a0af68199b74d37eb16b935e921e68fc2a6335b62d32d9bdcf9fbc6aedcdabadff06690606a6f2964f5d842fe55295e15983e7cee951911d195c4ffa2fb8497ca57b74804e95841a0e3ead1b096090a4904922911c8c5de1d96f3960bc0068125c6bfc12afc9ef23fa1331a24aab76ae2ad29eb2579c6903ac60f93f157d6e6f7580f01abdae79d8d6e1af190e63fea59c66ca93efbde90ccb70b13bd1110d7e066d5030687f3527b62d2fe80a797e83e409dbf66e96db", 0xbe3, 0xfffffffffffffff9) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0xe, 0x2010, 0xffffffffffffffff, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x121040, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0xa, 0x8000, 0x0, 0x9, 0x1, 0xfffffdffffffffff, 0xfa0f, 0xffffffff}, 0x0) mremap(&(0x7f00007f1000/0x4000)=nil, 0x4000, 0x800000, 0x0, &(0x7f0000130000/0x800000)=nil) openat$ttyS3(0xffffffffffffff9c, 0x0, 0x2982, 0x0) openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2000094}, 0x4000800) socket$packet(0x11, 0x3, 0x300) r7 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r7, 0x40045532, &(0x7f0000000840)) 6.091308364s ago: executing program 3 (id=2038): r0 = socket(0x11, 0xa, 0x0) mprotect(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000001140)='net\x00') prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0) getdents64(r1, 0x0, 0x0) getsockname$packet(r0, 0x0, &(0x7f00000000c0)) keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="65723a73797a203030303070303030c8710000000000003430393300"], 0x2a, 0x0) r2 = socket(0x10, 0x803, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0xa, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) llistxattr(&(0x7f00000000c0)='./file0\x00', 0x0, 0x0) syz_emit_ethernet(0x46, &(0x7f0000000000)=ANY=[@ANYBLOB="0380c2000000bbbbd8d0fdc654ea645169cce2449a3ec56fbbbbbbbb0800451000380080000000019078ac1e0001ac1414aa030490781206183f2500000000670000008900007f000001e000000200186371ae9b1c03"], 0x0) lseek(r2, 0x7, 0x3) 5.999469482s ago: executing program 2 (id=2039): socketpair$unix(0x1, 0x0, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000001c0)=@abs={0x0, 0x0, 0x4e23}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) socket$alg(0x26, 0x5, 0x0) recvmmsg(r0, &(0x7f0000001400)=[{{&(0x7f0000000440)=@rc, 0x80, &(0x7f0000000a00)=[{&(0x7f00000014c0)=""/233, 0xe9}, {&(0x7f0000000580)=""/151, 0x97}, {&(0x7f0000000940)=""/130, 0x82}, {&(0x7f0000001bc0)=""/4096, 0x1000}, {&(0x7f00000003c0)=""/14, 0xe}, {&(0x7f00000004c0)=""/42, 0x2a}], 0x6, &(0x7f0000000a80)=""/104, 0x68}, 0x61b}, {{&(0x7f0000000b00)=@l2tp6={0xa, 0x0, 0x0, @remote}, 0x80, &(0x7f0000000500)=[{&(0x7f0000000b80)=""/183, 0xb7}, {&(0x7f0000000840)=""/128, 0x80}, {&(0x7f0000000cc0)=""/241, 0xf1}], 0x3, &(0x7f0000000dc0)=""/209, 0xd1}, 0x8}, {{&(0x7f0000000ec0)=@vsock, 0x80, &(0x7f0000001280)=[{&(0x7f00000015c0)=""/204, 0xcc}, {&(0x7f0000001040)=""/100, 0x64}, {&(0x7f00000010c0)=""/32, 0x20}, {&(0x7f0000001100)=""/64, 0x40}, {&(0x7f0000001140)=""/29, 0x1d}, {&(0x7f0000001180)=""/207, 0xcf}], 0x6, &(0x7f0000001300)=""/246, 0xf6}, 0x1ff}], 0x3, 0x2, 0x0) (async) recvmmsg(r0, &(0x7f0000001400)=[{{&(0x7f0000000440)=@rc, 0x80, &(0x7f0000000a00)=[{&(0x7f00000014c0)=""/233, 0xe9}, {&(0x7f0000000580)=""/151, 0x97}, {&(0x7f0000000940)=""/130, 0x82}, {&(0x7f0000001bc0)=""/4096, 0x1000}, {&(0x7f00000003c0)=""/14, 0xe}, {&(0x7f00000004c0)=""/42, 0x2a}], 0x6, &(0x7f0000000a80)=""/104, 0x68}, 0x61b}, {{&(0x7f0000000b00)=@l2tp6={0xa, 0x0, 0x0, @remote}, 0x80, &(0x7f0000000500)=[{&(0x7f0000000b80)=""/183, 0xb7}, {&(0x7f0000000840)=""/128, 0x80}, {&(0x7f0000000cc0)=""/241, 0xf1}], 0x3, &(0x7f0000000dc0)=""/209, 0xd1}, 0x8}, {{&(0x7f0000000ec0)=@vsock, 0x80, &(0x7f0000001280)=[{&(0x7f00000015c0)=""/204, 0xcc}, {&(0x7f0000001040)=""/100, 0x64}, {&(0x7f00000010c0)=""/32, 0x20}, {&(0x7f0000001100)=""/64, 0x40}, {&(0x7f0000001140)=""/29, 0x1d}, {&(0x7f0000001180)=""/207, 0xcf}], 0x6, &(0x7f0000001300)=""/246, 0xf6}, 0x1ff}], 0x3, 0x2, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f0000000240)={0x2, 0x4e24, @broadcast}, 0x10, &(0x7f0000000780)}, 0x2000c040) (async) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f0000000240)={0x2, 0x4e24, @broadcast}, 0x10, &(0x7f0000000780)}, 0x2000c040) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x0, 0x0, 0x200000, 0x0, 0xb49, 0x6, 0xc, 0x0, 0x1}, 0x0) syz_open_dev$dri(0x0, 0x1, 0x0) (async) syz_open_dev$dri(0x0, 0x1, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) read$dsp(r2, 0x0, 0x0) (async) read$dsp(r2, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r3 = fsopen(&(0x7f0000000400)='nfs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f0000000280)='source', &(0x7f0000000680)='//\xf2/\x06\b/\xdf/o\xdc\xea\x95\x9a\x82\x10\x97W\x8f7\x98\x9b\\/\\\xf9\rmD\x94)U\xdb\x15X.I\n}\xf3\x9d\xe4_\x05\x9cqf4I^#b?9\xde\xafu\'\x83L\xe0\x97\xe1n_\xa4%\xb1\x97\x93\xafv\xce/\\\xb4L\xf2_\xa7\xfb\xf4\x84\x1fA\xeas^\xef\xa2\x85\xa3!\xfb\x93\xd7R\xab2\x1eW\xe9h\x9b\xf7ul\xf9D\xd4\x82X5\x13\xaa\x87\xf9\xba\xa9m\x14\x14R_\x9a\\>4\xce\x8e_#\xf8D\xb1\xdep\x01\xcc:\xa6\xc5n\xeb\xab\xf70\x99\xef\x8b4\xce\x8e_#\xf8D\xb1\xdep\x01\xcc:\xa6\xc5n\xeb\xab\xf70\x99\xef\x8b4\xce\x8e_#\xf8D\xb1\xdep\x01\xcc:\xa6h\xd1\x1d\xac\xaa\xfb\xc7Y\xcd\xc5n\xeb\xab\xf70\x99\xef\x8b0x0}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r5, 0x3b87, &(0x7f0000000380)={0x18, 0x1, 0x0, 0x0, r6, 0x200}) r7 = syz_open_procfs$namespace(0x0, &(0x7f0000000640)='ns/time_for_children\x00') open_by_handle_at(r7, &(0x7f0000000000)=ANY=[@ANYBLOB="20000000f100000006"], 0x4000) ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f00000000c0)) (async) ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f00000000c0)) ioctl$PPPIOCSMAXCID(r4, 0x40047451, &(0x7f0000000200)=0x8) ioctl$PPPIOCSFLAGS1(r4, 0x40047459, &(0x7f0000000100)=0x2000004) pwritev(r4, &(0x7f00000002c0), 0x0, 0xe, 0x200004) (async) pwritev(r4, &(0x7f00000002c0), 0x0, 0xe, 0x200004) r8 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000180)={'dummy0\x00', @dev={'\xaa\xaa\xaa\xaa\xaa', 0x44}}) (async) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000180)={'dummy0\x00', @dev={'\xaa\xaa\xaa\xaa\xaa', 0x44}}) lseek(0xffffffffffffffff, 0x1000000, 0x0) 5.675411441s ago: executing program 2 (id=2041): r0 = socket$inet_udp(0x2, 0x2, 0x0) creat(&(0x7f0000000340)='./file0\x00', 0x8) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x2e, 0x0, &(0x7f0000000180)="e30080670000ec67838717bd86dde1484db4241544716b9ea42231ed9953a3d05dacf5bb80b4b7ee0fae7aea5349", 0x0, 0xa0000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x3}, 0x50) r1 = getpid() r2 = syz_pidfd_open(r1, 0x0) setns(r2, 0x24020000) r3 = syz_clone(0x16040000, 0x0, 0x0, 0x0, 0x0, 0x0) r4 = landlock_create_ruleset(&(0x7f0000000000)={0x110, 0x0, 0x3}, 0x18, 0x0) landlock_restrict_self(r4, 0x0) r5 = landlock_create_ruleset(&(0x7f0000000080)={0x220, 0x1, 0x1}, 0x18, 0x0) landlock_restrict_self(r5, 0x0) landlock_restrict_self(r5, 0x0) rt_sigqueueinfo(r3, 0xb, &(0x7f0000000080)={0x36, 0x208, 0xfffffff3}) r6 = syz_open_dev$sg(&(0x7f0000000140), 0x6f5e, 0x1) ioctl$FIBMAP(r6, 0x1, &(0x7f0000000040)=0x85) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000000)=@filter={'filter\x00', 0x42, 0x4, 0x2d0, 0xffffffff, 0x130, 0x130, 0x238, 0xffffffff, 0xffffffff, 0x238, 0x238, 0x238, 0xffffffff, 0x4, 0x0, {[{{@ip={@rand_addr, @empty, 0x0, 0x0, 'veth0_to_batadv\x00', 'wlan0\x00', {}, {0xff}, 0xc, 0x2, 0x2}, 0x0, 0x70, 0x98, 0x0, {0x100000000000000}}, @REJECT={0x28}}, {{@ip={@loopback, @empty, 0xffffff00, 0xff000000, 'geneve0\x00', 'macsec0\x00', {0xff}, {}, 0x2e, 0x0, 0x4}, 0x0, 0x70, 0x98}, @common=@inet=@SYNPROXY={0x28, 'SYNPROXY\x00', 0x0, {0x1f, 0x9, 0x2}}}, {{@ip={@multicast1, @loopback, 0xff, 0xff000000, 'bond0\x00', 'dvmrp0\x00', {0xff}, {}, 0x2f, 0x0, 0x21}, 0x0, 0xe0, 0x108, 0x0, {}, [@common=@unspec=@ipvs={{0x48}, {@ipv4=@broadcast, [0xff, 0x15e8e3e2862adc62, 0xff, 0xff000000], 0x4e20, 0x0, 0x0, 0x4e24, 0x20, 0x8}}, @common=@icmp={{0x28}, {0xb, "20a3", 0x1}}]}, @REJECT={0x28}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x330) r7 = socket$rds(0x15, 0x5, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(r7, 0x114, 0xa, &(0x7f0000000000)=ANY=[@ANYBLOB="e6"], 0x4) r8 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0100000002000000400000004000000000000000", @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000e6ffffffffffffff00"/28], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000540)={0x1, 0x8, &(0x7f0000000180)=ANY=[@ANYBLOB="180200000e000000000000000000000018120000", @ANYRES32=r8, @ANYBLOB="000000bf01000000b703000000000000850000008506000000000000000000009500000000000000"], &(0x7f00000000c0)='GPL\x00', 0x3, 0x0, 0x0, 0x40f00, 0x5c, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) 5.555011927s ago: executing program 6 (id=2042): getresuid(0x0, 0x0, &(0x7f0000000280)) unshare(0x2a020400) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xfffff000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x101302, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r5, 0xc00caee0, &(0x7f0000000100)={0x4, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r6, 0x4018aee1, &(0x7f00000001c0)=@attr_other={0x0, 0x1, 0x2, 0x0}) socket$inet6_udp(0xa, 0x2, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000300)=ANY=[@ANYBLOB="3800000010000104fcffffffffdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="03150000000000001800128008000100707070000c00028008000100", @ANYRES32, @ANYBLOB="79ae826f905cf73d3a7fdeb9c657a180f90aa691ee2516e9676bd1ac804f42c77c6a195cd066988948d2492bc306acb7671f3df69663075f9755cb11a5372c9501d779bdd8572471851c2865de176085b34fccf8919eb96db23b487aa549b9c0aef1cc87ae410a209d01341db753f2bdfa8714cf2e4b22b4ee500d5ca17e8f429be6a7114c5d03077cc7633a4e30250de83370a3f9ca46ef3401d674ff1f91f9b4f940967cc66a46c08a47bebb5927d26ad15adbfd14d1a633c8e990968bf75594d3"], 0x38}, 0x1, 0x0, 0x0, 0x2004d808}, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000500)=@newlink={0x68, 0x10, 0x1, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, r9}, [@IFLA_LINKINFO={0x48, 0x12, 0x0, 0x1, @ip6gretap={{0xe}, {0x34, 0x2, 0x0, 0x1, [@IFLA_GRE_REMOTE={0x14, 0x7, @local}, @IFLA_GRE_LOCAL={0x14, 0x6, @dev={0xfe, 0x80, '\x00', 0x15}}, @IFLA_GRE_LINK={0x8, 0x1, r9}]}}}]}, 0x68}}, 0x0) 5.471012412s ago: executing program 2 (id=2043): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) (async) r1 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r1, &(0x7f0000000140), 0x10) sendmsg$can_bcm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB="05"], 0x48}}, 0x0) (async) sendmsg$can_bcm(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)={0x5, 0x901, 0x0, {}, {0x0, 0x2710}, {}, 0x1, @canfd={{}, 0x0, 0x0, 0x0, 0x0, "d7c139a0d4fe372efa7e8cdba3417665ffb2b92af56c860b29402f8111302ae84c15b9dd43bda8847acbe40605b5ee1c8f0676814afc7e9f0413567e592c7c15"}}, 0x80}}, 0x0) sendmsg$can_bcm(r1, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000000c0)={0x6, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x7, 0x0, 0x0, 0x0, "a464357177330772"}}, 0x48}}, 0x8044) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(r0, 0x84, 0x4, &(0x7f0000000140), &(0x7f0000000180)=0x4) (async) syz_usb_connect(0x6, 0x36, &(0x7f00000002c0)=ANY=[@ANYRESDEC=r0], 0x0) (async, rerun: 64) ioctl$sock_SIOCGIFVLAN_SET_VLAN_EGRESS_PRIORITY_CMD(r0, 0x8982, &(0x7f0000000000)={0x3, 'hsr0\x00', {0x4a7}}) (rerun: 64) 5.14730053s ago: executing program 5 (id=2044): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_open_dev$dri(&(0x7f0000000180), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f00000000c0)={0xd5, 0x1002, 0xa}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r2, &(0x7f0000000380)={0x2, 0x4e22, @multicast1}, 0x10) r3 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000300), 0x2842, 0x0) read$FUSE(r3, &(0x7f0000002900)={0x2020}, 0x2020) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) splice(r3, 0x0, r4, 0x0, 0x7c1c, 0x8) ioctl$DRM_IOCTL_AGP_ENABLE(r4, 0x40086432, &(0x7f0000000580)=0x2) write$apparmor_exec(r4, &(0x7f0000000000)={'stack ', '\x00'}, 0x7) setsockopt$sock_int(r2, 0x1, 0x800000000f, &(0x7f0000000080)=0x7, 0x4) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r5, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) listen(r2, 0xb5d6) bind$inet6(r5, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @loopback, 0xffffffff}, 0x1c) r6 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000b80), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_TSINFO_GET(r0, &(0x7f0000000f40)={0x0, 0x0, &(0x7f0000000f00)={&(0x7f0000000d00)={0x34, r6, 0x1, 0x70bd27, 0x25dfdbfb, {}, [@HEADER={0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x4}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'gretap0\x00'}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x4040894}, 0x4040094) 5.087022153s ago: executing program 3 (id=2045): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000640)="430fc73f0f2390b9800000c00f3235010000000f300f20d835080000000f22d8c4e18173f53866baf80cb83879e487ef66bafc0cec66b88e008ec02d1aa80000460f1c460041ae", 0x47}], 0x1, 0x74, 0x0, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000240)) write$P9_RSTATu(0xffffffffffffffff, &(0x7f00000000c0)={0x6cb, 0x7d, 0x2, {{0x500, 0x319, 0x0, 0xde, {0x4, 0x2}, 0x0, 0x0, 0x7, 0x4, 0x2e, '\x04nodZ=\xbfd\x027\xfcb%\xff\xff\xff\x80\x05\x00\x00\x00\x00\x00\x00\xff\x03\xff\x92\xe9\x16\x00\x05\x9beq,\x93\xcb=\xb6\xc21\xd1\x19\xaa\xa1', 0x9a, 'p\x02\x00}\xfag>\xff\xeb\t\xb55\x1f\x9e\xde\x05J\x00\x00\x00\x00\x18{\x82\xd9\xb5i(\xfb\xbf\v\x00\x00+Y_\xcb\x14\xa8\xf3\x0e&\xe5&\xab\xc1\x80jB\xdez\xdc\x81\x06\xb4\x94\xe1\x8d\xb5\x7f\xc1\xac\x8d\x06\x85\x95\xf0\x1c\x1c\xbe\x05\xc2v\x16/\x81\xb4\a\xe5\r\xb6\x939g!\xf3\xed\x9c\xe2\x01\x9e\xe6\xa9F\xe3\xa5Z\x1b@\xee\xb9:\xc2\x9f7[Z\xfd\xf1\xdf\x11,\x9a\xaf\xd3i\x94\xe1e\xb3:\xf7\x86\xc54\x05\x87]7\xa0E\"\x17\x8b7P\x9es\xc7\x02_\xc4\x13\xc7\xd1*\x80\x86?p#hf\x8d', 0x99, '-a\xcc\xeb\xb8\xc8\x86A\xeb\x93\xb4\xcc\xf6\x00*\xb8{\xfc\b\xe2\xe7H\xa2\x1dQH\x00\x00\x00\x00\x00\x00\x00\x00\x00\xc2\xcf4\xd6\xa5\x99 \xc3z\x82D\x941\xbe\x81y\xbf2n#kz\xa2Bu\xd4y-\xe8\xa9QM\xe4\xe8\xc0eh:\xb8s\xd0\x1e\x0e\b\xff!20\x1a\x94\xf5K\x80\xb48E\x89T\\=\xd5\x12UT\xef\xf2\xa0B\xe3\xe1\x00d.\xc3\xc1Z>\xdd7\xbd\xa7JFq\x1fZ\xefw\xd4\xed\x9fVb~\xcc\xaa\xee\xfb\xef\xe3|\x14\xae\xe1:\xba\xbdN\v\x15[\xa8\xa2K\x00\xcf\xf3_', 0x185, '\xf8\xf6i\xfbqm\x9a\xc6[\x94\bg\x8c,;\x9e\x1dR\xc3l\xde{\xa4\xa4\x00\xb4\xb0\xb4\xf1t\xa6f\xa8R\x9aE\x1b4\a\xdb\xda\xb2\x88K\xaf\x05\x00\x00\x00\x00\x00\x00\x00G\xec!\xca\xbf\xf2\x0f\x9c\x1c\xbe6\xf4\xfd\x1aL\xdb\x80\xe8\xd4\a\x00\x00\x007\x00\x87\x0fFB\xe4\xc5\xde\x87\x14\xa2\xb0\x84L#E\xd8\xdfI\xd7\x00\xef\xc4R\xaf\xb5F\x9e\xaa\xd2\xc8\x85z5$F\xae+N\xa7\b\xfa\"\xc6\xdeH\x82\xe3FAQ\xdfC\xbeZ\'\x9a\x95\xf2\xa9\x00\x17D\xa9tSXF\xe1>-\f\xb4\x9eJ\x0f\xa1u3C\xb8\xa3\xc0\xaf\xca\xe6,\xc4)\xc0\xec}dT\x00\x00B\x8dX\x9du\x9fa~\xa1\x95\"\xc6/\x19$\x80\x11\x9b(\x01\xc9\xc1\x04\x14\x05`\xf2\r8Y\n\x81\x98*\x94\x90\xb3\x95\xe9\x00t\v\xdc\x1a\xb08w&A\x9b\xff\xd5\xc7s}L*\x17\xb9/\x18\xed\xc9\x9c\x10\x99\xe4\x0f\x13\xd8(\x04\x9f<[:\x7f\xe00\xd9\xc7\x8a\xea\x99\x03\xaf\x14#U\xf5I\xab\xb3\xf7\xb4\v\xb0\x10\"+O\xed\xec\xd3\x0e\xa3\x9e\xc49fG\"a\xb0\xd5\xabe\x14Cj\xc3\xb9pn\x01\xeb\xfe^\v\xb34w\xd1\xcfx\xe0l\\\xd5\x83\xa4\x9b3jV\xba\xb25\x90\xba\x87\x0f\xc2Et\xbf\xf1\x8c\xb5\x81\x92\xdet%>\xde\xab\xcc\n\x02\xcd\xc7\xd4>\xc4\x84\x88\x0e\xa7\xfb\xc4\x80e\"\xc7\x8e\x1f\xa7\x06\xda\x87\b\xeaQ~\\\x8b_*\x10w\xf6\xf6\xf3\xdd`\xfd\xf9B\"\xe9\xa2g/\x80:'}, 0x39d, 'odev/n\xb1{#\x00\xf9\xda\xa5\xee#&n\xcf\x85\xfe\xa6^B\xd9y\xa3\xfd\xe5\xf4u\xda\xf0;\x11r\xd9{\xad\xc7\tZ\xfdv\xfeO\fA\xf7\xf7t\x1e\xac\x03\x00\x00\xec\xff\x00\x00\xdb\xa0\xc2\xf7\xf0\x9f\xf5<~M\x1a\xd6n-\a\x01\x98\x01\x9f0\x11\x84G\xaau\xf8$k\xccB\xea\xa8\xc61\xc0\xc5\x00\x95\x9at\xf5\x16\x85\xf5\x06\xae\x89H\x06\x87\x82g\xd5\xa1)\x8dy,J7\xf2\xe1\xcb\xbd$\x82\x92\x9a\r\x89r\xb5\xcfs.\xa5\xb0\xd7#\x85\x93\xae\xd3\xb4.\xe7\xca\xc0}\xe0\x9d\x1dh\xa6\x033\xa8\x82F}+1\xaa\xfbV\xc5}}\xc6&\xe49\a\x96\xa1\xebH\'Fi\xab\x13\xf8\xb1\x1d\x14`Y\xf3\x10\xe2cMY?\xece\xd5)\xf3\x82\x06fd\xc0\xfbNL\x90W\np\x04\x9f9\x9f\x06\x1fu\xb7y|\xe1\xfe\x11\xea\x91\x96\t\xd5\x1aA\xdd=\xe3\x04\xbd|~\xd0\xa4V\xf0\xae\x12.a\x05\xc9\xce\x88}\xf5\xa6\xe0\xb6\xa7}Yl\xf8\x8b\xa6\xe5\xc69|}P!\xd7\x98\x95(\xfd\x179\xe1\xc2\xd8\x7f\xc2\x00\x00\x000\xe4\xee+\xfc\x7f\x80P\x85\x11C\xe5\x16\x1a\xcdG\x15\n\xcb\xaft8\"\xdf\xe2\x03\xb1\b\xd3~\x91M\xc1\xe5>#LP\x9e\xcaA\a\xa1q,\xaa\x9d\xa5=\x05\x1c6\x88Ly\x18&a\xf3\xca6\xbc\xdb\xfb\xbd&q\t\xf81\x9d\x8d\xd5\xc0p\x99\xeb\x1b\x11\x03\x06U\xf5biOat=\x19B\x1bJ\x19\xef\x8b\x8bL\xe9\xc9\x93\xc7\xd6\xcb0\fNezNP\xa3[\\\xc1k\x8c\x16\x1a\x8e=\xf9\x03k\xbc\xf2\x8a\xdc\xd1\x9alL)\x17\t\xae\xe5\xab>[\xc5\xae)\xf4u\xe4\xd2D\b\xb5\x16}\x0f\xaf_\xc1Vkp\\\x8b`\xaf\xa8\xac\xa4/~\x04i\x18\x8a\x0e\xf0b\xca\x18\xe3\x8f\x9e\xe1\n\xc7}+~\xb9\xd6\x0e\xa7\x9f\xdbUd\x11\xe5\x9d\xfb\xd8\xdb\xb8\xa2\xa6b.\xbc\xf8Lio\xa4\xda!\xba\xd22\r\rh\xe9\xbfCF\xf0ha\x19\xa3\x9e@\x03\x95\xc8\xf2\x82^\xa0i\xae\x0e\x14;\xd1\xa4Ay\xed\x8e<\xea\v^\x9a\x19\xcc\x7f\xfaP\x0f\xa4\x1bl\x80I\xbd\xe4X\'\xd5N\xc9\x01\xd2z\xd1%\x05h\x89\xb33k?\x06\x83\x8c[fz\xe2.\xfe;\xc1[\x82_\x7f\xbc\xe4\x80\'(\x1c\xf9\xfe\x8f\xc2\x1f\xc7|$=\xe2g\x051\x0e\xb8\x1c\xf7M\xe0)1\x92\xa1?j\xd0W\xdea\xfd\x8a\xba\x8e\xf4C\x9b\xc0jE\xb2\xb01bQZ#C:\xfe\xb5*\xed\xb5\xabo3FS8\x05\x15\xf7y\xf3]\xc8\xa7\x8c7w$\x92\xa2(L!\xd2\x13V\xd4s\xf0\x0f\x85\x13|{\xf0cou}5(\x86\x9b?\x00w5\xcf\xf8\\\x9d\x97\x8b\xf5]\xcc&\xd6-%\xe3\b\xf0\x88\'\xa9\x1f\xf4{\xec\x92\xf8\xe9\x1ey\bfT\x00\xaaN9\xb3Y\x86#\x9d\\{\x94\x92\xc5\xbb&\xbcU\xb5[I\xedpHnn}\xa3\x8c \x84P\xf9\xf7\x9e\x1bA\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xae-[\\\x99\xf7\x17\xf0\xa0wI#\x9b]\b\xf8\xc5\xc0\xadyQ\xe0\xa7\xc7\xf3\xdb\x8d\xfd?\x86W%\x8al\x04\xf3-W\xad(s\xdeE\xfa\x98\xb0\xf8&y\x17\xff\x9b\xbe\x9c\rt\xa5\xac\xa2\x06\xfe)\xe0\xc1\x03\x9f\"U<\'GB]\x83\x100x.\xe7\x8f\x8b\xa3]\xe3\x18\xc5?\tO\x92\\\xc9x.\x94\xb6\xc8p\xa4\x87g\x8b\xfa\xe7E\xdf\xf2h\xbd\xa7\xfd\xec\x87<\xe4\xfbK\x8d\xcb\xa0A\x9b0D\x9a\xdf\xefrAb\xbf\xb1\n\xaf\xcf\xeaH\xa6\x7f\xaew3\xcc:\x7f\x1e\xef\x91\xbeR\x85!^\xabA\xf6', 0xffffffffffffffff}}, 0x6cb) r3 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000041436120410e5150e8d5000000010902f98a5c01000000090401001186eee2000905821704"], 0x0) syz_usb_control_io$sierra_net(r3, 0x0, 0x0) syz_usb_ep_write$ath9k_ep1(r3, 0x82, 0xffffffffffffff42, &(0x7f0000000000)=ANY=[]) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, 0x1, 0x2}, 0x28) ioctl$KVM_RUN(r2, 0xae80, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x100000, 0x2) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x13f, 0x9}}, 0x20) r6 = mmap$binder(&(0x7f0000012000/0x4000)=nil, 0x4000, 0x1, 0x11, r4, 0x6) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000280)={0x28, 0x0, &(0x7f0000000200)=[@dead_binder_done, @exit_looper, @free_buffer={0x40086303, r6}, @register_looper, @enter_looper, @register_looper], 0xd8, 0x0, &(0x7f0000000440)="9611f8c7693079ef56291da7e56cd13a6475ae728a2b4525bc3948f1fa0d31481dd273df6b1eaf117c8cd5ec4339f0a62b6a0c45c3fc5b2f02d5df38dd9102491c93050299e396b5660e94d9484e0e6911eaecd7244e9d8188748ffa022fe02de40f986990817a88508adbba84476f252714f19d00dd0d8641236c19eaf81677d64b60cb65958d07ebc95577138009a8d46e9739e6a47a2cec7582f1f406ef790609b9ad620ddf9a90cf1c2103da9d4e4975dfa6c4d78ede77d3b2ff7488ef7cb6c67cc587bead58580815c4c90493a02425bc737f37c30a"}) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x29, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000008c0)=@newqdisc={0x24, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r9, {0xffff}, {0xffff, 0xffff}, {0x2, 0x1}}}, 0x24}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000040)={'team_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r10, &(0x7f00000012c0)={0x0, 0x3f, &(0x7f0000000580)={&(0x7f0000000140)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r11, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x8}, @TCA_EGRESS_BLOCK={0x8, 0xe, 0x8}]}, 0x40}}, 0x0) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r4, &(0x7f0000000a80)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000a40)={&(0x7f0000000980)={0xb4, 0x0, 0x400, 0x70bd27, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_ADDR_REMOTE={0x4}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x4}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0xe}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x10000}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0xfffff001}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x34, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_ID={0x5}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r9}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0xfed3}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x6}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x14, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @broadcast}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}]}, @MPTCP_PM_ATTR_ADDR={0x24, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r11}, @MPTCP_PM_ADDR_ATTR_ID={0x5}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0xd}]}]}, 0xb4}, 0x1, 0x0, 0x0, 0x8011}, 0x8800) setrlimit(0xf, &(0x7f00000007c0)={0x1, 0x5}) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000180)=ANY=[@ANYBLOB="50000000210001b0a44bfb000000000004000000ff010000000000000000000000000001fc0200000000000000000000000000f6c8499385cfc1a4187b03651400000000f0cd7900000000000a", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x50}}, 0x0) r12 = syz_genetlink_get_family_id$l2tp(&(0x7f00000003c0), r4) sendmsg$L2TP_CMD_SESSION_MODIFY(r4, &(0x7f00000006c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000600)={&(0x7f0000000540)={0x50, r12, 0x800, 0x70bd29, 0x25dfdbff, {}, [@L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x5}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x7}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0xf6}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x3}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x1}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x9}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x50}, 0x1, 0x0, 0x0, 0xc5}, 0x1) 5.046417329s ago: executing program 5 (id=2046): r0 = syz_io_uring_setup(0x4587, &(0x7f0000000ac0)={0x0, 0x85650, 0x80, 0x0, 0x254}, &(0x7f00000002c0), &(0x7f0000000300)) io_uring_register$IORING_REGISTER_BUFFERS2(r0, 0xf, &(0x7f0000001580)={0xf2, 0x1, 0x0, 0x0, &(0x7f0000000200)}, 0x20) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000}, 0x0) r4 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r4, &(0x7f0000000000)={&(0x7f0000000080)=@rxrpc=@in4={0x21, 0x3, 0x2, 0xffffffffffffffe2, {0x2, 0x4e22, @empty}}, 0x80, &(0x7f0000000140)=[{&(0x7f0000000ac0)="ee", 0xfffffe5e}], 0x1, &(0x7f0000001a00)=ANY=[@ANYRESDEC], 0x10b8}, 0x8000) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = io_uring_setup(0x4e67, &(0x7f00000001c0)={0x0, 0x4bc8, 0x0, 0x2, 0x2d5}) io_uring_register$IORING_REGISTER_PBUF_STATUS(r6, 0x1a, &(0x7f0000000140)={0xfff}, 0x1) sendmsg$nl_generic(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c00000040000748cfbe67a6f83df0db8e67258ea9b001feffffff00000000017c00000400428004000180"], 0x1c}, 0x1, 0x0, 0x0, 0x48815}, 0xc000) r7 = openat$sndtimer(0xffffffffffffff9c, &(0x7f00000000c0), 0x40400) ioctl$SNDRV_TIMER_IOCTL_PAUSE(r7, 0x54a3) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000007c0)=@newtfilter={0x5c, 0x2c, 0xd27, 0x70bd28, 0x8000, {0x0, 0x0, 0x0, r3, {0x8, 0x7}, {}, {0x8, 0x3}}, [@filter_kind_options=@f_flower={{0xb}, {0x2c, 0x2, [@TCA_FLOWER_KEY_ENC_OPTS_MASK={0x10, 0x55, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_ERSPAN={0xc, 0x3, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_ERSPAN_VER={0x5}]}]}, @TCA_FLOWER_KEY_ENC_OPTS={0x18, 0x54, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_ERSPAN={0x14, 0x3, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_ERSPAN_VER={0x5, 0x1, 0x1}, @TCA_FLOWER_KEY_ENC_OPT_ERSPAN_INDEX={0x8, 0x2, 0x100c}]}]}]}}]}, 0x5c}, 0x1, 0x0, 0x0, 0x26044028}, 0x800) r8 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000240), 0x400, 0x0) read$dsp(r8, &(0x7f0000000600)=""/78, 0x4e) sendmsg$NFT_BATCH(r1, &(0x7f0000000080)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000a00000a08010000050a01040000000000000000050000073c00048008000240115984e514000300776731000000000000000000000000000800024030138351140003007465616d5f736c6176655f300000000008000540fffffffc2c0004801400030073797a5f74756e0000000000000000001400030076657468305f6d6163767461700000000c000240000000000000000408000540fffffffc47000c001e8931dcb438b85830c4f38cc1df02590bf5d8b6c3e34f9586957be82d1320baf1094a3c34fdcd4a8144b4ff01eb42f7131cb50cbbc9ccc34bb86e0e4b3c2135687e070008000a40000000010b00070066696c7465720000080007006e6174000900010073797a300000000020000000120a01010000000000000000020000080900020073797a310000000068010000140a05000000000000000000030000070c0006400000000000000002f3000800292e4a4a5ccc911b5ffa712384ff32a7d3161ac032653f2f6632c6fbc0ab4ab6d1654f833e1566a530a8a561243a49d413819a93a63b6524e7d7d0a1d436531af1021fc8cc758390b4a2fb63c30bd935f509468ff42f4e0e000000000000008c76f2fd46c812d07c9ab5b2df79be5afa2cf5c0f62617ed13fc006b906988d9710d22dcb523f8f762832840be61f45d2577e3dc93d90c1ad8db4f5c1bbae6ae92a3f317c8d9d205e83d6bd167b796c8d58c9daf530dee1fe2c024afd1de9dc4a2794c096aaeb1685f1474c93291aec8869467662cd3a4150ae62760ac9a95210f16c39c4b9f852a9323333bf47046cc9b88ae3e0008000340000000010c00064000000000000000050900021fa1f53a3200000000080003400000000a0900020073797a30000000000900010073797a300000000008000340000000020900010073797a310000000014000000110001000000000000000000"], 0x2b8}}, 0x10) 4.831390231s ago: executing program 5 (id=2047): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085", 0xcb}], 0x3, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) syz_open_dev$video4linux(&(0x7f0000000080), 0x2, 0xc878a41a0e64cc4e) syz_open_dev$vim2m(&(0x7f0000000000), 0xdcc2, 0x2) fsopen(&(0x7f0000000580)='overlay\x00', 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) modify_ldt$write2(0x11, &(0x7f0000000200)={0x0, 0x20000800, 0x2000, 0x0, 0x3, 0x1, 0x1, 0x1}, 0x10) socket$inet_udp(0x2, 0x2, 0x0) r4 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x22902, 0x0) ioctl$FBIO_WAITFORVSYNC(r4, 0x40044620, 0x0) dup(0xffffffffffffffff) socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000002380)=ANY=[@ANYBLOB], 0x28}], 0x1}, 0x4000800) 4.739901475s ago: executing program 2 (id=2048): r0 = syz_usb_connect(0x2, 0x24, &(0x7f00000012c0)=ANY=[@ANYBLOB="08000000000000000102030109021200010000500f090458000052b4a62c"], 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$sierra_net(r0, 0x0, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) (async, rerun: 64) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000100)) (async, rerun: 64) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f00000001c0)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc0004}]}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x0, 0x0}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f00000000c0)={0x1, &(0x7f0000000000)=[{0x6, 0x5, 0x4, 0x7ffc0001}]}) setsockopt$IP_VS_SO_SET_ADD(r1, 0x0, 0x482, 0x0, 0xfffffffffffffe95) (async) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) (async) ioctl$SIOCGSTAMP(r3, 0x8906, 0x0) (async) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f00000000c0)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x4, 0xfff, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) fsetxattr$security_capability(r3, 0x0, 0x0, 0x0, 0x1) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x113c}}, 0x8004) (async) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCMSET(r4, 0x5418, &(0x7f0000000200)=0x8201) (async) openat$ttyS3(0xffffff9c, &(0x7f0000000240), 0x220080, 0x0) close(0xffffffffffffffff) r5 = openat$sequencer2(0xffffff9c, &(0x7f00000001c0), 0x0, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r5, 0x40085112, &(0x7f0000000180)=@t={0x4, 0x8, 0x1, 0x2}) (async) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) pread64(0xffffffffffffffff, &(0x7f0000000100)=""/50, 0x32, 0x20000000000040) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c00000010000304ffffffff0000000000000400", @ANYRES32=0x0, @ANYBLOB="0003000002800000140012800a00010069706f69620000000400028008000500", @ANYRES8=r6, @ANYBLOB='t'], 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x4000) r7 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r7, 0x6, 0xc, &(0x7f00000004c0)=0x279, 0x0) 4.676308699s ago: executing program 4 (id=2049): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000001980)=ANY=[@ANYBLOB="c001000019000100fffffffffcdbdf2500000000000000000000000000000000fffffffc00000000000000000000000003000000fffc00000a00800087000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fbffffffffffffff000000000000100000000000000004000000000000000002000000000000000000000000c06b6e0000000000000000000c001c00", @ANYRES32=0x0, @ANYBLOB="0000000044000500e0000001000000000000000000000000000004d4ff0000000a000000fc0200000000000000000000000000010000000003025b000100000000000000b5000800b10008"], 0x1c0}}, 0x2c000010) 4.600393641s ago: executing program 4 (id=2050): madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCADDRT(r0, 0x890b, &(0x7f0000000000)={0x4000000, {}, {0x2, 0x0, @empty}, {0x2, 0x0, @empty}, 0x2a0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x1}) ioctl$sock_inet_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={0x0, {}, {0x2, 0x0, @broadcast}, {0x2, 0x0, @empty}, 0xab852ebbeefbd6b1, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x7}) r1 = socket(0xa, 0x1, 0x0) r2 = openat(0xffffffffffffffff, &(0x7f00000000c0)='./file0\x00', 0x98c82, 0x20) r3 = open(&(0x7f00000001c0)='./file0\x00', 0x10040, 0x189) socket$inet6_udplite(0xa, 0x2, 0x88) clock_gettime(0x0, &(0x7f00000003c0)={0x0, 0x0}) mq_timedreceive(r3, &(0x7f0000000240)=""/231, 0xe7, 0x5, &(0x7f0000000400)={r4, r5+10000000}) r6 = inotify_init1(0x80000) inotify_add_watch(r6, &(0x7f00000000c0)='./file0\x00', 0x14) setxattr$incfs_metadata(&(0x7f0000000340)='./file0\x00', &(0x7f0000000380), 0x0, 0x0, 0x0) removexattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000140)=ANY=[@ANYBLOB="73797374656d2e5d7f657226796e63667bae6d6574616461746100"]) setsockopt$sock_int(r2, 0x1, 0x3, &(0x7f0000000100)=0x9, 0x4) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\f\x00\x00\x00\x00\x00', @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) bind$inet6(r1, &(0x7f0000000080)={0xa, 0xe64, 0x3, @ipv4={'\x00', '\xff\xff', @empty}, 0x202}, 0x1c) r7 = socket(0xa, 0x1, 0x0) setsockopt$sock_int(r7, 0x1, 0xf, &(0x7f0000000040)=0xa, 0x4) bind$inet6(r7, &(0x7f0000000480)={0xa, 0xe64, 0x3, @empty, 0x2}, 0x1c) syz_clone(0x40021080, 0x0, 0x0, 0x0, 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x0, &(0x7f0000000100)}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r3, 0x3ba0, &(0x7f00000004c0)={0x48, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) r9 = socket$rds(0x15, 0x5, 0x0) r10 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r10, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000840)="89000000120081ae08060cdc030000fe7f03214e000000000001ffca1b1f0000000024c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec00150c00034003080c00bdad446b31007a46e3988285dcdf12f21308f868fece01955fed0009d78f0a947e", 0x75}, {&(0x7f0000000140)="11d6cb557c8496a2fe7a81f38210bfa9b70ee09c", 0x14}], 0x2}, 0x4000000) socket$packet(0x11, 0x2, 0x300) setsockopt$SO_RDS_TRANSPORT(r9, 0x114, 0x8, &(0x7f0000000080)=0x2, 0x4) setsockopt$RDS_FREE_MR(r9, 0x114, 0x3, &(0x7f00000007c0)={{}, 0xc}, 0x10) close_range(r1, r8, 0x2) 4.327952225s ago: executing program 6 (id=2051): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000d00)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000050000000900010073797a30000000002c000000030a01010000000000000000050000000900010073797a30000000000900030073797a300000000058000000060a010400000000000000000500400008000b4000000000300004802c0001800b00010074756e6e656c00001c00028008000340000000f5080001400000000008000240000000140900010073797a30"], 0xcc}}, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x20, 0x3, 0x1, 0x201, 0x0, 0x0, {0x1, 0x0, 0x8}, [@CTA_FILTER={0xc, 0x19, 0x0, 0x1, [@CTA_FILTER_REPLY_FLAGS={0x8, 0x2, 0x1100}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x4048002}, 0x4040090) quotactl$Q_SETINFO(0xffffffff80000602, &(0x7f0000000040)=@nullb, 0xee00, &(0x7f0000000080)={0x2ef, 0x9, 0x0, 0x1}) shutdown(r1, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000004c0)=[@in={0x2, 0x4e22, @rand_addr=0x64010101}]}, &(0x7f0000000440)=0x10) setsockopt$inet_sctp6_SCTP_ASSOCINFO(r1, 0x84, 0x1, &(0x7f0000000500)={r3, 0x58a6, 0x2, 0x400, 0x9, 0x7}, 0x14) 4.176069456s ago: executing program 4 (id=2052): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000035ffaa20cd0caf104a380102030109021b0001000010000904590201801e2a00090582"], 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000100)=@abs={0x0, 0x0, 0x4e20}, 0x6e) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$inet6(0xa, 0x6, 0xff) r3 = socket$l2tp(0x2, 0x2, 0x73) setsockopt$IPT_SO_SET_REPLACE(r3, 0x0, 0x40, &(0x7f0000000a00)=@filter={'filter\x00', 0x42, 0x4, 0x370, 0xffffffff, 0x2d8, 0x1e0, 0x100, 0xffffffff, 0xffffffff, 0x2d8, 0x2d8, 0x2d8, 0xffffffff, 0x4, 0x0, {[{{@ip={@empty, @loopback, 0x0, 0x0, 'veth0_to_batadv\x00', 'wlan0\x00', {}, {}, 0x11, 0x0, 0x40}, 0x0, 0xd8, 0x111, 0x0, {0x100000000000000}, [@common=@inet=@l2tp={{0x30}, {0xffffffff, 0x0, 0x3, 0x0, 0xa}}, @common=@unspec=@owner={{0x38}, {0x0, 0xffffffffffffffff, 0x0, 0xee00, 0x5, 0x6}}]}, @REJECT={0x28}}, {{@uncond, 0x0, 0xb8, 0xe0, 0x0, {}, [@common=@unspec=@ipvs={{0x48}, {@ipv6=@local, [0x101, 0xffffffff, 0x0, 0xff000000], 0x4e24, 0x5c, 0x7, 0x4e24, 0x10, 0x21}}]}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x8}}}, {{@ip={@multicast2, @private=0xa010102, 0x0, 0x0, 'veth1_virt_wifi\x00', '\x00', {}, {}, 0x0, 0x1}, 0x0, 0xb8, 0xf8, 0x0, {}, [@common=@unspec=@connlabel={{0x28}, {0xf, 0x2}}, @common=@socket0={{0x20}}]}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz1\x00'}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x3d0) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty, 0x1000}, 0x1c) recvmmsg(r2, &(0x7f00000009c0)=[{{0x0, 0x0, 0x0}, 0x4}], 0x65942126f3d7b6a8, 0x2, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x4000045, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) mremap(&(0x7f0000064000/0x3000)=nil, 0x3000, 0x600000, 0x3, &(0x7f0000a00000/0x600000)=nil) ioctl$VIDIOC_DQBUF(0xffffffffffffffff, 0xc0585611, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000640)={0x3, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, 0x0) socket$netlink(0x10, 0x3, 0xa) r4 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$sock_int(r4, 0x1, 0x29, &(0x7f0000000100)=0x1003ff, 0x4) setsockopt$SO_TIMESTAMPING(r4, 0x1, 0x25, &(0x7f0000000000)=0x356, 0x4) sendmmsg$inet6(r4, &(0x7f00000000c0)=[{{&(0x7f00000001c0)={0xa, 0x0, 0x0, @mcast2}, 0x1c, 0x0}}], 0x1, 0x0) recvmmsg(r4, &(0x7f0000005cc0), 0x1, 0x40012000, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r5, 0x0, r6, 0x0, 0x1, 0x0) ioctl$sock_inet_udp_SIOCINQ(r6, 0x5760, 0x0) 4.159683012s ago: executing program 6 (id=2053): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x101401, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x2002, 0x0) syz_open_dev$midi(&(0x7f0000000000), 0x2, 0x800) socket$inet6_sctp(0xa, 0x5, 0x84) socket$inet6_sctp(0xa, 0x1, 0x84) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000580)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000000), 0x41, 0x0) pwrite64(r3, 0x0, 0x0, 0x239c1317) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f00000002c0)={0x38, 0x5, 0x8, 0x1, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xda0e, 0xffffffff}, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) r4 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000540), 0x2, 0x0) r5 = syz_open_dev$sndctrl(&(0x7f0000000340), 0x1ff, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r5, 0xc4c85513, &(0x7f0000000000)={0x2, 0x4, 0x1, 0x0, 'syz1\x00', 0x109a7}) write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000040), 0x111}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r4, 0x0, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtclass={0x54, 0x28, 0x8, 0x70bd2b, 0x25dfdbfe, {0x0, 0x0, 0x0, r8, {0x8, 0x4}, {0x1b, 0x10}, {0x4, 0xf}}, [@tclass_kind_options=@c_multiq={0xb}, @TCA_RATE={0x6, 0x5, {0xa, 0x5}}, @TCA_RATE={0x6, 0x5, {0x4, 0xa}}, @TCA_RATE={0x6, 0x5, {0x5, 0x7}}, @tclass_kind_options=@c_clsact={0xb}]}, 0x54}, 0x1, 0x0, 0x0, 0x20000001}, 0x10) sendmsg$nl_route_sched(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd27, 0x25dfdbfb, {0x0, 0x0, 0x0, r8, {0xffee, 0x1}, {0xa, 0xc}, {0xa, 0xe}}, ["", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x405c071}, 0x4c002) r9 = socket$inet_sctp(0x2, 0x5, 0x84) listen(r9, 0x1ff) sendmsg$nl_route_sched(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x129, 0x400, 0xfffffffd, {0x0, 0x0, 0x0, r8, {0xb, 0xd}, {0x0, 0xc}, {0x8}}}, 0x24}}, 0x40004) 3.928421928s ago: executing program 5 (id=2054): syz_usb_connect(0x2, 0x24, &(0x7f00000007c0)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0) (async) r0 = syz_usb_connect(0x2, 0x24, &(0x7f00000007c0)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000000)={0x1c, &(0x7f0000000240)=ANY=[], 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000003c0)={0x44, &(0x7f0000000500)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000040)={0x44, &(0x7f0000000180)={0x40, 0x17, 0x1, 'i'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, 0x0) (async) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f00000001c0)={0x1c, &(0x7f0000000940)=ANY=[], 0x0, 0x0}) (async) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f00000001c0)={0x1c, &(0x7f0000000940)=ANY=[], 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000500)={0x34, &(0x7f0000000300)={0x40, 0x12}, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000500)={0x34, &(0x7f0000000300)={0x40, 0x12}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) (async) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) openat$kvm(0xffffffffffffff9c, 0x0, 0x22102, 0x0) (async) openat$kvm(0xffffffffffffff9c, 0x0, 0x22102, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000f00)=@base={0x5, 0x4, 0xfff, 0x7}, 0x50) bpf$BPF_MAP_LOOKUP_AND_DELETE_ELEM(0x15, &(0x7f00000001c0)={r1, 0x0, 0x0, 0x4}, 0x20) syz_usb_control_io(r0, 0x0, &(0x7f0000000cc0)={0x84, &(0x7f00000008c0)={0x0, 0x12}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) 2.935285486s ago: executing program 3 (id=2055): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000280)={'wlan0\x00', 0x0}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x1, 0x0, 0x3000, 0x2000, &(0x7f0000000000/0x2000)=nil}) r3 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000180), 0x40, 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000000200)={{0x1, 0x1, 0x18, r3, {0x1f30}}, './file0\x00'}) ioctl$KVM_CREATE_VM(r4, 0xae01, 0x14) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400), r4) sendmsg$NL80211_CMD_DEL_TX_TS(r4, &(0x7f00000004c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x38, r5, 0x1, 0x70bd26, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_TSID={0x5, 0xd2, 0x2}, @NL80211_ATTR_TSID={0x5, 0xd2, 0x1}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_TSID={0x5, 0xd2, 0xe}]}, 0x38}, 0x1, 0x0, 0x0, 0x8005}, 0x24044804) r6 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/raw\x00') socket$igmp(0x2, 0x3, 0x2) read$FUSE(r6, &(0x7f0000000b40)={0x2020}, 0x2020) sendmsg$NL80211_CMD_UPDATE_OWE_INFO(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x34, r5, 0x400, 0x70bd25, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x65fb, 0x4d}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x34}, 0x1, 0x0, 0x0, 0x8000}, 0x20040020) r7 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r0, &(0x7f00003a1000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="9a01000000f800b8d58800000f23d00f21f8351000000d0f23f864640f79ea66baf80cb8c85f5480ef66bafc0cecc4c2adac17b9550200000f320f2860c7c4e11751df0f2e2d00000080b9800000c00f3235008000000f30", 0x58}], 0x1, 0x4a, 0x0, 0x0) ioctl$KVM_SET_GUEST_DEBUG_x86(r7, 0x4048ae9b, &(0x7f0000000080)={0xe0003, 0x0, {[0xffffffffffffffff, 0x1f8, 0x7a08253c, 0xffffffffefffff15, 0x3, 0x4, 0x4, 0xffff]}}) setsockopt$IP6T_SO_SET_REPLACE(r4, 0x29, 0x40, &(0x7f0000000500)=@security={'security\x00', 0xe, 0x4, 0x3a0, 0xffffffff, 0x1d8, 0x0, 0x0, 0xffffffff, 0xffffffff, 0x2d0, 0x2d0, 0x2d0, 0xffffffff, 0x4, &(0x7f00000002c0), {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE2={0x28, 'NFQUEUE\x00', 0x2, {0x1, 0x0, 0x3}}}, {{@uncond, 0x0, 0xd0, 0x108, 0x0, {}, [@common=@icmp6={{0x28}, {0x11, "59bb"}}]}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{0xffffffffffffffff, 0x3, 0x2}, {0x1, 0x6, 0x5}, {0x2, 0x0, 0x5}, 0xe, 0x8}}}, {{@ipv6={@mcast1, @local, [0xffffff00, 0xffffffff, 0xffffff00, 0xffffffff], [0xffffff00, 0xffffff00, 0xff000000, 0xffffff00], '\x00', 'macvlan0\x00', {0xff}, {0xff}, 0x3c, 0x10, 0x6, 0x8}, 0x0, 0xd0, 0xf8, 0x0, {}, [@common=@hl={{0x28}, {0x1, 0x9}}]}, @common=@inet=@SYNPROXY={0x28, 'SYNPROXY\x00', 0x0, {0x17, 0x1, 0x2}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x400) ioctl$KVM_RUN(r7, 0xae80, 0x0) 2.675270763s ago: executing program 6 (id=2056): r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000300)='/proc/tty/drivers\x00', 0x0, 0x0) r1 = syz_io_uring_setup(0x49c, &(0x7f00000000c0)={0x0, 0x79af, 0x4000, 0x8000, 0x3, 0x0, r0}, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) r4 = syz_usb_connect$rtl8150(0x5, 0x3f, &(0x7f0000000080)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xbda, 0x8150, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) socket$pptp(0x18, 0x1, 0x2) syz_emit_ethernet(0x8a, &(0x7f0000000140)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff86dd61fb070100542f00fe8000000000000000000000000000bbfe8000000000000000000000000000aa0c2088be00060001bf3f030b7d270100810000013f0c78f364e8000086dd810088a808"], 0x0) syz_usb_control_io$rtl8150(r4, &(0x7f0000000180)={0x14, &(0x7f0000000140)={0x20, 0x2f8995c3bc72427, 0x35, {0x35, 0x0, "d73d33b7b15488fb8b26551aca0d29dc0ebd5e9ec87f85c7a100adbc601e04687aba50eb6bcd6b2ad3fe4a7ade168fb9c58cd0"}}, &(0x7f0000000200)={0x0, 0x3, 0x3c, @string={0x3c, 0x3, "fc2c141895def4992519fc74d56ee8ebfec7ac2cd89e0c294a2ae5fc2b143394289ee2db951e02ddd4113be1d21094d03ac329f86c785e3c19d5"}}}, &(0x7f00000007c0)={0x2c, &(0x7f0000000380)={0x40, 0x0, 0x9d, "c6ebccad657fec65a9203933fcd612c9f7c460fd703342e539b495ecbb51c36abba209cbfc962c8a3ea7608763eab0f4928d13a71573a0e18b4e73af79c77eced7c0b027600fad4066ac2fecc59dc5f393d8f65e81bc355be3e22b7025388f8e7df5a10f2d12d7e7749af097e9141b06a47d6896ca95fa1f823eeac303fd41f2b0b3b689217db45c59340a65052843e1c9c95b087f6e6068752a945aca"}, &(0x7f0000000280)={0x0, 0xa, 0x1, 0x5}, &(0x7f00000002c0)={0x0, 0x8, 0x1, 0xd}, &(0x7f0000000440)={0xc0, 0x5, 0x3, "4dfd8f"}, &(0x7f0000000500)=ANY=[@ANYBLOB="40080200000000003486ac7e0b3e6f06feb43d699fcbbcf2003dcb"]}) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000000)=0xffb, 0x0, 0x4) sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000880)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x24, 0x0, 0x400, 0x70bd26, 0x25dfdbfe, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x1) syz_io_uring_submit(r2, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x40, 0x4007, @fd=r0, 0xffffffffffffffff, &(0x7f0000000580)=""/207, 0xcf, 0x2, 0x1}) io_uring_enter(r1, 0x627, 0x4c1, 0x43, 0x0, 0x30) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r5, &(0x7f0000000080)={0x0, 0x74, &(0x7f0000000100)=[{&(0x7f00000001c0)="5c00000012006bab9a3fe3d86e17aa0a046b876c1d0048007ea60864160af36504001a0038001d001931a0e69ee517d34460bc06000000a705251e6182949a3651f60a84c9f4d4938037e70e4509c5bb", 0x33fe0}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000680)={{{@in=@remote, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in6=@local}}, &(0x7f0000000480)=0xe8) getgroups(0x3, &(0x7f0000000540)=[0x0, 0x0, 0xee00]) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r0, 0xc018937b, &(0x7f0000000780)={{0x1, 0x1, 0x18, r5, {r6, r7}}, './file0\x00'}) 2.601508737s ago: executing program 3 (id=2057): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000780), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x2, 0x100000, 0x2000, &(0x7f0000ffe000/0x2000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000000c0)={0x2515, 0x0, 0x0, 0x1000, &(0x7f0000fec000/0x1000)=nil}) ioctl$KVM_GET_DIRTY_LOG(r1, 0x4010ae42, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000c33000/0x4000)=nil}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000006c0)=@newlink={0x4c, 0x10, 0x437, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x40409, 0x21000}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @gtp={{0x8}, {0x20, 0x2, 0x0, 0x1, [@IFLA_GTP_LOCAL6={0x14, 0x8, @ipv4={'\x00', '\xff\xff', @empty}}, @IFLA_GTP_CREATE_SOCKETS={0x5}]}}}]}, 0x4c}}, 0x0) 2.373274011s ago: executing program 3 (id=2058): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) arch_prctl$ARCH_SHSTK_UNLOCK(0x5004, 0x3) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e22}, 0x48) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0x0, 0xffffffff}, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) setsockopt$sock_int(r4, 0x1, 0x35, &(0x7f0000000040)=0x1, 0x4) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=@base={0x1, 0x42, 0x6, 0x8, 0x0, 0x1}, 0x48) getpgid(0x0) r6 = syz_open_dev$video4linux(&(0x7f0000000000), 0xa3, 0x8080) ioctl$VIDIOC_SUBDEV_G_SELECTION(r6, 0xc040563d, &(0x7f0000000040)={0x1, 0x0, 0x102, 0x0, {0x5, 0xff, 0x0, 0xe}}) r7 = syz_open_dev$mouse(&(0x7f00000000c0), 0x800, 0x121040) ioctl$SNDRV_RAWMIDI_IOCTL_DRAIN(r7, 0x40045731, 0x0) r8 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0xc, 0x4, 0x4, 0x8001, 0x0, r5, 0x0, '\x00', 0x0, r7}, 0x50) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x8000, r8}, 0x38) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0xa, 0x8001, 0x5, 0x9, 0x0, 0x80000000000b12, 0xfa11, 0xffffffff}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./file0\x00', 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000080), 0x800, &(0x7f00000003c0)=ANY=[]) r9 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') read$FUSE(r9, &(0x7f0000004100)={0x2020}, 0x2020) socket$nl_route(0x10, 0x3, 0x0) syz_usb_connect(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000014da2108ab1204000000000000010902240001b30000040904410c17ff5d810009050f1f05e13f0000090583"], 0x0) 2.351621537s ago: executing program 5 (id=2059): ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f00000000c0)={'ip6tnl0\x00', &(0x7f0000000140)={'ip6gre0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @mcast2, @remote, 0x40, 0x700, 0x0, 0xfffffffe}}) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = creat(&(0x7f00000000c0)='./bus\x00', 0x118) pwritev(r1, &(0x7f0000000b00), 0x0, 0xffffffff, 0x2) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f00000010c0)={0x1, 0x8000}, 0x4) syz_usb_connect(0x0, 0x9f3, &(0x7f0000001140)=ANY=[@ANYBLOB="12018000006c1f20d11295c12ec2010203010902e1090309c008080904a7070dff02460c09050c00000202070107250108090600bb21b87e5ce0bcbcc18ca5487f41060a974085bbfbfa4283ba1582bd7620f03f9d55d54a4be0fa2d61781f736f891afa630f2259d0c8636935784fd394944a200caf949a576ddca44aa698cc6324724d2eecabb6e057ed30aafbb44d0bb3624af2f88b0286e401fa572df4d350f0c949ab60d109122bbfd53eec20483541d2b104cba31dd47b9a23352fa0358124af4f6b9ab9d3aadf4631f92aefac04e4430bafb47bf92790078f867759526cb1d855c9c26c3af10b4a770d92f009050e0c000206000609050710bf010802050725010c08ff03072501000e00000905040140000801e007250100100a00ef001a2e11c2778b1908b0108b7ac84aa789953879eba16c0120cbfb31068ced3db202269341cfea9ceaf8a5e6638229ffa06c09ea955357ddf522da7814d76c900004f486249dd884ffaa08cba6a821ee1407a6650b70645258065ee712b2e6862a7b273217cd88eb0be7b0f31ba50968f06ddbecee0ef6d67ecd193a4c9247172fe5eda1c9718fc6fd48ebc7d13d2dcc1670039d1bedef9a99930f54fd517820d6b5ec91067851b00a1dc82b4ed3c116f2d6064c7034e07d5080386161ed0651ad7a0fbbf784b38fb403d5693c4b543551280a22c62ce35d5d49c2b06f20bed6d9e3a9ba99b4dd6b353e8afa06d709050b10400408fff309050f04000405090062231e73354383c5090bd5cf58eb4b22e941838302d8a970e62b77215f898b067b6a26972fb2f37e59bb70f2cd4fe611b891ca46a33f784f9328e563ea52ce99fcaeb1f0bd1bab1c3218cbf57402aa4086cc353fef016d791d1e8f9df6cbabde14320905000c0800000801f708855fa5e31000a066aed9380824d4809ac7f2670b8a605875d75335196f2200e708ad3f283d1e65cafc819e94e2a9a72d1d6903245f543a9c075ae746e10014878f288bdb117b61f938b3a0a884010f348ed80074355a57f99067a092a83e3173ca69d9e76967d5d82b4d90f17dc4a4060cd88feaaf2d40bf2ee0c5c249e52368e1b0b9403d9d5ad5c6b79800e0d2ed3d8f21fe8699db4c72c7a29863a8b55410d3e8bc20325fc20e7fb47ab79dc9f2f53fa0dfc27ff82106186562875ffc5afdcc676e3aaa551f152315ec7961dbcb994edbb5c09280b441cb95e00b94d5d924123512dbe68ef48b209dfbc03102b10a56ffbf4723090508000002050000ac05a6a9ce9f4713f512e2777145bf8046d6f2a08c063822bb39938fad06f52aef0e5b929712f1a131fe9696c7b6fd12785ca6b3bcdd10d3d8e87966379a455406604e23102a89a7f4f535efb1df5939d697485d4a3ee2af4e9fc3e5037e6cae50a6b22a0d7c759b1343f187636921519a1f4dff9608c46e7de29900d417ee433b437464b3e97ab66e5bc41a3b8c741049f1f89b72f9fa93d6fe8b429939cf34e0db3edd8edd1ddf319086960905031010000405070905020c4000090b01072501000d01000905040020004023020725010802770c090500094000080900090506034000480101c304b570afabab115844ba700ef1668dd9c6ecab4fb45f72de19b09d2ca581a6d5bb555a7d4fa56f9169292860f200bf9d3dad185492ffb77e8f53f33c01aa6ba0eb8903128ba3d2087255ab7220389bb5b3692b1fce9aa4d596926e71bb79308354bcc57a914435b4092c16588715aa24456d83a8113d5be4a08961cd19f85616101d27331a89b84ae62c45e30b12e1842086cb6560c7cc2d9168ea19ca7336c2e5c958ca6fed0b48784c131d32dfa93eb05d07eb8ce82d7fa4516dfe3bcee33d31c331feddde5c74e55958794e99c7920904c33604bc08a681092105001201223a0d090503040004070a010725010c0500000725010c0102000905090100040508e4450276d4182171de4edfc1e6a0bbe2dd965dfafb90c356987e83ebc589e90e27cfb5de43059cc2581e89f957fd5f7f981fffdb15d5de62ea4fb2821622c6f188448c8065140725011c090b2609050f03080005002c0905df1008000401ddf530ad37cb6ebb447b976e67e6cbf6e907815374f6db3696201d66f2d700db0195f882213019f0007116d02d5739e31dbcd6e52c062e68ac748079c53ab3fa01ebe7bc7d42c40a9f270bbe960a5077fc84e950591e2f0f064ed3afb620379427ca6180b97bc2ed274efd8b6df8f9ff9c4ea54f608912692b54d3dd68142f59a090f9de3f36055c5f95cca14ee9fd16fe2873f21716804a02d5d8b595a1c598f9fa9a38f3864cb3a1a18a8ccf3282ea67eee532e5f52e4c915c816c152a9951b59884c4701900d42095be8d687fa0d067ecb01f40fcc5cf1c7c56e9fe949bba1d9ae117ef4f49dd94cc547341900b19897e0309050708000204100409058000ff03020207e70cdf04db8f7dabb9c3e666cb6d23ca9f4e4467a776c8b0974805f0bda702f23310d5e9862cf2f250ea9cd5e7f9995a34c2f905ff330926127b156f55bf29ba3b50daee866a3dda8fefb5b4cc0747ba3bbe419831be4cf42e666920e3a3444970f1036c69a53e8ceec1fe000ba09a587b092de7706f5114f72a018163712d8a146080c5e8e1c3a84cc6cb144746f6ff39c0216a77c8c90ddc58f3aa8f158bc7ff39f066c7c6f51f5faf1fcefe6d0cc58524feaa1a462b063a37fdf67bb85b872277b44683e5d26841019d3ee0e72353a7a0f93f89b0a6df461ce6e5bc9cdb177ba851f686d21809050e00ff03670803312171fad0eed1ce5c879bf27d69490593561e37e120820eeb2214df41366bdcc49d5e248ecee91d18563dfb23ce28e70a0725010c0301f809050c02000201720609058000080002040609050910000402060607250108a40800022475696185f883940fd25e7f1f99e30ecc78badcd987834aebde718a669a7969db00b5d25d1faaf612bca55d397e03facaa6b367b2a473241b7ce8e2940216c7ceddf49581e2a3404d77283513c054caf45ba56908c6e4a467c4f0e249091577940d62be57bfb7a9a1e19062407942503d4aff2402c0cec12f3e4aba21d96dbf52db8863520366cb6a52f754ec79300abfb371f06eb10634e68bb4f9304f7d6f75160f8917aed7980aeced7e5de841515e2a302aa22fa3525ce149f9a4519e1c5f985904be4b1ce16ce1a59656fc1aafb5145837c9f7cb491cf595e5a8d3c27051fd8e168fcebe358ba477649f34905224fac5c82ce7a6396a96e39a7182d994aa09050b1220000d04f83409ffa71141b9feeb1bb6d8495cc80ce62e8d1363804fb006d39b27df2e077fd12f93a360837f402c893ca529cdefe8e0d50e0009058010ff0307010a072501080710006a2188abc346c512f15caf90f89d28807289a9a786dcba4906f8dbbebaa730c381c1678573deef351bb830e053cb751da11d70aab055ffbded93f73d7ddefb63f104d29ce3512cedd730f42693680f7b42d051d5982afc841673e602bf673629fe5b79e8351fd38dc2c609050102000266001809050e08400007024209050c0400044601fb9cd6aecdb02e1297e66a5eb45d7cc463b776bc3c277c1f967af97fd42f4f577d3a5b507f0506eaed627102f947017955525bbe6ebd1e9f589fc53250cb005f8f8e5be69114193f699fe0461a16ce16b7a3e9e766df2d40d94572f46cf442eee1f6275d0376bb4f3e0cc52cbdf003b6eb166fb66854e34511489993886b36c55fe431f1fff6f8ee8144e026ada0961df81ca12346f3682852240dd15c4d3171e49a6bc37b81ab33b5c180e41b099272315f7432ae38f9e42a84f7ce5ebba7da33ba120f016fc0c32153a000"/2763], &(0x7f0000001040)={0xa, &(0x7f0000000080)={0xa, 0x6, 0x200, 0x9, 0x9, 0x7f, 0x8, 0xc}, 0x4f, &(0x7f0000001100)=ANY=[@ANYRES16=r0], 0x8, [{0x4, &(0x7f0000000100)=@lang_id={0x4, 0x3, 0x445}}, {0xfffffffffffffe2f, &(0x7f0000000240)=@string={0x3e, 0x3, "b9b8f2a2a40602e95df0b94bc8f75e989a4769a92393a36a5d8f64f2bbdf49f2b01590118549240513696e6d4e73cb9a8f8bfd5b427cce94dd9ad7d7"}}, {0x3c, &(0x7f00000001c0)=@string={0x3c, 0x3, "ebc3e14572dcdd5489980c9d6564422f1c5d7c2987a279ac5952dc0af0b419ac5b59b7e70430940ca1e1c4ed31799c709fd7f0e1f95c41aa5a49"}}, {0x4, &(0x7f0000000d00)=@lang_id={0x4, 0x3, 0x40c}}, {0x71, &(0x7f0000000d40)=@string={0x71, 0x3, "235dc87d3bb4555e714ae1d2313b9da3fbfeedaa3db9ece59806652364b0d3c2f0387ccfae5247157fec5cb2139ac02621b4b9b435300f42375ce81d4fd68010cc0ef2876cc4e4275424dec1308d10a140c07c7496067604d27300527d433c4f39c302d4d9c307aa76241702eb2743"}}, {0xa8, &(0x7f0000000dc0)=@string={0xa8, 0x3, "ab5e81974bbb6c968e790ddb122e01f079a975133fad3100f205f5fef7db160b0b8705bb3e827cb703d4b7856b021c4aa7c88aa1f26e9193356966460f732ae14c7ed4920f3d7c7df25a7bf90398adf6d779120d56a73803f6abf6a4f440300f495b48715df04e9b47404b94a6408e4f99f414d4d94ac2187b01e6a19bd33bc8a98788e1c15d878a2855d35a201ece26f8102a347134adfde41032e6018515a613214768faea"}}, {0xf2, &(0x7f0000000480)=ANY=[@ANYBLOB="f2038d13b028fdc5448e2f83f463e4648ee41e4c07777792f79c5f1e39b88f37621d57eade4ccac2bea891fd128cb03e57bf5a0d74b8debe89629b1843f348d528c6c9c9d80bd8b1eca6df417565277c97ac9811f05c8cd51978c6f8a2160d41130a4b6926a5f396c6cfddad32dd6380bbf69eecba3ff762634e7e9bec8de9c510ac15bcf0a27e74508bbbc66c6b4f7f4781cb5a5d5dfb7b26de4e5d7a310823e704e283ba3fbc48c11f034330db1db3b87f0f5f2ba69bb1f88d5131e95a1252a70af737b7456bd4eeff03d0f24254d45dc78a5f522a014a0ba6af3da935f7fa537b50e984e56bd24c1fafd1b17d8d00140970f2aca6e318456759cfab0f059abb13ac5111aa469ae7005dfe649df57024242542aebfbfd7f7247d00"/293]}, {0x8a, &(0x7f0000000f80)=@string={0x8a, 0x3, "fd60e481dd611f71df29820ec4560eadb2b187abaa2906a556a6ff5407c0097adacf3443492f4fbc9c4c9314b358a8583c7f2916fc8ed8907f195c7a98953896847dcc04df9901d90d1ba0e2b8d5f2f49314e8d3e6fa16248473ccc2c8b78248929ed13fe6a699cad850599cd18d8d1aaf884707393418c98b1cb3f7cd317a2dd22550796ff368b8"}}]}) socket$inet_mptcp(0x2, 0x1, 0x106) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x2000000000000022, &(0x7f00000002c0)=0x1, 0x4) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000300)={@in6={{0xa, 0x4e21, 0x5, @loopback, 0xa}}, 0x0, 0x0, 0x3, 0x0, "bb353738cb473fc7c9f1cf53b6a7b4e23602a3c364ca41d6e5615445244740bd4c0b42a21d7214bf92594925208a0e2f964e654dc534a6324d4993fcf19b2df3ee818a118a7c49462189316d556d2ccd"}, 0xd8) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f0000000200)=[{{0x0, 0x0, &(0x7f0000000280)=[{&(0x7f00000006c0)=""/189, 0xbd}, {&(0x7f00000005c0)=""/65, 0x41}, {&(0x7f0000000780)=""/125, 0x7d}, {&(0x7f0000000800)=""/65, 0x41}], 0x4, &(0x7f0000000640)=""/98, 0x62}}], 0x1, 0x40010003, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x0, 0x1, 0x401, 0x0, 0xa9, 0x8000000000000000, 0x8, 0x7, 0x8000003}, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc1002}]}) pipe2$watch_queue(&(0x7f0000000300), 0x80) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = shmget$private(0x0, 0x800000, 0x880, &(0x7f0000173000/0x800000)=nil) r6 = socket$inet6(0xa, 0x2, 0x0) socket(0x2d, 0x2, 0x0) ioctl$sock_inet6_SIOCSIFDSTADDR(r6, 0x8918, &(0x7f0000000080)={@private2, 0x29}) shmctl$IPC_RMID(r5, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0xaf01, 0x0) io_uring_register$IORING_REGISTER_FILES(0xffffffffffffffff, 0x20, &(0x7f0000000000), 0x0) syz_open_procfs(0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) 1.293609878s ago: executing program 2 (id=2060): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x100, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x37) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0xfc80, &(0x7f00000001c0)={&(0x7f0000000080)=ANY=[@ANYRESHEX=r2], 0xa4}, 0x1, 0x0, 0x0, 0x5050}, 0x40000c1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f00000000c0)={0xc}) socket$kcm(0x10, 0x2, 0x0) ioctl$KVM_GET_NR_MMU_PAGES(r1, 0xae45, 0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) gettid() timer_create(0x0, 0x0, &(0x7f0000bbdffc)) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) syz_emit_ethernet(0x36, 0x0, 0x0) r7 = socket$inet_udp(0x2, 0x2, 0x0) sendmsg$TIPC_NL_LINK_GET(0xffffffffffffffff, 0x0, 0x0) socket$kcm(0xa, 0x2, 0x3a) close(r7) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r8, &(0x7f0000001080)={0x0, 0x1c02, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="6c00000002060104db406e3e0004000200000000100003006269746d61703a706f72740005000400000000000900020073797a32000000000500050000006c00050001000600000024000780080008400000137906000440fffff000060005400000000008000640"], 0x6c}}, 0x0) io_setup(0xe, 0x0) write$binfmt_misc(r6, &(0x7f0000000000), 0xfffffecc) splice(r5, 0x0, r7, 0x0, 0x4ffe6, 0x8864000000000000) 459.493002ms ago: executing program 6 (id=2061): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000001140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=ANY=[@ANYBLOB="3c02000019000100feffffff10000000e0000001000000000000000000000000ac1414bb0000000000000000000000004e22000c01ff00000a008000fc000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000000000000000000000000000000000000000000005d0a0000000000000000000000000000000000000000000001000000000000000900000000000200800000000000000000000000020000000000000000000000000000000000000084010500fc000000000000000000000000000004fffffffd3c00000000000000640101010000000000000000000000000735000000020000000000000000000000000000ffffffff000000000000000000000000000000003300"], 0x23c}}, 0x0) 103.549351ms ago: executing program 4 (id=2062): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001800), 0xc0241, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file1\x00'}, 0x6e) stat(&(0x7f00000001c0)='./file1\x00', &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0}) sendmmsg$unix(r2, &(0x7f00000003c0)=[{{&(0x7f0000000740)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000000)=[{&(0x7f00000005c0)="8706775e5b46bfedd9fea9a33d36994e1ff2f0afb81a38dddae2d5a4cc0f37657dff2d77850b76f970e16a44fb1fbbe02bf9a7fdb735e34e047672ea2fddf38948e838be95bc320cb000129088b902c293e75be38703cf0a7bcc0b626200314e50d35e9e72293e8a827d642b2450ae6176b6e6140749d3004a1ebe1987b677a934563cda1215f59d2753dbc6ceae57769b98aae054165374a3d3fbc18985c365ebda05c8273281cb8fdf9809389a7a77cd13bfd8a3195698e8a2f31de3d9584b4211ab64a6e358e2a964f4c7d99227bf010f019b84e50ad31defebbe2ba37ee5081152b40f795d8e3a137099a4f137ec1d7bbc701c4cc3f9f52999", 0xfb}], 0x1, &(0x7f0000000840)=ANY=[@ANYBLOB="04000000000000000100000002000000", @ANYRES32, @ANYRES32=r3, @ANYRES32=0x0, @ANYBLOB="00000000280000000000fce24f36a42be720d060", @ANYRES32=r2, @ANYRES32=r2, @ANYRES32=r2, @ANYRES32=r0, @ANYRES32=r1, @ANYRES32=r2, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00'], 0x68, 0x10}}], 0x1, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, 0x0, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, 0x0, 0x0) sched_setattr(0x0, 0x0, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3c0000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="312000000000000014002b800800030004000000b6ffffff0200000008001b0000000000"], 0x3c}, 0x1, 0x0, 0x0, 0x20048054}, 0x20000050) r5 = socket$inet(0x2, 0x4000000000000001, 0x0) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x64) syz_open_dev$sndctrl(&(0x7f0000000440), 0x0, 0x0) ioctl$DRM_IOCTL_LOCK(0xffffffffffffffff, 0x4008642a, &(0x7f0000000180)={0x0, 0x1}) openat$audio(0xffffffffffffff9c, 0x0, 0x40000000040201, 0x0) r6 = syz_open_dev$sndpcmp(&(0x7f0000000200), 0x0, 0x20d65) ioctl$SNDRV_PCM_IOCTL_SYNC_PTR(r6, 0xc0884123, &(0x7f0000000300)={0x5, "244689261a3365eb47c14247a532ccbd3bf3b29282987c7cc12acb8ae6d2fbd3428a0df873e1d58af8bf70c05fc6c43edcdaa8e7db0700", {0x2, 0x2}}) r7 = io_uring_setup(0x1692, &(0x7f0000000400)={0x0, 0x631d, 0x0, 0x4, 0x2d8}) socket$l2tp(0x2, 0x2, 0x73) io_uring_register$IORING_REGISTER_BUFFERS2(r7, 0xf, &(0x7f0000002700)={0x2, 0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000480)=""/264, 0x108}, {&(0x7f00000015c0)=""/4096, 0x1000}], 0x0}, 0x20) socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$inet_tcp_int(r5, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r5, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) sendto$inet(r5, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendto$inet(r5, &(0x7f0000000580)="17", 0xfdef, 0x10008095, 0x0, 0x0) syz_usb_connect$cdc_ncm(0x6, 0x76, 0x0, 0x0) mkdir(&(0x7f0000000040)='./file1\x00', 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) 0s ago: executing program 6 (id=2063): r0 = syz_open_dev$loop(&(0x7f0000000100), 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.idle_time\x00', 0x275a, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000140)=ANY=[@ANYBLOB="b40000000000000079104800000000007900280000000000950074000000000022187069f9fb6bdbca6359d81e8eecd7934bdcd758593c4e4ead4367ee3caad7a68421695cdba2a119ca79a0a9a842dbeba155bc249578ff037773a2813b594c769c354a802307ef4ea733072570de61c55077543278cb2f2ce50f80aa94017b5ba8805cdd558a7eb801e1a9442402e596944d7dc5db8c2aa2a96eb2ba810078c32e228ea525f9dabdd2de349bf424610dc6a94b237888800628fa480e7d411df454c90cf5e070b0fa21c5fa54a65b920e43e67e9d7a6094bda46a016e7b8f9edbb8"], 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x94) write$binfmt_misc(r1, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0xb, 0x1c, "fee8a2ab78fc979fd1e00db6072000001ea89de2b4410000e60080b8785d960000100000000000000000000000000000000000527000", "2809e8dbe108598948224ad44afac11d875397bdb22d0000b420a1a93c5240f45f819ef6167d3d458dd4992861ac00", "f4bd000000801900000000000000000000000000000000000000000100", [0x0, 0x2000000000001]}}) kernel console output (not intermixed with test programs): config index 0 descriptor/start: -61 [ 502.643044][ T5842] usb 6-1: can't read configurations, error -61 [ 502.681214][ T5842] usb usb6-port1: attempt power cycle [ 502.771580][T12102] geneve0: entered allmulticast mode [ 503.046639][ T5842] usb 6-1: new high-speed USB device number 11 using dummy_hcd [ 503.098863][ T5842] usb 6-1: Using ep0 maxpacket: 32 [ 503.121157][ T5842] usb 6-1: too many configurations: 185, using maximum allowed: 8 [ 503.155214][ T5842] usb 6-1: unable to read config index 0 descriptor/start: -61 [ 503.172752][ T5842] usb 6-1: can't read configurations, error -61 [ 503.317248][ T5842] usb 6-1: new high-speed USB device number 12 using dummy_hcd [ 503.368118][ T5842] usb 6-1: Using ep0 maxpacket: 32 [ 503.385512][ T5842] usb 6-1: too many configurations: 185, using maximum allowed: 8 [ 503.419151][ T5842] usb 6-1: unable to read config index 0 descriptor/start: -61 [ 503.434215][ T5842] usb 6-1: can't read configurations, error -61 [ 503.449747][ T5842] usb usb6-port1: unable to enumerate USB device [ 503.943711][T12148] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 503.977857][T12148] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 504.182800][ T5926] usb 2-1: new high-speed USB device number 63 using dummy_hcd [ 504.231570][ T5842] usb 3-1: USB disconnect, device number 78 [ 504.467024][ T5926] usb 2-1: Using ep0 maxpacket: 32 [ 504.486061][ T5926] usb 2-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 504.521770][ T5926] usb 2-1: config 155 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 504.558125][ T5926] usb 2-1: config 155 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 504.617177][ T5926] usb 2-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 504.649692][ T5926] usb 2-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 504.659625][ T5926] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 504.688332][ T5926] usb 2-1: Product: syz [ 504.697299][ T5926] usb 2-1: Manufacturer: syz [ 504.711742][ T5926] usb 2-1: SerialNumber: syz [ 504.762681][ C1] imon 2-1:155.0: imon usb_rx_callback_intf0: status(-71) [ 504.796074][ T5926] input: iMON Panel, Knob and Mouse(15c2:ffdc) as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:155.0/input/input33 [ 504.957113][ T5926] imon 2-1:155.0: Unknown 0xffdc device, defaulting to VFD and iMON IR [ 504.995140][ T5926] (id 0x00) [ 505.228896][ T5926] rc_core: IR keymap rc-imon-pad not found [ 505.242878][ T5926] Registered IR keymap rc-empty [ 505.300113][ T5926] imon 2-1:155.0: Looks like you're trying to use an IR protocol this device does not support [ 505.320398][ T5926] imon 2-1:155.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 505.332018][T12175] : renamed from veth0_to_bond (while UP) [ 505.372825][T12171] No such timeout policy "syz0" [ 505.387987][T12174] binder: 12173:12174 ioctl c0306201 2000000003c0 returned -14 [ 505.388069][ T5926] rc rc0: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:155.0/rc/rc0 [ 505.427316][ T5926] input: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:155.0/rc/rc0/input34 [ 505.479554][ T5926] imon 2-1:155.0: iMON device (15c2:ffdc, intf0) on usb<2:63> initialized [ 505.591458][T12182] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 505.627903][T12182] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 505.693227][T12182] netlink: 40 bytes leftover after parsing attributes in process `syz.4.1667'. [ 505.913789][T12182] netlink: 'syz.4.1667': attribute type 8 has an invalid length. [ 505.927760][T12187] netlink: 'syz.2.1668': attribute type 1 has an invalid length. [ 505.950655][T12182] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 505.972685][T12182] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 506.034964][T12182] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 506.075532][T12187] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1668'. [ 506.087546][T12189] bond2: (slave vxcan3): The slave device specified does not support setting the MAC address [ 506.141256][T12182] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 506.151430][T12189] bond2: (slave vxcan3): Error -95 calling set_mac_address [ 506.244191][ T5905] usb 2-1: USB disconnect, device number 63 [ 506.355057][T12187] 8021q: adding VLAN 0 to HW filter on device bond2 [ 506.575206][T12187] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1668'. [ 506.603602][T12187] macvlan2: entered promiscuous mode [ 506.621996][T12187] macvlan2: entered allmulticast mode [ 506.651813][T12187] bond2: entered promiscuous mode [ 506.658823][T12187] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 506.702173][T12187] bond2: left promiscuous mode [ 506.966742][T12205] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 506.985904][T12205] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 509.116879][T12232] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 509.129309][T12234] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 509.782706][T12246] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 509.805705][T12246] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 510.767410][ T5913] usb 4-1: new high-speed USB device number 82 using dummy_hcd [ 510.797220][ T5905] usb 2-1: new high-speed USB device number 64 using dummy_hcd [ 510.931535][ T5913] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 510.949129][ T5913] usb 4-1: config 0 has no interface number 0 [ 510.957583][ T5905] usb 2-1: Using ep0 maxpacket: 16 [ 510.964879][ T5905] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 11 [ 510.974526][ T5905] usb 2-1: config 1 interface 0 altsetting 3 endpoint 0xB has invalid wMaxPacketSize 0 [ 510.991197][ T5913] usb 4-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 511.001347][ T5913] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 511.010402][ T5905] usb 2-1: config 1 interface 0 altsetting 3 bulk endpoint 0xB has invalid maxpacket 0 [ 511.021147][ T5913] usb 4-1: Product: syz [ 511.025469][ T5913] usb 4-1: Manufacturer: syz [ 511.031302][ T5905] usb 2-1: config 1 interface 0 altsetting 3 endpoint 0x8A has invalid wMaxPacketSize 0 [ 511.043177][ T5913] usb 4-1: SerialNumber: syz [ 511.057955][ T5913] usb 4-1: config 0 descriptor?? [ 511.065323][ T5905] usb 2-1: config 1 interface 0 altsetting 3 bulk endpoint 0x8A has invalid maxpacket 0 [ 511.091237][ T5905] usb 2-1: config 1 interface 0 has no altsetting 0 [ 511.101715][ T5905] usb 2-1: New USB device found, idVendor=04e6, idProduct=0003, bcdDevice= 1.77 [ 511.115348][ T5905] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 511.142396][ T5905] ums-sddr09 2-1:1.0: USB Mass Storage device detected [ 511.289547][ T5913] usb 4-1: dvb_usb_v2: found a 'E3C EC168 reference design' in warm state [ 511.304673][ T5913] usb 4-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 511.327824][ T5913] dvbdev: DVB: registering new adapter (E3C EC168 reference design) [ 511.356116][ T5913] usb 4-1: media controller created [ 511.390929][ T5913] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 511.411517][ T5905] ums-sddr09 2-1:1.0: probe with driver ums-sddr09 failed with error -22 [ 511.436355][ T5905] usb 2-1: USB disconnect, device number 64 [ 511.704011][T12267] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 511.744378][T12267] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 511.987379][ T5926] usb 3-1: new high-speed USB device number 79 using dummy_hcd [ 512.023521][T12274] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 512.039730][T12274] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 512.188885][ T5926] usb 3-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 512.202561][ T5926] usb 3-1: config 220 has 1 interface, different from the descriptor's value: 3 [ 512.260655][ T42] usb 6-1: new high-speed USB device number 13 using dummy_hcd [ 512.295346][ T5926] usb 3-1: config 220 interface 0 has no altsetting 0 [ 512.313120][ T5926] usb 3-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 512.323832][ T5926] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 512.332560][ T5926] usb 3-1: Product: syz [ 512.339455][ T5926] usb 3-1: Manufacturer: syz [ 512.344098][ T5926] usb 3-1: SerialNumber: syz [ 512.377112][ T8369] usb 2-1: new high-speed USB device number 65 using dummy_hcd [ 512.437117][ T42] usb 6-1: Using ep0 maxpacket: 16 [ 512.449098][ T42] usb 6-1: config 0 has an invalid interface number: 251 but max is 0 [ 512.466278][ T42] usb 6-1: config 0 has no interface number 0 [ 512.475404][ T42] usb 6-1: config 0 interface 251 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 16 [ 512.507727][ T42] usb 6-1: config 0 interface 251 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64 [ 512.525256][ T42] usb 6-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 512.537345][ T8369] usb 2-1: Using ep0 maxpacket: 32 [ 512.542715][ T5913] i2c i2c-1: ec100: i2c rd failed=-110 reg=33 [ 512.545005][ T42] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 512.560393][ T42] usb 6-1: Product: syz [ 512.564677][ T42] usb 6-1: Manufacturer: syz [ 512.571897][ T8369] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 512.604188][ T42] usb 6-1: SerialNumber: syz [ 512.611979][ T8369] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 512.627672][ T5926] uvcvideo 3-1:220.0: Found Unit with invalid ID 0 [ 512.638299][ T5926] uvcvideo 3-1:220.0: probe with driver uvcvideo failed with error -22 [ 512.649031][ T8369] usb 2-1: New USB device found, idVendor=1e7d, idProduct=2d51, bcdDevice= 0.00 [ 512.666079][ T42] usb 6-1: config 0 descriptor?? [ 512.676193][T12275] raw-gadget.5 gadget.5: fail, usb_ep_enable returned -22 [ 512.685671][ T5926] usb 3-1: USB disconnect, device number 79 [ 512.695790][ T8369] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 512.715454][T12275] raw-gadget.5 gadget.5: fail, usb_ep_enable returned -22 [ 512.742113][ T8369] usb 2-1: config 0 descriptor?? [ 512.857139][ T5913] usb 4-1: USB disconnect, device number 82 [ 512.962609][T12273] raw-gadget.5 gadget.5: fail, usb_ep_enable returned -22 [ 512.977525][T12273] raw-gadget.5 gadget.5: fail, usb_ep_enable returned -22 [ 513.106429][T12279] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 513.121115][T12279] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 513.190286][ T42] asix 6-1:0.251 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61 [ 513.237133][ T42] asix 6-1:0.251 (unnamed net_device) (uninitialized): Failed to read MAC address: -61 [ 513.298853][ T42] asix 6-1:0.251: probe with driver asix failed with error -5 [ 513.613747][ T5913] usb 6-1: USB disconnect, device number 13 [ 513.737102][ T42] usb 3-1: new high-speed USB device number 80 using dummy_hcd [ 513.919469][ T42] usb 3-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 513.929192][ T42] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 513.943681][ T42] usb 3-1: config 0 descriptor?? [ 514.184131][ T5842] usb 6-1: new high-speed USB device number 14 using dummy_hcd [ 514.228997][ T42] udl 3-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 514.317503][ T5842] usb 6-1: device descriptor read/64, error -71 [ 514.557434][ T5842] usb 6-1: new high-speed USB device number 15 using dummy_hcd [ 514.691765][ T5842] usb 6-1: device descriptor read/64, error -71 [ 514.880658][ T5842] usb usb6-port1: attempt power cycle [ 515.247332][ T5842] usb 6-1: new high-speed USB device number 16 using dummy_hcd [ 515.817791][ T5842] usb 6-1: device descriptor read/8, error -71 [ 515.888377][ T8369] usbhid 2-1:0.0: can't add hid device: -71 [ 515.894713][ T8369] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 516.030368][ T8369] usb 2-1: USB disconnect, device number 65 [ 516.077168][ T5842] usb 6-1: new high-speed USB device number 17 using dummy_hcd [ 516.104511][ T5842] usb 6-1: device descriptor read/8, error -71 [ 516.229840][ T5842] usb usb6-port1: unable to enumerate USB device [ 516.277044][ T42] [drm:udl_init] *ERROR* Selecting channel failed [ 516.336347][ T42] [drm] Initialized udl 0.0.1 for 3-1:0.0 on minor 2 [ 516.367573][ T42] [drm] Initialized udl on minor 2 [ 516.403299][ T42] udl 3-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 516.496966][ T42] udl 3-1:0.0: [drm] Cannot find any crtc or sizes [ 516.535709][ T8369] udl 3-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 516.556820][ T42] usb 3-1: USB disconnect, device number 80 [ 516.583398][ T8369] udl 3-1:0.0: [drm] Cannot find any crtc or sizes [ 516.608355][T12310] syzkaller0: entered promiscuous mode [ 516.637546][T12310] syzkaller0: entered allmulticast mode [ 516.699103][T12310] tipc: Enabled bearer , priority 0 [ 516.737555][T12309] tipc: Resetting bearer [ 516.798625][T12309] tipc: Disabling bearer [ 517.030408][ T42] usb 3-1: new high-speed USB device number 81 using dummy_hcd [ 517.235780][ T42] usb 3-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 517.264691][ T42] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 517.283587][T12329] netlink: 92 bytes leftover after parsing attributes in process `syz.3.1703'. [ 517.300950][ T42] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 517.335350][ T42] usb 3-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 517.358214][ T42] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 517.379127][T12332] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1703'. [ 517.399791][ T42] usb 3-1: SerialNumber: syz [ 517.642914][ T42] usb 3-1: cannot find UAC_HEADER [ 517.680367][ T8369] usb 4-1: new high-speed USB device number 83 using dummy_hcd [ 517.869838][ T8369] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 16 [ 517.899904][ T42] snd-usb-audio 3-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 517.913268][ T8369] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 64 [ 517.931914][ T8369] usb 4-1: New USB device found, idVendor=0a46, idProduct=9621, bcdDevice=4f.32 [ 517.944885][ T42] usb 3-1: USB disconnect, device number 81 [ 517.955614][ T8369] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 517.979420][ T8369] usb 4-1: Product: syz [ 517.985513][ T8369] usb 4-1: Manufacturer: syz [ 517.991275][ T8369] usb 4-1: SerialNumber: syz [ 518.004273][ T8369] usb 4-1: config 0 descriptor?? [ 518.015739][T12329] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 518.058250][ T5883] udevd[5883]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 518.076709][T12329] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 518.300705][T12346] netlink: 92 bytes leftover after parsing attributes in process `syz.3.1703'. [ 518.523227][ T8369] dm9601 4-1:0.0: probe with driver dm9601 failed with error -71 [ 518.605983][ T8369] usb 4-1: USB disconnect, device number 83 [ 519.676152][T12384] fuse: Unknown parameter '18446744073709551615' [ 520.897197][T12401] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 520.912530][T12401] batadv0: mtu less than device minimum [ 520.930430][T12401] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 520.942709][T12401] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 520.954085][T12401] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 520.965504][T12401] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 520.977000][T12401] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 520.988854][T12401] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 521.000150][T12401] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 521.011404][T12401] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 521.022738][T12401] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 521.196799][T12401] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 521.298172][T12401] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 521.345864][T12401] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 521.370998][T12401] batman_adv: batadv0: Interface deactivated: dummy0 [ 521.379621][T12401] batman_adv: batadv0: Removing interface: dummy0 [ 521.398254][T12411] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 521.487655][T12411] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 522.041939][T12417] ip6t_srh: unknown srh invflags 4000 [ 522.480923][T12406] tipc: Enabled bearer , priority 0 [ 522.731092][ T5842] usb 2-1: new high-speed USB device number 66 using dummy_hcd [ 522.789763][T12405] tipc: Disabling bearer [ 522.928453][ T5842] usb 2-1: Using ep0 maxpacket: 32 [ 522.948655][ T5842] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 522.994612][ T5842] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 523.033228][ T5842] usb 2-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 523.059633][ T5842] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 523.114799][ T5842] usb 2-1: config 0 descriptor?? [ 523.148406][T12423] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 523.164387][ T5842] hub 2-1:0.0: USB hub found [ 523.185275][T12423] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 523.242055][T12423] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 523.270800][T12423] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 523.345678][ T5842] hub 2-1:0.0: config failed, hub doesn't have any ports! (err -19) [ 523.767284][ T5842] hid-generic 0003:046D:C31C.002F: hidraw0: USB HID v8.00 Device [HID 046d:c31c] on usb-dummy_hcd.1-1/input0 [ 524.625688][T12444] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 524.697658][T12420] usb 2-1: reset high-speed USB device number 66 using dummy_hcd [ 524.717701][T12444] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 525.103308][ T5842] usb 2-1: USB disconnect, device number 66 [ 525.109966][T12420] usbhid 2-1:0.0: reset_resume error -19 [ 525.428723][ T42] usb 6-1: new full-speed USB device number 18 using dummy_hcd [ 525.701782][ T42] usb 6-1: not running at top speed; connect to a high speed hub [ 525.723308][ T42] usb 6-1: config 1 interface 0 altsetting 7 endpoint 0x2 has invalid maxpacket 512, setting to 64 [ 525.768070][ T42] usb 6-1: config 1 interface 0 has no altsetting 0 [ 525.823828][ T42] usb 6-1: New USB device found, idVendor=1b1c, idProduct=0a52, bcdDevice= 0.40 [ 525.887137][ T42] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 525.997137][ T42] usb 6-1: Product: ဌ [ 526.001364][ T42] usb 6-1: Manufacturer: 灁〹戀唉ᅬ箧嘩ꆀØ睊Ⲉ⠴ꍱ꾱阆䊈搱䘀⹑䓨뢢퓵䭖栬唯ᯂ哱⸺ૻ㷾鬮Ӎ招铵鐘ⶣ傳嫢䀘僵휵꺜ᡇ⎃㹩∻ᶔⶮ氤釺仢ொ꒛დ◫験쳼픒䬮砂햚녶ヷ䬉惉唃冟蕭榸蔿॓㌇慃햧쯱㽯ﹴ蟟镬圬࿎쎊拯䊅Ќ蜚㴵㾉珴檒茜忭ずˁ⋢뢆럍騐؂Ç）槩졨⯂畅궺 [ 526.097036][ T42] usb 6-1: SerialNumber: syz [ 526.133497][T12455] raw-gadget.2 gadget.5: fail, usb_ep_enable returned -22 [ 526.203188][T12465] netlink: 184 bytes leftover after parsing attributes in process `syz.3.1728'. [ 526.308422][ T5842] usb 2-1: new high-speed USB device number 67 using dummy_hcd [ 526.480717][ T5842] usb 2-1: Using ep0 maxpacket: 32 [ 526.490570][ T5842] usb 2-1: config 4 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 526.504172][ T5842] usb 2-1: config 4 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 526.520834][ T5842] usb 2-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 526.541091][ T5842] usb 2-1: New USB device strings: Mfr=255, Product=255, SerialNumber=0 [ 526.556037][ T5842] usb 2-1: Product: syz [ 526.561069][ T5842] usb 2-1: Manufacturer: syz [ 526.572625][ T42] usbhid 6-1:1.0: can't add hid device: -71 [ 526.602642][ T5842] hub 2-1:4.0: USB hub found [ 526.610446][ T42] usbhid 6-1:1.0: probe with driver usbhid failed with error -71 [ 526.661321][ T42] usb 6-1: USB disconnect, device number 18 [ 526.793505][ T5842] hub 2-1:4.0: 2 ports detected [ 527.249861][T12480] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 527.295970][T12480] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 527.447290][ T5842] hub 2-1:4.0: set hub depth failed [ 527.497146][ T5842] usb 2-1: USB disconnect, device number 67 [ 527.594609][ T8369] IPVS: starting estimator thread 0... [ 527.847175][T12490] IPVS: using max 28 ests per chain, 67200 per kthread [ 527.928769][T12493] netlink: 16 bytes leftover after parsing attributes in process `syz.5.1736'. [ 527.995871][T12493] bond0: entered promiscuous mode [ 528.068772][T12493] bond_slave_0: entered promiscuous mode [ 528.131170][T12493] bond_slave_1: entered promiscuous mode [ 528.203212][T12493] bond0: left promiscuous mode [ 528.281731][T12493] bond_slave_0: left promiscuous mode [ 528.318100][T12493] bond_slave_1: left promiscuous mode [ 529.021476][T12510] netlink: 764 bytes leftover after parsing attributes in process `syz.1.1739'. [ 529.091986][T12510] net_ratelimit: 30 callbacks suppressed [ 529.092040][T12510] netlink: del zone limit has 4 unknown bytes [ 530.014614][T12527] loop4: detected capacity change from 0 to 16384 [ 530.045289][T12526] FAULT_INJECTION: forcing a failure. [ 530.045289][T12526] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 530.067145][ T5905] usb 2-1: new high-speed USB device number 68 using dummy_hcd [ 530.155458][T12526] CPU: 0 UID: 0 PID: 12526 Comm: syz.3.1743 Tainted: G L syzkaller #0 PREEMPT(full) [ 530.155490][T12526] Tainted: [L]=SOFTLOCKUP [ 530.155498][T12526] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 530.155510][T12526] Call Trace: [ 530.155518][T12526] [ 530.155527][T12526] dump_stack_lvl+0xe8/0x150 [ 530.155562][T12526] should_fail_ex+0x412/0x560 [ 530.155598][T12526] _copy_from_user+0x2d/0xb0 [ 530.155621][T12526] ___sys_recvmsg+0x175/0x590 [ 530.155745][T12526] ? __lock_acquire+0x6b5/0x2cf0 [ 530.155795][T12526] ? __pfx____sys_recvmsg+0x10/0x10 [ 530.155856][T12526] do_recvmmsg+0x334/0x800 [ 530.155889][T12526] ? __pfx_do_recvmmsg+0x10/0x10 [ 530.155922][T12526] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 530.155964][T12526] __x64_sys_recvmmsg+0x198/0x250 [ 530.155993][T12526] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 530.156030][T12526] do_syscall_64+0x14d/0xf80 [ 530.156050][T12526] ? trace_irq_disable+0x3b/0x150 [ 530.156078][T12526] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 530.156098][T12526] ? clear_bhb_loop+0x40/0x90 [ 530.156122][T12526] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 530.156144][T12526] RIP: 0033:0x7f029a19c799 [ 530.156162][T12526] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 530.156180][T12526] RSP: 002b:00007f029b064028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 530.156202][T12526] RAX: ffffffffffffffda RBX: 00007f029a415fa0 RCX: 00007f029a19c799 [ 530.156217][T12526] RDX: 0000000000000300 RSI: 0000200000000440 RDI: 0000000000000008 [ 530.156230][T12526] RBP: 00007f029b064090 R08: 0000000000000000 R09: 0000000000000000 [ 530.156243][T12526] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 530.156255][T12526] R13: 00007f029a416038 R14: 00007f029a415fa0 R15: 00007f029a53fa48 [ 530.156286][T12526] [ 530.587098][ T5905] usb 2-1: Using ep0 maxpacket: 32 [ 530.598953][ T5905] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 172, changing to 7 [ 530.610924][ T5905] usb 2-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 149, changing to 7 [ 530.625337][T12529] loop4: detected capacity change from 16384 to 16383 [ 530.752294][ T5905] usb 2-1: New USB device found, idVendor=0582, idProduct=0010, bcdDevice= 0.40 [ 530.780086][ T5905] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 530.823499][ T5905] usb 2-1: Product: 쳾ᬟ즶캫ᖮ밍砄⓴፛놝ꨣ쫝༪蚘囍㣘⏴爷ａ㵌僉䅾ᢠ쥯גּ࿌鼚㾡㊫㮡え閦佁焍珀戟渏⻆뽪럈囗桪ஶ᣶蠰␁溺成ﯬ羯脣法頢欲퍦䫏ݠ㌙豚儌ꥰᙤ㡚恪⎽䙆鑂﬐품擕揶秲潀∯㴮玥㣞漿컙≉뾪誏摚נꔺ닌⊖⽇麼켸푼ꗌ㰚쎻탌⚖鼱ᆯ㑬漌盘䓹姊㶨 [ 530.929947][ T5905] usb 2-1: Manufacturer: ￦肥뿛㛫칭帬 [ 530.936006][ T5905] usb 2-1: SerialNumber: ࠒ [ 531.161241][ T5905] usb 2-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 531.184190][ T5905] usb 2-1: cannot setup if 2: error -71 [ 531.271725][T12535] fuse: Bad value for 'fd' [ 531.300355][ T5905] snd-usb-audio 2-1:1.0: probe with driver snd-usb-audio failed with error -71 [ 531.418090][ T5905] usb 2-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 531.487724][ T5905] usb 2-1: cannot setup if 2: error -71 [ 531.493617][ T5905] snd-usb-audio 2-1:1.1: probe with driver snd-usb-audio failed with error -71 [ 531.587147][ T42] usb 6-1: new high-speed USB device number 19 using dummy_hcd [ 531.622266][ T5905] usb 2-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 531.698898][ T5905] usb 2-1: cannot setup if 2: error -71 [ 531.927286][ T42] usb 6-1: Using ep0 maxpacket: 16 [ 531.948557][ T5905] snd-usb-audio 2-1:1.2: probe with driver snd-usb-audio failed with error -71 [ 532.000349][ T5905] usb 2-1: USB disconnect, device number 68 [ 532.054908][ T42] usb 6-1: New USB device found, idVendor=2137, idProduct=0001, bcdDevice=2a.35 [ 532.064790][ T42] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 532.106368][ T42] usb 6-1: Product: syz [ 532.114018][ T6112] udevd[6112]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.2/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 532.341424][ T42] usb 6-1: Manufacturer: syz [ 532.362811][ T42] usb 6-1: SerialNumber: syz [ 532.401240][ T42] usb 6-1: config 0 descriptor?? [ 532.441243][ T42] as10x_usb: device has been detected [ 532.451085][ T42] dvbdev: DVB: registering new adapter (Sky IT Digital Key (green led)) [ 532.493822][ T42] usb 6-1: DVB: registering adapter 1 frontend 0 (Sky IT Digital Key (green led))... [ 532.546373][ T42] as10x_usb: error during firmware upload part1 [ 532.587129][ T42] Registered device Sky IT Digital Key (green led) [ 532.635043][T12535] netlink: 24 bytes leftover after parsing attributes in process `syz.5.1745'. [ 532.667201][ T5928] usb 3-1: new high-speed USB device number 82 using dummy_hcd [ 532.717706][T12535] netlink: 32 bytes leftover after parsing attributes in process `syz.5.1745'. [ 532.847747][ T5928] usb 3-1: Using ep0 maxpacket: 8 [ 532.874266][ T5928] usb 3-1: unable to get BOS descriptor or descriptor too short [ 532.885175][ T5928] usb 3-1: config 17 has an invalid interface number: 9 but max is 1 [ 532.894264][ T5928] usb 3-1: config 17 has an invalid descriptor of length 0, skipping remainder of the config [ 532.905009][ T5928] usb 3-1: config 17 has 1 interface, different from the descriptor's value: 2 [ 532.914627][ T5928] usb 3-1: config 17 has no interface number 0 [ 532.972651][ T5928] usb 3-1: config 17 interface 9 altsetting 6 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 533.041668][ T5928] usb 3-1: config 17 interface 9 has no altsetting 0 [ 533.083191][ T5928] usb 3-1: New USB device found, idVendor=0763, idProduct=2001, bcdDevice=2c.ff [ 533.102713][ T5928] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 533.400577][ T5928] usb 3-1: Product: syz [ 533.411468][ T5928] usb 3-1: Manufacturer: syz [ 533.423710][ T5928] usb 3-1: SerialNumber: syz [ 533.663378][ T5928] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 533.697873][ T42] usb 4-1: new high-speed USB device number 84 using dummy_hcd [ 533.888634][ T42] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 533.914575][ T42] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 533.946398][ T42] usb 4-1: New USB device found, idVendor=046d, idProduct=c52f, bcdDevice= 0.00 [ 533.967133][ T5928] snd-usb-audio 3-1:17.9: probe with driver snd-usb-audio failed with error -2 [ 534.009558][ T5928] usb 3-1: USB disconnect, device number 82 [ 534.018272][ T42] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 534.155364][ T6113] udevd[6113]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:17.9/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 534.217741][ T42] usb 4-1: config 0 descriptor?? [ 535.185991][T12568] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1756'. [ 535.281352][ T5913] usb 6-1: USB disconnect, device number 19 [ 535.336238][ T5913] Unregistered device Sky IT Digital Key (green led) [ 535.366134][ T5913] as10x_usb: device has been disconnected [ 535.383545][T12573] FAULT_INJECTION: forcing a failure. [ 535.383545][T12573] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 535.383593][T12573] CPU: 1 UID: 0 PID: 12573 Comm: syz.2.1757 Tainted: G L syzkaller #0 PREEMPT(full) [ 535.383613][T12573] Tainted: [L]=SOFTLOCKUP [ 535.383618][T12573] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 535.383627][T12573] Call Trace: [ 535.383633][T12573] [ 535.383639][T12573] dump_stack_lvl+0xe8/0x150 [ 535.383664][T12573] should_fail_ex+0x412/0x560 [ 535.383689][T12573] _copy_from_user+0x2d/0xb0 [ 535.383709][T12573] ___sys_recvmsg+0x175/0x590 [ 535.383726][T12573] ? __lock_acquire+0x6b5/0x2cf0 [ 535.383748][T12573] ? __pfx____sys_recvmsg+0x10/0x10 [ 535.383796][T12573] do_recvmmsg+0x334/0x800 [ 535.383819][T12573] ? __pfx_do_recvmmsg+0x10/0x10 [ 535.383845][T12573] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 535.383874][T12573] __x64_sys_recvmmsg+0x198/0x250 [ 535.383894][T12573] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 535.383919][T12573] do_syscall_64+0x14d/0xf80 [ 535.383948][T12573] ? trace_irq_disable+0x3b/0x150 [ 535.383968][T12573] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 535.383982][T12573] ? clear_bhb_loop+0x40/0x90 [ 535.383999][T12573] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 535.384013][T12573] RIP: 0033:0x7f7652f9c799 [ 535.384026][T12573] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 535.384038][T12573] RSP: 002b:00007f7653e18028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 535.384053][T12573] RAX: ffffffffffffffda RBX: 00007f7653215fa0 RCX: 00007f7652f9c799 [ 535.384063][T12573] RDX: 0000000000000300 RSI: 0000200000000440 RDI: 0000000000000008 [ 535.384072][T12573] RBP: 00007f7653e18090 R08: 0000000000000000 R09: 0000000000000000 [ 535.384081][T12573] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 535.384089][T12573] R13: 00007f7653216038 R14: 00007f7653215fa0 R15: 00007f765333fa48 [ 535.384110][T12573] [ 535.618060][T12580] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 535.618469][T12580] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 536.725742][T12592] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 536.726069][T12592] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 536.937120][ T5913] usb 3-1: new high-speed USB device number 83 using dummy_hcd [ 537.108488][ T5913] usb 3-1: Using ep0 maxpacket: 16 [ 537.153761][ T42] usbhid 4-1:0.0: can't add hid device: -71 [ 537.177308][ T42] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 537.207196][ T5913] usb 3-1: config index 0 descriptor too short (expected 4495, got 71) [ 537.227086][ T5913] usb 3-1: config 0 has an invalid interface number: 105 but max is 0 [ 537.235308][ T5913] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 537.254934][ T42] usb 4-1: USB disconnect, device number 84 [ 537.310712][ T5913] usb 3-1: config 0 has no interface number 0 [ 537.337119][ T5913] usb 3-1: New USB device found, idVendor=046c, idProduct=14e0, bcdDevice= 0.01 [ 537.346309][ T5913] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 537.356196][ T5913] usb 3-1: Product: syz [ 537.366372][T12602] syzkaller0: entered promiscuous mode [ 537.372574][T12602] syzkaller0: entered allmulticast mode [ 537.408339][ T5913] usb 3-1: Manufacturer: syz [ 537.415087][T12602] tipc: Enabled bearer , priority 0 [ 537.424467][T12601] tipc: Resetting bearer [ 537.432675][ T5913] usb 3-1: SerialNumber: syz [ 537.472529][T12601] tipc: Disabling bearer [ 537.485916][ T5913] usb 3-1: config 0 descriptor?? [ 537.524817][ T5913] uvcvideo 3-1:0.105: probe with driver uvcvideo failed with error -22 [ 537.684619][T12605] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1765'. [ 537.735677][ T5926] usb 3-1: USB disconnect, device number 83 [ 537.805450][T12605] bond0: option miimon: invalid value (18446744073709062779) [ 537.846581][T12605] bond0: option miimon: allowed values 0 - 2147483647 [ 537.869458][T12605] bond0 (unregistering): Released all slaves [ 538.138086][T12608] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1767'. [ 538.337131][ T5905] usb 2-1: new high-speed USB device number 69 using dummy_hcd [ 538.377680][T12612] tipc: Enabling of bearer rejected, failed to enable media [ 538.441046][T12614] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1769'. [ 538.507565][ T5905] usb 2-1: Using ep0 maxpacket: 32 [ 538.514914][ T5905] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 538.561654][ T5905] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 538.576163][ T5905] usb 2-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 538.591281][ T5905] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 538.600578][T12616] netlink: 184 bytes leftover after parsing attributes in process `syz.2.1770'. [ 538.623449][ T5905] usb 2-1: config 0 descriptor?? [ 538.659168][ T5905] hub 2-1:0.0: USB hub found [ 538.679131][T12618] binder: 12617:12618 ioctl c0306201 200000000080 returned -14 [ 538.738360][T12618] syzkaller0: entered promiscuous mode [ 538.743984][T12618] syzkaller0: entered allmulticast mode [ 538.848651][ T5905] hub 2-1:0.0: config failed, can't read hub descriptor (err -90) [ 538.973592][T12625] xt_hashlimit: size too large, truncated to 1048576 [ 539.188046][T12629] syzkaller0: entered promiscuous mode [ 539.194276][T12629] syzkaller0: entered allmulticast mode [ 539.219591][T12629] tipc: Enabled bearer , priority 0 [ 539.233791][T12628] tipc: Resetting bearer [ 539.263476][ T5905] hid-generic 0003:046D:C31C.0030: item fetching failed at offset 0/1 [ 539.278090][T12628] tipc: Disabling bearer [ 539.278626][ T5905] hid-generic 0003:046D:C31C.0030: probe with driver hid-generic failed with error -22 [ 539.459540][T12610] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 539.471308][T12610] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 539.608570][ T5928] usb 2-1: USB disconnect, device number 69 [ 540.118604][T12642] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 540.129611][T12642] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 540.186008][T12646] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1781'. [ 540.435014][T12653] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1783'. [ 540.486394][T12654] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1783'. [ 540.763727][T12663] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1785'. [ 541.042535][ T29] audit: type=1326 audit(1773815416.721:1967): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12658 comm="syz.5.1784" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc6be39c799 code=0x7ffc0000 [ 541.272349][T12669] xt_hashlimit: size too large, truncated to 1048576 [ 541.285519][ T29] audit: type=1326 audit(1773815416.751:1968): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12658 comm="syz.5.1784" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc6be39c799 code=0x7ffc0000 [ 541.337803][T12670] netlink: 'syz.4.1788': attribute type 1 has an invalid length. [ 541.342087][ T29] audit: type=1326 audit(1773815416.751:1969): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12658 comm="syz.5.1784" exe="/root/syz-executor" sig=0 arch=c000003e syscall=98 compat=0 ip=0x7fc6be39c799 code=0x7ffc0000 [ 541.482041][ T29] audit: type=1326 audit(1773815416.751:1970): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12658 comm="syz.5.1784" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc6be39c799 code=0x7ffc0000 [ 541.559297][ T29] audit: type=1326 audit(1773815416.751:1971): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12658 comm="syz.5.1784" exe="/root/syz-executor" sig=0 arch=c000003e syscall=434 compat=0 ip=0x7fc6be39c799 code=0x7ffc0000 [ 541.585792][ T29] audit: type=1326 audit(1773815416.751:1972): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12658 comm="syz.5.1784" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc6be39c799 code=0x7ffc0000 [ 541.674132][ T29] audit: type=1326 audit(1773815416.751:1973): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12658 comm="syz.5.1784" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fc6be39c799 code=0x7ffc0000 [ 541.731695][ T29] audit: type=1326 audit(1773815416.751:1974): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12658 comm="syz.5.1784" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc6be39c799 code=0x7ffc0000 [ 541.830582][ T29] audit: type=1326 audit(1773815416.751:1975): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12658 comm="syz.5.1784" exe="/root/syz-executor" sig=0 arch=c000003e syscall=272 compat=0 ip=0x7fc6be39c799 code=0x7ffc0000 [ 541.916447][ T29] audit: type=1326 audit(1773815416.761:1976): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12658 comm="syz.5.1784" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc6be39c799 code=0x7ffc0000 [ 542.237350][T12688] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1792'. [ 542.479741][ T5890] kworker/1:3 (5890) used greatest stack depth: 15712 bytes left [ 542.528566][ T5926] usb 6-1: new full-speed USB device number 20 using dummy_hcd [ 542.705545][ T5926] usb 6-1: config 0 has an invalid interface number: 113 but max is 0 [ 542.776568][ T5926] usb 6-1: config 0 has no interface number 0 [ 542.941476][ T5926] usb 6-1: config 0 interface 113 altsetting 2 has an endpoint descriptor with address 0x14, changing to 0x4 [ 543.120071][ T5926] usb 6-1: config 0 interface 113 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 543.395231][ T5926] usb 6-1: config 0 interface 113 has no altsetting 0 [ 543.625216][ T5926] usb 6-1: New USB device found, idVendor=054c, idProduct=02e1, bcdDevice=e2.c8 [ 543.637393][ T5926] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 543.662303][ T5926] usb 6-1: Product: syz [ 543.672489][ T5926] usb 6-1: Manufacturer: syz [ 543.699829][ T5926] usb 6-1: SerialNumber: syz [ 543.724581][ T5926] usb 6-1: config 0 descriptor?? [ 543.761526][ T5926] pn533_usb 6-1:0.113: NFC: Could not find bulk-in or bulk-out endpoint [ 543.782923][T12711] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 543.821343][T12711] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 543.868860][T12711] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 543.909185][T12711] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 544.477168][T12715] xt_hashlimit: size too large, truncated to 1048576 [ 545.027328][ T5926] usb 4-1: new high-speed USB device number 85 using dummy_hcd [ 545.035909][T12727] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 545.073876][T12727] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 545.153216][ T5928] usb 6-1: USB disconnect, device number 20 [ 545.167898][ T5926] usb 4-1: device descriptor read/64, error -71 [ 545.407251][ T5926] usb 4-1: new high-speed USB device number 86 using dummy_hcd [ 545.539133][ T5926] usb 4-1: device descriptor read/64, error -71 [ 545.607440][T12735] syzkaller0: entered promiscuous mode [ 545.613148][T12735] syzkaller0: entered allmulticast mode [ 545.622982][T12735] tipc: Enabled bearer , priority 0 [ 545.647530][ T5926] usb usb4-port1: attempt power cycle [ 545.653665][T12735] tipc: Resetting bearer [ 545.722931][T12735] tipc: Disabling bearer [ 545.990813][ T5926] usb 4-1: new high-speed USB device number 87 using dummy_hcd [ 546.041403][ T5926] usb 4-1: device descriptor read/8, error -71 [ 546.407319][ T5926] usb 4-1: new high-speed USB device number 88 using dummy_hcd [ 546.437991][ T5926] usb 4-1: device descriptor read/8, error -71 [ 546.557822][ T5926] usb usb4-port1: unable to enumerate USB device [ 546.947099][ T5905] usb 6-1: new high-speed USB device number 21 using dummy_hcd [ 547.095100][ T5905] usb 6-1: device descriptor read/64, error -71 [ 547.406552][ T5905] usb 6-1: new high-speed USB device number 22 using dummy_hcd [ 547.568887][ T5905] usb 6-1: device descriptor read/64, error -71 [ 547.591270][T12764] vlan2: entered allmulticast mode [ 547.598743][T12764] bridge_slave_0: entered allmulticast mode [ 547.745946][ T5905] usb usb6-port1: attempt power cycle [ 548.137180][ T5905] usb 6-1: new high-speed USB device number 23 using dummy_hcd [ 548.159700][ T5905] usb 6-1: device descriptor read/8, error -71 [ 548.467091][ T5905] usb 6-1: new high-speed USB device number 24 using dummy_hcd [ 548.487834][ T5905] usb 6-1: device descriptor read/8, error -71 [ 548.830508][ T5905] usb usb6-port1: unable to enumerate USB device [ 549.547129][ T5928] usb 4-1: new high-speed USB device number 89 using dummy_hcd [ 549.708814][ T5928] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 549.743613][ T5928] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 549.778618][ T5928] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 549.823044][ T5928] usb 4-1: New USB device found, idVendor=2040, idProduct=2000, bcdDevice=65.72 [ 549.835037][T12799] syzkaller0: entered promiscuous mode [ 549.841177][ T5928] usb 4-1: New USB device strings: Mfr=151, Product=0, SerialNumber=0 [ 549.852381][T12799] syzkaller0: entered allmulticast mode [ 549.867118][ T5928] usb 4-1: Manufacturer: syz [ 549.891638][ T5928] usb 4-1: config 0 descriptor?? [ 549.912906][T12799] tipc: Enabled bearer , priority 0 [ 549.920494][ T5928] smsusb:smsusb_probe: board id=9, interface number 0 [ 549.931718][ T5928] smsusb:smsusb_probe: Device initialized with return code -19 [ 549.943095][T12798] tipc: Resetting bearer [ 550.005485][T12798] tipc: Disabling bearer [ 550.254704][T12806] netlink: 'syz.4.1824': attribute type 10 has an invalid length. [ 550.274844][T12806] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 551.290807][T12825] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1827'. [ 551.977990][ T5905] usb 4-1: USB disconnect, device number 89 [ 553.073208][T12851] usb usb9: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 553.092003][T12846] tipc: Enabled bearer , priority 0 [ 553.107572][T12851] usb usb9: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 553.124645][T12846] tipc: Resetting bearer [ 553.148857][ T29] kauditd_printk_skb: 22 callbacks suppressed [ 553.148874][ T29] audit: type=1326 audit(1773815428.831:1999): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12850 comm="syz.3.1833" exe="/root/syz-executor" sig=31 arch=c000003e syscall=317 compat=0 ip=0x7f029a19c799 code=0x0 [ 553.358902][T12844] tipc: Disabling bearer [ 553.627243][ T5905] usb 3-1: new high-speed USB device number 84 using dummy_hcd [ 553.770268][ T5905] usb 3-1: device descriptor read/64, error -71 [ 553.931380][T12865] libceph: resolve '0..' (ret=-3): failed [ 554.033750][T12868] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 554.067257][ T5905] usb 3-1: new high-speed USB device number 85 using dummy_hcd [ 554.075381][T12868] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 554.237694][ T5905] usb 3-1: device descriptor read/64, error -71 [ 554.347632][ T5905] usb usb3-port1: attempt power cycle [ 554.777919][T12884] syzkaller0: entered promiscuous mode [ 554.783585][T12884] syzkaller0: entered allmulticast mode [ 554.987450][ T5905] usb 3-1: new high-speed USB device number 86 using dummy_hcd [ 555.061835][ T5905] usb 3-1: device descriptor read/8, error -71 [ 555.317195][ T5905] usb 3-1: new high-speed USB device number 87 using dummy_hcd [ 555.349332][ T5905] usb 3-1: device descriptor read/8, error -71 [ 555.471039][ T5905] usb usb3-port1: unable to enumerate USB device [ 555.516648][ T5913] usb 4-1: new high-speed USB device number 90 using dummy_hcd [ 555.569613][T12898] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 555.581865][T12898] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 555.657185][ T5913] usb 4-1: device descriptor read/64, error -71 [ 555.813204][T12898] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 555.823373][ T5905] usb 2-1: new high-speed USB device number 70 using dummy_hcd [ 555.836402][T12898] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 555.897141][ T5913] usb 4-1: new high-speed USB device number 91 using dummy_hcd [ 555.977862][ T5905] usb 2-1: Using ep0 maxpacket: 32 [ 556.043740][ T5913] usb 4-1: device descriptor read/64, error -71 [ 556.087979][ T5905] usb 2-1: config 0 has an invalid interface number: 188 but max is 0 [ 556.098926][ T5905] usb 2-1: config 0 has no interface number 0 [ 556.105073][ T5905] usb 2-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 556.119655][ T5905] usb 2-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 556.134657][ T5905] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 556.142817][ T5905] usb 2-1: Product: syz [ 556.147373][ T5905] usb 2-1: Manufacturer: syz [ 556.154074][ T5905] usb 2-1: SerialNumber: syz [ 556.159677][ T5913] usb usb4-port1: attempt power cycle [ 556.226104][ T5905] usb 2-1: config 0 descriptor?? [ 556.239486][T12896] raw-gadget.3 gadget.1: fail, usb_ep_enable returned -22 [ 556.461531][T12896] raw-gadget.3 gadget.1: fail, usb_ep_enable returned -22 [ 556.497399][ T5913] usb 4-1: new high-speed USB device number 92 using dummy_hcd [ 556.599189][ T5913] usb 4-1: device descriptor read/8, error -71 [ 556.680249][ T5905] asix 2-1:0.188 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61 [ 556.701737][ T5905] asix 2-1:0.188: probe with driver asix failed with error -61 [ 556.801746][ C0] vcan0: j1939_tp_rxtimer: 0xffff88802d1c0c00: rx timeout, send abort [ 556.812791][ C0] vcan0: j1939_xtp_rx_abort_one: 0xffff88802d1c0c00: 0x20000: (3) A timeout occurred and this is the connection abort to close the session. [ 556.835593][T12907] syzkaller0: entered promiscuous mode [ 556.841644][T12907] syzkaller0: entered allmulticast mode [ 556.847920][ T5913] usb 4-1: new high-speed USB device number 93 using dummy_hcd [ 556.877849][ T5913] usb 4-1: device descriptor read/8, error -71 [ 556.988530][ T5913] usb usb4-port1: unable to enumerate USB device [ 557.806764][ C0] ip6_tunnel: ip6gretap0 xmit: Routing loop! Remote address found on this node! [ 558.807254][ T5913] usb 4-1: new high-speed USB device number 94 using dummy_hcd [ 558.867498][T12928] syzkaller0: entered promiscuous mode [ 558.873012][T12928] syzkaller0: entered allmulticast mode [ 558.988016][ T5913] usb 4-1: too many configurations: 65, using maximum allowed: 8 [ 558.995879][ T8369] usb 2-1: USB disconnect, device number 70 [ 559.010369][ T5913] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 559.023497][ T5913] usb 4-1: config 0 has no interfaces? [ 559.042607][ T5913] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 559.066241][ T5913] usb 4-1: config 0 has no interfaces? [ 559.085870][ T5913] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 559.111939][ T5913] usb 4-1: config 0 has no interfaces? [ 559.151366][ T5913] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 559.174548][ T5913] usb 4-1: config 0 has no interfaces? [ 559.188465][ T5913] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 559.199865][ T5913] usb 4-1: config 0 has no interfaces? [ 559.229258][ T5913] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 559.248842][ T5913] usb 4-1: config 0 has no interfaces? [ 559.265637][T12933] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 559.275880][ T5913] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 559.313925][ T5913] usb 4-1: config 0 has no interfaces? [ 559.341348][ T5913] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 559.378889][ T5913] usb 4-1: config 0 has no interfaces? [ 559.400488][ T5913] usb 4-1: New USB device found, idVendor=046d, idProduct=08c1, bcdDevice=ee.8d [ 559.433405][ T5913] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 559.461138][ T5913] usb 4-1: config 0 descriptor?? [ 559.691634][ T5913] usb 4-1: USB disconnect, device number 94 [ 561.677128][ T5842] usb 6-1: new high-speed USB device number 25 using dummy_hcd [ 561.687128][ T5926] usb 3-1: new high-speed USB device number 88 using dummy_hcd [ 561.847231][ T5842] usb 6-1: device descriptor read/64, error -71 [ 561.854965][ T5844] cgroup: fork rejected by pids controller in /syz4 [ 561.888477][ T5926] usb 3-1: Using ep0 maxpacket: 16 [ 561.898831][ T5926] usb 3-1: unable to get BOS descriptor or descriptor too short [ 561.918537][ T5926] usb 3-1: config 6 has an invalid interface number: 27 but max is 0 [ 561.927589][ T5926] usb 3-1: config 6 has no interface number 0 [ 561.934571][ T5926] usb 3-1: config 6 interface 27 has no altsetting 0 [ 561.944395][ T5926] usb 3-1: New USB device found, idVendor=12d6, idProduct=0444, bcdDevice=c3.00 [ 561.954305][ T5926] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 561.963135][ T5926] usb 3-1: Product: syz [ 561.968209][ T5926] usb 3-1: Manufacturer: syz [ 561.972843][ T5926] usb 3-1: SerialNumber: syz [ 562.107155][ T5842] usb 6-1: new high-speed USB device number 26 using dummy_hcd [ 562.174148][ T5913] usb 5-1: USB disconnect, device number 16 [ 562.211391][ T5926] ems_usb 3-1:6.27 (unnamed net_device) (uninitialized): couldn't initialize controller: -22 [ 562.247067][ T5926] ems_usb 3-1:6.27: probe with driver ems_usb failed with error -22 [ 562.257313][ T5842] usb 6-1: device descriptor read/64, error -71 [ 562.315731][ T5926] usb 3-1: USB disconnect, device number 88 [ 562.388414][ T5842] usb usb6-port1: attempt power cycle [ 562.448593][T11378] netdevsim netdevsim4 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 562.470929][T11378] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 562.611454][T12986] No such timeout policy "syz0" [ 562.755701][T11378] netdevsim netdevsim4 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 562.767414][ T5842] usb 6-1: new high-speed USB device number 27 using dummy_hcd [ 562.798712][ T5842] usb 6-1: device descriptor read/8, error -71 [ 562.903936][T11378] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 562.943509][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 562.950514][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 563.013652][T11378] netdevsim netdevsim4 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 563.026936][T11378] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 563.047408][ T5842] usb 6-1: new high-speed USB device number 28 using dummy_hcd [ 563.080070][ T5842] usb 6-1: device descriptor read/8, error -71 [ 563.131844][T11378] netdevsim netdevsim4 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 563.143739][T11378] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 563.219730][ T5842] usb usb6-port1: unable to enumerate USB device [ 563.618542][T11378] bridge_slave_1: left allmulticast mode [ 563.627485][T11378] bridge_slave_1: left promiscuous mode [ 563.650774][T11378] bridge0: port 2(bridge_slave_1) entered disabled state [ 563.681301][T11378] bridge_slave_0: left allmulticast mode [ 563.700323][T11378] bridge0: port 1(bridge_slave_0) entered disabled state [ 563.869583][T10661] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 563.880142][T10661] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 563.890817][T10661] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 563.899411][T10661] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 563.907952][T10661] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 564.133279][T10661] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 564.146516][T10661] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 564.157589][T10661] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 564.198947][T10661] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 564.213539][T10661] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 564.558259][ T5842] usb 3-1: new full-speed USB device number 89 using dummy_hcd [ 564.775168][ T5842] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 564.785742][ T5842] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x1 has invalid wMaxPacketSize 0 [ 564.800260][ T5842] usb 3-1: config 0 interface 0 altsetting 2 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 564.816858][ T5842] usb 3-1: config 0 interface 0 has no altsetting 0 [ 564.827941][ T5842] usb 3-1: New USB device found, idVendor=0e41, idProduct=4142, bcdDevice=d4.6e [ 564.837427][ T5842] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 564.850871][ T5842] usb 3-1: Product: syz [ 564.855169][ T5842] usb 3-1: Manufacturer: syz [ 564.864697][T11378] bond0 (unregistering): (slave bridge0): Releasing backup interface [ 564.873715][ T5842] usb 3-1: SerialNumber: syz [ 564.913094][ T5842] usb 3-1: config 0 descriptor?? [ 564.930726][ T5842] snd_usb_toneport 3-1:0.0: Line 6 TonePort UX2 found [ 564.972195][T11378] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 565.003888][T11378] bond0 (unregistering): Released all slaves [ 565.234436][T11378] tipc: Left network mode [ 565.239052][ T5842] snd_usb_toneport 3-1:0.0: set_interface failed [ 565.255273][ T5842] snd_usb_toneport 3-1:0.0: Line 6 TonePort UX2 now disconnected [ 565.307264][ T5842] snd_usb_toneport 3-1:0.0: probe with driver snd_usb_toneport failed with error -71 [ 565.374804][ T5842] usb 3-1: USB disconnect, device number 89 [ 565.968862][ T5836] Bluetooth: hci1: command tx timeout [ 566.288637][ T5836] Bluetooth: hci2: command tx timeout [ 567.258194][T13026] tipc: Enabled bearer , priority 0 [ 567.268061][T13031] tipc: Resetting bearer [ 567.281189][ T5842] ip6_tunnel: ip6gretap0: Local routing loop detected! [ 567.298318][T13024] tipc: Disabling bearer [ 567.967402][T13050] loop2: detected capacity change from 0 to 7 [ 568.058956][ T5836] Bluetooth: hci1: command tx timeout [ 568.291507][ T5842] ip6_tunnel: ip6gretap0: Local routing loop detected! [ 568.298791][T13050] Dev loop2: unable to read RDB block 7 [ 568.366416][T13050] loop2: AHDI p2 p3 [ 568.367078][ T5836] Bluetooth: hci2: command tx timeout [ 568.382170][T13050] loop2: partition table partially beyond EOD, truncated [ 568.806144][T12998] chnl_net:caif_netlink_parms(): no params data found [ 568.917638][ T5197] Dev loop2: unable to read RDB block 7 [ 568.923278][ T5197] loop2: AHDI p2 p3 [ 568.949231][ T5197] loop2: partition table partially beyond EOD, truncated [ 568.968234][T11378] veth0: left promiscuous mode [ 569.022784][T11378] batadv0: left promiscuous mode [ 569.050084][T13067] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1886'. [ 569.087911][T11378] hsr_slave_0: left promiscuous mode [ 569.113675][T11378] hsr_slave_1: left promiscuous mode [ 569.128208][T11378] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 569.165895][T11378] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 569.464775][T13076] netlink: 184 bytes leftover after parsing attributes in process `syz.3.1888'. [ 570.043259][T11378] team0 (unregistering): Port device team_slave_1 removed [ 570.084687][T11378] team0 (unregistering): Port device team_slave_0 removed [ 570.126514][ T5836] Bluetooth: hci1: command tx timeout [ 570.447345][ T5836] Bluetooth: hci2: command tx timeout [ 570.943415][T13005] chnl_net:caif_netlink_parms(): no params data found [ 571.094113][T12998] bridge0: port 1(bridge_slave_0) entered blocking state [ 571.110692][T13102] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1892'. [ 571.140884][T12998] bridge0: port 1(bridge_slave_0) entered disabled state [ 571.167487][T12998] bridge_slave_0: entered allmulticast mode [ 571.175363][T12998] bridge_slave_0: entered promiscuous mode [ 571.260424][T12998] bridge0: port 2(bridge_slave_1) entered blocking state [ 571.283785][T12998] bridge0: port 2(bridge_slave_1) entered disabled state [ 571.339135][T12998] bridge_slave_1: entered allmulticast mode [ 571.357701][T12998] bridge_slave_1: entered promiscuous mode [ 571.433596][T13108] FAULT_INJECTION: forcing a failure. [ 571.433596][T13108] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 571.462960][T13108] CPU: 0 UID: 0 PID: 13108 Comm: syz.3.1894 Tainted: G L syzkaller #0 PREEMPT(full) [ 571.463000][T13108] Tainted: [L]=SOFTLOCKUP [ 571.463006][T13108] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 571.463016][T13108] Call Trace: [ 571.463023][T13108] [ 571.463030][T13108] dump_stack_lvl+0xe8/0x150 [ 571.463057][T13108] should_fail_ex+0x412/0x560 [ 571.463084][T13108] _copy_from_user+0x2d/0xb0 [ 571.463102][T13108] ___sys_recvmsg+0x175/0x590 [ 571.463119][T13108] ? __lock_acquire+0x6b5/0x2cf0 [ 571.463142][T13108] ? __pfx____sys_recvmsg+0x10/0x10 [ 571.463191][T13108] do_recvmmsg+0x334/0x800 [ 571.463215][T13108] ? __pfx_do_recvmmsg+0x10/0x10 [ 571.463241][T13108] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 571.463271][T13108] __x64_sys_recvmmsg+0x198/0x250 [ 571.463291][T13108] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 571.463318][T13108] do_syscall_64+0x14d/0xf80 [ 571.463333][T13108] ? trace_irq_disable+0x3b/0x150 [ 571.463356][T13108] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 571.463371][T13108] ? clear_bhb_loop+0x40/0x90 [ 571.463390][T13108] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 571.463405][T13108] RIP: 0033:0x7f029a19c799 [ 571.463420][T13108] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 571.463434][T13108] RSP: 002b:00007f029b064028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 571.463451][T13108] RAX: ffffffffffffffda RBX: 00007f029a415fa0 RCX: 00007f029a19c799 [ 571.463462][T13108] RDX: 0000000000000300 RSI: 0000200000000440 RDI: 0000000000000008 [ 571.463472][T13108] RBP: 00007f029b064090 R08: 0000000000000000 R09: 0000000000000000 [ 571.463482][T13108] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 571.463491][T13108] R13: 00007f029a416038 R14: 00007f029a415fa0 R15: 00007f029a53fa48 [ 571.463513][T13108] [ 571.744267][T12998] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 571.979474][T12998] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 572.101803][T12998] team0: Port device team_slave_0 added [ 572.113733][T12998] team0: Port device team_slave_1 added [ 572.153596][T12998] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 572.161549][T12998] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 572.206521][ T5836] Bluetooth: hci1: command tx timeout [ 572.248739][T12998] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 572.526913][ T5836] Bluetooth: hci2: command tx timeout [ 572.991125][T13005] bridge0: port 1(bridge_slave_0) entered blocking state [ 573.020039][T13005] bridge0: port 1(bridge_slave_0) entered disabled state [ 573.042348][T13005] bridge_slave_0: entered allmulticast mode [ 573.066200][T13005] bridge_slave_0: entered promiscuous mode [ 573.193857][T12998] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 573.216895][T12998] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 573.309046][T12998] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 573.347271][T13005] bridge0: port 2(bridge_slave_1) entered blocking state [ 573.354460][T13005] bridge0: port 2(bridge_slave_1) entered disabled state [ 573.362845][T11378] IPVS: stop unused estimator thread 0... [ 573.382113][T13005] bridge_slave_1: entered allmulticast mode [ 573.418977][T13005] bridge_slave_1: entered promiscuous mode [ 573.556672][ T5842] usb 4-1: new high-speed USB device number 95 using dummy_hcd [ 573.581145][T13005] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 573.630112][T13005] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 573.738300][ T5842] usb 4-1: Using ep0 maxpacket: 16 [ 573.754510][ T5842] usb 4-1: config 1 has an invalid interface number: 19 but max is 0 [ 573.774756][ T5842] usb 4-1: config 1 has no interface number 0 [ 573.791779][ T5842] usb 4-1: config 1 interface 19 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 573.816251][ T5842] usb 4-1: config 1 interface 19 has no altsetting 0 [ 573.835659][ T5842] usb 4-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice= 7.c9 [ 573.855359][ T5842] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 573.887151][ T5842] usb 4-1: Product: syz [ 573.905718][ T5842] usb 4-1: Manufacturer: syz [ 573.927728][ T5842] usb 4-1: SerialNumber: syz [ 574.010189][T13005] team0: Port device team_slave_0 added [ 574.042672][ T5842] usb 4-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 574.057155][T12998] hsr_slave_0: entered promiscuous mode [ 574.064158][T12998] hsr_slave_1: entered promiscuous mode [ 574.107784][T12998] debugfs: 'hsr0' already exists in 'hsr' [ 574.113699][T12998] Cannot create hsr debugfs directory [ 574.229649][ T8369] usb 4-1: USB disconnect, device number 95 [ 574.230944][ T35] usb 4-1: Failed to submit usb control message: -71 [ 574.247963][T13005] team0: Port device team_slave_1 added [ 574.268078][ T35] usb 4-1: unable to send the bmi data to the device: -71 [ 574.317742][ T35] usb 4-1: unable to get target info from device [ 574.325128][ T35] usb 4-1: could not get target info (-71) [ 574.338054][ T35] usb 4-1: could not probe fw (-71) [ 574.594481][T13005] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 574.604044][T13005] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 574.630961][T13005] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 574.648445][T13005] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 574.658091][T13005] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 574.686654][T13005] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 574.688073][ T8369] usb 4-1: new high-speed USB device number 96 using dummy_hcd [ 574.706584][ T5842] usb 3-1: new low-speed USB device number 90 using dummy_hcd [ 574.837351][ T8369] usb 4-1: device descriptor read/64, error -71 [ 574.846537][ T5842] usb 3-1: device descriptor read/64, error -71 [ 574.874771][T13005] hsr_slave_0: entered promiscuous mode [ 574.887692][T13005] hsr_slave_1: entered promiscuous mode [ 574.904535][T13005] debugfs: 'hsr0' already exists in 'hsr' [ 574.918501][T13005] Cannot create hsr debugfs directory [ 575.077570][ T8369] usb 4-1: new high-speed USB device number 97 using dummy_hcd [ 575.107002][ T5842] usb 3-1: new low-speed USB device number 91 using dummy_hcd [ 575.222025][ T8369] usb 4-1: device descriptor read/64, error -71 [ 575.266590][ T5842] usb 3-1: device descriptor read/64, error -71 [ 575.344759][ T8369] usb usb4-port1: attempt power cycle [ 575.376958][ T5842] usb usb3-port1: attempt power cycle [ 575.662074][T13184] FAULT_INJECTION: forcing a failure. [ 575.662074][T13184] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 575.697460][ T8369] usb 4-1: new high-speed USB device number 98 using dummy_hcd [ 575.705199][T13184] CPU: 0 UID: 0 PID: 13184 Comm: syz.5.1904 Tainted: G L syzkaller #0 PREEMPT(full) [ 575.705235][T13184] Tainted: [L]=SOFTLOCKUP [ 575.705241][T13184] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 575.705251][T13184] Call Trace: [ 575.705257][T13184] [ 575.705265][T13184] dump_stack_lvl+0xe8/0x150 [ 575.705291][T13184] should_fail_ex+0x412/0x560 [ 575.705317][T13184] _copy_from_user+0x2d/0xb0 [ 575.705334][T13184] ___sys_recvmsg+0x175/0x590 [ 575.705352][T13184] ? __lock_acquire+0x6b5/0x2cf0 [ 575.705375][T13184] ? __pfx____sys_recvmsg+0x10/0x10 [ 575.705417][T13184] do_recvmmsg+0x334/0x800 [ 575.705443][T13184] ? __pfx_do_recvmmsg+0x10/0x10 [ 575.705468][T13184] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 575.705505][T13184] __x64_sys_recvmmsg+0x198/0x250 [ 575.705525][T13184] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 575.705551][T13184] do_syscall_64+0x14d/0xf80 [ 575.705567][T13184] ? trace_irq_disable+0x3b/0x150 [ 575.705588][T13184] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 575.705604][T13184] ? clear_bhb_loop+0x40/0x90 [ 575.705622][T13184] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 575.705637][T13184] RIP: 0033:0x7fc6be39c799 [ 575.705651][T13184] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 575.705664][T13184] RSP: 002b:00007fc6bf1cc028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 575.705681][T13184] RAX: ffffffffffffffda RBX: 00007fc6be615fa0 RCX: 00007fc6be39c799 [ 575.705692][T13184] RDX: 0000000000000300 RSI: 0000200000000440 RDI: 0000000000000008 [ 575.705702][T13184] RBP: 00007fc6bf1cc090 R08: 0000000000000000 R09: 0000000000000000 [ 575.705711][T13184] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 575.705720][T13184] R13: 00007fc6be616038 R14: 00007fc6be615fa0 R15: 00007fc6be73fa48 [ 575.705743][T13184] [ 575.923411][ T8369] usb 4-1: device descriptor read/8, error -71 [ 575.925985][T13005] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 575.937194][ T5842] usb 3-1: new low-speed USB device number 92 using dummy_hcd [ 575.950951][T13005] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 575.969974][T13005] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 575.988734][ T5842] usb 3-1: device descriptor read/8, error -71 [ 575.998747][T13005] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 576.200421][ T8369] usb 4-1: new high-speed USB device number 99 using dummy_hcd [ 576.236643][ T5842] usb 3-1: new low-speed USB device number 93 using dummy_hcd [ 576.255415][T12998] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 576.267354][ T5842] usb 3-1: device descriptor read/8, error -71 [ 576.279732][ T8369] usb 4-1: device descriptor read/8, error -71 [ 576.305502][T12998] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 576.333633][T12998] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 576.360447][T12998] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 576.387476][ T5842] usb usb3-port1: unable to enumerate USB device [ 576.397530][ T8369] usb usb4-port1: unable to enumerate USB device [ 576.458479][T13005] 8021q: adding VLAN 0 to HW filter on device bond0 [ 576.534795][T13005] 8021q: adding VLAN 0 to HW filter on device team0 [ 576.561564][ T127] bridge0: port 1(bridge_slave_0) entered blocking state [ 576.568857][ T127] bridge0: port 1(bridge_slave_0) entered forwarding state [ 576.625528][T11378] bridge0: port 2(bridge_slave_1) entered blocking state [ 576.632728][T11378] bridge0: port 2(bridge_slave_1) entered forwarding state [ 576.785403][T12998] 8021q: adding VLAN 0 to HW filter on device bond0 [ 576.838143][ T29] audit: type=1326 audit(1773815452.521:2000): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13219 comm="syz.5.1908" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fc6be39c799 code=0x0 [ 576.850445][T12998] 8021q: adding VLAN 0 to HW filter on device team0 [ 576.900610][ T127] bridge0: port 1(bridge_slave_0) entered blocking state [ 576.907854][ T127] bridge0: port 1(bridge_slave_0) entered forwarding state [ 576.921106][ T127] bridge0: port 2(bridge_slave_1) entered blocking state [ 576.928330][ T127] bridge0: port 2(bridge_slave_1) entered forwarding state [ 576.999763][T13005] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 577.128744][T13005] veth0_vlan: entered promiscuous mode [ 577.175096][T12998] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 577.203772][T13005] veth1_vlan: entered promiscuous mode [ 577.267791][T13005] veth0_macvtap: entered promiscuous mode [ 577.300737][T13005] veth1_macvtap: entered promiscuous mode [ 577.323425][T12998] veth0_vlan: entered promiscuous mode [ 577.471786][T12998] veth1_vlan: entered promiscuous mode [ 577.513772][T13005] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 577.583489][T12998] veth0_macvtap: entered promiscuous mode [ 577.623015][T13005] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 577.686996][T12998] veth1_macvtap: entered promiscuous mode [ 577.724467][ T1092] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 577.737767][ T1092] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 577.812465][ T1092] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 577.850910][ T1092] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 577.954453][T12998] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 578.001340][T12998] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 578.038718][ T5928] usb 3-1: new high-speed USB device number 94 using dummy_hcd [ 578.050716][ T1092] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 578.087078][ T1092] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 578.163471][ T1092] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 578.177525][ T1092] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 578.186299][ T1092] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 578.226709][ T5928] usb 3-1: Using ep0 maxpacket: 8 [ 578.238163][ T5928] usb 3-1: config 1 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 578.257767][ T5928] usb 3-1: config 1 interface 0 altsetting 2 endpoint 0x81 has invalid wMaxPacketSize 0 [ 578.273563][T11378] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 578.298485][T11378] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 578.299190][ T1092] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 578.317087][ T5928] usb 3-1: config 1 interface 0 altsetting 2 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 578.348159][ T5928] usb 3-1: config 1 interface 0 has no altsetting 0 [ 578.362606][ T5928] usb 3-1: string descriptor 0 read error: -22 [ 578.372617][ T5928] usb 3-1: New USB device found, idVendor=13ec, idProduct=0006, bcdDevice= 0.40 [ 578.413047][ T5928] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 578.859442][T11378] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 578.872506][ T5928] hid_parser_main: 4007 callbacks suppressed [ 578.872528][ T5928] zydacron 0003:13EC:0006.0031: unknown main item tag 0x0 [ 578.904181][T11378] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 578.915098][T13263] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 578.926400][T13263] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 578.935753][ T5928] zydacron 0003:13EC:0006.0031: unknown main item tag 0x0 [ 578.957425][ T5928] zydacron 0003:13EC:0006.0031: unknown main item tag 0x0 [ 578.964730][ T5928] zydacron 0003:13EC:0006.0031: unknown main item tag 0x0 [ 579.008374][ T5928] zydacron 0003:13EC:0006.0031: unknown main item tag 0x0 [ 579.031073][ T5928] zydacron 0003:13EC:0006.0031: unknown main item tag 0x0 [ 579.088572][ T5928] zydacron 0003:13EC:0006.0031: unknown main item tag 0x0 [ 579.121466][ T5928] zydacron 0003:13EC:0006.0031: unknown main item tag 0x0 [ 579.135395][ T35] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 579.157253][T13266] FAULT_INJECTION: forcing a failure. [ 579.157253][T13266] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 579.169017][ T5928] zydacron 0003:13EC:0006.0031: unknown main item tag 0x0 [ 579.176952][ T35] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 579.198001][ T796] usb 4-1: new high-speed USB device number 100 using dummy_hcd [ 579.199513][ T5928] zydacron 0003:13EC:0006.0031: unknown main item tag 0x0 [ 579.216196][T13266] CPU: 1 UID: 0 PID: 13266 Comm: syz.6.1914 Tainted: G L syzkaller #0 PREEMPT(full) [ 579.216228][T13266] Tainted: [L]=SOFTLOCKUP [ 579.216236][T13266] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 579.216249][T13266] Call Trace: [ 579.216259][T13266] [ 579.216269][T13266] dump_stack_lvl+0xe8/0x150 [ 579.216306][T13266] should_fail_ex+0x412/0x560 [ 579.216342][T13266] _copy_from_user+0x2d/0xb0 [ 579.216366][T13266] ___sys_recvmsg+0x175/0x590 [ 579.216393][T13266] ? __lock_acquire+0x6b5/0x2cf0 [ 579.216426][T13266] ? __pfx____sys_recvmsg+0x10/0x10 [ 579.216488][T13266] do_recvmmsg+0x334/0x800 [ 579.216522][T13266] ? __pfx_do_recvmmsg+0x10/0x10 [ 579.216556][T13266] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 579.216600][T13266] __x64_sys_recvmmsg+0x198/0x250 [ 579.216635][T13266] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 579.216672][T13266] do_syscall_64+0x14d/0xf80 [ 579.216694][T13266] ? trace_irq_disable+0x3b/0x150 [ 579.216724][T13266] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 579.216747][T13266] ? clear_bhb_loop+0x40/0x90 [ 579.216774][T13266] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 579.216793][T13266] RIP: 0033:0x7f3e7a59c799 [ 579.216812][T13266] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 579.216830][T13266] RSP: 002b:00007f3e7b539028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 579.216850][T13266] RAX: ffffffffffffffda RBX: 00007f3e7a815fa0 RCX: 00007f3e7a59c799 [ 579.216865][T13266] RDX: 0000000000000300 RSI: 0000200000000440 RDI: 0000000000000008 [ 579.216877][T13266] RBP: 00007f3e7b539090 R08: 0000000000000000 R09: 0000000000000000 [ 579.216890][T13266] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 579.216901][T13266] R13: 00007f3e7a816038 R14: 00007f3e7a815fa0 R15: 00007f3e7a93fa48 [ 579.216930][T13266] [ 579.555627][ T5928] zydacron 0003:13EC:0006.0031: hidraw0: USB HID v17.99 Device [HID 13ec:0006] on usb-dummy_hcd.2-1/input0 [ 579.643739][ T796] usb 4-1: device descriptor read/64, error -71 [ 579.930978][ T796] usb 4-1: new high-speed USB device number 101 using dummy_hcd [ 580.028164][ T5920] usb 3-1: USB disconnect, device number 94 [ 580.079488][ T796] usb 4-1: device descriptor read/64, error -71 [ 580.116667][ T5913] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 580.197156][ T796] usb usb4-port1: attempt power cycle [ 580.626539][ T5913] usb 5-1: Using ep0 maxpacket: 32 [ 581.089040][ T5913] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 581.195668][ T5913] usb 5-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 581.236622][ T796] usb 4-1: new high-speed USB device number 102 using dummy_hcd [ 581.372565][ T5913] usb 5-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 581.391031][ T796] usb 4-1: device descriptor read/8, error -71 [ 581.427832][ T5913] usb 5-1: Product: syz [ 581.443625][ T5913] usb 5-1: Manufacturer: syz [ 581.467067][ T5928] usb 3-1: new high-speed USB device number 95 using dummy_hcd [ 581.472661][ T5913] usb 5-1: SerialNumber: syz [ 581.496743][ T5913] usb 5-1: config 0 descriptor?? [ 581.563568][T13278] raw-gadget.3 gadget.4: fail, usb_ep_enable returned -22 [ 581.631206][ T5913] hub 5-1:0.0: bad descriptor, ignoring hub [ 581.662211][ T5913] hub 5-1:0.0: probe with driver hub failed with error -5 [ 581.685508][ T5928] usb 3-1: config 0 has an invalid interface number: 50 but max is 0 [ 581.686687][ T796] usb 4-1: new high-speed USB device number 103 using dummy_hcd [ 581.717799][ T5928] usb 3-1: config 0 has no interface number 0 [ 581.737732][ T5928] usb 3-1: config 0 interface 50 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 581.923127][ T796] usb 4-1: device descriptor read/8, error -71 [ 581.929023][ T5926] usb 6-1: new high-speed USB device number 29 using dummy_hcd [ 581.955598][ T5928] usb 3-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=e6.fc [ 581.984340][ T5928] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 582.054162][ T5928] usb 3-1: Product: syz [ 582.067053][ T796] usb usb4-port1: unable to enumerate USB device [ 582.069478][ T29] audit: type=1326 audit(1773815457.741:2001): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13302 comm="syz.6.1920" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f3e7a59c799 code=0x0 [ 582.100406][ T5926] usb 6-1: device descriptor read/64, error -71 [ 582.115730][ T5928] usb 3-1: Manufacturer: syz [ 582.140637][ T5928] usb 3-1: SerialNumber: syz [ 582.172061][ T5928] usb 3-1: config 0 descriptor?? [ 582.293242][ T5928] yurex 3-1:0.50: USB YUREX device now attached to Yurex #1 [ 582.368742][ T5926] usb 6-1: new high-speed USB device number 30 using dummy_hcd [ 582.432611][ C1] yurex 3-1:0.50: yurex_interrupt - overflow with length 8, actual length is 8 [ 582.509347][ T5926] usb 6-1: device descriptor read/64, error -71 [ 582.585905][T13273] netlink: 'syz.4.1873': attribute type 3 has an invalid length. [ 582.623217][ T5926] usb usb6-port1: attempt power cycle [ 582.634638][ T796] usb 3-1: USB disconnect, device number 95 [ 582.649155][ T796] yurex 3-1:0.50: USB YUREX #1 now disconnected [ 583.021471][ T5926] usb 6-1: new high-speed USB device number 31 using dummy_hcd [ 583.085927][T13326] xt_hashlimit: size too large, truncated to 1048576 [ 583.207759][ T5926] usb 6-1: device descriptor read/8, error -71 [ 583.653590][ T5926] usb 6-1: new high-speed USB device number 32 using dummy_hcd [ 583.711616][ T5926] usb 6-1: device descriptor read/8, error -71 [ 583.839490][ T5926] usb usb6-port1: unable to enumerate USB device [ 585.096094][T13349] fuse: Unknown parameter '3x6fd' [ 585.506564][ T5842] usb 4-1: new high-speed USB device number 104 using dummy_hcd [ 585.647066][ T5842] usb 4-1: device descriptor read/64, error -71 [ 585.682795][T13363] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1930'. [ 585.745269][T13363] team1: entered promiscuous mode [ 585.758835][T13365] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1930'. [ 585.777086][T13363] team1: entered allmulticast mode [ 585.793728][T13363] 8021q: adding VLAN 0 to HW filter on device team1 [ 585.874916][T13365] team2: entered promiscuous mode [ 585.886648][ T5842] usb 4-1: new high-speed USB device number 105 using dummy_hcd [ 585.886830][T13365] team2: entered allmulticast mode [ 585.917702][T13365] 8021q: adding VLAN 0 to HW filter on device team2 [ 586.026772][ T5842] usb 4-1: device descriptor read/64, error -71 [ 586.138846][ T5842] usb usb4-port1: attempt power cycle [ 586.459714][ T796] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 586.476602][ T5842] usb 4-1: new high-speed USB device number 106 using dummy_hcd [ 586.496569][ T5905] usb 3-1: new high-speed USB device number 96 using dummy_hcd [ 586.507270][ T5842] usb 4-1: device descriptor read/8, error -71 [ 586.616580][ T796] usb 7-1: Using ep0 maxpacket: 16 [ 586.624893][ T796] usb 7-1: config 0 has an invalid interface number: 1 but max is 0 [ 586.633723][ T796] usb 7-1: config 0 has no interface number 0 [ 586.645469][ T796] usb 7-1: New USB device found, idVendor=04fc, idProduct=1528, bcdDevice=6d.5d [ 586.655214][ T796] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 586.663877][ T796] usb 7-1: Product: syz [ 586.669672][ T796] usb 7-1: Manufacturer: syz [ 586.674839][ T796] usb 7-1: SerialNumber: syz [ 586.679863][ T5905] usb 3-1: unable to get BOS descriptor or descriptor too short [ 586.697826][ T5905] usb 3-1: New USB device found, idVendor=1c9e, idProduct=9603, bcdDevice=f3.0a [ 586.708528][ T796] usb 7-1: config 0 descriptor?? [ 586.720906][ T5905] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 586.733130][ T796] gspca_main: spca1528-2.14.0 probing 04fc:1528 [ 586.739716][ T5905] usb 3-1: Product: syz [ 586.744276][ T5905] usb 3-1: Manufacturer: syz [ 586.749274][ T5842] usb 4-1: new high-speed USB device number 107 using dummy_hcd [ 586.761380][ T5905] usb 3-1: SerialNumber: syz [ 586.787845][ T5842] usb 4-1: device descriptor read/8, error -71 [ 586.911271][ T5842] usb usb4-port1: unable to enumerate USB device [ 587.030336][T13373] x_tables: ip6_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 587.328611][T13383] xt_hashlimit: size too large, truncated to 1048576 [ 587.582501][T13387] syzkaller0: entered promiscuous mode [ 587.591397][T13387] syzkaller0: entered allmulticast mode [ 587.640955][ T796] gspca_spca1528: reg_w err -71 [ 587.646063][ T796] spca1528 7-1:0.1: probe with driver spca1528 failed with error -71 [ 587.681059][ T796] usb 7-1: USB disconnect, device number 2 [ 588.038001][T13396] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 588.067288][ T5913] usb 5-1: USB disconnect, device number 17 [ 588.291760][T13401] kAFS: unable to lookup cell '(' [ 588.533723][T13410] fuse: Bad value for 'fd' [ 588.547581][T13409] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1942'. [ 588.558664][T13409] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1942'. [ 588.571076][T13409] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1942'. [ 588.581184][T13409] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1942'. [ 588.798592][ T796] usb 6-1: new high-speed USB device number 33 using dummy_hcd [ 588.986773][ T796] usb 6-1: Using ep0 maxpacket: 16 [ 589.017478][ T796] usb 6-1: New USB device found, idVendor=2137, idProduct=0001, bcdDevice=2a.35 [ 589.027005][ T796] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 589.035146][ T796] usb 6-1: Product: syz [ 589.042300][ T796] usb 6-1: Manufacturer: syz [ 589.047134][ T796] usb 6-1: SerialNumber: syz [ 589.059153][ T796] usb 6-1: config 0 descriptor?? [ 589.082377][ T796] as10x_usb: device has been detected [ 589.089701][ T796] dvbdev: DVB: registering new adapter (Sky IT Digital Key (green led)) [ 589.125206][ T796] usb 6-1: DVB: registering adapter 1 frontend 0 (Sky IT Digital Key (green led))... [ 589.261825][ T5905] option 3-1:4.0: GSM modem (1-port) converter detected [ 589.359328][ T796] as10x_usb: error during firmware upload part1 [ 589.366259][ T796] Registered device Sky IT Digital Key (green led) [ 589.518284][ T5905] usb 3-1: USB disconnect, device number 96 [ 589.614577][ T5905] option 3-1:4.0: device disconnected [ 589.880133][ T8369] IPVS: starting estimator thread 0... [ 589.922324][T13422] xt_hashlimit: size too large, truncated to 1048576 [ 589.978874][T13420] IPVS: using max 28 ests per chain, 67200 per kthread [ 589.987784][ T5905] usb 3-1: new high-speed USB device number 97 using dummy_hcd [ 590.196659][ T5905] usb 3-1: Using ep0 maxpacket: 16 [ 590.218246][ T5905] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 590.357553][ T5905] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 590.429906][ T5905] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 590.537196][ T5905] usb 3-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 590.551550][ T5905] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 590.673445][ T5905] usb 3-1: config 0 descriptor?? [ 591.067483][ T5926] usb 4-1: new high-speed USB device number 108 using dummy_hcd [ 591.134929][ T5905] hid_parser_main: 4007 callbacks suppressed [ 591.134948][ T5905] microsoft 0003:045E:07DA.0032: unknown main item tag 0x0 [ 591.186102][ T5905] microsoft 0003:045E:07DA.0032: unknown main item tag 0x0 [ 591.203935][ T5905] microsoft 0003:045E:07DA.0032: unknown main item tag 0x0 [ 591.203973][ T5905] microsoft 0003:045E:07DA.0032: unknown main item tag 0x0 [ 591.204007][ T5905] microsoft 0003:045E:07DA.0032: unknown main item tag 0x0 [ 591.259593][ T5926] usb 4-1: config index 0 descriptor too short (expected 23569, got 27) [ 591.260210][ T5926] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 591.280348][ T5926] usb 4-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 591.338716][T13415] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 591.357468][T13415] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 591.369763][ T5905] microsoft 0003:045E:07DA.0032: unknown main item tag 0x0 [ 591.381340][ T5905] microsoft 0003:045E:07DA.0032: unknown main item tag 0x0 [ 591.390602][ T5905] microsoft 0003:045E:07DA.0032: unknown main item tag 0x0 [ 591.398167][ T5926] usb 4-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 591.398195][ T5926] usb 4-1: Manufacturer: syz [ 591.437137][ T5905] microsoft 0003:045E:07DA.0032: unknown main item tag 0x0 [ 591.450356][ T5905] microsoft 0003:045E:07DA.0032: unknown main item tag 0x0 [ 591.464730][ T5926] usb 4-1: config 0 descriptor?? [ 591.472775][ T5905] microsoft 0003:045E:07DA.0032: hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.2-1/input0 [ 591.526510][ T5905] microsoft 0003:045E:07DA.0032: no inputs found [ 591.560755][ T5905] microsoft 0003:045E:07DA.0032: could not initialize ff, continuing anyway [ 591.627394][ T5905] usb 3-1: USB disconnect, device number 97 [ 591.657130][ T5926] rc_core: IR keymap rc-hauppauge not found [ 591.663091][ T5926] Registered IR keymap rc-empty [ 591.705937][ T5926] rc rc0: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0 [ 591.798679][ T5926] input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0/input35 [ 591.833914][T13453] fido_id[13453]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.2/usb3/report_descriptor': No such file or directory [ 591.834514][T13445] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 592.057369][T13445] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 592.088496][T13458] x_tables: duplicate underflow at hook 2 [ 592.130666][T13458] x_tables: duplicate underflow at hook 1 [ 592.635167][ T5905] usb 6-1: USB disconnect, device number 33 [ 592.705494][ T5905] Unregistered device Sky IT Digital Key (green led) [ 592.716797][ T5905] as10x_usb: device has been disconnected [ 592.906872][ T5913] usb 5-1: new high-speed USB device number 18 using dummy_hcd [ 593.096539][ T5913] usb 5-1: Using ep0 maxpacket: 8 [ 593.207951][ T5913] usb 5-1: config index 0 descriptor too short (expected 301, got 45) [ 593.257199][ T5913] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 593.269339][ T5913] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 593.279484][ T5913] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 593.289795][ T5913] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 593.358075][T13481] netlink: 'syz.6.1960': attribute type 4 has an invalid length. [ 593.651357][T13482] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 593.667649][ T5913] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 593.703046][T13482] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 593.892892][ T5913] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 594.035203][ T5905] usb 4-1: USB disconnect, device number 108 [ 594.223409][ T5913] usb 5-1: usb_control_msg returned -32 [ 594.240425][ T5913] usbtmc 5-1:16.0: can't read capabilities [ 594.687088][T13495] rtc_cmos 00:00: Alarms can be up to one day in the future [ 594.867990][T13491] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 594.887606][T13491] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 594.922783][ T5905] usb 5-1: USB disconnect, device number 18 [ 594.945876][T13491] usbtmc 5-1:16.0: stb usb_control_msg returned -71 [ 595.092674][T13495] bridge0: port 2(bridge_slave_1) entered disabled state [ 595.100217][T13495] bridge0: port 1(bridge_slave_0) entered disabled state [ 595.366814][ T5905] usb 5-1: new high-speed USB device number 19 using dummy_hcd [ 595.412881][T13495] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 595.488573][T13495] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 595.565475][ T5905] usb 5-1: config 1 interface 0 altsetting 77 bulk endpoint 0x3 has invalid maxpacket 1024 [ 595.599685][ T5905] usb 5-1: config 1 interface 0 has no altsetting 0 [ 595.656648][ T5905] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 595.670014][ T5905] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 595.688183][ T5905] usb 5-1: Product: syz [ 595.696920][ T5905] usb 5-1: Manufacturer: syz [ 595.701572][ T5905] usb 5-1: SerialNumber: syz [ 595.730191][T10661] Bluetooth: hci0: command 0x0406 tx timeout [ 595.739019][T13468] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 596.180622][ T35] netdevsim netdevsim5 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 596.187684][ T5905] cdc_ether 5-1:1.0: probe with driver cdc_ether failed with error -71 [ 596.236938][ T5905] usb 5-1: USB disconnect, device number 19 [ 596.306086][ T35] netdevsim netdevsim5 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 596.352481][ T35] netdevsim netdevsim5 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 596.471217][ T35] netdevsim netdevsim5 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 598.063366][T13544] syzkaller0: entered promiscuous mode [ 598.080862][T13544] syzkaller0: entered allmulticast mode [ 598.846782][ T5905] usb 4-1: new high-speed USB device number 109 using dummy_hcd [ 599.107231][ T5905] usb 4-1: Using ep0 maxpacket: 8 [ 599.133542][ T5905] usb 4-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 599.146732][ T5905] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 599.165044][ T5905] usb 4-1: Product: syz [ 599.171495][ T5905] usb 4-1: Manufacturer: syz [ 599.176274][ T5905] usb 4-1: SerialNumber: syz [ 599.193887][ T5905] usb 4-1: config 0 descriptor?? [ 599.422891][ T5905] usb 4-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 599.626406][T13575] tipc: Enabled bearer , priority 0 [ 599.634084][T13575] syzkaller0: entered promiscuous mode [ 599.647280][T13575] syzkaller0: entered allmulticast mode [ 599.717487][T13575] tipc: Resetting bearer [ 599.860466][ T29] audit: type=1326 audit(1773815475.541:2002): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13576 comm="syz.4.1989" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff76599c799 code=0x7ffc0000 [ 599.940645][ T29] audit: type=1326 audit(1773815475.541:2003): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13576 comm="syz.4.1989" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff76599c799 code=0x7ffc0000 [ 599.981683][ T29] audit: type=1326 audit(1773815475.541:2004): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13576 comm="syz.4.1989" exe="/root/syz-executor" sig=0 arch=c000003e syscall=53 compat=0 ip=0x7ff76599c799 code=0x7ffc0000 [ 600.064151][ T29] audit: type=1326 audit(1773815475.541:2005): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13576 comm="syz.4.1989" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff76599c799 code=0x7ffc0000 [ 600.242428][ T29] audit: type=1326 audit(1773815475.541:2006): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13576 comm="syz.4.1989" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff76599c799 code=0x7ffc0000 [ 600.356084][ T29] audit: type=1326 audit(1773815475.611:2007): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13576 comm="syz.4.1989" exe="/root/syz-executor" sig=0 arch=c000003e syscall=42 compat=0 ip=0x7ff76599c799 code=0x7ffc0000 [ 600.787323][ T29] audit: type=1326 audit(1773815475.611:2008): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13576 comm="syz.4.1989" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff76599c799 code=0x7ffc0000 [ 600.809987][ T29] audit: type=1326 audit(1773815475.611:2009): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13576 comm="syz.4.1989" exe="/root/syz-executor" sig=0 arch=c000003e syscall=307 compat=0 ip=0x7ff76599c799 code=0x7ffc0000 [ 601.267245][ T5928] usb 3-1: new high-speed USB device number 98 using dummy_hcd [ 601.427077][ T5928] usb 3-1: Using ep0 maxpacket: 8 [ 601.435939][ T5928] usb 3-1: unable to get BOS descriptor or descriptor too short [ 601.566155][ T5905] dvb_usb_rtl28xxu 4-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 601.589559][ T5905] usb 4-1: USB disconnect, device number 109 [ 601.592981][ T5928] usb 3-1: config index 0 descriptor too short (expected 24880, got 18) [ 601.620364][ T5928] usb 3-1: config 56 has too many interfaces: 99, using maximum allowed: 32 [ 601.654463][ T5928] usb 3-1: config 56 has an invalid descriptor of length 56, skipping remainder of the config [ 601.731472][ T5928] usb 3-1: config 56 has 0 interfaces, different from the descriptor's value: 99 [ 601.799237][ T5928] usb 3-1: New USB device found, idVendor=058f, idProduct=6610, bcdDevice=48.05 [ 601.819467][ T5928] usb 3-1: New USB device strings: Mfr=2, Product=0, SerialNumber=3 [ 601.947003][ T5928] usb 3-1: Manufacturer: syz [ 601.957053][ T5928] usb 3-1: SerialNumber: syz [ 602.301559][ T5928] usb 3-1: USB disconnect, device number 98 [ 602.328036][T13574] tipc: Resetting bearer [ 602.441668][T13574] tipc: Disabling bearer [ 602.527126][ T5926] usb 4-1: new full-speed USB device number 110 using dummy_hcd [ 602.691472][ T5926] usb 4-1: unable to get BOS descriptor or descriptor too short [ 602.702787][ T5926] usb 4-1: not running at top speed; connect to a high speed hub [ 602.750189][ T5926] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 602.777100][ T5926] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 602.805130][ T5926] usb 4-1: Product: syz [ 602.823275][ T5926] usb 4-1: Manufacturer: syz [ 602.847189][ T5926] usb 4-1: SerialNumber: syz [ 603.127066][ T5926] usb 4-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 603.157373][ T5926] usb 4-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 603.303246][ T5926] usb 4-1: USB disconnect, device number 110 [ 603.444492][ T5883] udevd[5883]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 603.767091][ T8369] usb 3-1: new high-speed USB device number 99 using dummy_hcd [ 603.941185][ T8369] usb 3-1: Using ep0 maxpacket: 32 [ 603.950747][ T8369] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 603.971770][ T8369] usb 3-1: config 0 interface 0 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 0 [ 603.999405][ T8369] usb 3-1: config 0 interface 0 has no altsetting 0 [ 604.019275][ T8369] usb 3-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 604.031821][ T8369] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 604.059901][ T8369] usb 3-1: Product: syz [ 604.064185][ T8369] usb 3-1: Manufacturer: syz [ 604.087082][ T8369] usb 3-1: SerialNumber: syz [ 604.144857][ T8369] usb 3-1: config 0 descriptor?? [ 604.212598][T13627] FAULT_INJECTION: forcing a failure. [ 604.212598][T13627] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 604.243636][T13627] CPU: 1 UID: 0 PID: 13627 Comm: syz.3.2003 Tainted: G L syzkaller #0 PREEMPT(full) [ 604.243661][T13627] Tainted: [L]=SOFTLOCKUP [ 604.243668][T13627] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 604.243678][T13627] Call Trace: [ 604.243685][T13627] [ 604.243691][T13627] dump_stack_lvl+0xe8/0x150 [ 604.243718][T13627] should_fail_ex+0x412/0x560 [ 604.243746][T13627] _copy_from_user+0x2d/0xb0 [ 604.243764][T13627] ___sys_recvmsg+0x175/0x590 [ 604.243782][T13627] ? __lock_acquire+0x6b5/0x2cf0 [ 604.243805][T13627] ? __pfx____sys_recvmsg+0x10/0x10 [ 604.243848][T13627] do_recvmmsg+0x334/0x800 [ 604.243872][T13627] ? __pfx_do_recvmmsg+0x10/0x10 [ 604.243898][T13627] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 604.243927][T13627] __x64_sys_recvmmsg+0x198/0x250 [ 604.243948][T13627] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 604.243974][T13627] do_syscall_64+0x14d/0xf80 [ 604.243989][T13627] ? trace_irq_disable+0x3b/0x150 [ 604.244011][T13627] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 604.244027][T13627] ? clear_bhb_loop+0x40/0x90 [ 604.244045][T13627] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 604.244060][T13627] RIP: 0033:0x7f029a19c799 [ 604.244076][T13627] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 604.244089][T13627] RSP: 002b:00007f029b064028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 604.244105][T13627] RAX: ffffffffffffffda RBX: 00007f029a415fa0 RCX: 00007f029a19c799 [ 604.244117][T13627] RDX: 0000000000000300 RSI: 0000200000000440 RDI: 0000000000000008 [ 604.244126][T13627] RBP: 00007f029b064090 R08: 0000000000000000 R09: 0000000000000000 [ 604.244136][T13627] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 604.244145][T13627] R13: 00007f029a416038 R14: 00007f029a415fa0 R15: 00007f029a53fa48 [ 604.244167][T13627] [ 604.441049][ T5926] usb 7-1: new full-speed USB device number 3 using dummy_hcd [ 604.603221][ T5926] usb 7-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 604.614305][ T5926] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 604.623093][ T5926] usb 7-1: Product: syz [ 604.628092][ T5926] usb 7-1: Manufacturer: syz [ 604.633253][ T5926] usb 7-1: SerialNumber: syz [ 604.652636][ T796] hid_parser_main: 1 callbacks suppressed [ 604.652658][ T796] hid-generic 0000:0000:0000.0033: unknown main item tag 0x0 [ 604.654457][ T5926] usb 7-1: config 0 descriptor?? [ 604.681396][ T8369] gs_usb 3-1:0.0: Couldn't get device config: (err=-121) [ 604.691890][ T8369] gs_usb 3-1:0.0: probe with driver gs_usb failed with error -121 [ 604.706552][ T5905] usb 6-1: new high-speed USB device number 34 using dummy_hcd [ 604.730154][ T796] hid-generic 0000:0000:0000.0033: hidraw0: HID v0.00 Device [syz1] on syz0 [ 604.882253][ T5926] usb 7-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 604.896730][ T5905] usb 6-1: Using ep0 maxpacket: 16 [ 604.921196][ T5905] usb 6-1: New USB device found, idVendor=0471, idProduct=0327, bcdDevice=61.a4 [ 604.942095][ T5905] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 604.974269][ T5905] usb 6-1: config 0 descriptor?? [ 604.993897][ T5905] gspca_main: sonixj-2.14.0 probing 0471:0327 [ 605.020892][ T5928] usb 3-1: USB disconnect, device number 99 [ 605.286158][T13644] input: syz1 as /devices/virtual/input/input36 [ 605.561690][T13649] i2c i2c-0: DVB: adapter 0 frontend 0 frequency 4294967287 out of range (51000000..2150000000) [ 605.660516][ T5905] usb 6-1: USB disconnect, device number 34 [ 605.717887][T13625] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 605.745663][T13625] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 605.799654][ T5926] dvb_usb_rtl28xxu 7-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 605.850347][ T5926] usb 7-1: USB disconnect, device number 3 [ 605.867542][ T796] usb 3-1: new high-speed USB device number 100 using dummy_hcd [ 606.061471][T13666] tipc: Started in network mode [ 606.066786][ T796] usb 3-1: Using ep0 maxpacket: 16 [ 606.071494][ T796] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 606.075106][T13666] tipc: Node identity dee0437a72f1, cluster identity 4711 [ 606.084136][ T796] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x4 has invalid wMaxPacketSize 0 [ 606.092889][T13666] tipc: Enabled bearer , priority 0 [ 606.106953][ T796] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 606.135225][T13665] tipc: Disabling bearer [ 606.162468][ T796] usb 3-1: New USB device found, idVendor=04d8, idProduct=0a30, bcdDevice=ce.47 [ 606.173120][ T796] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 606.181810][ T796] usb 3-1: Product: syz [ 606.186161][ T796] usb 3-1: Manufacturer: syz [ 606.190843][ T796] usb 3-1: SerialNumber: syz [ 606.199502][ T796] usb 3-1: config 0 descriptor?? [ 606.236532][ T5905] usb 5-1: new full-speed USB device number 20 using dummy_hcd [ 606.252376][ T796] mcba_usb 3-1:0.0: Can't find endpoints [ 606.424885][T13668] bond0: option ad_user_port_key: invalid value (41938) [ 606.424917][T13668] bond0: option ad_user_port_key: allowed values 0 - 1023 [ 606.443812][ T5905] usb 5-1: New USB device found, idVendor=174f, idProduct=6a31, bcdDevice=26.3f [ 606.443837][ T5905] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 606.443853][ T5905] usb 5-1: Product: syz [ 606.443864][ T5905] usb 5-1: Manufacturer: syz [ 606.443876][ T5905] usb 5-1: SerialNumber: syz [ 606.446019][ T5905] usb 5-1: config 0 descriptor?? [ 606.455378][ T5905] gspca_main: stk1135-2.14.0 probing 174f:6a31 [ 606.465942][ T5928] usb 3-1: USB disconnect, device number 100 [ 606.473465][T13671] netlink: 388 bytes leftover after parsing attributes in process `syz.3.2012'. [ 606.476733][T13668] bond0 (unregistering): Released all slaves [ 606.886572][ T5842] usb 7-1: new low-speed USB device number 4 using dummy_hcd [ 606.967415][ T5905] gspca_stk1135: reg_w 0x2 err -110 [ 606.976864][ T5905] gspca_stk1135: serial bus timeout: status=0x00 [ 606.983337][ T5905] gspca_stk1135: Sensor write failed [ 606.997567][ T5905] gspca_stk1135: serial bus timeout: status=0x00 [ 607.004229][ T5905] gspca_stk1135: Sensor write failed [ 607.038613][ T5905] gspca_stk1135: serial bus timeout: status=0x00 [ 607.053074][ T5905] gspca_stk1135: Sensor read failed [ 607.058553][ T5842] usb 7-1: Invalid ep0 maxpacket: 32 [ 607.065555][ T5905] gspca_stk1135: serial bus timeout: status=0x00 [ 607.078781][ T5905] gspca_stk1135: Sensor read failed [ 607.090478][ T5905] gspca_stk1135: Detected sensor type unknown (0x0) [ 607.216544][ T5842] usb 7-1: new low-speed USB device number 5 using dummy_hcd [ 607.283629][ T5905] gspca_stk1135: serial bus timeout: status=0x00 [ 607.294862][ T5905] gspca_stk1135: Sensor read failed [ 607.300406][ T5905] gspca_stk1135: serial bus timeout: status=0x00 [ 607.307087][ T5905] gspca_stk1135: Sensor read failed [ 607.312473][ T5905] gspca_stk1135: serial bus timeout: status=0x00 [ 607.319237][ T5905] gspca_stk1135: Sensor write failed [ 607.324758][ T5905] gspca_stk1135: serial bus timeout: status=0x00 [ 607.333382][ T5905] gspca_stk1135: Sensor write failed [ 607.340684][ T5905] stk1135 5-1:0.0: probe with driver stk1135 failed with error -110 [ 607.427447][ T5842] usb 7-1: Invalid ep0 maxpacket: 32 [ 607.448280][ T5842] usb usb7-port1: attempt power cycle [ 607.503922][T13682] hsr_slave_0: left promiscuous mode [ 607.518869][T13682] hsr_slave_1: left promiscuous mode [ 607.836951][ T5842] usb 7-1: new low-speed USB device number 6 using dummy_hcd [ 607.886279][T13687] FAULT_INJECTION: forcing a failure. [ 607.886279][T13687] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 607.909753][T13687] CPU: 1 UID: 0 PID: 13687 Comm: syz.2.2016 Tainted: G L syzkaller #0 PREEMPT(full) [ 607.909787][T13687] Tainted: [L]=SOFTLOCKUP [ 607.909796][T13687] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 607.909808][T13687] Call Trace: [ 607.909817][T13687] [ 607.909826][T13687] dump_stack_lvl+0xe8/0x150 [ 607.909866][T13687] should_fail_ex+0x412/0x560 [ 607.909892][T13687] _copy_from_user+0x2d/0xb0 [ 607.909930][T13687] ___sys_recvmsg+0x175/0x590 [ 607.909956][T13687] ? __lock_acquire+0x6b5/0x2cf0 [ 607.909987][T13687] ? __pfx____sys_recvmsg+0x10/0x10 [ 607.910042][T13687] do_recvmmsg+0x334/0x800 [ 607.910066][T13687] ? __pfx_do_recvmmsg+0x10/0x10 [ 607.910114][T13687] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 607.910155][T13687] __x64_sys_recvmmsg+0x198/0x250 [ 607.910185][T13687] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 607.910216][T13687] do_syscall_64+0x14d/0xf80 [ 607.910247][T13687] ? trace_irq_disable+0x3b/0x150 [ 607.910277][T13687] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 607.910304][T13687] ? clear_bhb_loop+0x40/0x90 [ 607.910333][T13687] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 607.910349][T13687] RIP: 0033:0x7f7652f9c799 [ 607.910379][T13687] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 607.910398][T13687] RSP: 002b:00007f7653e18028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 607.910426][T13687] RAX: ffffffffffffffda RBX: 00007f7653215fa0 RCX: 00007f7652f9c799 [ 607.910441][T13687] RDX: 0000000000000300 RSI: 0000200000000440 RDI: 0000000000000008 [ 607.910454][T13687] RBP: 00007f7653e18090 R08: 0000000000000000 R09: 0000000000000000 [ 607.910467][T13687] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 607.910478][T13687] R13: 00007f7653216038 R14: 00007f7653215fa0 R15: 00007f765333fa48 [ 607.910531][T13687] [ 607.915232][ T5842] usb 7-1: Invalid ep0 maxpacket: 32 [ 608.266581][ T5842] usb 7-1: new low-speed USB device number 7 using dummy_hcd [ 608.297808][ T5842] usb 7-1: Invalid ep0 maxpacket: 32 [ 608.309088][ T5842] usb usb7-port1: unable to enumerate USB device [ 608.356670][T13692] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2018'. [ 608.956735][ T5842] usb 3-1: new high-speed USB device number 101 using dummy_hcd [ 609.140612][ T5842] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 609.149838][ T5842] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 609.163189][ T5842] usb 3-1: Product: syz [ 609.182181][ T5842] usb 3-1: Manufacturer: syz [ 609.223962][ T5842] usb 3-1: SerialNumber: syz [ 609.290058][ T5842] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 609.309314][ T5913] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 609.689774][ T24] usb 5-1: USB disconnect, device number 20 [ 610.350431][T13699] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 610.365758][T13699] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 610.374609][ T5913] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 610.383716][ T5913] ath9k_htc: Failed to initialize the device [ 610.415879][T13699] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 610.431612][T13699] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 610.448412][ T5913] usb 3-1: ath9k_htc: USB layer deinitialized [ 610.508522][ T24] usb 4-1: new high-speed USB device number 111 using dummy_hcd [ 610.577301][ T5926] usb 6-1: new high-speed USB device number 35 using dummy_hcd [ 610.667031][ T24] usb 4-1: Using ep0 maxpacket: 16 [ 610.690674][ T24] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 610.721606][ T5926] usb 6-1: device descriptor read/64, error -71 [ 610.767232][T13733] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2030'. [ 610.807203][ T24] usb 4-1: New USB device found, idVendor=054c, idProduct=024b, bcdDevice= 0.00 [ 610.837023][ T24] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 610.869798][ T24] usb 4-1: config 0 descriptor?? [ 611.025015][T13738] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 611.067081][ T5926] usb 6-1: new high-speed USB device number 36 using dummy_hcd [ 611.087571][T13738] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 611.118570][T13738] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 611.139026][T13738] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 611.207115][ T5926] usb 6-1: device descriptor read/64, error -71 [ 611.315360][ T24] sony 0003:054C:024B.0034: unknown main item tag 0x0 [ 611.327357][ T5926] usb usb6-port1: attempt power cycle [ 611.339400][ T24] sony 0003:054C:024B.0034: unknown main item tag 0x0 [ 611.346269][ T24] sony 0003:054C:024B.0034: unknown main item tag 0x0 [ 611.367120][ T24] sony 0003:054C:024B.0034: unknown main item tag 0x0 [ 611.373989][ T24] sony 0003:054C:024B.0034: unknown main item tag 0x0 [ 611.397095][ T24] sony 0003:054C:024B.0034: unknown main item tag 0x0 [ 611.403950][ T24] sony 0003:054C:024B.0034: unknown main item tag 0x0 [ 611.428270][ T24] sony 0003:054C:024B.0034: unknown main item tag 0x0 [ 611.442138][ T24] sony 0003:054C:024B.0034: unknown main item tag 0x0 [ 611.457973][ T24] sony 0003:054C:024B.0034: unknown main item tag 0x0 [ 611.495000][ T24] sony 0003:054C:024B.0034: hiddev0,hidraw0: USB HID v0.08 Device [HID 054c:024b] on usb-dummy_hcd.3-1/input0 [ 611.513281][T13723] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 611.541017][T13723] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 611.557042][ T24] sony 0003:054C:024B.0034: failed to claim input [ 611.697233][ T5926] usb 6-1: new high-speed USB device number 37 using dummy_hcd [ 611.737754][ T5926] usb 6-1: device descriptor read/8, error -71 [ 611.765599][ T24] usb 4-1: USB disconnect, device number 111 [ 611.978900][ T5926] usb 6-1: new high-speed USB device number 38 using dummy_hcd [ 612.017971][ T5926] usb 6-1: device descriptor read/8, error -71 [ 612.127968][ T5926] usb usb6-port1: unable to enumerate USB device [ 612.165036][T13756] syzkaller0: entered promiscuous mode [ 612.171407][T13756] syzkaller0: entered allmulticast mode [ 612.575362][ T5926] usb 3-1: USB disconnect, device number 101 [ 612.621812][ T29] audit: type=1326 audit(1773815488.291:2010): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13764 comm="syz.3.2038" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f029a19c799 code=0x0 [ 612.751319][T13771] tipc: Enabled bearer , priority 0 [ 612.940169][T13771] tipc: Disabling bearer [ 613.417526][ T24] ip6_tunnel: ip6gretap0 xmit: Routing loop! Remote address found on this node! [ 613.837161][ T5926] usb 4-1: new high-speed USB device number 112 using dummy_hcd [ 613.915110][T13802] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2049'. [ 614.007253][ T5926] usb 4-1: Using ep0 maxpacket: 32 [ 614.023322][ T5926] usb 4-1: config index 0 descriptor too short (expected 35577, got 27) [ 614.038448][ T5926] usb 4-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 614.048004][ T24] ip6_tunnel: ip6gretap0 xmit: Routing loop! Remote address found on this node! [ 614.069495][ T5926] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 614.090686][ T5926] usb 4-1: config 1 has no interface number 0 [ 614.099318][ T5926] usb 4-1: config 1 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 614.110996][ T5926] usb 4-1: config 1 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 33028, setting to 1024 [ 614.123379][ T5926] usb 4-1: config 1 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 614.128475][ T5842] usb 3-1: new full-speed USB device number 102 using dummy_hcd [ 614.143681][ T5926] usb 4-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 614.155099][ T5926] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 614.183262][ T5926] snd_usb_pod 4-1:1.1: Line 6 Pocket POD found [ 614.317613][ T5842] usb 3-1: device descriptor read/64, error -71 [ 614.418425][ T5926] snd_usb_pod 4-1:1.1: Line 6 Pocket POD now attached [ 614.556550][ T5842] usb 3-1: new full-speed USB device number 103 using dummy_hcd [ 614.804851][ T5905] usb 5-1: new high-speed USB device number 21 using dummy_hcd [ 614.817114][ T5842] usb 3-1: device descriptor read/64, error -71 [ 614.912848][T13819] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 614.927375][ T5926] usb 4-1: USB disconnect, device number 112 [ 614.940772][ T5926] snd_usb_pod 4-1:1.1: Line 6 Pocket POD now disconnected [ 614.976037][T13819] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 615.016890][ T5842] usb usb3-port1: attempt power cycle [ 615.073198][ T5905] usb 5-1: Using ep0 maxpacket: 32 [ 615.081666][ T5905] usb 5-1: config 0 has an invalid interface number: 89 but max is 0 [ 615.095416][ T5905] usb 5-1: config 0 has no interface number 0 [ 615.104470][ T5905] usb 5-1: config 0 interface 89 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 615.115581][ T5905] usb 5-1: config 0 interface 89 has no altsetting 0 [ 615.125529][ T5905] usb 5-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4a [ 615.135207][ T5905] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 615.143467][ T5905] usb 5-1: Product: syz [ 615.148216][ T5928] usb 6-1: new full-speed USB device number 39 using dummy_hcd [ 615.156265][ T5905] usb 5-1: Manufacturer: syz [ 615.161866][ T5905] usb 5-1: SerialNumber: syz [ 615.174329][ T5905] usb 5-1: config 0 descriptor?? [ 615.188333][ T5905] em28xx 5-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 615.199719][ T5905] em28xx 5-1:0.89: Video interface 89 found: [ 615.312750][ T5928] usb 6-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 615.323737][ T5928] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 615.340473][ T5928] usb 6-1: Product: syz [ 615.349310][ T5928] usb 6-1: Manufacturer: syz [ 615.356609][ T5842] usb 3-1: new full-speed USB device number 104 using dummy_hcd [ 615.358571][ T5928] usb 6-1: SerialNumber: syz [ 615.429845][ T5928] usb 6-1: config 0 descriptor?? [ 615.451651][ T5842] usb 3-1: device descriptor read/8, error -71 [ 615.696586][ T5842] usb 3-1: new full-speed USB device number 105 using dummy_hcd [ 615.727479][ T5842] usb 3-1: device descriptor read/8, error -71 [ 615.882213][ T5842] usb usb3-port1: unable to enumerate USB device [ 615.936238][ T5905] em28xx 5-1:0.89: unknown em28xx chip ID (0) [ 616.159684][ T5928] dvb_usb_rtl28xxu 6-1:0.0: chip type detection failed -71 [ 616.167678][ T5928] dvb_usb_rtl28xxu 6-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 616.200237][ T5928] usb 6-1: USB disconnect, device number 39 [ 616.236879][ T5913] usb 7-1: new high-speed USB device number 8 using dummy_hcd [ 616.430747][ T5913] usb 7-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.00 [ 616.703636][ T5913] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 616.721675][ T5913] usb 7-1: Product: syz [ 616.736077][ T5913] usb 7-1: Manufacturer: syz [ 616.741309][ T5913] usb 7-1: SerialNumber: syz [ 616.928683][ T5928] usb 6-1: new high-speed USB device number 40 using dummy_hcd [ 617.336577][ T796] usb 4-1: new high-speed USB device number 113 using dummy_hcd [ 617.337736][ T5928] usb 6-1: Using ep0 maxpacket: 32 [ 617.353398][ T5928] usb 6-1: config 9 has an invalid interface number: 167 but max is 2 [ 617.365072][ T5928] usb 6-1: config 9 has an invalid interface number: 181 but max is 2 [ 617.374718][ T5928] usb 6-1: config 9 contains an unexpected descriptor of type 0x1, skipping [ 617.422632][ T5928] usb 6-1: config 9 contains an unexpected descriptor of type 0x1, skipping [ 617.465474][T13830] netlink: 'syz.6.2056': attribute type 29 has an invalid length. [ 617.473536][ T5928] usb 6-1: config 9 has an invalid descriptor of length 195, skipping remainder of the config [ 617.518980][ T796] usb 4-1: Using ep0 maxpacket: 8 [ 617.529198][ T5928] usb 6-1: config 9 has 2 interfaces, different from the descriptor's value: 3 [ 617.531061][ T796] usb 4-1: config 179 has an invalid interface number: 65 but max is 0 [ 617.581898][ T796] usb 4-1: config 179 has no interface number 0 [ 617.615373][ T796] usb 4-1: config 179 interface 65 altsetting 12 endpoint 0xF has an invalid bInterval 63, changing to 9 [ 617.629570][ T796] usb 4-1: config 179 interface 65 altsetting 12 endpoint 0xF has invalid maxpacket 57605, setting to 1024 [ 617.642940][ T5928] usb 6-1: config 9 has no interface number 0 [ 617.664734][ T5913] rtl8150 7-1:1.0: couldn't reset the device [ 617.671263][ T5913] rtl8150 7-1:1.0: probe with driver rtl8150 failed with error -5 [ 617.681330][ T796] usb 4-1: config 179 interface 65 altsetting 12 endpoint 0x83 has invalid wMaxPacketSize 0 [ 617.704508][ T5928] usb 6-1: config 9 has no interface number 1 [ 617.724931][ T5928] usb 6-1: config 9 interface 167 altsetting 7 endpoint 0xC has invalid maxpacket 512, setting to 64 [ 617.726627][ T796] usb 4-1: config 179 interface 65 altsetting 12 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 617.754753][ T5913] usb 7-1: USB disconnect, device number 8 [ 617.764384][ T5928] usb 6-1: config 9 interface 167 altsetting 7 endpoint 0xE has invalid maxpacket 512, setting to 64 [ 617.777884][ T5905] em28xx 5-1:0.89: reading from i2c device at 0xa0 failed (error=-5) [ 617.782488][ T5928] usb 6-1: config 9 interface 167 altsetting 7 endpoint 0x7 has invalid maxpacket 447, setting to 64 [ 617.799775][ T5928] usb 6-1: config 9 interface 167 altsetting 7 endpoint 0xB has invalid maxpacket 1088, setting to 64 [ 617.800958][ T5905] em28xx 5-1:0.89: board has no eeprom [ 617.822547][ T5928] usb 6-1: config 9 interface 167 altsetting 7 endpoint 0xF has invalid maxpacket 1024, setting to 64 [ 617.836074][ T5928] usb 6-1: config 9 interface 167 altsetting 7 has an invalid descriptor for endpoint zero, skipping [ 617.858346][ T796] usb 4-1: config 179 interface 65 has no altsetting 0 [ 617.870326][ T5928] usb 6-1: config 9 interface 167 altsetting 7 endpoint 0x8 has invalid maxpacket 512, setting to 64 [ 617.883337][ T5928] usb 6-1: config 9 interface 167 altsetting 7 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 617.896056][ T796] usb 4-1: New USB device found, idVendor=12ab, idProduct=0004, bcdDevice= 0.00 [ 617.896087][ T796] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 617.913654][ T5928] usb 6-1: config 9 interface 167 altsetting 7 endpoint 0x86 has an invalid bInterval 71, changing to 7 [ 617.913706][ T5928] usb 6-1: config 9 interface 167 altsetting 7 endpoint 0x86 has invalid maxpacket 34766, setting to 1024 [ 617.913737][ T5928] usb 6-1: config 9 interface 167 altsetting 7 has a duplicate endpoint with address 0x4, skipping [ 617.956076][ T5928] usb 6-1: config 9 interface 167 altsetting 7 has an invalid descriptor for endpoint zero, skipping [ 617.976694][ T5905] em28xx 5-1:0.89: Identified as Terratec Grabby (card=67) [ 617.985061][ T5905] em28xx 5-1:0.89: analog set to bulk mode. [ 617.992703][ T5842] em28xx 5-1:0.89: Registering V4L2 extension [ 618.003317][ T5928] usb 6-1: config 9 interface 167 altsetting 7 endpoint 0x6 has an invalid bInterval 72, changing to 10 [ 618.092223][ T5928] usb 6-1: config 9 interface 167 altsetting 7 has 14 endpoint descriptors, different from the interface descriptor's value: 13 [ 618.182909][ T5928] usb 6-1: too many endpoints for config 9 interface 181 altsetting 112: 175, using maximum allowed: 30 [ 618.197188][ T5842] em28xx 5-1:0.89: reading from i2c device at 0x4a failed (error=-5) [ 618.229167][ T5842] em28xx 5-1:0.89: reading from i2c device at 0x48 failed (error=-5) [ 618.321517][ T5842] em28xx 5-1:0.89: reading from i2c device at 0x42 failed (error=-5) [ 618.356992][ T5842] em28xx 5-1:0.89: reading from i2c device at 0x40 failed (error=-5) [ 618.445404][ T796] usb 5-1: USB disconnect, device number 21 [ 618.463379][ T796] em28xx 5-1:0.89: Disconnecting em28xx [ 618.490358][ T5842] em28xx 5-1:0.89: Config register raw data: 0xffffffed [ 618.514600][ T5842] em28xx 5-1:0.89: AC97 chip type couldn't be determined [ 618.532349][ T5842] em28xx 5-1:0.89: No AC97 audio processor [ 618.547613][ T5928] usb 6-1: config 9 interface 181 altsetting 112 has a duplicate endpoint with address 0xE, skipping [ 618.569080][ T5842] usb 5-1: Decoder not found [ 618.580021][T13852] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2062'. [ 618.608225][ T5842] em28xx 5-1:0.89: failed to create media graph [ 618.629723][ T5928] usb 6-1: config 9 interface 181 altsetting 112 has a duplicate endpoint with address 0xC, skipping [ 618.653762][T13852] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2062'. [ 618.682815][ T5842] em28xx 5-1:0.89: V4L2 device video103 deregistered [ 618.682815][ T5928] usb 6-1: config 9 interface 181 altsetting 112 has an invalid descriptor for endpoint zero, skipping [ 618.682849][ T5928] usb 6-1: config 9 interface 181 altsetting 112 endpoint 0x9 has invalid maxpacket 1024, setting to 64 [ 618.766148][T13852] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2062'. [ 618.791541][T13852] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2062'. [ 618.802261][T13852] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2062'. [ 618.823296][T13852] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2062'. [ 618.833508][ T5928] usb 6-1: config 9 interface 181 altsetting 112 has 4 endpoint descriptors, different from the interface descriptor's value: 175 [ 618.866970][ T5928] usb 6-1: config 9 interface 167 has no altsetting 0 [ 618.887248][ T5928] usb 6-1: config 9 interface 181 has no altsetting 0 [ 618.910472][ T5928] usb 6-1: New USB device found, idVendor=12d1, idProduct=c195, bcdDevice=c2.2e [ 618.913635][ T5842] em28xx 5-1:0.89: Registering snapshot button... [ 618.922428][T13854] ================================================================== [ 618.934390][T13854] BUG: KASAN: slab-use-after-free in v4l2_fh_open+0xac/0x420 [ 618.942101][T13854] Read of size 8 at addr ffff888033424748 by task v4l_id/13854 [ 618.949778][T13854] [ 618.952195][T13854] CPU: 1 UID: 0 PID: 13854 Comm: v4l_id Tainted: G L syzkaller #0 PREEMPT(full) [ 618.952218][T13854] Tainted: [L]=SOFTLOCKUP [ 618.952224][T13854] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 618.952234][T13854] Call Trace: [ 618.952241][T13854] [ 618.952247][T13854] dump_stack_lvl+0xe8/0x150 [ 618.952272][T13854] print_report+0xba/0x230 [ 618.952309][T13854] ? v4l2_fh_open+0xac/0x420 [ 618.952327][T13854] kasan_report+0x117/0x150 [ 618.952348][T13854] ? v4l2_fh_open+0xac/0x420 [ 618.952369][T13854] v4l2_fh_open+0xac/0x420 [ 618.952387][T13854] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 618.952407][T13854] em28xx_v4l2_open+0x157/0x9a0 [ 618.952472][T13854] ? do_raw_spin_lock+0x12b/0x2f0 [ 618.952491][T13854] v4l2_open+0x1bf/0x3a0 [ 618.952529][T13854] chrdev_open+0x4cd/0x5e0 [ 618.952549][T13854] ? __pfx_chrdev_open+0x10/0x10 [ 618.952566][T13854] ? fsnotify_open_perm_and_set_mode+0x135/0x6d0 [ 618.952588][T13854] ? __pfx_chrdev_open+0x10/0x10 [ 618.952605][T13854] do_dentry_open+0x785/0x14e0 [ 618.952631][T13854] vfs_open+0x3b/0x340 [ 618.952683][T13854] ? path_openat+0x2df0/0x3860 [ 618.952707][T13854] path_openat+0x2e08/0x3860 [ 618.952736][T13854] ? __pfx_stack_trace_save+0x10/0x10 [ 618.952767][T13854] ? stack_depot_save_flags+0x33/0x810 [ 618.952817][T13854] ? __pfx_path_openat+0x10/0x10 [ 618.952831][T13854] ? __x64_sys_openat+0x138/0x170 [ 618.952851][T13854] ? do_syscall_64+0x14d/0xf80 [ 618.952867][T13854] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 618.952885][T13854] ? __lock_acquire+0x6b5/0x2cf0 [ 618.952906][T13854] do_file_open+0x23e/0x4a0 [ 618.952924][T13854] ? __pfx_do_file_open+0x10/0x10 [ 618.952947][T13854] ? _raw_spin_unlock+0x28/0x50 [ 618.952968][T13854] ? alloc_fd+0x64b/0x6c0 [ 618.952992][T13854] do_sys_openat2+0x113/0x200 [ 618.953014][T13854] ? __pfx_do_sys_openat2+0x10/0x10 [ 618.953035][T13854] ? exc_page_fault+0x6a/0xc0 [ 618.953051][T13854] ? do_user_addr_fault+0xc6f/0x1340 [ 618.953083][T13854] __x64_sys_openat+0x138/0x170 [ 618.953106][T13854] do_syscall_64+0x14d/0xf80 [ 618.953121][T13854] ? trace_irq_disable+0x3b/0x150 [ 618.953143][T13854] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 618.953158][T13854] ? clear_bhb_loop+0x40/0x90 [ 618.953176][T13854] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 618.953191][T13854] RIP: 0033:0x7f8db9aa7407 [ 618.953205][T13854] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 618.953218][T13854] RSP: 002b:00007ffc54fdfc70 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 618.953234][T13854] RAX: ffffffffffffffda RBX: 00007f8dba1af880 RCX: 00007f8db9aa7407 [ 618.953246][T13854] RDX: 0000000000000000 RSI: 00007ffc54fe0f1c RDI: ffffffffffffff9c [ 618.953257][T13854] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 [ 618.953266][T13854] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 618.953275][T13854] R13: 00007ffc54fdfec0 R14: 00007f8dba316000 R15: 0000563033d0d4d8 [ 618.953292][T13854] [ 618.953298][T13854] [ 619.254652][T13854] Allocated by task 5842: [ 619.259088][T13854] kasan_save_track+0x3e/0x80 [ 619.263778][T13854] __kasan_kmalloc+0x93/0xb0 [ 619.268392][T13854] __kmalloc_cache_noprof+0x31c/0x660 [ 619.273778][T13854] em28xx_v4l2_init+0x10b/0x2e70 [ 619.278855][T13854] em28xx_init_extension+0x120/0x1c0 [ 619.284180][T13854] process_scheduled_works+0xb6e/0x18c0 [ 619.289757][T13854] worker_thread+0xa53/0xfc0 [ 619.294350][T13854] kthread+0x388/0x470 [ 619.298430][T13854] ret_from_fork+0x51e/0xb90 [ 619.303030][T13854] ret_from_fork_asm+0x1a/0x30 [ 619.307819][T13854] [ 619.310251][T13854] Freed by task 5842: [ 619.314243][T13854] kasan_save_track+0x3e/0x80 [ 619.319287][T13854] kasan_save_free_info+0x46/0x50 [ 619.324394][T13854] __kasan_slab_free+0x5c/0x80 [ 619.329163][T13854] kfree+0x1c1/0x630 [ 619.333301][T13854] em28xx_v4l2_init+0x1683/0x2e70 [ 619.338365][T13854] em28xx_init_extension+0x120/0x1c0 [ 619.343692][T13854] process_scheduled_works+0xb6e/0x18c0 [ 619.349248][T13854] worker_thread+0xa53/0xfc0 [ 619.353848][T13854] kthread+0x388/0x470 [ 619.357929][T13854] ret_from_fork+0x51e/0xb90 [ 619.362534][T13854] ret_from_fork_asm+0x1a/0x30 [ 619.367312][T13854] [ 619.369652][T13854] The buggy address belongs to the object at ffff888033424000 [ 619.369652][T13854] which belongs to the cache kmalloc-8k of size 8192 [ 619.383715][T13854] The buggy address is located 1864 bytes inside of [ 619.383715][T13854] freed 8192-byte region [ffff888033424000, ffff888033426000) [ 619.397785][T13854] [ 619.400119][T13854] The buggy address belongs to the physical page: [ 619.406568][T13854] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x33420 [ 619.415504][T13854] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 619.424037][T13854] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 619.431775][T13854] page_type: f5(slab) [ 619.435779][T13854] raw: 00fff00000000040 ffff88813fea6280 dead000000000100 dead000000000122 [ 619.444631][T13854] raw: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 619.453222][T13854] head: 00fff00000000040 ffff88813fea6280 dead000000000100 dead000000000122 [ 619.461980][T13854] head: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 619.470668][T13854] head: 00fff00000000003 ffffea0000cd0801 00000000ffffffff 00000000ffffffff [ 619.479343][T13854] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 619.488013][T13854] page dumped because: kasan: bad access detected [ 619.494866][T13854] page_owner tracks the page as allocated [ 619.500576][T13854] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd28c0(GFP_NOWAIT|__GFP_IO|__GFP_FS|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 11615, tgid 11609 (syz.2.1550), ts 467315615903, free_ts 466158395446 [ 619.521941][T13854] post_alloc_hook+0x231/0x280 [ 619.526750][T13854] get_page_from_freelist+0x24dc/0x2580 [ 619.532400][T13854] __alloc_frozen_pages_noprof+0x18d/0x380 [ 619.539100][T13854] allocate_slab+0x77/0x660 [ 619.543607][T13854] refill_objects+0x331/0x3c0 [ 619.548304][T13854] __pcs_replace_empty_main+0x2e6/0x730 [ 619.553857][T13854] __kvmalloc_node_noprof+0x657/0x8a0 [ 619.559238][T13854] kvm_dev_ioctl_get_cpuid+0x224/0x7d0 [ 619.564725][T13854] kvm_arch_dev_ioctl+0x405/0x9e0 [ 619.569761][T13854] kvm_dev_ioctl+0x59e/0x1590 [ 619.574442][T13854] __se_sys_ioctl+0xfc/0x170 [ 619.579035][T13854] do_syscall_64+0x14d/0xf80 [ 619.583677][T13854] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 619.589610][T13854] page last free pid 11599 tgid 11599 stack trace: [ 619.596126][T13854] __free_frozen_pages+0xc2b/0xdb0 [ 619.601247][T13854] __slab_free+0x263/0x2b0 [ 619.605662][T13854] qlist_free_all+0x97/0x100 [ 619.610271][T13854] kasan_quarantine_reduce+0x148/0x160 [ 619.615818][T13854] __kasan_slab_alloc+0x22/0x80 [ 619.620674][T13854] kmem_cache_alloc_lru_noprof+0x2b8/0x640 [ 619.626496][T13854] shmem_alloc_inode+0x28/0x40 [ 619.631299][T13854] alloc_inode+0x6a/0x1b0 [ 619.635638][T13854] new_inode+0x22/0x170 [ 619.639809][T13854] shmem_get_inode+0x347/0xe60 [ 619.644577][T13854] shmem_symlink+0xa3/0x470 [ 619.649085][T13854] vfs_symlink+0x195/0x340 [ 619.653508][T13854] filename_symlinkat+0x1cd/0x410 [ 619.658537][T13854] __se_sys_symlinkat+0x4e/0x2b0 [ 619.663475][T13854] do_syscall_64+0x14d/0xf80 [ 619.668068][T13854] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 619.673962][T13854] [ 619.676285][T13854] Memory state around the buggy address: [ 619.681998][T13854] ffff888033424600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 619.690060][T13854] ffff888033424680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 619.698189][T13854] >ffff888033424700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 619.706258][T13854] ^ [ 619.712685][T13854] ffff888033424780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 619.720771][T13854] ffff888033424800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 619.728831][T13854] ================================================================== [ 619.746870][ T5928] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 619.765075][ T5928] usb 6-1: Product: 쏫䗡哝颉鴌摥⽂崜⥼ꊇ걹剙૜듰같奛〄ಔ礱炜힟峹ꩁ䥚 [ 619.785664][ T5928] usb 6-1: SerialNumber: Ќ [ 619.885448][T13852] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2062'. [ 619.898778][T13852] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2062'. [ 619.930632][ T5842] input: em28xx snapshot button as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.89/input/input37 [ 619.948483][T13852] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2062'. [ 619.981215][ T5842] em28xx 5-1:0.89: Remote control support is not available for this card. [ 619.990947][ T796] em28xx 5-1:0.89: Closing input extension [ 620.007565][T13852] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2062'. [ 620.018667][ T796] em28xx 5-1:0.89: Deregistering snapshot button [ 620.031684][ T5928] usb 6-1: can't set config #9, error -71 [ 620.042385][ T5928] usb 6-1: USB disconnect, device number 40 [ 620.050056][T13854] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 620.057312][T13854] CPU: 1 UID: 0 PID: 13854 Comm: v4l_id Tainted: G L syzkaller #0 PREEMPT(full) [ 620.067906][T13854] Tainted: [L]=SOFTLOCKUP [ 620.072230][T13854] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 620.082283][T13854] Call Trace: [ 620.085564][T13854] [ 620.088497][T13854] vpanic+0x56c/0xa60 [ 620.092496][T13854] ? __pfx_vpanic+0x10/0x10 [ 620.097034][T13854] panic+0xc5/0xd0 [ 620.100808][T13854] ? __pfx_panic+0x10/0x10 [ 620.105230][T13854] ? preempt_schedule_thunk+0x16/0x30 [ 620.110640][T13854] ? preempt_schedule_thunk+0x16/0x30 [ 620.116056][T13854] ? v4l2_fh_open+0xac/0x420 [ 620.120665][T13854] check_panic_on_warn+0x89/0xb0 [ 620.125713][T13854] ? v4l2_fh_open+0xac/0x420 [ 620.130328][T13854] end_report+0x73/0x180 [ 620.134596][T13854] ? v4l2_fh_open+0xac/0x420 [ 620.139203][T13854] kasan_report+0x128/0x150 [ 620.143728][T13854] ? v4l2_fh_open+0xac/0x420 [ 620.148338][T13854] v4l2_fh_open+0xac/0x420 [ 620.152775][T13854] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 620.158772][T13854] em28xx_v4l2_open+0x157/0x9a0 [ 620.163643][T13854] ? do_raw_spin_lock+0x12b/0x2f0 [ 620.168686][T13854] v4l2_open+0x1bf/0x3a0 [ 620.172957][T13854] chrdev_open+0x4cd/0x5e0 [ 620.177420][T13854] ? __pfx_chrdev_open+0x10/0x10 [ 620.182380][T13854] ? fsnotify_open_perm_and_set_mode+0x135/0x6d0 [ 620.188728][T13854] ? __pfx_chrdev_open+0x10/0x10 [ 620.193681][T13854] do_dentry_open+0x785/0x14e0 [ 620.198562][T13854] vfs_open+0x3b/0x340 [ 620.202664][T13854] ? path_openat+0x2df0/0x3860 [ 620.207456][T13854] path_openat+0x2e08/0x3860 [ 620.212073][T13854] ? __pfx_stack_trace_save+0x10/0x10 [ 620.217465][T13854] ? stack_depot_save_flags+0x33/0x810 [ 620.222947][T13854] ? __pfx_path_openat+0x10/0x10 [ 620.227901][T13854] ? __x64_sys_openat+0x138/0x170 [ 620.232949][T13854] ? do_syscall_64+0x14d/0xf80 [ 620.237738][T13854] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 620.243820][T13854] ? __lock_acquire+0x6b5/0x2cf0 [ 620.248783][T13854] do_file_open+0x23e/0x4a0 [ 620.253391][T13854] ? __pfx_do_file_open+0x10/0x10 [ 620.258438][T13854] ? _raw_spin_unlock+0x28/0x50 [ 620.263320][T13854] ? alloc_fd+0x64b/0x6c0 [ 620.267673][T13854] do_sys_openat2+0x113/0x200 [ 620.272377][T13854] ? __pfx_do_sys_openat2+0x10/0x10 [ 620.277600][T13854] ? exc_page_fault+0x6a/0xc0 [ 620.282387][T13854] ? do_user_addr_fault+0xc6f/0x1340 [ 620.287691][T13854] __x64_sys_openat+0x138/0x170 [ 620.292568][T13854] do_syscall_64+0x14d/0xf80 [ 620.297185][T13854] ? trace_irq_disable+0x3b/0x150 [ 620.302241][T13854] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 620.308323][T13854] ? clear_bhb_loop+0x40/0x90 [ 620.313022][T13854] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 620.318929][T13854] RIP: 0033:0x7f8db9aa7407 [ 620.323357][T13854] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 620.343060][T13854] RSP: 002b:00007ffc54fdfc70 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 620.351490][T13854] RAX: ffffffffffffffda RBX: 00007f8dba1af880 RCX: 00007f8db9aa7407 [ 620.359477][T13854] RDX: 0000000000000000 RSI: 00007ffc54fe0f1c RDI: ffffffffffffff9c [ 620.367466][T13854] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 [ 620.375450][T13854] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 620.383437][T13854] R13: 00007ffc54fdfec0 R14: 00007f8dba316000 R15: 0000563033d0d4d8 [ 620.391434][T13854] [ 620.395082][T13854] Kernel Offset: disabled [ 620.399407][T13854] Rebooting in 86400 seconds..