last executing test programs: 8.237403163s ago: executing program 0 (id=2127): madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xd, 0x4, &(0x7f00000000c0)=ANY=[@ANYBLOB="b400000000000000dd0a00000000000278735188b7cebb63000100950000000000000046d7761b25ac860f0f657d14d7a263b0dcc17f5558a62ceb4e3318f17e6bde7cb4b1c92cda17965abd7a3193afdab1d0d065756d63c1ba875072dcc564c47a90c7e61637b539a402fac528bc87fed2b6b89050a299"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sock_ops, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x3}, 0x8}, 0x94) syz_emit_vhci(&(0x7f0000000440)=ANY=[], 0x7) r0 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x1, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f0000000780)={{0x8, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x4, 0x0, 0x40000000000, 0xffffffffffffffff, 0xffffffeffffffffe, 0x0, 0x4, 0x0, 0x7, 0x4, 0x0, 0x0, 0xfffffeffbfffffff, 0x0, 0x0, 0x0, 0x3, 0x80000000, 0x3, 0x0, 0x0, 0x4, 0x0, 0x6, 0x1, 0x40, 0x0, 0xfffffffffffffffd, 0x100200000, 0xb, 0x6, 0x0, 0x0, 0x0, 0x9, 0x0, 0x10000, 0x3000, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffdfffffffff, 0xfb8c, 0x3, 0x0, 0x7, 0x10000, 0x7785, 0x0, 0x4, 0x4, 0x8, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x80000002000, 0x0, 0x4, 0x0, 0xfffffffffffffffe, 0x0, 0x9, 0x0, 0xfffffffffffffffe, 0x9, 0x1000000000, 0x0, 0x80000000000002, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x2c5, 0x0, 0x100, 0x81, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x9, 0x100000000000, 0x4000000000, 0x3, 0x2, 0x0, 0x7, 0xc0c0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0xffffffffffeffffc, 0x0, 0x1, 0x2000000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000, 0x0, 0x80]}) r1 = socket$alg(0x26, 0x5, 0x0) r2 = syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_control_io(r2, &(0x7f0000000340)={0x2c, &(0x7f0000000080)={0x40, 0xd, 0x23, {0x23, 0x3, "28ef06630ac0ac25b0a751593c2a62105617e173e0c1956147eaa57a9d044a811e"}}, &(0x7f0000000140)={0x0, 0x3, 0x4, @lang_id={0x4}}, &(0x7f0000000180)={0x0, 0xf, 0x56, {0x5, 0xf, 0x56, 0x2, [@ss_container_id={0x14, 0x10, 0x4, 0x9, "02ed7ba99e413c3ac4c2b10b43ef35c6"}, @generic={0x3d, 0x10, 0x4, "e8bf9a496d0a9bf7a3422a46aaec81c7fb73f0cac8887fefa6feefceb233fb2f50dca752f2729fe0afd70b48f357c8e6815e4b0b45ca96c0a651"}]}}, 0x0, &(0x7f0000000300)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x1, 0x2, 0x7, 0x5, 0xb8, 0xf8, 0x6}}}, &(0x7f0000000dc0)={0x84, &(0x7f0000000380)={0x0, 0x15, 0xc8, "66e6a3094d9d2d61feeb70d3d88393bd45608a3338a572b9a500fda9cbc913b18adeb7f0b2c70b1e1fa5858329ab6750f5c326cc854051b28ec57629e58d6aebbde6907cda3ad1ad17c48e2accb54d8a486dc077395580789954246807ade014a6ec869912b64d39f13d4d38aaa561365e10c71325d55783fa159608c4b79f3ef9ac2d5fa2def3e079d6f6e5f7a3be858cbb6de5e8e969c263930d89f3007bb5042ab164080fd03e3e9af937bcb00b54f94be19dce69bbe97155059b36ba5f2eb97c2f7a471b7e64"}, &(0x7f0000000480)={0x0, 0xa, 0x1, 0x88}, &(0x7f0000000540)={0x0, 0x8, 0x1, 0x1}, &(0x7f0000000580)={0x20, 0x0, 0x4}, &(0x7f00000005c0)={0x20, 0x0, 0x8, {0x120, 0x8, [0xf000]}}, &(0x7f0000000600)={0x40, 0x7, 0x2}, &(0x7f0000000640)={0x40, 0x9, 0x1, 0x9}, &(0x7f0000000680)={0x40, 0xb, 0x2, "cdef"}, &(0x7f00000006c0)={0x40, 0xf, 0x2, 0x81}, &(0x7f0000000700)={0x40, 0x13, 0x6, @broadcast}, &(0x7f0000000740)={0x40, 0x17, 0x6, @multicast}, &(0x7f0000000c80)={0x40, 0x19, 0x2, "7faf"}, 0x0, &(0x7f0000000d00)={0x40, 0x1c, 0x1, 0x8}, &(0x7f0000000d40)={0x40, 0x1e, 0x1, 0xe}, &(0x7f0000000d80)={0x40, 0x21, 0x1, 0xe4}}) syz_usb_control_io(r2, 0x0, 0x0) r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$EVIOCGMASK(r3, 0x5b01, 0x0) bind$alg(r1, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(camellia)\x00'}, 0x5f) pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) fanotify_mark(0xffffffffffffffff, 0x1, 0x4800003e, r4, 0x0) vmsplice(r5, &(0x7f0000000240)=[{&(0x7f0000000040)='d', 0x1}], 0x1, 0xf) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2000000000000) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) syz_clone3(&(0x7f0000000140)={0x21000000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f0000000040), 0x2}, 0xa0) 6.057711912s ago: executing program 3 (id=2141): unshare(0x2000400) r0 = epoll_create(0x3ff) epoll_pwait2(r0, &(0x7f0000000280)=[{}], 0x1, &(0x7f00000002c0), &(0x7f0000000300)={[0x3]}, 0x8) syz_io_uring_setup(0x186, &(0x7f0000000240)={0x0, 0x3416, 0x13100, 0x2, 0x4}, &(0x7f0000000140), 0x0) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000004c0), 0x48100) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r1, 0xc08c5332, &(0x7f0000000040)={0x0, 0xfffffffe, 0x0, 'queue1\x00'}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$TIPC_NL_MON_SET(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000000000000000900000024000480130001"], 0x38}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r1, 0xc05c5340, &(0x7f0000000340)={0x0, 0x1, 0xffffffff, {0x82, 0x9}, 0x2, 0xff}) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x40000, 0x0) fcntl$notify(r5, 0x402, 0x40000008) getdents(r5, &(0x7f00000002c0)=""/114, 0x72) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[], 0x38}, 0x1, 0x300, 0x0, 0x11}, 0x0) 5.956442604s ago: executing program 3 (id=2142): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000100)=@newqdisc={0x24, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x0, 0x6}, {0xffff, 0xffff}, {0x0, 0xfff1}}}, 0x24}}, 0x20008001) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) (async) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000500)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r0, @ANYBLOB="060015000a0000000c001680080001"], 0x38}}, 0x10) (async) r1 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x0) (async) r2 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000440)=@raw={'raw\x00', 0x8, 0x3, 0x458, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x388, 0xffffffff, 0xffffffff, 0x388, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [0x0, 0xff], 'netdevsim0\x00', 'bridge0\x00'}, 0x0, 0x128, 0x150, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x4}}, @common=@inet=@hashlimit1={{0x58}, {'bond_slave_1\x00', {0x45, 0x1ff, 0x6, 0xb0e2, 0x10001, 0x84e, 0xfffffffb, 0x18, 0x8}, {0x1}}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0x208, 0x238, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@recent1={{0x108}, {0x8, 0x6, 0x10, 0x0, 'syz0\x00', 0x7, [0xffffffff, 0xffffff00, 0xff000000, 0xffffff00]}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x4b8) (async, rerun: 64) syz_emit_ethernet(0x5e, &(0x7f0000000000)=ANY=[@ANYBLOB="ffffffffffffaaaaaaaaaabb86dd6012000b00283aff00000000000000000000000000000000ff0200000000000000000000000000018900907800000000fe8000000000000000000000000000bbfc000000000000000000000000000001ddbfff668611fdfa1e712eddd5"], 0x0) (async, rerun: 64) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x4, &(0x7f00000000c0)=0x9d, 0x4) 5.76616568s ago: executing program 3 (id=2143): mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x6, 0x50, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) recvmmsg(0xffffffffffffffff, &(0x7f0000004600), 0x0, 0x2, 0x0) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000000), 0x88002, 0x0) pwritev(r2, &(0x7f0000000ec0)=[{0x0}, {&(0x7f0000000b00)='\x00\x00\"', 0x3}], 0x2, 0x0, 0x81) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000140)='children\x00') socket$l2tp(0x2, 0x2, 0x73) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './bus\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) unshare(0xc000400) syz_open_procfs(0x0, &(0x7f0000000540)='mounts\x00') mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x1) r5 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x9080, 0x0) read$FUSE(r5, 0x0, 0x0) 5.164727003s ago: executing program 0 (id=2147): r0 = syz_io_uring_setup(0x49a, &(0x7f0000000200)={0x0, 0x79af, 0x0, 0x7fff, 0x259}, &(0x7f0000000140)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000000)=0xffb, 0x0, 0x4) (async) syz_io_uring_submit(r1, r2, &(0x7f00000002c0)=@IORING_OP_TIMEOUT={0xb, 0x11, 0x0, 0x0, 0x0, &(0x7f0000000100), 0x1, 0x40, 0x1}) r3 = syz_usb_connect(0x5, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="9f01000083667d1040206402d14e0102030109021b000100000000090400000190f19c000905f3ed"], 0x0) syz_usb_control_io(r3, 0x0, 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) (async, rerun: 32) syz_usb_control_io(r3, 0x0, 0x0) (async, rerun: 32) syz_usb_control_io$printer(r3, 0x0, 0x0) (async) syz_usb_control_io(r3, 0x0, &(0x7f0000000600)={0x44, &(0x7f0000000340)={0x40, 0xf, 0x1, 'V'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r3, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r3, 0x0, &(0x7f0000000440)={0x44, &(0x7f0000000840)={0x20, 0x11, 0x27, "9fca60e0a545936838ae6e9621078b19b55f6cc66ac73981fcc1bb7f1be73197218438ea370ca4"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r3, 0x0, 0x0) syz_usb_control_io$hid(r3, 0x0, &(0x7f0000000580)={0x2c, &(0x7f00000004c0)={0x0, 0xa}, 0x0, 0x0, 0x0, 0x0}) io_uring_enter(r0, 0x627, 0xc104effd, 0x43, 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) (async, rerun: 64) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) (rerun: 64) sendmsg$IPCTNL_MSG_EXP_NEW(r4, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000980)={0x4c, 0x0, 0x2, 0x401, 0x0, 0x0, {0xa}, [@CTA_EXPECT_MASTER={0x4}, @CTA_EXPECT_MASK={0x4}, @CTA_EXPECT_TUPLE={0x30, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast2}, {0x14, 0x4, @ipv4={'\x00', '\xff\xff', @multicast2}}}}]}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20008004}, 0x4) syz_usb_connect$cdc_ecm(0x5, 0x72, &(0x7f0000000080)={{0x12, 0x1, 0x50, 0x2, 0x0, 0x0, 0x20, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x60, 0x1, 0x1, 0x5, 0xe0, 0xb, "", [{{0x9, 0x4, 0x0, 0x9, 0x3, 0x2, 0x6, 0x0, 0x2, {{0xa, 0x24, 0x6, 0x0, 0x0, "240fe77258"}, {0x5, 0x24, 0x0, 0x7}, {0xd, 0x24, 0xf, 0x1, 0x9, 0x3, 0xc, 0x1}, [@ncm={0x6, 0x24, 0x1a, 0xc1, 0x4}, @mbim={0xc, 0x24, 0x1b, 0x0, 0x6, 0xe0, 0x8, 0x7fff, 0x9}, @dmm={0x7, 0x24, 0x14, 0x2, 0xc016}, @network_terminal={0x7, 0x24, 0xa, 0x0, 0x5, 0x0, 0x6}]}, {[], {{0x9, 0x5, 0x82, 0x2, 0x10, 0x7, 0x8}}, {{0x9, 0x5, 0x3, 0x2, 0x20, 0x0, 0x1, 0xb7}}}}}]}}]}}, &(0x7f0000000500)={0xa, &(0x7f0000000180)={0xa, 0x6, 0x110, 0x8, 0x52, 0x4, 0x20, 0x7}, 0xaa, &(0x7f00000006c0)=ANY=[@ANYBLOB="050faa000303100b98100b17833dbc4bcc6d9c9736aef89afe7accf7a0d880e3d6f40c2f8d8b60630115ff2559cb459bcc484f59f053e6bb5fc66c3dec7306bcb32d0ecee3d333b93dc30e61a80de448cfb5ff0d5a28430d08ed145576c4c490050e70d7071a865947774204c905c263dac4422ce39f8c6d0b82c68e92ecc34aac1dc08f7e8a60b8245a2b115f733b9b727e8de9632e4f4b6b7985de9453541d0a10030201000f000400140828fae32e76fb7547f20b285e874b2997bbda08df7eeef34f9f8d632ae353c4a1b4a580b0d6fbfe987933315324cfeb7e310a6eeea10a3ad766acb3fa52382b58d82df709a615b82a409054208c3d473d01c49fb5c9de350257889f523c4b39114e0afd0a2325555a373b92d245bb3de291898ebb0c43ae9f0d0e9ca4b04f6b71fe56f9764606d31ddc6f930749619b2e022e2732fb"], 0x2, [{0x34, &(0x7f0000000280)=@string={0x34, 0x3, "5227462820f6126c271b6dc412887925627bd2c3b666bf69fbb5392ab2ef37188cc011af0abfccc9e7dea1963e71eec816d2"}}, {0x4, &(0x7f0000000300)=@lang_id={0x4, 0x3, 0x3401}}]}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x6a855000) r5 = socket(0x2b, 0x80801, 0x1) listen(r5, 0x9) (async) r6 = io_uring_setup(0x660c, &(0x7f00000006c0)={0x0, 0x103, 0x0, 0xfffffffc, 0x211}) socket$nl_netfilter(0x10, 0x3, 0xc) (async) r7 = socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$nl_crypto(r7, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000820}, 0xc, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="f0000000110002002dbd7000ffdbdf25647262675f6e6f70725f7368613100"/180], 0xf0}, 0x1, 0x0, 0x0, 0x24008054}, 0x85) r8 = openat$dsp1(0xffffffffffffff9c, &(0x7f0000000100), 0x82e82, 0x0) ioctl$SOUND_MIXER_READ_STEREODEVS(r8, 0x80044dfb, &(0x7f0000000140)) (async) close(r6) (async, rerun: 32) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) (rerun: 32) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x8}) 4.693027768s ago: executing program 2 (id=2151): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xf}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0xa30e, 0x1, 0xfffffffa}}}}]}, 0x44}}, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) (async) syz_open_procfs$namespace(0x0, &(0x7f0000000100)='ns/net\x00') (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x0, 0x50, 0xffffffffffffffff, 0x0) (async) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) (async) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, 0x0) (async) ioctl$sock_FIOGETOWN(r4, 0x8903, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x100000001, 0xfffffe0000000001, 0xfa11, 0x65aa}, 0x0) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0x0) execveat(0xffffffffffffff9c, &(0x7f0000000280)='./file2\x00', 0x0, 0x0, 0x0) (async) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) (async) r6 = socket$inet6(0xa, 0x800000000000002, 0x0) (async) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) (async) r7 = io_uring_setup(0xfdd, &(0x7f0000000040)={0x0, 0x36d, 0xc000, 0x2c, 0xa0002f5}) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0xfffffffffffffda2, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffee1, 0x0, 0x0}, 0x94) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x24, &(0x7f0000000000)=0xa, 0x4) (async) r8 = syz_open_procfs(0x0, &(0x7f0000000000)='timers\x00') preadv(r8, &(0x7f00000002c0)=[{&(0x7f0000000100)=""/122, 0x7a}], 0x1, 0x45, 0x0) (async) io_uring_enter(r7, 0x2219, 0x7721, 0x16, 0x0, 0x0) (async) sendmmsg$inet6(r6, &(0x7f0000000e00)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c, 0x0}}], 0x1, 0x0) 4.641269607s ago: executing program 3 (id=2152): openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r0 = socket$rxrpc(0x21, 0x2, 0x2) setsockopt$RXRPC_MIN_SECURITY_LEVEL(r0, 0x110, 0x4, &(0x7f0000000000)=0x7fffffff, 0x4) (async) setsockopt$RXRPC_MIN_SECURITY_LEVEL(r0, 0x110, 0x4, &(0x7f0000000000)=0x7fffffff, 0x4) r1 = syz_clone(0xbf24ba00, 0x0, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) (async) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) (async) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(r1, &(0x7f0000000280)={0x38, 0x5, 0x53, 0x7, 0x8000000, 0x9, 0x0, 0x9, 0xfa11, 0xffffffff}, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) mremap(&(0x7f0000000000/0x9000)=nil, 0x600002, 0x600002, 0x7, &(0x7f0000a00000/0x600000)=nil) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) (async) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) io_uring_setup(0x1694, &(0x7f0000000080)={0x0, 0xfac7}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) 4.481769219s ago: executing program 2 (id=2154): mmap(&(0x7f0000735000/0x4000)=nil, 0x4000, 0x2000004, 0x6031, 0xffffffffffffffff, 0x23a2000) r0 = gettid() r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x4) read(r1, &(0x7f0000000440)=""/247, 0x26) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000040)={0x31, @tick=0xfffff797, 0x0, {0xfd, 0x2}, 0x0, 0x0, 0x4}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_INFO(r1, 0xc08c5335, &(0x7f0000000200)={0x7, 0x2, 0x1, 'queue0\x00', 0x996a}) tkill(r0, 0x7) mmap(&(0x7f0000abb000/0x1000)=nil, 0x1000, 0x0, 0x102000200032, 0xffffffffffffffff, 0x87f64000) setsockopt$sock_timeval(0xffffffffffffffff, 0x1, 0x2f, &(0x7f0000abaff9), 0x10) mremap(&(0x7f0000ceb000/0x2000)=nil, 0x2000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) socket$nl_route(0x10, 0x3, 0x0) 4.364946042s ago: executing program 4 (id=2155): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da0700000000000109022400010000000009040000090300000009210000000122220009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = openat$vimc2(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_usb_connect(0x5, 0x40, &(0x7f0000000540)=ANY=[@ANYBLOB="12007da49d8f295dfeca365eabb4010003bf6e9140d107093a31d10102030109002e00010404000000049204008fb0a94009210800c501223c197ad102b60c0e0a2402023b000800080809240201070205105bd3c4fd002811a98b875810c1b881a88eb53646f65f4d4302c61407f44cafe55c78c0e9ee3d24c8135199f38b50b0136e8f07812ab72e17350388098b4c5f9f04374c5b80bc5ea348656f4cd598ce049e1677b3ae649c019c30a1dfef32bf8134ee6975f3ebccbc5b0b2c2cb15262033bb09c6b416b897f43dd8c7ab38088b67da71e0a087ee892df7aec36d804020e491e8bd0abf4f9e24ec72013373734b2f4860fd9e968eb05c6558c42ff2595c4e5a358f5622302ccf38496f91e0cf2f44295cc63e30e198be5be105c52e87670656aa2558f8cd798271497ec7e0d9fa23baf805e45bb7263486751ce290aac5b422833b38b55c6bf50d84642e7fcd61b8f70546384e3ce"], &(0x7f0000000280)={0xa, &(0x7f0000000100)={0xa, 0x6, 0x201, 0x8, 0x8, 0x4, 0x20, 0x3}, 0x2b, &(0x7f0000000140)={0x5, 0xf, 0x2b, 0x3, [@ext_cap={0x7, 0x10, 0x2, 0x2, 0x4, 0x4, 0xffff}, @ssp_cap={0x18, 0x10, 0xa, 0x2, 0x3, 0x800, 0xff0f, 0x13, [0xff0000, 0xc00f, 0xfff0]}, @ext_cap={0x7, 0x10, 0x2, 0x0, 0x8, 0x7, 0xfffe}]}, 0x3, [{0x4, &(0x7f0000000180)=@lang_id={0x4, 0x3, 0x4c0a}}, {0x31, &(0x7f00000002c0)=@string={0x31, 0x3, "2e66b6c818ba1d05c25ed3f326b8b69df6a60401ed4eada039038c5a1c6f0060e6abb821c29e61c183f9808d808482"}}, {0x4, &(0x7f0000000240)=@lang_id={0x4, 0x3, 0x444}}]}) ioctl$VFAT_IOCTL_READDIR_SHORT(r1, 0x82307202, &(0x7f0000000300)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_int(r2, &(0x7f00000000c0)='cgroup.max.depth\x00', 0x2, 0x0) write$cgroup_subtree(r3, &(0x7f0000000240)=ANY=[@ANYBLOB='-', @ANYRESOCT], 0x4) ioctl$VIDIOC_ENUM_FMT(r1, 0xc0405602, &(0x7f0000000200)={0x0, 0xa, 0x0, "e5e81571c97b166978ff61fcfd2409b2b73e0f936ed774de107de8a9041b5113", 0x50424752}) r4 = fsopen(&(0x7f0000000240)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) r5 = fsmount(r4, 0x0, 0x0) fchdir(r5) r6 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000380), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000100), &(0x7f00000003c0)='./file0\x00', 0x800, &(0x7f00000022c0)={{'fd', 0x3d, r6}, 0x2c, {'rootmode', 0x3d, 0x4000}}, 0x0, 0x0, 0x0) r7 = open$dir(&(0x7f0000000000)='./file0\x00', 0x4000, 0x100) openat(r7, &(0x7f00000001c0)='./file0\x00', 0x6d0200, 0x88) syz_usb_control_io$hid(r0, &(0x7f00000000c0)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00222200000096231b0680e608a70000002a900683749e821c0b8b9236590b09007a159385"], 0x0}, 0x0) 4.187514936s ago: executing program 2 (id=2157): r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_LAPIC(r0, 0x4400ae8f, &(0x7f0000000740)={"6fd2530c26281df2fbeec138099f901b6a41d7882382835d377e4024d1dd24a297a4633011effd5471c88e84542a374834f1cdbc874a3e540e99a298559abbbdf39b0310ffe9aa05442cf00ece7966e2bdf2adda97c9f55382aac0bc15c14d14ccd86b2d35bc23b2413e239327422aa961db54d7700e09cfaf2f9c05dc1d0e5bd2471fcce5bb8659829ce3d6fcea46824ec47c383bccfc142095169786f83fcee04ba2fb8791585dc54be8fa75cf435e29f92c8a1b47547b5520525a23312c0a84969ff0d5a0db6baafa3db40edfc401e7b7c1b82907ae603a1a2384515ea643bbac071eb466bb1ca0db7eeb49726a377c7461f502f8e67a0900000000000000dbe5cca0b1172a219724e4adc1ceb5001141a57e5af9de05884d2bcb675e22a3cc676446ed945a16ae04c88ff15dfaf0a7286a0f938fbd9e7457a815a2947cb24acaefc63488c2eb633ed2926747778b58233abb03d3dcaa0f9ce80e0bdabd1c42383d9ea3d4adc424ff55b1212a70e2a6811345b7a9423bb506c7259f61d4118c7250d8af96a15f1ee88d0f92011b37c143fa77bc8cd9d1827f69662f47e2454471862f6f423143a7e2ce0c0b86bc91848ac3d9de55ae6c7ca2a52fcc8113137f79b7fcc93fa6548399fffe3f1e07adcae4c04917bc9af6879280bc750daa59cdf4c6d6c8b578fb5a871aaa36992ac617cb28a6c9771172016a81967599c79cdd3dc4507bba005ab93ee53c114000c20bc0e151057f3e8588540278b5b44f58b748692149b1e9532bca1751263c619ebc686a24ea0bf702d16c64d44aa2ee8ff572c68b28c5f9f48b6be9a26d94ef9e12a84c7d144164ba539db4761635aae50ce649a0b85250e362e09ec696741ce4f87ea249a1ed55845b81d2a4d6840e452d9765ed4ffc176d1e5c5ce9c65f71522ff6f9daa581aa95121b216b483ea4ad9ba74be8612759dc22790f39c409da30ff4704f5f79be576b3f24ea83d051702e8d5aea64c070b215883228848662b6545827291f4d1455febed68503e42e5fa9396e0cd14cf81f146e525c909e76bdf4cfef49a55faf6d895b1577028edf2b1c0e3560c64f666b9f7f09509c8e098d036557b0b98096d3e4b8459abb0b6f2e0eae980c6c71692f624ed5811019229f711236d4f4e69afcc7f1c4ac4871f8b2d79e1d4bb62337d62394ee1c5c94d9bd50a14e822f58653692f6751b5431eac19c0a9cc302bd69b814203000000000000cb9533756b20b173862e48020c830977faa6826bd8934a507502a93cb36913cbe4a1ee0e02f191932069264bb0fbe8333d9235cb6c0cc921216b3e5b274c128057ab4433f76d0116f965b24cd768dd87f423465aa719c555595a7462edf4ae593d9edc76ccec69d432e5f67260f8fdcdc4646a00a087d26197ac3062c7fbcfbecb15154a344400"}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x640a41, 0x0) r2 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0xc, &(0x7f0000000980)={0x6}, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)={0x1c, 0x52, 0x1, 0x0, 0x4, {0x2}, [@typed={0x8, 0x1, 0x0, 0x0, @binary="feffffff"}]}, 0x1c}}, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'syzkaller1\x00', 0xc201}) r3 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @multicast}) write$tun(r1, &(0x7f00000004c0)=ANY=[@ANYBLOB="000086dd0500560008005400000060ec970001983a00fc000018c6ba35000000000000000700ff02000000000000000000000000000100000000000000000000000000002c"], 0xfdef) syz_genetlink_get_family_id$fou(&(0x7f00000000c0), r2) 4.105412181s ago: executing program 2 (id=2159): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000002c0)={0x1, 0x4, &(0x7f00000000c0)=@framed={{}, [@jmp={0x4, 0x0, 0xc}]}, &(0x7f0000000040)='GPL\x00'}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000cc0)=ANY=[@ANYBLOB="b700000012edfffebfa30000000000000703000028feffff620af0fff8ffffff61a4f0ff000000001d200000000000007f000000000000005504000001ed0a002500000017ff2000dd40000000000000730a00fe000000001f04000000000000e5000000000000009500000000000000023bc065b7a379d17cf9333379fc9e84af69912435f1b6a693002e7f3be361917adef6ee1c8a2b4f8ef1e50b91f32050e436fe275daf51efd601b6482a0800000098efefb202ee010400006e7a1de4a21f379dbf01de00b1b564fef3bef70548aed0d600c095199fe3ff3128e599b0eaebbdbd7359a48f5b0afc646cb7798b3e6440c2fbdb00a3e35208b0bbf12cd8dff0c710e4000000000000009fbe4b61a615c6c57a2b649dc74a1a610643b08d9ec21ead2ed51b104d4d91af25b8123deda8a3658d42ecbf1dbf6d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31a76e42f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0800d9b3a69b37caa964e4b7000000000000d5f728d236619074d6ebdf098bc908f50ae728a40f9411fe7226a4040bef29b66e3858d051c096e37c4f46010400000000c3da29faf75ddd1aa96960bca97af13382cb881cc1f62c0f8f8f0e8d76b86f9c45636614786f5a2cb77230a874640dcbe0b20bb77c022d4cab080078fce8c5c81b7037181fc2f18f781aaa6e2957d7e39cc1baddcb7ec6667e699f24e41697ee7ea23e4b29a8b6cc9a1f5a7b3caae05f13792292cb949b3aab06b1e042ff2164d80c605532b18ab1c156b97e5889685a96949e4cb40df77b8bb84b0e733a63784ccc214d930cbb7e090df9a2867b3acec439c163fcd7071b53ac29df826f8ae6d6e18c1eacf5bf870768d5217e9bb5a05d9e22ce67f1231bd236486727d970acc546087acbf30f2f8165b47ba56dfadd14b306e98931485747292c6fe6e188750cf4f87cce2aa7d67c7133a9f05954cde298a35ea6d715ba80aee63300000000000000000000000000000000000040000000000000000386000000b854adb4f8080064e8407c6bdb37114c80fbaa4a0ec5aaf4b0ac6f2128668279eb6fc144344e2d461c9a1be8fa0061ea9d55ee4716bea8e1cebf9ed39325a904514d8e90131bfc00000000000000d7c5af73c683625aaad5eda5004a76c9f8975ed4c5e4eb3e77e9885769754932609f19e2f615a01cb6d17fbf5cb539403cb0572534f054d5514ad8269b2bdf2ca4958a62a6e744f9a4c1e646e1dd2ca19583f0f8b0dc53debd7d44f334e6ed7445a9580f970e483b307c4b3c018bc194b23d37e6a2e52d8288e5aab6fec586d52386e8c07a88c88e8faec5f1b16b2014f6952ce7d6be12c6bdb9651ca6fc907061be311d1354e6295698594a73136237bee068d3819400e43544830a3f74b7942f22336953978a5b2032da4238cc61162c04c1297395b73e18c9387615a2bc87d9e2445f3d323d3fac347932a4bac694c55fe9d145906d410f58f1951405d10504efe402cae085afef5dbd617e87ddbd23834a50d7eb8e327fb5db12cbd6a9efe8e671c4f251fe3bf440cabdfe3400a670d14b9b3cd8d86e492997a0168c022ef3536bd1dc731f4f9f8cb6c3857fb8aaaa95024f8da775f72950212b84fc6133ae14d1429cd4905dabb52e43af7e65acf97b4951fa1e967d16a5ed642efc855a4a46b85cd079934ad3188276efae9387eaa2c910fb8de24b5d4fded86c3811ccd00520150b16000080122965558074956da5e4c3bbefcb64aa8be4456ed2caf0f49e4dcc1b7af0b51b9cafeda067b6bbf3aa4371f5e76ab3f60afea80bb066aafb7517f787b090f419a20278a3c779e03afd9a6af6fd518e5dce030f88ec5a5cb7601a161da0f8089322d84ac523040d13e1f1300c2c6555bce60d95dd3288e53435713f03add23f14c8db5555c62de4f626483632a2ab547f88dd6efec73a0271a19ca3aa860aa4dcaeeb9bd91a0cb429efae2a5fcc08b3a572969bbe91c921ac1476027772c87d1767e38ba49e3e57fafea83e495a6a1d1a4ebf83434986091dd66ffe3ffed0c39552a312e2db596d9c828c02f6fc13c8ddbb50bfd7dd8aa2f35f259fc83e007f00a292dd3b856faa4b7e66e1b64505f65900839df71a97d4d05d37f7ecf8ed9a22da26ae674bba16c204f6b2f8f74fc56b7126d7c11ece6e88ec41192aaee75415c58d264a2b6adae02c821b62428902aad499825ab85a348638384cd12e61dbde5c47056f0a20b4e2a2328d5db5cfe56557a129e6be231acf5f57995c60d9fca5f63a0dfd18054717120bda466d04774b530500d8b022719ca77a4e0a66b4708f791d849a5e2aaa0074a9560ede2600df5a5c41392fe9460080fcb1e65233fb8dbeec4c86dbcf6a0673e38d2d3615e5bfbde44afe0fa7564231fff7e7f1f3ad68492dd2ccb1decb15b5d7d3e37e8b7d28921c4b9280979521173f322df408d9818b6cc400098abb860600911480a876fbba698801937e8b4264eb6f5137bd9b075f1488d22230592a79000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002f316aa0886c174b73decb46c1c85edf50d8fcbac5ff76b365611666da86a8e65b30e55ac1275e938706bd7c000000000000003f7cd4d5cb9076b81b7741ec03877afb5237ea1694addebc14c3ae49f88c462aa2050acf2d9a97d3be29a5614d1eba2c98cf0236401e02d7c445e50f76419ab4f78f67a09e63dd4faa2e7b59399f055f2fa278783fefb0a5ef0b41e14a6fe6ba306206670b84894e901a523fcbadfeff0492df6b53002514bc834e876810d9a6a78e70a9e22860c36a724770b4185de44db6bf21fef32a8d5b36d9014f38fee012365f963b2a85e7d8075c333475b9f0284405e3127dde7e41285fbe0bdd37220e316f2297743dd4731614a50c16c6a41744c3d24eab511317f97b7b4a1c2ec33fedc46e9bf0fa640eebd3d58f0ebdb7cb8ccffd6d6ab7e0e843591d2618e2d2cdc7081c8fafffe9c350a5c554a387de4ee7aac6478d99de7dd82bef044a6d33c789d566c90c46ad581aa250bc93b233a2291b5b10eebc49b6882f910547a77d55e26bf19f1d4661550b177ef53933a305e69b8a95119dcf5bda599d625054776151b2cd1fcde238bdc527594a6c17aa9728af7a3830e7092b01b119ea4e7e7f0e21527d622cc29c9f0c8720195368f8a9d3374337ab4d130619d93c5ef37e7ddd0b2da147e6e513455b88753446de959a6cbfa1ffbc7ad5d8c3b48017fd31dcf72f337b639253f44cb27a12174bc4c191e21015d0c431a71906eb9c6a14c8a060459ef26787ce3d1cbfd5cc459f0048b5d06f6cbd3e9b34c89f3fb2f951ae81d7fcc8bc0000000000000000000000000000000000010000009231feef3117197c7963c2ba910969f776c8b2ea3970f358107945d9e74e9bdfa58e68b65a9201bc4b73b431df5aa29f363917f90e3fa1eaf553db1c761dd9b634a9c4d7c21d24fe6d953ed9438cad0f8dfe03e5e2f73019352f1fb682a5a6ebbf24ebc49e3d7058e696eb3f4b642f36c9006c0067e24a64aa8c53dd824a4ee271e35ed9eed636338f1835fc957729d63dc1bfc7b772cbe536c2d3aff27c22f9a2f876512616a5bdaf22a16e19d1b5f52abb40b433983d0cf50234de659c1a397ce901000000caae1bcfdce33dae6adc260321702f239c25ab181390e7dc8c1e5b1cf3b4fef1cd5c44a89b5e5d8314e02f4673ded90bce9a4025b0232eec970f7aa17f175a14e8dc8de9bac0006b98a8283eee5665f3aede28228e0468db"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x1e}, 0x48) 3.989588336s ago: executing program 2 (id=2161): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000300), 0x802, 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x5) (async) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000480)={{0xfffc, 0x9, 0x0, 0x6}, 'syz0\x00', 0x3}) (async) ioctl$UI_SET_KEYBIT(r0, 0x40045565, 0xf7) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000080)={0x1, &(0x7f0000000100)=[{0x80000006, 0x0, 0x0, 0xb}]}, 0x10) (async) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) (async) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, 0x0, 0x0) r3 = syz_usb_connect(0x1, 0x2d, &(0x7f0000000340)=ANY=[@ANYBLOB="120100001ddf8208c007121522300000000109021b0001000000010904010001faf40d00090582239f"], 0x0) r4 = syz_open_dev$char_usb(0xc, 0xb4, 0x800000000000) syz_usb_disconnect(r3) (async) writev(r4, &(0x7f0000003480)=[{&(0x7f00000021c0)="81", 0x1}], 0x1) (async) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r5 = socket$kcm(0x2, 0x0, 0x2) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) write$tun(r2, &(0x7f0000000240)=ANY=[], 0x22) ioctl$UI_DEV_CREATE(r0, 0x5501) 3.462910373s ago: executing program 3 (id=2165): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x180) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) close(0x3) openat$cgroup_subtree(r0, &(0x7f0000000200), 0x2, 0x0) rmdir(&(0x7f0000000080)='./cgroup/../file0\x00') close(0x3) syz_usb_connect(0x2, 0x24, &(0x7f00000012c0)=ANY=[@ANYRES64=0x0], 0x0) 2.653972121s ago: executing program 4 (id=2169): r0 = request_key(0x0, 0x0, &(0x7f00000006c0)='\x00\x000\x00\xa5^y\xa9n\x00\xe3\xa3\x89\x90&)\bT\x91\x14\xba\x19\xadJ(\xeb\xef\x97.\x9c4\x12:0\xb6\x00\x00:\xb2\xff\xff\xff\x7f\x00\x00\x00\x00P\x1d\x1e]\xde\x00D\xd4b\xd98\x82\xb7\x9a\xec\x18\xd5\x14T\x8f84\xd8\x91^\xd0\xd6\xde\x8ex-y#\x84\xdc\x93\xf7\xedZ\xcd\x1c\xa5C\n\xa1MF\xf5^$\xb0\xe4\x95\x03\x84X\xf0\x19\a\x9eI\xba\xf1n>\xac\xdfL\xa6\xc2\xc9\xab\x01\xea\xf3G\x18\x81\xa0\xff-\x1f\xceE\xd8L7c(j\x80\xc7>\xc0\xf5\xf0/O\xf4\xea\x16\xd7\xb1\xd3\xfb\x10g\xaaQ\xff\xd7\x03\xa2\xd8k\xa7\x85c\xa9\xa4\xc6N\xc2m,\xb07}\xe2/\xbf&@\xb6>\xd2\xeb\x81Rb{\xa6A-u\x19\x1d\xc3\x93\xc7\xa1\xc8A{\x93\a\xd6t\xf4\xf4\xc3\xf7\xc0[k\xdc\x92\x8bd]\xa3\x87\x06fp~O\xdf2\x00\xb2~?F&\xccX\xf8]\xd1Q#\xceF\x9cO\xfa\xed\x06\xcc\xf4q\xa8\x00\x00\x87\x80\xc9u\xd5na\x16\xb6\rB\x8a\xc2\xf2\xc3@F\xab%\xe7\xfd\xf7.', 0x0) request_key(&(0x7f0000000040)='dns_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='y\xa9n::e\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00', r0) 2.569951889s ago: executing program 4 (id=2170): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x220243, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000400)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000140)={0x28, 0x6, r1, 0x0, &(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x800}) (async) ioctl$IOMMU_IOAS_COPY(r0, 0x3b83, &(0x7f0000000040)={0x28, 0x5, r1, r1, 0x3, 0xfffffffffffffffa, 0x3fff}) (async) r2 = syz_open_dev$sndpcmp(&(0x7f0000000200), 0x0, 0xa2c65) ioctl$SNDRV_PCM_IOCTL_SW_PARAMS(r2, 0xc0884113, &(0x7f0000000240)={0x0, 0x2, 0x0, 0xa79, 0x0, 0x0, 0x0, 0x3, 0x7fff, 0x7ded}) (async) close(r2) (async) syz_io_uring_setup(0xd86, &(0x7f0000000140)={0x0, 0x2c32, 0x400, 0x1, 0x22f}, &(0x7f00000001c0), &(0x7f0000000000)) (async) socket$packet(0x11, 0x2, 0x300) (async) socket$packet(0x11, 0x3, 0x300) (async) openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x80102, 0x0) eventfd2(0x4001, 0x800) (async) socket$inet6_udp(0xa, 0x2, 0x0) (async) openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) (async) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000000)={0x1, 0x0, 0x5000, 0x2000, &(0x7f0000ffd000/0x2000)=nil}) socket$inet6_sctp(0xa, 0x801, 0x84) (async) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101044, 0x1ff) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) (async) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x604bc0, 0x0) fanotify_init(0x200, 0x0) (async) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x2, 0xe4) socket(0xa, 0x1, 0x0) (async) openat(r3, &(0x7f0000000300)='./file1\x00', 0xc4042, 0x0) open(&(0x7f0000000080)='./file1\x00', 0x64842, 0x86) 2.36104797s ago: executing program 2 (id=2171): r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/diskstats\x00', 0x0, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x81c0, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000200), 0x0, &(0x7f00000006c0)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x1000}}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="300000001800190100000000fcdbdf250a800000000001040000fdff13000100"], 0x30}}, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x2c41, 0x0) ioctl$FS_IOC_FSGETXATTR(r3, 0x801c581f, 0x0) r4 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0) io_setup(0xff, &(0x7f0000000040)=0x0) r6 = eventfd2(0x1, 0x0) io_submit(r5, 0x7, &(0x7f0000000980)=[&(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, r4, &(0x7f00000000c0)="25b624c31434eef09a53f6b51a84a2c7a88e40eb3349b778507f0d065ab24f51a8d6a2a4107853dbd973ad17aa8bac90fde3e59877cec16e134f0d4622c614e72973d1efe189538a5896d3474a8c692d6a2f0ba527767a99c19422d076f2de9b84f03822ea52c94f8fd4114a2daf68dcbe6dc474c5a03261227ddce00065ed70d5e93ace251e5592dc8dd1f85a2c0982c20cf2f3ffdc7ab86f92b26c6396456e2444bc0fc85c952de56cef34fce39d62cf39c2bbcbc59ebe14f6a4a08a044ea2d145c52695b9ae77884716e3bf07c657a5447cfaff74d014775300eda7ef07a9b6909f", 0xe3, 0x4, 0x0, 0x1, r0}, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x3, r0, &(0x7f0000000380)="501b6460a01129ad7c6475150fc9a57e253915b91225768936ca10c5cb22a373ef6ab19816464a35655c71fef6c7213ac22ebf7fe1ce775fdb6f5339acc0e4a076597892682249bd3a43d244615838ccf656f2f33364f8e72f4c760b3e7896af0234ea6df0205f942f98a0bbaa5fd13ac8855855def5943e3c3f207b5cc0441f151c7d09c0e36ae1245dbb376fb0689e2715aae470504c006036379dc0aa", 0x9e, 0x6, 0x0, 0x1, r6}, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x6, 0x4, r4, &(0x7f0000000440)="a8153bcb5f135b5c590710adce5edc3671077ae36a00fca3e5cd69772b13b24bc0fefdfc9b716edcf25fc8e5f5615e225852f3b2b22df9e5c6a3d7f212b1f3ba3e66df2afce140aad94995293f77acc67b94bb0383596a9b08bb3ba4a2ccc39df1d84857cb852ebf5d8d4b924a87c04cc3afbd49b407579b94eac5ffd7aff6d4cf13ec9426f027f8fb851b4d00e5468c472a1a136cd2141e9a7e64c9f8baac3aedfd27b9467fe949914c04e1b31b6031c88c0d3ecae8d01d5f4159bcedd78a9058cd2a8ca73945e5ab409f4a277b9f027b4498978dc963a2cdcc4f4a4296b94e97a5971ddc9f35040298590cf9e3109b6b9bad", 0xf3, 0x10001, 0x0, 0x2, r0}, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, 0x2, r0, &(0x7f0000000540)="7a0e95f768951d684cfb0f8a49174bc82474dd79b06f20e7a1dc31d3c14197b8af33f9e039d43e16b41a93ab93207218fcf37db701cfcb2b8bca6dacc0287b01554a9e32c338e5ef5644949d0f8c24197b8263f38a03212ba8540166c249780956571090cda2963ebde708159bf7ac50dcb23e4395e16377b488151b3c0f96e6", 0x80, 0xe637, 0x0, 0x3, r0}, &(0x7f0000000700)={0x0, 0x0, 0x0, 0x2, 0x2a8, r4, &(0x7f0000000600)="10b286c610739a42ff40ece8ad1d217cde44e2d0156669f3b2a18a64d0797ea63de40c96a01a6ed367742bc7e404d5a11a637c527f2c04a96ff739c7b67c5ae064d3d321925138ef91ffdae9aa4dcb840fed5c4ebb90dcb294f9bc541782e288b1bb7678310011d021cd7b6fcb2f0656c88b18172f184d9a126f0e3578f8c1d0570a48f6f3df57cbfaf52c1a4670744c02ef27ba2539a51fc1d15fb026e26b6d4c22c3a13aa0b4d1913d20a9b18d1f92ed000413f27a45fe2c935eed64ef2ee8ee941f8014180e09770652f382ffa994f606a3dc6a73bd4fff448f656b3d7ba7", 0xe0, 0x80000000, 0x0, 0x3, r0}, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x1, 0x7, r0, &(0x7f00000008c0)="7de19420f747449bca8ffe124477db6d5b45d14ed1bf5df2bd8aa1f005b9b666a343b97f0c3b39079e36b154f772792c59310d7ce7a7b5fd81879799f8226f1f7f2d750c2b67f1a797b08046a0c5eb2c68b5873cf383017c9f3da4d27a6a2bc668a9492646203480be86648e5d688dc951069ef3d1038c14b96509382fd1d32318d55aaee866e440aa8dead4aefcc468b01742d9047bc366a85f596a", 0x9c, 0x7f, 0x0, 0x1, r0}, &(0x7f0000000840)={0x0, 0x0, 0x0, 0x6, 0x7, r4, &(0x7f0000000ac0)="181247ab87dee9108f5d0ac60e22a071d89dd310158acbc6f34155b0c6b8aa00332c573dc049109a4e708ae6d64cf2c146663a08a633d1bc535cf08af8a447635681831f3736c4eb68534657f59571d1b4c1ad694348f07e48576970509bf3da1fcbb5dbb59955645b6c457d103aa4fbce36d169316aefb95ff58fa32132c8072f4e5a2d341b319bb7231a405973b1d2651430d963ad12d361205fefe929db24c638c480d69eb32fc6fad73683426887ebc2f4f6496fa838bfb09039d3d60b2256dd0c03a672d5e7a6b962a46a013f80490d0e", 0xd3, 0x81, 0x0, 0x1}]) sendfile(r4, r0, 0x0, 0x3fffff) r7 = syz_usb_connect(0x2, 0x2d, &(0x7f0000000d00)=ANY=[@ANYRESHEX=r4], 0x0) syz_usb_control_io(r7, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000009c0)={0xc, 0x0, 0x0}) syz_clone(0x12090000, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)="cc9abdc2443a905ac8a25cb42cec697197b9f8b9232b71c245eff6f109be5b62a06ffc2f75c43962a6f3e604d26f52df9d2f792985f23c0ba80e882efd5c2bd85cfbd2c759a57b132b06fb72909a342eb0215c61367b742575f7c63aca61c637ab5dff8a26311d9e7c73da61aa4da3007eae6e4e16e3dd23d3bb7396ac206bb8082e4253525ba69e27f0db0ed11658be5926ca44ddc375b951fafede4995022ccf95b604d217c6a91b8d0f3cf96cba33c97e9cf69cb0f8a7fbfec4a340922a8f0bbcdd7be2bdc3660242c03edc3bc7a43b6308460103960d78acfe44e84e2f088aee952d46a9ba02d355b67ce95e061ba8dc33c93355d47fea065118262e4fe52c47b7ad1462b7b65d3f4afea5991457968b5113bd88a1458b598c2cc686ccee7a43bbd4d04c2739fb1fac8657511058a9e491ee5cc46ab0b855537f3d2f67fa230d9ef73517b73625fd6a1b2fbfa7ba3e0023d822f8a82a3069e8ab039628079b2e05de7cc96547c7a1c8704b5cef99208b8b536d11080b522dc5bd5e4ac60d569f48a9735a79d96712d2d7663227eeff159ffc6e39ce448120da018c9197c09104ab423a8940e2279bf58b29640f4bd2d193bffbdbe24c587dd6a1501ddfafe69e65c5a1ba7e3bdcd5706e4f220cbe4e03eac03dc44d8240f8f87bf0310d40230f59d2435ffa41131a1760ae624893eb00e31cbfabae37ac0c9856b991b8157abd12fe89127ea596de9677311cc91d907d9e465ceda1fad46b7cc9d33da11a96a1a20afb707b747d2465469172439fc7eeb26d8ab699a98b84fe29655f424e7dfdcb9498501725ae237236331a09818194a38cd55f8983630a47ad6d65477454fbc36712b25270cd8c1d15986c07c0c193e72909ed8cab36be93d12fa7bf90081dba0118a774afff3931982db02a633cd0c8cd9bb06621e8f041d034910a84e9d1ddf8a2e94cfa4b7d926b9cc1c048e1ed65e1beafafb5daeed5c0edf09bbba9d25bb9f119795fbf32df80eef41e5d5d55ec7ca97ede51f64f6b1d8ebbdb14ed90573d1be36375721c07c99148ef6767ee533795b9194b3b12f960f6b08f1729a105b6348655cac4bb4992c374c5829416b3afaf81b979a45b81d60a5babd5da6ef880032054a33c95a958059be2dc7d9ee8a40e927ef3217c694e94c07bce8e5d1cf91745b86cfe4101e7876c7bea2bb1c6ffe96dcf022c003c9864820036c83941b7ee8c16e6c2ad08ec4782bdddffa50e81f0b4f7deca59b9e39b655b81037d67b875302788cbe344ea233fff68749a0c16c583582d0453b96fc895ab4e71dac8fde553e68c1f530b708fdb4c49850da900f04a137c6333289501c4c85b77e6cbe1ab23f67757a25e211cdd8abc463526c9cbf924cc8c85f03dcbb40175fca6fe60d722584664c926d250b6a9da2a8c8dc576ea27e5954d1d935b2908806b12308dc1d69b40e7309e23c405fc62e8bd60009116d3ad479b5c99b0a223ac21fadc556a2dbc954f14cad1f9161afad8c52f354551a3959c3510998a13db05ebd7702b0408d3920e38dd17b0dd5466ce7179dba4c67c64799798bb784081f6a73eaf4f11681266e0c2786db42ea091b3677f9ea58f86eb513e77dc2ae89c537fa2b00af16c2875022f9f4a56df05226fb5ebf26e0fdab20dc90ca94a658d7d65402ea466dda906507789ec89d1162ce215669d5d6ed64996660079d6d64fa0444875bcb243bae1098148c10208848aef5e10d5cf38cf2c35eb748dc8dc6d92da00363e703fa92406be1d1eeef5183d45c4749a103e444136a5995a635a3a93ab07852fafc3e4736228b9b9541b72ea6ed0f3ee3c708c762fbcf08b1460c1a534447752190b7692e0271b4b8dce0081010e7685d3497fb3e4bb32598dd42b078b2f024a18a8c616b1a3fea1e27a7a42f33e0e06e51d540ea40798d3c740f47d07d327ad62f9904120c22a5c2f3ec2150c5bed5fd1cbe1b7c1629982c960037b00ace882bff933c380fb977c770cc41af26746be9d706049f26b7d340bd1ae937f8bae0238277bd9f30fb19416c650b92e2c3f181136e0d5078c0fee6f8a07df6624cd5529745599f79e5348fc94b44f4653c96670aa21843ac265e4265d89870757168606f6c19b107ad597cdc844e22de617fcc2c86dae77bf2ee5b39a438a180ec259eef7ca649442162836b0a4bfa055087679c34047a68bbeba7e1d76e9d139b29f1232e7e3188dde0d689e1d07db5b0e424c3ed70317d164e7008e43fc27006e4ea82c8fe47c0b8d820f36af559418f57935408d5c63cf3759cbebfae65423ccd0dd815e3b3f422b5dd9c4a2dd3b68d4b9c435a7d8dc7d5cdafe52eae310e8b0588c8e6131cc8b349298e35bdb402fe22dd3628fcff89095218f5312b0f163934ac670026e81cf822e1160387c04f96753c8b58cf4718cca2ad597bcf8f7de7b5180249cc1977ffac41c101bbb46e5c272e4b05fa7d76e7b7e3098e833f1f65ebbd2992024b4da0dbbc32b80f93df24a8595e0a8ce641d2420fd5b45aa225b8b7dda6bcfbd2501acb8b7c9c626a07eab20c8c44160cb94bbedff8650e8081612bab933a44ac9ef4cc1c302a76648e10e82d7e25f1dcf8d1ba6e9d631f808129a7e82f562ddc135ef52dd18cc89c19b9b7f8ced6dc58a1666f1dd4aca5b5d1a47a43d19b4f0841d898c753dd569b74811094169f78df830ce3fbe9a69d722b2baeec43ac888fff8c8e9a9fed3ecf1866e84a10c4146ecfee5c167c3ebe60b437afad599784073f732779b0a9505ee006a78671b7fa7761aa34a6e06dd3f502ca6ca4d58f6acb79ce8fa6897adc854e43d4d1d62db5d243102c3251f8b1b672e67816c1774dfa26febf28af5b3da9b38b5fb2b33e2138f310e188d71beff84ecf482ac10ba9cdd16b23ae64e1474d762749cb3bb41d64a34ef1b42bfa82d4a6dd3d5941e5d38ff1edcb781b3d5973cd17c8265dbb8de0d2ed4731f4d8aaebd5f671479987d7097a425e96e2eb85edf1f0f5c47efa3da9cef1aa2ec21a3e49784f5897656510207a03e9ca1810a6bb16590c1677d615b7b43d707a9ec27a6a269e8243b294d101bd63d37dddca2453230f4062c9b3de05963dfc878edfbfbec60d416b130f0be517981f4f8161980fe00bdaf3b63f6dc10ab51fd6396f1ea29bbd147f9c656beeaa2777c0e11e418a725e66b00f530d22a1376e74c527bbdb1053dcadb7e93a7e958c49aa780fbcc4a495b3ae3fce76c6f38907b459ca5a53d2e827c6b2da163e212602078c5eec3f8ec40bd3738052c29a84087d1a3460b5253b4f5c14f7cd95645f90c2c5d7aef120de0b885f4c535a77a9c0d5069e7c78d9a8c4f1b86ff6cb81aea989f9f46c7a107e4fcf52167e28ebbc52244b3d8dbba6a9de9c717adc9db49a7d26cb347436343a4bd4eb7b71c96c28e3e23f26a1281c3204af40cc82a4ac8049b0951526f87b1ecc0069b461c9d377c260d0ed4aa57ccaf77fc8f79ff1549b6bce14576bd9788df61031ff57bd5b86b5e3fc272779a46a5fac9ef537af99937c63b38ffa8333bc412b0f0534eeeb8e1351678e906cb6214aaa5c87d30cbf3fd20e6203e6d441f89ded61dc580a6ce192b5e9366060fc44431d45c3d5b64a2b02c86dba294a5a8a7ea97ebd5187e865dce2656043ff09fb68d162de5bdc811a2a81f7f6b9bf08fa0d2579dada00a58081e2bb778e21d798e4dcffad368a4926d2702034483ff4396b882fe998f9ec73377095d9fcbb49689900db0be45f840f6ac715828b03e2e0751a408edf8fecb64e99114e091b1371839dbacf0b73b737a0ff2f989a7e3fe468625adead5591f3b23e893ff10cfefc66558830cdec1c320ea55c66db3ca6629f766a06916ee30eba3de85290e418c1156b85521fc1c13550ce0492d23dc2b070d782a4acebed1a0e0b263dfa2121b5f003bfe016e242cefbf11b9be1b37bf684046e3a9d793abbc750de11c2bcd19363b0fc7dc17fa28c3124278136407cd738095ca394d06b59f13c277c6cb4f77efa0b0eda9bfbaf5026ce00a6fac65d60ab68246000fd03ff8effb9a3c1da02d597b50eb4597f8cef3b09e2784c32c79b47249b76743a0350eb3c4a8a881b182bf02e624627ca2fee7ab3df82198b8f453c1c913dce7ed38c7c74fb8647a03f223c8a121e2443df7d791470c04f39e92ef9e2da1e29832d881cb79d9c01741704e610c2519a3f043b7dac32f5ba118b3ecbc87c0659a9a86e6649e2ea2271e6850f00e1469455f9603585725c98d51e64a600e6f71b8bfaa5278fe4a5bafe6fd75fc1940559597c36ca93205d36754fedb659b821a9fa5a153fdcee66315e8e63664d0bfe2be204a689eba849fb3b3ad7a395a0442b1cf658603d5b4efaeabacc73c70e84532e63d7cdb4bc21ff9061389a091033c98779c2b19e4c9113a0e7980b07f0076cc03ce5fde0f3a07803c2a0c3099166beb6512fa5243042d948770ab88cf8612cbe55061948e663c4e2a596c57edbb3de002ffcd0e02413812376e8169efaed0a4f98fe0e647bb53540aa3c47b664fc1ec9d46160349bfee216c2ddfbf980109862b9f0083cfbd5dc05ad829d060a5b5b76a23bac13862fb0f37a244f96c45055dda903257bdc6dee05625b9f5f9fc0c6710c47f946d38b77ac4691f260dfe27ad2b3ab9447188f13fae2c839ba90416aeb4d2e7553d3215a2561a6334e8a860db62c58ca8c43b9a2e7c11dd9d053ad5d1ef0ced4623e492e03fc503328e7b015ec52472674c02d8ccd9b2ba4067bbb70404871e2f3e2a6431146613c59e927260c5675b3dd2a3e548fa77bac79428d70a77bf446cc02b65d59a72651bf8752d651329253cca56693561fbf1405308d418808563240b54328bc619f91c45977af8d5056cad1971ee9ee8422504b0efbea1e3f17fdb8183d8f382631f1566abe6baba90f6b42acd831a9b21a02976ff44a9bc3952c42c783f0e421ada0ff5c22257b652cef7b95afab3038a630d0d492df395a258820f2141e1d37aee5b16db404a5ee755c7a0712b550cb4084cc7ef975985ad06331e329f33b0fc8e90c0") r9 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r9) ptrace$peeksig(0x4212, r9, &(0x7f0000000140)={0x0, 0x0, 0x4e}, &(0x7f0000000fc0)) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000c40)={0x28, 0x1, r8, 0x0, &(0x7f0000000bc0)="19e06b9202c70e9f48199d7313f6003fa7aaa5d97d30d5ead05fa36720d2c1bad39921aabce5c446a4a1a33faf71cbbf8716aaa8a8aba3e729d2a855c9f673f7f410c21c36c4f015e4a1150c373ad7dee298448489f45e35a3ef9658d8687192616573e857eee65d1e7549d1bb3c31ce", 0x70, 0x417}) syz_usb_control_io(r7, 0x0, &(0x7f0000000780)={0x84, &(0x7f00000002c0)={0x40, 0xa, 0x2, "41fe"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r7, 0x0, 0x0) syz_usb_control_io(r7, 0x0, 0x0) syz_usb_control_io(r7, &(0x7f0000000240)={0x2c, &(0x7f0000000340)={0x0, 0x21, 0x2, {0x2, 0xa}}, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000a00)={0x84, &(0x7f0000000280)={0x20, 0x18, 0x3, "36bca9"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000880)={0x40, 0x17, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x0, 0x0, 0x0, 0x0, 0x0}) 2.359888481s ago: executing program 4 (id=2172): ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000280)={'bridge0\x00', &(0x7f0000001380)=@ethtool_perm_addr={0x20, 0x6, "e1d85d1a0178"}}) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000280)={'bridge0\x00', 0x0}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000540)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x4, 0xffff2153, 0x2, 0xa, 0xd, 0x1c4, 0x7, 0x2, 0x6}}}}]}, 0x58}}, 0x0) r5 = socket(0x10, 0x803, 0x0) ioctl$TUNSETPERSIST(r1, 0x400454cb, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000800)=@newtfilter={0x7c, 0x2c, 0xca7, 0x70bd25, 0x0, {0x0, 0x0, 0x0, r6, {0x4, 0x4}, {}, {0x1, 0xfff1}}, [@filter_kind_options=@f_u32={{0x8}, {0x50, 0x2, [@TCA_U32_CLASSID={0x8, 0x1, {0x1, 0xffe0}}, @TCA_U32_SEL={0x44, 0x5, {0x44, 0xf, 0x3, 0x2, 0x7ae, 0x9, 0x8000, 0x65, [{0x7ffd, 0x20003fe, 0x80000000, 0x6}, {0x0, 0xe1, 0x8ad9, 0xfffffffd}, {0x3ff, 0xa, 0x76800, 0xd}]}}]}}]}, 0x7c}}, 0x20040054) getsockopt$sock_timeval(r3, 0x1, 0x43, &(0x7f0000000000), &(0x7f0000000140)=0x10) 2.313715228s ago: executing program 4 (id=2173): socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_open_dev$dmmidi(&(0x7f0000000300), 0x8, 0x920) ioctl$SNDRV_RAWMIDI_IOCTL_DRAIN(r2, 0x40045731, 0x0) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./file0\x00', 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000180), 0x42, 0x0) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000040)={0x5, 0x5, {0xffffffffffffffff}, {}, 0x183639ee, 0x10001}) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001680)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x8000}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x9c, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x74, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xc}, @NFTA_EXTHDR_OFFSET={0x8, 0x3, 0x1, 0x0, 0x3b}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x7}]}}}, {0x3c, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x2c, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x14}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_BITWISE_OP={0x8, 0x6, 0x1, 0x0, 0x5}, @NFTA_BITWISE_DATA={0x8, 0x7, 0x0, 0x1, [@NFTA_DATA_VALUE={0x4}]}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x110}}, 0x0) r5 = fsmount(r3, 0x1, 0x0) fchdir(r5) r6 = open(&(0x7f0000000000)='./file1\x00', 0x80242, 0x8) r7 = syz_open_dev$video4linux(&(0x7f0000000080), 0x0, 0x0) ioctl$VIDIOC_QUERYMENU(r7, 0xc008561c, &(0x7f0000000040)={0x980902, 0x0, @name="a13c67a9121fb71a1d3e142fe2fb8f9ba5ee159b867aa7d60668087c38d76487"}) write$FUSE_CREATE_OPEN(r6, &(0x7f0000000180)={0xa0, 0xfffffffffffffff5, 0x0, {{0x4, 0x1, 0x5, 0x6, 0x3, 0x1, {0x1, 0x180, 0xff, 0x5, 0x100, 0x7cf4, 0x9, 0x7ffffffd, 0xfffffffe, 0x8000, 0x0, 0xee00, 0x0, 0x3ff, 0x1}}, {0x0, 0x11}}}, 0xa0) sendfile(r6, r6, &(0x7f0000000080), 0x4d9b6eaf) r8 = syz_open_dev$vbi(0x0, 0x3, 0x2) ioctl$VIDIOC_S_OUTPUT(r8, 0xc004562f, &(0x7f0000000000)=0x1) ioctl$VIDIOC_S_DV_TIMINGS(r8, 0xc0845657, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r9, 0x8924, &(0x7f0000000000)={'macsec0\x00', @random="010000201000"}) 2.117035586s ago: executing program 0 (id=2177): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="380000006800010003001000fdffff7f00000000000000000c0002000100000c1500000014000600ac1414bb00"/56], 0x38}, 0x1, 0x0, 0x0, 0x800}, 0x4000080) 1.979331763s ago: executing program 1 (id=2178): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r3, 0x0, 0xf3a, 0x0) (async) close(r2) write(r0, 0x0, 0x0) (async) mmap(&(0x7f00009fd000/0x600000)=nil, 0x600000, 0x100000d, 0x6031, 0xffffffffffffffff, 0x0) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) listen(r4, 0x100) (async) shutdown(r4, 0x0) (async) accept4(r4, 0x0, 0x0, 0x800) (async) mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0x200000b, 0x8c4b815a5465c2b2, 0xffffffffffffffff, 0x0) (async) syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0x100e099, 0x0, 0x3, 0xb4}, &(0x7f0000000000), &(0x7f0000000280)) (async) getsockopt$bt_hci(0xffffffffffffffff, 0x84, 0x7d, 0x0, 0x0) (async) syz_usb_connect$midi(0x3, 0x49, &(0x7f0000000080)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0xff, 0x1430, 0x474b, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x37, 0x1, 0x1, 0x74, 0xc0, 0x71, "", {{{0x9, 0x4, 0x0, 0x0, 0x2, 0x1, 0x3, 0x30, 0x7, [], [{{0x9, 0x5, 0x0, 0x8, 0x40, 0x0, 0x9, 0xe2, {0x5, 0x25, 0x1, 0x1, "c1"}}}, {{0x9, 0x5, 0xf, 0x10, 0x8, 0x3, 0x3, 0x80, {0xe, 0x25, 0x1, 0xa, "e1bd3b6c69c7c5e0c79e"}}}]}}}}}]}}, &(0x7f00000006c0)={0xa, &(0x7f0000000100)={0xa, 0x6, 0x110, 0x1, 0x1, 0x81, 0x10, 0x3}, 0x8, &(0x7f00000001c0)={0x5, 0xf, 0x8, 0x1, [@ptm_cap={0x3}]}, 0x9, [{0x4, &(0x7f0000000200)=@lang_id={0x4, 0x3, 0x419}}, {0x7a, &(0x7f0000000780)=@string={0x7a, 0x3, "50223e8bba4571cfb73b47e2b2ba9e8dd11e2ac456334f81c640fa9cdabb7238f0ad4994578f0db603c281f793275468e23a3d2868b5ba646ee5e3efe3013e9135a42ceea76ebdba1fd891bd48e205feb9b4e4d5f12b9979f24716396e430016d83b7842c83cd2b1aa2c0eb620fb9a81a4b7ddd84701300c"}}, {0x100, &(0x7f0000000340)=@string={0x100, 0x3, "3e6d6d0dab4e6f16e660036d0bc8193edc6b464be8a3647b723566f6359abc5004a7959baa7d3b62a6b2c3936728b600e98414d9b7dd30e2901b2d8fe010860106cdfdf7453d513bf39adb79eda68f1bf36f823105c5c34c5639c2c85fa3cf21d5a4d052cfe52d35022863614f1bd2b020417809aa8186018454fde20e41625a928f8ab6e624842681310ce22ac1d4995c778cfc0c730caa108ffc6faaef0da8824f0ef5de541c70fb6aa7d61965e39416c822980f28786632d41a99a34b6770ca93d7609672064c7cce90821e31a495ef1e71b7ac46eacd497e7808b91dc7f2f9500902eb76994b105eab7ad842c732acc48a89cb63862e5d2ab024b199"}}, {0x1d, &(0x7f0000000240)=@string={0x1d, 0x3, "7bdadf88e436488cc2e1cc65d363bccce42432473b2e9165c64bf7"}}, {0x12, &(0x7f0000000440)=@string={0x12, 0x3, "6aedbdaa02dd5b4e40a0dd01377b75ee"}}, {0xab, &(0x7f0000000480)=@string={0xab, 0x3, "d27ee57187115a2cd168cf5743cb9d92e12583131581da9e6e1fa4484c63f7d5c67c665fafeedd75b1dcfbf2de73c3f15953afccc11e257d959a73181465f91bad89ba03ee2b69fefb515f343a674e72c2f28c7a1ba7deccab0cd4924a778f97e9d8ab0fa91e8146bf90015d550ee7d9438671b9aa1758d46d6317acd98c8b6ac52d24383441e103d574669be890a9f4bf231d83729ace7b5f7f8393e7bf1a683dc8ed97b29999ea87"}}, {0x4, &(0x7f0000000540)=@lang_id={0x4, 0x3, 0xdc9e}}, {0x3d, &(0x7f0000000580)=@string={0x3d, 0x3, "2e72a5a92ca4033740aab902483d9e9bb671a5d1af6612f5f1711113d9b6f8e8b03e58083f75d7aa669b4fc2aed59c574d9657194b4438914e2945"}}, {0xf8, &(0x7f00000005c0)=@string={0xf8, 0x3, "2821803d3156c7530c86211b129fc3ee8b8250c0f7180cdb2c5097bc79de35c9ea7127c82dbae1f828e49542ef3627bf4ae5677d6f29242b351d9550c8a0ce701d212ba52b5283102a17126b4adf8df0829aa8041acf9bb28231c45298b6383975b541c20722196e3e12054fd05d7a382e793db5e79207c18e93298e735306f101444e7d111d6f922e48bc052cc5d5f4610aea356ab86be69c9949aa18598733f56214797a0702e311bf3b88e0a35e4352d0b27c017d4920c83742683e525809334bc77dc4604bc6eeea56add1be0d19f738db97d61dc04fc40c2e1dd5a34a679e8483ac9eb7fce1233471f1695b1ffa390000000000"}}]}) 1.921660889s ago: executing program 0 (id=2179): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000001880)=ANY=[@ANYBLOB="b7000000ff00001fbfa300000000000007030000f0ffffff620af0fff8ffffff71a4f0ff000000002d040200000000001d400200000000004704000001ed00006203000000ffffff9c440000000000007a0a00fe00ffffffc3030000f1000000b4000000000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710e4d58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00c37dfca3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebaa2c598b4fc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204ab3949006c3172171652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d156ae8383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15f279b513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aa0000000000000000832371fe5bc621426d1ed0a4a99702cc1b692c3f0b15629eaf4c12a1e717d29135753208165b9cdbae2ed9dc7358f0e3adde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c3bfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbad937f778af083e055f6138a757ebd0ed93517a6b244f9acf41ac5d73a008364e0606a594807031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac42738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f62e96753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c25000000000000000005a7b57f03ca91a01ba2e30ca9be8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e1661261173f359e93d2c5e424c17998802008f0232b3955e052a4cecd89008f70314a0bdd491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b393cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91ed92cac7c2ccd17d338bbda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd849904568916694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a8811922928e000000ab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a09313b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abb8a9982ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028ad0c74e2a9478fa3be18a1a2b65079cc1c7bc46dd12305a1ae9dd19e8d525206c0a728cfd42193abe8130b51d6c9b94c5513df2d85e8c01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ad1012fd7a8139566fd5e59c84f4ab279b1b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336d205c5913ef670000000000000000ba470bfe6290421338ef8f6d27117cd1471bf3c0b64416fbbe955da0281e7ef7f7d5176150e86cda98d07f7de2088cb2ffd1d4c71097635c2bb3d9a0b01e757256ee427f0a244d48682bf89e2279b383b616b40f116172bc1b995eb2c1220597af8df52646f1f0cb65cfa7e038e8bb5d4d52b86a61d82dc14a4f5cc7e6061c65ccdbc2afc3f363ecf34ad0b227687c3ea8d63683ddd5914116edd9e075da9e3638647188bc8f95107c9250995eb6cadcd0f65b8504ff10304f2ceba275f9d485ed5554d64005db877f0fbb3beba59666ff66f132d5077835823592d6d392f5ff62f6f876eb10d8cbf0a73f8421b74c8916e4077b8866c95ad88bc7130244183ed216210f10f69b3e0ee13d06e4eb240cce5ec1c3b1defe4c0f8b83a34ef4f5f8f9ceefb678ad29d3683e3c44a01549e55ffca41c0b06e013f054257646c58b667ec0701004c239589b3e64ef5e1d5ed22b5fd5a90fe3453327c3652d5c9762428f0bd0178d1b80a60f64343ab77d8baa0a388711c8d2d6d3e9049814b15b6ea21387040989d69c3aa27256c55780f33d20823d8e2eb6e56850162969bf4c6c9632a55cf5be00"/2944], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xfffffffffffffd64}, 0x48) bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000003c0)={r0, 0xffffffffffffffff, 0x20, 0x0, @val=@uprobe_multi={0x0, 0x0, 0x0, 0x4}}, 0x40) mkdir(&(0x7f00000000c0)='./cgroup/../file0\x00', 0x88c64d537be67eeb) 1.396145547s ago: executing program 1 (id=2180): r0 = request_key(0x0, 0x0, &(0x7f00000006c0)='\x00\x000\x00\xa5^y\xa9n\x00\xe3\xa3\x89\x90&)\bT\x91\x14\xba\x19\xadJ(\xeb\xef\x97.\x9c4\x12:0\xb6\x00\x00:\xb2\xff\xff\xff\x7f\x00\x00\x00\x00P\x1d\x1e]\xde\x00D\xd4b\xd98\x82\xb7\x9a\xec\x18\xd5\x14T\x8f84\xd8\x91^\xd0\xd6\xde\x8ex-y#\x84\xdc\x93\xf7\xedZ\xcd\x1c\xa5C\n\xa1MF\xf5^$\xb0\xe4\x95\x03\x84X\xf0\x19\a\x9eI\xba\xf1n>\xac\xdfL\xa6\xc2\xc9\xab\x01\xea\xf3G\x18\x81\xa0\xff-\x1f\xceE\xd8L7c(j\x80\xc7>\xc0\xf5\xf0/O\xf4\xea\x16\xd7\xb1\xd3\xfb\x10g\xaaQ\xff\xd7\x03\xa2\xd8k\xa7\x85c\xa9\xa4\xc6N\xc2m,\xb07}\xe2/\xbf&@\xb6>\xd2\xeb\x81Rb{\xa6A-u\x19\x1d\xc3\x93\xc7\xa1\xc8A{\x93\a\xd6t\xf4\xf4\xc3\xf7\xc0[k\xdc\x92\x8bd]\xa3\x87\x06fp~O\xdf2\x00\xb2~?F&\xccX\xf8]\xd1Q#\xceF\x9cO\xfa\xed\x06\xcc\xf4q\xa8\x00\x00\x87\x80\xc9u\xd5na\x16\xb6\rB\x8a\xc2\xf2\xc3@F\xab%\xe7\xfd\xf7.', 0x0) request_key(&(0x7f0000000040)='dns_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='y\xa9n::e\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00', r0) 1.299948535s ago: executing program 1 (id=2181): socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_buf(r0, 0x1, 0x1c, &(0x7f0000000000)=""/77, &(0x7f000000c140)=0x5f) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101301) ioctl$USBDEVFS_CONTROL(r3, 0xc0185500, &(0x7f0000000040)={0x80, 0x0, 0x6, 0x9, 0x2, 0x0, &(0x7f00000017c0)="39c9"}) setsockopt$inet_udp_int(r2, 0x11, 0xb, &(0x7f0000000200)=0x6, 0x4) r4 = socket$packet(0x11, 0x2, 0x300) mmap(&(0x7f0000001000/0x3000)=nil, 0x30000, 0x0, 0x11, r4, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r2, 0x80045530, &(0x7f0000000240)=""/3) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000080)={0x1, 0x2, &(0x7f0000000180)=@raw=[@cb_func={0x18, 0x9, 0x4, 0x0, 0xfffffffffffffffa}], &(0x7f0000000040)='syzkaller\x00', 0x4, 0xff6, &(0x7f0000002840)=""/4086, 0x41100, 0x20}, 0x94) bind$inet(r2, &(0x7f00000001c0)={0x2, 0x4e24, @empty}, 0x10) r5 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_tcp_TCP_CONGESTION(r5, 0x6, 0xd, &(0x7f00000000c0)='dctcp', 0x5) r6 = syz_open_dev$video4linux(&(0x7f0000000100), 0x7ff, 0x20000) ioctl$VIDIOC_S_INPUT(r6, 0xc0045627, &(0x7f0000000180)=0x4) syz_emit_ethernet(0x39, &(0x7f0000000340)={@empty, @broadcast, @void, {@arp={0x806, @generic={0x30f, 0x805, 0x6, 0xd, 0x2, @empty, "ca089c7013dbb40f2220697368", @multicast, "9297658dcb35771f9c55"}}}}, 0x0) syz_genetlink_get_family_id$devlink(&(0x7f0000000080), r1) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000140)) (async) getsockopt$sock_buf(r0, 0x1, 0x1c, &(0x7f0000000000)=""/77, &(0x7f000000c140)=0x5f) (async) socket$nl_netfilter(0x10, 0x3, 0xc) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) socket$inet_udplite(0x2, 0x2, 0x88) (async) syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101301) (async) ioctl$USBDEVFS_CONTROL(r3, 0xc0185500, &(0x7f0000000040)={0x80, 0x0, 0x6, 0x9, 0x2, 0x0, &(0x7f00000017c0)="39c9"}) (async) setsockopt$inet_udp_int(r2, 0x11, 0xb, &(0x7f0000000200)=0x6, 0x4) (async) socket$packet(0x11, 0x2, 0x300) (async) mmap(&(0x7f0000001000/0x3000)=nil, 0x30000, 0x0, 0x11, r4, 0x0) (async) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r2, 0x80045530, &(0x7f0000000240)=""/3) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000080)={0x1, 0x2, &(0x7f0000000180)=@raw=[@cb_func={0x18, 0x9, 0x4, 0x0, 0xfffffffffffffffa}], &(0x7f0000000040)='syzkaller\x00', 0x4, 0xff6, &(0x7f0000002840)=""/4086, 0x41100, 0x20}, 0x94) (async) bind$inet(r2, &(0x7f00000001c0)={0x2, 0x4e24, @empty}, 0x10) (async) socket$inet6_mptcp(0xa, 0x1, 0x106) (async) setsockopt$inet6_tcp_TCP_CONGESTION(r5, 0x6, 0xd, &(0x7f00000000c0)='dctcp', 0x5) (async) syz_open_dev$video4linux(&(0x7f0000000100), 0x7ff, 0x20000) (async) ioctl$VIDIOC_S_INPUT(r6, 0xc0045627, &(0x7f0000000180)=0x4) (async) syz_emit_ethernet(0x39, &(0x7f0000000340)={@empty, @broadcast, @void, {@arp={0x806, @generic={0x30f, 0x805, 0x6, 0xd, 0x2, @empty, "ca089c7013dbb40f2220697368", @multicast, "9297658dcb35771f9c55"}}}}, 0x0) (async) syz_genetlink_get_family_id$devlink(&(0x7f0000000080), r1) (async) 1.217601213s ago: executing program 0 (id=2182): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file2\x00'}, 0x6e) r2 = fsopen(&(0x7f0000001340)='cgroup2\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) r3 = fsmount(r2, 0x1, 0x0) r4 = openat$cgroup_procs(r3, &(0x7f00000001c0)='cgroup.threads\x00', 0x2, 0x0) pread64(r4, &(0x7f0000000400)=""/8, 0x45, 0x1) sendfile(r4, r4, 0x0, 0x1000007fd) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f0000000980), 0x4000000000001dd, 0x10002, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={&(0x7f0000000080)=@nfc={0x27, 0x0, 0x1, 0x2}, 0x80, 0x0}, 0xff00) sendmsg$IPCTNL_MSG_CT_GET(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)=ANY=[@ANYBLOB="440000000201010100000000000000000200000004000180180002801400018008000100b04c94a708000200ac1414aa140019800800010004000000080002"], 0x44}}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, 0x0, 0x0) r6 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)={0x2, 0xb, 0x4, 0x5, 0x2, 0x0, 0x70bd27, 0x25dfdc02}, 0x10}}, 0x24000840) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x22004800) r7 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0xe) ioctl$KVM_GET_DEVICE_ATTR_vm(r7, 0x4018aee2, &(0x7f0000000180)=@attr_arm64={0x0, 0x0, 0x0, &(0x7f0000000040)={0x80000001, 0x1}}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r9 = syz_io_uring_setup(0x10f, &(0x7f0000000380)={0x0, 0x46ee, 0x400, 0xffffdffe, 0x32e}, &(0x7f0000000140)=0x0, &(0x7f0000000200)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r10, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r10, r11, &(0x7f00000002c0)=@IORING_OP_CONNECT={0x10, 0x40, 0x0, r8, 0x22, &(0x7f00000000c0)=@un=@file={0x1, './file0\x00'}, 0x0, 0x0, 0x1}) io_uring_enter(r9, 0x3516, 0x67f, 0x64, 0x0, 0x0) 1.211092494s ago: executing program 1 (id=2183): r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) r3 = openat$audio1(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) ioctl$SNDCTL_DSP_SUBDIVIDE(r3, 0xc0045009, &(0x7f0000000440)=0x10) ioctl$SNDCTL_DSP_SUBDIVIDE(r3, 0xc0045009, &(0x7f0000000000)=0x6cca) epoll_create1(0x0) connect$unix(r1, &(0x7f0000000140)=@file={0x0, './file0\x00'}, 0x6e) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000480), 0xc0d00) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r4, 0x4058534c, &(0x7f0000000180)={0x80, 0x7, 0x102, 0x2000101, 0x8, 0x4}) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r4, 0x4058534c, &(0x7f0000000040)={0x80, 0x7, 0x10000, 0x0, 0x7, 0x6}) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000e00)=ANY=[@ANYBLOB="3c00009525002000010026bd700006000000000001000000000606000100084002000a01010208000b000600000004000100640101000800010000007016935d364cc1cd00bb0a4b41735ea37f00cd1208553573b1"], 0x3c}, 0x1, 0x0, 0x0, 0x40}, 0x4004804) fsmount(0xffffffffffffffff, 0x1, 0x70) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000001100)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(serpent)\x00'}, 0x58) setsockopt$CAIFSO_REQ_PARAM(r5, 0x116, 0x80, &(0x7f0000000280)="fd8ae3b82cce62a802df8a997cfd4eea108e9447dc302098c2d555356b18489fd161ebd3c30749493e197a3757c17b23439faa12920710479182016d2537140a5e271e6b45b7438a51b9af303c87aeb45b902b276927f7d2b6f7617f3662f58d390cfb23fcb87c05ba48eef432bf59e7166559ac6ea927d030dcdd2da29d0427fd4c4f96a10b6daf8c1ea1ea00e5adae98379f5b784e0159809166e38d782a9e1de363745d604df3fed71495d629122b", 0xb0) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, 0x0, 0x0) r6 = accept4(r5, 0x0, 0x0, 0x800) sendmmsg$alg(r6, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000006c0)="e3a0e9796cfd1647e299f4e376fdba128280be72219d205e81f4a7f71c1926a2e1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b36006007b4fe035bbb095873048ec471be46528eae2643ab1296ad1e04853cc2b5b679935c6373fe9c4000be9f5241cceb34bb8869e981d7626cbd0d5b7b40722a1e049d9cd94e771559e23d24f6c8fbab8952c60c4efa1681047b70299d03073f4716d0f535805d8fcaae7e831cbeb59b56c707c9c4495584cbbf198e4b254efd9440c4565088064b55dccdc6329261f6b4f9e9b3343423dc79faa8f49827f6b06a0257032593a221df10c36bf89b65552dccf90d205c2e49b1eb3ec3ccfef9ba190fc1f54dd2ed4d12b8001786c98ed1a67da7b545f7cc7f2548ccaf4dd68a1050c4fae45a5d1f78291ec032a66e9c2d51a9f57b13d7d3b8bebcc5e0d328dd118d910ebc83678460539e590f6d45260e93efdad2af2b0364255e0ec6157c410795739692675940d66cc18bb851d7b620c0dcb84a44d34ca7bcea0ec633b8713ffbef46d10979deefe9941083846fee2b0666bb0142afb8b2f5ec9a4b05518fb0e40c1a15bc4008e6fd228b6e418e87df00dbdfe1b8d7527bdd598c1d48fff2325c1e17a0e987101a32326190d07bb53997295b97a463add6479a60ab5fab0377a34e298c22dc349342cd911274ad5e4864280004f8e31853cadc2ffdb10786e5382c7f978d5b2ebc6218bf55b72b8128962", 0x211}, {&(0x7f0000000480)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158dab05f9f37e094750e60465cc7c24a854ea51fc24580c40dffc8a355e38aa7f19ce94e116cea269988452ab369df6f891abff9f24c0a00a0f4e86ac7017ebea935728bc6103d6bd5ee3ed5ab3b88f5fcc6d9e0fd7bba62b0cfc3f8b938dc6f9195c1f695088d745523e40464dd6f0f0fb8150d6b452d0be3b952a7c2c520bc6ebe018a6a7f32292d22f575", 0xbd}], 0x2, &(0x7f0000000180)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x20040800) recvmsg$unix(r6, &(0x7f0000000cc0)={&(0x7f0000000340), 0x6e, &(0x7f0000000640)=[{&(0x7f00000003c0)=""/21, 0x15}, {&(0x7f0000000400)=""/78, 0x4e}, {&(0x7f0000000900)=""/205, 0xcd}, {&(0x7f0000000540)=""/100, 0x64}, {&(0x7f0000000a00)=""/155, 0x9b}, {&(0x7f0000002b00)=""/4096, 0x1000}, {&(0x7f0000000ac0)=""/146, 0x92}], 0x7, &(0x7f0000000b80)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}], 0x130}, 0x6) recvmsg(r6, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000001180)=""/4096, 0x1000}], 0x1}, 0x0) r7 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX(r7, 0x84, 0x6e, &(0x7f0000000000)=[@in={0x2, 0x4e23, @private=0xa010100}], 0x10) ioctl$UI_SET_SWBIT(0xffffffffffffffff, 0x4004556d, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r7, 0x84, 0x1d, &(0x7f0000000040)={0x1, [0x0]}, &(0x7f0000000080)=0x8) sendmmsg$inet_sctp(r7, &(0x7f0000002ac0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000d00)=ANY=[@ANYBLOB="20000000e9f9d7cb1da2844b02000000de010102440000006f000000a395d1e8bcd5c3d0c466ba6013e929802f0bff0c11b4504b15f179f66616c38329d5d44e6be84d4d0f1f992d904fb62808a8b32f21f712cd1d7f2882d1c6ef64798c99fec011f3b6d846866a57456afeffff6158184d0fab506a407245b0a5b5bcbccedbd15de202234e3c409a9881f51b44a1257264149cbf755cfd0191d9436d4b9582604b01c1bd4d2779f41358205052c796b02f80612fbe5de887320e98a4545ba826178954293c1b9198679aaedc7402ff4dc8795793528ec27095ef2cafa1607c5a59a565fd", @ANYRES32=r8], 0x20, 0x20008001}], 0x1, 0x24010000) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r6, 0x84, 0x13, &(0x7f00000000c0)={r8, 0x52a8}, &(0x7f0000000200)=0x8) r9 = syz_io_uring_setup(0x1215, &(0x7f0000000500)={0x0, 0x7d10, 0x20, 0x0, 0x306}, &(0x7f0000000000), &(0x7f0000000580)) io_uring_register$IORING_REGISTER_PERSONALITY(r9, 0x9, 0x0, 0x0) 1.107866603s ago: executing program 4 (id=2184): r0 = socket$kcm(0x29, 0x5, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000240)='net/kcm\x00') preadv(r1, &(0x7f0000000200)=[{&(0x7f0000000040)=""/68, 0x44}, {&(0x7f0000000280)=""/103, 0x67}], 0x2, 0x0, 0x0) syz_usb_connect(0x5, 0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000319021508fd070100e56a010203010902240001080a40040904000702b95fc30309058803200006020409058302"], &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_SYNC(r0, 0x9408, 0x0) r2 = gettid() r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)={0x5c, 0x2, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0x3}, @IPSET_ATTR_BUCKETSIZE={0x5}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_TYPENAME={0x10, 0x3, 'hash:ip,mac\x00'}]}, 0x5c}}, 0x0) r4 = syz_open_dev$evdev(&(0x7f0000000000), 0x3, 0x822b01) write$char_usb(r4, &(0x7f0000000040)="e2", 0x918) ioctl$EVIOCGKEY(r4, 0x80404518, &(0x7f00000001c0)) ioctl$FIDEDUPERANGE(r1, 0xc0189436, &(0x7f0000000380)={0x7, 0x1, 0x6, 0x0, 0x0, [{{r3}, 0xffff}, {{r0}, 0xa4}, {{r4}, 0x200000000}, {{r1}, 0x5}, {{r0}, 0x9}, {{r1}, 0xffffffff00000001}]}) socket$inet6_mptcp(0xa, 0x1, 0x106) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) syslog(0x3, &(0x7f0000000200), 0x0) prlimit64(r2, 0xd, &(0x7f0000000000)={0x0, 0x100}, &(0x7f0000000040)) prctl$PR_SCHED_CORE(0x3e, 0x2, r2, 0x2, 0x0) 342.712195ms ago: executing program 0 (id=2185): mmap(&(0x7f0000735000/0x4000)=nil, 0x4000, 0x2000004, 0x6031, 0xffffffffffffffff, 0x23a2000) mmap(&(0x7f0000abb000/0x1000)=nil, 0x1000, 0x0, 0x102000200032, 0xffffffffffffffff, 0x87f64000) setsockopt$sock_timeval(0xffffffffffffffff, 0x1, 0x2f, &(0x7f0000abaff9), 0x10) mremap(&(0x7f0000ceb000/0x2000)=nil, 0x2000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) (fail_nth: 11) 269.305783ms ago: executing program 3 (id=2186): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000100)={'ip_vti0\x00', &(0x7f0000000080)={'gre0\x00', 0x0, 0x700, 0x7800, 0x0, 0x2, {{0xa, 0x4, 0x3, 0x22, 0x28, 0x65, 0x0, 0x80, 0x29, 0x0, @local, @private=0xa010100, {[@cipso={0x86, 0x13, 0xffffffffffffffff, [{0x0, 0x6, "1612364b"}, {0x0, 0x7, "bfe1177708"}]}, @end]}}}}}) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r0, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x70, r1, 0x400, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_ADDR={0x54, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @initdev={0xac, 0x1e, 0x1, 0x0}}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x6}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast1}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @dev={0xfe, 0x80, '\x00', 0x40}}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private0={0xfc, 0x0, '\x00', 0x1}}]}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0x3}]}, 0x70}, 0x1, 0x0, 0x0, 0x4004005}, 0x11) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$MPTCP_PM_CMD_ANNOUNCE(r3, &(0x7f0000000400)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000003c0)={&(0x7f00000002c0)={0xc4, r1, 0x4, 0x70bd2c, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x1c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @private=0xa010100}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_ID={0x5}]}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x4c, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x4}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private1={0xfc, 0x1, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e21}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @remote}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r2}]}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x9}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x20, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private0={0xfc, 0x0, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0xff}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}]}, 0xc4}, 0x1, 0x0, 0x0, 0x40800}, 0x4010) r5 = syz_genetlink_get_family_id$tipc(&(0x7f0000000480), r0) sendmsg$TIPC_CMD_ENABLE_BEARER(r0, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x404004}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x34, r5, 0x1bbae3fa9a32afb, 0x70bd29, 0x25dfdbff, {{}, {}, {0x18, 0x17, {0x0, 0x4, @udp='udp:syz2\x00'}}}, ["", "", ""]}, 0x34}, 0x1, 0x0, 0x0, 0x8080}, 0x8) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r6, &(0x7f0000000640)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x38, 0x2, 0x6, 0x3, 0x0, 0x0, {0x1, 0x0, 0x6}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_TYPENAME={0x16, 0x3, 'hash:net,port,net\x00'}]}, 0x38}, 0x1, 0x0, 0x0, 0x24008840}, 0x174222467f5db027) ioctl$DVB_DEMUX_DMX_EXPBUF(r4, 0xc00c6f3e, &(0x7f0000000680)={0x2, 0x80000, r3}) ioctl$NS_GET_OWNER_UID(0xffffffffffffffff, 0xb704, &(0x7f0000000700)=0x0) sendmsg$nl_xfrm(r7, &(0x7f00000008c0)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000880)={&(0x7f0000000740)=@delpolicy={0x110, 0x14, 0x100, 0x70bd27, 0x25dfdbff, {{@in=@private=0xa010101, @in=@dev={0xac, 0x14, 0x14, 0x3e}, 0x4e20, 0x9, 0x4e21, 0x0, 0x2, 0x10, 0x0, 0x67, r2, r8}, 0x6e6bbd}, [@sec_ctx={0xbe, 0x8, {0xba, 0x8, 0x0, 0x3f, 0xb2, "1113890f5a25dba52f0fdad2fdfd55e21c5715d878b1df954b139cb1f4f0fef44199ed862aa88e054c81263aa10dd467575f35d5c04cb3a617c1945b63d818e6875405169e18b105042bb6d15f267f5756005f300896ce9e849d1fa3781c8871ee8908189da2cbb1c508503c52ca30d0e73face8ac4b9d3d634b4800602f9f93c03413b2c1a94312b278b4e3b62b603962a928a15155173a06afa2efa3f07415c55b2c91d7743290c80cf9aca3e5348ace66"}}]}, 0x110}, 0x1, 0x0, 0x0, 0x10}, 0x219e2b27c39d0bef) r9 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000940), r0) sendmsg$IPVS_CMD_DEL_SERVICE(r7, &(0x7f0000000a00)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x3c, r9, 0x400, 0x70bd2d, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0xe}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x10}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8001}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x1}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4004}, 0x804) socketpair(0x1f, 0x800, 0x8, &(0x7f0000000a40)={0xffffffffffffffff, 0xffffffffffffffff}) io_setup(0x4, &(0x7f0000000a80)=0x0) io_submit(r12, 0x3, &(0x7f0000001c00)=[&(0x7f0000000b00)={0x0, 0x0, 0x0, 0x3, 0x3, r10, &(0x7f0000000ac0)="4d5157a2bfbe76d6b583baa383625c773ca5b558ea2754dec1ea6385da3fb17303ebcdf26ce3bb18d3f7fa8fa63aef569213", 0x32, 0x7ff, 0x0, 0x5, r7}, &(0x7f0000001b40)={0x0, 0x0, 0x0, 0x5, 0x5, r11, &(0x7f0000000b40)="08315acb9a31c00fce77e9190c3b4e8e6f02b1ffe81a3b7dd7b3f4ce18d075330f09a0ebf75bf6fab0491ee8a57a101fbea510f037348f0d6b0a49778405ca329b4c12b052208a7c6acf056b0bd45fe775318e10e14ce60c34c181b7c6db9d134fafa45b35eb13c930349c45cc8da492b44667e521d92aae27f5f9f409a26d53f0028f4077ca50919e1e5fb7833b849dd7e6e9169b39e5d0c7510c2bd0b6948f344eac408278091268471461815988f365772615d60c8b4407572a7a1d0b97088d70d1afa8e3d8897b37df43dd2ad44af471c439bc7804ff915e44be8d75358b8a0fb07d8ef944986aaa2610da08a65e3a558d545256c497ede4437191ab527943412e3dd03671d42d6436936dd30206ec686bbc74c2d21164e6b2f0c9ae2af27ee318765a15ab12f20a44bcdb117c191843936e524c382cbc3640d87f8c5b3780d437bf589d653749763a8f9bbc9b7fdb0cb2d6996ae9878f767d5725a62dfd1eae999b37087059cba5f5813cdefe98dab11be9d5baca722529fd6de188866f5ce9fe6cbe23cab8d5207fb1236845f9a86d1eda136b5a10dc8eb030c8ef5eb8b7cf3f5283e9d39557d64cdf25666b52f7e0f545df4ee089c5090c8cd6da18ebbaeedab385924851755fdadb8eafc1dde5bdd412f0df5c1b4202ab41f57c046651eeb5e847148d7676721b5fa228b9854389f73b0076bafda77eaa595e2c60491ef8cc640ad610671b5040bbae3661aa646b950dffba9af7ae6c16aa9658a1f472d02384906bbd62b89fd50882dd1cb1300de909a255dc8a873edbfc27e781a2d685563d493def7f32ca7ca32b98a0fdd3fc705a7e6a21865c2a6b59aeeb7ea3b135d84c075979b7ff7890899274349c00cfad81b57285470dbf740d51b2110da27a9d1344cbb57bbc4412a2e8f1a744156dda35a04e3135c21e9803b7ee9be045ba1d71fa9ee7c4dfe2f9bb0528d6d4ea45e0209f69f50857d88d13bac279ba029c3c2a31f21711be624ed8197b6dcc3121d4fc8daf416f466e53e37dfc03b1e074fd4bdc4170fa3aa1b92f7c791adc4d3b0451212de554c8829deb1536b7edd3f0c979b30a892244bcdf2cb2e61fc6c0440ea370951a17bf46cb5ec7463fef1b361a3ef0d743152e8eaff3d46ba29565370ae0fc946a4ec0fd5e627eb768a6c1e08a7802e7ed4635ae4fb605cd46bbf864d9a9930dd5dc63763c0e4f7d12e43e023a4191f03e4eea93bed82db0f16b0b1df14c0fda6bde9db2685a38bd66b3801846079761857852517c4f1fcecb295135e8ef5f7cf872b2fc1c922f432927194c2c32d206867aacfdae33c0536e76edf890b6dbe326763a5d391f623226f58284e117280fc3c0ae4d59caf1b95b536b1e8511e5fc643d3bbbd03060a0ebcab62f8e921f57681690c620774bc3f6ab1fff4e11b736514d88ead2821edb32d1ab8c8d883af5c33c2a1462c3518089afcec936a8c894944f2c5048b607cad1dab49bf89335b9e68f779921590d882424acef480b1e4df28618dacfa570d9d1f4841b1f51f48a0ae1c0dc5c008a373dac2fb81b8beebde495c5e007ade3661764b4c5c8e480a475f02da431eb45b0287650d40f39fb2be7edba003d5430cea4643b2fa282b8cc3d237e73bbea37546e96c06921e95d73ec0db72e4ea337a070a1afa873322d4ffb2a3d2f9f472ad040fd248aa7ab9cf48ce3a518565c1e3ef71fabc5449810559b25efcae6cc9397cf26c43005968aae57d07f225aaa7c03c6fdce0831c9dd9a7820814d5db82207e5003790652fe1518d2b3528cad865e7a33c653c7048af9efb312f82a6d7aaf5b01d178cad2df12ffd1a14b8271c86cb3b8c4b0af3689be0a552b27b296232749703fc8997854376292dfecb7d9f56113a0498a93b254c8e482d28d1094c1f8ab51f30886c417fd9dfd2635ec772364224119df932cf9678df2951a50db994022cd8a9c26839799abc3536f803f83185a043ac6b1200113f41167b6af412c0d3640a9b45109f16231bfd21dcd539a2a0fb30764be224d04aba21bb06e453717d5b690689520640032c5fa0793eefc53cb57fff5fcb399cda42777663f1830d10a9033d9d1153737b3439d857241f89f94a4f3e0b389cf71027a922fb727a78482d1833b6f89145d50c2b1d9edf8dfc4c2fff4d64c2383668cb3a28e45b8b2bd35d9134f6f34c2cd515368e68a10809d0ea33a1f8a3d63cb4f0ac676e8318d6e21ea7aad01bd965ff1de00d82ab89021d3f4d328b1bb7dcac8db9f31e42c9624cbc5904e7baf25c9edcd118fa542827515c61acbd10a63642160ae7c62219f2c0f1f3dad4a1fb632ac70c7a9a5c148466dde173a2569df2602a33ce5852118155a94c33f576304d03c659f04b1064eb92c8e825bb9705292104dcd97edc6071e04d2ae892d7d1e1b5e07f02c3b4c7b988e2102ece6dd2abb6f45903d26483a0eeb305530e98c76483c7fd78b4b82252b275e533df20ca20b09fb2ac93425c74f8900bb95ff49510e31ddfd8709fa91be9eadcc0a7e926e041ff495abce5095d3d495489f4105f2cc24b71527f407ac923f30956788f04a1c8fb04017534359fd8f7af63a78f2e8594856fcec219001c9ddfecb0db99f873dd209f2e6b3bce91e81e77dd98bafd086ad7c3e1bef6a8b00688229674306a9057cf0b53bed2ff1ed76f73ed59ea02d6345d2bc30ee2a8e42e4c3dfdce3c3cdb097c7987a3fc8e891c69d96a0b279a141b8d28ff4bf7a822bb5a42f66e1ac3bf9531ee2bfa972feea1b1f87192fc17de09f4683aa1f013a396f1ea231b616d49c0df32240f7d48cae6608cd39607e66d67eb2a5106cb950940325f71650ea906a69a43686cc678f5b7bd112b437f37ed3baec18e82cde5fc6f2807569c83c5e0ca05d9e5bcc310267652f06513ad29290ca0a0c398acab4613bc49b3542dac3a6f3ac2d443034e8b732631a768cc0280d601d35c2695be2fea2835bb9b44863ead3ea86b403d924849b513a3a86ddfce80093d3d0df8371bc1e76bdba0d0f065d4a400a73d49227c0e97bc198ac05c40a68d5e74f5c7dbd0090b106c913027b7c6e0c5994627b98a03d5f70d19a7a23cf9ea8afb332dffacc8699c6586c30446a2d58147421459f5df155e29b16076619b6649e97f23bf814b035db682383259f514db2e5dbbe3d49489ccbec516c59810cc5acc802301aea8c7d42e2934fa46989bb983a3174debb28d6555e7965cadccff8a8f78d0b20bbe9fe2ccc248a858f217873f6be33ec5499a11992e6d657bc04a079c99847d99098780bed2e558df1d65a373271c4c99fa180f574c1b9230026cb2768c65550000585a11c732ecb21f88ae679f820ab6bff5e295af30546a5c8c16180ae9587b322576ba8ccf4d20ceca63fa231756756415705fecfffcb3b145f780e8b713457017ed35a88e62243cab8ed3a92b67b4c7b96eb8fbbfb6bc3c36af88b34643566af086d3a7111b805c9918f53701bee7ca4047341f84cb6f1e65b63f3eebc4607e02abd3591cf1ce31a7ba08bb7e4297f0bef1b7a1840e67b720d7e91105a01121d1869afb02f2ce158954fdc80fad1d188132e056c44816d4c19a057a4c3a0845f484d470ab55f1dfbb2a8526a8bf54bcb71175c8d927b24d5a52292f7f86d4b733be2cfb9bb6255bf26e1619e14f63fa955a17c6b952c0cb48b7aa3fbd258dcb59897566f62238ca45d41e3d055b0dbd11839d90ff202760e0173034857e79dec64c7e1975101f6f3572d3dc1b10cfce238b8968b6f959c06f8dfca6ce5e6931aec8c58d99396bee73193b833642866ca1bf5501aa0e38261008b568675a51ddfd740afc82fe64fae4a1efc5458f8c0b7e932f4087e09b8999d626ee6f1d80ce361ce70510e9a0141f0df3886067d2f73b1b3693b55c975c8f1bb0cf974e4ba2012a82e8c93bd5477cba1d11ca90a3e718df9f429d3eecb99f85872bc7bb7687b5e7b9a35b0aebeb5508dc19d442191ea41d3634e60df15828a5aaa8e6290a571a6d93adfb331cc62889afe412531b5d83f28343c134c7f2b5bfef3a1b90f72bcec4834bc100ea5b85cb5bc28ca9d81a31af710bc3a3ef3855d54deff0101aaca0de46e63958123fe81f8314724ac714ef607aeb7ef1d16977d20b5759b41a564fe25e6fc19617bf64e2b519f2685882410615e11fca3cd8a0e9a6a1d93743dfc6b28788ee5d2ec1d477a737731d1a46bf92243a50ec5af010fdacd91dc0c2b1823920fe8ea7ae65ed93f93d44e481953e9608e702c49ae50b9ff5ab9ca6d8eae571c3c4f6da9943eb63c5db364b150410b926429e85780bf6046d645420fb946dec87b15d1e9b85d194bd89e9af86b6ceea063d6fca2951a29546c7de34c11bc977775226b53e9913316129eb7d1ac848d20f17bc62eb3d9d129ab5842474ece41eee86368f495147b287fee839a9795eae1b4794d7d4acf58a46a8fc95eecd9f051f1d61b583aa63dbfbf5ae44cdd1be15a6200deba56d91114f029a4701fbd21c5c16a2a44cc3d88eeceda6bdaeb0b066a817c281615f770f21733f8034b20cb66c0b03589582adbf27acfde6f55463644386a816be0fd805ab2cb5ecfce1923eab994b705c9062e3d9c7eaec8fe53c0ba1d6f7e8681df3e939c89cae162f5e0323a2216eb20eff47222ced23137aaa3b726ed32e00a94ba0cc2d35872912791ab5a841027f5dace6cab2f3e12c7a289c2c0e91f9a7345bf7832ca6697dbcd2b6ef17270fde485e951ea72fb12cfc37ff0b2dafbd11cdb5c300f877361f1bf3cbbad85391aa68f8bb236546280b8dcc83618cc42249e8d7cedd4fba5ec05e60175176527fc22ab4d1a41aea16b392ebd53a062a530dab500d84e21fb89be83f51c3a1542ab2cef641f66156b5a585ee565f1d4a69970183c7c8077e9de97c7434b16918acdce62bd2d1ae1c189b65617ec230aff290eb57faae17bd17939632aa4a7cdeba55a62f5b191e777d01eb410c2a298a1dd9d3626e3b337c0442dec79b7b636c0ea7cdffa9032c30f431573673e4436c5d4653f7a6e8fc633002d92d31c361cb01f0d520f3d73f4a50cee9a59d5506949bf3905a59c0e773b593aeb3489bbbb63f5f94c85535c81028ffbb52db9df2dcc2f5eae75340ba4e079c116dfac401074800fc317a9e36448d3b30d51a0d595ecb9ca06d651f788541bc79795335beaa60a71a7d9458c7ff41148f486755c1417bd064bffb99834eac327c0a622760bb68ec21dcb1366f5f3981e4ba4e6980043f684fe091f67b86cba289a4dcdc95ad93badeb40bc6b1412716472b8f7c4641ed59d270717ace430be53a6b819b24e5329df3c653f05d5b8ae851acd9ca58678428e7b87e5eb4657979d3089e22cccdd7e1b1614e5ce1f12ab4f24470b23de4ce6e1fdc211c43ad65a73d0ea37fe89b01dff4121e52e5e25885663e70b86b778a10c8dbcc1f8d2c473160275036a177f02b56743420aad3029ad0ba551f92a31f5c527e011ed27626585ebf767dbf608ed0f4310a7f2edd6181464ce068983008f24c9dfda7d4be6ea0b44b8bc24e5cdd28498737181259b2bce415a662c6b85294031200c0fe317cfde745387e7dd01fc42ffadda3c8347aa9697c158fd71ecd36a1e4ddaaaea67e5575af7527bc11aea8600b04f63ca391586e0d0569a1b8f67b91ad925a810f0186765f7d06cec504180da4158c65e5f69ed00fa687c578f3dded014a351015f77328a26f7b1f821a521e28afe0b46a0aff672a67bc6c3665d864792a56da7fdba72926f6", 0x1000, 0xffffffffffffff81, 0x0, 0x2, r7}, &(0x7f0000001bc0)={0x0, 0x0, 0x0, 0x0, 0xe1, 0xffffffffffffffff, &(0x7f0000001b80)="2d33736d517ac1be50c48d", 0xb, 0x3ff, 0x0, 0x4, r7}]) faccessat(r7, &(0x7f0000001c40)='./file0\x00', 0x2) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001cc0), 0xffffffffffffffff) sendmsg$NL80211_CMD_DEL_PMKSA(r13, &(0x7f0000001d80)={&(0x7f0000001c80)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000001d40)={&(0x7f0000001d00)={0x3c, r14, 0x20, 0x70bd2d, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_FILS_CACHE_ID={0x6, 0xfd, 0xf}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_FILS_CACHE_ID={0x6, 0xfd, 0x2}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4008044}, 0x800) socket$packet(0x11, 0x2, 0x300) r15 = syz_genetlink_get_family_id$devlink(&(0x7f0000001e00), r13) sendmsg$DEVLINK_CMD_RATE_GET(r0, &(0x7f0000001f80)={&(0x7f0000001dc0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000001f40)={&(0x7f0000001e40)={0x100, r15, 0xc00, 0x70bd29, 0xa, {}, [@DEVLINK_ATTR_RATE_NODE_NAME={0xe}, @handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_RATE_NODE_NAME={0x82, 0xa8, @random="19c4dbb46de58c31508c55ebfc9cf5e7eefee93ce446791f307bb9beaae9b9e05f02683955ed7e968842094815a6e2b8c4f2f28f62bd1bc54c430437636a645e771a3ef87f8ff7c73fa28be910ba3bb6026975535218d9f7ccd9479f126b6764c457d25edc96f9b5520c2c63b0f8d64cde3dd72e3a45207824097c659663"}, @DEVLINK_ATTR_PORT_INDEX={0x8, 0x3, 0x3}, @handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_RATE_NODE_NAME={0xe}]}, 0x100}, 0x1, 0x0, 0x0, 0x8014}, 0x4040040) socket$netlink(0x10, 0x3, 0xe) read$FUSE(r7, &(0x7f0000001fc0)={0x2020, 0x0, 0x0}, 0x2020) statx(r7, &(0x7f0000004000)='./file0\x00', 0x6000, 0x100, &(0x7f0000004040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getgroups(0x6, &(0x7f0000004140)=[0xee01, 0xee01, 0xffffffffffffffff, 0x0, 0x0, 0x0]) write$FUSE_DIRENTPLUS(r7, &(0x7f0000004180)={0x158, 0x0, r16, [{{0x3, 0x1, 0x9, 0x8, 0xfff, 0x1, {0x5, 0xfd, 0xc, 0x2000, 0x8, 0x4000, 0x1, 0x8, 0x7fff, 0x8000, 0xffffffff, r8, r17, 0x8, 0x3}}, {0x4, 0x6, 0x9, 0x4, 'mptcp_pm\x00'}}, {{0x0, 0x1, 0x2, 0x0, 0x0, 0xd431, {0x1, 0xfd0, 0x4, 0x5, 0x52c, 0x100, 0x5, 0x2, 0x8, 0x2000, 0xa, r8, r18, 0xbd, 0x13dd72c0}}, {0x0, 0x5, 0x8, 0x9, 'nl80211\x00'}}]}, 0x158) 241.896899ms ago: executing program 1 (id=2187): madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) sendmsg$NL80211_CMD_ADD_TX_TS(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x64, r1, 0x400, 0x70bd29, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x9, 0x80000000}}}}, [@NL80211_ATTR_USER_PRIO={0x5, 0xd3, 0x2}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0x9}, @NL80211_ATTR_USER_PRIO={0x5, 0xd3, 0x3}, @NL80211_ATTR_TSID={0x5, 0xd2, 0x9}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0x80}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_USER_PRIO={0x5, 0xd3, 0x6}, @NL80211_ATTR_TSID={0x5, 0xd2, 0x7}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000020}, 0x45) r2 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0xc, &(0x7f0000000040)={0x7fffffff}, 0x10) sendmsg$kcm(r2, &(0x7f00000016c0)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000040)="2e00000022008102e00f80ecdb4cb9020a", 0x4a}, {&(0x7f0000001700)="0c74c75350f4a590e15c61c7942348092734fe1863473bbce6798a60e9", 0x1d}], 0x2, 0x0, 0x0, 0x10}, 0x0) (async) io_setup(0x9, &(0x7f0000000000)=0x0) (async) r4 = open(&(0x7f0000000180)='./bus\x00', 0x8107e, 0x8b) io_submit(r3, 0x1, &(0x7f00000002c0)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x8, 0xc, r4, &(0x7f0000000040)='\x00', 0x1, 0x400, 0x0, 0x0, r4}]) sendmsg$NL80211_CMD_STOP_P2P_DEVICE(r4, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x14, r1, 0x100, 0x70bd28, 0x25dfdbfe, {{}, {@void, @void}}, ["", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x40}, 0x804) mmap$binder(&(0x7f000000d000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x8000000000000) 0s ago: executing program 1 (id=2188): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000100)=@newtclass={0x24, 0x28, 0x800, 0x70bd26, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0x9}, {0xffe6, 0xfffc}, {0xffe0, 0xf}}}, 0xffffffffffffff81}}, 0x80800) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000500)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000003680)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128\x00'}, 0x58) r3 = syz_io_uring_setup(0x10d, &(0x7f0000000140)={0x0, 0xbcb7, 0x80, 0x3, 0x1000}, &(0x7f0000000340)=0x0, &(0x7f0000000300)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f00000002c0)=@IORING_OP_ACCEPT={0xd, 0x40, 0x0, r2, 0x0}) io_uring_enter(r3, 0x3516, 0x3e44, 0x8, 0x0, 0x0) r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0), 0x80, 0x0) mknodat(r6, &(0x7f0000000240)='./file0\x00', 0x8, 0x3) r7 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=@newlink={0x5c, 0x10, 0x401, 0x70bd26, 0x25dfdbfe, {}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @erspan={{0xb}, {0x18, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}, @IFLA_GRE_FWMARK={0x8, 0x14, 0x9}, @IFLA_GRE_ERSPAN_VER={0x5, 0x16, 0x1}]}}}, @IFLA_IFNAME={0x14, 0x3, 'nicvf0\x00'}]}, 0x5c}, 0x1, 0x0, 0x0, 0x8c1}, 0x80) socket$inet_tcp(0x2, 0x1, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) r8 = syz_io_uring_setup(0xbdc, &(0x7f0000000640)={0x0, 0xec25, 0x400, 0x1, 0x40000333}, &(0x7f00000006c0)=0x0, &(0x7f00000001c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r9, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r9, r10, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, &(0x7f0000000600)=[{&(0x7f0000001800)=""/216, 0xd8}], 0x1}) io_uring_enter(r8, 0x847ba, 0x0, 0xe, 0x0, 0x0) sendmmsg(r7, &(0x7f00000002c0), 0x40000000000009f, 0x0) kernel console output (not intermixed with test programs): 89][T12550] openvswitch: netlink: ct_state flags 00002cac unsupported [ 435.489343][ T5893] usb 3-1: new full-speed USB device number 100 using dummy_hcd [ 435.549367][ T5935] usb 4-1: new high-speed USB device number 114 using dummy_hcd [ 435.645536][ T5893] usb 3-1: config 1 has an invalid interface number: 128 but max is 1 [ 435.689453][ T5893] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 435.720864][ T5935] usb 4-1: too many configurations: 9, using maximum allowed: 8 [ 435.729592][ T5935] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 435.739390][ T5935] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 435.742537][ T5893] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 435.750812][ T5935] usb 4-1: config 0 interface 0 has no altsetting 0 [ 435.773903][ T5935] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 435.790068][ T5935] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 435.801541][ T5893] usb 3-1: config 1 has no interface number 0 [ 435.805600][ T5935] usb 4-1: config 0 interface 0 has no altsetting 0 [ 435.809848][ T5893] usb 3-1: config 1 interface 128 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 435.831708][ T5935] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 435.841715][ T5893] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 435.842819][ T5935] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 435.863889][ T5893] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 435.872308][ T5893] usb 3-1: Product: syz [ 435.876847][T12558] loop6: detected capacity change from 0 to 7 [ 435.883761][ T5893] usb 3-1: Manufacturer: syz [ 435.888529][T12558] Dev loop6: unable to read RDB block 7 [ 435.894288][T12558] loop6: AHDI p3 p4 [ 435.898194][T12558] loop6: partition table partially beyond EOD, truncated [ 435.907777][ T5893] usb 3-1: SerialNumber: syz [ 435.907782][ T5935] usb 4-1: config 0 interface 0 has no altsetting 0 [ 435.908997][ T5935] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 435.930916][ T5935] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 435.941254][T12558] loop6: p3 start 2427370299 is beyond EOD, truncated [ 435.945515][ T5935] usb 4-1: config 0 interface 0 has no altsetting 0 [ 435.952053][ T5893] cdc_wdm 3-1:1.128: skipping garbage [ 435.961794][ T5893] cdc_wdm 3-1:1.128: probe with driver cdc_wdm failed with error -22 [ 435.986060][ T5935] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 436.002412][ T5935] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 436.035521][ T5935] usb 4-1: config 0 interface 0 has no altsetting 0 [ 436.058475][ T5935] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 436.072310][ T5935] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 436.111002][ T5935] usb 4-1: config 0 interface 0 has no altsetting 0 [ 436.138511][ T5935] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 436.190518][ T5935] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 436.219157][ T5935] usb 4-1: config 0 interface 0 has no altsetting 0 [ 436.240397][ T5935] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 436.259495][ T5935] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 436.282952][ T5935] usb 4-1: config 0 interface 0 has no altsetting 0 [ 436.305722][ T5935] usb 4-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 436.327913][ T5935] usb 4-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 436.348501][ T5935] usb 4-1: Product: syz [ 436.360922][ T5935] usb 4-1: Manufacturer: syz [ 436.372858][ T5935] usb 4-1: SerialNumber: syz [ 436.399041][T12566] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 436.399314][ T5935] usb 4-1: config 0 descriptor?? [ 436.436783][T12566] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 436.447491][ T5935] yurex 4-1:0.0: USB YUREX device now attached to Yurex #0 [ 436.619375][ T9] usb 5-1: new full-speed USB device number 101 using dummy_hcd [ 436.651010][ T5935] usb 4-1: USB disconnect, device number 114 [ 436.659150][ T5935] yurex 4-1:0.0: USB YUREX #0 now disconnected [ 436.770972][ T9] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 436.782265][ T9] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBE, changing to 0x8E [ 436.794191][ T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 10 [ 436.805622][ T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 436.815783][ T9] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 436.831163][ T9] usb 5-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 436.840424][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 436.848562][ T9] usb 5-1: Product: syz [ 436.852986][ T9] usb 5-1: Manufacturer: syz [ 436.857602][ T9] usb 5-1: SerialNumber: syz [ 436.864336][ T9] usb 5-1: config 0 descriptor?? [ 437.071709][ T9] radio-si470x 5-1:0.0: si470x_get_report: usb_control_msg returned -71 [ 437.080812][ T9] radio-si470x 5-1:0.0: probe with driver radio-si470x failed with error -5 [ 437.093890][ T9] usb 5-1: USB disconnect, device number 101 [ 437.824256][ T5935] usb 3-1: USB disconnect, device number 100 [ 438.984266][T12610] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=254807808 (509615616 ns) > initial count (595314 ns). Using initial count to start timer. [ 439.165293][T12616] hsr0: entered promiscuous mode [ 439.170975][T12616] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1802'. [ 439.210412][T12616] hsr_slave_0: left promiscuous mode [ 439.272985][T12616] hsr_slave_1: left promiscuous mode [ 439.387756][T12616] hsr0 (unregistering): left promiscuous mode [ 440.019585][ T1298] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.026072][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 441.304694][T12657] netlink: 'syz.4.1816': attribute type 1 has an invalid length. [ 441.328801][T12657] IPVS: sed: FWM 3 0x00000003 - no destination available [ 441.409366][ T1602] usb 3-1: new high-speed USB device number 101 using dummy_hcd [ 441.590599][ T1602] usb 3-1: Using ep0 maxpacket: 32 [ 441.599105][ T1602] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 441.612294][ T1602] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 441.623300][ T1602] usb 3-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 441.635719][ T1602] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 441.652845][ T1602] usb 3-1: config 0 descriptor?? [ 441.946895][T12669] netlink: 56 bytes leftover after parsing attributes in process `syz.3.1818'. [ 441.988236][T12669] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1818'. [ 442.093536][ T1602] savu 0003:1E7D:2D5A.0018: hiddev0,hidraw0: USB HID v0.00 Device [HID 1e7d:2d5a] on usb-dummy_hcd.2-1/input0 [ 442.343580][ T9] usb 3-1: USB disconnect, device number 101 [ 442.363979][T12676] fuse: Unknown parameter 'group ' [ 442.669613][ T5893] usb 5-1: new high-speed USB device number 102 using dummy_hcd [ 442.821601][ T5893] usb 5-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 442.836534][ T5893] usb 5-1: New USB device found, idVendor=041e, idProduct=4007, bcdDevice=5d.18 [ 442.846867][ T5893] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 442.862479][ T5893] gspca_main: stv0680-2.14.0 probing 041e:4007 [ 443.064190][T12690] team_slave_0: entered promiscuous mode [ 443.070168][T12690] team_slave_1: entered promiscuous mode [ 443.083947][T12690] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 443.535187][T12704] vivid-007: disconnect [ 444.139305][ T5893] gspca_stv0680: usb_control_msg error 2, request = 0x6, error = -71 [ 444.148920][ T5893] stv0680 5-1:4.0: Could not get descriptor 0200 [ 444.165174][ T5893] gspca_stv0680: usb_control_msg error 0, request = 0x80, error = -71 [ 444.185888][T12720] loop6: detected capacity change from 0 to 7 [ 444.189341][ T5893] stv0680 5-1:4.0: last error: 9, command = 0xc [ 444.218709][T12700] vivid-007: reconnect [ 444.226416][T12720] Dev loop6: unable to read RDB block 7 [ 444.232202][T12720] loop6: AHDI p3 p4 [ 444.236444][T12720] loop6: partition table partially beyond EOD, truncated [ 444.244699][T12720] loop6: p3 start 2427370299 is beyond EOD, truncated [ 444.265917][ T5893] usb 5-1: USB disconnect, device number 102 [ 444.301159][T12722] netlink: 'syz.2.1832': attribute type 1 has an invalid length. [ 444.937352][T12742] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 445.129763][ T1602] usb 4-1: new high-speed USB device number 115 using dummy_hcd [ 445.249326][ T5923] usb 2-1: new high-speed USB device number 106 using dummy_hcd [ 445.299310][ T1602] usb 4-1: Using ep0 maxpacket: 8 [ 445.322255][ T1602] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 445.332184][ T1602] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 445.358498][ T1602] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 445.381182][ T5923] usb 2-1: device descriptor read/64, error -71 [ 445.390340][ T1602] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 445.415499][ T1602] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 445.432531][ T1602] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 445.580892][T12749] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1841'. [ 445.590772][T12749] bridge_slave_1: left allmulticast mode [ 445.599930][T12749] bridge_slave_1: left promiscuous mode [ 445.609748][T12749] bridge0: port 2(bridge_slave_1) entered disabled state [ 445.642324][T12749] bridge_slave_0: left allmulticast mode [ 445.648093][T12749] bridge_slave_0: left promiscuous mode [ 445.684091][ T5923] usb 2-1: new high-speed USB device number 107 using dummy_hcd [ 445.685759][T12749] bridge0: port 1(bridge_slave_0) entered disabled state [ 445.701836][ T1602] usb 4-1: GET_CAPABILITIES returned 0 [ 445.708213][ T1602] usbtmc 4-1:16.0: can't read capabilities [ 445.849517][ T5923] usb 2-1: device descriptor read/64, error -71 [ 445.957055][T12758] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 445.969810][T12758] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 445.977896][ T5923] usb usb2-port1: attempt power cycle [ 446.009018][T12760] loop6: detected capacity change from 0 to 7 [ 446.026579][T12760] Dev loop6: unable to read RDB block 7 [ 446.032727][T12760] loop6: AHDI p3 p4 [ 446.036781][T12760] loop6: partition table partially beyond EOD, truncated [ 446.044385][T12760] loop6: p3 start 2427370299 is beyond EOD, truncated [ 446.159330][ T5935] usb 5-1: new high-speed USB device number 103 using dummy_hcd [ 446.322257][ T5935] usb 5-1: Using ep0 maxpacket: 8 [ 446.330024][ T5935] usb 5-1: config 0 has too many interfaces: 65, using maximum allowed: 32 [ 446.339014][ T5935] usb 5-1: config 0 has an invalid interface number: 150 but max is 64 [ 446.348108][ T5923] usb 2-1: new high-speed USB device number 108 using dummy_hcd [ 446.357194][ T5935] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 446.371088][ T5935] usb 5-1: config 0 has 2 interfaces, different from the descriptor's value: 65 [ 446.380674][ T5935] usb 5-1: config 0 has no interface number 0 [ 446.386911][ T5923] usb 2-1: device descriptor read/8, error -71 [ 446.393449][ T5935] usb 5-1: config 0 interface 150 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 446.406876][ T5935] usb 5-1: config 0 interface 150 has no altsetting 0 [ 446.414075][ T5935] usb 5-1: New USB device found, idVendor=1395, idProduct=0300, bcdDevice=81.75 [ 446.488318][T12775] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1848'. [ 446.500303][T12775] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1848'. [ 446.540127][ T5935] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 446.650150][ T1602] usb 4-1: USB disconnect, device number 115 [ 446.669384][ T5923] usb 2-1: new high-speed USB device number 109 using dummy_hcd [ 446.684457][ T5935] usb 5-1: config 0 descriptor?? [ 446.691670][ T5923] usb 2-1: device descriptor read/8, error -71 [ 446.800949][ T5923] usb usb2-port1: unable to enumerate USB device [ 447.108101][ T5935] usb 5-1: USB disconnect, device number 103 [ 447.189339][ T1602] usb 4-1: new high-speed USB device number 116 using dummy_hcd [ 447.339330][ T1602] usb 4-1: Using ep0 maxpacket: 8 [ 447.346135][ T1602] usb 4-1: unable to get BOS descriptor or descriptor too short [ 447.354056][ T1602] usb 4-1: too many configurations: 110, using maximum allowed: 8 [ 447.363267][ T1602] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 447.371241][ T1602] usb 4-1: can't read configurations, error -61 [ 447.509868][ T1602] usb 4-1: new high-speed USB device number 117 using dummy_hcd [ 447.669423][ T1602] usb 4-1: Using ep0 maxpacket: 8 [ 447.682054][ T1602] usb 4-1: unable to get BOS descriptor or descriptor too short [ 447.695705][ T1602] usb 4-1: too many configurations: 110, using maximum allowed: 8 [ 447.706041][ T1602] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 447.714176][ T1602] usb 4-1: can't read configurations, error -61 [ 447.729867][ T1602] usb usb4-port1: attempt power cycle [ 447.780637][T12784] netlink: 'syz.4.1850': attribute type 1 has an invalid length. [ 447.805585][T12784] IPVS: sed: FWM 3 0x00000003 - no destination available [ 448.099352][ T1602] usb 4-1: new high-speed USB device number 118 using dummy_hcd [ 448.120365][ T1602] usb 4-1: Using ep0 maxpacket: 8 [ 448.129311][ T1602] usb 4-1: unable to get BOS descriptor or descriptor too short [ 448.137844][ T1602] usb 4-1: too many configurations: 110, using maximum allowed: 8 [ 448.148618][ T1602] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 448.156574][ T1602] usb 4-1: can't read configurations, error -61 [ 448.289355][ T1602] usb 4-1: new high-speed USB device number 119 using dummy_hcd [ 448.319999][ T1602] usb 4-1: Using ep0 maxpacket: 8 [ 448.327252][ T1602] usb 4-1: unable to get BOS descriptor or descriptor too short [ 448.335384][ T1602] usb 4-1: too many configurations: 110, using maximum allowed: 8 [ 448.344884][ T1602] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 448.352906][ T1602] usb 4-1: can't read configurations, error -61 [ 448.359971][ T1602] usb usb4-port1: unable to enumerate USB device [ 448.622059][T12791] FAULT_INJECTION: forcing a failure. [ 448.622059][T12791] name failslab, interval 1, probability 0, space 0, times 0 [ 448.635436][T12791] CPU: 1 UID: 0 PID: 12791 Comm: syz.4.1854 Tainted: G L syzkaller #0 PREEMPT(full) [ 448.635455][T12791] Tainted: [L]=SOFTLOCKUP [ 448.635460][T12791] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 448.635469][T12791] Call Trace: [ 448.635492][T12791] [ 448.635502][T12791] dump_stack_lvl+0xe8/0x150 [ 448.635646][T12791] should_fail_ex+0x412/0x560 [ 448.635713][T12791] should_failslab+0xa8/0x100 [ 448.635787][T12791] __kmalloc_noprof+0xe8/0x760 [ 448.635800][T12791] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 448.635890][T12791] tomoyo_realpath_from_path+0xe3/0x5d0 [ 448.635910][T12791] ? tomoyo_path_number_perm+0x219/0x630 [ 448.635921][T12791] tomoyo_path_number_perm+0x246/0x630 [ 448.635934][T12791] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 448.635947][T12791] ? __lock_acquire+0x6b5/0x2cf0 [ 448.635978][T12791] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 448.636052][T12791] ? __fget_files+0x2a/0x420 [ 448.636087][T12791] ? __fget_files+0x2a/0x420 [ 448.636108][T12791] ? __fget_files+0x3a0/0x420 [ 448.636129][T12791] ? __fget_files+0x2a/0x420 [ 448.636156][T12791] security_file_ioctl+0xc3/0x2a0 [ 448.636231][T12791] __se_sys_ioctl+0x47/0x170 [ 448.636257][T12791] do_syscall_64+0x14d/0xf80 [ 448.636299][T12791] ? trace_irq_disable+0x3b/0x150 [ 448.636340][T12791] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 448.636371][T12791] ? clear_bhb_loop+0x40/0x90 [ 448.636392][T12791] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 448.636416][T12791] RIP: 0033:0x7f4ea6f9c799 [ 448.636477][T12791] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 448.636494][T12791] RSP: 002b:00007f4ea7e4f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 448.636533][T12791] RAX: ffffffffffffffda RBX: 00007f4ea7215fa0 RCX: 00007f4ea6f9c799 [ 448.636541][T12791] RDX: 0000200000000600 RSI: 00000000c0485619 RDI: 0000000000000003 [ 448.636548][T12791] RBP: 00007f4ea7e4f090 R08: 0000000000000000 R09: 0000000000000000 [ 448.636554][T12791] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 448.636560][T12791] R13: 00007f4ea7216038 R14: 00007f4ea7215fa0 R15: 00007f4ea733fa48 [ 448.636576][T12791] [ 448.636589][T12791] ERROR: Out of memory at tomoyo_realpath_from_path. [ 448.896987][T12793] loop6: detected capacity change from 0 to 7 [ 448.904607][T12793] Dev loop6: unable to read RDB block 7 [ 448.910305][T12793] loop6: AHDI p3 p4 [ 448.914337][T12793] loop6: partition table partially beyond EOD, truncated [ 448.922646][T12793] loop6: p3 start 2427370299 is beyond EOD, truncated [ 450.051349][T12810] Set syz1 is full, maxelem 1029 reached [ 450.109339][ T1602] usb 3-1: new high-speed USB device number 102 using dummy_hcd [ 450.189900][T12816] i2c i2c-0: dtv_property_process_set: SET cmd 0x00000000 undefined [ 450.269427][ T1602] usb 3-1: Using ep0 maxpacket: 16 [ 450.280321][ T1602] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 450.309401][ T1602] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 450.336396][ T1602] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 10 [ 450.387231][ T1602] usb 3-1: New USB device found, idVendor=05ac, idProduct=027d, bcdDevice= 0.00 [ 450.639341][ T9] usb 5-1: new high-speed USB device number 104 using dummy_hcd [ 450.678042][ T1602] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 450.710202][ T1602] usb 3-1: config 0 descriptor?? [ 450.929451][ T5935] usb 4-1: new full-speed USB device number 120 using dummy_hcd [ 450.934414][T12828] FAULT_INJECTION: forcing a failure. [ 450.934414][T12828] name failslab, interval 1, probability 0, space 0, times 0 [ 450.949997][ T9] usb 5-1: device descriptor read/64, error -71 [ 450.956576][T12828] CPU: 0 UID: 0 PID: 12828 Comm: syz.3.1865 Tainted: G L syzkaller #0 PREEMPT(full) [ 450.956605][T12828] Tainted: [L]=SOFTLOCKUP [ 450.956613][T12828] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 450.956623][T12828] Call Trace: [ 450.956631][T12828] [ 450.956639][T12828] dump_stack_lvl+0xe8/0x150 [ 450.956669][T12828] should_fail_ex+0x412/0x560 [ 450.956696][T12828] should_failslab+0xa8/0x100 [ 450.956720][T12828] __kmalloc_noprof+0xe8/0x760 [ 450.956740][T12828] ? tomoyo_encode+0x28b/0x550 [ 450.956769][T12828] tomoyo_encode+0x28b/0x550 [ 450.956797][T12828] tomoyo_realpath_from_path+0x58d/0x5d0 [ 450.956828][T12828] ? tomoyo_path_number_perm+0x219/0x630 [ 450.956847][T12828] tomoyo_path_number_perm+0x246/0x630 [ 450.956869][T12828] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 450.956891][T12828] ? __lock_acquire+0x6b5/0x2cf0 [ 450.956922][T12828] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 450.956958][T12828] ? __fget_files+0x2a/0x420 [ 450.956986][T12828] ? __fget_files+0x2a/0x420 [ 450.957008][T12828] ? __fget_files+0x3a0/0x420 [ 450.957031][T12828] ? __fget_files+0x2a/0x420 [ 450.957059][T12828] security_file_ioctl+0xc3/0x2a0 [ 450.957081][T12828] __se_sys_ioctl+0x47/0x170 [ 450.957105][T12828] do_syscall_64+0x14d/0xf80 [ 450.957121][T12828] ? trace_irq_disable+0x3b/0x150 [ 450.957146][T12828] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 450.957164][T12828] ? clear_bhb_loop+0x40/0x90 [ 450.957186][T12828] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 450.957204][T12828] RIP: 0033:0x7f059b19c799 [ 450.957223][T12828] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 450.957238][T12828] RSP: 002b:00007f059c012028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 450.957257][T12828] RAX: ffffffffffffffda RBX: 00007f059b415fa0 RCX: 00007f059b19c799 [ 450.957269][T12828] RDX: 0000200000000600 RSI: 00000000c0485619 RDI: 0000000000000003 [ 450.957281][T12828] RBP: 00007f059c012090 R08: 0000000000000000 R09: 0000000000000000 [ 450.957293][T12828] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 450.957304][T12828] R13: 00007f059b416038 R14: 00007f059b415fa0 R15: 00007f059b53fa48 [ 450.957333][T12828] [ 450.957351][T12828] ERROR: Out of memory at tomoyo_realpath_from_path. [ 451.214646][ T1602] apple 0003:05AC:027D.0019: unknown main item tag 0x0 [ 451.269748][ T1602] apple 0003:05AC:027D.0019: unknown main item tag 0x0 [ 451.274216][T12832] netlink: 'syz.0.1864': attribute type 1 has an invalid length. [ 451.336738][ T9] usb 5-1: new high-speed USB device number 105 using dummy_hcd [ 451.357098][ T1602] apple 0003:05AC:027D.0019: unknown main item tag 0x0 [ 451.384405][ T1602] apple 0003:05AC:027D.0019: unknown main item tag 0x0 [ 451.411898][ T1602] apple 0003:05AC:027D.0019: unknown main item tag 0x0 [ 451.449672][ T1602] apple 0003:05AC:027D.0019: unknown main item tag 0x0 [ 451.479943][ T9] usb 5-1: device descriptor read/64, error -71 [ 451.488933][ T1602] apple 0003:05AC:027D.0019: unknown main item tag 0x0 [ 451.524330][ T1602] apple 0003:05AC:027D.0019: unknown main item tag 0x0 [ 451.568321][ T1602] apple 0003:05AC:027D.0019: unknown main item tag 0x0 [ 451.580811][ T1602] apple 0003:05AC:027D.0019: unknown main item tag 0x0 [ 451.589742][ T9] usb usb5-port1: attempt power cycle [ 451.606346][ T1602] apple 0003:05AC:027D.0019: hidraw0: USB HID v0.00 Device [HID 05ac:027d] on usb-dummy_hcd.2-1/input0 [ 451.623210][ T1602] usb 3-1: USB disconnect, device number 102 [ 451.664210][T12838] loop6: detected capacity change from 0 to 7 [ 451.672132][T12838] Dev loop6: unable to read RDB block 7 [ 451.678015][T12838] loop6: AHDI p3 p4 [ 451.696799][T12838] loop6: partition table partially beyond EOD, truncated [ 451.731521][T12838] loop6: p3 start 2427370299 is beyond EOD, truncated [ 451.838816][T12841] fido_id[12841]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.2/usb3/report_descriptor': No such file or directory [ 451.861808][T12843] netlink: 'syz.1.1868': attribute type 10 has an invalid length. [ 451.870058][T12843] team0: Cannot enslave team device to itself [ 452.029423][ T9] usb 5-1: new high-speed USB device number 106 using dummy_hcd [ 452.051386][ T9] usb 5-1: device descriptor read/8, error -71 [ 452.302710][ T9] usb 5-1: new high-speed USB device number 107 using dummy_hcd [ 452.343381][T12850] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 452.355265][ T9] usb 5-1: device descriptor read/8, error -71 [ 452.361968][ T796] usb 3-1: new high-speed USB device number 103 using dummy_hcd [ 452.493609][ T9] usb usb5-port1: unable to enumerate USB device [ 452.549446][ T796] usb 3-1: too many configurations: 9, using maximum allowed: 8 [ 452.690871][ T796] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 452.710121][ T796] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 452.746376][ T796] usb 3-1: config 0 interface 0 has no altsetting 0 [ 452.780560][ T796] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 452.789809][ T796] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 452.814303][ T796] usb 3-1: config 0 interface 0 has no altsetting 0 [ 452.839389][ T796] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 452.848779][ T796] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 452.915608][ T796] usb 3-1: config 0 interface 0 has no altsetting 0 [ 452.961463][ T796] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 453.059403][ T796] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 453.070653][ T796] usb 3-1: config 0 interface 0 has no altsetting 0 [ 453.078541][ T796] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 453.087976][ T796] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 453.099172][ T796] usb 3-1: config 0 interface 0 has no altsetting 0 [ 453.142733][ T796] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 453.155249][ T796] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 453.176550][ T796] usb 3-1: config 0 interface 0 has no altsetting 0 [ 453.185335][ T796] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 453.195638][ T796] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 453.215411][ T796] usb 3-1: config 0 interface 0 has no altsetting 0 [ 453.227670][ T796] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 453.237080][ T796] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 453.248443][ T796] usb 3-1: config 0 interface 0 has no altsetting 0 [ 453.385783][ T796] usb 3-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 453.419640][ T796] usb 3-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 453.449331][ T796] usb 3-1: Product: syz [ 453.453703][ T796] usb 3-1: Manufacturer: syz [ 453.479303][ T796] usb 3-1: SerialNumber: syz [ 453.510571][ T796] usb 3-1: config 0 descriptor?? [ 453.539431][ T796] yurex 3-1:0.0: USB YUREX device now attached to Yurex #0 [ 453.616829][T12868] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1873'. [ 453.841317][T12872] FAULT_INJECTION: forcing a failure. [ 453.841317][T12872] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 453.891806][ T29] kauditd_printk_skb: 12 callbacks suppressed [ 453.891825][ T29] audit: type=1800 audit(1773038488.844:385): pid=12874 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.1870" name="SYSV00000000" dev="tmpfs" ino=1 res=0 errno=0 [ 453.935632][T12872] CPU: 1 UID: 0 PID: 12872 Comm: syz.3.1876 Tainted: G L syzkaller #0 PREEMPT(full) [ 453.935652][T12872] Tainted: [L]=SOFTLOCKUP [ 453.935657][T12872] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 453.935665][T12872] Call Trace: [ 453.935673][T12872] [ 453.935681][T12872] dump_stack_lvl+0xe8/0x150 [ 453.935713][T12872] should_fail_ex+0x412/0x560 [ 453.935740][T12872] _copy_from_user+0x2d/0xb0 [ 453.935855][T12872] video_usercopy+0x36f/0x14b0 [ 453.935957][T12872] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 453.935972][T12872] ? __pfx___video_do_ioctl+0x10/0x10 [ 453.935996][T12872] ? __pfx_video_usercopy+0x10/0x10 [ 453.936028][T12872] ? __fget_files+0x2a/0x420 [ 453.936055][T12872] ? __fget_files+0x2a/0x420 [ 453.936072][T12872] ? __fget_files+0x3a0/0x420 [ 453.936087][T12872] v4l2_ioctl+0x18d/0x1e0 [ 453.936099][T12872] ? __pfx_v4l2_ioctl+0x10/0x10 [ 453.936111][T12872] __se_sys_ioctl+0xfc/0x170 [ 453.936129][T12872] do_syscall_64+0x14d/0xf80 [ 453.936145][T12872] ? trace_irq_disable+0x3b/0x150 [ 453.936170][T12872] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 453.936189][T12872] ? clear_bhb_loop+0x40/0x90 [ 453.936209][T12872] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 453.936220][T12872] RIP: 0033:0x7f059b19c799 [ 453.936231][T12872] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 453.936240][T12872] RSP: 002b:00007f059c012028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 453.936251][T12872] RAX: ffffffffffffffda RBX: 00007f059b415fa0 RCX: 00007f059b19c799 [ 453.936259][T12872] RDX: 0000200000000600 RSI: 00000000c0485619 RDI: 0000000000000003 [ 453.936266][T12872] RBP: 00007f059c012090 R08: 0000000000000000 R09: 0000000000000000 [ 453.936275][T12872] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 453.936286][T12872] R13: 00007f059b416038 R14: 00007f059b415fa0 R15: 00007f059b53fa48 [ 453.936315][T12872] [ 455.152539][T12891] m1Ie5n: entered promiscuous mode [ 455.294305][T12899] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1884'. [ 455.333472][T12901] netlink: 'syz.4.1882': attribute type 1 has an invalid length. [ 455.366346][T12901] IPVS: sed: FWM 3 0x00000003 - no destination available [ 455.447428][ T29] audit: type=1326 audit(1773038490.394:386): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12903 comm="syz.3.1885" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f059b19c799 code=0x7ffc0000 [ 455.471664][ T29] audit: type=1326 audit(1773038490.394:387): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12903 comm="syz.3.1885" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f059b19c799 code=0x7ffc0000 [ 455.497852][ T29] audit: type=1326 audit(1773038490.424:388): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12903 comm="syz.3.1885" exe="/root/syz-executor" sig=0 arch=c000003e syscall=85 compat=0 ip=0x7f059b19c799 code=0x7ffc0000 [ 455.537866][ T796] usb 2-1: new low-speed USB device number 110 using dummy_hcd [ 455.549522][ T29] audit: type=1326 audit(1773038490.424:389): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12903 comm="syz.3.1885" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f059b19c799 code=0x7ffc0000 [ 455.573916][ T29] audit: type=1326 audit(1773038490.424:390): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12903 comm="syz.3.1885" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f059b19c799 code=0x7ffc0000 [ 455.599010][ T29] audit: type=1326 audit(1773038490.454:391): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12903 comm="syz.3.1885" exe="/root/syz-executor" sig=0 arch=c000003e syscall=190 compat=0 ip=0x7f059b19c799 code=0x7ffc0000 [ 455.691999][ T29] audit: type=1326 audit(1773038490.454:392): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12903 comm="syz.3.1885" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f059b19c799 code=0x7ffc0000 [ 455.718078][ T796] usb 2-1: config 15 has an invalid interface number: 154 but max is 0 [ 455.729853][ T29] audit: type=1326 audit(1773038490.454:393): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12903 comm="syz.3.1885" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f059b19c799 code=0x7ffc0000 [ 455.739348][ T796] usb 2-1: config 15 has an invalid descriptor of length 0, skipping remainder of the config [ 455.769513][ T796] usb 2-1: config 15 has no interface number 0 [ 455.776591][ T796] usb 2-1: config 15 interface 154 altsetting 7 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 455.790100][ T9] usb 4-1: new full-speed USB device number 121 using dummy_hcd [ 455.798958][ T796] usb 2-1: config 15 interface 154 has no altsetting 0 [ 455.815258][ T29] audit: type=1326 audit(1773038490.454:394): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12903 comm="syz.3.1885" exe="/root/syz-executor" sig=0 arch=c000003e syscall=54 compat=0 ip=0x7f059b19c799 code=0x7ffc0000 [ 455.827027][ T796] usb 2-1: string descriptor 0 read error: -22 [ 455.868896][ T796] usb 2-1: New USB device found, idVendor=0bc7, idProduct=0002, bcdDevice=9e.7c [ 455.882272][ T796] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 455.904205][ T1602] usb 3-1: USB disconnect, device number 103 [ 455.913112][ T1602] yurex 3-1:0.0: USB YUREX #0 now disconnected [ 455.952832][ T9] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 15 [ 455.962136][ T9] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 455.987443][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 456.001642][ T796] ati_remote 2-1:15.154: ati_remote_probe: Unexpected desc.bNumEndpoints [ 456.054092][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 64 [ 456.069754][ T9] usb 4-1: New USB device found, idVendor=077d, idProduct=04aa, bcdDevice=5b.d8 [ 456.079421][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 456.087536][ T9] usb 4-1: Product: syz [ 456.106189][ T9] usb 4-1: Manufacturer: syz [ 456.111132][ T9] usb 4-1: SerialNumber: syz [ 456.127219][ T9] usb 4-1: config 0 descriptor?? [ 456.139059][T12904] raw-gadget.3 gadget.3: fail, usb_ep_enable returned -22 [ 456.354414][ T9] powermate: Expected payload of 3--6 bytes, found 64 bytes! [ 456.359453][ T1602] usb 3-1: new high-speed USB device number 104 using dummy_hcd [ 456.378321][ T9] input: Griffin SoundKnob as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/input/input57 [ 456.407814][ C0] powermate: config urb returned -71 [ 456.413750][ C0] powermate: config urb returned -71 [ 456.419133][ C0] powermate: config urb returned -71 [ 456.424616][ C0] powermate: config urb returned -71 [ 456.436549][ T9] usb 4-1: USB disconnect, device number 121 [ 456.442628][ C0] powermate 4-1:0.0: powermate_irq - usb_submit_urb failed with result: -19 [ 456.499489][ T1602] usb 3-1: device descriptor read/64, error -71 [ 456.614174][T12911] FAULT_INJECTION: forcing a failure. [ 456.614174][T12911] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 456.629222][T12911] CPU: 1 UID: 0 PID: 12911 Comm: syz.4.1888 Tainted: G L syzkaller #0 PREEMPT(full) [ 456.629251][T12911] Tainted: [L]=SOFTLOCKUP [ 456.629258][T12911] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 456.629269][T12911] Call Trace: [ 456.629278][T12911] [ 456.629286][T12911] dump_stack_lvl+0xe8/0x150 [ 456.629321][T12911] should_fail_ex+0x412/0x560 [ 456.629351][T12911] _copy_to_user+0x31/0xb0 [ 456.629379][T12911] video_usercopy+0xe0a/0x14b0 [ 456.629411][T12911] ? __pfx___video_do_ioctl+0x10/0x10 [ 456.629435][T12911] ? __pfx_video_usercopy+0x10/0x10 [ 456.629466][T12911] ? __fget_files+0x2a/0x420 [ 456.629495][T12911] ? __fget_files+0x2a/0x420 [ 456.629517][T12911] ? __fget_files+0x3a0/0x420 [ 456.629544][T12911] v4l2_ioctl+0x18d/0x1e0 [ 456.629566][T12911] ? __pfx_v4l2_ioctl+0x10/0x10 [ 456.629587][T12911] __se_sys_ioctl+0xfc/0x170 [ 456.629611][T12911] do_syscall_64+0x14d/0xf80 [ 456.629628][T12911] ? trace_irq_disable+0x3b/0x150 [ 456.629663][T12911] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 456.629683][T12911] ? clear_bhb_loop+0x40/0x90 [ 456.629705][T12911] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 456.629723][T12911] RIP: 0033:0x7f4ea6f9c799 [ 456.629741][T12911] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 456.629756][T12911] RSP: 002b:00007f4ea7e4f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 456.629776][T12911] RAX: ffffffffffffffda RBX: 00007f4ea7215fa0 RCX: 00007f4ea6f9c799 [ 456.629790][T12911] RDX: 0000200000000600 RSI: 00000000c0485619 RDI: 0000000000000003 [ 456.629802][T12911] RBP: 00007f4ea7e4f090 R08: 0000000000000000 R09: 0000000000000000 [ 456.629813][T12911] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 456.629824][T12911] R13: 00007f4ea7216038 R14: 00007f4ea7215fa0 R15: 00007f4ea733fa48 [ 456.629852][T12911] [ 456.879354][ T1602] usb 3-1: new high-speed USB device number 105 using dummy_hcd [ 457.008197][T12915] FAULT_INJECTION: forcing a failure. [ 457.008197][T12915] name failslab, interval 1, probability 0, space 0, times 0 [ 457.009349][ T1602] usb 3-1: device descriptor read/64, error -71 [ 457.123667][T12915] CPU: 1 UID: 0 PID: 12915 Comm: syz.4.1890 Tainted: G L syzkaller #0 PREEMPT(full) [ 457.123707][T12915] Tainted: [L]=SOFTLOCKUP [ 457.123714][T12915] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 457.123725][T12915] Call Trace: [ 457.123733][T12915] [ 457.123741][T12915] dump_stack_lvl+0xe8/0x150 [ 457.123773][T12915] should_fail_ex+0x412/0x560 [ 457.123803][T12915] should_failslab+0xa8/0x100 [ 457.123828][T12915] __kmalloc_noprof+0xe8/0x760 [ 457.123850][T12915] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 457.123883][T12915] tomoyo_realpath_from_path+0xe3/0x5d0 [ 457.123918][T12915] ? tomoyo_path_number_perm+0x219/0x630 [ 457.123938][T12915] tomoyo_path_number_perm+0x246/0x630 [ 457.123962][T12915] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 457.123983][T12915] ? fuse_dentry_settime+0x22a/0x4d0 [ 457.124054][T12915] ? d_splice_alias_ops+0x117/0x3d0 [ 457.124080][T12915] ? fuse_lookup+0x4ab/0x4e0 [ 457.124107][T12915] ? __pfx_fuse_lookup+0x10/0x10 [ 457.124152][T12915] ? __pfx_current_check_access_path+0x10/0x10 [ 457.124273][T12915] ? lookup_one_qstr_excl+0x1d8/0x360 [ 457.124301][T12915] tomoyo_path_mkdir+0xb0/0xf0 [ 457.124327][T12915] ? __pfx_tomoyo_path_mkdir+0x10/0x10 [ 457.124355][T12915] ? __pfx_filename_create+0x10/0x10 [ 457.124380][T12915] security_path_mkdir+0x169/0x350 [ 457.124443][T12915] filename_mkdirat+0x200/0x510 [ 457.124470][T12915] ? __pfx_filename_mkdirat+0x10/0x10 [ 457.124495][T12915] ? do_getname+0x151/0x250 [ 457.124521][T12915] __se_sys_mkdirat+0x35/0x150 [ 457.124545][T12915] do_syscall_64+0x14d/0xf80 [ 457.124562][T12915] ? trace_irq_disable+0x3b/0x150 [ 457.124593][T12915] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 457.124613][T12915] ? clear_bhb_loop+0x40/0x90 [ 457.124633][T12915] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 457.124649][T12915] RIP: 0033:0x7f4ea6f9c799 [ 457.124667][T12915] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 457.124682][T12915] RSP: 002b:00007f4ea7e4f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 457.124700][T12915] RAX: ffffffffffffffda RBX: 00007f4ea7215fa0 RCX: 00007f4ea6f9c799 [ 457.124712][T12915] RDX: 0000000000000062 RSI: 0000200000000900 RDI: ffffffffffffff9c [ 457.124723][T12915] RBP: 00007f4ea7e4f090 R08: 0000000000000000 R09: 0000000000000000 [ 457.124733][T12915] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 457.124743][T12915] R13: 00007f4ea7216038 R14: 00007f4ea7215fa0 R15: 00007f4ea733fa48 [ 457.124773][T12915] [ 457.124781][T12915] ERROR: Out of memory at tomoyo_realpath_from_path. [ 457.390165][ T1602] usb usb3-port1: attempt power cycle [ 457.777226][ T1602] usb 3-1: new high-speed USB device number 106 using dummy_hcd [ 457.893085][ T1602] usb 3-1: device descriptor read/8, error -71 [ 458.139368][ T1602] usb 3-1: new high-speed USB device number 107 using dummy_hcd [ 458.160198][ T1602] usb 3-1: device descriptor read/8, error -71 [ 458.217707][ T5935] usb 2-1: USB disconnect, device number 110 [ 458.273882][ T1602] usb usb3-port1: unable to enumerate USB device [ 458.312190][T12930] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1895'. [ 458.906244][T12946] FAULT_INJECTION: forcing a failure. [ 458.906244][T12946] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 458.929631][T12946] CPU: 0 UID: 0 PID: 12946 Comm: syz.0.1900 Tainted: G L syzkaller #0 PREEMPT(full) [ 458.929660][T12946] Tainted: [L]=SOFTLOCKUP [ 458.929667][T12946] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 458.929677][T12946] Call Trace: [ 458.929684][T12946] [ 458.929692][T12946] dump_stack_lvl+0xe8/0x150 [ 458.929723][T12946] should_fail_ex+0x412/0x560 [ 458.929752][T12946] _copy_to_user+0x31/0xb0 [ 458.929782][T12946] simple_read_from_buffer+0xe1/0x170 [ 458.929812][T12946] proc_fail_nth_read+0x1bb/0x230 [ 458.929886][T12946] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 458.929914][T12946] ? rw_verify_area+0x2a6/0x4d0 [ 458.929934][T12946] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 458.929958][T12946] vfs_read+0x20c/0xa70 [ 458.929977][T12946] ? fdget_pos+0x246/0x320 [ 458.930007][T12946] ? __pfx___mutex_lock+0x10/0x10 [ 458.930027][T12946] ? __pfx_vfs_read+0x10/0x10 [ 458.930047][T12946] ? __fget_files+0x2a/0x420 [ 458.930076][T12946] ? __fget_files+0x3a0/0x420 [ 458.930100][T12946] ? __fget_files+0x2a/0x420 [ 458.930132][T12946] ksys_read+0x150/0x270 [ 458.930155][T12946] ? __pfx_ksys_read+0x10/0x10 [ 458.930173][T12946] ? __pfx_v4l2_ioctl+0x10/0x10 [ 458.930208][T12946] do_syscall_64+0x14d/0xf80 [ 458.930224][T12946] ? trace_irq_disable+0x3b/0x150 [ 458.930248][T12946] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 458.930266][T12946] ? clear_bhb_loop+0x40/0x90 [ 458.930288][T12946] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 458.930306][T12946] RIP: 0033:0x7f09df35cfce [ 458.930324][T12946] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 458.930339][T12946] RSP: 002b:00007f09e0201fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 458.930359][T12946] RAX: ffffffffffffffda RBX: 00007f09e02026c0 RCX: 00007f09df35cfce [ 458.930373][T12946] RDX: 000000000000000f RSI: 00007f09e02020a0 RDI: 0000000000000004 [ 458.930385][T12946] RBP: 00007f09e0202090 R08: 0000000000000000 R09: 0000000000000000 [ 458.930397][T12946] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 458.930408][T12946] R13: 00007f09df616038 R14: 00007f09df615fa0 R15: 00007f09df73fa48 [ 458.930438][T12946] [ 459.173150][T12942] netlink: 'syz.4.1898': attribute type 1 has an invalid length. [ 459.329624][T12942] IPVS: sed: FWM 3 0x00000003 - no destination available [ 459.350540][T12948] tipc: Enabled bearer , priority 0 [ 459.365892][T12948] syzkaller0: entered promiscuous mode [ 459.450784][T12948] syzkaller0: entered allmulticast mode [ 459.488885][T12948] tipc: Resetting bearer [ 459.646875][T12966] FAULT_INJECTION: forcing a failure. [ 459.646875][T12966] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 459.660709][T12966] CPU: 0 UID: 0 PID: 12966 Comm: syz.4.1906 Tainted: G L syzkaller #0 PREEMPT(full) [ 459.660740][T12966] Tainted: [L]=SOFTLOCKUP [ 459.660746][T12966] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 459.660758][T12966] Call Trace: [ 459.660766][T12966] [ 459.660773][T12966] dump_stack_lvl+0xe8/0x150 [ 459.660796][T12966] should_fail_ex+0x412/0x560 [ 459.660812][T12966] _copy_from_iter+0x1d3/0x1670 [ 459.660911][T12966] ? rcu_is_watching+0x15/0xb0 [ 459.660935][T12966] ? __pfx__copy_from_iter+0x10/0x10 [ 459.660952][T12966] ? netlink_sendmsg+0x650/0xb40 [ 459.661030][T12966] ? skb_put+0x11b/0x210 [ 459.661086][T12966] netlink_sendmsg+0x6c0/0xb40 [ 459.661103][T12966] ? __pfx_netlink_sendmsg+0x10/0x10 [ 459.661118][T12966] ? aa_sock_msg_perm+0xf1/0x1b0 [ 459.661153][T12966] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 459.661174][T12966] ____sys_sendmsg+0x972/0x9f0 [ 459.661232][T12966] ? __pfx_____sys_sendmsg+0x10/0x10 [ 459.661246][T12966] ? import_iovec+0x73/0xa0 [ 459.661262][T12966] ___sys_sendmsg+0x2a5/0x360 [ 459.661278][T12966] ? __pfx____sys_sendmsg+0x10/0x10 [ 459.661304][T12966] ? __fget_files+0x2a/0x420 [ 459.661318][T12966] ? __fget_files+0x3a0/0x420 [ 459.661337][T12966] __x64_sys_sendmsg+0x1bd/0x2a0 [ 459.661348][T12966] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 459.661361][T12966] ? __pfx_ksys_write+0x10/0x10 [ 459.661378][T12966] do_syscall_64+0x14d/0xf80 [ 459.661388][T12966] ? trace_irq_disable+0x3b/0x150 [ 459.661402][T12966] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 459.661412][T12966] ? clear_bhb_loop+0x40/0x90 [ 459.661424][T12966] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 459.661434][T12966] RIP: 0033:0x7f4ea6f9c799 [ 459.661446][T12966] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 459.661455][T12966] RSP: 002b:00007f4ea7e4f028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 459.661467][T12966] RAX: ffffffffffffffda RBX: 00007f4ea7215fa0 RCX: 00007f4ea6f9c799 [ 459.661475][T12966] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000007 [ 459.661481][T12966] RBP: 00007f4ea7e4f090 R08: 0000000000000000 R09: 0000000000000000 [ 459.661487][T12966] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 459.661493][T12966] R13: 00007f4ea7216038 R14: 00007f4ea7215fa0 R15: 00007f4ea733fa48 [ 459.661508][T12966] [ 459.984680][T12972] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1907'. [ 460.149371][ T9] usb 4-1: new low-speed USB device number 122 using dummy_hcd [ 460.311712][ T9] usb 4-1: config 15 has an invalid interface number: 154 but max is 0 [ 460.323922][ T9] usb 4-1: config 15 has an invalid descriptor of length 0, skipping remainder of the config [ 460.347305][ T9] usb 4-1: config 15 has no interface number 0 [ 460.371352][ T9] usb 4-1: config 15 interface 154 altsetting 7 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 460.470099][ T1602] tipc: Node number set to 4237843923 [ 460.578992][ T9] usb 4-1: config 15 interface 154 has no altsetting 0 [ 460.797018][ T9] usb 4-1: string descriptor 0 read error: -22 [ 460.809650][ T9] usb 4-1: New USB device found, idVendor=0bc7, idProduct=0002, bcdDevice=9e.7c [ 460.824160][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 460.912680][ T9] ati_remote 4-1:15.154: ati_remote_probe: Unexpected desc.bNumEndpoints [ 461.691993][T12998] gtp1: entered promiscuous mode [ 461.719420][T12998] gtp1: entered allmulticast mode [ 462.284412][T12953] tipc: Resetting bearer [ 462.354496][T12953] tipc: Disabling bearer [ 462.516372][T13009] netlink: 'syz.0.1916': attribute type 1 has an invalid length. [ 462.775414][T13013] binder: 13012:13013 ioctl c0306201 2000000003c0 returned -14 [ 462.852739][ T5935] usb 4-1: USB disconnect, device number 122 [ 463.400439][T13025] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 463.489522][ T5907] usb 4-1: new high-speed USB device number 123 using dummy_hcd [ 463.600252][ T9] usb 3-1: new high-speed USB device number 108 using dummy_hcd [ 463.679528][ T5907] usb 4-1: Using ep0 maxpacket: 32 [ 463.889446][ T9] usb 3-1: Using ep0 maxpacket: 8 [ 463.905758][ T9] usb 3-1: config 0 has an invalid interface number: 52 but max is 0 [ 463.920386][ T5907] usb 4-1: New USB device found, idVendor=2040, idProduct=d900, bcdDevice=a9.2c [ 463.929818][ T5907] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 463.946752][ T9] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 463.967616][ T5907] usb 4-1: Product: syz [ 463.973241][ T5907] usb 4-1: Manufacturer: syz [ 464.002083][ T9] usb 3-1: config 0 has no interface number 0 [ 464.008561][ T5907] usb 4-1: SerialNumber: syz [ 464.034641][ T9] usb 3-1: config 0 interface 52 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 464.066175][ T5907] usb 4-1: config 0 descriptor?? [ 464.081981][ T5907] dvb-usb: found a 'Hauppauge MAX S2 or WinTV NOVA HD USB2.0' in warm state. [ 464.102568][ T5907] dw2102: su3000_power_ctrl: 1, initialized 0 [ 464.108809][ T9] usb 3-1: config 0 interface 52 has no altsetting 0 [ 464.115660][ T10] usb 5-1: new high-speed USB device number 108 using dummy_hcd [ 464.169400][ T5907] dvb-usb: bulk message failed: -22 (2/0) [ 464.195901][ T9] usb 3-1: New USB device found, idVendor=06cb, idProduct=0003, bcdDevice= 0.00 [ 464.208686][ T9] usb 3-1: New USB device strings: Mfr=0, Product=234, SerialNumber=34 [ 464.238893][ T5907] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 464.261986][ T9] usb 3-1: Product: syz [ 464.268654][ T9] usb 3-1: SerialNumber: syz [ 464.286869][ T5907] dvbdev: DVB: registering new adapter (Hauppauge MAX S2 or WinTV NOVA HD USB2.0) [ 464.296392][ T10] usb 5-1: Using ep0 maxpacket: 8 [ 464.326630][ T10] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 464.339140][T13023] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 464.349179][T13023] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 464.361637][T13023] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 464.380789][T13023] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 464.553197][ T10] usb 5-1: config 0 has no interface number 0 [ 464.568795][ T9] usb 3-1: config 0 descriptor?? [ 464.579508][ T5907] usb 4-1: media controller created [ 464.584983][ T10] usb 5-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 464.613875][ T5907] dvb-usb: bulk message failed: -22 (6/0) [ 464.621337][ T5907] dw2102: i2c transfer failed. [ 464.629139][ T10] usb 5-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 464.639380][ T5907] dvb-usb: bulk message failed: -22 (6/0) [ 464.646536][ T10] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 464.660338][T13040] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 464.726117][ T5907] dw2102: i2c transfer failed. [ 464.745791][ T5907] dvb-usb: bulk message failed: -22 (6/0) [ 464.766997][ T10] usb 5-1: config 0 descriptor?? [ 464.778639][ T5907] dw2102: i2c transfer failed. [ 464.787793][ T5907] dvb-usb: bulk message failed: -22 (6/0) [ 464.802964][ T5907] dw2102: i2c transfer failed. [ 464.808883][T13022] netlink: 44 bytes leftover after parsing attributes in process `syz.2.1921'. [ 464.818952][T13022] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1921'. [ 464.829149][ T10] iowarrior 5-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 464.849876][ T9] usb 3-1: Can not set alternate setting to 1, error: -71 [ 464.890048][ T9] synaptics_usb 3-1:0.52: probe with driver synaptics_usb failed with error -71 [ 464.902990][ T5907] dvb-usb: bulk message failed: -22 (6/0) [ 464.928082][ T5907] dw2102: i2c transfer failed. [ 464.944288][ T5907] dvb-usb: bulk message failed: -22 (6/0) [ 464.951701][ T9] usb 3-1: USB disconnect, device number 108 [ 464.959547][ T5907] dw2102: i2c transfer failed. [ 464.968594][ T5907] dvb-usb: MAC address: 02:02:02:02:02:02 [ 465.015399][ T5907] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 465.090904][ T5907] dvb-usb: bulk message failed: -22 (3/0) [ 465.116971][ T5907] dw2102: command 0x0e transfer failed. [ 465.170638][ T5907] dvb-usb: bulk message failed: -22 (3/0) [ 465.176834][ T5907] dw2102: command 0x0e transfer failed. [ 465.490147][ T5907] dvb-usb: bulk message failed: -22 (3/0) [ 465.496224][ T5907] dw2102: command 0x0e transfer failed. [ 465.502414][ T5907] dvb-usb: bulk message failed: -22 (3/0) [ 465.544174][ T5907] dw2102: command 0x0e transfer failed. [ 465.562933][ T5907] dvb-usb: bulk message failed: -22 (1/0) [ 465.590416][ T5907] dw2102: command 0x51 transfer failed. [ 465.746543][ T5907] DVB: Unable to find symbol ds3000_attach() [ 465.752928][ T9] usb 3-1: new low-speed USB device number 109 using dummy_hcd [ 465.767978][ T5907] dvb-usb: no frontend was attached by 'Hauppauge MAX S2 or WinTV NOVA HD USB2.0' [ 465.912757][ T9] usb 3-1: config 15 has an invalid interface number: 154 but max is 0 [ 465.921321][ T9] usb 3-1: config 15 has an invalid descriptor of length 0, skipping remainder of the config [ 465.936429][ T5907] rc_core: IR keymap rc-su3000 not found [ 465.948840][ T9] usb 3-1: config 15 has no interface number 0 [ 465.958800][ T5907] Registered IR keymap rc-empty [ 465.978880][ T9] usb 3-1: config 15 interface 154 altsetting 7 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 466.012158][ T5907] rc rc0: Hauppauge MAX S2 or WinTV NOVA HD USB2.0 as /devices/platform/dummy_hcd.3/usb4/4-1/rc/rc0 [ 466.058845][ T9] usb 3-1: config 15 interface 154 has no altsetting 0 [ 466.078718][ T5907] input: Hauppauge MAX S2 or WinTV NOVA HD USB2.0 as /devices/platform/dummy_hcd.3/usb4/4-1/rc/rc0/input58 [ 466.168244][ T9] usb 3-1: string descriptor 0 read error: -22 [ 466.175732][ T9] usb 3-1: New USB device found, idVendor=0bc7, idProduct=0002, bcdDevice=9e.7c [ 466.192135][ T5907] dvb-usb: schedule remote query interval to 150 msecs. [ 466.204623][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 466.212930][ T5907] dw2102: su3000_power_ctrl: 0, initialized 1 [ 466.223390][ T5907] dvb-usb: Hauppauge MAX S2 or WinTV NOVA HD USB2.0 successfully initialized and connected. [ 466.243117][ T9] ati_remote 3-1:15.154: ati_remote_probe: Unexpected desc.bNumEndpoints [ 466.290416][ T5907] usb 4-1: USB disconnect, device number 123 [ 466.402746][ T5907] dvb-usb: Hauppauge MAX S2 or WinTV NOVA HD USB2. successfully deinitialized and disconnected. [ 466.685477][T13070] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1932'. [ 466.808633][T13073] [U] V3Fپ"S/4:XTZWTLW= [ 466.810306][T13073] [U] J"E:" [ 466.939459][ T1602] usb 5-1: USB disconnect, device number 108 [ 467.226216][T13077] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1936'. [ 467.525713][T13068] [U] VCΚT-LYMXʛ//BKEAӁ97Y>':D$%:˜SƆZGL: 18AR9!]QГٖ(AY=/ 260 [ 475.949486][ T5923] usb 5-1: new high-speed USB device number 110 using dummy_hcd [ 475.999007][T13214] bond2: invalid ARP target 0.0.0.0 specified for addition [ 476.007080][T13214] bond2: option arp_ip_target: invalid value (0) [ 476.017054][T13214] bond2 (unregistering): Released all slaves [ 476.220736][ T796] hid (null): bogus close delimiter [ 476.226150][ T796] hid (null): unknown global tag 0xe5 [ 476.259370][ T5923] usb 5-1: Using ep0 maxpacket: 16 [ 476.273669][ T5923] usb 5-1: config index 0 descriptor too short (expected 16456, got 72) [ 476.282602][ T5923] usb 5-1: config 0 has an invalid interface number: 125 but max is 1 [ 476.290858][ T5923] usb 5-1: config 0 has an invalid interface number: 125 but max is 1 [ 476.308705][ T5923] usb 5-1: config 0 has an invalid interface number: 125 but max is 1 [ 476.327179][ T5923] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 476.342371][ T5923] usb 5-1: config 0 has no interface number 0 [ 476.348613][ T5923] usb 5-1: config 0 interface 125 altsetting 4 endpoint 0x4 has invalid maxpacket 21760, setting to 64 [ 476.359834][ T5923] usb 5-1: config 0 interface 125 altsetting 4 endpoint 0xB has invalid wMaxPacketSize 0 [ 476.369727][ T5923] usb 5-1: config 0 interface 125 altsetting 4 endpoint 0x2 has invalid wMaxPacketSize 0 [ 476.379687][ T5923] usb 5-1: config 0 interface 125 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 476.504823][T12750] usb 3-1: USB disconnect, device number 114 [ 476.564866][ T5923] usb 5-1: config 0 interface 125 has no altsetting 0 [ 476.575552][ T5923] usb 5-1: config 0 interface 125 has no altsetting 2 [ 476.590678][ T5923] usb 5-1: New USB device found, idVendor=050d, idProduct=0002, bcdDevice=23.27 [ 476.602780][ T5923] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 476.612570][ T5923] usb 5-1: Product: syz [ 476.618306][ T5923] usb 5-1: Manufacturer: syz [ 476.623265][ T5923] usb 5-1: SerialNumber: syz [ 476.671735][ T5923] usb 5-1: config 0 descriptor?? [ 476.686526][ T5923] usb 5-1: selecting invalid altsetting 2 [ 476.825432][T13230] netlink: 168 bytes leftover after parsing attributes in process `syz.1.1979'. [ 476.873329][T13230] binder_alloc: 13229: binder_alloc_buf size -272 failed, no address space [ 476.914049][T13230] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 476.934214][T13231] binder: 13229:13231 ioctl c0306201 200000000380 returned -14 [ 477.810015][ T5923] usb 5-1: USB disconnect, device number 110 [ 478.286307][T13256] FAULT_INJECTION: forcing a failure. [ 478.286307][T13256] name failslab, interval 1, probability 0, space 0, times 0 [ 478.299169][T13256] CPU: 0 UID: 0 PID: 13256 Comm: syz.1.1986 Tainted: G L syzkaller #0 PREEMPT(full) [ 478.299188][T13256] Tainted: [L]=SOFTLOCKUP [ 478.299192][T13256] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 478.299199][T13256] Call Trace: [ 478.299207][T13256] [ 478.299215][T13256] dump_stack_lvl+0xe8/0x150 [ 478.299245][T13256] should_fail_ex+0x412/0x560 [ 478.299271][T13256] should_failslab+0xa8/0x100 [ 478.299293][T13256] __kmalloc_noprof+0xe8/0x760 [ 478.299312][T13256] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 478.299341][T13256] tomoyo_realpath_from_path+0xe3/0x5d0 [ 478.299374][T13256] ? tomoyo_path_number_perm+0x219/0x630 [ 478.299395][T13256] tomoyo_path_number_perm+0x246/0x630 [ 478.299418][T13256] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 478.299440][T13256] ? __lock_acquire+0x6b5/0x2cf0 [ 478.299469][T13256] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 478.299507][T13256] ? __fget_files+0x2a/0x420 [ 478.299553][T13256] ? __fget_files+0x2a/0x420 [ 478.299577][T13256] ? __fget_files+0x3a0/0x420 [ 478.299608][T13256] ? __fget_files+0x2a/0x420 [ 478.299635][T13256] security_file_ioctl+0xc3/0x2a0 [ 478.299656][T13256] __se_sys_ioctl+0x47/0x170 [ 478.299679][T13256] do_syscall_64+0x14d/0xf80 [ 478.299693][T13256] ? trace_irq_disable+0x3b/0x150 [ 478.299718][T13256] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 478.299737][T13256] ? clear_bhb_loop+0x40/0x90 [ 478.299757][T13256] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 478.299774][T13256] RIP: 0033:0x7f3b7499c799 [ 478.299792][T13256] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 478.299806][T13256] RSP: 002b:00007f3b757c5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 478.299817][T13256] RAX: ffffffffffffffda RBX: 00007f3b74c15fa0 RCX: 00007f3b7499c799 [ 478.299825][T13256] RDX: 0000200000000040 RSI: 000000004040534e RDI: 0000000000000004 [ 478.299831][T13256] RBP: 00007f3b757c5090 R08: 0000000000000000 R09: 0000000000000000 [ 478.299838][T13256] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 478.299844][T13256] R13: 00007f3b74c16038 R14: 00007f3b74c15fa0 R15: 00007f3b74d3fa48 [ 478.299859][T13256] [ 478.549324][T13256] ERROR: Out of memory at tomoyo_realpath_from_path. [ 478.809071][T13265] netlink: 'syz.1.1988': attribute type 1 has an invalid length. [ 480.029433][ T5923] usb 2-1: new high-speed USB device number 117 using dummy_hcd [ 480.191196][ T5923] usb 2-1: config index 0 descriptor too short (expected 65187, got 92) [ 480.202561][ T5923] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 480.218430][ T5923] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 480.228009][ T5923] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 480.236283][ T5923] usb 2-1: Product: syz [ 480.240757][ T5923] usb 2-1: Manufacturer: syz [ 480.251525][ T5923] usb 2-1: SerialNumber: syz [ 480.278539][T13296] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 480.278757][ T5923] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 480.300158][ T9] usb 3-1: new high-speed USB device number 115 using dummy_hcd [ 480.306870][T12750] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 480.317323][T13296] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 480.450473][ T9] usb 3-1: Using ep0 maxpacket: 32 [ 480.461850][ T9] usb 3-1: config 0 has an invalid interface number: 67 but max is 0 [ 480.477857][ T9] usb 3-1: config 0 has no interface number 0 [ 480.489022][ T9] usb 3-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 480.502002][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 480.510197][ T796] usb 4-1: new high-speed USB device number 125 using dummy_hcd [ 480.518711][ T9] usb 3-1: Product: syz [ 480.524203][ T9] usb 3-1: Manufacturer: syz [ 480.529044][ T9] usb 3-1: SerialNumber: syz [ 480.537658][ T9] usb 3-1: config 0 descriptor?? [ 480.580060][ T5907] usb 2-1: USB disconnect, device number 117 [ 480.669484][ T796] usb 4-1: Using ep0 maxpacket: 32 [ 480.676716][ T796] usb 4-1: config 2 has an invalid interface number: 194 but max is 0 [ 480.687361][ T796] usb 4-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 480.860376][T13311] netlink: 'syz.1.2000': attribute type 1 has an invalid length. [ 480.902766][ T796] usb 4-1: config 2 has no interface number 0 [ 480.917150][ T796] usb 4-1: config 2 interface 194 altsetting 0 endpoint 0xA has an invalid bInterval 0, changing to 7 [ 480.937741][ T796] usb 4-1: config 2 interface 194 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 4 [ 480.961129][ T796] usb 4-1: New USB device found, idVendor=0499, idProduct=1025, bcdDevice=9c.f6 [ 480.980495][ T796] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 481.231425][ T796] usb 4-1: string descriptor 0 read error: -71 [ 481.250564][ T796] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 481.378709][ T796] usb 4-1: USB disconnect, device number 125 [ 481.541360][T12750] usb 2-1: Service connection timeout for: 258 [ 481.558408][T12750] ath9k_htc 2-1:1.0: ath9k_htc: Unable to initialize HTC services [ 481.568374][T12750] ath9k_htc: Failed to initialize the device [ 481.582264][T13287] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 481.602511][ T5907] usb 2-1: ath9k_htc: USB layer deinitialized [ 481.630322][T13287] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 481.669934][ T9] smsc95xx 3-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -71 [ 481.695038][ T9] smsc95xx 3-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 481.762699][ T9] smsc95xx 3-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000014: -71 [ 481.789951][ T9] smsc95xx 3-1:0.67: probe with driver smsc95xx failed with error -71 [ 481.859521][ T9] usb 3-1: USB disconnect, device number 115 [ 481.940129][ T29] audit: type=1326 audit(1773038516.884:474): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13312 comm="syz.4.2001" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f4ea6f9c799 code=0x0 [ 482.180372][T13328] xt_CT: No such helper "pptp" [ 482.399354][ T9] usb 4-1: new high-speed USB device number 126 using dummy_hcd [ 482.550088][ T9] usb 4-1: Using ep0 maxpacket: 16 [ 482.559025][ T9] usb 4-1: New USB device found, idVendor=1604, idProduct=8007, bcdDevice=af.a6 [ 482.568439][ T9] usb 4-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 482.576719][ T9] usb 4-1: Product: syz [ 482.581015][ T9] usb 4-1: Manufacturer: syz [ 482.585619][ T9] usb 4-1: SerialNumber: syz [ 482.593061][ T9] usb 4-1: config 0 descriptor?? [ 482.609304][ T5907] usb 2-1: new high-speed USB device number 118 using dummy_hcd [ 482.771522][ T5907] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 482.782189][ T5907] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 482.791545][ T5907] usb 2-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 482.810943][ T9] usb 4-1: USB disconnect, device number 126 [ 482.824865][ T5907] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 482.843900][ T5907] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 482.854857][ T5907] usb 2-1: Product: syz [ 482.864008][ T5907] usb 2-1: Manufacturer: syz [ 482.880147][ T5907] usb 2-1: SerialNumber: syz [ 482.897529][ T5907] cdc_ncm 2-1:1.0: skipping garbage [ 482.906992][ T5907] cdc_ncm 2-1:1.0: CDC Union missing and no IAD found [ 482.914543][ T5907] cdc_ncm 2-1:1.0: bind() failure [ 483.094795][T12750] usb 2-1: USB disconnect, device number 118 [ 483.938531][T13352] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2015'. [ 484.112385][T13360] netlink: 'syz.4.2016': attribute type 1 has an invalid length. [ 484.186168][T13360] IPVS: sed: FWM 3 0x00000003 - no destination available [ 485.301414][ T1602] usb 2-1: new high-speed USB device number 119 using dummy_hcd [ 485.340204][ T29] audit: type=1326 audit(1773038520.294:475): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13402 comm="syz.2.2029" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7feb9af9c799 code=0x7ffc0000 [ 485.420910][ T29] audit: type=1326 audit(1773038520.294:476): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13402 comm="syz.2.2029" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7feb9af9c799 code=0x7ffc0000 [ 485.487442][ T1602] usb 2-1: Using ep0 maxpacket: 16 [ 485.507952][ T1602] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xC6, changing to 0x86 [ 485.520333][ T29] audit: type=1326 audit(1773038520.294:477): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13402 comm="syz.2.2029" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7feb9af9c799 code=0x7ffc0000 [ 485.561179][ T1602] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x86 has invalid wMaxPacketSize 0 [ 485.585483][ T1602] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x86 has invalid maxpacket 0 [ 485.593118][ T29] audit: type=1326 audit(1773038520.294:478): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13402 comm="syz.2.2029" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7feb9af9c799 code=0x7ffc0000 [ 485.605550][ T1602] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 485.660685][ T1602] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 485.661545][ T29] audit: type=1326 audit(1773038520.294:479): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13402 comm="syz.2.2029" exe="/root/syz-executor" sig=0 arch=c000003e syscall=326 compat=0 ip=0x7feb9af9c799 code=0x7ffc0000 [ 485.701849][ T1602] usb 2-1: New USB device found, idVendor=054c, idProduct=06c1, bcdDevice=c2.87 [ 485.720024][ T1602] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 485.721471][ T29] audit: type=1326 audit(1773038520.294:480): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13402 comm="syz.2.2029" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7feb9af9c799 code=0x7ffc0000 [ 485.743208][ T1602] usb 2-1: Product: syz [ 485.752295][ T29] audit: type=1326 audit(1773038520.294:481): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13402 comm="syz.2.2029" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7feb9af9c799 code=0x7ffc0000 [ 485.766502][ T1602] usb 2-1: Manufacturer: syz [ 485.778210][ T29] audit: type=1326 audit(1773038520.294:482): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13402 comm="syz.2.2029" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7feb9af9c799 code=0x7ffc0000 [ 485.805294][ T29] audit: type=1326 audit(1773038520.294:483): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13402 comm="syz.2.2029" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7feb9af9c799 code=0x7ffc0000 [ 485.830336][T13422] netlink: 56 bytes leftover after parsing attributes in process `syz.4.2035'. [ 485.855621][T13405] fuse: Unknown parameter 'rootmo' [ 485.879446][ T1602] usb 2-1: SerialNumber: syz [ 485.893400][ T1602] usb 2-1: config 0 descriptor?? [ 485.912164][ T1602] port100 2-1:0.0: NFC: Could not get supported command types [ 486.042738][T13430] netlink: 92 bytes leftover after parsing attributes in process `syz.3.2037'. [ 486.112810][T13397] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 486.124027][T13397] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 486.177048][ T5907] usb 2-1: USB disconnect, device number 119 [ 486.309394][ T9] usb 3-1: new high-speed USB device number 116 using dummy_hcd [ 486.462295][ T9] usb 3-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 486.479323][ T9] usb 3-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 486.499801][ T9] usb 3-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 486.518927][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 486.534824][T13432] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 486.560724][ T9] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 486.755772][T13432] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 486.787407][T13432] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 486.893698][T13444] netlink: 'syz.1.2042': attribute type 1 has an invalid length. [ 486.960873][T13444] bond3: (slave bridge1): Enslaving as a backup interface with an up link [ 486.975530][T13444] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2042'. [ 487.737768][T13445] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 487.745598][T13445] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 487.751984][T13445] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 487.758096][T13445] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 487.764242][T13445] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 488.019633][ T1602] usb 2-1: new high-speed USB device number 120 using dummy_hcd [ 488.027468][T12750] usb 5-1: new high-speed USB device number 111 using dummy_hcd [ 488.089461][ T9] usb 4-1: new high-speed USB device number 127 using dummy_hcd [ 488.179388][ T1602] usb 2-1: device descriptor read/64, error -71 [ 488.199324][T12750] usb 5-1: Using ep0 maxpacket: 16 [ 488.206725][T12750] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 488.217023][T12750] usb 5-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 488.227784][T12750] usb 5-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice= 7.c9 [ 488.237071][T12750] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 488.239312][ T9] usb 4-1: Using ep0 maxpacket: 8 [ 488.245183][T12750] usb 5-1: Product: syz [ 488.253229][ T9] usb 4-1: unable to get BOS descriptor or descriptor too short [ 488.254329][T12750] usb 5-1: Manufacturer: syz [ 488.254349][T12750] usb 5-1: SerialNumber: syz [ 488.273162][ T9] usb 4-1: config 9 has an invalid interface number: 66 but max is 0 [ 488.281862][ T9] usb 4-1: config 9 has no interface number 0 [ 488.291285][ T9] usb 4-1: New USB device found, idVendor=22b8, idProduct=2d95, bcdDevice=a2.a6 [ 488.300716][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 488.308711][ T9] usb 4-1: Product: syz [ 488.313271][ T9] usb 4-1: Manufacturer: syz [ 488.317966][ T9] usb 4-1: SerialNumber: syz [ 488.429593][ T1602] usb 2-1: new high-speed USB device number 121 using dummy_hcd [ 488.556569][ T9] usb 4-1: USB disconnect, device number 127 [ 488.559674][ T1602] usb 2-1: device descriptor read/64, error -71 [ 488.679579][ T1602] usb usb2-port1: attempt power cycle [ 488.757602][T13464] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2048'. [ 488.767027][T13464] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2048'. [ 488.964717][ T9] usb 3-1: USB disconnect, device number 116 [ 489.039491][ T1602] usb 2-1: new high-speed USB device number 122 using dummy_hcd [ 489.049678][ T5825] Bluetooth: hci1: command 0x0c1a tx timeout [ 489.080729][ T1602] usb 2-1: device descriptor read/8, error -71 [ 489.339350][ T1602] usb 2-1: new high-speed USB device number 123 using dummy_hcd [ 489.359729][ T1602] usb 2-1: device descriptor read/8, error -71 [ 489.409361][ T5907] usb 4-1: new full-speed USB device number 2 using dummy_hcd [ 489.469410][ T9] usb 3-1: new high-speed USB device number 117 using dummy_hcd [ 489.477485][ T1602] usb usb2-port1: unable to enumerate USB device [ 489.539480][ T5907] usb 4-1: device descriptor read/64, error -71 [ 489.631304][ T9] usb 3-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 489.640751][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 489.651100][ T9] usb 3-1: config 0 descriptor?? [ 489.661273][ T9] cp210x 3-1:0.0: cp210x converter detected [ 489.769379][ T5825] Bluetooth: hci4: command 0x0c1a tx timeout [ 489.776519][T13477] Bluetooth: hci3: command 0x0c1a tx timeout [ 489.776553][ T5825] Bluetooth: hci2: command 0x0c1a tx timeout [ 489.789521][ T5907] usb 4-1: new full-speed USB device number 3 using dummy_hcd [ 489.789582][ T5825] Bluetooth: hci0: command 0x0c1a tx timeout [ 489.859752][ T9] cp210x 3-1:0.0: failed to get vendor val 0x370b size 1: -32 [ 489.867619][ T9] cp210x 3-1:0.0: querying part number failed [ 489.877808][ T9] usb 3-1: cp210x converter now attached to ttyUSB0 [ 489.929516][ T5907] usb 4-1: device descriptor read/64, error -71 [ 490.039551][ T5907] usb usb4-port1: attempt power cycle [ 490.182941][ T9] usb 5-1: USB disconnect, device number 111 [ 490.390493][ T5907] usb 4-1: new full-speed USB device number 4 using dummy_hcd [ 490.419889][ T5907] usb 4-1: device descriptor read/8, error -71 [ 490.619324][ T9] usb 5-1: new high-speed USB device number 112 using dummy_hcd [ 490.700004][ T5907] usb 4-1: new full-speed USB device number 5 using dummy_hcd [ 490.730025][ T5907] usb 4-1: device descriptor read/8, error -71 [ 490.849847][ T5907] usb usb4-port1: unable to enumerate USB device [ 490.869333][ T9] usb 5-1: Using ep0 maxpacket: 16 [ 490.879787][ T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 490.898099][ T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 490.918221][ T9] usb 5-1: New USB device found, idVendor=1532, idProduct=011b, bcdDevice= 0.00 [ 490.927430][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 490.992070][ T9] usb 5-1: config 0 descriptor?? [ 491.413320][ T9] razer 0003:1532:011B.001B: unbalanced collection at end of report description [ 491.432824][ T9] razer 0003:1532:011B.001B: probe with driver razer failed with error -22 [ 491.615767][ T9] usb 5-1: USB disconnect, device number 112 [ 491.689357][ T1602] usb 2-1: new high-speed USB device number 124 using dummy_hcd [ 491.859419][ T1602] usb 2-1: Using ep0 maxpacket: 32 [ 491.866251][ T1602] usb 2-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 491.875629][ T1602] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 491.885748][ T1602] usb 2-1: config 0 descriptor?? [ 492.093585][ T1602] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 492.102263][ T1602] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 492.112688][ T1602] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 492.119922][ T1602] usb 2-1: media controller created [ 492.137244][ T1602] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 492.208343][T12750] usb 3-1: USB disconnect, device number 117 [ 492.284050][T12750] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 492.295314][T13511] fuse: Bad value for 'rootmode' [ 492.303613][T12750] cp210x 3-1:0.0: device disconnected [ 492.321740][T13515] FAULT_INJECTION: forcing a failure. [ 492.321740][T13515] name failslab, interval 1, probability 0, space 0, times 0 [ 492.334511][T13515] CPU: 1 UID: 0 PID: 13515 Comm: syz.3.2063 Tainted: G L syzkaller #0 PREEMPT(full) [ 492.334539][T13515] Tainted: [L]=SOFTLOCKUP [ 492.334545][T13515] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 492.334556][T13515] Call Trace: [ 492.334563][T13515] [ 492.334571][T13515] dump_stack_lvl+0xe8/0x150 [ 492.334600][T13515] should_fail_ex+0x412/0x560 [ 492.334624][T13515] ? hash_ip4_add+0x78/0x1ee0 [ 492.334757][T13515] should_failslab+0xa8/0x100 [ 492.334781][T13515] __kmalloc_noprof+0xe8/0x760 [ 492.334800][T13515] ? hash_ip4_add+0xc81/0x1ee0 [ 492.334826][T13515] ? hash_ip4_add+0x78/0x1ee0 [ 492.334850][T13515] hash_ip4_add+0xc81/0x1ee0 [ 492.334882][T13515] ? hash_ip4_add+0xa21/0x1ee0 [ 492.334905][T13515] ? hash_ip4_add+0xa21/0x1ee0 [ 492.334938][T13515] hash_ip4_uadt+0x664/0x860 [ 492.334964][T13515] ? __pfx_hash_ip4_add+0x10/0x10 [ 492.334989][T13515] ? __pfx_hash_ip4_uadt+0x10/0x10 [ 492.335029][T13515] call_ad+0x18d/0xb60 [ 492.335055][T13515] ? __pfx_call_ad+0x10/0x10 [ 492.335087][T13515] ? __nla_parse+0x40/0x60 [ 492.335162][T13515] ip_set_ad+0x824/0x9d0 [ 492.335191][T13515] ? __pfx_ip_set_ad+0x10/0x10 [ 492.335245][T13515] nfnetlink_rcv_msg+0xc00/0x12c0 [ 492.335303][T13515] ? unwind_get_return_address+0x4d/0x90 [ 492.335330][T13515] ? nfnetlink_rcv_msg+0x229/0x12c0 [ 492.335367][T13515] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 492.335427][T13515] netlink_rcv_skb+0x232/0x4b0 [ 492.335453][T13515] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 492.335484][T13515] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 492.335517][T13515] ? bpf_lsm_capable+0x9/0x20 [ 492.335541][T13515] ? security_capable+0x7e/0x2c0 [ 492.335570][T13515] nfnetlink_rcv+0x2c0/0x27b0 [ 492.335598][T13515] ? __local_bh_enable_ip+0xd0/0x130 [ 492.335632][T13515] ? lockdep_hardirqs_on+0x7a/0x110 [ 492.335692][T13515] ? __dev_queue_xmit+0x277/0x3890 [ 492.335744][T13515] ? __local_bh_enable_ip+0xd0/0x130 [ 492.335765][T13515] ? __dev_queue_xmit+0x277/0x3890 [ 492.335783][T13515] ? __dev_queue_xmit+0x1e78/0x3890 [ 492.335801][T13515] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 492.335826][T13515] ? __dev_queue_xmit+0x277/0x3890 [ 492.335850][T13515] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 492.335875][T13515] ? __pfx___dev_queue_xmit+0x10/0x10 [ 492.335898][T13515] ? ref_tracker_free+0x693/0x840 [ 492.335919][T13515] ? __copy_skb_header+0xa3/0x4a0 [ 492.335938][T13515] ? __pfx_ref_tracker_free+0x10/0x10 [ 492.335972][T13515] ? skb_clone+0x246/0x3a0 [ 492.335993][T13515] ? __netlink_deliver_tap+0x807/0x850 [ 492.336016][T13515] ? netlink_deliver_tap+0x2e/0x1b0 [ 492.336044][T13515] ? netlink_deliver_tap+0x2e/0x1b0 [ 492.336074][T13515] netlink_unicast+0x80f/0x9b0 [ 492.336103][T13515] ? __pfx_netlink_unicast+0x10/0x10 [ 492.336126][T13515] ? netlink_sendmsg+0x650/0xb40 [ 492.336147][T13515] ? skb_put+0x11b/0x210 [ 492.336176][T13515] netlink_sendmsg+0x813/0xb40 [ 492.336208][T13515] ? __pfx_netlink_sendmsg+0x10/0x10 [ 492.336233][T13515] ? aa_sock_msg_perm+0xf1/0x1b0 [ 492.336256][T13515] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 492.336279][T13515] ____sys_sendmsg+0x972/0x9f0 [ 492.336305][T13515] ? __pfx_____sys_sendmsg+0x10/0x10 [ 492.336331][T13515] ? import_iovec+0x73/0xa0 [ 492.336359][T13515] ___sys_sendmsg+0x2a5/0x360 [ 492.336381][T13515] ? __pfx____sys_sendmsg+0x10/0x10 [ 492.336431][T13515] ? __fget_files+0x2a/0x420 [ 492.336461][T13515] ? __fget_files+0x3a0/0x420 [ 492.336497][T13515] __x64_sys_sendmsg+0x1bd/0x2a0 [ 492.336514][T13515] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 492.336539][T13515] ? __pfx_ksys_write+0x10/0x10 [ 492.336568][T13515] do_syscall_64+0x14d/0xf80 [ 492.336586][T13515] ? trace_irq_disable+0x3b/0x150 [ 492.336608][T13515] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 492.336625][T13515] ? clear_bhb_loop+0x40/0x90 [ 492.336645][T13515] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 492.336662][T13515] RIP: 0033:0x7f059b19c799 [ 492.336680][T13515] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 492.336694][T13515] RSP: 002b:00007f059c012028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 492.336713][T13515] RAX: ffffffffffffffda RBX: 00007f059b415fa0 RCX: 00007f059b19c799 [ 492.336725][T13515] RDX: 0000000000000004 RSI: 0000200000000000 RDI: 0000000000000003 [ 492.336735][T13515] RBP: 00007f059c012090 R08: 0000000000000000 R09: 0000000000000000 [ 492.336744][T13515] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 492.336755][T13515] R13: 00007f059b416038 R14: 00007f059b415fa0 R15: 00007f059b53fa48 [ 492.336784][T13515] [ 492.838717][T13518] syzkaller1: entered promiscuous mode [ 492.854827][T13518] syzkaller1: entered allmulticast mode [ 492.864397][T13522] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2066'. [ 493.145115][T13526] kvm: kvm [13525]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0xc1) = 0x592ec0000000 [ 493.179389][T12750] usb 3-1: new high-speed USB device number 118 using dummy_hcd [ 493.209818][T13526] kvm: kvm [13525]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0xc2) = 0x8428c0000000 [ 493.292807][T13526] kvm: kvm [13525]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x11e) = 0xa340c0000000 [ 493.331182][T12750] usb 3-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 493.341199][T12750] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 493.352131][T12750] usb 3-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 493.361730][T12750] usb 3-1: config 1 has no interface number 1 [ 493.368027][T12750] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 493.376265][T13526] kvm: kvm [13525]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x186) = 0x5835c0000000 [ 493.392080][T12750] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 493.405191][T12750] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 493.423733][T12750] usb 3-1: Product: syz [ 493.434575][T12750] usb 3-1: Manufacturer: syz [ 493.445990][T12750] usb 3-1: SerialNumber: syz [ 493.454968][T13526] kvm: kvm [13525]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x187) = 0x3c4fc0000000 [ 493.469353][ T1602] stb0899_attach: Driver disabled by Kconfig [ 493.475517][ T1602] az6027: no front-end attached [ 493.475517][ T1602] [ 493.484757][ T1602] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 493.509582][ T1602] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.1/usb2/2-1/input/input60 [ 493.565328][ T1602] dvb-usb: schedule remote query interval to 400 msecs. [ 493.587798][ T1602] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 493.684118][T12750] usb 3-1: No MIDI 2.0 at altset 1, falling back to MIDI 1.0 [ 493.699552][T12750] usb 3-1: MIDIStreaming interface descriptor not found [ 493.708493][T13518] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2065'. [ 493.721537][T13518] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2065'. [ 493.832912][T12750] usb 3-1: USB disconnect, device number 118 [ 493.887012][ T5822] udevd[5822]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.2/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 494.168566][T13547] binder: 13546:13547 ioctl c018620c 200000000240 returned -22 [ 494.180559][T13548] ptrace attach of "./syz-executor exec"[5840] was attempted by "./syz-executor exec"[13548] [ 494.219604][ T5907] usb 2-1: USB disconnect, device number 124 [ 494.306254][ T5907] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 494.450515][T13562] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2078'. [ 494.459582][ T796] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 494.484343][T13562] netlink: 'syz.1.2078': attribute type 5 has an invalid length. [ 494.498936][T13562] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2078'. [ 494.517576][T13562] geneve3: entered promiscuous mode [ 494.528751][T13562] geneve3: entered allmulticast mode [ 494.536083][ T7025] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 256 - 0 [ 494.548718][ T7025] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 256 - 0 [ 494.569957][ T7025] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 256 - 0 [ 494.578801][ T7025] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 256 - 0 [ 494.609367][ T796] usb 4-1: device descriptor read/64, error -71 [ 494.709323][ T5907] usb 5-1: new high-speed USB device number 113 using dummy_hcd [ 494.869333][ T796] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 494.876883][ T5907] usb 5-1: Using ep0 maxpacket: 16 [ 494.884669][ T5907] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 494.925832][ T5907] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 494.962237][ T5907] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 495.003498][ T5907] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 495.017248][ T796] usb 4-1: device descriptor read/64, error -71 [ 495.033161][T13571] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 495.039336][ T5907] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 495.044135][T13571] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 495.058638][ T5907] usb 5-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 495.079627][ T5907] usb 5-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 495.087679][ T5907] usb 5-1: Manufacturer: syz [ 495.108228][ T5907] usb 5-1: config 0 descriptor?? [ 495.144139][ T796] usb usb4-port1: attempt power cycle [ 495.268649][ T1602] usb 2-1: new high-speed USB device number 125 using dummy_hcd [ 495.337126][T13564] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 495.391198][T13588] netlink: 'syz.2.2085': attribute type 5 has an invalid length. [ 495.429332][ T1602] usb 2-1: Using ep0 maxpacket: 8 [ 495.436408][ T1602] usb 2-1: unable to get BOS descriptor or descriptor too short [ 495.446366][ T1602] usb 2-1: config 7 has an invalid interface number: 6 but max is 0 [ 495.458688][ T1602] usb 2-1: config 7 has no interface number 0 [ 495.466856][ T1602] usb 2-1: config 7 interface 6 altsetting 254 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 495.480296][ T1602] usb 2-1: config 7 interface 6 has no altsetting 0 [ 495.488852][ T1602] usb 2-1: New USB device found, idVendor=1a8d, idProduct=100d, bcdDevice=30.9e [ 495.498403][ T1602] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 495.506743][ T1602] usb 2-1: Product: syz [ 495.511085][ T1602] usb 2-1: Manufacturer: syz [ 495.515692][ T1602] usb 2-1: SerialNumber: syz [ 495.519387][ T796] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 495.550023][ T796] usb 4-1: device descriptor read/8, error -71 [ 495.659410][ T9] usb 3-1: new full-speed USB device number 119 using dummy_hcd [ 495.732184][ T1602] option 2-1:7.6: GSM modem (1-port) converter detected [ 495.744883][ T1602] usb 2-1: USB disconnect, device number 125 [ 495.754885][ T1602] option 2-1:7.6: device disconnected [ 495.789531][ T796] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 495.811530][ T796] usb 4-1: device descriptor read/8, error -71 [ 495.819653][ T9] usb 3-1: unable to get BOS descriptor or descriptor too short [ 495.827843][ T9] usb 3-1: not running at top speed; connect to a high speed hub [ 495.837227][ T9] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 128, changing to 4 [ 495.848485][ T9] usb 3-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 22, changing to 4 [ 495.861118][ T9] usb 3-1: config 1 interface 2 altsetting 1 endpoint 0x82 has invalid maxpacket 39669, setting to 1023 [ 495.874487][ T9] usb 3-1: New USB device found, idVendor=041e, idProduct=3020, bcdDevice= 0.40 [ 495.883660][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 495.892632][ T9] usb 3-1: Product: syz [ 495.896827][ T9] usb 3-1: Manufacturer: syz [ 495.901488][ T9] usb 3-1: SerialNumber: syz [ 495.920054][ T796] usb usb4-port1: unable to enumerate USB device [ 496.180114][ T9] usb 3-1: 1:1 : incorrect wMaxPacketSize for BADD profile [ 496.187771][ T9] usb 3-1: incorrect wMaxPacketSize 0x3ff for BADD profile [ 496.223663][ T9] snd-usb-audio 3-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 496.239569][ T9] usb 3-1: USB disconnect, device number 119 [ 496.293392][ T5969] udevd[5969]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 496.639108][T13592] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2086'. [ 496.712392][T13593] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2086'. [ 497.587168][ T9] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 497.609297][ T5907] rc_core: IR keymap rc-hauppauge not found [ 497.627227][ T5907] Registered IR keymap rc-empty [ 497.632654][ T5907] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 497.659423][ T5907] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 497.690606][ T5907] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0 [ 497.720756][ T5907] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0/input61 [ 497.758710][ T5907] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 497.792573][ T9] usb 4-1: config 0 has no interfaces? [ 497.801754][ T9] usb 4-1: New USB device found, idVendor=1e7d, idProduct=2cf6, bcdDevice= 0.00 [ 497.810966][ T5907] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 497.819295][ T9] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 497.837837][ T9] usb 4-1: Manufacturer: syz [ 497.846877][T13641] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2094'. [ 497.849931][ T5907] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 497.881147][ T9] usb 4-1: config 0 descriptor?? [ 497.890392][ T5907] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 497.909812][ T5907] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 497.939822][ T5907] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 497.960027][ T5907] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 497.981526][ T5907] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 498.003915][ T5907] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 498.033124][ T5907] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 498.061377][ T5907] mceusb 5-1:0.0: Registered with mce emulator interface version 1 [ 498.070331][ T5907] mceusb 5-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 498.089102][ T5907] usb 5-1: USB disconnect, device number 113 [ 498.110174][ T9] usb 3-1: new high-speed USB device number 120 using dummy_hcd [ 498.124103][ T1602] usb 4-1: USB disconnect, device number 10 [ 498.291656][ T9] usb 3-1: config 1 interface 0 altsetting 112 bulk endpoint 0x82 has invalid maxpacket 32 [ 498.301968][ T9] usb 3-1: config 1 interface 0 altsetting 112 bulk endpoint 0x3 has invalid maxpacket 1024 [ 498.312376][ T9] usb 3-1: config 1 interface 0 has no altsetting 0 [ 498.322999][ T9] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 498.334325][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 498.342586][ T9] usb 3-1: Product: ࠧ [ 498.346776][ T9] usb 3-1: Manufacturer: Ђ [ 498.352997][ T9] usb 3-1: SerialNumber: 枹㦝紘洁݊⇱ྤ恨ꓦⷦ춋岉吃븩ȡ垼痸칡ಬ﹒㡀⥣࿔젶瘙ꢅ맆处⏴㏽䮨㭅빛ܿ媅呏﹗䵸价ʑ풁ꗸ掸ᚦꝪ먩⺐曗費끫閧뷗臆쇳ٶ构ᙫ [ 498.381018][T13643] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 498.396047][T13643] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 498.623977][ T9] cdc_ether 3-1:1.0: probe with driver cdc_ether failed with error -71 [ 498.666339][ T9] usb 3-1: USB disconnect, device number 120 [ 498.682787][ T5907] usb 2-1: new high-speed USB device number 126 using dummy_hcd [ 498.869335][ T5907] usb 2-1: Using ep0 maxpacket: 32 [ 498.876772][ T5907] usb 2-1: config 0 has an invalid interface number: 188 but max is 0 [ 498.885396][ T5907] usb 2-1: config 0 has no interface number 0 [ 498.900352][ T5907] usb 2-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 498.912949][ T5907] usb 2-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 498.922575][ T5907] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 498.931411][ T5907] usb 2-1: Product: syz [ 498.935716][ T5907] usb 2-1: Manufacturer: syz [ 498.940486][ T5907] usb 2-1: SerialNumber: syz [ 498.947364][ T5907] usb 2-1: config 0 descriptor?? [ 498.955377][T13662] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 498.999322][ T10] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 499.149455][ T10] usb 4-1: Using ep0 maxpacket: 32 [ 499.164112][T13662] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 499.176258][ T10] usb 4-1: New USB device found, idVendor=1039, idProduct=2120, bcdDevice= 2.a7 [ 499.187978][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 499.196700][ T10] usb 4-1: Product: syz [ 499.201459][ T10] usb 4-1: Manufacturer: syz [ 499.211566][ T5907] asix 2-1:0.188: probe with driver asix failed with error -71 [ 499.221875][ T10] usb 4-1: SerialNumber: syz [ 499.234337][ T10] usb 4-1: config 0 descriptor?? [ 499.243983][ T5907] usb 2-1: USB disconnect, device number 126 [ 499.463273][ T10] usb 4-1: [ueagle-atm] ADSL device founded vid (0X1039) pid (0X2120) Rev (0X2A7): Eagle II [ 499.599400][ T5907] usb 2-1: new high-speed USB device number 127 using dummy_hcd [ 499.749308][ T5907] usb 2-1: Using ep0 maxpacket: 16 [ 499.757443][ T5907] usb 2-1: config 0 has an invalid interface number: 8 but max is 0 [ 499.767327][ T5907] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 499.779716][ T5907] usb 2-1: config 0 has no interface number 0 [ 499.790827][ T5907] usb 2-1: config 0 interface 8 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 499.805447][ T5907] usb 2-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 499.814912][ T5907] usb 2-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 499.823071][ T5907] usb 2-1: Product: syz [ 499.830790][ T5907] usb 2-1: SerialNumber: syz [ 499.837223][ T5907] usb 2-1: config 0 descriptor?? [ 499.845189][ T5907] usbhid 2-1:0.8: couldn't find an input interrupt endpoint [ 500.023138][ T5907] usb 5-1: new high-speed USB device number 114 using dummy_hcd [ 500.105238][ T10] usb 4-1: reset high-speed USB device number 11 using dummy_hcd [ 500.180345][ T5907] usb 5-1: Using ep0 maxpacket: 8 [ 500.188618][ T5907] usb 5-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 48, changing to 7 [ 500.212039][ T5907] usb 5-1: New USB device found, idVendor=0499, idProduct=150a, bcdDevice= 0.40 [ 500.221703][ T5907] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 500.271563][ T5907] usb 5-1: Product: syz [ 500.275788][ T5907] usb 5-1: Manufacturer: syz [ 500.320813][ T5907] usb 5-1: SerialNumber: syz [ 500.375330][T13691] loop6: detected capacity change from 0 to 524288000 [ 500.538438][ T10] usb 4-1: [UEAGLE-ATM] interface 1 not found [ 500.574177][T13693] bond2: option ad_user_port_key: invalid value (19034) [ 500.581350][T13693] bond2: option ad_user_port_key: allowed values 0 - 1023 [ 500.612053][ T10] ueagle-atm 4-1:0.0: usbatm_usb_probe: bind failed: -19! [ 500.623375][ T29] kauditd_printk_skb: 116 callbacks suppressed [ 500.623393][ T29] audit: type=1326 audit(1773038535.564:600): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13694 comm="syz.0.2114" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f09df39c799 code=0x7ffc0000 [ 500.668047][ T5907] usb 5-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 500.680251][ T5907] usb 5-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 500.690469][T13693] bond2 (unregistering): Released all slaves [ 500.717408][ T29] audit: type=1326 audit(1773038535.604:601): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13694 comm="syz.0.2114" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f09df39c799 code=0x7ffc0000 [ 500.746336][ T1602] usb 4-1: USB disconnect, device number 11 [ 500.759520][ T29] audit: type=1326 audit(1773038535.604:602): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13694 comm="syz.0.2114" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f09df39c799 code=0x7ffc0000 [ 500.846004][ T29] audit: type=1326 audit(1773038535.604:603): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13694 comm="syz.0.2114" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f09df39c799 code=0x7ffc0000 [ 501.073638][ T29] audit: type=1326 audit(1773038535.604:604): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13694 comm="syz.0.2114" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f09df39c799 code=0x7ffc0000 [ 501.075786][ T5907] usb 5-1: USB disconnect, device number 114 [ 501.188171][ T10] usb 2-1: USB disconnect, device number 127 [ 501.217551][ T29] audit: type=1326 audit(1773038535.604:605): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13694 comm="syz.0.2114" exe="/root/syz-executor" sig=0 arch=c000003e syscall=50 compat=0 ip=0x7f09df39c799 code=0x7ffc0000 [ 501.289838][ T5835] udevd[5835]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 501.312080][ T29] audit: type=1326 audit(1773038535.604:606): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13694 comm="syz.0.2114" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f09df39c799 code=0x7ffc0000 [ 501.346957][ T29] audit: type=1326 audit(1773038535.614:607): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13694 comm="syz.0.2114" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f09df39c799 code=0x7ffc0000 [ 501.371592][ T29] audit: type=1326 audit(1773038535.614:608): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13694 comm="syz.0.2114" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f09df39c799 code=0x7ffc0000 [ 501.400203][ T29] audit: type=1326 audit(1773038535.614:609): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13694 comm="syz.0.2114" exe="/root/syz-executor" sig=0 arch=c000003e syscall=327 compat=0 ip=0x7f09df39c799 code=0x7ffc0000 [ 501.452207][ T1298] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.472860][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.580748][T13707] FAULT_INJECTION: forcing a failure. [ 501.580748][T13707] name failslab, interval 1, probability 0, space 0, times 0 [ 501.593488][T13707] CPU: 1 UID: 0 PID: 13707 Comm: syz.3.2116 Tainted: G L syzkaller #0 PREEMPT(full) [ 501.593511][T13707] Tainted: [L]=SOFTLOCKUP [ 501.593516][T13707] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 501.593523][T13707] Call Trace: [ 501.593529][T13707] [ 501.593535][T13707] dump_stack_lvl+0xe8/0x150 [ 501.593555][T13707] should_fail_ex+0x412/0x560 [ 501.593570][T13707] ? hash_ip4_add+0x78/0x1ee0 [ 501.593586][T13707] should_failslab+0xa8/0x100 [ 501.593601][T13707] __kmalloc_noprof+0xe8/0x760 [ 501.593612][T13707] ? hash_ip4_add+0xc81/0x1ee0 [ 501.593627][T13707] ? hash_ip4_add+0x78/0x1ee0 [ 501.593640][T13707] hash_ip4_add+0xc81/0x1ee0 [ 501.593659][T13707] ? hash_ip4_add+0xa21/0x1ee0 [ 501.593672][T13707] ? hash_ip4_add+0xa21/0x1ee0 [ 501.593691][T13707] hash_ip4_uadt+0x664/0x860 [ 501.593707][T13707] ? __pfx_hash_ip4_add+0x10/0x10 [ 501.593720][T13707] ? __pfx_hash_ip4_uadt+0x10/0x10 [ 501.593743][T13707] call_ad+0x18d/0xb60 [ 501.593758][T13707] ? __pfx_call_ad+0x10/0x10 [ 501.593776][T13707] ? __nla_parse+0x40/0x60 [ 501.593792][T13707] ip_set_ad+0x824/0x9d0 [ 501.593807][T13707] ? __pfx_ip_set_ad+0x10/0x10 [ 501.593835][T13707] nfnetlink_rcv_msg+0xc00/0x12c0 [ 501.593847][T13707] ? unwind_get_return_address+0x4d/0x90 [ 501.593863][T13707] ? nfnetlink_rcv_msg+0x229/0x12c0 [ 501.593882][T13707] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 501.593919][T13707] netlink_rcv_skb+0x232/0x4b0 [ 501.593934][T13707] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 501.593946][T13707] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 501.593964][T13707] ? bpf_lsm_capable+0x9/0x20 [ 501.593978][T13707] ? security_capable+0x7e/0x2c0 [ 501.593995][T13707] nfnetlink_rcv+0x2c0/0x27b0 [ 501.594011][T13707] ? __local_bh_enable_ip+0xd0/0x130 [ 501.594024][T13707] ? lockdep_hardirqs_on+0x7a/0x110 [ 501.594039][T13707] ? __dev_queue_xmit+0x277/0x3890 [ 501.594051][T13707] ? __local_bh_enable_ip+0xd0/0x130 [ 501.594062][T13707] ? __dev_queue_xmit+0x277/0x3890 [ 501.594072][T13707] ? __dev_queue_xmit+0x1e78/0x3890 [ 501.594081][T13707] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 501.594095][T13707] ? __dev_queue_xmit+0x277/0x3890 [ 501.594107][T13707] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 501.594122][T13707] ? __pfx___dev_queue_xmit+0x10/0x10 [ 501.594135][T13707] ? ref_tracker_free+0x693/0x840 [ 501.594147][T13707] ? __copy_skb_header+0xa3/0x4a0 [ 501.594158][T13707] ? __pfx_ref_tracker_free+0x10/0x10 [ 501.594178][T13707] ? skb_clone+0x246/0x3a0 [ 501.594190][T13707] ? __netlink_deliver_tap+0x807/0x850 [ 501.594203][T13707] ? netlink_deliver_tap+0x2e/0x1b0 [ 501.594218][T13707] ? netlink_deliver_tap+0x2e/0x1b0 [ 501.594234][T13707] netlink_unicast+0x80f/0x9b0 [ 501.594250][T13707] ? __pfx_netlink_unicast+0x10/0x10 [ 501.594262][T13707] ? netlink_sendmsg+0x650/0xb40 [ 501.594274][T13707] ? skb_put+0x11b/0x210 [ 501.594289][T13707] netlink_sendmsg+0x813/0xb40 [ 501.594307][T13707] ? __pfx_netlink_sendmsg+0x10/0x10 [ 501.594321][T13707] ? aa_sock_msg_perm+0xf1/0x1b0 [ 501.594335][T13707] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 501.594347][T13707] ____sys_sendmsg+0x972/0x9f0 [ 501.594362][T13707] ? __pfx_____sys_sendmsg+0x10/0x10 [ 501.594376][T13707] ? import_iovec+0x73/0xa0 [ 501.594392][T13707] ___sys_sendmsg+0x2a5/0x360 [ 501.594404][T13707] ? __pfx____sys_sendmsg+0x10/0x10 [ 501.594429][T13707] ? __fget_files+0x2a/0x420 [ 501.594444][T13707] ? __fget_files+0x3a0/0x420 [ 501.594462][T13707] __x64_sys_sendmsg+0x1bd/0x2a0 [ 501.594474][T13707] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 501.594488][T13707] ? __pfx_ksys_write+0x10/0x10 [ 501.594512][T13707] do_syscall_64+0x14d/0xf80 [ 501.594521][T13707] ? trace_irq_disable+0x3b/0x150 [ 501.594536][T13707] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 501.594545][T13707] ? clear_bhb_loop+0x40/0x90 [ 501.594558][T13707] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 501.594568][T13707] RIP: 0033:0x7f059b19c799 [ 501.594580][T13707] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 501.594589][T13707] RSP: 002b:00007f059c012028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 501.594601][T13707] RAX: ffffffffffffffda RBX: 00007f059b415fa0 RCX: 00007f059b19c799 [ 501.594608][T13707] RDX: 0000000000000004 RSI: 0000200000000000 RDI: 0000000000000003 [ 501.594615][T13707] RBP: 00007f059c012090 R08: 0000000000000000 R09: 0000000000000000 [ 501.594621][T13707] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 501.594627][T13707] R13: 00007f059b416038 R14: 00007f059b415fa0 R15: 00007f059b53fa48 [ 501.594642][T13707] [ 502.297092][ T750] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 20001 - 0 [ 502.315230][T13721] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2119'. [ 502.329457][ T750] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 20001 - 0 [ 502.365593][ T750] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 20001 - 0 [ 502.481427][ T750] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 20001 - 0 [ 502.819573][ T1602] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 502.827344][T12750] usb 5-1: new high-speed USB device number 115 using dummy_hcd [ 502.979455][ T1602] usb 2-1: device descriptor read/64, error -71 [ 502.985872][T12750] usb 5-1: device descriptor read/64, error -71 [ 503.229622][ T1602] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 503.257235][T12750] usb 5-1: new high-speed USB device number 116 using dummy_hcd [ 503.399567][ T1602] usb 2-1: device descriptor read/64, error -71 [ 503.407205][T12750] usb 5-1: device descriptor read/64, error -71 [ 503.529646][ T1602] usb usb2-port1: attempt power cycle [ 503.549112][T12750] usb usb5-port1: attempt power cycle [ 503.810411][T13762] binder: 13759:13762 ioctl 8038550a 200000000040 returned -22 [ 503.919964][T12750] usb 5-1: new high-speed USB device number 117 using dummy_hcd [ 503.927811][ T1602] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 503.952093][T12750] usb 5-1: device descriptor read/8, error -71 [ 503.960923][ T1602] usb 2-1: device descriptor read/8, error -71 [ 504.189316][T12750] usb 5-1: new high-speed USB device number 118 using dummy_hcd [ 504.209356][ T1602] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 504.217759][T12750] usb 5-1: device descriptor read/8, error -71 [ 504.230008][ T1602] usb 2-1: device descriptor read/8, error -71 [ 504.329594][T12750] usb usb5-port1: unable to enumerate USB device [ 504.339724][ T1602] usb usb2-port1: unable to enumerate USB device [ 504.489379][T13774] xt_HMARK: spi-set and port-set can't be combined [ 504.841589][T13788] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2141'. [ 504.944907][T13792] x_tables: ip6_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 504.955782][T13792] x_tables: ip6_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 504.967041][T13792] x_tables: ip6_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 504.978271][T13792] x_tables: ip6_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 504.989990][T13792] x_tables: ip6_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 505.000864][T13792] x_tables: ip6_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 505.012027][T13792] x_tables: ip6_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 505.024517][T13792] x_tables: ip6_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 505.035723][T13792] x_tables: ip6_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 505.046786][T13792] x_tables: ip6_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 505.699709][T13806] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2145'. [ 506.015207][T13813] bridge2: entered promiscuous mode [ 506.029304][T13813] bridge2: entered allmulticast mode [ 506.060073][T13808] Option '[y$ [ 506.060073][T13808] >ڎTkS@SVfhJ' to dns_resolver key: bad/missing value [ 506.276740][T13827] loop3: detected capacity change from 0 to 7 [ 506.287137][ T5835] Dev loop3: unable to read RDB block 7 [ 506.294174][ T5835] loop3: unable to read partition table [ 506.300448][ T5835] loop3: partition table beyond EOD, truncated [ 506.324555][T13827] Dev loop3: unable to read RDB block 7 [ 506.342775][T13827] loop3: unable to read partition table [ 506.351626][T13827] loop3: partition table beyond EOD, truncated [ 506.381611][T13827] loop_reread_partitions: partition scan of loop3 (被x ) failed (rc=-5) [ 506.717677][ T10] usb 5-1: new high-speed USB device number 119 using dummy_hcd [ 506.861282][T13851] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2160'. [ 506.876390][T13851] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2160'. [ 506.889971][ T10] usb 5-1: Using ep0 maxpacket: 16 [ 506.897432][ T10] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 506.918869][ T10] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 506.939374][ T10] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 506.952549][ T10] usb 5-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 506.962228][ T10] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 506.973375][ T10] usb 5-1: config 0 descriptor?? [ 507.031496][T13858] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2162'. [ 507.042023][T13858] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2162'. [ 507.052552][T13858] netlink: 160 bytes leftover after parsing attributes in process `syz.1.2162'. [ 507.062923][T13858] A link change request failed with some changes committed already. Interface gre0 may have been left with an inconsistent configuration, please check. [ 507.119463][ T5907] usb 3-1: new low-speed USB device number 121 using dummy_hcd [ 507.270934][ T5907] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 507.279031][ T5907] usb 3-1: config 0 has no interface number 0 [ 507.297365][ T5907] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 507.318797][ T5907] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 507.350199][ T5907] usb 3-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 507.362013][ T5907] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 507.385874][ T5907] usb 3-1: config 0 descriptor?? [ 507.393114][T13834] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 507.407266][T13853] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 507.419802][T13834] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 507.445570][ T5907] iowarrior 3-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 507.475201][ T10] microsoft 0003:045E:07DA.001C: hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.4-1/input0 [ 507.503112][ T10] microsoft 0003:045E:07DA.001C: no inputs found [ 507.517900][ T10] microsoft 0003:045E:07DA.001C: could not initialize ff, continuing anyway [ 507.636080][T12750] usb 3-1: USB disconnect, device number 121 [ 507.642193][ C1] iowarrior 3-1:0.1: iowarrior_callback - usb_submit_urb failed with result -19 [ 507.670075][ T5907] usb 5-1: USB disconnect, device number 119 [ 507.709881][T13855] input: syz0 as /devices/virtual/input/input65 [ 507.741276][ T10] usb 4-1: new full-speed USB device number 12 using dummy_hcd [ 507.889759][ T10] usb 4-1: device descriptor read/64, error -71 [ 508.139331][ T10] usb 4-1: new full-speed USB device number 13 using dummy_hcd [ 508.289545][ T10] usb 4-1: device descriptor read/64, error -71 [ 508.409836][ T10] usb usb4-port1: attempt power cycle [ 508.807196][ T9] usb 3-1: new full-speed USB device number 122 using dummy_hcd [ 508.815031][ T10] usb 4-1: new full-speed USB device number 14 using dummy_hcd [ 508.847054][ T10] usb 4-1: device descriptor read/8, error -71 [ 509.215308][ T9] usb 3-1: device descriptor read/64, error -71 [ 509.549509][ T10] usb 4-1: new full-speed USB device number 15 using dummy_hcd [ 509.569816][ T10] usb 4-1: device descriptor read/8, error -71 [ 509.689372][ T9] usb 3-1: new full-speed USB device number 123 using dummy_hcd [ 509.697355][ T10] usb usb4-port1: unable to enumerate USB device [ 509.850497][ T9] usb 3-1: device descriptor read/64, error -71 [ 509.959613][ T9] usb usb3-port1: attempt power cycle [ 510.009611][ T10] usb 5-1: new high-speed USB device number 120 using dummy_hcd [ 510.159313][ T10] usb 5-1: Using ep0 maxpacket: 8 [ 510.166808][ T10] usb 5-1: unable to get BOS descriptor or descriptor too short [ 510.176857][ T10] usb 5-1: config 8 interface 0 altsetting 7 endpoint 0x83 has invalid wMaxPacketSize 0 [ 510.187066][ T10] usb 5-1: config 8 interface 0 altsetting 7 bulk endpoint 0x83 has invalid maxpacket 0 [ 510.197359][ T10] usb 5-1: config 8 interface 0 has no altsetting 0 [ 510.206266][ T10] usb 5-1: New USB device found, idVendor=07fd, idProduct=0001, bcdDevice=6a.e5 [ 510.215649][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 510.223897][ T10] usb 5-1: Product: syz [ 510.228130][ T10] usb 5-1: Manufacturer: syz [ 510.233005][ T10] usb 5-1: SerialNumber: syz [ 510.299330][ T9] usb 3-1: new full-speed USB device number 124 using dummy_hcd [ 510.319962][ T9] usb 3-1: device descriptor read/8, error -71 [ 510.454585][ T10] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 510.462341][ T10] usb 5-1: selecting invalid altsetting 0 [ 510.589787][ T9] usb 3-1: new full-speed USB device number 125 using dummy_hcd [ 510.610802][T13936] FAULT_INJECTION: forcing a failure. [ 510.610802][T13936] name failslab, interval 1, probability 0, space 0, times 0 [ 510.624712][ T9] usb 3-1: device descriptor read/8, error -71 [ 510.636181][ T10] snd-usb-audio 5-1:8.0: probe with driver snd-usb-audio failed with error -12 [ 510.639114][T13938] tipc: Enabling of bearer rejected, failed to enable media [ 510.652344][ T10] usb 5-1: USB disconnect, device number 120 [ 510.677712][T13936] CPU: 0 UID: 0 PID: 13936 Comm: syz.0.2185 Tainted: G L syzkaller #0 PREEMPT(full) [ 510.677744][T13936] Tainted: [L]=SOFTLOCKUP [ 510.677750][T13936] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 510.677761][T13936] Call Trace: [ 510.677768][T13936] [ 510.677776][T13936] dump_stack_lvl+0xe8/0x150 [ 510.677806][T13936] should_fail_ex+0x412/0x560 [ 510.677834][T13936] should_failslab+0xa8/0x100 [ 510.677856][T13936] ? anon_vma_clone+0x412/0xa00 [ 510.677909][T13936] kmem_cache_alloc_noprof+0x87/0x650 [ 510.677935][T13936] anon_vma_clone+0x412/0xa00 [ 510.677963][T13936] vma_expand+0xbf1/0xfa0 [ 510.677995][T13936] vma_merge_new_range+0x6a6/0x860 [ 510.678028][T13936] copy_vma+0x4fb/0x9e0 [ 510.678061][T13936] ? __pfx_copy_vma+0x10/0x10 [ 510.678090][T13936] ? __vma_start_exclude_readers+0x667/0x940 [ 510.678126][T13936] ? move_vma+0x6a2/0x1800 [ 510.678159][T13936] move_vma+0x829/0x1800 [ 510.678204][T13936] ? arch_get_unmapped_area_topdown+0x264/0xb60 [ 510.678231][T13936] ? __pfx_move_vma+0x10/0x10 [ 510.678260][T13936] ? __pfx_arch_get_unmapped_area_topdown+0x10/0x10 [ 510.678294][T13936] ? cap_mmap_addr+0xaf/0x100 [ 510.678315][T13936] ? bpf_lsm_mmap_addr+0x9/0x50 [ 510.678345][T13936] mremap_to+0x788/0x850 [ 510.678376][T13936] ? __pfx_mremap_to+0x10/0x10 [ 510.678399][T13936] ? may_expand_vm+0x1b4/0x2f0 [ 510.678420][T13936] ? check_prep_vma+0x8d2/0xb10 [ 510.678452][T13936] __se_sys_mremap+0xd37/0xfc0 [ 510.678485][T13936] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 510.678516][T13936] ? __pfx___se_sys_mremap+0x10/0x10 [ 510.678545][T13936] ? fput+0xa0/0xd0 [ 510.678584][T13936] ? ksys_write+0x242/0x270 [ 510.678607][T13936] ? __pfx_ksys_write+0x10/0x10 [ 510.678631][T13936] ? __x64_sys_mremap+0x20/0xc0 [ 510.678654][T13936] do_syscall_64+0x14d/0xf80 [ 510.678670][T13936] ? trace_irq_disable+0x3b/0x150 [ 510.678694][T13936] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 510.678713][T13936] ? clear_bhb_loop+0x40/0x90 [ 510.678736][T13936] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 510.678754][T13936] RIP: 0033:0x7f09df39c799 [ 510.678772][T13936] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 510.678787][T13936] RSP: 002b:00007f09e0202028 EFLAGS: 00000246 ORIG_RAX: 0000000000000019 [ 510.678807][T13936] RAX: ffffffffffffffda RBX: 00007f09df615fa0 RCX: 00007f09df39c799 [ 510.678821][T13936] RDX: 0000000000800000 RSI: 0000000000002000 RDI: 0000200000ceb000 [ 510.678833][T13936] RBP: 00007f09e0202090 R08: 0000200000130000 R09: 0000000000000000 [ 510.678845][T13936] R10: 0000000000000003 R11: 0000000000000246 R12: 0000000000000002 [ 510.678857][T13936] R13: 00007f09df616038 R14: 00007f09df615fa0 R15: 00007f09df73fa48 [ 510.678887][T13936] [ 510.764492][ T5823] udevd[5823]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:8.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 510.783644][ T9] usb usb3-port1: unable to enumerate USB device [ 510.887896][T13936] ------------[ cut here ]------------ [ 510.989092][T13936] anon_vma->num_active_vmas [ 510.989114][T13936] WARNING: mm/rmap.c:528 at unlink_anon_vmas+0x6c5/0x730, CPU#1: syz.0.2185/13936 [ 511.003669][T13936] Modules linked in: [ 511.007983][T13936] CPU: 1 UID: 0 PID: 13936 Comm: syz.0.2185 Tainted: G L syzkaller #0 PREEMPT(full) [ 511.019444][T13936] Tainted: [L]=SOFTLOCKUP [ 511.023780][T13936] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 511.034358][T13936] RIP: 0010:unlink_anon_vmas+0x6c5/0x730 [ 511.040287][T13936] Code: 08 00 48 3b 6c 24 18 74 29 e8 e7 22 aa ff 49 89 ee e9 cf fd ff ff e8 da 22 aa ff 90 0f 0b 90 e9 4d fe ff ff e8 cc 22 aa ff 90 <0f> 0b 90 e9 81 fe ff ff e8 be 22 aa ff eb 05 e8 b7 22 aa ff 48 83 [ 511.060572][T13936] RSP: 0018:ffffc9001040f648 EFLAGS: 00010293 [ 511.066656][T13936] RAX: ffffffff821b7ae4 RBX: ffff88808b4dbee0 RCX: ffff88807d62bd00 [ 511.075566][T13936] RDX: 0000000000000000 RSI: ffffffffffffffff RDI: 0000000000000000 [ 511.084004][T13936] RBP: ffff88808eace670 R08: ffff88808b4dbeef R09: 1ffff1101169b7dd [ 511.092300][T13936] R10: dffffc0000000000 R11: ffffed101169b7de R12: ffffffffffffffff [ 511.100569][T13936] R13: 1ffff1100b73a760 R14: ffff88805b9d3b00 R15: ffff88808b4dbee0 [ 511.108552][T13936] FS: 0000000000000000(0000) GS:ffff888125563000(0000) knlGS:0000000000000000 [ 511.117804][T13936] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 511.124757][T13936] CR2: 00002000000bd038 CR3: 0000000061046000 CR4: 00000000003526f0 [ 511.132988][T13936] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000003e4f [ 511.141176][T13936] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 511.149140][T13936] Call Trace: [ 511.152621][T13936] [ 511.155553][T13936] free_pgtables+0x836/0xb70 [ 511.160329][T13936] ? __pfx_free_pgtables+0x10/0x10 [ 511.165462][T13936] ? __pfx_down_write+0x10/0x10 [ 511.170511][T13936] exit_mmap+0x490/0xa10 [ 511.174749][T13936] ? __pfx_exit_mmap+0x10/0x10 [ 511.179716][T13936] ? __pfx_exit_aio+0x10/0x10 [ 511.184420][T13936] ? uprobe_clear_state+0x27c/0x290 [ 511.189951][T13936] __mmput+0x118/0x430 [ 511.194042][T13936] exit_mm+0x168/0x220 [ 511.198103][T13936] do_exit+0x6a2/0x23c0 [ 511.202453][T13936] ? __pfx_do_exit+0x10/0x10 [ 511.207038][T13936] ? do_raw_spin_lock+0x12b/0x2f0 [ 511.212124][T13936] do_group_exit+0x21b/0x2d0 [ 511.216715][T13936] ? _raw_spin_unlock_irq+0x23/0x50 [ 511.222059][T13936] get_signal+0x1284/0x1330 [ 511.226597][T13936] arch_do_signal_or_restart+0xbc/0x830 [ 511.232258][T13936] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 511.238407][T13936] ? fput_close_sync+0x11f/0x240 [ 511.243398][T13936] exit_to_user_mode_loop+0x86/0x480 [ 511.248716][T13936] ? rcu_is_watching+0x15/0xb0 [ 511.253529][T13936] do_syscall_64+0x32d/0xf80 [ 511.258112][T13936] ? trace_irq_disable+0x3b/0x150 [ 511.263194][T13936] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 511.269369][T13936] ? clear_bhb_loop+0x40/0x90 [ 511.274053][T13936] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 511.279987][T13936] RIP: 0033:0x7f09df39c799 [ 511.284389][T13936] Code: Unable to access opcode bytes at 0x7f09df39c76f. [ 511.291441][T13936] RSP: 002b:00007f09e02020e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 511.299996][T13936] RAX: fffffffffffffe00 RBX: 00007f09df615fa8 RCX: 00007f09df39c799 [ 511.308002][T13936] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f09df615fa8 [ 511.316039][T13936] RBP: 00007f09df615fa0 R08: 0000000000000000 R09: 0000000000000000 [ 511.324042][T13936] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 511.332059][T13936] R13: 00007f09df616038 R14: 00007f09df73f960 R15: 00007f09df73fa48 [ 511.340091][T13936] [ 511.343124][T13936] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 511.350387][T13936] CPU: 1 UID: 0 PID: 13936 Comm: syz.0.2185 Tainted: G L syzkaller #0 PREEMPT(full) [ 511.361328][T13936] Tainted: [L]=SOFTLOCKUP [ 511.365638][T13936] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 511.375687][T13936] Call Trace: [ 511.378952][T13936] [ 511.381867][T13936] vpanic+0x56c/0xa60 [ 511.385869][T13936] ? __pfx__printk+0x10/0x10 [ 511.390439][T13936] ? __pfx_vpanic+0x10/0x10 [ 511.394925][T13936] ? is_bpf_text_address+0x292/0x2b0 [ 511.400200][T13936] ? is_bpf_text_address+0x26/0x2b0 [ 511.405392][T13936] panic+0xc5/0xd0 [ 511.409114][T13936] ? __pfx_panic+0x10/0x10 [ 511.413534][T13936] __warn+0x315/0x4f0 [ 511.417512][T13936] ? unlink_anon_vmas+0x6c5/0x730 [ 511.422532][T13936] ? unlink_anon_vmas+0x6c5/0x730 [ 511.427544][T13936] __report_bug+0x29a/0x540 [ 511.432155][T13936] ? unlink_anon_vmas+0x6c5/0x730 [ 511.437176][T13936] ? __pfx___report_bug+0x10/0x10 [ 511.442198][T13936] ? mas_ascend+0x304/0x890 [ 511.446758][T13936] ? unlink_anon_vmas+0x6c5/0x730 [ 511.451774][T13936] report_bug+0x16a/0x220 [ 511.456111][T13936] ? unlink_anon_vmas+0x6c5/0x730 [ 511.461124][T13936] ? unlink_anon_vmas+0x6c7/0x730 [ 511.466140][T13936] handle_bug+0x9c/0x200 [ 511.470373][T13936] exc_invalid_op+0x1a/0x50 [ 511.474867][T13936] asm_exc_invalid_op+0x1a/0x20 [ 511.479708][T13936] RIP: 0010:unlink_anon_vmas+0x6c5/0x730 [ 511.485331][T13936] Code: 08 00 48 3b 6c 24 18 74 29 e8 e7 22 aa ff 49 89 ee e9 cf fd ff ff e8 da 22 aa ff 90 0f 0b 90 e9 4d fe ff ff e8 cc 22 aa ff 90 <0f> 0b 90 e9 81 fe ff ff e8 be 22 aa ff eb 05 e8 b7 22 aa ff 48 83 [ 511.504933][T13936] RSP: 0018:ffffc9001040f648 EFLAGS: 00010293 [ 511.510995][T13936] RAX: ffffffff821b7ae4 RBX: ffff88808b4dbee0 RCX: ffff88807d62bd00 [ 511.518956][T13936] RDX: 0000000000000000 RSI: ffffffffffffffff RDI: 0000000000000000 [ 511.526917][T13936] RBP: ffff88808eace670 R08: ffff88808b4dbeef R09: 1ffff1101169b7dd [ 511.534885][T13936] R10: dffffc0000000000 R11: ffffed101169b7de R12: ffffffffffffffff [ 511.542858][T13936] R13: 1ffff1100b73a760 R14: ffff88805b9d3b00 R15: ffff88808b4dbee0 [ 511.550835][T13936] ? unlink_anon_vmas+0x6c4/0x730 [ 511.555878][T13936] ? unlink_anon_vmas+0x6c4/0x730 [ 511.560916][T13936] free_pgtables+0x836/0xb70 [ 511.565514][T13936] ? __pfx_free_pgtables+0x10/0x10 [ 511.570711][T13936] ? __pfx_down_write+0x10/0x10 [ 511.575561][T13936] exit_mmap+0x490/0xa10 [ 511.579798][T13936] ? __pfx_exit_mmap+0x10/0x10 [ 511.584571][T13936] ? __pfx_exit_aio+0x10/0x10 [ 511.589253][T13936] ? uprobe_clear_state+0x27c/0x290 [ 511.594444][T13936] __mmput+0x118/0x430 [ 511.598506][T13936] exit_mm+0x168/0x220 [ 511.602587][T13936] do_exit+0x6a2/0x23c0 [ 511.606764][T13936] ? __pfx_do_exit+0x10/0x10 [ 511.611346][T13936] ? do_raw_spin_lock+0x12b/0x2f0 [ 511.616370][T13936] do_group_exit+0x21b/0x2d0 [ 511.620969][T13936] ? _raw_spin_unlock_irq+0x23/0x50 [ 511.626253][T13936] get_signal+0x1284/0x1330 [ 511.630799][T13936] arch_do_signal_or_restart+0xbc/0x830 [ 511.636344][T13936] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 511.642493][T13936] ? fput_close_sync+0x11f/0x240 [ 511.647434][T13936] exit_to_user_mode_loop+0x86/0x480 [ 511.652734][T13936] ? rcu_is_watching+0x15/0xb0 [ 511.657496][T13936] do_syscall_64+0x32d/0xf80 [ 511.662077][T13936] ? trace_irq_disable+0x3b/0x150 [ 511.667094][T13936] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 511.673186][T13936] ? clear_bhb_loop+0x40/0x90 [ 511.677857][T13936] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 511.683741][T13936] RIP: 0033:0x7f09df39c799 [ 511.688152][T13936] Code: Unable to access opcode bytes at 0x7f09df39c76f. [ 511.695156][T13936] RSP: 002b:00007f09e02020e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 511.703559][T13936] RAX: fffffffffffffe00 RBX: 00007f09df615fa8 RCX: 00007f09df39c799 [ 511.711530][T13936] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f09df615fa8 [ 511.719490][T13936] RBP: 00007f09df615fa0 R08: 0000000000000000 R09: 0000000000000000 [ 511.727450][T13936] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 511.735411][T13936] R13: 00007f09df616038 R14: 00007f09df73f960 R15: 00007f09df73fa48 [ 511.743389][T13936] [ 511.746752][T13936] Kernel Offset: disabled [ 511.751066][T13936] Rebooting in 86400 seconds..