last executing test programs: 8m36.286917448s ago: executing program 2 (id=1546): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x1, &(0x7f0000000000)=[{0x6, 0xfd, 0xc, 0x42}]}, 0x10) listen(r0, 0x2005) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fsopen(&(0x7f0000000180)='hfs\x00', 0x1) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000003c000000030a010100000000000000000a0000070900010073797a3100000000090003"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) fsconfig$FSCONFIG_SET_STRING(r2, 0x1, &(0x7f0000000080)='io\x7f\x1cl\x1e\b\xda7', &(0x7f0000000440)='io#harset', 0x0) sendto$inet6(r1, 0x0, 0x0, 0x24040014, &(0x7f0000000000)={0xa, 0x4e22, 0x40, @empty}, 0x1c) r4 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r4, 0x10e, 0xb, &(0x7f0000000000)=0x1e, 0x4) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r5, @ANYBLOB="9b0000bd7000ffdbdf2501000000080002"], 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x4000) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) sendmsg$ETHTOOL_MSG_FEATURES_SET(r4, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40000}, 0x4040100) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$smc(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$SMC_PNETID_ADD(r6, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000140)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="001a27bd7000fbdbdf25020000000900030073797a30000000000900030073797a32000000001aa049daf838"], 0x2c}, 0x1, 0x0, 0x0, 0x20044840}, 0x2000004c) r9 = accept4$packet(0xffffffffffffffff, &(0x7f0000000340), &(0x7f0000000380)=0x14, 0x80800) ioctl$NILFS_IOCTL_GET_CPINFO(r7, 0x80186e82, &(0x7f0000001640)={&(0x7f0000001400)=[{0x3, 0x0, 0x6cb3, 0xbb5f, 0x7f, 0x1, 0x6, 0xff}, {0x3, 0x0, 0x100000001, 0x7fff, 0x4, 0x8000000000000001, 0xc, 0x6}, {0x2, 0x0, 0x61, 0x7f, 0x4, 0x3, 0xd8, 0xffff}, {0x0, 0x0, 0x100000000, 0x80000001, 0x8, 0x1200, 0x6, 0x6}, {0x2, 0x0, 0x1, 0x8, 0x80000001, 0x200, 0x3, 0x9}, {0x1, 0x0, 0x4, 0x8, 0x10001, 0x8000000000000001, 0xc93a, 0x39}, {0x0, 0x0, 0x10001, 0x0, 0xdd, 0x7fffffff, 0x6, 0x2}, {0x3, 0x0, 0x4, 0x81, 0x6, 0x1, 0x2, 0x9}, {0x0, 0x0, 0x8000000000000000, 0x9, 0x9189, 0x0, 0x7, 0xffffffffffffffff}, {0x3, 0x0, 0xa, 0x5, 0x8, 0x5, 0x9, 0x1}], 0xa, 0x38, 0x0, 0xea6}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r6, &(0x7f00000013c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x800008}, 0xc, &(0x7f0000001380)={&(0x7f0000000680)=ANY=[@ANYBLOB="b80c0000", @ANYRES16=0x0, @ANYBLOB="080026bd7000ffdbdf253900000008000300", @ANYRES32=0x0, @ANYBLOB="0c0099000200000026000000d0015a800c0001800500060000000000240000800700010003030000150001006c050548023049363602166030606c240c00000064000080140003008a0003007f00ffff420002000b00fdff050004000200000005000700010000003a000200433a2c29333808000d324a0053150e2b462416164248022f270828171a242b013f0c2b10184a481915282a1f1a31344947004d1d314a00000c00008005000700000000005c000380050007000400000005000400010000000500060001000000220001000c0b03061870023005030b120e600205164eed06481b3601366c3660091800001400050043b6ff010200000001010004ffff04000500060002001200d000008005000600010000000500040000000000050007000100000021000200324615442f370810343408471d2a032557382903420d571a3723564744000000450002001929284628232f41290441360a2b303209073233523d512c49283117253a36403a4034171f101e2b140548135157002f0f4911244140173b572b203b13494e234d0000000500040000000000090001000206160103000000320002001c31014b08370e4f550b000905330a022e270c4e28220c4e07422d3c12292c051404564d1e2e4421212239183d43000030015a80680001801f00020035543c313014073431543c2b540c1f4c08484a1e2c403d2d092d370014000300000009000d000d00000005000000ffff1b00020013501e48292519093111433c393f15492c0334294a482c0014000300ce00000001000200ffff0300000000045800038005000400020000000500060002000000420002004c52554b063c204b18211e201d550b14295632574e243130001039500c1c032f14011805490c05251d381a493b3851393d452924413b291024253908043f00006c0003800500070000000000160001001b094824121660040c161b2416040c6c606c0000050006000000000005000600020000000500040000000000130001006c0600301604690224240c0406020100050006000100000014000500050005000700020006000500d12e0800e0035a8084000080140003006000080009000e0001008100060001000500070001000000050007000000030000000000000005182436040b040416126036161b240203026c602400140003009646d02307000000000001000800040024000200100c130d0b051520102817374b15382d314e4811153026392b191c471f3c10240500040002000000640000801400030008000800050083000400060e00000700140003000200070007000100090000100002f7001400050009007f0080000900050009000600f9ff140005001000040005000200f7ff0600f300000405000700000000000500060001000000500002801400030006000700e9000007fe01ed030600060005000600010000002f0002000f08032819323f1f1f114349203205102f2d1f2837483807401c51051d1757461544130452004f304433490074000380050004000200000014000300238efaff00007d14f1ff0000050056624c0002000f2f48230441183c2a2950305146182f26532854070051181027350b471806374c443e4e47234a334303411c04252d12374c2c330d574f3c2d4701514d3ac9d43e1d261f07364809050007000f0000000c000380080001000606166c000101800500060001000000440002001f38123f28484824004408113f1d452a3f3e023d474f442b304f3a3011552c0122303e4220082a0045483a390201150b095048005310471d3e203d0516473051140003000b0001008e02c878f9e80101070004003d000200520639133808064741044330123f404e1a09112a050c4054300215490038390247270b5156174b0408511d1c4042561118412e26401a21394200000005000400020000001c0002001b09203f422a413505502002181333083d53040d4d4124201a000200385450224e17292d080e4f50232e3e0747020f0e161e00000b000100481b1b350c2430000500060001000000080001001b2930050c000280050006000100000080000380140003000f84020007000010ff07cb9307000c00050004000000000005000700020000000500060002000000050006000000000014000500070008001c72010052980300060008000a000100010b0616182400001400030004004f0faf0f09000300020008000300140003000900ffffffff0500c800e1097e0030001c0002800500070000000000050006000200000005000600000000007c000380050007000100000021000100120009016c010309011836060404186c12180101061636053601600318000000140002004b1a3c4857073d283021154fa3304e501400050007000600040001000400ff01050007001400050001000300fd18a6870800040002000700050004000100000005000700020000006c035a803c0003801400050008000100060005000500c7e60700060005000600020000000500040000000000140005000b000300ba000600ff0029c305000300f0000080270002000a2d57263d12143d544f124c4f29372c1710004501384b56010e0f2612375048244c3500050007000200000051000200114e0310081e1f0a472a094d193f0c39533a4e0f2642392951574f42552f4617540d3735281b360f2d2a1536172a361f1d49264e07405319511a4934164114533d261a233d1f37131256460e28000000390002004e04290931202a552f1b2a3c4843301700123d3c462047490f044e4d090c06402d420251412414084916030c171518010c2f200842000000220001e0b625051ca828601b16000201010148300460031603120b0c030c020c600b00000500070002000000680000801400030001000d0007000800ff00010400003603140005000700030006000101000008000700060005000200320000001a00010016040203090213046c0b160502601324480106021801000005000700000000000500020024000000050006000000000060000380140003000300010408001b200300140000000500320002001a435051110e1f33311d453e2f1b2a2b3347050841124f5100105012480b152952211608474820380409573128190000140003000900cf00070001004f0d0900010005008c00008005000200170000000e0002001f2349570f38322c18090000090001000c303602030000000500040003000000140005000c007f0008000c00018055000004c0ff470002004c0326413909254018214817171d0a2545081d063125430e254a16214000222843103c4411401b575038451a110a22100f250024520f02002310452d144f461e570132001400008005000600000000000500070001000000d40001804e0002003741502e4c4f4e032d3d574832514c184156140a0b173e19190b342028221421041502362d56383f3213151411331d073f40180328331122533c43203c2b12243900524514162c51462d000048000200514b3e201b5630351529562018433f2220442c0a47030f2c3e0d4f1d2333264426011f063a4a0647044014093b122f3f2252184b3322302f4904162c494622405116392e1100020018343d492951403857231e3d46000000050004000100000014000500f7ff080009000900eb8d020005000500050007000200000044025a8074000280050004000000000014000300090008000100d700686c0002810003001400050000010000cb5fff7f01000180010005000900010000480336060000002a000200141d1a2d2b090c51482108110c242b1132070846234714081e0d1e184e474c11113421330c16000005000700000000007800038005000600020000001400030002000700932e0000000006000400cc0009000100031809480300000017000100480c1b484805000903046016041804360b061b0005000600010000000500040000000000070001000115560005000400010000001400050001000004050007000004a969ff0006001c0003800500070001000000050007000000000005000400000000006c000280050006000100000014000300080063e200000100fe0006000080010005000700020000001400050000000400010007000700010409000900140005006c120300080001000300060009000b00050006000200000014000500060070300400050006000800020006000c000180050007000000000058000180050006000200000014000500000001803b0000508000ff0fffffe300140003001000ffff0300f300080001007f00000014000300200c100009000500870c940b04000104050007000200000005000700020000005400008014000500080000008100000109000900000005003c0002003933111229283933071c3d511b46030e242c3d3c070f311a480a470d2a09381b102d2e571a3c433a15553d0a03524f02214429374229020c1400008005000400000000000500060001000000"], 0xcb8}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000) getsockname$packet(r9, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000400)=0x14) sendmsg$SMC_PNETID_DEL(r4, &(0x7f0000000300)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000500)=ANY=[@ANYBLOB="5c000000ab5b56f289f8af5e04c08070b5a0ae70e41a6ffe8340b117b92b44528d4ad5cd90b9573930551ae2ff7e79d618eee59677a36775f6385583ffae43ee8d2f8587baa5c94261c8aeb4da92c216661b333985150fa6d8d53fd7b4381e9df0abd17aeb710a1d58d65c0ddd1106a6dbb259928e2041981967ed8d743123c5e395655b6cf81c9e8811dfbad8789758d9410f29ff0096103f5df8ef32f1863a0b85fbe4b33a8035ed29fcc41f2a113627a53457f5ca1e0741e9548d1811abfceaf53589f629a97d871ee0c62d6a0a", @ANYRES16=r8, @ANYBLOB="000a2dbd7000ffdbdf2503000000050004000100000005000400020000000900030073797a31000000000500040002000000050004000200000005000400010000001400020076657468305f6d616376746170000000140002006e657464657673696d300000000000000900010073797a3100000000"], 0x7c}, 0x1, 0x0, 0x0, 0x1}, 0x20000001) sendmmsg$inet(r1, &(0x7f0000000180)=[{{0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000280)="6c53aac8e39e792540723a0774e60c7d9a91ae235dedbd04ce4ce45ceb4c0961e0f173094fc7138dfc35be115c88c79e2308a9356ff3e10f8bfe7e1ebcc936a7feddabbdcc", 0x45}], 0x1}}], 0x1, 0x11) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setstatus(r10, 0x4, 0x42800) sendmmsg$unix(r10, &(0x7f00000bd000), 0x318, 0x0) close_range(r2, 0xffffffffffffffff, 0x2) 8m36.210015717s ago: executing program 2 (id=1547): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000003c0)={'wlan0\x00', 0x0}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="90000000", @ANYRES16=r2, @ANYBLOB="010026bd7000000000003b000000", @ANYRES32=r1, @ANYBLOB="0600cd00680000006c0033"], 0x90}, 0x1, 0x0, 0x0, 0xc0}, 0x0) 8m36.151809289s ago: executing program 2 (id=1549): r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x7}, 0x1c) r2 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r2, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r3 = syz_open_procfs(0x0, &(0x7f0000000000)='map_files\x00') lseek(r3, 0x1, 0x0) getdents64(r3, 0xffffffffffffffff, 0x43) listen(r1, 0xfffffffc) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r4, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) close_range(r0, 0xffffffffffffffff, 0x200000000000000) 8m36.030108296s ago: executing program 2 (id=1551): syz_open_dev$usbfs(0x0, 0x206, 0x20182) openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) open(&(0x7f0000000140)='./file1\x00', 0x60142, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file1\x00', &(0x7f0000000140), 0x2, &(0x7f0000002400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r0, &(0x7f0000002480)={0x2020, 0x0, 0x0}, 0x2020) open(&(0x7f0000002280)='./file1\x00', 0x5482, 0x7e3111f862955f54) write$FUSE_INIT(r0, &(0x7f0000002300)={0x50, 0x0, r1, {0x7, 0x9, 0x0, 0x1030002, 0x0, 0x0, 0x2}}, 0x50) read$FUSE(r0, &(0x7f00000065c0)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_INTERRUPT(r0, &(0x7f0000002240)={0x10, 0xffffffffffffffda, r2}, 0x10) r5 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x20080, 0x0) r6 = dup3(r5, r0, 0x0) close(0x3) openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1\x00', 0x103042, 0x0) r7 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) getgroups(0x4, &(0x7f0000000040)=[0xee01, r4, 0xee00, r4]) write$FUSE_CREATE_OPEN(r7, &(0x7f0000000480)={0xa0, 0x0, r1, {{0x4, 0x0, 0x7, 0x80, 0x9, 0x40, {0x1, 0x3, 0x3, 0x6, 0x46c, 0x8, 0x1, 0x9, 0x4, 0xa000, 0x9, r3, r8, 0x7, 0x10}}, {0x0, 0x13}}}, 0xa0) syz_clone(0x204000, &(0x7f0000000300)="dc75a53b0e3863f5bc24a1a0c478ddc67dc26b2489e0add3f8471d7516fa426684c3c1dc9a616a75021fe597b976f8833fd0127e29729b594277fc49406b25ffc210ba14b9cec9ea9a44cb3ad6ffd167f92055e1593898a39c2b8c063fd0e7d4db25bfd15b890f8f83b7bc1a6d75d930667751eb279cffea9c0b1536afc2689a979bfd22032a79fbe660", 0x8a, &(0x7f00000003c0), &(0x7f0000000400), &(0x7f0000000440)="28af0f") openat$fuse(0xffffffffffffff9c, &(0x7f0000000200), 0x42, 0x0) io_uring_enter(r6, 0x480b, 0xb859, 0x0, &(0x7f0000000180)={[0x1]}, 0x8) socket$unix(0x1, 0x1, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2000002, 0x4ca31, 0xffffffffffffffff, 0x0) 8m35.001974483s ago: executing program 2 (id=1557): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=@delchain={0x24, 0x65, 0x400, 0x70bd29, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x509d884560ba1ba6, 0x3}, {}, {0x8, 0x10}}}, 0x24}}, 0x10) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000004bc0)={0x0, 0x0, &(0x7f0000004b80)={&(0x7f0000000100)=ANY=[@ANYBLOB="60b80000", @ANYRES16, @ANYBLOB="050427bd7000fedbdf250100000008000100", @ANYRES32, @ANYBLOB="4400028040000100240001006d6f646500"/43], 0x60}, 0x1, 0x0, 0x0, 0x4000401}, 0x4040084) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=@newqdisc={0x44, 0x24, 0x1, 0x80000000, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x8, 0x3}, {0xa, 0xffe0}, {0xfff1, 0x9}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0x14, 0x8002, [@TCA_FQ_PIE_LIMIT={0x8, 0x1, 0xf4b6}, @TCA_FQ_PIE_FLOWS={0x8, 0x2, 0xfe2a}]}}]}, 0x44}}, 0x20004055) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x11}, 0x400c840) r1 = socket$netlink(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0x5, 0x4, 0x0, &(0x7f0000000140)='GPL\x00', 0x4}, 0x94) sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x0) 8m34.526372669s ago: executing program 2 (id=1562): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x28, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}]}, 0x28}}, 0x0) syz_80211_inject_frame(&(0x7f00000002c0)=@device_b, &(0x7f0000000300)=@mgmt_frame=@probe_response={{{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x1, [{0x2, 0x1}]}, @void, @void, @void, @void, @void, @void}, 0x2f) syz_80211_inject_frame(0x0, 0x0, 0x0) r3 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000180), 0x60c01, 0x0) write$rfkill(r3, &(0x7f0000000080)={0x4, 0x1, 0x3, 0x1}, 0x8) 8m34.42325127s ago: executing program 32 (id=1562): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x28, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}]}, 0x28}}, 0x0) syz_80211_inject_frame(&(0x7f00000002c0)=@device_b, &(0x7f0000000300)=@mgmt_frame=@probe_response={{{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x1, [{0x2, 0x1}]}, @void, @void, @void, @void, @void, @void}, 0x2f) syz_80211_inject_frame(0x0, 0x0, 0x0) r3 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000180), 0x60c01, 0x0) write$rfkill(r3, &(0x7f0000000080)={0x4, 0x1, 0x3, 0x1}, 0x8) 5.710109974s ago: executing program 4 (id=5365): madvise(&(0x7f00001f2000/0x2000)=nil, 0x2000, 0xd) get_mempolicy(0x0, 0x0, 0x2, &(0x7f0000240000/0x1000)=nil, 0x3) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8) r0 = socket(0x1e, 0x4, 0x0) connect$tipc(r0, 0x0, 0x0) write$P9_RSTATu(0xffffffffffffffff, &(0x7f0000000540)=ANY=[@ANYBLOB="340200000200000005f3000005"], 0x234) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r1 = syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000840)={0x0, &(0x7f0000000580)=[@nested_vmlaunch={0x12f, 0x18}, @nested_amd_inject_event={0x180, 0x38, {0x1, 0xc7, 0x1, 0x7, 0x2}}, @cpuid={0x64, 0x18, {0x5, 0x7fff}}, @uexit={0x0, 0x18, 0x1}, @uexit={0x0, 0x18, 0x401}, @nested_load_code={0x12e, 0x7a, {0x1, "420f0137420f221a673e2ef30f01df66b8e8008ee0430f01dfb9410600000f32c7442400aef765aec7442402ec530000c7442406000000000f011c240f20e035000002000f22e0460f3248b806000000000000000f23c00f21f83502000c000f23f8"}}, @out_dx={0x6a, 0x28, {0x4cc6, 0x3, 0xfffffffffffff001}}, @nested_vmresume={0x130, 0x18, 0x3}, @wrmsr={0x65, 0x20, {0x17b, 0x1}}, @uexit={0x0, 0x18, 0x100000001}, @cpuid={0x64, 0x18, {0x3, 0xb}}, @enable_nested={0x12c, 0x18}, @nested_amd_invlpga={0x17d, 0x20, {0xeeef0000, 0xeaa7}}, @wr_crn={0x67, 0x20, {0x2, 0x24e}}, @nested_intel_vmwrite_mask={0x154, 0x38, {0x2, @guest16=0x80e, 0x6, 0x7d1f, 0x1}}, @nested_vmlaunch={0x12f, 0x18}, @nested_amd_inject_event={0x180, 0x38, {0x3, 0xb7, 0x1, 0x8c, 0x2}}, @nested_vmlaunch={0x12f, 0x18, 0x2}, @nested_vmresume={0x130, 0x18}], 0x2b2}) ioctl$KVM_SET_MSRS(r1, 0x4008ae89, &(0x7f0000000880)={0x4, 0x0, [{0x361, 0x0, 0x5}, {0x856}, {0x9fe, 0x0, 0xffffffff}, {0xc001001f, 0x0, 0xffffffff}]}) r2 = syz_open_dev$vcsu(&(0x7f00000002c0), 0x1, 0x1) r3 = io_uring_setup(0x524, &(0x7f0000000040)={0x0, 0x33af, 0x1c080, 0xa, 0x20002f7, 0x0, r2}) sendmsg$IPCTNL_MSG_CT_GET_STATS_CPU(r0, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x14, 0x4, 0x1, 0x201, 0x0, 0x0, {0x2, 0x0, 0x9}, ["", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x60000091}, 0x4004024) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000000)={'wlan1\x00', 0x0}) io_uring_enter(r3, 0x2219, 0x7721, 0x16, 0x0, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) r5 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000000), 0x40, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) sendmsg$key(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="021600070e0000002abd7000fddbdf25010014007f00000005001a0000000000000000000000000000000001fc02000000000000000000000000000108001400010015004e21000004000400010000000600000000000000bf0f00000000000008000000000000000100140009000000"], 0x70}}, 0x40000) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r6, 0x1, &(0x7f0000000040)={{}, {0x0, 0x3938700}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) futex(&(0x7f0000000200)=0x1, 0x6, 0x0, &(0x7f0000000240)={0x77359400}, 0x0, 0x1) preadv(r5, &(0x7f0000000100)=[{&(0x7f0000000040)=""/166, 0x3f}], 0x1, 0x0, 0x8) r7 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r7, 0x107, 0xd, &(0x7f0000000040)=@req3={0x410000, 0x100000001, 0x210000, 0x1, 0xd, 0x200}, 0x1c) close_range(r4, 0xffffffffffffffff, 0x0) 4.692695071s ago: executing program 4 (id=5371): r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0xd) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x0, 0x1, 0x40, 0x0, 0xa9, 0x8000000000000000, 0x8, 0x7, 0x8000003}, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc1002}]}) pipe2$watch_queue(0x0, 0x80) openat$sysctl(0xffffffffffffff9c, 0x0, 0x1, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x9, 0x0, 0x7fff0000}]}) r3 = syz_open_dev$sg(&(0x7f0000001940), 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r3, 0x1, &(0x7f00000000c0)=ANY=[@ANYBLOB='BD']) r4 = shmget$private(0x0, 0x800000, 0x880, &(0x7f0000173000/0x800000)=nil) shmctl$IPC_RMID(r4, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) flock(r0, 0x2) r5 = creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) r6 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/meminfo\x00', 0x0, 0x0) read$FUSE(r6, &(0x7f0000000180)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) rt_sigprocmask(0x0, &(0x7f0000000000)={[0xfffffffffffffff9]}, 0x0, 0x8) r8 = gettid() tkill(r8, 0x12) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002700)={0x11, 0x16, &(0x7f00000027c0)=ANY=[@ANYBLOB="1800000002000000000000000101000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018120000", @ANYRES16=r7, @ANYBLOB="0000000000000000b703000000000000850000000c000000b700000000000000850000003e0000005cb4fcffffffffffbf910000000000008500000085000000b70000000000000095000000000000007dd3af7057163138751183de621f17188d04d42c1b0b34ddebea2b3120ad4109f130e0dc2f817b6cff60f7d86a72afa006546e710804cea18a2261ab79f6d8bbb2d6476f779fbc443300c6e89a32c84d1901dce6de8eaf922c357701ad02638cb9e108c326c64a952c35"], &(0x7f0000002280)='GPL\x00', 0x7f, 0xee, &(0x7f0000002340)=""/238, 0x41000, 0x5d, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000002540)={0xa, 0x2}, 0x8, 0x10, &(0x7f0000002580)={0x3, 0x6, 0x6, 0xfffffffc}, 0x10, 0x0, 0x0, 0x8, &(0x7f0000002640), &(0x7f0000002680)=[{0x1000001, 0x3, 0xc}, {0x3, 0x3, 0xa, 0x1}, {0x3, 0x3, 0x6, 0x5}, {0x5, 0x4, 0x3, 0x6}, {0x0, 0x4, 0xa, 0x9}, {0x4, 0x3, 0x8, 0x8}, {0x5, 0x2, 0x7, 0x7}, {0x5, 0x1, 0xb}]}, 0x94) tkill(r8, 0x1) syz_open_dev$loop(0x0, 0xffff, 0x121ac3) r9 = openat$cgroup_ro(r5, 0x0, 0x275a, 0x0) sendmsg$NFT_BATCH(r5, 0x0, 0x20050840) write$binfmt_misc(r9, &(0x7f00000022c0)="89e1ac52a6e1cbc0414d960202cffbdafd369b1ed2b75078e3ac04e13a92671203cc7c296d1ac78011e2c932b4b6afbc1529427030301fc5e9a07cbd27fdd3add117a0601402b7ac63aa36d2fb0faf3e693c3f26dee587150c9975382028521866582c767c883e0e15d8f2f9cdb7", 0x6e) 3.32604413s ago: executing program 3 (id=5387): syz_mount_image$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0xa, 0x0, 0x0, 0x0, 0x0) landlock_create_ruleset(&(0x7f0000000040)={0x0, 0x3}, 0x10, 0x0) (async) r0 = landlock_create_ruleset(&(0x7f0000000040)={0x0, 0x3}, 0x10, 0x0) landlock_restrict_self(r0, 0x0) landlock_restrict_self(r0, 0x0) landlock_restrict_self(r0, 0x0) (async) landlock_restrict_self(r0, 0x0) landlock_restrict_self(r0, 0x0) landlock_restrict_self(r0, 0x0) syz_mount_image$fuse(0x0, &(0x7f0000000180)='./file1/file3\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file1/file3\x00', 0x0) landlock_create_ruleset(&(0x7f0000000040)={0x2, 0x3, 0x3}, 0x18, 0x0) (async) r1 = landlock_create_ruleset(&(0x7f0000000040)={0x2, 0x3, 0x3}, 0x18, 0x0) landlock_restrict_self(r1, 0x0) (async) landlock_restrict_self(r1, 0x0) landlock_restrict_self(r0, 0x8) landlock_restrict_self(r1, 0x6) landlock_restrict_self(r1, 0x0) landlock_restrict_self(r1, 0x5) landlock_restrict_self(r1, 0x4) (async) landlock_restrict_self(r1, 0x4) landlock_restrict_self(r1, 0x5) landlock_restrict_self(r1, 0x1) landlock_restrict_self(r0, 0xc) r2 = landlock_create_ruleset(&(0x7f00000001c0)={0x2fbd, 0x1}, 0x18, 0x0) landlock_restrict_self(r2, 0x0) (async) landlock_restrict_self(r2, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000140)='./file1/file3\x00', 0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x2) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='fd=', @ANYRESDEC=r3, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) (async) mount$fuse(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='fd=', @ANYRESDEC=r3, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r3, &(0x7f0000000cc0)={0x2020}, 0x2020) (async) read$FUSE(r3, &(0x7f0000000cc0)={0x2020}, 0x2020) socket$packet(0x11, 0x2, 0x300) (async) socket$packet(0x11, 0x2, 0x300) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r4, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0x60ae0}], 0x318, 0x0, 0xdb0, 0xf5ffffff}, 0x3f01) sendmsg$tipc(r5, &(0x7f0000000240)={0x0, 0x18, &(0x7f00000000c0), 0x31}, 0x0) (async) sendmsg$tipc(r5, &(0x7f0000000240)={0x0, 0x18, &(0x7f00000000c0), 0x31}, 0x0) 3.325766164s ago: executing program 0 (id=5388): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=@getqdisc={0x24, 0x26, 0x52e, 0x70bd27, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0x3, 0x10}, {0x8, 0xf}, {0xf, 0xb}}}, 0x24}}, 0x10) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000004bc0)={0x0, 0x0, &(0x7f0000004b80)={&(0x7f0000000100)=ANY=[@ANYBLOB="60b80000", @ANYRES16, @ANYBLOB="050427bd7000fedbdf250100000008000100", @ANYRES32, @ANYBLOB], 0x60}, 0x1, 0x0, 0x0, 0x4000401}, 0x4c14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=@newqdisc={0x44, 0x24, 0x10c, 0xc0000001, 0x0, {0x0, 0x0, 0x0, 0x0, {0xfff3, 0x8}, {0x2, 0xf}, {0x8, 0x9}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0x14, 0x8002, [@TCA_FQ_PIE_TARGET={0x8}, @TCA_FQ_PIE_TUPDATE={0x8, 0x4, 0x400}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000001}, 0x20004015) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) r0 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) 3.269086793s ago: executing program 3 (id=5389): r0 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x4e22, 0x0, @empty, 0x72}, 0x1c) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000000)=0x651f, 0x4) sendmsg$inet6(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000540)}, 0x40800) 3.206332559s ago: executing program 3 (id=5390): openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, 0x0, 0x80200, 0x0) syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0xdfbd5000) r0 = socket$rds(0x15, 0x5, 0x0) bind$rds(r0, &(0x7f0000000040)={0x2, 0x2, @loopback}, 0x10) mmap(&(0x7f0000000000/0x400000)=nil, 0x1e9000, 0x16, 0x200000006c832, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) unshare(0x22020600) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) renameat2(r1, &(0x7f00000002c0)='./file0\x00', r1, &(0x7f00000003c0)='./bus\x00', 0x0) sendmsg$rds(r0, &(0x7f0000001600)={&(0x7f0000000000)={0x2, 0x0, @remote}, 0x10, 0x0, 0x0, &(0x7f0000000780)=[@rdma_args={0x48, 0x114, 0x1, {{}, {0x0}, &(0x7f00000006c0)=[{&(0x7f0000000100)=""/44, 0x2c}], 0x1, 0x76}}], 0x48}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) timer_create(0x0, 0x0, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) sendmmsg$inet6(r2, &(0x7f0000000140)=[{{&(0x7f0000000240)={0xa, 0x4f21, 0x8000001, @private2={0xfc, 0x2, '\x00', 0xdf}, 0x3}, 0x1c, &(0x7f00000003c0)=[{&(0x7f00000001c0)="14", 0x1}], 0x1}}], 0x1, 0x931766f6319eed40) shutdown(r2, 0x1) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x1c, &(0x7f0000000000)=[@in6={0xa, 0x0, 0x0, @private0={0xfc, 0x0, '\x00', 0x1}, 0x9}]}, 0x0) getsockopt$inet_sctp6_SCTP_MAX_BURST(r1, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000300)=0xfffffe34) setsockopt$inet_sctp6_SCTP_MAX_BURST(r2, 0x84, 0x14, &(0x7f0000000040)=@assoc_value={r4, 0xf2b}, 0x8) getsockopt$inet_sctp_SCTP_ASSOCINFO(r1, 0x84, 0x1, &(0x7f00000001c0)={r4, 0x100, 0x8000, 0x4, 0x1, 0xffff}, &(0x7f0000000240)=0x14) write$RDMA_USER_CM_CMD_BIND_IP(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000080)) setrlimit(0x7, 0x0) 3.052641744s ago: executing program 5 (id=5392): r0 = socket$nl_generic(0x11, 0x3, 0x10) sendmsg(r0, &(0x7f0000000000)={&(0x7f00000000c0)=@caif=@dgm={0x25, 0xd, 0x1}, 0x80, &(0x7f0000000240)=[{&(0x7f00000007c0)="4ba72c4cfd81685544f46c3f86dd46", 0xf}], 0x1, 0x0, 0x0, 0x11000000}, 0x1) 3.02270143s ago: executing program 0 (id=5393): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, 0x0, 0x4000054) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x200000000000011, 0x3, 0x7) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) r5 = syz_open_procfs(0x0, &(0x7f00000004c0)='gid_map\x00') read$FUSE(r5, &(0x7f0000002140)={0x2020}, 0x2020) ioctl$FIBMAP(0xffffffffffffffff, 0x1, 0x0) bind$packet(r2, &(0x7f0000000d00)={0x11, 0x0, r4, 0x1, 0x0, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}, 0x14) socket$kcm(0x2, 0xa, 0x2) ioctl$TUNSETVNETBE(0xffffffffffffffff, 0x400454de, &(0x7f0000000040)=0x1) write$tun(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB], 0xfdef) writev(r1, &(0x7f00000001c0)=[{&(0x7f0000000400)="390003001300034700bb5be1c3e4feff06000000010000004500000025000000190004000400ad000200000000000006040000000000f93132", 0x39}], 0x1) 3.021896852s ago: executing program 5 (id=5394): syz_open_procfs(0x0, &(0x7f0000000240)='net/vlan/vlan0\x00') ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f00000000c0)={'tunl0\x00', 0x0}) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f00000002c0)='blkio.throttle.write_iops_device\x00', 0x2, 0x0) r2 = openat$audio1(0xffffffffffffff9c, &(0x7f0000000080), 0x129202, 0x0) ioctl$SNDCTL_DSP_STEREO(r2, 0xc0045003, &(0x7f00000000c0)) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000004c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000000900010073797a30000000005c000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a80000000000800054000000021200011800a0001006c696d6974000000100002800c0001400000000000000101140000001000010000000000000000000084000a"], 0xa4}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r4, 0x89f1, &(0x7f0000000440)={'tunl0\x00', &(0x7f0000000400)={'syztnl0\x00', 0x0, 0x8000, 0x700, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x3, 0x14, 0x0, 0x0, 0x7, 0x0, 0x0, @multicast2, @private}}}}) write$cgroup_subtree(r1, &(0x7f00000000c0)=ANY=[], 0x6a) 2.96220489s ago: executing program 3 (id=5395): connect$unix(0xffffffffffffffff, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x8, 0x0, 0x0, 0xd, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) ioctl$VIDIOC_SUBDEV_ENUM_FRAME_SIZE(0xffffffffffffffff, 0xc040564a, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) unshare(0x400) ioctl$VIDIOC_S_INPUT(0xffffffffffffffff, 0xc0045627, &(0x7f00000000c0)=0x3) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) socket$inet(0x2, 0x3, 0x8) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f00000013c0)=0x80000000001, 0x4) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f00000001c0)="a6e2976b5c4383036d32dadd2e144d8645ca8d1b230e105614396838da83c754887e7bea2f35d4ea667817d90d532af065f2e398dd9081ea16f8b371a202a6f9e505bbc964a0d3880bf0104a0a0a2f0d311efee1637e85a0125b38f961918f99bf9c2c146e42327f178dc2b3d4936e7f7f0a79f74ba464d83ab41742d1186776dc1779b5c50ac82d0fa8f9e42074b5b6079207fb21e718080907964669be539791e3e98687ee059853", 0xfffffffffffffcc1, 0x840, 0x0, 0x0) sendto$inet6(r0, &(0x7f00000002c0)="e8", 0xfffffffffffffd79, 0x2000c850, 0x0, 0x4d) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup3(r0, r1, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x12, r1, 0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000140)={&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x0, &(0x7f0000001f00)=""/4106, 0xfffffffffffffccb, 0x0, 0x0}, &(0x7f0000000080)=0x40) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r2, 0x6, 0x23, &(0x7f00000000c0)={&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x0, 0x0, &(0x7f0000001400)=""/200, 0xfffffffffffffecd, 0x0, 0x0}, &(0x7f0000001380)=0x40) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, 0x0, &(0x7f0000000000)) 2.961458843s ago: executing program 0 (id=5396): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={0x0}}, 0x0) 2.939211207s ago: executing program 0 (id=5397): r0 = socket$inet6(0xa, 0x3, 0x87) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f00000005c0)=0x7fff, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x380000, @loopback={0xfe80000000000000}, 0x4}, 0x1c) 2.908668736s ago: executing program 3 (id=5398): r0 = syz_open_dev$vim2m(&(0x7f00000001c0), 0xe992, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000380)={0x11, 0x1, 0x3, "33c500100000e70040fcd817a45b729fd5085780ee0f00", 0x20363059}) 2.861942483s ago: executing program 0 (id=5399): openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(0xffffffffffffffff, 0xc1105511, &(0x7f0000000040)={0xa, 0x0, 0x3d, 0x10000, 'syz1\x00', 0x5}) ioctl$LOOP_CONFIGURE(0xffffffffffffffff, 0x4c0a, &(0x7f0000000080)={0xffffffffffffffff, 0x0, {0x0, 0x0, 0x0, 0x7, 0x4000000000000ffd, 0x0, 0x0, 0x1e, 0xc, "faf98317e5a1149989fc8dbe43ea6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60c9e6d680f985881a7beda9d69098c8b534464c516bdd8a0f35", "32d8cc26f7061a74df2cfc06c89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "67523760fd40f78d2cfc03d81a8ca55ba139c01802c4dae4162e43ac61b7ad33", [0x400000010, 0x9]}}) r0 = add_key$user(&(0x7f00000001c0), &(0x7f0000000300)={'syz', 0x0}, &(0x7f0000000240)="166ec4b16a", 0x5, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000140)={r0, r1, r0}, &(0x7f0000000340)=""/95, 0x5f, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x20042, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000640)="430fc73f0f2390b9800000c00f3235010000000f300f20d835080000000f22d8c4e18173f53866baf80cb83879e487ef66bafc0cec66b88e008ec02d1aa80000460f1c460041ae", 0x47}], 0x1, 0x74, 0x0, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) add_key$user(&(0x7f0000000080), 0x0, 0x0, 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = dup(r3) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x10000000005, 0x9, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x89f9b000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) tkill(0x0, 0x3b) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x2) syz_kvm_setup_cpu$x86(r3, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) r6 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x39) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r7, 0x4040aea0, &(0x7f0000000040)=@x86={0x6, 0x0, 0x8, 0x0, 0x4, 0x8, 0x6, 0xb, 0x83, 0xe, 0x5, 0xa, 0x0, 0x101, 0x2a, 0x0, 0x0, 0x0, 0x0, '\x00', 0xff, 0x100000c}) r8 = syz_open_dev$tty1(0xc, 0x4, 0x1) r9 = dup(r8) write$UHID_INPUT(r9, &(0x7f0000000880)={0xf, {"a2e3ad214fc752f91b29090955f70e0dd038e7ff7fc6e5539b3267078b089b34083b681a0890e0878f0e1ac6e7049b076d959b669a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b313b0d076d0936cd3b78130daa61d8e809ea889b5802b77f07227227b7ba67e0e78669a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae19397d696d0d758f2dc7d1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000002335875271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1fe90a56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617601000000be70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d1456a95a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9980000000b3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f72483b6c82fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c2021d653a5520000008213b704a5000000000000008ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc94681359bad8deff4b05f60cea0da7710a80000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4e38a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2bed9e53803edf1a4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfab78d1f48c13b64df07847754b8400daaa69bf5c8f4ceb360c7e658828563e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034e00000000ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c478b095b68441a34cb51682a8ae4d24ad92f243941ed274549b79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdbe6c4579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93ae62fccfcbb2b75a2183c46eb65ca8124e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43e4fb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e01feffffffffffff83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369d75f2e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aa01b20f7694a00f16e2d0174035a2c22656dc00880acebdbe8ddbd75c2f998d8ac2dfad2ba3a50200000045a45957f24d758ed024b3849c11d412a2a03b4247497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe2907ac0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf463661c953fcad6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7cd419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaeecf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6ea94f88a4facfd4c735a20307c737afae5136651b1b9bd522dcb399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a37684f4113c48859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463183b4b87c105000000302a808d7f5251440613d17ca51055f2f416a44fe180d2d50c312cca7cb14a20dc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb40100000006376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab83c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7ceec7dc808bf653639d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a602000000000000007007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00303000000000000007fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf6529006c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6522fb5f6ffcdd56fed88935fcb75912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae233a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a5bd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08008897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b80c1c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57fa9c0fe662a46b7f71cd47744db86c50b704c98ad90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe360500000000000000b77940b5f07722e47a09d3679507000000000000934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1062dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1df0d07b3d5bd3b01faffd0addbed2881a9700af561ac8c7e36bb2fc4c40e9c766c06817bb903729a7db6ff957697c9ede7885d94ffa8759be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c1484d2f9c55f4901203a9a8a2c3e90f39c3dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000600", 0x1000}}, 0x1006) write$rfkill(r9, &(0x7f0000000080)={0x8, 0x9, 0x0, 0x1, 0x1}, 0x8) 2.861654391s ago: executing program 5 (id=5400): r0 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x4e22, 0x0, @empty, 0x72}, 0x1c) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000000)=0x651f, 0x4) sendmsg$inet6(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000540)=[{&(0x7f00000004c0)="24b3593da4166846bde7345ebd867aee9fcee8d8a047c879b4aad3", 0x1b}, {&(0x7f0000000440)="421b0cd59e601786da9f0dc35b5555d39761e27d85f6f3434b422d20c87e00b101531c01f57e06d77595f215b0dd4a5f7e527cf52d829882f286a06f76c1de6e573563d85c4eb941c1489d3b3a6c8af2e0f41031b3e410", 0x57}], 0x2}, 0x40800) 2.848610027s ago: executing program 5 (id=5401): r0 = syz_open_dev$dri(&(0x7f0000000040), 0x5, 0x12180) ioctl$DRM_IOCTL_MAP_BUFS(r0, 0xc0186419, &(0x7f0000001600)={0x8, &(0x7f00000000c0)=""/39, &(0x7f0000001540)=[{0x1, 0xbc, 0xa5b6, &(0x7f0000000140)=""/188}, {0x7fffffff, 0xed, 0x9, &(0x7f0000000200)=""/237}, {0x5b, 0xbf, 0x0, &(0x7f0000000300)=""/191}, {0x6, 0x30, 0x5, &(0x7f00000003c0)=""/48}, {0xf05, 0xb0, 0x5, &(0x7f0000000400)=""/176}, {0x100, 0x38, 0x7fff, &(0x7f00000004c0)=""/56}, {0x2, 0x3b, 0x2, &(0x7f0000000500)=""/59}, {0x8, 0x1000, 0x7, &(0x7f0000000540)=""/4096}]}) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_GET_VCPU_EVENTS(r2, 0x4048aecb, &(0x7f0000000080)) close_range(r1, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaa1780c206050186dd6000000000084f00fe8000000000000000000000000000bbfe8000000000000000000000000000aa8400000100000000"], 0x0) 2.829900829s ago: executing program 3 (id=5402): mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, '\x00', 0x1b}, 0xd}, 0x1c) r1 = syz_usb_connect(0x5, 0x24, &(0x7f0000000440)=ANY=[@ANYBLOB="1201000006c055080a115014cb6201020301090212"], 0x0) syz_usb_control_io$sierra_net(r1, 0x0, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000040)='westwood', 0x8) write$binfmt_script(r0, &(0x7f0000000200), 0xfffffd9d) syz_usb_connect$uac3(0x2, 0xbb, &(0x7f0000000080)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x20, 0x1235, 0x18, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xa9, 0x3, 0x1, 0x7, 0x40, 0xd, {0x8, 0xb, 0x1, 0x2, 0x1, 0x26, 0x30, 0x2}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0xd, 0xa, 0x1}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {[@format_type_i_descriptor={0x6, 0x24, 0x2, 0x1, 0x6, 0x3}, @format_type_i_continuous={0xe, 0x24, 0x2, 0x1, 0x5, 0x2, 0x8d, 0x2, "4de427", "fa742d"}, @format_type_ii_discrete={0x12, 0x24, 0x2, 0x2, 0x2, 0x7, 0xdc, "08b22431c848fdd289"}]}, {{0x9, 0x5, 0x1, 0x9, 0x3ff, 0x0, 0x6, 0x4, {0xa, 0x25, 0x25, 0x9, 0x5, 0x4b6}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {[@format_type_ii_discrete={0x9, 0x24, 0x2, 0x2, 0x1, 0xa0, 0xa}, @format_type_i_continuous={0xc, 0x24, 0x2, 0x1, 0x1, 0x3, 0x2, 0x6, "4743a8", "e2"}]}, {{0x9, 0x5, 0x82, 0x9, 0x20, 0x6, 0x78, 0x9, {0xa, 0x25, 0x25, 0xfffff27f, 0x7, 0xc}}}}}}}}]}}, &(0x7f0000000740)={0xa, &(0x7f0000000140)={0xa, 0x6, 0x310, 0x4, 0x6, 0x7f, 0x8, 0x8}, 0x114, &(0x7f0000000240)={0x5, 0xf, 0x114, 0x5, [@ss_cap={0xa, 0x10, 0x3, 0x0, 0x6, 0x3, 0xf, 0x6}, @ext_cap={0x7, 0x10, 0x2, 0x2, 0x5, 0x0, 0xf32}, @ext_cap={0x7, 0x10, 0x2, 0x0, 0x6, 0xe, 0x7}, @generic={0xf4, 0x10, 0xa, "8b6576e2783c5c5722bb303f9caeb75748bfe48df2ccf8d70e92b60b996bbd698bbc04ae8f01ab759077ffdf6ca33a85457aa8d6238d87046fad9d8ba5b6f58111b9c8bb27268bbf5aa341740894c166b637ca4c7cc96229e525515bef5f192e490dd88626230ff681973a6ad82f26181e1effb3c247a63dc5dfe5e19f0925cfaeb341a89752a0ff21ea3f099c53a9e836c1a875f2357ee07cc640d59168f7844a7ce97021424f4ba082968b5eb30ea1176108b8529d2ebd90403a2ee04cceb1072a2f9cd206413dc902fb65888371178f44e349cf7336d8ff10cb830480d81dd60fa56c5376e81ccc4b1fb3d34ca3d208"}, @ptm_cap={0x3}]}, 0x9, [{0x4, &(0x7f0000000380)=@string={0x4, 0x3, "2612"}}, {0x2e, &(0x7f00000003c0)=@string={0x2e, 0x3, "cbbb8554b5a6aa6cfaefd8ca508ef12c312cd798c6e83dac6e19bdee5058cbe4d41d61d095986cf78fd0de90"}}, {0x2, &(0x7f0000000400)=@string={0x2}}, {0x4, &(0x7f0000000480)=@lang_id={0x4, 0x3, 0x40d}}, {0xcc, &(0x7f00000004c0)=@string={0xcc, 0x3, "915f6f36c793371c3cce97db6b2bf79b358619e41995613449056d37c99bb95b71e7204c836ccafed2fea0fa2a72e2f7da1ba6518c615d002091f82dd40f0a4fbe4eca44a3e073586601647be5ca1f3214116175a955a65e96d31999e75940d1108f3ca76b642fa8d9416b464a89a1caf54bf51f3ce73e6f093084ae3357a95431b7aefb524a2961bd9bfc1c9c06c9dcd6c4c53a2255a44fe92a0d59735ee0e60f5f8931da7728df786604528ed37e64cd3bffd014ade82213649876e641db0b3f6ee9bbc661e8372d0b"}}, {0x46, &(0x7f00000005c0)=@string={0x46, 0x3, "8f1be415608dac35215112e8e8eee4067ab7cbf6ffb254ae4b1782d096939efc6487511f6ad15ac871cf7cd5e3a1b9947b1ac1fe515339a138380969d4e4635fbe7a25c1"}}, {0x4, &(0x7f0000000640)=@lang_id={0x4, 0x3, 0x2c01}}, {0x4, &(0x7f0000000680)=@lang_id={0x4, 0x3, 0x480a}}, {0x49, &(0x7f00000006c0)=@string={0x49, 0x3, "707e0b43ac8561c55984cbf9f81f9e7795435157f19ef77708bd29ed9145d810dd48650c90213c6dbd4c0fe9bb62884f8a1e89497cf48868eb9368aad7ca06e387631e6186bc5e"}}]}) r2 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) fcntl$lock(r2, 0x410, &(0x7f00000000c0)={0x1, 0x1, 0x1, 0xfffe}) sendmsg$NFT_BATCH(r2, &(0x7f0000000900)={&(0x7f00000001c0), 0xc, &(0x7f00000008c0)={&(0x7f0000000800)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xa}}, [@NFT_MSG_DELFLOWTABLE={0x18, 0x18, 0xa, 0x401, 0x0, 0x0, {0x0, 0x0, 0xa}, [@NFTA_FLOWTABLE_HOOK={0x4}]}, @NFT_MSG_NEWSET={0x48, 0x9, 0xa, 0x5, 0x0, 0x0, {0x7, 0x0, 0x3}, [@NFTA_SET_GC_INTERVAL={0x8, 0xc, 0x1, 0x0, 0xc7}, @NFTA_SET_HANDLE={0xc, 0x10, 0x1, 0x0, 0x5}, @NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_GC_INTERVAL={0x8, 0xc, 0x1, 0x0, 0xfffffffd}, @NFTA_SET_HANDLE={0xc, 0x10, 0x1, 0x0, 0x2}]}, @NFT_MSG_DELRULE={0x28, 0x8, 0xa, 0x5, 0x0, 0x0, {0x7}, [@NFTA_RULE_HANDLE={0xc, 0x3, 0x1, 0x0, 0x2}, @NFTA_RULE_CHAIN_ID={0x8, 0xb, 0x1, 0x0, 0x4}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0xb0}}, 0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, r2, 0xa9525000) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r3, 0xffffffffffffffff, 0x0) madvise(&(0x7f00009c0000/0x1000)=nil, 0x1000, 0xc) 2.746196815s ago: executing program 5 (id=5403): mount$fuse(0x0, 0x0, &(0x7f0000002100), 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="66643d0c79d3846101009049ca56f0a2f705", @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',']) kexec_load(0x3, 0x1, &(0x7f00000005c0)=[{&(0x7f0000000100), 0x0, 0x5, 0xffffffff}], 0x0) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000002840)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0x0, @loopback, 0x20}, 0x1c, 0x0}}], 0x1, 0x14018891) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x48001}, 0x4044050) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000540), 0x82, 0x0) timerfd_settime(0xffffffffffffffff, 0x0, &(0x7f00000002c0)={{0x77359400}, {0x0, 0x3938700}}, 0xffffffffffffffff) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r3 = accept4(r2, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11", 0xce}], 0x3, &(0x7f0000000380)=[@assoc={0x18, 0x117, 0x4, 0x5}], 0x18}], 0x1, 0x40800) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) r5 = socket$alg(0x26, 0x5, 0x0) r6 = syz_open_dev$usbfs(&(0x7f0000000100), 0x77, 0x101301) ioctl$USBDEVFS_CONTROL(r6, 0xc0105500, &(0x7f0000000000)={0x80, 0x6, 0xefe, 0xec, 0x0, 0x0, 0x0}) bind$alg(r5, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) r7 = accept4(r5, 0x0, 0x0, 0x0) sendmsg$alg(r7, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080)=[@assoc={0x18, 0x117, 0x4, 0x71c6}], 0x18, 0x28048810}, 0x2c000044) sendmsg$nl_route_sched_retired(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000012100), 0xe078}}, 0x0) recvmmsg(r7, &(0x7f0000000180)=[{{0x0, 0x0, 0x0}, 0x200bac}, {{0x0, 0x0, &(0x7f0000000200), 0x24}, 0x4}], 0x2, 0x60, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f00000000c0)="650f340f3566b842000f00d8b805000000b9a00000000f01c13e0f070fde460b0f0130670f01c2f2360f217a0f07", 0x2e}], 0x1, 0x11, 0x0, 0x0) sendmsg$NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH(r7, &(0x7f0000000700)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000440)={&(0x7f0000000740)=ANY=[@ANYRES16, @ANYRES16=0x0, @ANYRES16=r5], 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x40040) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000340)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_LEAVE_OCB(r3, &(0x7f00000006c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000940)=ANY=[@ANYBLOB="28000000f11327ca868714d1c96f81a62c49b32769c40257a7b2672a996c9f3954b364402dd56f7e44bd2c33f276cb1b546bf8e7f06fa20e6daf1de8159ac37b98d84d1d16beb749b11a4e5631500d8a3dca604250a8f0acae03710b87117db41e7a3f96070ebac642aa6469a2f79ed6f9756b83a9", @ANYRESDEC=r4, @ANYBLOB="000100000000ffdbdf256d00000008000300", @ANYRES32=r8, @ANYBLOB="0c009900000cacf100000000"], 0x28}, 0x1, 0x0, 0x0, 0x44810}, 0x801) pwritev(0xffffffffffffffff, &(0x7f0000000b00)=[{&(0x7f0000001880)="ea7c5828b87d70214008724bcae1ce6577c01031b19698ecb8a7f5183947918ce2cc9dc778dbfff9e28e1a6df7d8f95c3e45768a6786d6325bc0fe4ed394c8ed0edcbb9f917074251a7f5b6b24c52516a68f181592262dfd12b5af7386658c5fb6c36d86d5084624a302a155c0463b6c36e9fc88338b0f66e2713728a21d19d9a33da93d419df63d8a87fa100381ec74de8b7409f4977d3cd7a9f2fb03cec91c4277b39b2c9f227a9b74926a11960d085e2aaf98673d2a67fa95b8d9dcc72ca6181f6b9b2d1c402267e6cfef5599e1520077d9bc472fb5a5db42b1befd498ec7b8d519b12f065323b15280a2540bc7a4ffe508fc12f93707064caf4111e893142f9867b432b1e6258caa2ae081b8b646c25de7f5366a21f9dd257b84546cd316e17b79d22c4bcaf70e8a96d1e502b53c581c75482d1d63f0d5f3fb5bdbb714583f0798e0c4d6c9d99513e91a68a26612053290f15f5a2e06acfa229356e37b4d57697224e9561c0430a67fcb5dea72acc91e60751a5b07eb603548a646f082ce213347b4ee908bd95cc56775330aa09d4f19f48a8cb5d7f6346d82bab8ff019309684bd01eb4d90febe2269cd2a1100130c242a2995ce38638a3bbc9008ac0e820a1e0b9a9511af47aa7f3e30a69589985423f3b4ea98152433bf1aa53a0981f783f11c4cc50f70fe63b2043b74b9cb7da59caedadc1fa1f662831a353969893d4f93b919cda52a1ce2200a0a7895abb293c29d6d197cce98a4df8fc90c582014742a00b4bd09f1fcc5ff5753320d2b5593e657c0fb87a4cfa323ce59111eea806a6e020fb0c4fdd601087811e33e793975b5e9e936c16d243bdea757e0ee4508f5d5b496ed07b6f0f1f46ed752448f30d679b23ba8142d4ab25beb913ee77547866e5d9501a55e9797ba3407f3f4cc11398bdaf3ac4c2e79a5b133a09fcf8ae790bb985fa01daf2758fd8a77fde15a822227dddf64bb2ebc49a56ad025e01c6c59e4818abdf808789d9f87c103cf7f7d21d2a1345b9b7fd66b1cf96002343fbd62f8080d945e70bd93d4bf42b401477abed49065b4a8ccfb9d93724118168de2e8df4f78ccf3b9593f993423a619ef6bd8392a2cfc6424d3687fcdc67d33073db95d856f312b934d05a3c4e967217837920fee73b00757b617d1ef3bfc2e88a8a72f0948263db2c9e7bd491f059b6ee8d0ea3f2193314562910529869b248172bfe0f914f7a91a27c6e9e6c2e3455a7ae765392b48fc959958aa39a5a483b2a6e873ac76f8579515e42f7a3bbc82bcf71edaf12f7b40a2adc74d67ef793988cc8ac788185049e57fb84757bdc700ffde10afc19df290787ed98222f8afb2b6d11944666331350e2914466b398750acae526146373b2cbe1bdd1803e6c920a182a1ad118a3d09313c2ce2703a0a1c09215cab90c35b03b1c795cf704f42dd31ddff6be67bb355977b2e07609c5228299a170308e54705674384fc294cdfa4abf989d3c3bf3eabbbcf52a6a0646bf6db5b61ad027007464fd6fc10490ee2e9190c28ae5cb3733105cb782c0d53e5c79c3e455609d557d824154d01e282788ec8ae7c8a03fcd6cd4e37829b0f921c46d715454d5e1281c641cf0756a2f31b0369ce94e819e6254af95b88bffd7bb2cfe9469d303497fead174839b2789b5aa703176510eab1f46916b3b63f6f5b2df262fe7274a0cee9bd6e115e5f9f48ac1c09e5b3c546ae95b9916a633869854d3ee39d4acb800e876e7fc084ffd79a20fca8331caff657ec89b445c6012ff7eb9531eb1e8c90cdc66b82d6fd608310099503a9dcf50b40d10a3b1ab520477e20ad5f6405cd4b5b36d201e12088d7868c6e94737ea88db6ed5f7df4d31cbd2d0c4f21cdcc3b181f5aae7216dc4c06b2989bb44e5369ba96ce87f3e3abbb530d103a53d7e0b914115c302c935eea7d256a73aa851d84dec6d9112163be8135889c67fa90e796a6f050fba0a6a740618cd513748072daac9f3e25034772cc400a14834afbde835bc9fd7cf1113d67ebe99a3b78907596886ad5a1670ef572c18e26c98fe40194428de339cba7b8efc5fa7faf7512ef6b89a877f3e534fb4512729df686e14aece08fab3b42ea14acde0e18ffe5dc00e74288661c7463e00f3b942cddf3b71e1dcf71989f378b933df099316451cca296a4e117bbeb3b1e552e5a10f9731449ae830de14989049ce818f720e77e78a86c307c80450b26278bc25ee7390ce6d4c4dfc8d39b6b4b1ce6f3865dbdd1d37aedb555288bea9ef95c8600dea1cd10e9e42d15aa804f99a31bfaa5ea52185333d734c766e3bb4a9abf86cf4d840dc188167a25cc3054b65fd7ce053d38518474ab55e59c1ccaf34d57b4cd73b07ed63d754ab3d57dfc0f67bbdb22e33d9f63aa2b36cf0af338794d4acbd1b13669bde67f7bd032f9c6b400e8054a0cff77fc6e0591195b21715e42c881e23156b4ba504d7e1b6eb9c2ec9b9e382d85f7c52bd964d305da9496dbaa022880ddf236730c458f31258d64ae2668aa863b3fe558c7f8cfb3dabf42edcaf2891e9b9462c44153658eae85cd499abd9dca762adf26d9904d28b772b3fc3d066d56261474c944387ac7eb00059025ff25e34b8f7c2986db1ccc4297e1315c3ceeef1b8f98e0500bbb8bb0ab52d80f8c6c8fa5d24b9a05f5350e2fd59af4b9fa9a2b4339b61e208f227ba968d4dbd36246133de2078c6a15dd57754a3537c31d04da545f062dbf9cbaa0840e23974f441a4d5937fec23ff81c193bd951a7bacac8eb6d4705702cbe3c930f27869753ba6026455bbb7742c53644f1646d7545467091a207905f831505f214fbd818aea4455705b5e727850cdcac40620135b8dba85cb0c0f393af252ec082cba5c43385fbc2cc5682bc1994b064e29c8c5a20e7e6d15fbb13e6fd1a86b2fda666fbcd80fd08be00a7423fcafbdd8283bac88ead203bc10d1c1a13ca2fe853fa6cc8991b0476561be085b086b0d0e45f73e59f519342c13f368a37464cb55b8a13846f4cd610536d5c4b8704fcd347abe6712d3de67d7918e6954898f31647a8ea37ecc2e1bb02b1b26e7a60fbb2b0a48efc5795c12d5c4ac8dc4149dea0f2e085422ec69352882622711b74e1e32c7ead2cf3c554e8ff1648e8b66d0dc6997b6304b3b560a33d75aa49476175a386ca721156ea79bdba432d439dbceb0285561abd5d134badd9f38c04fae8fa920edfff15705371c907848c14acdfb0b22a4c7168e1840e8b8a50349dcee5f429b3cb34e30f0f67acf93604792b8574f36ea9409d422621f3c0c7b781fc8e23d1d46f04a9b44f633e5f72cb079fbde66a9745705666c6dab6238628e57ee6cffa8cfad616dac1abe2789c9efccb4fc7e65e490d9a4e49e7ce72a6980e72f70a17649e67de86f86b61a4b6219daefc939b5904e5712ecaf85c98484fc02585b1aa990b95173e4a2907cf877af696e528e6b2b634a4fb7d791cacc8644fa76e062148d411e18f0da5aed22116828cd700a28e8f46bca950550acb4ab05eddeb6b2dac24702cff4de0a3ece393cac879ed2f0c5b9645839cfdb79fb1df87596b14504cba9dddda51edaffcd0214b91b5898ea022774e699aa0caf0f646cc0cb8e8fc8b8be43c23aa7f6bd29fd0615c0b78f3514a52989d7f35ad08a4bd473e61da6657cc2e85d3b2b7d3fb51174a96f27038ddbc87a35e09a668e436aa40146c6a26dca87b39220f139b772719d80aadb752c622bf09acd6846838fb48a8817ba4aa72eaa32e82251b3789969d8518f9aa07cdcb9a355f73f119725c086168aaca262f13cd742e5f06c969a462638a557e15a4f5d43e3242c08f23b00d2b8d57c60d3636abd4068ec03a4be3429b95e41351ab5c58812e552df90c3e6c9d8779aa484e74f073ea9fcdce13b1dff8e7c101b2c6865c5cefe108e3559f520e2bc42c9dc39b57fddb44ca49f2689e10c1381c0740d20cbca46da475c62f513cb08398a5fd5d4f6b13ce839fe149df0d291a8f7267fe90a7e1845dace17cd927c2d1aeffbdc36bb983172ceff025e84b0419645fcc72897b992f5081c78756122391947f08ccd20806cfc2bded705b472fc52e84734e016cbd309aadebbbb4e8bdfed77b1e0b15ce0904838d9e4d64643df66f0353c377e554b428dc0f31189a134cdb8e66d2755e84c2b2409c3d63a81f5f05616baf6a243b09153a4f8289e15a5a4ffb007b0cbeffde25391bb2acd86b453e245643c0fa1dfe5d42e0e3f1c592a00b77f0133adf7989c6c2bf3ddc0b8a2b14f35d33f62f4ee2fc56166372058e997b9abe6bad8aa718f8d87ad095e8f354aaef540840437b5451771266a8358ed75954db52b38bca4a1c8696dca1de03b12627254409f8bb68c94eeaa1a8bcf894482b96e81b9ff5c2383a907537a191aff0bb5b5418ef5670cecca1cfbd41b61879b11a5a5053cd86cf5d61f8c2f7d7ad2034a1801b3b92a79ac3b4343c680008b1ba10577a35173cac6d4dbc1d00e436f238b57093b34d4ea19c225b84a2d6086cc6cf72595b980c88142d268bbf9c8375a93afe75c3583b3b9687368d78147985d209e6d89c335e948c51696a948f01ad062dcf84a99584466e24646b2e441fefb10ef962432f2925d6d98e790acf4ca7d9339a589a537aa3392ec79f34a6544144072ab8248e45ac560a78c70c5afcbf10909299dfcd67981c88780c1340c951e115ffec56d23b9ead6a55024e199238f4b133e3e1e0e84318b5037a3947ae09749c25c7e4887936ecf0ba9a807dfa471ea1f3350b70feb58dc9e2836365ce4db456a341e43410cac1253fe08e79c21fca932716f4c171fc957cb325737b70532d81f0eb2f0a16478c0d934165728f7b29a8a0ff6bc964e99dea26d3efd28336b00c112a26da7a2ea1c21a9688cc3a68293958edf27ae89e5f9b8348af4121028e760cf68c931af92906d27dad4d330df9201b5395ccce0c803806422883667ccb11438d9dbe1901d4ab98d89914b313338486deb6f748053517e2188c479adb1eabb8e8ed5d05bb3f66826fae83bbc5bce3615ee32d937ffbe8846a1156aaf7bf9b9d4189bdf290b3df254077688eeda824d6ea0a452f7e7f915c1a94ee250a3907ec035d7ba7bb0256811f04646ca156b8925506c774df4d4072c02929e985057a5f7ddc1469c7306e6fdb86b810ada1cc96f6bd389597dd27dd656f55c316fb2d56b2d13eddf893722e813934a19778719be99697c365222db64039f9caab1201c430e53df1af8a0321c8759fc33e8204150080979936d0717f6c4c9145fb828389acbb894a4600485e8b105c7165a40e814889343deead6d434a8da60eed1e50aa507ac2793b4a4c5517265f859f223bb4f6cadc6fb53430304baea18189e2b5ddd266c38f5c325ba391a50fcd34060d217c4118889c4275e40a8428099ddfa3cc0d8241c22fc1554318e922f3b1257f2046d70df460c5283a539487583ffca1972a19237b06480e0a56d9e185fe4dc3607666d81ed0d9d9f5c5c568a5a0a87160b6d35c73dae9c6177f2b25d90a2598042f4b43bc765fa86a831c401a01c391a8fdc8f8c742f2322a1b8ef18ec7d82f013893c981f6bd96ec57d8e73e1633ae3970721fcea055ecc836ce3", 0xf91}], 0x0, 0x1, 0x2) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x18, 0x0, 0x0) 2.650928491s ago: executing program 5 (id=5404): gettid() r0 = syz_usb_connect(0x3, 0x3c, &(0x7f0000000380)=ANY=[@ANYBLOB="120101000814c910be0632a2f333010203010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) (async) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000680)={0x44, &(0x7f00000003c0)={0x0, 0x14, 0xf5, "115c8a4eab26a0823fadb54911e9c0e0fccef83f755f3abf9d421c9169dba1a927e3d1304763f08405bf6aff99466d4cbbca89efb6554330b1bce3246f670899c4ae28553757d87da06be6409ec2fdead47163e6936aa272c9274f8c1524ca36962ffcc1ca0c9ad992a0c8b9549c9b96f26697ada5a55f43a299bace3ad320f92d5699222fbb80cb1a36672a698267c4e7f914f93e05277e15831ca76ef27602c887dbf64971897cbed5a1cce2fe6599dbc4be7054b74da7ad28a28c1c5a1fc47c46bc8403e8f110506227846a752f48ce80feb11f09323c0b6aff7e6a3f7c3c7c29484bb553b3dc559868b0da0c7b5d7f308d05fc"}, &(0x7f00000004c0)={0x0, 0xa, 0x1, 0x5}, &(0x7f0000000500)={0x0, 0x8, 0x1, 0x6}, &(0x7f0000000540)={0x20, 0x80, 0x1c, {0xe502, 0x1, 0x6, 0x9, 0x4, 0x401, 0x359c, 0x8, 0x375, 0xffff, 0x101, 0x8}}, &(0x7f0000000580)={0x20, 0x85, 0x4, 0x23}, &(0x7f00000005c0)={0x20, 0x83, 0x2, 0x1}, &(0x7f0000000600)={0x20, 0x87, 0x2, 0x720a}, &(0x7f0000000640)={0x20, 0x89, 0x2}}) syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) (async) r1 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) syz_usb_connect$midi(0x2, 0x4f, &(0x7f0000000180)={{0x12, 0x1, 0x250, 0x0, 0x0, 0x0, 0x40, 0x1430, 0x474b, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x3d, 0x1, 0x1, 0x8b, 0x70, 0x4, "", {{{0x9, 0x4, 0x0, 0x0, 0x3, 0x1, 0x3, 0x30, 0x5, [], [{{0x9, 0x5, 0x5, 0xe, 0x8d026bda17bf10e8, 0x7f, 0xf7, 0x40, {0x6, 0x25, 0x1, 0x2, 'r;'}}}, {{0x9, 0x5, 0xf, 0x2, 0x8, 0x7, 0x40, 0x5, {0x5, 0x25, 0x1, 0x1, "de"}}}, {{0x9, 0x5, 0x87, 0x52f828ab2ca3a53b, 0x40, 0x3, 0x9, 0x8, {0x5, 0x25, 0x1, 0x1, '4'}}}]}}}}}]}}, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0}) ioctl$I2C_RDWR(r1, 0x707, &(0x7f0000000040)={&(0x7f00000001c0)=[{0x2, 0xb010, 0x0, 0x0}, {0x5, 0xc010, 0x0, 0x0}, {0x8000, 0x4000, 0xd9, &(0x7f00000000c0)="4c0667fca019232b9e3eab7efc3ae65a28a2057b8bf846a7fe005e87c4d42d00a674c82fcbe57c358526f5703566510649a9ac071d9adb2d7651520a63787fda17bb2e70451f1257e124171a8b16e708163830422ac735ffcbe4403bd54236647e4e25bfd7017b0a015a8c2affc86e5054c18c728d3131e3317d7f73f72489c81688ad27cb7c766742752517cc5e0e0089276a8561d288f777f2e4b8cf7ed222dc9f330440003a4ec4fd2d86f962e9682b0e08b4a6b21efc19084786958f6b50eb5c9deaeeffbf3f8c84be3fafb9202094fd48aec6fabdd2da"}], 0x3}) 2.163298258s ago: executing program 0 (id=5410): r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = syz_usb_connect(0x5, 0x35, &(0x7f0000000500)=ANY=[@ANYBLOB="120100004aaf36207205a5580a27010203010902230001000000000904010901a37d7e03090500004000020401080b01"], 0x0) syz_usb_disconnect(r1) r2 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[], 0x0) syz_usb_control_io$printer(r2, 0x0, 0x0) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_control_io$hid(r2, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r2, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r2, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r2, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r1, 0x0, &(0x7f0000000300)={0x44, &(0x7f0000000100)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) ioctl$FE_GET_EVENT(r3, 0x80286f4e, &(0x7f0000000440)) r4 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r4, 0x29, 0x49, &(0x7f0000000000)=0x3, 0x4) r5 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') syz_kvm_setup_syzos_vm$x86(r5, &(0x7f0000c00000/0x400000)=nil) r6 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x7}, 0x1c) setsockopt$sock_timeval(r6, 0x1, 0x14, &(0x7f0000000080)={0x77359400}, 0x10) r7 = socket$netlink(0x10, 0x3, 0x10) sendmsg$nl_route_sched(r7, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@newqdisc={0x2c, 0x24, 0x2, 0x70bd2d, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0xfff2, 0xd}, {0xf, 0x4}, {0xffff}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0x8d5}]}, 0x2c}, 0x1, 0x0, 0x0, 0x10}, 0x10) bind$netlink(r7, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r7, 0x1, 0x8, &(0x7f0000000000), 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r7, 0x10e, 0x4, &(0x7f0000000640)=0x10001800, 0x4) listen(r6, 0xfffffffc) r8 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r8, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) close_range(r0, 0xffffffffffffffff, 0x200000000000000) 1.951692904s ago: executing program 1 (id=5414): ioctl$AUTOFS_IOC_PROTOSUBVER(0xffffffffffffffff, 0x80049367, 0x0) openat$sequencer(0xffffffffffffff9c, 0x0, 0x20001, 0x0) syz_open_dev$audion(0x0, 0x1ff, 0x0) timer_settime(0x0, 0x1, 0x0, 0x0) unshare(0x2a020400) r0 = getpgid(0x0) r1 = syz_pidfd_open(r0, 0x0) pidfd_send_signal(r1, 0x21, 0x0, 0x4) r2 = socket$inet6(0xa, 0x3, 0x87) setsockopt$inet6_int(r2, 0x29, 0x1000000000021, &(0x7f00000005c0)=0x7fff, 0x4) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x380000, @loopback, 0x4}, 0x1c) 1.878425697s ago: executing program 1 (id=5415): memfd_create(&(0x7f0000000cc0)='\x9d#\x00\xe6Z\x00\xafq%\xa5\x83\xa6\xb5\x01\x83y\xf3\xb2\xe6b$\a\x00\x00\x00\x00\x00\x01\x00\x00\xf7\xffg\xf5\x12oP\b\x00\x00\x00LR\xa1\x00\x00\x17\x1f$^\xe1\x00\x04\x00\x00\x00\x00\a\xff;\xeb\xf1\xd0\xce\xe5\x19\x12\b\x01\xd9\xae>/\x05\x00\xce\xd5O\xcc\b\x9e\x19\x19#\x00\x00\x15\x00\x00\x00\xa1\xa2\xe0g\x98\xbf*\xdcc\x12.\xb7\xbe`\'\xcb\xb6\xaf\xdc\xa0D\x93.\xf25\x957\xec\xfb\xe6|\\\xe4h\xfc\x14\x05\x00\xfd\xc7\x00\x00\x00\x00\x91\x98\x15\xec\xdb\xaa\t9\x11\xb4h$h\x0ew\x00&0\xdd\x19\x86\x90\xbe\xd7\xdc\n\xcbC\x15\xfcp\x11\xda\x00\x00\x00\x00?\xd0\xe1{\x84\xb5\x82q\x19\xacS\x88|\x99\xfd\x9eS\x80\xcb\x14G\xfa\xff\xff\xff\xff\xff\xff\xff\xcd\xf0\xb1\xd2\x168\xbf`$\xbf\xca\xea\xa3\x83q\xb6Pr\xd4\xb5X\\\xdbD\n\x03G\x00\x04\x00\x01\xbc\xac\x18\xba\xce\xb3%QF\x03\b\x9dh\xcb)\xf4f\x12[\xf9\r\t\xff\x06\xe7j\x9fTJ;T\xf3\xfa\xef{h\xb0\xc0:\x8f|\x8f\x06\xf8T\x826`M\x11\x1c\xb0*8\v\x1e\xcf\x03\xd3\xe8,?P\xac\x86\x13b\xa8D\x0f\x93\xab\x1c\x11\x00\xc5\x8d\x82\x00\x00\x00\x00\x00\x00\x00\x0f\x81\xf3\x05\xa3{\x96\xf9\xba\x9em\xe9\"\x03\x933P\xbb\xd6\x9b\f\xa7\x8f9\x988\tgC\xbc\xe0\xc5\xf4\xe0E%<\xd8w\x00k\x042Y\xd9\xc5\xe5\xb9\xe6\xff\x04K%yH\xe5\xf4\x8b\x03Ca8\x1e\xe9\\#\xf8O\fw\xd9\xf5cF\xcc\x1a2ex\xb4\x0fi$\x97\x81.\x02\x04m\xfbT2\xd4\"\x1e\xf0\x16\x0f\x97\xe6j}J\xca\xb8)f\xd5\xfd>\x9bU\xb0\x03Zt0\xc0b\xad\xef@o\xc1\xd6\x17T\f\xc30\xe2\x89\xf6L\x131\x9c\t\xa7\x80\x1b:\xbb\x04\xd7\xd1\x06\xa0\xe9\xbah\xb6\xb2\xea/{Q\xca\x14\x03\x00\x00\x00t\xc9\xecd\r\xd5)\x1d\xaf\n\xc0\xc1\x1d}DY\x95&\xe7\xf4U\xff\xcd&\a\x9f\x1bg\xe5|~\xc1\xc5n\x12%ur\xa1\x9e`\xc2\x01\b,\x18\xaf\xccD\xdeag\xc6\xf3\xd6\x94\x9d\xae\x8bl\xee\x7fu\xe5bu\x84\x04\xb3@\xa1\xf7\xc6\x13\xf9I\xfa\x12\xfc\x96\",aT\xfd\"\x01\x92\xb1\xbf\x8a\x15\x88\xfd\x8f\x88\x87\x82\x9c:L\xd2\xb8\xfa5\x066\x82\xf3_LUr\xfa\xd2\x99d \x97c9G\x99\xe3\xcc$\x96cu\x97\xe7\xc7a\tm\xe8F\xc7j\xf8\x98\x81\xe7\xf7\xab3F\xf4u\xdaav\xd21\v\x99HG\xdfx\x1cPl\t#\xc1\x8e\xddW\x00\x00\x00\x8fw\xa9A\xf7m\xeec\xb6\\\xa4T\xeej\xe2\xba\xb2V\xacc\xc6|\xae]\xdb\x10\xb3\x80z\xd5\n\xa3u\xfb\b\x03\xe5\xca;\xe5uH<\x9a\x12\x84(\x9f\xd2\xe1k\x955;J\xa4\x81Lm\x90\x1a\xfdI}\xb0\xa1\xec9\x17\xd1\xa2\xc7\xca\x98\xaeS\x92Ew`\xd2\x02\xda\xc9\xd4\xea\x02\x1d\xd3\xd5\x81\xdb\xd9~\xd6-:\xee\xe8\t\xf7\xe6\xf1\x88\x86\xb0\x04\x9ep\xb1\x93\x16\xf9\xdb\x15\x8a\xa3h<\xaf\xa0\xb5\xb0\x05ir\xff\xff\xff\xff\x00\x00\x00\x00\x83\x91\xad\x11\xf4\xbcz\x9b\x8bp]o\au\x175I\x1d\xe2\x97\xb6\x06\xdc\x14\x9b>\xd7F\xdb?\xc7%0n/\xf5S\xb5\xe8\xa5\xd1\xddN\xf9ir\xd1r\xf4L\t3\xadDz\\\xf4`\x13\xf7)\x91w\a\xcc+E\xdd\xe9\xdbb\x9c\xff\x98\x03\xb7\x0e=\xba\xa3um\xde\xff$|\xb7\x86j+\x00\x00\x00\x00\x00\x00\x00Z\xef\xd6\xf4Zs\xfc\ro\x03\xabB\x18\xdc\a\xe3\r\x00\x00\x00\x00\x00\x00I\xe1\xe2?M\x8b\x853\xce\x19\xba\fA8\x8a\xa1\x04v\xcb\xa9c\xac\xee\x8e\x8d\xfa/\x83Wm#\xe2\x8b\x01\xc2\x97\"K\x1d\xc3\tuC<}_M\x18nik9\x8a\xb1(\x04\x11\x92\x1a\xff\xbb]\x12S\xc4D\xd2h0!\x899-\xec%\xd2\xa8\x1a\xc6Fe\xff?c+\xde\xa0[\xbc\x1d\xa0\xe3\xda+\xdcK\x86\xaa\x94AD\x00[\x9c\xb1!\x01N\xd9\x96so\\\xd5\x9d$_=\x86b[\xe1\xc7\x9a\xb4}\x1erI\xe4\xb2\xb7\xe6 \x1f\a}\xb5V\x89\x9d\x9fA\xa5\xa7\xd5\x1d\x15#\x1fY&\xf2\'\xe9\xb0.\xeb\xe7\xc4\x83\xa1\xe1\t\x94^\xd4\x99\xc9\x9f\x1e\xb9\x85\x9cX\xe7\xd1l1\x1d\xc8 \xc7FB\x91\xca\x17]#c\xf5\xea\x7fL=b\xec\"\x83\xfe\x818\x14\xcdCz\x9d\x1b\xb5Q^3\xc9\\\x7fQOU\xa2~\xbe\xa8E\xe0e~sl\aJ\xec\xb2(2D\x8f\xfc\x9a\x1d7\xdc\xcfA\xc7\x9b\x93\xbc\xb2\x1d\xbe\x8eY\xce!\x04\xae\x8d\x8e%x\xa1\xe8\xca\x14W\x0f\x04b\xf29UC\\~\v\xf7\xd8\xe3\\\x8d\xdbDY\x1a\v\xa3a\xde@\xac\xca\x80\x89\xc7/\xab0\'Bk\xfc\xa0\x04\xf9:p\xd4\x1a\x84\x98\xd1\xe7a\x97\x96{\xb8g{:\xfc]', 0x4) r0 = socket$inet6(0xa, 0x3, 0x7) setsockopt$inet6_buf(r0, 0x29, 0x39, 0x0, 0x0) connect$inet6(r0, &(0x7f0000001940)={0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x9}, 0x1c) setsockopt$inet6_IPV6_RTHDRDSTOPTS(r0, 0x29, 0x37, &(0x7f0000000380)=ANY=[@ANYBLOB="a5010000010000", @ANYRES64=r0], 0x18) sendmmsg$inet6(r0, &(0x7f0000002240)=[{{0x0, 0x0, 0x0}}], 0x1, 0x44) 1.877977699s ago: executing program 1 (id=5416): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040), 0x140, 0x0) ioctl$RTC_UIE_ON(r1, 0x7003) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x14, &(0x7f0000000240)={0xffffffffffffffff}, 0x2, 0x1}}, 0x20) write$RDMA_USER_CM_CMD_BIND_IP(r0, &(0x7f0000000040)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x4e24, 0x9, @mcast2, 0x4}, r2}}, 0x30) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000180)={0x3, 0x40, 0xfa02, {{0x6000000, 0x4e24, 0x40003, @mcast1}, {0x2, 0xfff9, 0xc60, @remote, 0x9}, r2, 0x9dffffff}}, 0x48) 1.856232553s ago: executing program 1 (id=5417): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000540)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(cast6)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11", 0xfffffde6}], 0x3, &(0x7f0000000380)=[@op={0x18}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000700)=""/88, 0xffffff45}, {&(0x7f0000000780)=""/83, 0x53}], 0x2, 0x0, 0xf00}, 0x0) fsopen(&(0x7f00000001c0)='bpf\x00', 0x0) futex(&(0x7f000000cffc)=0x4, 0x80000000000b, 0x4, 0x0, &(0x7f0000048000), 0x0) r2 = socket$kcm(0xa, 0x2, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) sendmsg$sock(r2, &(0x7f0000000080)={&(0x7f0000000580)=@in6={0x2, 0x4e22, 0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0xffffffff}}], 0x18}, 0x0) 1.507912493s ago: executing program 4 (id=5418): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0xff, 0x7fff0000}]}) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETTABLE(r0, &(0x7f0000000280)={0x0, 0x3, &(0x7f0000000240)={&(0x7f0000000100)={0x14, 0x1, 0xa, 0x201, 0x0, 0x0, {0x2}}, 0x14}}, 0x0) 1.445892838s ago: executing program 4 (id=5419): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000003840), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000500)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_DEL_KEY(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000280)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYBLOB="010028bd7000fddbdf250c00000008000300", @ANYRES32=r1, @ANYBLOB="0a00060008021154110000"], 0x34}, 0x1, 0x0, 0x0, 0x20008081}, 0x8c0) r2 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000080), 0x402, 0x0) read(r2, &(0x7f00000000c0)=""/163, 0xd0140f23) sendmsg$tipc(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000040)=@id={0x1e, 0x3, 0x0, {0x6ec, 0x2}}, 0x10, &(0x7f0000000a00)=[{&(0x7f00000003c0)="6882b5482b047d1993111bc8d5066be5dfd8f9ea5918054a3d32012375b5be349f06e85c183bd62d551f1bee173f4c7697ccd54b8171ba7ccc806d8d130a2d780f9cf4a7511e0620a58433eaae61c114bac093534e5e50de0d517aa59093a148a643c7192fdb05058abf87eb5511e6e80edbb0fcf1ea60", 0x77}, {&(0x7f0000000980)="b8b5160a62479f88c530f32b1028c972de442c04b700a043d882b2027a717907cabce9180349bb71dccbf068ad9721c59b10061c50c4951f5ae29bd2401fca62fa1e89cda6126f857070560c5537e96b3e", 0x51}], 0x2, &(0x7f0000000a40)="028edf36133eaa37fb60ea6b75479685dddd7486e881", 0x16, 0x4008001}, 0x800) sendmmsg(0xffffffffffffffff, &(0x7f00000002c0), 0x40000000000009f, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000540)={0x26, 'aead\x00', 0x0, 0x0, 'generic-gcm-aesni\x00'}, 0x58) recvmsg(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}], 0x1}, 0x0) syz_open_dev$midi(&(0x7f0000000000), 0x3, 0x189e42) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1600000004"], 0x50) 991.022954ms ago: executing program 1 (id=5420): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec77e000) getsockopt(0xffffffffffffffff, 0x28, 0xfffffffe, &(0x7f0000001680)=""/56, &(0x7f0000000280)=0x38) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r2 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000040), 0x40500, 0x0) ioctl$PTP_EXTTS_REQUEST(r2, 0x40103d02, 0x0) fsopen(0x0, 0x0) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004}, 0x0) r3 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000140)={'lo\x00', 0x0}) recvmmsg(r0, &(0x7f0000001640)=[{{&(0x7f0000000280)=@l2tp={0x2, 0x0, @empty}, 0x80, 0x0}}], 0x1, 0x0, 0x0) r5 = socket$inet(0x2, 0x3, 0x4) setsockopt$inet_opts(r5, 0x0, 0x4, &(0x7f0000000000)="8907040400", 0x5) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f00000000c0)='ip6_vti0\x00', 0x10) connect$inet(r5, &(0x7f0000000080)={0x2, 0x4e20, @private=0xa010100}, 0x10) sendmmsg$inet(r5, &(0x7f0000000f40)=[{{&(0x7f0000000040)={0x2, 0x0, @broadcast}, 0x10, 0x0, 0x0, 0x0, 0x0, 0xe0}}], 0x68000, 0xe000) r6 = socket$inet6_mptcp(0xa, 0x1, 0x106) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x1, 0x4, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x20, '\x00', r4}, 0x94) listen(r6, 0x800000b) r7 = socket$netlink(0x10, 0x3, 0x4) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r9, 0x29, 0x1b, 0x0, 0x0) sendmmsg(r8, &(0x7f0000001c00), 0x400000000000159, 0x40840) write(r7, &(0x7f00000000c0)="29000000140005b7ff000051915f95eb01010003a606a40e07fff024bb000000000000000040000d00", 0x29) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r10, 0x803) socket$inet6_tcp(0xa, 0x1, 0x0) 906.048436ms ago: executing program 4 (id=5421): mknodat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x11c0, 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x840, 0x191) r1 = creat(&(0x7f0000000080)='./file0\x00', 0x20) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$AUTOFS_IOC_EXPIRE(r2, 0x810c9365, &(0x7f00000003c0)={{0x7, 0x6}, 0x100, './file0\x00'}) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x4, 0x0, 0x2, 0x4}}, 0x20) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r3, 0xc01864c6, &(0x7f0000000040)={0x0, 0xfdd0}) write$RDMA_USER_CM_CMD_LISTEN(r1, &(0x7f0000000380)={0x7, 0x8}, 0x10) sendmsg$DCCPDIAG_GETSOCK(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYRESOCT], 0x4c}}, 0x0) landlock_create_ruleset(&(0x7f0000000040)={0x11202, 0x1, 0x3}, 0x18, 0x2) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r4, 0x84, 0x6e, &(0x7f0000000140)=[@in={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x1, 0x0}}], 0x10) r5 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r5, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r4, 0x84, 0x7c, &(0x7f0000000080)={r6, 0x9, 0x7fff}, 0x8) 103.624169ms ago: executing program 1 (id=5422): r0 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000380)={'bridge_slave_0\x00'}) r1 = socket(0x10, 0x3, 0x0) ioctl$XFS_IOC_FD_TO_HANDLE(0xffffffffffffffff, 0xc038586a, &(0x7f0000000500)={r1, &(0x7f0000000240)='\\\xf3p\x19\xaa^', 0x2000, &(0x7f0000000280)={@align=0x9, {0x2, 0xf4, 0x3, 0xf0f5}}, 0xac14, &(0x7f00000003c0)={@_ha_fsid}, &(0x7f0000000600)=0x3}) openat$ppp(0xffffffffffffff9c, &(0x7f0000000180), 0x20000, 0x0) sendmsg$nl_route(r1, 0x0, 0x80) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000540), 0x2, 0x0) r3 = syz_usb_connect(0x0, 0x24, &(0x7f0000000780)=ANY=[@ANYBLOB="12010000cf8bed20d90f25004029000000010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r3, 0x0, &(0x7f0000000580)={0x44, &(0x7f0000000700)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r4 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) ioctl$I2C_SMBUS(r4, 0x720, &(0x7f0000000200)={0x1, 0x7, 0x1, &(0x7f0000000040)={0x5, "810556c721393f4084c89ea7f77d040b00"}}) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000640)=ANY=[@ANYBLOB="200000002e00090027bd7000fedbdf25040000000c001a80080004777331e58004008000"], 0x20}, 0x1, 0x0, 0x0, 0x42804}, 0x84) keyctl$set_reqkey_keyring(0xe, 0x5) prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x2, 0x4, 0x4, 0x9}, 0x50) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xd, 0x6, 0x4, 0x1, 0x1, r6}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000440)={{r7}, &(0x7f0000000840), &(0x7f0000000340)=r6}, 0x20) close(r6) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000380)={r7, &(0x7f0000000900)}, 0x20) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f00000000c0)={'wlan0\x00'}) sendmsg$NL80211_CMD_STOP_SCHED_SCAN(r5, &(0x7f0000000380)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="270f28bd7000fbdbdf254c0000746a940a620ddf3f0038fda8427b000000000000000c0058022100000000837099480058007f000000000000000c00580062000000000000000c5f9a6a64a8ed3e30068c702c00580028000000000000000c"], 0x5c}, 0x1, 0x0, 0x0, 0x20008804}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={0x0, 0x64}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000000) sendmsg$nl_route(r1, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000a40)=ANY=[@ANYRES32, @ANYRESOCT=r2, @ANYBLOB="1000000000000300000012800b00010062726964670a00001800028005001900845fe3751ff97bc091d7f7"], 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x10) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=@newqdisc={0x24, 0x24, 0x1, 0x70bd26, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x7}, {0xffff, 0xffff}, {0x5, 0x7ff9}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x841) 0s ago: executing program 4 (id=5423): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r0, 0x29, 0x1a, &(0x7f0000000080)=0x2, 0x4) bind$inet6(r0, &(0x7f0000000540)={0xa, 0x4e22, 0x7, @empty, 0x1fc}, 0x1c) creat(&(0x7f00000011c0)='./file0\x00', 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f00000000c0)='tasks\x00', 0x2, 0x0) r3 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) setpgid(r3, r3) setpgid(0x0, r3) tkill(r3, 0x4) wait4(r3, 0x0, 0x2, 0x0) syz_open_procfs$namespace(r3, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x6) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000780)={0x0, 0x4, 0x0, [0x806f, 0x0, 0x2d5, 0x2, 0x6], [0x6, 0x7, 0x1, 0x9, 0x8002, 0x0, 0x5, 0x2, 0x0, 0x802, 0x9, 0x200000100, 0xffffffffffffffff, 0xfffffffffffffff4, 0x4a, 0x5, 0x100, 0xd, 0xdd, 0x5, 0x1, 0x2a9, 0x2000000003, 0xc39, 0x0, 0x8, 0x100000000, 0x2, 0xa51, 0x8, 0x2, 0x800000000000001, 0x7, 0xfffffffffffffffb, 0x81, 0x100, 0x5, 0x931, 0x101, 0x3, 0xf, 0x8000000000000000, 0x7, 0x1, 0xfffffffffffffffb, 0x77, 0x6a8, 0x102, 0xe, 0x83, 0x538a, 0x6, 0xfffffffffffffffb, 0x4, 0x3, 0x8000000000000000, 0x5, 0x0, 0x80008000, 0x8000000000000000, 0x40000000000004, 0xffffffff, 0xfffffffffffffffd, 0x5bc, 0x1, 0x0, 0x4, 0x8000, 0xc9, 0x0, 0x2000000000000006, 0x9, 0x82c, 0x8000, 0xe000000000000, 0xe4, 0x11, 0x0, 0x8, 0x26, 0xffffffffffffffff, 0x7, 0xbfb, 0x8000000000000000, 0x2000000009, 0x8, 0x0, 0x6, 0x6, 0x7, 0x100000002, 0x4, 0x3, 0x7, 0x7, 0x7, 0x9, 0x1, 0x16d, 0x6, 0x68d, 0xffffffffffff43b0, 0x8, 0x50000000000000, 0xe, 0x0, 0x1, 0x6e8, 0x5, 0x7, 0x6, 0x3, 0x6, 0x5, 0x1, 0x3, 0x10000, 0x7fffffff, 0x7, 0x3, 0x1]}) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000fe4000/0x11000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ff1000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004084) r4 = io_uring_setup(0x899, &(0x7f0000000040)={0x0, 0x83cb1, 0x8000, 0x8, 0x20002ff}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000240)={0x1, &(0x7f0000000000)=[{0x6, 0x5, 0x7, 0x7ffc0001}]}) io_uring_enter(r4, 0x2219, 0x7721, 0x16, 0x0, 0x0) write$cgroup_pid(r2, &(0x7f0000000240)=r3, 0x12) getsockname$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000040)=0x1c) syz_usb_connect$midi(0x6, 0x58, &(0x7f00000001c0)=ANY=[@ANYBLOB="120101020000001030144b4740000102030109024600d2a50000090904000002010300040f6b1f030c04e12e99929ac602ae01080bf100000000000000495009058000000400ff0808252004ed2d7091"], &(0x7f0000000680)={0xa, &(0x7f0000000280)={0xa, 0x6, 0x250, 0x0, 0x0, 0x7f, 0x40, 0x73}, 0x24, &(0x7f0000000700)=ANY=[@ANYBLOB="050f2400020b1001000400050509082c14100407d4edace1399c5de4662299032e0ede756eca68860be2767f2a5384bfcbc16f636e322380c7a36970dbd539d7a06561ae5e524fc02a8c471506c9b9"], 0x8, [{0x4, &(0x7f0000000300)=@lang_id={0x4, 0x3, 0x280a}}, {0x4, &(0x7f0000000340)=@lang_id={0x4, 0x3, 0x3401}}, {0x4, &(0x7f0000000380)=@lang_id={0x4, 0x3, 0x2c01}}, {0x4, &(0x7f00000003c0)=@lang_id={0x4, 0x3, 0x43e}}, {0x4, &(0x7f0000000400)=@lang_id={0x4, 0x3, 0x809}}, {0x4, &(0x7f0000000440)=@lang_id={0x4}}, {0x4e, &(0x7f0000000480)=ANY=[@ANYBLOB="4e031bc9b75644600e5865b9e503a31815ffabe738c0315cecc99cc4f87f38bf3e5375dbdd9e245f1f6a398531808bdb76bf02cae2f8c553dd50c7cf6abe31ab278b48d224f7b3aae45d13aa2c4a"]}, {0x8d, &(0x7f0000000580)=@string={0x8d, 0x3, "6b3539098cac04eaff858af489b0cc25ead0d1b57304fc039d91de22297c60f4b4d7c4d87537bd3143fb9b98a992ac7822e2238ac10c7de36ba31d6c0f251f1e0f12261fd91b6547fa65ed7cc129d16d1cb5ec367619006e842a9f1e80e199c7f70c8130077051a013a341c24a3637f05d84cae4822fe7d3aa00cea4876a47eabdb7a04dd31ca5ffc1b020"}}]}) listen(r0, 0x80000003) r5 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r6, 0x4008ae89, &(0x7f0000000240)={0x1, 0x0, [{0x4b564d02, 0xec000000, 0xe9}]}) ioctl$FAT_IOCTL_GET_ATTRIBUTES(r0, 0x80047210, &(0x7f0000000100)) r7 = socket$netlink(0x10, 0x3, 0x9) writev(r7, &(0x7f00000000c0)=[{&(0x7f0000000140)="580000001500add427323b470c47b45602067fffffff81004e220700000000000000a8002000eaa57b00090080020efffeffe809020000ff0004f03a007357ac8ddc1fdd00000000000004ffffffe7ee0000000044c60000", 0x2a}], 0x1) kernel console output (not intermixed with test programs): all_64+0x174/0x580 [ 721.905971][T20733] ? clear_bhb_loop+0x40/0x90 [ 721.905985][T20733] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 721.905996][T20733] RIP: 0033:0x7fa6a6d9ce59 [ 721.906022][T20733] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 721.906033][T20733] RSP: 002b:00007fa6a7c1b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 721.906051][T20733] RAX: ffffffffffffffda RBX: 00007fa6a7015fa0 RCX: 00007fa6a6d9ce59 [ 721.906060][T20733] RDX: 04000000000001f2 RSI: 0000200000000000 RDI: 0000000000000004 [ 721.906069][T20733] RBP: 00007fa6a7c1b090 R08: 0000000000000000 R09: 0000000000000000 [ 721.906077][T20733] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 721.906085][T20733] R13: 00007fa6a7016038 R14: 00007fa6a7015fa0 R15: 00007fa6a713fa48 [ 721.906098][T20733] [ 722.211279][T20736] FAULT_INJECTION: forcing a failure. [ 722.211279][T20736] name failslab, interval 1, probability 0, space 0, times 0 [ 722.276244][T20736] CPU: 0 UID: 0 PID: 20736 Comm: syz.4.4899 Tainted: G L syzkaller #0 PREEMPT(full) [ 722.276278][T20736] Tainted: [L]=SOFTLOCKUP [ 722.276281][T20736] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 722.276288][T20736] Call Trace: [ 722.276294][T20736] [ 722.276299][T20736] dump_stack_lvl+0xe8/0x150 [ 722.276320][T20736] should_fail_ex+0x40c/0x560 [ 722.276341][T20736] should_failslab+0xa8/0x100 [ 722.276364][T20736] __kmalloc_cache_noprof+0x88/0x660 [ 722.276384][T20736] ? __raw_spin_lock_init+0x45/0x100 [ 722.276401][T20736] ? register_netdevice+0x57e/0x1eb0 [ 722.276416][T20736] register_netdevice+0x57e/0x1eb0 [ 722.276429][T20736] ? netlink_rcv_skb+0x226/0x4a0 [ 722.276439][T20736] ? ____sys_sendmsg+0x9b9/0xa20 [ 722.276452][T20736] ? __x64_sys_sendmsg+0x1b1/0x290 [ 722.276467][T20736] ? do_syscall_64+0x174/0x580 [ 722.276487][T20736] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 722.276507][T20736] ? __pfx_register_netdevice+0x10/0x10 [ 722.276526][T20736] ? ip_tunnel_find+0x425/0x500 [ 722.276548][T20736] ? __pfx_ip_tunnel_find+0x10/0x10 [ 722.276560][T20736] ? net_generic+0x1e/0x240 [ 722.276571][T20736] ? ip_tunnel_newlink+0x230/0x8b0 [ 722.276584][T20736] ip_tunnel_newlink+0x25a/0x8b0 [ 722.276598][T20736] ? __pfx_ip_tunnel_newlink+0x10/0x10 [ 722.276614][T20736] ? ipgre_netlink_parms+0x666/0x9c0 [ 722.276635][T20736] erspan_newlink+0x47a/0x8d0 [ 722.276655][T20736] ? __pfx_erspan_newlink+0x10/0x10 [ 722.276686][T20736] ? rtnl_create_link+0xa04/0xd70 [ 722.276698][T20736] ? __pfx_erspan_newlink+0x10/0x10 [ 722.276710][T20736] rtnl_newlink_create+0x310/0xb00 [ 722.276723][T20736] ? __pfx_rtnl_newlink_create+0x10/0x10 [ 722.276735][T20736] ? __pfx___mutex_lock+0x10/0x10 [ 722.276751][T20736] ? ns_capable+0x89/0xe0 [ 722.276769][T20736] rtnl_newlink+0x167f/0x1bd0 [ 722.276792][T20736] ? __pfx_rtnl_newlink+0x10/0x10 [ 722.276807][T20736] ? unwind_next_frame+0x8f/0x2550 [ 722.276822][T20736] ? rcu_is_watching+0x15/0xb0 [ 722.276839][T20736] ? is_bpf_text_address+0x26/0x2b0 [ 722.276859][T20736] ? rcu_is_watching+0x15/0xb0 [ 722.276876][T20736] ? rcu_is_watching+0x15/0xb0 [ 722.276890][T20736] ? lock_release+0x4b/0x3c0 [ 722.276911][T20736] ? lock_release+0x4b/0x3c0 [ 722.276934][T20736] ? is_bpf_text_address+0x292/0x2b0 [ 722.276955][T20736] ? is_bpf_text_address+0x26/0x2b0 [ 722.276976][T20736] ? unwind_next_frame+0x8f/0x2550 [ 722.276989][T20736] ? rcu_is_watching+0x15/0xb0 [ 722.276999][T20736] ? is_bpf_text_address+0x26/0x2b0 [ 722.277012][T20736] ? rcu_is_watching+0x15/0xb0 [ 722.277021][T20736] ? rcu_is_watching+0x15/0xb0 [ 722.277030][T20736] ? lock_release+0x4b/0x3c0 [ 722.277042][T20736] ? lock_release+0x4b/0x3c0 [ 722.277063][T20736] ? is_bpf_text_address+0x292/0x2b0 [ 722.277084][T20736] ? is_bpf_text_address+0x26/0x2b0 [ 722.277106][T20736] ? kernel_text_address+0xa5/0xe0 [ 722.277123][T20736] ? __kernel_text_address+0xd/0x30 [ 722.277136][T20736] ? unwind_get_return_address+0x4d/0x90 [ 722.277147][T20736] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 722.277159][T20736] ? arch_stack_walk+0xfb/0x150 [ 722.277172][T20736] ? __pfx_rtnl_newlink+0x10/0x10 [ 722.277181][T20736] ? lock_release+0x4b/0x3c0 [ 722.277193][T20736] ? bpf_lsm_capable+0x9/0x20 [ 722.277206][T20736] ? security_capable+0x7e/0x2c0 [ 722.277230][T20736] ? __pfx_rtnl_newlink+0x10/0x10 [ 722.277246][T20736] rtnetlink_rcv_msg+0x802/0xc00 [ 722.277271][T20736] ? kasan_save_track+0x3e/0x80 [ 722.277291][T20736] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 722.277307][T20736] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 722.277319][T20736] ? __netlink_lookup+0xc6/0x8b0 [ 722.277331][T20736] ? rcu_is_watching+0x15/0xb0 [ 722.277341][T20736] netlink_rcv_skb+0x226/0x4a0 [ 722.277356][T20736] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 722.277374][T20736] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 722.277396][T20736] ? net_generic+0x1e/0x240 [ 722.277410][T20736] ? net_generic+0x1e/0x240 [ 722.277425][T20736] ? netlink_deliver_tap+0x2e/0x1b0 [ 722.277442][T20736] netlink_unicast+0x7bb/0x940 [ 722.277453][T20736] netlink_sendmsg+0x813/0xb40 [ 722.277466][T20736] ? __pfx_netlink_sendmsg+0x10/0x10 [ 722.277477][T20736] ? aa_sock_msg_perm+0xf1/0x1b0 [ 722.277486][T20736] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 722.277499][T20736] ? __pfx_netlink_sendmsg+0x10/0x10 [ 722.277518][T20736] ____sys_sendmsg+0x9b9/0xa20 [ 722.277541][T20736] ? __pfx_____sys_sendmsg+0x10/0x10 [ 722.277561][T20736] ? lock_release+0x4b/0x3c0 [ 722.277582][T20736] ? import_iovec+0x73/0xa0 [ 722.277597][T20736] ___sys_sendmsg+0x2a5/0x360 [ 722.277608][T20736] ? rcu_is_watching+0x15/0xb0 [ 722.277616][T20736] ? get_pid_task+0x20/0x1f0 [ 722.277625][T20736] ? __pfx____sys_sendmsg+0x10/0x10 [ 722.277636][T20736] ? rcu_is_watching+0x15/0xb0 [ 722.277655][T20736] ? __fget_files+0x2a/0x420 [ 722.277673][T20736] ? __fget_files+0x3a2/0x420 [ 722.277694][T20736] __x64_sys_sendmsg+0x1b1/0x290 [ 722.277714][T20736] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 722.277735][T20736] ? rcu_is_watching+0x15/0xb0 [ 722.277745][T20736] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 722.277756][T20736] do_syscall_64+0x174/0x580 [ 722.277768][T20736] ? trace_irq_disable+0x3b/0x140 [ 722.277781][T20736] ? clear_bhb_loop+0x40/0x90 [ 722.277791][T20736] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 722.277805][T20736] RIP: 0033:0x7fa6a6d9ce59 [ 722.277820][T20736] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 722.277834][T20736] RSP: 002b:00007fa6a7c1b028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 722.277853][T20736] RAX: ffffffffffffffda RBX: 00007fa6a7015fa0 RCX: 00007fa6a6d9ce59 [ 722.277865][T20736] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000003 [ 722.277876][T20736] RBP: 00007fa6a7c1b090 R08: 0000000000000000 R09: 0000000000000000 [ 722.277883][T20736] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 722.277889][T20736] R13: 00007fa6a7016038 R14: 00007fa6a7015fa0 R15: 00007fa6a713fa48 [ 722.277899][T20736] [ 722.911233][T20696] Bluetooth: hci1: command 0x0406 tx timeout [ 722.917475][T20696] Bluetooth: hci3: command 0x0406 tx timeout [ 722.923668][T20696] Bluetooth: hci2: command 0x0c1a tx timeout [ 723.109605][T20747] blktrace: Concurrent blktraces are not allowed on sg0 [ 723.170466][T20751] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4905'. [ 723.309557][T20759] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4908'. [ 723.660187][ T5695] usb 1-1: USB disconnect, device number 112 [ 723.693387][T20771] fuse: Bad value for 'fd' [ 723.841785][T20776] netlink: 'syz.1.4914': attribute type 1 has an invalid length. [ 723.896316][T20780] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4914'. [ 723.966300][T20776] bond3: entered promiscuous mode [ 723.972944][T20776] 8021q: adding VLAN 0 to HW filter on device bond3 [ 723.981111][T20780] bond3: entered allmulticast mode [ 724.007254][T20776] bond3: (slave bridge2): making interface the new active one [ 724.015311][T20776] bridge2: entered promiscuous mode [ 724.021825][T20776] bridge2: entered allmulticast mode [ 724.028792][T20776] bond3: (slave bridge2): Enslaving as an active interface with an up link [ 724.086938][ T5695] usb 1-1: new high-speed USB device number 113 using dummy_hcd [ 724.109120][T19420] IPVS: starting estimator thread 0... [ 724.115419][T20784] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 724.125843][T20784] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 724.206931][T20785] IPVS: using max 88 ests per chain, 211200 per kthread [ 724.236902][T19409] usb 5-1: new high-speed USB device number 16 using dummy_hcd [ 724.388428][T19409] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 724.398879][T19409] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 724.408332][T19409] usb 5-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 724.417723][T19409] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 724.430736][T19409] usb 5-1: config 0 descriptor?? [ 724.566888][T19414] usb 4-1: new full-speed USB device number 25 using dummy_hcd [ 724.718935][T19414] usb 4-1: unable to get BOS descriptor or descriptor too short [ 724.731885][T19414] usb 4-1: not running at top speed; connect to a high speed hub [ 724.741754][T19414] usb 4-1: config 12 has an invalid interface number: 104 but max is 0 [ 724.750697][T19414] usb 4-1: config 12 has no interface number 0 [ 724.757435][T19414] usb 4-1: config 12 interface 104 altsetting 9 has an endpoint descriptor with address 0x1F, changing to 0xF [ 724.770441][T19414] usb 4-1: config 12 interface 104 has no altsetting 0 [ 724.791008][T19414] usb 4-1: New USB device found, idVendor=05f9, idProduct=ffff, bcdDevice=e6.f3 [ 724.810210][T19414] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 724.826572][T19414] usb 4-1: Product: syz [ 724.831273][T19414] usb 4-1: Manufacturer: syz [ 724.836081][T19414] usb 4-1: SerialNumber: syz [ 724.947170][ T5624] Bluetooth: hci2: command 0x0c1a tx timeout [ 725.600687][T20797] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4920'. [ 726.027162][T20800] syzkaller0: entered promiscuous mode [ 726.032750][T20800] syzkaller0: entered allmulticast mode [ 726.108326][T20802] xt_hashlimit: size too large, truncated to 1048576 [ 726.162094][T20804] netlink: 14 bytes leftover after parsing attributes in process `syz.5.4922'. [ 726.189178][T20806] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 726.209650][T20806] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 726.386241][T20813] netlink: 44 bytes leftover after parsing attributes in process `syz.1.4925'. [ 726.450039][T20818] netlink: 'syz.5.4926': attribute type 21 has an invalid length. [ 726.458202][T20818] netlink: 136 bytes leftover after parsing attributes in process `syz.5.4926'. [ 726.710353][T20824] netlink: 16 bytes leftover after parsing attributes in process `syz.0.4928'. [ 726.864843][T20826] input: syz1 as /devices/virtual/input/input85 [ 726.898003][T19425] usb 5-1: USB disconnect, device number 16 [ 727.265680][T20845] FAULT_INJECTION: forcing a failure. [ 727.265680][T20845] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 727.293542][T20845] CPU: 0 UID: 0 PID: 20845 Comm: syz.5.4937 Tainted: G L syzkaller #0 PREEMPT(full) [ 727.293572][T20845] Tainted: [L]=SOFTLOCKUP [ 727.293579][T20845] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 727.293589][T20845] Call Trace: [ 727.293596][T20845] [ 727.293603][T20845] dump_stack_lvl+0xe8/0x150 [ 727.293627][T20845] should_fail_ex+0x40c/0x560 [ 727.293650][T20845] _copy_from_iter+0x1d3/0x1660 [ 727.293671][T20845] ? rcu_is_watching+0x15/0xb0 [ 727.293688][T20845] ? trace_kmem_cache_alloc+0x29/0xe0 [ 727.293707][T20845] ? __build_skb+0x62/0x440 [ 727.293735][T20845] ? kmem_cache_alloc_noprof+0x303/0x650 [ 727.293753][T20845] ? __build_skb+0x62/0x440 [ 727.293770][T20845] ? __pfx__copy_from_iter+0x10/0x10 [ 727.293790][T20845] ? __build_skb+0x2a2/0x440 [ 727.293808][T20845] ? netlink_sendmsg+0x650/0xb40 [ 727.293828][T20845] ? skb_put+0x112/0x210 [ 727.293846][T20845] netlink_sendmsg+0x6c0/0xb40 [ 727.293867][T20845] ? __pfx_netlink_sendmsg+0x10/0x10 [ 727.293888][T20845] ? aa_sock_msg_perm+0xf1/0x1b0 [ 727.293904][T20845] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 727.293923][T20845] ? __pfx_netlink_sendmsg+0x10/0x10 [ 727.293942][T20845] ____sys_sendmsg+0x9b9/0xa20 [ 727.293966][T20845] ? __pfx_____sys_sendmsg+0x10/0x10 [ 727.293986][T20845] ? lock_release+0x4b/0x3c0 [ 727.294009][T20845] ? import_iovec+0x73/0xa0 [ 727.294031][T20845] ___sys_sendmsg+0x2a5/0x360 [ 727.294050][T20845] ? rcu_is_watching+0x15/0xb0 [ 727.294066][T20845] ? get_pid_task+0x20/0x1f0 [ 727.294082][T20845] ? __pfx____sys_sendmsg+0x10/0x10 [ 727.294103][T20845] ? rcu_is_watching+0x15/0xb0 [ 727.294128][T20845] ? __fget_files+0x2a/0x420 [ 727.294145][T20845] ? __fget_files+0x3a2/0x420 [ 727.294165][T20845] __x64_sys_sendmsg+0x1b1/0x290 [ 727.294186][T20845] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 727.294210][T20845] ? rcu_is_watching+0x15/0xb0 [ 727.294227][T20845] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 727.294243][T20845] do_syscall_64+0x174/0x580 [ 727.294263][T20845] ? trace_irq_disable+0x3b/0x140 [ 727.294283][T20845] ? clear_bhb_loop+0x40/0x90 [ 727.294301][T20845] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 727.294317][T20845] RIP: 0033:0x7f15db19ce59 [ 727.294332][T20845] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 727.294346][T20845] RSP: 002b:00007f15dc0f1028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 727.294365][T20845] RAX: ffffffffffffffda RBX: 00007f15db415fa0 RCX: 00007f15db19ce59 [ 727.294377][T20845] RDX: 0000000020004804 RSI: 0000200000000000 RDI: 0000000000000006 [ 727.294388][T20845] RBP: 00007f15dc0f1090 R08: 0000000000000000 R09: 0000000000000000 [ 727.294399][T20845] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 727.294409][T20845] R13: 00007f15db416038 R14: 00007f15db415fa0 R15: 00007f15db53fa48 [ 727.294432][T20845] [ 727.659911][T19414] usbserial_generic 4-1:12.104: The "generic" usb-serial driver is only for testing and one-off prototypes. [ 727.681818][T19414] usbserial_generic 4-1:12.104: Tell linux-usb@vger.kernel.org to add your device to a proper driver. [ 727.704394][T19414] usbserial_generic 4-1:12.104: generic converter detected [ 727.740809][T19414] usb 4-1: generic converter now attached to ttyUSB0 [ 727.761007][T19414] usb 4-1: USB disconnect, device number 25 [ 727.809931][T19414] generic ttyUSB0: generic converter now disconnected from ttyUSB0 [ 727.851854][T19414] usbserial_generic 4-1:12.104: device disconnected [ 728.171473][T20866] FAULT_INJECTION: forcing a failure. [ 728.171473][T20866] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 728.206597][T20866] CPU: 0 UID: 0 PID: 20866 Comm: syz.1.4944 Tainted: G L syzkaller #0 PREEMPT(full) [ 728.206629][T20866] Tainted: [L]=SOFTLOCKUP [ 728.206635][T20866] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 728.206645][T20866] Call Trace: [ 728.206651][T20866] [ 728.206658][T20866] dump_stack_lvl+0xe8/0x150 [ 728.206672][T20866] should_fail_ex+0x40c/0x560 [ 728.206684][T20866] _copy_from_user+0x2d/0xb0 [ 728.206699][T20866] ___sys_sendmsg+0x1c6/0x360 [ 728.206711][T20866] ? rcu_is_watching+0x15/0xb0 [ 728.206721][T20866] ? get_pid_task+0x20/0x1f0 [ 728.206730][T20866] ? __pfx____sys_sendmsg+0x10/0x10 [ 728.206742][T20866] ? rcu_is_watching+0x15/0xb0 [ 728.206756][T20866] ? __fget_files+0x2a/0x420 [ 728.206766][T20866] ? __fget_files+0x3a2/0x420 [ 728.206777][T20866] __x64_sys_sendmsg+0x1b1/0x290 [ 728.206790][T20866] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 728.206812][T20866] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 728.206827][T20866] do_syscall_64+0x174/0x580 [ 728.206844][T20866] ? trace_irq_disable+0x3b/0x140 [ 728.206863][T20866] ? clear_bhb_loop+0x40/0x90 [ 728.206878][T20866] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 728.206893][T20866] RIP: 0033:0x7f9d7959ce59 [ 728.206907][T20866] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 728.206922][T20866] RSP: 002b:00007f9d7a37e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 728.206940][T20866] RAX: ffffffffffffffda RBX: 00007f9d79815fa0 RCX: 00007f9d7959ce59 [ 728.206952][T20866] RDX: 0000000000000000 RSI: 00002000000002c0 RDI: 0000000000000003 [ 728.206963][T20866] RBP: 00007f9d7a37e090 R08: 0000000000000000 R09: 0000000000000000 [ 728.206973][T20866] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 728.206983][T20866] R13: 00007f9d79816038 R14: 00007f9d79815fa0 R15: 00007f9d7993fa48 [ 728.207001][T20866] [ 728.454788][T20870] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 728.576937][T19420] usb 4-1: new high-speed USB device number 26 using dummy_hcd [ 728.585387][T19419] usb 6-1: new full-speed USB device number 95 using dummy_hcd [ 728.700491][T20872] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 728.718158][T20872] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 728.732259][T20872] netlink: 'syz.1.4946': attribute type 3 has an invalid length. [ 728.748479][T19420] usb 4-1: Using ep0 maxpacket: 32 [ 728.755442][T19419] usb 6-1: config 0 interface 0 altsetting 11 endpoint 0x81 has invalid maxpacket 1023, setting to 64 [ 728.767040][T19419] usb 6-1: config 0 interface 0 altsetting 11 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 728.780192][T19420] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 728.791435][T19419] usb 6-1: config 0 interface 0 has no altsetting 0 [ 728.798517][T19419] usb 6-1: New USB device found, idVendor=09da, idProduct=022b, bcdDevice= 0.00 [ 728.808256][T19419] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 728.817781][T19420] usb 4-1: New USB device found, idVendor=0424, idProduct=c001, bcdDevice=aa.5f [ 728.828736][T19419] usb 6-1: config 0 descriptor?? [ 728.838617][T19420] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 728.847243][T20867] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 728.868738][T19420] usb 4-1: Product: syz [ 728.879504][T19420] usb 4-1: Manufacturer: syz [ 728.889592][T19420] usb 4-1: SerialNumber: syz [ 728.901848][T19420] usb 4-1: config 0 descriptor?? [ 729.026903][ T9] usb 1-1: new high-speed USB device number 114 using dummy_hcd [ 729.189000][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 729.215038][T20862] kvm: kvm [20861]: vcpu0, guest rIP: 0x9113 Unhandled WRMSR(0x187) = 0x700 [ 729.224056][T20862] kvm: kvm [20861]: vcpu0, guest rIP: 0x9113 Unhandled WRMSR(0x186) = 0xf400 [ 729.236597][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x4 has invalid maxpacket 12336, setting to 64 [ 729.237684][T20862] kvm: kvm [20861]: vcpu0, guest rIP: 0x9113 Unhandled WRMSR(0x11e) = 0x9500 [ 729.277004][ T9] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9375, bcdDevice=1a.de [ 729.294458][T20862] kvm: kvm [20861]: vcpu0, guest rIP: 0x9113 Unhandled WRMSR(0xc2) = 0x8200 [ 729.334115][T20862] kvm: kvm [20861]: vcpu0, guest rIP: 0x9113 Unhandled WRMSR(0xc1) = 0x6f00 [ 729.342989][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 729.370638][ T9] usb 1-1: config 0 descriptor?? [ 729.519715][T19414] usb 4-1: USB disconnect, device number 26 [ 729.580151][T20890] openvswitch: netlink: nsh attribute has unmatched MD type 0. [ 729.599863][T20890] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 729.613580][T20894] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4951'. [ 729.634256][T20894] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4951'. [ 729.708682][T20898] netlink: 280 bytes leftover after parsing attributes in process `syz.4.4952'. [ 729.762698][T20900] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4954'. [ 729.961474][T20907] netlink: 16186 bytes leftover after parsing attributes in process `syz.1.4955'. [ 730.165025][T20917] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4959'. [ 730.176443][T20917] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4959'. [ 730.468113][ T9] ath6kl: Failed to submit usb control message: -110 [ 730.510191][ T9] ath6kl: unable to send the bmi data to the device: -110 [ 730.555441][ T9] ath6kl: Unable to send get target info: -110 [ 730.589905][ T9] ath6kl: Failed to init ath6kl core: -110 [ 730.617417][ T9] ath6kl_usb 1-1:0.0: probe with driver ath6kl_usb failed with error -110 [ 730.793801][T20936] netlink: 280 bytes leftover after parsing attributes in process `syz.1.4964'. [ 731.133299][T19419] usbhid 6-1:0.0: can't add hid device: -71 [ 731.155031][T19419] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 731.191323][T19419] usb 6-1: USB disconnect, device number 95 [ 731.486937][ T9] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 731.614145][T19419] usb 1-1: USB disconnect, device number 114 [ 731.661476][ T9] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 731.700975][ T9] usb 4-1: config 1 interface 1 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 731.748251][ T9] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 731.771327][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 731.795953][ T9] usb 4-1: Product: syz [ 731.806864][ T9] usb 4-1: Manufacturer: syz [ 731.814616][ T9] usb 4-1: SerialNumber: syz [ 731.833911][ T9] cdc_ncm 4-1:1.0: skipping garbage [ 731.856472][ T9] cdc_ncm 4-1:1.0: CDC Union missing and no IAD found [ 731.873192][ T9] cdc_ncm 4-1:1.0: bind() failure [ 731.889483][ T9] cdc_ncm 4-1:1.1: CDC Union missing and no IAD found [ 731.896330][ T9] cdc_ncm 4-1:1.1: bind() failure [ 732.026905][T19419] usb 1-1: new high-speed USB device number 115 using dummy_hcd [ 732.052648][T20945] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4967'. [ 732.095957][ T9] usb 4-1: USB disconnect, device number 27 [ 732.188572][T19419] usb 1-1: too many configurations: 9, using maximum allowed: 8 [ 732.205054][T19419] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 732.223287][T19419] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 732.246725][T19419] usb 1-1: config 0 interface 0 has no altsetting 0 [ 732.261917][T19419] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 732.275411][T19419] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 732.287115][T19419] usb 1-1: config 0 interface 0 has no altsetting 0 [ 732.294898][T19419] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 732.304531][T19419] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 732.315589][T19419] usb 1-1: config 0 interface 0 has no altsetting 0 [ 732.324599][T19419] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 732.333749][T19419] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 732.345230][T19419] usb 1-1: config 0 interface 0 has no altsetting 0 [ 732.352970][T19419] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 732.362075][T19419] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 732.373283][T19419] usb 1-1: config 0 interface 0 has no altsetting 0 [ 732.381029][T19419] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 732.390064][T19419] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 732.401639][T19419] usb 1-1: config 0 interface 0 has no altsetting 0 [ 732.411484][T19419] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 732.423710][T19419] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 732.427831][T19414] usb 6-1: new high-speed USB device number 96 using dummy_hcd [ 732.434653][T19419] usb 1-1: config 0 interface 0 has no altsetting 0 [ 732.451380][T19419] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 732.460628][T19419] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 732.471996][T19419] usb 1-1: config 0 interface 0 has no altsetting 0 [ 732.480249][T19419] usb 1-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 732.489426][T19419] usb 1-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 732.497834][T19419] usb 1-1: Product: syz [ 732.502093][T19419] usb 1-1: Manufacturer: syz [ 732.506688][T19419] usb 1-1: SerialNumber: syz [ 732.513119][T19419] usb 1-1: config 0 descriptor?? [ 732.521470][T19419] yurex 1-1:0.0: USB YUREX device now attached to Yurex #0 [ 732.597484][T19414] usb 6-1: too many configurations: 53, using maximum allowed: 8 [ 732.614456][T19414] usb 6-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 732.630831][T19414] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 732.642652][T19414] usb 6-1: Product: syz [ 732.646953][T19414] usb 6-1: Manufacturer: syz [ 732.647549][ T9] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 732.651713][T19414] usb 6-1: SerialNumber: syz [ 732.811767][ T9] usb 5-1: config 0 has an invalid interface number: 69 but max is 0 [ 732.813135][T20974] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4970'. [ 732.829242][ T9] usb 5-1: config 0 has no interface number 0 [ 732.849566][ T9] usb 5-1: config 0 interface 69 altsetting 0 bulk endpoint 0x8 has invalid maxpacket 1023 [ 732.878116][ C0] usb 1-1: yurex_control_callback - control failed: -71 [ 732.878421][ T5695] usb 1-1: USB disconnect, device number 115 [ 732.899555][ T9] usb 5-1: config 0 interface 69 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 732.901689][T19414] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPROTO [ 732.926963][ T5695] yurex 1-1:0.0: USB YUREX #0 now disconnected [ 732.931007][ T9] usb 5-1: New USB device found, idVendor=0c4b, idProduct=0100, bcdDevice=d7.ca [ 732.943237][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 732.961939][ T9] usb 5-1: Product: syz [ 732.964897][T19414] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): lan78xx_setup_irq_domain() failed : -71 [ 732.966432][ T9] usb 5-1: Manufacturer: syz [ 732.976808][T19414] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 732.992470][T19414] lan78xx 6-1:1.0: probe with driver lan78xx failed with error -71 [ 733.002025][ T9] usb 5-1: SerialNumber: syz [ 733.009161][T20976] netlink: 'syz.1.4979': attribute type 1 has an invalid length. [ 733.018711][T19414] usb 6-1: USB disconnect, device number 96 [ 733.018996][ T9] usb 5-1: config 0 descriptor?? [ 733.041882][T20965] raw-gadget.2 gadget.4: fail, usb_ep_enable returned -22 [ 733.050965][ T9] cyberjack 5-1:0.69: Reiner SCT Cyberjack USB card reader converter detected [ 733.064880][ T9] usb 5-1: Reiner SCT Cyberjack USB card reader converter now attached to ttyUSB0 [ 733.499426][T20965] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 733.518219][T20965] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 733.535778][T19414] usb 5-1: USB disconnect, device number 17 [ 733.544197][T19414] cyberjack ttyUSB0: Reiner SCT Cyberjack USB card reader converter now disconnected from ttyUSB0 [ 733.559754][T19414] cyberjack 5-1:0.69: device disconnected [ 733.745732][T20984] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 733.854620][T20988] syzkaller1: entered promiscuous mode [ 733.879747][T20988] syzkaller1: entered allmulticast mode [ 734.201763][T21005] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 734.242175][T20995] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 734.248867][T21012] binder: BINDER_SET_CONTEXT_MGR already set [ 734.284750][T21012] binder: 21009:21012 ioctl 4018620d 2000000000c0 returned -16 [ 734.790363][T21032] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 734.790590][T21032] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 734.815264][T21032] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 734.815490][T21032] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 735.376969][T19414] usb 4-1: new full-speed USB device number 28 using dummy_hcd [ 735.424693][T21047] syzkaller0: entered promiscuous mode [ 735.432966][T21047] syzkaller0: entered allmulticast mode [ 735.527137][T19419] usb 6-1: new high-speed USB device number 97 using dummy_hcd [ 735.558359][T19414] usb 4-1: config 6 interface 0 has no altsetting 0 [ 735.586570][T19414] usb 4-1: New USB device found, idVendor=2063, idProduct=7200, bcdDevice= 3.9c [ 735.598019][T19414] usb 4-1: New USB device strings: Mfr=0, Product=178, SerialNumber=104 [ 735.607150][T19414] usb 4-1: Product: syz [ 735.613401][T19414] usb 4-1: SerialNumber: syz [ 735.662790][T21056] binder: BINDER_SET_CONTEXT_MGR already set [ 735.669161][T21056] binder: 21054:21056 ioctl 4018620d 200000000240 returned -16 [ 735.685173][T21056] binder: BINDER_SET_CONTEXT_MGR already set [ 735.694044][T21056] binder: 21054:21056 ioctl 4018620d 200000000040 returned -16 [ 735.702096][T19419] usb 6-1: Using ep0 maxpacket: 8 [ 735.708305][T21056] binder: 21054:21056 ioctl c0306201 200000000180 returned -14 [ 735.718283][T19419] usb 6-1: unable to get BOS descriptor or descriptor too short [ 735.727628][T19419] usb 6-1: config 0 has an invalid interface number: 122 but max is 0 [ 735.736147][T19419] usb 6-1: config 0 has no interface number 0 [ 735.762733][T19419] usb 6-1: config 0 interface 122 altsetting 187 endpoint 0x82 has invalid maxpacket 59391, setting to 1024 [ 735.797964][T19419] usb 6-1: config 0 interface 122 altsetting 187 has an endpoint descriptor with address 0x95, changing to 0x85 [ 735.840679][T19419] usb 6-1: config 0 interface 122 altsetting 187 endpoint 0x85 has invalid maxpacket 19271, setting to 1024 [ 735.878623][T19419] usb 6-1: config 0 interface 122 altsetting 187 bulk endpoint 0x85 has invalid maxpacket 1024 [ 735.894849][T19419] usb 6-1: config 0 interface 122 altsetting 187 endpoint 0x6 has invalid wMaxPacketSize 0 [ 735.908061][T19419] usb 6-1: config 0 interface 122 altsetting 187 bulk endpoint 0x6 has invalid maxpacket 0 [ 735.919226][T19419] usb 6-1: config 0 interface 122 has no altsetting 0 [ 735.933030][T19419] usb 6-1: New USB device found, idVendor=04b8, idProduct=0521, bcdDevice=15.4a [ 735.943234][T19419] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 735.955297][T19414] usb 4-1: USB disconnect, device number 28 [ 735.977198][T19419] usb 6-1: Product: syz [ 735.988363][T19419] usb 6-1: Manufacturer: syz [ 735.994695][T19419] usb 6-1: SerialNumber: syz [ 736.009908][T19419] usb 6-1: config 0 descriptor?? [ 736.015689][T21045] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 736.025331][T21045] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 736.240436][T21045] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 736.268712][T21045] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 736.297858][T21045] __nla_validate_parse: 1 callbacks suppressed [ 736.297875][T21045] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5005'. [ 736.357530][T19419] pl2303 6-1:0.122: pl2303 converter detected [ 736.372416][T19419] pl2303 6-1:0.122: pl2303_vendor_read - failed to read [8484]: -71 [ 736.407277][T19419] pl2303 6-1:0.122: pl2303_vendor_write - failed to write [0404]: -71 [ 736.437825][T19419] pl2303 6-1:0.122: pl2303_vendor_read - failed to read [8484]: -71 [ 736.468770][T21072] netlink: 32 bytes leftover after parsing attributes in process `syz.3.5015'. [ 736.487901][T19419] pl2303 6-1:0.122: pl2303_vendor_read - failed to read [8383]: -71 [ 736.507103][T19419] pl2303 6-1:0.122: pl2303_vendor_read - failed to read [8484]: -71 [ 736.542418][T19419] pl2303 6-1:0.122: pl2303_vendor_write - failed to write [0404]: -71 [ 736.573924][T19419] pl2303 6-1:0.122: pl2303_vendor_read - failed to read [8484]: -71 [ 736.601544][T19419] pl2303 6-1:0.122: pl2303_vendor_read - failed to read [8383]: -71 [ 736.628056][T19419] pl2303 6-1:0.122: pl2303_vendor_write - failed to write [0000]: -71 [ 736.656221][T19419] pl2303 6-1:0.122: pl2303_vendor_write - failed to write [0001]: -71 [ 736.684646][T19419] pl2303 6-1:0.122: pl2303_vendor_write - failed to write [0002]: -71 [ 736.709242][T19419] usb 6-1: pl2303 converter now attached to ttyUSB0 [ 736.738083][T19419] usb 6-1: USB disconnect, device number 97 [ 736.756263][T19419] pl2303 ttyUSB0: pl2303 converter now disconnected from ttyUSB0 [ 736.769898][T19419] pl2303 6-1:0.122: device disconnected [ 736.865720][T21077] tipc: Started in network mode [ 736.870952][T21077] tipc: Node identity aaaaaaaaaa1a, cluster identity 4711 [ 736.878310][T21077] tipc: Enabled bearer , priority 0 [ 737.153720][T21096] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 737.162504][T21096] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 737.181647][T21100] FAULT_INJECTION: forcing a failure. [ 737.181647][T21100] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 737.201690][T21100] CPU: 1 UID: 0 PID: 21100 Comm: syz.4.5027 Tainted: G L syzkaller #0 PREEMPT(full) [ 737.201709][T21100] Tainted: [L]=SOFTLOCKUP [ 737.201713][T21100] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 737.201719][T21100] Call Trace: [ 737.201723][T21100] [ 737.201728][T21100] dump_stack_lvl+0xe8/0x150 [ 737.201744][T21100] should_fail_ex+0x40c/0x560 [ 737.201756][T21100] _copy_from_user+0x2d/0xb0 [ 737.201770][T21100] kstrtouint_from_user+0xd6/0x180 [ 737.201780][T21100] ? __might_fault+0xaf/0x130 [ 737.201792][T21100] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 737.201803][T21100] ? __mutex_trylock_common+0x15f/0x270 [ 737.201814][T21100] ? vfs_write+0x22b/0xba0 [ 737.201826][T21100] ? rcu_is_watching+0x15/0xb0 [ 737.201836][T21100] proc_fail_nth_write+0x8e/0x210 [ 737.201848][T21100] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 737.201860][T21100] ? preempt_count_add+0x91/0x190 [ 737.201875][T21100] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 737.201886][T21100] vfs_write+0x296/0xba0 [ 737.201899][T21100] ? __pfx_vfs_write+0x10/0x10 [ 737.201912][T21100] ? __fget_files+0x3a2/0x420 [ 737.201922][T21100] ? __fget_files+0x2a/0x420 [ 737.201933][T21100] ksys_write+0x150/0x270 [ 737.201945][T21100] ? __pfx_ksys_write+0x10/0x10 [ 737.201957][T21100] ? rcu_is_watching+0x15/0xb0 [ 737.201967][T21100] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 737.201981][T21100] do_syscall_64+0x174/0x580 [ 737.201994][T21100] ? trace_irq_disable+0x3b/0x140 [ 737.202007][T21100] ? clear_bhb_loop+0x40/0x90 [ 737.202017][T21100] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 737.202026][T21100] RIP: 0033:0x7fa6a6d5d68e [ 737.202035][T21100] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 737.202043][T21100] RSP: 002b:00007fa6a7c1afe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 737.202055][T21100] RAX: ffffffffffffffda RBX: 00007fa6a7c1b6c0 RCX: 00007fa6a6d5d68e [ 737.202062][T21100] RDX: 0000000000000001 RSI: 00007fa6a7c1b0a0 RDI: 0000000000000005 [ 737.202068][T21100] RBP: 00007fa6a7c1b090 R08: 0000000000000000 R09: 0000000000000000 [ 737.202074][T21100] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 737.202080][T21100] R13: 00007fa6a7016038 R14: 00007fa6a7015fa0 R15: 00007fa6a713fa48 [ 737.202090][T21100] [ 737.716932][T19419] usb 5-1: new high-speed USB device number 18 using dummy_hcd [ 737.767027][ T9] usb 1-1: new full-speed USB device number 116 using dummy_hcd [ 737.866896][T19419] usb 5-1: Using ep0 maxpacket: 32 [ 737.873405][T19419] usb 5-1: config 4 has an invalid interface number: 228 but max is 0 [ 737.881947][T19419] usb 5-1: config 4 has no interface number 0 [ 737.888669][T19419] usb 5-1: too many endpoints for config 4 interface 228 altsetting 12: 129, using maximum allowed: 30 [ 737.900043][T19419] usb 5-1: config 4 interface 228 altsetting 12 endpoint 0x7 has invalid wMaxPacketSize 0 [ 737.910445][T19419] usb 5-1: config 4 interface 228 altsetting 12 bulk endpoint 0x7 has invalid maxpacket 0 [ 737.920476][T19419] usb 5-1: config 4 interface 228 altsetting 12 has 1 endpoint descriptor, different from the interface descriptor's value: 129 [ 737.933843][T19419] usb 5-1: config 4 interface 228 has no altsetting 0 [ 737.941823][ T9] usb 1-1: config 0 has an invalid interface number: 237 but max is 0 [ 737.950189][ T9] usb 1-1: config 0 has no interface number 0 [ 737.957864][ T9] usb 1-1: config 0 interface 237 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 10 [ 737.974914][ T9] usb 1-1: config 0 interface 237 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 737.985519][ T9] usb 1-1: config 0 interface 237 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 10 [ 737.997631][T19419] usb 5-1: New USB device found, idVendor=0499, idProduct=a9a2, bcdDevice=c4.e8 [ 737.999870][ T5695] tipc: Node number set to 11578026 [ 738.006704][T19419] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 738.006725][T19419] usb 5-1: Product: syz [ 738.006740][T19419] usb 5-1: Manufacturer: syz [ 738.032592][ T9] usb 1-1: config 0 interface 237 altsetting 0 endpoint 0x8A has invalid wMaxPacketSize 0 [ 738.042795][T19419] usb 5-1: SerialNumber: syz [ 738.049367][ T9] usb 1-1: New USB device found, idVendor=045e, idProduct=84bd, bcdDevice=89.b6 [ 738.058669][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 738.068118][ T9] usb 1-1: Product: syz [ 738.073811][ T9] usb 1-1: Manufacturer: syz [ 738.079264][ T9] usb 1-1: SerialNumber: syz [ 738.085891][ T9] usb 1-1: config 0 descriptor?? [ 738.096416][ T9] xpad 1-1:0.237: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 738.113100][ T9] input: Generic X-Box pad as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.237/input/input86 [ 738.240118][T21129] FAULT_INJECTION: forcing a failure. [ 738.240118][T21129] name failslab, interval 1, probability 0, space 0, times 0 [ 738.253338][T21129] CPU: 1 UID: 0 PID: 21129 Comm: syz.3.5039 Tainted: G L syzkaller #0 PREEMPT(full) [ 738.253366][T21129] Tainted: [L]=SOFTLOCKUP [ 738.253372][T21129] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 738.253382][T21129] Call Trace: [ 738.253389][T21129] [ 738.253396][T21129] dump_stack_lvl+0xe8/0x150 [ 738.253417][T21129] should_fail_ex+0x40c/0x560 [ 738.253432][T21129] should_failslab+0xa8/0x100 [ 738.253448][T21129] kmem_cache_alloc_node_noprof+0x8f/0x680 [ 738.253467][T21129] ? rcu_is_watching+0x15/0xb0 [ 738.253484][T21129] ? __alloc_skb+0x1d7/0x7a0 [ 738.253501][T21129] ? trace_irq_enable+0x3b/0x140 [ 738.253523][T21129] __alloc_skb+0x1d7/0x7a0 [ 738.253541][T21129] sock_wmalloc+0xb2/0x130 [ 738.253554][T21129] pppol2tp_sendmsg+0x17d/0x610 [ 738.253565][T21129] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 738.253577][T21129] ? __pfx_pppol2tp_sendmsg+0x10/0x10 [ 738.253587][T21129] ____sys_sendmsg+0x9b9/0xa20 [ 738.253604][T21129] ? __pfx_____sys_sendmsg+0x10/0x10 [ 738.253624][T21129] ? lock_release+0x4b/0x3c0 [ 738.253648][T21129] ? import_iovec+0x73/0xa0 [ 738.253668][T21129] ___sys_sendmsg+0x2a5/0x360 [ 738.253686][T21129] ? _parse_integer_limit+0x1ae/0x1f0 [ 738.253698][T21129] ? __pfx____sys_sendmsg+0x10/0x10 [ 738.253710][T21129] ? kstrtouint+0x6e/0xe0 [ 738.253729][T21129] ? rcu_is_watching+0x15/0xb0 [ 738.253738][T21129] ? lock_release+0x4b/0x3c0 [ 738.253756][T21129] ? __might_fault+0xcb/0x130 [ 738.253775][T21129] __sys_sendmmsg+0x273/0x4d0 [ 738.253800][T21129] ? __pfx___sys_sendmmsg+0x10/0x10 [ 738.253822][T21129] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 738.253845][T21129] ? ksys_write+0x242/0x270 [ 738.253860][T21129] ? __pfx_ksys_write+0x10/0x10 [ 738.253874][T21129] __x64_sys_sendmmsg+0xa0/0xc0 [ 738.253886][T21129] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 738.253895][T21129] do_syscall_64+0x174/0x580 [ 738.253910][T21129] ? trace_irq_disable+0x3b/0x140 [ 738.253930][T21129] ? clear_bhb_loop+0x40/0x90 [ 738.253947][T21129] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 738.253963][T21129] RIP: 0033:0x7f375639ce59 [ 738.253978][T21129] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 738.253993][T21129] RSP: 002b:00007f37571a1028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 738.254011][T21129] RAX: ffffffffffffffda RBX: 00007f3756615fa0 RCX: 00007f375639ce59 [ 738.254019][T21129] RDX: 0000000000034000 RSI: 0000200000004380 RDI: 0000000000000003 [ 738.254026][T21129] RBP: 00007f37571a1090 R08: 0000000000000000 R09: 0000000000000000 [ 738.254031][T21129] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 738.254037][T21129] R13: 00007f3756616038 R14: 00007f3756615fa0 R15: 00007f375673fa48 [ 738.254047][T21129] [ 738.550962][T19414] usb 1-1: USB disconnect, device number 116 [ 738.784596][ T29] audit: type=1800 audit(1781679938.134:1982): pid=21140 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.5042" name="SYSV00000000" dev="tmpfs" ino=4 res=0 errno=0 [ 739.058472][T19414] usb 4-1: new high-speed USB device number 29 using dummy_hcd [ 739.237059][T19414] usb 4-1: Using ep0 maxpacket: 16 [ 739.250084][T19414] usb 4-1: New USB device found, idVendor=0471, idProduct=030c, bcdDevice=ba.e9 [ 739.259812][T19414] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 739.277083][T19414] usb 4-1: Product: syz [ 739.285944][T19414] usb 4-1: Manufacturer: syz [ 739.295854][T19414] usb 4-1: SerialNumber: syz [ 739.312702][T19414] usb 4-1: config 0 descriptor?? [ 739.327796][T19414] pwc: Philips PCVC690K (Vesta Pro Scan) USB webcam detected. [ 739.527747][T21140] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 739.545093][T21140] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 740.076430][T19414] pwc: send_video_command error -71 [ 740.090165][T19414] pwc: Failed to set video mode VGA@30 fps; return code = -71 [ 740.101584][T19414] Philips webcam 4-1:0.0: probe with driver Philips webcam failed with error -71 [ 740.113162][T19414] usb 4-1: USB disconnect, device number 29 [ 740.200005][T21163] IPv6: addrconf: prefix option has invalid lifetime [ 740.300160][T21165] netlink: 108 bytes leftover after parsing attributes in process `syz.1.5051'. [ 740.456895][T19414] usb 4-1: new high-speed USB device number 30 using dummy_hcd [ 740.557822][T19419] usb 5-1: USB disconnect, device number 18 [ 740.609368][ T6077] udevd[6077]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:4.228/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 740.643539][T19414] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 740.660296][T19414] usb 4-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 740.683822][T19414] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 740.693371][T19414] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 740.709258][T21162] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 740.727577][T19414] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 740.809813][T21192] vxcan1: tx address claim with dlc 0 [ 740.877868][T21198] netlink: 108 bytes leftover after parsing attributes in process `syz.0.5063'. [ 740.932816][T21201] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5064'. [ 740.945232][T19414] usb 4-1: USB disconnect, device number 30 [ 740.985337][T21203] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5064'. [ 741.085020][T21206] netlink: 16 bytes leftover after parsing attributes in process `syz.0.5065'. [ 741.100406][T21207] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 741.117211][T21207] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 741.191093][T21211] syzkaller0: entered promiscuous mode [ 741.196643][T21211] syzkaller0: entered allmulticast mode [ 741.202405][ T5695] usb 6-1: new high-speed USB device number 98 using dummy_hcd [ 741.336961][ T5695] usb 6-1: device descriptor read/64, error -71 [ 741.457597][T19414] usb 4-1: new high-speed USB device number 31 using dummy_hcd [ 741.565262][T21225] syzkaller0: entered promiscuous mode [ 741.579693][ T5695] usb 6-1: new high-speed USB device number 99 using dummy_hcd [ 741.595313][T21225] syzkaller0: entered allmulticast mode [ 741.606968][T19414] usb 4-1: Using ep0 maxpacket: 16 [ 741.614776][T19414] usb 4-1: config 222 has an invalid interface number: 31 but max is 0 [ 741.624492][T19414] usb 4-1: config 222 has no interface number 0 [ 741.636365][T19414] usb 4-1: config 222 interface 31 altsetting 11 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 741.650323][T19414] usb 4-1: config 222 interface 31 altsetting 11 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 741.663813][T19414] usb 4-1: config 222 interface 31 altsetting 11 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 741.676087][T19414] usb 4-1: config 222 interface 31 has no altsetting 0 [ 741.690695][T19414] usb 4-1: New USB device found, idVendor=0f11, idProduct=2030, bcdDevice=a9.fd [ 741.704438][T21228] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 741.711691][T19414] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 741.719805][ T5695] usb 6-1: device descriptor read/64, error -71 [ 741.731355][T19414] usb 4-1: Product: syz [ 741.735646][T19414] usb 4-1: Manufacturer: syz [ 741.741365][T19414] usb 4-1: SerialNumber: syz [ 741.748738][T21162] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 741.811632][T21230] bond9: entered promiscuous mode [ 741.827587][ T5695] usb usb6-port1: attempt power cycle [ 741.834705][T21230] 8021q: adding VLAN 0 to HW filter on device bond9 [ 742.187027][ T5695] usb 6-1: new high-speed USB device number 100 using dummy_hcd [ 742.207885][ T5695] usb 6-1: device descriptor read/8, error -71 [ 742.446915][ T5695] usb 6-1: new high-speed USB device number 101 using dummy_hcd [ 742.480960][ T5695] usb 6-1: device descriptor read/8, error -71 [ 742.496118][T19414] ldusb 4-1:222.31: Interrupt out endpoint not found (using control endpoint instead) [ 742.515290][T19414] ldusb 4-1:222.31: LD USB Device #0 now attached to major 180 minor 0 [ 742.528161][T19414] usb 4-1: USB disconnect, device number 31 [ 742.551682][T19414] ldusb 4-1:222.31: LD USB Device #0 now disconnected [ 742.623073][ T5695] usb usb6-port1: unable to enumerate USB device [ 742.721224][T21246] syzkaller0: entered promiscuous mode [ 742.728350][T21246] syzkaller0: entered allmulticast mode [ 742.805385][T21251] netlink: 'syz.1.5081': attribute type 1 has an invalid length. [ 742.935279][T21262] program syz.3.5082 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 742.948534][T21262] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 743.031759][T21268] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 743.041476][T21268] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 743.228200][T21281] netlink: 16 bytes leftover after parsing attributes in process `syz.0.5089'. [ 743.276951][T19425] usb 4-1: new full-speed USB device number 32 using dummy_hcd [ 743.358888][T21290] binder: 21289:21290 ioctl c018620c 200000000000 returned -22 [ 743.448941][T19425] usb 4-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 743.454677][T21298] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 743.458375][T19425] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 743.497276][T19425] usb 4-1: config 0 descriptor?? [ 743.514096][T19425] cp210x 4-1:0.0: cp210x converter detected [ 743.564675][T21302] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 743.573798][T21302] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 743.712416][T19425] cp210x 4-1:0.0: failed to get vendor val 0x370b size 1: -121 [ 743.720234][T19425] cp210x 4-1:0.0: querying part number failed [ 743.729617][T19425] usb 4-1: cp210x converter now attached to ttyUSB0 [ 744.190416][T21326] FAULT_INJECTION: forcing a failure. [ 744.190416][T21326] name failslab, interval 1, probability 0, space 0, times 0 [ 744.204198][T21326] CPU: 1 UID: 0 PID: 21326 Comm: syz.4.5108 Tainted: G L syzkaller #0 PREEMPT(full) [ 744.204226][T21326] Tainted: [L]=SOFTLOCKUP [ 744.204233][T21326] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 744.204242][T21326] Call Trace: [ 744.204250][T21326] [ 744.204257][T21326] dump_stack_lvl+0xe8/0x150 [ 744.204279][T21326] should_fail_ex+0x40c/0x560 [ 744.204297][T21326] should_failslab+0xa8/0x100 [ 744.204319][T21326] ? mas_alloc_nodes+0x291/0x350 [ 744.204354][T21326] kmem_cache_alloc_noprof+0x87/0x650 [ 744.204375][T21326] mas_alloc_nodes+0x291/0x350 [ 744.204392][T21326] mas_preallocate+0x2cf/0x630 [ 744.204409][T21326] ? rcu_is_watching+0x15/0xb0 [ 744.204424][T21326] ? __pfx_mas_preallocate+0x10/0x10 [ 744.204445][T21326] ? anon_vma_name+0x61/0x210 [ 744.204466][T21326] ? __mas_set_range+0x11a/0x3a0 [ 744.204483][T21326] __split_vma+0x318/0xa50 [ 744.204503][T21326] ? __pfx___split_vma+0x10/0x10 [ 744.204524][T21326] ? can_vma_merge_left+0xed/0x340 [ 744.204547][T21326] vma_modify+0x93a/0x1c70 [ 744.204562][T21326] ? vma_modify+0x60/0x1c70 [ 744.204577][T21326] vma_modify_flags+0x24b/0x330 [ 744.204593][T21326] ? __pfx_vma_modify_flags+0x10/0x10 [ 744.204613][T21326] ? rcu_is_watching+0x15/0xb0 [ 744.204628][T21326] ? percpu_counter_add_batch+0xec/0x1d0 [ 744.204646][T21326] ? __vm_enough_memory+0x11a/0x380 [ 744.204663][T21326] mprotect_fixup+0x624/0xb10 [ 744.204686][T21326] ? __pfx_mprotect_fixup+0x10/0x10 [ 744.204706][T21326] ? mas_next_slot+0xc91/0xd70 [ 744.204730][T21326] ? apparmor_file_mprotect+0x1d0/0x400 [ 744.204749][T21326] ? security_file_mprotect+0x1a/0x290 [ 744.204772][T21326] do_mprotect_pkey+0x9d3/0xcd0 [ 744.204798][T21326] ? __pfx_do_mprotect_pkey+0x10/0x10 [ 744.204811][T21326] ? do_vmi_munmap+0x252/0x2d0 [ 744.204829][T21326] ? __pfx___vm_munmap+0x10/0x10 [ 744.204842][T21326] ? vm_mmap_pgoff+0x35a/0x4e0 [ 744.204860][T21326] ? rcu_is_watching+0x15/0xb0 [ 744.204878][T21326] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 744.204893][T21326] __x64_sys_mprotect+0x80/0x90 [ 744.204913][T21326] do_syscall_64+0x174/0x580 [ 744.204932][T21326] ? trace_irq_disable+0x3b/0x140 [ 744.204952][T21326] ? clear_bhb_loop+0x40/0x90 [ 744.204969][T21326] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 744.204984][T21326] RIP: 0033:0x7fa6a6d9cc57 [ 744.205000][T21326] Code: 89 38 eb 84 0f 1f 80 00 00 00 00 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 48 c7 c0 ff ff ff ff e9 7a ff ff ff b8 0a 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 744.205013][T21326] RSP: 002b:00007fa6a7c19d18 EFLAGS: 00000217 ORIG_RAX: 000000000000000a [ 744.205031][T21326] RAX: ffffffffffffffda RBX: 00007fa6a0000000 RCX: 00007fa6a6d9cc57 [ 744.205043][T21326] RDX: 0000000000000003 RSI: 0000000000021000 RDI: 00007fa6a0000000 [ 744.205053][T21326] RBP: 0000000000021000 R08: 00000000ffffffff R09: 0000000000000000 [ 744.205064][T21326] R10: 0000000000000022 R11: 0000000000000217 R12: 0000000004000000 [ 744.205074][T21326] R13: 0000000000001000 R14: 00007fa6a4000000 R15: 0000000003200000 [ 744.205091][T21326] [ 744.575592][T21336] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5111'. [ 744.811116][ T9] usb 6-1: new high-speed USB device number 102 using dummy_hcd [ 744.821389][T19419] usb 5-1: new high-speed USB device number 19 using dummy_hcd [ 744.866092][T21351] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 744.879353][T21351] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 744.986965][ T9] usb 6-1: Using ep0 maxpacket: 32 [ 744.993511][ T9] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 745.004431][T19419] usb 5-1: Using ep0 maxpacket: 32 [ 745.010945][T19419] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0xC has invalid maxpacket 8 [ 745.020953][T19419] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x2 has an invalid bInterval 54, changing to 9 [ 745.032355][ T9] usb 6-1: New USB device found, idVendor=0582, idProduct=0582, bcdDevice= 0.40 [ 745.041502][T19419] usb 5-1: config 1 interface 0 altsetting 0 has a duplicate endpoint with address 0x2, skipping [ 745.052151][ T9] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 745.060328][ T9] usb 6-1: Product: syz [ 745.064513][ T9] usb 6-1: Manufacturer: syz [ 745.069370][ T9] usb 6-1: SerialNumber: syz [ 745.075589][T19419] usb 5-1: New USB device found, idVendor=0763, idProduct=0150, bcdDevice= 0.40 [ 745.085535][T19419] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 745.093675][T19419] usb 5-1: Product: syz [ 745.098068][T19419] usb 5-1: Manufacturer: syz [ 745.102688][T19419] usb 5-1: SerialNumber: syz [ 745.111492][T21335] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 745.146885][T19425] usb 1-1: new high-speed USB device number 117 using dummy_hcd [ 745.296937][T19425] usb 1-1: Using ep0 maxpacket: 32 [ 745.303680][T19425] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 745.303888][T21334] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 745.315761][T19425] usb 1-1: New USB device found, idVendor=5543, idProduct=0042, bcdDevice= 0.00 [ 745.324617][T21334] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 745.333546][T19425] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 745.351171][T19425] usb 1-1: config 0 descriptor?? [ 745.371412][ T9] usb 6-1: BAAD HEADPHONE p_chmask mismatch [ 745.403700][ T9] snd-usb-audio 6-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 745.418776][ T9] usb 6-1: USB disconnect, device number 102 [ 745.431012][ T6077] udevd[6077]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 745.464911][T19419] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 745.480200][T19419] usb 5-1: MIDIStreaming interface descriptor not found [ 745.488398][T19419] usb 5-1: too many endpoints [ 745.525007][T19419] usb 5-1: USB disconnect, device number 19 [ 745.556075][ T5631] udevd[5631]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 745.572539][T21353] netlink: 64 bytes leftover after parsing attributes in process `syz.0.5117'. [ 745.612767][T21353] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5117'. [ 745.624460][T21357] netlink: 212348 bytes leftover after parsing attributes in process `syz.1.5119'. [ 745.723186][T21361] FAULT_INJECTION: forcing a failure. [ 745.723186][T21361] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 745.737932][T21361] CPU: 1 UID: 0 PID: 21361 Comm: syz.1.5121 Tainted: G L syzkaller #0 PREEMPT(full) [ 745.737968][T21361] Tainted: [L]=SOFTLOCKUP [ 745.737975][T21361] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 745.737985][T21361] Call Trace: [ 745.737992][T21361] [ 745.737999][T21361] dump_stack_lvl+0xe8/0x150 [ 745.738022][T21361] should_fail_ex+0x40c/0x560 [ 745.738043][T21361] _copy_from_user+0x2d/0xb0 [ 745.738064][T21361] ___sys_recvmsg+0x173/0x5a0 [ 745.738084][T21361] ? ktime_get_ts64+0xa9/0x410 [ 745.738107][T21361] ? __pfx____sys_recvmsg+0x10/0x10 [ 745.738125][T21361] ? rcu_is_watching+0x15/0xb0 [ 745.738141][T21361] ? ktime_get_ts64+0xa9/0x410 [ 745.738165][T21361] ? __pfx_set_normalized_timespec64+0x10/0x10 [ 745.738189][T21361] ? lock_release+0x4b/0x3c0 [ 745.738213][T21361] do_recvmmsg+0x31a/0x7f0 [ 745.738236][T21361] ? __pfx_do_recvmmsg+0x10/0x10 [ 745.738255][T21361] ? lock_release+0x4b/0x3c0 [ 745.738278][T21361] ? get_timespec64+0x119/0x1b0 [ 745.738292][T21361] ? __pfx_get_timespec64+0x10/0x10 [ 745.738304][T21361] ? rcu_is_watching+0x15/0xb0 [ 745.738319][T21361] ? trace_irq_enable+0x3b/0x140 [ 745.738340][T21361] __x64_sys_recvmmsg+0x1b7/0x250 [ 745.738360][T21361] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 745.738379][T21361] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 745.738398][T21361] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 745.738414][T21361] do_syscall_64+0x174/0x580 [ 745.738433][T21361] ? clear_bhb_loop+0x40/0x90 [ 745.738449][T21361] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 745.738463][T21361] RIP: 0033:0x7f9d7959ce59 [ 745.738478][T21361] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 745.738491][T21361] RSP: 002b:00007f9d7a37e028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 745.738508][T21361] RAX: ffffffffffffffda RBX: 00007f9d79815fa0 RCX: 00007f9d7959ce59 [ 745.738520][T21361] RDX: 04000000000003b4 RSI: 00002000000037c0 RDI: 0000000000000003 [ 745.738531][T21361] RBP: 00007f9d7a37e090 R08: 0000200000003700 R09: 0000000000000000 [ 745.738542][T21361] R10: 0000000000002000 R11: 0000000000000246 R12: 0000000000000002 [ 745.738553][T21361] R13: 00007f9d79816038 R14: 00007f9d79815fa0 R15: 00007f9d7993fa48 [ 745.738570][T21361] [ 745.994453][T19425] input: HID 5543:0042 Pen as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:5543:0042.0052/input/input87 [ 746.028104][T19425] input: HID 5543:0042 Mouse as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:5543:0042.0052/input/input88 [ 746.049869][T19425] uclogic 0003:5543:0042.0052: input,hidraw0: USB HID v7f.fd Mouse [HID 5543:0042] on usb-dummy_hcd.0-1/input0 [ 746.105917][ T9] usb 4-1: USB disconnect, device number 32 [ 746.114050][ T9] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 746.131054][ T9] cp210x 4-1:0.0: device disconnected [ 746.240856][T21353] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 746.269147][T21368] netlink: 24 bytes leftover after parsing attributes in process `syz.3.5123'. [ 746.269974][T21373] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 746.287073][T21353] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 746.296713][T21373] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 746.299629][T21368] netlink: 24 bytes leftover after parsing attributes in process `syz.3.5123'. [ 746.326186][T21373] sock: sock_set_timeout: `syz.1.5125' (pid 21373) tries to set negative timeout [ 746.349992][T21368] netlink: 24 bytes leftover after parsing attributes in process `syz.3.5123'. [ 746.361018][T21368] netlink: 24 bytes leftover after parsing attributes in process `syz.3.5123'. [ 746.372482][T21368] netlink: 24 bytes leftover after parsing attributes in process `syz.3.5123'. [ 746.385646][ T9] usb 1-1: USB disconnect, device number 117 [ 746.666964][T19419] usb 4-1: new low-speed USB device number 33 using dummy_hcd [ 746.816949][T19419] usb 4-1: Invalid ep0 maxpacket: 16 [ 746.947889][T19419] usb 4-1: new low-speed USB device number 34 using dummy_hcd [ 747.006238][T21404] Cannot find del_set index 8192 as target [ 747.086976][T19420] usb 5-1: new high-speed USB device number 20 using dummy_hcd [ 747.136909][T19419] usb 4-1: Invalid ep0 maxpacket: 16 [ 747.142471][T19419] usb usb4-port1: attempt power cycle [ 747.217041][T19420] usb 5-1: device descriptor read/64, error -71 [ 747.247595][T19425] usb 6-1: new high-speed USB device number 103 using dummy_hcd [ 747.268862][ T1328] ieee802154 phy0 wpan0: encryption failed: -22 [ 747.275224][ T1328] ieee802154 phy1 wpan1: encryption failed: -22 [ 747.436921][T19425] usb 6-1: Using ep0 maxpacket: 32 [ 747.443502][T19425] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 747.454825][T19425] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 747.464539][T19425] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0xC has invalid wMaxPacketSize 0 [ 747.474301][T19425] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xE8, changing to 0x88 [ 747.476941][T19420] usb 5-1: new high-speed USB device number 21 using dummy_hcd [ 747.486943][T19425] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x88 has an invalid bInterval 0, changing to 7 [ 747.493745][T19419] usb 4-1: new low-speed USB device number 35 using dummy_hcd [ 747.508686][T19425] usb 6-1: config 0 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 4 [ 747.527477][T19419] usb 4-1: Invalid ep0 maxpacket: 16 [ 747.537433][T19425] usb 6-1: New USB device found, idVendor=05e1, idProduct=0408, bcdDevice=25.11 [ 747.548163][T19425] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=7 [ 747.556195][T19425] usb 6-1: Product: syz [ 747.560757][T19425] usb 6-1: Manufacturer: syz [ 747.566770][T19425] usb 6-1: SerialNumber: syz [ 747.575310][T19425] usb 6-1: config 0 descriptor?? [ 747.585906][T19425] usb 6-1: no audio or video endpoints found [ 747.636905][T19420] usb 5-1: device descriptor read/64, error -71 [ 747.657307][T19419] usb 4-1: new low-speed USB device number 36 using dummy_hcd [ 747.687346][T19419] usb 4-1: Invalid ep0 maxpacket: 16 [ 747.699900][T19419] usb usb4-port1: unable to enumerate USB device [ 747.722141][T21429] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 747.751026][T19420] usb usb5-port1: attempt power cycle [ 747.797149][T19409] usb 1-1: new high-speed USB device number 118 using dummy_hcd [ 747.833824][T19425] usb 6-1: USB disconnect, device number 103 [ 747.956971][T19409] usb 1-1: Using ep0 maxpacket: 32 [ 747.963504][T19409] usb 1-1: config index 0 descriptor too short (expected 29220, got 36) [ 747.972080][T19409] usb 1-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 747.981085][T19409] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 747.990470][T19409] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 748.001437][T19409] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 748.012136][T19409] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 748.026691][T19409] usb 1-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 748.037971][T19409] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 748.056528][T21437] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(7) [ 748.063077][T21437] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 748.072402][T19409] usb 1-1: config 0 descriptor?? [ 748.083386][T21437] vhci_hcd vhci_hcd.0: Device attached [ 748.137074][T19420] usb 5-1: new high-speed USB device number 22 using dummy_hcd [ 748.157633][T19420] usb 5-1: device descriptor read/8, error -71 [ 748.285472][T19409] usblp 1-1:0.0: usblp0: USB Bidirectional printer dev 118 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 748.313695][T19409] usb 1-1: USB disconnect, device number 118 [ 748.324015][T19409] usblp0: removed [ 748.357030][T19425] usb 36-1: SetAddress Request (6) to port 0 [ 748.365530][T19425] usb 36-1: new SuperSpeed USB device number 6 using vhci_hcd [ 748.406940][T19420] usb 5-1: new high-speed USB device number 23 using dummy_hcd [ 748.427388][T19420] usb 5-1: device descriptor read/8, error -71 [ 748.466958][ C0] af_packet: tpacket_rcv: packet too big, clamped from 70 to 4294967286. macoff=82 [ 748.490095][T21445] xt_hashlimit: size too large, truncated to 1048576 [ 748.537085][T19420] usb usb5-port1: unable to enumerate USB device [ 748.960036][ T29] audit: type=1326 audit(1781679948.314:1983): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21451 comm="syz.0.5152" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2d2259ce59 code=0x7ffc0000 [ 748.988003][ T29] audit: type=1326 audit(1781679948.314:1984): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21451 comm="syz.0.5152" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2d2259ce59 code=0x7ffc0000 [ 749.014552][ T29] audit: type=1326 audit(1781679948.314:1985): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21451 comm="syz.0.5152" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=470 compat=0 ip=0x7f2d2259ce59 code=0x7ffc0000 [ 749.041252][ T29] audit: type=1326 audit(1781679948.314:1986): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21451 comm="syz.0.5152" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2d2259ce59 code=0x7ffc0000 [ 749.067294][ T29] audit: type=1326 audit(1781679948.314:1987): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21451 comm="syz.0.5152" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2d2259ce59 code=0x7ffc0000 [ 749.215765][T21438] vhci_hcd: connection reset by peer [ 749.230865][ T13] vhci_hcd vhci_hcd.1: stop threads [ 749.247849][ T13] vhci_hcd vhci_hcd.1: release socket [ 749.260904][ T13] vhci_hcd vhci_hcd.1: disconnect device [ 749.352466][T21466] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 749.366566][T21466] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 749.471179][T21471] __nla_validate_parse: 29 callbacks suppressed [ 749.471196][T21471] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5160'. [ 749.494931][ T13] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 749.511919][ T13] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 749.530459][ T13] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 749.544683][ T13] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 749.618353][ T29] audit: type=1326 audit(1781679948.964:1988): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21477 comm="syz.5.5163" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f15db19ce59 code=0x7ffc0000 [ 749.678532][ T29] audit: type=1326 audit(1781679948.974:1989): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21477 comm="syz.5.5163" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f15db19ce59 code=0x7ffc0000 [ 749.703479][ T29] audit: type=1326 audit(1781679948.974:1990): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21477 comm="syz.5.5163" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=470 compat=0 ip=0x7f15db19ce59 code=0x7ffc0000 [ 749.729113][ T29] audit: type=1326 audit(1781679948.974:1991): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21477 comm="syz.5.5163" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f15db19ce59 code=0x7ffc0000 [ 749.756083][ T29] audit: type=1326 audit(1781679948.974:1992): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21477 comm="syz.5.5163" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f15db19ce59 code=0x7ffc0000 [ 749.994767][T21496] fuse: Bad value for 'fd' [ 750.183838][T21514] FAULT_INJECTION: forcing a failure. [ 750.183838][T21514] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 750.198745][T21514] CPU: 1 UID: 0 PID: 21514 Comm: syz.5.5176 Tainted: G L syzkaller #0 PREEMPT(full) [ 750.198773][T21514] Tainted: [L]=SOFTLOCKUP [ 750.198778][T21514] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 750.198788][T21514] Call Trace: [ 750.198794][T21514] [ 750.198801][T21514] dump_stack_lvl+0xe8/0x150 [ 750.198822][T21514] should_fail_ex+0x40c/0x560 [ 750.198840][T21514] _copy_from_user+0x2d/0xb0 [ 750.198862][T21514] ___sys_sendmsg+0x1c6/0x360 [ 750.198882][T21514] ? rcu_is_watching+0x15/0xb0 [ 750.198898][T21514] ? get_pid_task+0x20/0x1f0 [ 750.198914][T21514] ? __pfx____sys_sendmsg+0x10/0x10 [ 750.198933][T21514] ? rcu_is_watching+0x15/0xb0 [ 750.198956][T21514] ? __fget_files+0x2a/0x420 [ 750.198973][T21514] ? __fget_files+0x3a2/0x420 [ 750.198993][T21514] __x64_sys_sendmsg+0x1b1/0x290 [ 750.199013][T21514] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 750.199037][T21514] ? rcu_is_watching+0x15/0xb0 [ 750.199052][T21514] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 750.199068][T21514] do_syscall_64+0x174/0x580 [ 750.199086][T21514] ? trace_irq_disable+0x3b/0x140 [ 750.199107][T21514] ? clear_bhb_loop+0x40/0x90 [ 750.199124][T21514] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 750.199139][T21514] RIP: 0033:0x7f15db19ce59 [ 750.199154][T21514] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 750.199167][T21514] RSP: 002b:00007f15dc0f1028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 750.199185][T21514] RAX: ffffffffffffffda RBX: 00007f15db415fa0 RCX: 00007f15db19ce59 [ 750.199196][T21514] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 750.199206][T21514] RBP: 00007f15dc0f1090 R08: 0000000000000000 R09: 0000000000000000 [ 750.199215][T21514] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 750.199224][T21514] R13: 00007f15db416038 R14: 00007f15db415fa0 R15: 00007f15db53fa48 [ 750.199239][T21514] [ 750.788065][T19420] usb 6-1: new high-speed USB device number 104 using dummy_hcd [ 750.815314][T21536] FAULT_INJECTION: forcing a failure. [ 750.815314][T21536] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 750.860086][T21537] raw_sendmsg: syz.0.5182 forgot to set AF_INET. Fix it! [ 750.909902][T21536] CPU: 1 UID: 0 PID: 21536 Comm: syz.4.5183 Tainted: G L syzkaller #0 PREEMPT(full) [ 750.909930][T21536] Tainted: [L]=SOFTLOCKUP [ 750.909936][T21536] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 750.909947][T21536] Call Trace: [ 750.909954][T21536] [ 750.909961][T21536] dump_stack_lvl+0xe8/0x150 [ 750.909987][T21536] should_fail_ex+0x40c/0x560 [ 750.910010][T21536] _copy_from_user+0x2d/0xb0 [ 750.910036][T21536] copy_from_sockptr_offset+0x66/0xa0 [ 750.910062][T21536] do_tcp_getsockopt+0x1d62/0x2980 [ 750.910087][T21536] ? __pfx_do_tcp_getsockopt+0x10/0x10 [ 750.910108][T21536] ? sock_recv_errqueue+0x570/0x5e0 [ 750.910127][T21536] ? rcu_is_watching+0x15/0xb0 [ 750.910146][T21536] ? rcu_is_watching+0x15/0xb0 [ 750.910162][T21536] ? aa_label_sk_perm+0x532/0x6e0 [ 750.910187][T21536] ? lock_release+0x4b/0x3c0 [ 750.910211][T21536] ? arch_stack_walk+0xfb/0x150 [ 750.910233][T21536] ? __might_fault+0xaf/0x130 [ 750.910257][T21536] ? __pfx_aa_label_sk_perm+0x10/0x10 [ 750.910279][T21536] ? lock_acquire+0x5f/0x350 [ 750.910311][T21536] ? aa_file_perm+0x18b/0x15f0 [ 750.910328][T21536] ? _parse_integer_limit+0x1ae/0x1f0 [ 750.910350][T21536] ? kstrtoull+0x12f/0x1d0 [ 750.910368][T21536] ? kstrtouint+0x6e/0xe0 [ 750.910386][T21536] ? get_pid_task+0x20/0x1f0 [ 750.910402][T21536] ? rcu_is_watching+0x15/0xb0 [ 750.910416][T21536] ? get_pid_task+0x20/0x1f0 [ 750.910432][T21536] ? aa_sk_perm+0x6d5/0x900 [ 750.910455][T21536] ? rcu_is_watching+0x15/0xb0 [ 750.910470][T21536] ? __pfx_sock_common_getsockopt+0x10/0x10 [ 750.910486][T21536] tcp_getsockopt+0x83/0x130 [ 750.910504][T21536] ? sock_recv_errqueue+0x570/0x5e0 [ 750.910519][T21536] ? sock_recv_errqueue+0x570/0x5e0 [ 750.910540][T21536] ? __pfx_sock_common_getsockopt+0x10/0x10 [ 750.910556][T21536] do_sock_getsockopt+0x51d/0x7e0 [ 750.910579][T21536] ? __pfx_vfs_write+0x10/0x10 [ 750.910601][T21536] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 750.910622][T21536] ? do_sys_openat2+0x14e/0x200 [ 750.910640][T21536] ? kmem_cache_free+0x182/0x650 [ 750.910661][T21536] ? fd_install+0x94/0x3d0 [ 750.910686][T21536] ? ksys_write+0x1fc/0x270 [ 750.910709][T21536] __x64_sys_getsockopt+0x1a4/0x240 [ 750.910732][T21536] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 750.910750][T21536] do_syscall_64+0x174/0x580 [ 750.910773][T21536] ? clear_bhb_loop+0x40/0x90 [ 750.910793][T21536] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 750.910809][T21536] RIP: 0033:0x7fa6a6d9ce59 [ 750.910825][T21536] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 750.910841][T21536] RSP: 002b:00007fa6a7c1b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 750.910862][T21536] RAX: ffffffffffffffda RBX: 00007fa6a7015fa0 RCX: 00007fa6a6d9ce59 [ 750.910874][T21536] RDX: 0000000000000023 RSI: 0000000000000006 RDI: 0000000000000003 [ 750.910883][T21536] RBP: 00007fa6a7c1b090 R08: 0000200000002100 R09: 0000000000000000 [ 750.910893][T21536] R10: 00002000000020c0 R11: 0000000000000246 R12: 0000000000000001 [ 750.910902][T21536] R13: 00007fa6a7016038 R14: 00007fa6a7015fa0 R15: 00007fa6a713fa48 [ 750.910921][T21536] [ 751.276951][T19420] usb 6-1: Using ep0 maxpacket: 16 [ 751.609020][T19420] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 11 [ 751.624782][T19420] usb 6-1: config 1 interface 0 altsetting 3 endpoint 0xB has invalid wMaxPacketSize 0 [ 751.667857][T19420] usb 6-1: config 1 interface 0 altsetting 3 bulk endpoint 0xB has invalid maxpacket 0 [ 751.689643][T19420] usb 6-1: config 1 interface 0 altsetting 3 endpoint 0x8A has invalid wMaxPacketSize 0 [ 751.704379][T19420] usb 6-1: config 1 interface 0 altsetting 3 bulk endpoint 0x8A has invalid maxpacket 0 [ 751.729297][T19420] usb 6-1: config 1 interface 0 has no altsetting 0 [ 751.738876][T19420] usb 6-1: New USB device found, idVendor=04e6, idProduct=0003, bcdDevice= 1.77 [ 751.748630][T19420] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 751.792397][T19420] ums-sddr09 6-1:1.0: USB Mass Storage device detected [ 751.845773][T21551] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 751.855624][T21551] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 751.877608][T21556] binder: 21554:21556 ioctl c0306201 200000000080 returned -14 [ 751.887678][T21556] binder: 21554:21556 ioctl c0306201 2000000003c0 returned -14 [ 751.924770][T21551] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 751.943289][T21551] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 751.955785][T21551] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 751.965377][T21551] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 751.994337][T19420] scsi host1: usb-storage 6-1:1.0 [ 752.006882][ T9] usb 5-1: new high-speed USB device number 24 using dummy_hcd [ 752.158192][ T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 249, changing to 11 [ 752.186847][ T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 752.202342][T21522] netlink: 9 bytes leftover after parsing attributes in process `syz.5.5178'. [ 752.213205][ T9] usb 5-1: New USB device found, idVendor=1e71, idProduct=200f, bcdDevice= 0.00 [ 752.230630][T21522] gretap0: entered promiscuous mode [ 752.239304][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 752.264779][ T9] usb 5-1: config 0 descriptor?? [ 752.416041][T19414] usb 6-1: USB disconnect, device number 104 [ 752.587988][T21570] netlink: 'syz.4.5188': attribute type 4 has an invalid length. [ 752.679553][T21577] netlink: 'syz.4.5188': attribute type 4 has an invalid length. [ 753.175167][T21590] netlink: 620 bytes leftover after parsing attributes in process `syz.1.5198'. [ 753.255111][T21593] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 753.279252][T21593] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 753.431341][T19425] usb 36-1: device descriptor read/8, error -110 [ 753.479321][T21597] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 753.496881][T21597] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 753.541981][ T9] usbhid 5-1:0.0: can't add hid device: -71 [ 753.553744][ T9] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 753.565717][ T9] usb 5-1: USB disconnect, device number 24 [ 753.655876][T21611] netlink: 'syz.0.5204': attribute type 1 has an invalid length. [ 753.672687][T21611] 8021q: adding VLAN 0 to HW filter on device bond1 [ 753.694645][T21611] bond1: (slave syz_tun): Enslaving as a backup interface with an up link [ 753.753727][T21616] netlink: 'syz.0.5206': attribute type 2 has an invalid length. [ 753.770454][T21616] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5206'. [ 753.847730][T19425] usb usb36-port1: attempt power cycle [ 754.086733][T21636] input: syz1 as /devices/virtual/input/input89 [ 754.132945][ T5615] udevd[5615]: setting mode of /dev/input/event4 to 020660 failed: No such file or directory [ 754.165974][ T5615] udevd[5615]: setting owner of /dev/input/event4 to uid=0, gid=104 failed: No such file or directory [ 754.427529][T19425] usb usb36-port1: unable to enumerate USB device [ 754.466930][T19409] usb 1-1: new high-speed USB device number 119 using dummy_hcd [ 754.664983][T21659] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 754.677808][T19409] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 754.678089][T21659] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 754.723424][T19409] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 754.760621][T19409] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 754.785109][T19425] usb 4-1: new high-speed USB device number 37 using dummy_hcd [ 754.815780][T19409] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 754.844325][T19409] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 754.864124][T19409] usb 1-1: config 0 descriptor?? [ 754.921524][T21659] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 754.946766][T21659] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 754.956919][T19425] usb 4-1: Using ep0 maxpacket: 32 [ 754.969087][T19425] usb 4-1: New USB device found, idVendor=0ac8, idProduct=0321, bcdDevice=6f.be [ 754.988998][T19425] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 755.007458][T19425] usb 4-1: config 0 descriptor?? [ 755.016692][T19425] gspca_main: vc032x-2.14.0 probing 0ac8:0321 [ 755.083312][T21668] netlink: 136 bytes leftover after parsing attributes in process `syz.4.5224'. [ 755.092450][T21668] A link change request failed with some changes committed already. Interface erspan0 may have been left with an inconsistent configuration, please check. [ 755.111133][T21668] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5224'. [ 755.120385][T21668] netlink: 24 bytes leftover after parsing attributes in process `syz.4.5224'. [ 755.288741][T19409] plantronics 0003:047F:FFFF.0053: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 755.406991][T19420] usb 5-1: new high-speed USB device number 25 using dummy_hcd [ 755.417001][T19425] gspca_vc032x: reg_w err -71 [ 755.424375][T19425] gspca_vc032x: I2c Bus Busy Wait 00 [ 755.430353][T19425] gspca_vc032x: I2c Bus Busy Wait 00 [ 755.435804][T19425] gspca_vc032x: I2c Bus Busy Wait 00 [ 755.447414][T19425] gspca_vc032x: I2c Bus Busy Wait 00 [ 755.453973][T19425] gspca_vc032x: I2c Bus Busy Wait 00 [ 755.460025][T19425] gspca_vc032x: I2c Bus Busy Wait 00 [ 755.465427][T19425] gspca_vc032x: I2c Bus Busy Wait 00 [ 755.471227][T19425] gspca_vc032x: I2c Bus Busy Wait 00 [ 755.479109][T19425] gspca_vc032x: I2c Bus Busy Wait 00 [ 755.484521][T19425] gspca_vc032x: I2c Bus Busy Wait 00 [ 755.492243][T19425] gspca_vc032x: I2c Bus Busy Wait 00 [ 755.498102][T19425] gspca_vc032x: I2c Bus Busy Wait 00 [ 755.503401][T19425] gspca_vc032x: I2c Bus Busy Wait 00 [ 755.510314][T19425] gspca_vc032x: I2c Bus Busy Wait 00 [ 755.515625][T19425] gspca_vc032x: I2c Bus Busy Wait 00 [ 755.521012][T19425] gspca_vc032x: I2c Bus Busy Wait 00 [ 755.526303][T19425] gspca_vc032x: I2c Bus Busy Wait 00 [ 755.531715][T19425] gspca_vc032x: I2c Bus Busy Wait 00 [ 755.537072][T19425] gspca_vc032x: Unknown sensor... [ 755.542196][T19425] vc032x 4-1:0.0: probe with driver vc032x failed with error -22 [ 755.555077][T19425] usb 4-1: USB disconnect, device number 37 [ 755.566974][T19420] usb 5-1: Using ep0 maxpacket: 8 [ 755.578166][T19420] usb 5-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 755.593354][T19420] usb 5-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 755.626919][T21643] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 755.651052][T19420] usb 5-1: config 0 interface 0 has no altsetting 0 [ 755.659889][T21643] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 755.671589][T19420] usb 5-1: New USB device found, idVendor=046a, idProduct=0023, bcdDevice= 0.00 [ 755.683158][T19420] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 755.696101][T19420] usb 5-1: config 0 descriptor?? [ 755.842815][T21682] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 755.860454][T21682] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 755.973592][T21684] FAULT_INJECTION: forcing a failure. [ 755.973592][T21684] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 755.986951][ T9] usb 6-1: new high-speed USB device number 105 using dummy_hcd [ 756.014054][T21684] CPU: 1 UID: 0 PID: 21684 Comm: syz.3.5229 Tainted: G L syzkaller #0 PREEMPT(full) [ 756.014083][T21684] Tainted: [L]=SOFTLOCKUP [ 756.014089][T21684] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 756.014099][T21684] Call Trace: [ 756.014107][T21684] [ 756.014117][T21684] dump_stack_lvl+0xe8/0x150 [ 756.014140][T21684] should_fail_ex+0x40c/0x560 [ 756.014160][T21684] _copy_to_user+0x31/0xb0 [ 756.014180][T21684] simple_read_from_buffer+0xe1/0x170 [ 756.014193][T21684] proc_fail_nth_read+0x1bb/0x230 [ 756.014211][T21684] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 756.014223][T21684] ? rw_verify_area+0x24a/0x4c0 [ 756.014239][T21684] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 756.014256][T21684] vfs_read+0x213/0xa80 [ 756.014275][T21684] ? rcu_is_watching+0x15/0xb0 [ 756.014293][T21684] ? __pfx___mutex_lock+0x10/0x10 [ 756.014318][T21684] ? __pfx_vfs_read+0x10/0x10 [ 756.014336][T21684] ? __fget_files+0x3a2/0x420 [ 756.014346][T21684] ? __fget_files+0x2a/0x420 [ 756.014357][T21684] ksys_read+0x150/0x270 [ 756.014369][T21684] ? __pfx_ksys_read+0x10/0x10 [ 756.014381][T21684] ? rcu_is_watching+0x15/0xb0 [ 756.014391][T21684] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 756.014408][T21684] do_syscall_64+0x174/0x580 [ 756.014427][T21684] ? trace_irq_disable+0x3b/0x140 [ 756.014448][T21684] ? clear_bhb_loop+0x40/0x90 [ 756.014466][T21684] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 756.014480][T21684] RIP: 0033:0x7f375635d68e [ 756.014491][T21684] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 756.014499][T21684] RSP: 002b:00007f37571a0fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 756.014510][T21684] RAX: ffffffffffffffda RBX: 00007f37571a16c0 RCX: 00007f375635d68e [ 756.014517][T21684] RDX: 000000000000000f RSI: 00007f37571a10a0 RDI: 0000000000000004 [ 756.014523][T21684] RBP: 00007f37571a1090 R08: 0000000000000000 R09: 0000000000000000 [ 756.014529][T21684] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 756.014534][T21684] R13: 00007f3756616038 R14: 00007f3756615fa0 R15: 00007f375673fa48 [ 756.014551][T21684] [ 756.227296][ T9] usb 6-1: Using ep0 maxpacket: 8 [ 756.253350][ T9] usb 6-1: New USB device found, idVendor=110a, idProduct=1450, bcdDevice=62.cb [ 756.266007][ T9] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 756.282252][ T9] usb 6-1: Product: syz [ 756.296946][ T9] usb 6-1: Manufacturer: syz [ 756.304794][ T9] usb 6-1: SerialNumber: syz [ 756.441724][T19420] usbhid 5-1:0.0: can't add hid device: -71 [ 756.465393][T19420] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 756.480018][T19420] usb 5-1: USB disconnect, device number 25 [ 756.593065][T21695] Cannot find map_set index 4 as target [ 756.732616][ T9] mxuport 6-1:254.0: mxuport_recv_ctrl_urb - short read (0 / 4) [ 756.750803][ T9] mxuport 6-1:254.0: probe with driver mxuport failed with error -5 [ 757.059061][T21702] netlink: 40 bytes leftover after parsing attributes in process `syz.4.5236'. [ 757.287560][ T5708] usb 1-1: USB disconnect, device number 119 [ 757.309274][T21711] netlink: 20 bytes leftover after parsing attributes in process `syz.4.5236'. [ 757.713753][T21722] netlink: 'syz.3.5244': attribute type 153 has an invalid length. [ 757.753742][T21725] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 757.765181][T21724] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 757.774838][T21725] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 757.785870][T21724] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 757.787063][T21728] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5246'. [ 757.805036][T21724] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 757.820053][T21724] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 757.842595][T21724] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 757.862033][T21724] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 758.147776][T19409] usb 5-1: new high-speed USB device number 26 using dummy_hcd [ 758.206916][T19425] usb 1-1: new full-speed USB device number 120 using dummy_hcd [ 758.326873][T19409] usb 5-1: Using ep0 maxpacket: 16 [ 758.337866][T19409] usb 5-1: config index 0 descriptor too short (expected 1024, got 27) [ 758.361197][T19409] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 758.374212][T19425] usb 1-1: device descriptor read/64, error -71 [ 758.402174][T19409] usb 5-1: config 0 has no interfaces? [ 758.421216][T19409] usb 5-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 758.444434][T19409] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 758.473904][T19409] usb 5-1: Product: syz [ 758.488354][T19409] usb 5-1: Manufacturer: syz [ 758.505905][T19409] usb 5-1: SerialNumber: syz [ 758.538677][T19409] usb 5-1: config 0 descriptor?? [ 758.588044][ T5708] usb 6-1: USB disconnect, device number 105 [ 758.626937][T19425] usb 1-1: new full-speed USB device number 121 using dummy_hcd [ 758.775138][T19409] usb 5-1: USB disconnect, device number 26 [ 758.813741][T19425] usb 1-1: device descriptor read/64, error -71 [ 758.919672][T21752] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 758.977159][T19425] usb usb1-port1: attempt power cycle [ 759.243611][T21771] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 759.277302][T21771] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 759.316857][T19425] usb 1-1: new full-speed USB device number 122 using dummy_hcd [ 759.357904][T19425] usb 1-1: device descriptor read/8, error -71 [ 759.506050][T21774] netlink: 24 bytes leftover after parsing attributes in process `syz.4.5260'. [ 759.626879][T19425] usb 1-1: new full-speed USB device number 123 using dummy_hcd [ 759.657342][T19425] usb 1-1: device descriptor read/8, error -71 [ 759.777128][T19425] usb usb1-port1: unable to enumerate USB device [ 760.107054][ T5708] usb 5-1: new high-speed USB device number 27 using dummy_hcd [ 760.267020][ T5708] usb 5-1: Using ep0 maxpacket: 8 [ 760.274712][ T5708] usb 5-1: unable to get BOS descriptor or descriptor too short [ 760.284247][ T5708] usb 5-1: config 4 has an invalid interface number: 163 but max is 0 [ 760.293949][ T5708] usb 5-1: config 4 has no interface number 0 [ 760.300455][ T5708] usb 5-1: config 4 interface 163 has no altsetting 0 [ 760.310219][ T5708] usb 5-1: New USB device found, idVendor=106c, idProduct=caa3, bcdDevice=49.b0 [ 760.319891][ T5708] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 760.328537][ T5708] usb 5-1: Product: syz [ 760.332960][ T5708] usb 5-1: Manufacturer: syz [ 760.339047][ T5708] usb 5-1: SerialNumber: syz [ 760.468590][T21782] netlink: 40 bytes leftover after parsing attributes in process `syz.3.5263'. [ 760.679776][ T5708] qmi_wwan 5-1:4.163: bogus CDC Union: master=0, slave=0 [ 760.697190][ T5708] qmi_wwan 5-1:4.163: probe with driver qmi_wwan failed with error -22 [ 760.711732][ T5708] usb 5-1: USB disconnect, device number 27 [ 760.726978][T19425] usb 6-1: new high-speed USB device number 106 using dummy_hcd [ 760.889694][T19425] usb 6-1: config 0 has no interfaces? [ 760.904645][T19425] usb 6-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 760.926917][T19425] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 760.948297][T19425] usb 6-1: config 0 descriptor?? [ 761.175816][ T5708] usb 6-1: USB disconnect, device number 106 [ 761.616928][ T5708] usb 6-1: new high-speed USB device number 107 using dummy_hcd [ 761.646053][T21800] dvmrp8: entered allmulticast mode [ 761.721482][ T29] kauditd_printk_skb: 5 callbacks suppressed [ 761.721499][ T29] audit: type=1800 audit(1781679961.074:1998): pid=21792 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.5267" name="/" dev="fuse" ino=4 res=0 errno=0 [ 761.795921][ T5708] usb 6-1: config 0 has no interfaces? [ 761.816367][ T5708] usb 6-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 761.840760][ T5708] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 761.912281][ T5708] usb 6-1: config 0 descriptor?? [ 761.945996][T21807] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 762.016522][T21809] netlink: 'syz.3.5273': attribute type 12 has an invalid length. [ 762.033844][T21809] netlink: 'syz.3.5273': attribute type 29 has an invalid length. [ 762.049351][T21809] netlink: 148 bytes leftover after parsing attributes in process `syz.3.5273'. [ 762.067778][T21809] netlink: 59 bytes leftover after parsing attributes in process `syz.3.5273'. [ 762.514791][T21838] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5284'. [ 762.524264][T21838] netlink: 20 bytes leftover after parsing attributes in process `syz.3.5284'. [ 762.549500][T21840] FAULT_INJECTION: forcing a failure. [ 762.549500][T21840] name failslab, interval 1, probability 0, space 0, times 0 [ 762.564051][T21840] CPU: 1 UID: 0 PID: 21840 Comm: syz.0.5285 Tainted: G L syzkaller #0 PREEMPT(full) [ 762.564078][T21840] Tainted: [L]=SOFTLOCKUP [ 762.564084][T21840] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 762.564093][T21840] Call Trace: [ 762.564098][T21840] [ 762.564106][T21840] dump_stack_lvl+0xe8/0x150 [ 762.564128][T21840] should_fail_ex+0x40c/0x560 [ 762.564146][T21840] should_failslab+0xa8/0x100 [ 762.564167][T21840] kmem_cache_alloc_node_noprof+0x8f/0x680 [ 762.564186][T21840] ? rcu_is_watching+0x15/0xb0 [ 762.564202][T21840] ? __alloc_skb+0x1d7/0x7a0 [ 762.564219][T21840] ? trace_irq_enable+0x3b/0x140 [ 762.564239][T21840] __alloc_skb+0x1d7/0x7a0 [ 762.564257][T21840] netlink_sendmsg+0x5d4/0xb40 [ 762.564279][T21840] ? __pfx_netlink_sendmsg+0x10/0x10 [ 762.564293][T21840] ? aa_sock_msg_perm+0xf1/0x1b0 [ 762.564302][T21840] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 762.564314][T21840] ? __pfx_netlink_sendmsg+0x10/0x10 [ 762.564325][T21840] ____sys_sendmsg+0x9b9/0xa20 [ 762.564339][T21840] ? __pfx_____sys_sendmsg+0x10/0x10 [ 762.564351][T21840] ? lock_release+0x4b/0x3c0 [ 762.564366][T21840] ? import_iovec+0x73/0xa0 [ 762.564379][T21840] ___sys_sendmsg+0x2a5/0x360 [ 762.564391][T21840] ? rcu_is_watching+0x15/0xb0 [ 762.564399][T21840] ? get_pid_task+0x20/0x1f0 [ 762.564408][T21840] ? __pfx____sys_sendmsg+0x10/0x10 [ 762.564420][T21840] ? rcu_is_watching+0x15/0xb0 [ 762.564434][T21840] ? __fget_files+0x2a/0x420 [ 762.564444][T21840] ? __fget_files+0x3a2/0x420 [ 762.564455][T21840] __x64_sys_sendmsg+0x1b1/0x290 [ 762.564467][T21840] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 762.564481][T21840] ? rcu_is_watching+0x15/0xb0 [ 762.564490][T21840] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 762.564500][T21840] do_syscall_64+0x174/0x580 [ 762.564512][T21840] ? trace_irq_disable+0x3b/0x140 [ 762.564523][T21840] ? clear_bhb_loop+0x40/0x90 [ 762.564534][T21840] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 762.564543][T21840] RIP: 0033:0x7f2d2259ce59 [ 762.564553][T21840] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 762.564561][T21840] RSP: 002b:00007f2d2343f028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 762.564572][T21840] RAX: ffffffffffffffda RBX: 00007f2d22815fa0 RCX: 00007f2d2259ce59 [ 762.564579][T21840] RDX: 0000000004000000 RSI: 0000200000000140 RDI: 0000000000000003 [ 762.564585][T21840] RBP: 00007f2d2343f090 R08: 0000000000000000 R09: 0000000000000000 [ 762.564591][T21840] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 762.564597][T21840] R13: 00007f2d22816038 R14: 00007f2d22815fa0 R15: 00007f2d2293fa48 [ 762.564606][T21840] [ 763.201268][T21866] openvswitch: netlink: Tunnel attr 78 out of range max 16 [ 763.346947][T19425] usb 1-1: new high-speed USB device number 124 using dummy_hcd [ 763.486952][ T5708] usb 5-1: new low-speed USB device number 28 using dummy_hcd [ 763.528423][T19425] usb 1-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 763.539447][T19425] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 763.550432][T19425] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 763.560222][T19425] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 763.574657][T19425] usb 1-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 763.583787][T19425] usb 1-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 763.587883][T21879] fuse: Bad value for 'fd' [ 763.592377][T19425] usb 1-1: Manufacturer: syz [ 763.602417][T19425] usb 1-1: config 0 descriptor?? [ 763.616979][ T5708] usb 5-1: device descriptor read/64, error -71 [ 763.762264][T21882] binder: 21781:21882 ioctl c018620b 0 returned -14 [ 763.856973][ T5708] usb 5-1: new low-speed USB device number 29 using dummy_hcd [ 763.933474][T21887] FAULT_INJECTION: forcing a failure. [ 763.933474][T21887] name failslab, interval 1, probability 0, space 0, times 0 [ 763.947849][T21887] CPU: 1 UID: 0 PID: 21887 Comm: syz.3.5303 Tainted: G L syzkaller #0 PREEMPT(full) [ 763.947872][T21887] Tainted: [L]=SOFTLOCKUP [ 763.947876][T21887] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 763.947883][T21887] Call Trace: [ 763.947887][T21887] [ 763.947891][T21887] dump_stack_lvl+0xe8/0x150 [ 763.947907][T21887] should_fail_ex+0x40c/0x560 [ 763.947919][T21887] should_failslab+0xa8/0x100 [ 763.947933][T21887] ? skb_clone+0x212/0x3a0 [ 763.947946][T21887] kmem_cache_alloc_noprof+0x87/0x650 [ 763.947960][T21887] skb_clone+0x212/0x3a0 [ 763.947972][T21887] __netlink_deliver_tap+0x413/0x860 [ 763.947986][T21887] ? netlink_deliver_tap+0x2e/0x1b0 [ 763.947997][T21887] netlink_deliver_tap+0x19c/0x1b0 [ 763.948008][T21887] netlink_unicast+0x77f/0x940 [ 763.948019][T21887] netlink_sendmsg+0x813/0xb40 [ 763.948031][T21887] ? __pfx_netlink_sendmsg+0x10/0x10 [ 763.948043][T21887] ? aa_sock_msg_perm+0xf1/0x1b0 [ 763.948052][T21887] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 763.948064][T21887] ? __pfx_netlink_sendmsg+0x10/0x10 [ 763.948075][T21887] ____sys_sendmsg+0x9b9/0xa20 [ 763.948096][T21887] ? __pfx_____sys_sendmsg+0x10/0x10 [ 763.948115][T21887] ? lock_release+0x4b/0x3c0 [ 763.948136][T21887] ? import_iovec+0x73/0xa0 [ 763.948158][T21887] ___sys_sendmsg+0x2a5/0x360 [ 763.948176][T21887] ? rcu_is_watching+0x15/0xb0 [ 763.948188][T21887] ? get_pid_task+0x20/0x1f0 [ 763.948197][T21887] ? __pfx____sys_sendmsg+0x10/0x10 [ 763.948210][T21887] ? rcu_is_watching+0x15/0xb0 [ 763.948224][T21887] ? __fget_files+0x2a/0x420 [ 763.948234][T21887] ? __fget_files+0x3a2/0x420 [ 763.948246][T21887] __x64_sys_sendmsg+0x1b1/0x290 [ 763.948258][T21887] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 763.948271][T21887] ? rcu_is_watching+0x15/0xb0 [ 763.948281][T21887] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 763.948294][T21887] do_syscall_64+0x174/0x580 [ 763.948307][T21887] ? trace_irq_disable+0x3b/0x140 [ 763.948319][T21887] ? clear_bhb_loop+0x40/0x90 [ 763.948329][T21887] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 763.948339][T21887] RIP: 0033:0x7f375639ce59 [ 763.948348][T21887] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 763.948357][T21887] RSP: 002b:00007f37571a1028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 763.948368][T21887] RAX: ffffffffffffffda RBX: 00007f3756615fa0 RCX: 00007f375639ce59 [ 763.948375][T21887] RDX: 0000000020004804 RSI: 0000200000000000 RDI: 0000000000000006 [ 763.948381][T21887] RBP: 00007f37571a1090 R08: 0000000000000000 R09: 0000000000000000 [ 763.948387][T21887] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 763.948393][T21887] R13: 00007f3756616038 R14: 00007f3756615fa0 R15: 00007f375673fa48 [ 763.948403][T21887] [ 763.986890][ T5708] usb 5-1: device descriptor read/64, error -71 [ 764.247399][T21862] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 764.256387][T21862] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 764.343932][T19425] usbhid 1-1:0.0: can't add hid device: -71 [ 764.351297][ T5708] usb usb5-port1: attempt power cycle [ 764.359949][T19425] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 764.380916][T19425] usb 1-1: USB disconnect, device number 124 [ 764.418004][T21892] netlink: 20 bytes leftover after parsing attributes in process `syz.0.5305'. [ 764.707020][ T5708] usb 5-1: new low-speed USB device number 30 using dummy_hcd [ 764.738296][ T5708] usb 5-1: device descriptor read/8, error -71 [ 764.807789][T19425] usb 6-1: USB disconnect, device number 107 [ 764.977438][ T5708] usb 5-1: new low-speed USB device number 31 using dummy_hcd [ 764.997556][ T5708] usb 5-1: device descriptor read/8, error -71 [ 765.127106][ T5708] usb usb5-port1: unable to enumerate USB device [ 765.356906][T19419] usb 6-1: new high-speed USB device number 108 using dummy_hcd [ 765.457010][ T5708] usb 1-1: new high-speed USB device number 125 using dummy_hcd [ 765.507303][T19419] usb 6-1: Using ep0 maxpacket: 16 [ 765.524112][T19419] usb 6-1: unable to get BOS descriptor or descriptor too short [ 765.543307][T19419] usb 6-1: unable to read config index 0 descriptor/start: -71 [ 765.563071][T19419] usb 6-1: can't read configurations, error -71 [ 765.608138][ T5708] usb 1-1: config 2 has an invalid interface number: 174 but max is 0 [ 765.623728][ T5708] usb 1-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 765.645303][ T5708] usb 1-1: config 2 has no interface number 0 [ 765.658119][ T5708] usb 1-1: config 2 interface 174 altsetting 0 has an endpoint descriptor with address 0x9E, changing to 0x8E [ 765.684608][ T5708] usb 1-1: config 2 interface 174 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 765.704932][ T5708] usb 1-1: config 2 interface 174 altsetting 0 bulk endpoint 0x8E has invalid maxpacket 0 [ 765.720219][ T5708] usb 1-1: config 2 interface 174 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 765.738334][ T5708] usb 1-1: New USB device found, idVendor=0424, idProduct=012c, bcdDevice=22.7e [ 765.755076][ T5708] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 765.763369][ T5708] usb 1-1: Product: syz [ 765.768159][ T5708] usb 1-1: Manufacturer: syz [ 765.772848][ T5708] usb 1-1: SerialNumber: syz [ 765.987728][T21935] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 765.997339][T21935] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 766.166940][T19420] usb 4-1: new full-speed USB device number 38 using dummy_hcd [ 766.196890][T19419] usb 6-1: new high-speed USB device number 109 using dummy_hcd [ 766.320408][T19420] usb 4-1: unable to get BOS descriptor or descriptor too short [ 766.320908][T19420] usb 4-1: not running at top speed; connect to a high speed hub [ 766.344356][T19420] usb 4-1: config 12 has an invalid descriptor of length 194, skipping remainder of the config [ 766.344372][T19420] usb 4-1: config 12 has 0 interfaces, different from the descriptor's value: 1 [ 766.346204][T19420] usb 4-1: New USB device found, idVendor=05f9, idProduct=ffff, bcdDevice=e6.f3 [ 766.346221][T19420] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 766.346230][T19420] usb 4-1: Product: syz [ 766.346252][T19420] usb 4-1: Manufacturer: syz [ 766.346260][T19420] usb 4-1: SerialNumber: syz [ 766.359108][T19419] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 766.413365][T21952] netem: change failed [ 766.414507][T19419] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 766.429554][T19419] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 766.447911][T19419] usb 6-1: config 0 descriptor?? [ 766.594134][ T5708] usb 1-1: probing VID:PID(0424:012C) [ 766.615583][ T5708] usb 1-1: vub300 testing BULK IN EndPoint(0) 8E [ 766.644762][ T5708] usb 1-1: Could not find two sets of bulk-in/out endpoint pairs [ 766.646734][T21963] netlink: 'syz.4.5324': attribute type 11 has an invalid length. [ 766.669788][T21963] netlink: 448 bytes leftover after parsing attributes in process `syz.4.5324'. [ 766.698349][ T5708] vub300 1-1:2.174: probe with driver vub300 failed with error -22 [ 766.708880][ T5708] usb 1-1: USB disconnect, device number 125 [ 766.869764][T21943] EXT4-fs: Value of option "test_dummy_encryption" is unrecognized [ 767.092456][T19419] ath6kl: mismatched byte count 0 vs. expected 12 [ 767.099279][T19419] ath6kl: Failed to init ath6kl core: -22 [ 767.105401][T19419] ath6kl_usb 6-1:0.0: probe with driver ath6kl_usb failed with error -22 [ 767.472031][T21984] netlink: 16 bytes leftover after parsing attributes in process `syz.4.5334'. [ 767.996954][T19425] usb 1-1: new high-speed USB device number 126 using dummy_hcd [ 768.156832][T19425] usb 1-1: Using ep0 maxpacket: 32 [ 768.163591][T19425] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 768.175305][T19425] usb 1-1: New USB device found, idVendor=5543, idProduct=0042, bcdDevice= 0.00 [ 768.185958][T19425] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 768.200618][T19425] usb 1-1: config 0 descriptor?? [ 768.232058][T22001] netlink: 32 bytes leftover after parsing attributes in process `syz.1.5340'. [ 768.244441][T22001] netlink: 20 bytes leftover after parsing attributes in process `syz.1.5340'. [ 768.255418][T22001] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 768.264961][T22001] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 768.643235][T19425] input: HID 5543:0042 Pen as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:5543:0042.0054/input/input90 [ 768.736770][T19425] input: HID 5543:0042 Mouse as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:5543:0042.0054/input/input91 [ 768.754975][T19425] uclogic 0003:5543:0042.0054: input,hidraw0: USB HID v7f.fd Mouse [HID 5543:0042] on usb-dummy_hcd.0-1/input0 [ 768.919328][T19425] usb 6-1: USB disconnect, device number 109 [ 768.974077][T19420] usb 4-1: USB disconnect, device number 38 [ 769.142796][T22022] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 769.192934][T22026] syzkaller1: entered promiscuous mode [ 769.205985][T22026] syzkaller1: entered allmulticast mode [ 769.320957][T22031] netlink: 1 bytes leftover after parsing attributes in process `syz.4.5352'. [ 769.496185][T22051] program syz.3.5360 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 769.523111][T22051] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5360'. [ 769.527604][T22053] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5361'. [ 769.573025][T22051] bridge2: port 1(veth3) entered blocking state [ 769.581245][T22051] bridge2: port 1(veth3) entered disabled state [ 769.588004][T22051] veth3: entered allmulticast mode [ 769.593843][T22051] veth3: entered promiscuous mode [ 769.607029][T19419] usb 6-1: new high-speed USB device number 110 using dummy_hcd [ 769.621690][T22051] bridge2: port 2(veth0_to_bond) entered blocking state [ 769.640717][T22051] bridge2: port 2(veth0_to_bond) entered disabled state [ 769.648164][T22051] veth0_to_bond: entered allmulticast mode [ 769.655130][T22051] veth0_to_bond: entered promiscuous mode [ 769.766861][T19419] usb 6-1: Using ep0 maxpacket: 32 [ 769.773866][T19419] usb 6-1: unable to get BOS descriptor or descriptor too short [ 769.783556][T19419] usb 6-1: config 0 has an invalid interface number: 77 but max is 0 [ 769.792661][T19419] usb 6-1: config 0 has no interface number 0 [ 769.798909][T19419] usb 6-1: config 0 interface 77 has no altsetting 0 [ 769.807619][T19419] usb 6-1: New USB device found, idVendor=061d, idProduct=c180, bcdDevice=9c.90 [ 769.817187][T19419] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 769.825237][T19419] usb 6-1: Product: syz [ 769.829464][T19419] usb 6-1: Manufacturer: syz [ 769.834071][T19419] usb 6-1: SerialNumber: syz [ 769.840027][T19419] usb 6-1: config 0 descriptor?? [ 769.908330][ T5695] usb 4-1: new full-speed USB device number 39 using dummy_hcd [ 770.062722][T19419] quatech2 6-1:0.77: Quatech 2nd gen USB to Serial Driver converter detected [ 770.079800][ T5695] usb 4-1: unable to get BOS descriptor or descriptor too short [ 770.088445][T19419] usb 6-1: qt2_attach - failed to power on unit: -71 [ 770.099794][T19419] quatech2 6-1:0.77: probe with driver quatech2 failed with error -71 [ 770.100258][ T5695] usb 4-1: not running at top speed; connect to a high speed hub [ 770.118527][T19419] usb 6-1: USB disconnect, device number 110 [ 770.119613][ T5695] usb 4-1: config 6 has an invalid interface number: 101 but max is 0 [ 770.133815][ T5695] usb 4-1: config 6 has no interface number 0 [ 770.140468][ T5695] usb 4-1: config 6 interface 101 altsetting 6 endpoint 0x6 has invalid maxpacket 1023, setting to 64 [ 770.151946][ T5695] usb 4-1: config 6 interface 101 has no altsetting 0 [ 770.161606][ T5695] usb 4-1: New USB device found, idVendor=8086, idProduct=0b03, bcdDevice=9d.63 [ 770.178408][ T5695] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 770.180107][T22063] netlink: 20 bytes leftover after parsing attributes in process `syz.5.5364'. [ 770.198603][T22063] netlink: 12 bytes leftover after parsing attributes in process `syz.5.5364'. [ 770.200243][ T5695] usb 4-1: Product: syz [ 770.226118][ T5695] usb 4-1: Manufacturer: 䙧ᙌ燪㮮짩⇴槝宏䤃⪞㯹錝刾卋П뀬髱쎊鑇⮬㯓紳奬䗣뜝䐢煭泌䡧ꁁ棥㤑넹ᡮㄜ㰙쐂뽷鋘桗븬皫ͼ➗Ứ뎼甿蜑ҏ䋍집휚姙刭䔍ᛘꛗ劫ﳙ掮䒙 [ 770.252398][ T5695] usb 4-1: SerialNumber: syz [ 770.260898][T22056] raw-gadget.5 gadget.3: fail, usb_ep_enable returned -22 [ 770.479715][ T5695] uvcvideo 4-1:6.101: Found UVC 0.00 device syz (8086:0b03) [ 770.487335][ T5695] uvcvideo 4-1:6.101: No valid video chain found. [ 770.497800][ T5695] usb 4-1: USB disconnect, device number 39 [ 770.527278][T19419] usb 6-1: new high-speed USB device number 111 using dummy_hcd [ 770.665101][T19425] usb 1-1: USB disconnect, device number 126 [ 770.678886][T19419] usb 6-1: unable to get BOS descriptor or descriptor too short [ 770.697111][T19419] usb 6-1: config 64 has an invalid interface number: 44 but max is 0 [ 770.707837][T19419] usb 6-1: config 64 has no interface number 0 [ 770.717726][T19419] usb 6-1: config 64 interface 44 altsetting 7 endpoint 0x83 has an invalid bInterval 57, changing to 9 [ 770.730504][T19419] usb 6-1: config 64 interface 44 has no altsetting 0 [ 770.765293][T19419] usb 6-1: New USB device found, idVendor=07c0, idProduct=158b, bcdDevice=d9.d2 [ 770.775791][T19419] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 770.787069][T19419] usb 6-1: Product: syz [ 770.801147][T19419] usb 6-1: Manufacturer: syz [ 770.815689][T19419] usb 6-1: SerialNumber: syz [ 770.895416][ T29] audit: type=1326 audit(1781679970.244:1999): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22068 comm="syz.0.5366" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2d2259ce59 code=0x7ffc0000 [ 770.922961][ T29] audit: type=1326 audit(1781679970.244:2000): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22068 comm="syz.0.5366" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2d2259ce59 code=0x7ffc0000 [ 770.948717][ T29] audit: type=1326 audit(1781679970.244:2001): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22068 comm="syz.0.5366" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2d2259ce59 code=0x7ffc0000 [ 770.974897][ T29] audit: type=1326 audit(1781679970.244:2002): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22068 comm="syz.0.5366" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2d2259ce59 code=0x7ffc0000 [ 771.000515][ T29] audit: type=1326 audit(1781679970.244:2003): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22068 comm="syz.0.5366" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2d2259ce59 code=0x7ffc0000 [ 771.026230][ T29] audit: type=1326 audit(1781679970.274:2004): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22068 comm="syz.0.5366" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2d2259ce59 code=0x7ffc0000 [ 771.054676][ T29] audit: type=1326 audit(1781679970.274:2005): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22068 comm="syz.0.5366" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2d2259ce59 code=0x7ffc0000 [ 771.079384][T22063] netlink: 32 bytes leftover after parsing attributes in process `syz.5.5364'. [ 771.090065][ T29] audit: type=1326 audit(1781679970.274:2006): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22068 comm="syz.0.5366" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2d2259ce59 code=0x7ffc0000 [ 771.130462][T19419] iowarrior 6-1:64.44: no interrupt-out endpoint found [ 771.152464][T19419] usb 6-1: USB disconnect, device number 111 [ 771.176599][ T29] audit: type=1326 audit(1781679970.274:2007): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22068 comm="syz.0.5366" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f2d2259ce59 code=0x7ffc0000 [ 771.221177][ T29] audit: type=1326 audit(1781679970.274:2008): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22068 comm="syz.0.5366" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f2d2259ce59 code=0x7ffc0000 [ 771.390778][T19419] IPVS: starting estimator thread 0... [ 771.401111][T22089] FAULT_INJECTION: forcing a failure. [ 771.401111][T22089] name failslab, interval 1, probability 0, space 0, times 0 [ 771.468880][T22089] CPU: 0 UID: 0 PID: 22089 Comm: syz.3.5373 Tainted: G L syzkaller #0 PREEMPT(full) [ 771.468898][T22089] Tainted: [L]=SOFTLOCKUP [ 771.468902][T22089] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 771.468909][T22089] Call Trace: [ 771.468913][T22089] [ 771.468918][T22089] dump_stack_lvl+0xe8/0x150 [ 771.468937][T22089] should_fail_ex+0x40c/0x560 [ 771.468952][T22089] should_failslab+0xa8/0x100 [ 771.468968][T22089] __kvmalloc_node_noprof+0x16e/0x890 [ 771.468982][T22089] ? hash_net_create+0x392/0xfe0 [ 771.468994][T22089] ? hash_net_create+0x2e7/0xfe0 [ 771.469005][T22089] hash_net_create+0x392/0xfe0 [ 771.469015][T22089] ? rcu_is_watching+0x15/0xb0 [ 771.469026][T22089] ? __nla_parse+0x40/0x60 [ 771.469038][T22089] ? __pfx_hash_net_create+0x10/0x10 [ 771.469048][T22089] ip_set_create+0xae2/0x1a40 [ 771.469068][T22089] ? ip_set_create+0x4e9/0x1a40 [ 771.469078][T22089] ? __pfx_ip_set_create+0x10/0x10 [ 771.469086][T22089] ? rcu_is_watching+0x15/0xb0 [ 771.469099][T22089] ? rcu_is_watching+0x15/0xb0 [ 771.469108][T22089] ? lock_release+0x4b/0x3c0 [ 771.469122][T22089] ? __nla_parse+0x40/0x60 [ 771.469133][T22089] nfnetlink_rcv_msg+0xcc2/0x12b0 [ 771.469145][T22089] ? unwind_get_return_address+0x4d/0x90 [ 771.469157][T22089] ? nfnetlink_rcv_msg+0x228/0x12b0 [ 771.469170][T22089] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 771.469188][T22089] netlink_rcv_skb+0x226/0x4a0 [ 771.469200][T22089] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 771.469210][T22089] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 771.469229][T22089] ? bpf_lsm_capable+0x9/0x20 [ 771.469238][T22089] ? security_capable+0x7e/0x2c0 [ 771.469254][T22089] nfnetlink_rcv+0x2b9/0x28c0 [ 771.469265][T22089] ? __dev_queue_xmit+0x29b/0x37f0 [ 771.469279][T22089] ? rcu_is_watching+0x15/0xb0 [ 771.469288][T22089] ? __dev_queue_xmit+0x29b/0x37f0 [ 771.469299][T22089] ? trace_irq_enable+0x3b/0x140 [ 771.469312][T22089] ? __dev_queue_xmit+0x29b/0x37f0 [ 771.469324][T22089] ? __dev_queue_xmit+0x29b/0x37f0 [ 771.469336][T22089] ? __local_bh_enable_ip+0xd0/0x130 [ 771.469350][T22089] ? __dev_queue_xmit+0x29b/0x37f0 [ 771.469362][T22089] ? __dev_queue_xmit+0x1ed7/0x37f0 [ 771.469378][T22089] ? ____sys_sendmsg+0x9b9/0xa20 [ 771.469391][T22089] ? ___sys_sendmsg+0x2a5/0x360 [ 771.469404][T22089] ? __dev_queue_xmit+0x29b/0x37f0 [ 771.469416][T22089] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 771.469437][T22089] ? __pfx___dev_queue_xmit+0x10/0x10 [ 771.469458][T22089] ? ref_tracker_free+0x689/0x830 [ 771.469476][T22089] ? __pfx_ref_tracker_free+0x10/0x10 [ 771.469495][T22089] ? __skb_clone+0x449/0x6c0 [ 771.469515][T22089] ? skb_clone+0x246/0x3a0 [ 771.469535][T22089] ? __netlink_deliver_tap+0x811/0x860 [ 771.469551][T22089] ? netlink_deliver_tap+0x2e/0x1b0 [ 771.469569][T22089] ? rcu_is_watching+0x15/0xb0 [ 771.469582][T22089] ? netlink_deliver_tap+0x2e/0x1b0 [ 771.469599][T22089] ? lock_release+0x4b/0x3c0 [ 771.469621][T22089] ? netlink_deliver_tap+0x2e/0x1b0 [ 771.469641][T22089] netlink_unicast+0x7bb/0x940 [ 771.469662][T22089] netlink_sendmsg+0x813/0xb40 [ 771.469684][T22089] ? __pfx_netlink_sendmsg+0x10/0x10 [ 771.469704][T22089] ? aa_sock_msg_perm+0xf1/0x1b0 [ 771.469720][T22089] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 771.469736][T22089] ? __pfx_netlink_sendmsg+0x10/0x10 [ 771.469752][T22089] ____sys_sendmsg+0x9b9/0xa20 [ 771.469773][T22089] ? __pfx_____sys_sendmsg+0x10/0x10 [ 771.469792][T22089] ? lock_release+0x4b/0x3c0 [ 771.469812][T22089] ? import_iovec+0x73/0xa0 [ 771.469832][T22089] ___sys_sendmsg+0x2a5/0x360 [ 771.469850][T22089] ? rcu_is_watching+0x15/0xb0 [ 771.469864][T22089] ? get_pid_task+0x20/0x1f0 [ 771.469880][T22089] ? __pfx____sys_sendmsg+0x10/0x10 [ 771.469901][T22089] ? rcu_is_watching+0x15/0xb0 [ 771.469925][T22089] ? __fget_files+0x2a/0x420 [ 771.469942][T22089] ? __fget_files+0x3a2/0x420 [ 771.469961][T22089] __x64_sys_sendmsg+0x1b1/0x290 [ 771.469979][T22089] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 771.470001][T22089] ? rcu_is_watching+0x15/0xb0 [ 771.470018][T22089] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 771.470035][T22089] do_syscall_64+0x174/0x580 [ 771.470055][T22089] ? trace_irq_disable+0x3b/0x140 [ 771.470074][T22089] ? clear_bhb_loop+0x40/0x90 [ 771.470092][T22089] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 771.470106][T22089] RIP: 0033:0x7f375639ce59 [ 771.470121][T22089] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 771.470133][T22089] RSP: 002b:00007f37571a1028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 771.470150][T22089] RAX: ffffffffffffffda RBX: 00007f3756615fa0 RCX: 00007f375639ce59 [ 771.470162][T22089] RDX: 0000000040040000 RSI: 0000200000000000 RDI: 0000000000000006 [ 771.470173][T22089] RBP: 00007f37571a1090 R08: 0000000000000000 R09: 0000000000000000 [ 771.470183][T22089] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 771.470193][T22089] R13: 00007f3756616038 R14: 00007f3756615fa0 R15: 00007f375673fa48 [ 771.470211][T22089] [ 771.495813][T22090] IPVS: using max 87 ests per chain, 208800 per kthread [ 771.686799][T22104] batman_adv: batadv0: adding TT local entry aa:aa:aa:aa:aa:2a to non-existent VLAN 3249 [ 771.928460][T19409] usb 6-1: new full-speed USB device number 112 using dummy_hcd [ 772.097779][T19409] usb 6-1: New USB device found, idVendor=0582, idProduct=0582, bcdDevice= 0.40 [ 772.097807][T19409] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 772.097817][T19409] usb 6-1: Product: syz [ 772.097825][T19409] usb 6-1: Manufacturer: syz [ 772.097832][T19409] usb 6-1: SerialNumber: syz [ 772.366010][ T5624] Bluetooth: hci2: unexpected event for opcode 0x0006 [ 772.389676][T19409] usb 6-1: 1:1 : incorrect wMaxPacketSize for BADD profile [ 772.394328][T19409] usb 6-1: incorrect wMaxPacketSize 0x3ff for BADD profile [ 772.449179][T19409] snd-usb-audio 6-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 772.459386][T19409] usb 6-1: USB disconnect, device number 112 [ 772.482078][ T6077] udevd[6077]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 772.721417][T22135] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5388'. [ 772.731598][T22135] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5388'. [ 772.775359][ T13] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 772.775436][T22135] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5388'. [ 772.795015][ T13] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 772.796947][T22135] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5388'. [ 772.814326][ T13] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 772.836201][ T13] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 772.900101][T22143] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 772.910737][T22143] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 773.565091][T22176] bridge0: port 1(bridge_slave_0) entered disabled state [ 773.565406][T22176] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 773.596231][T19425] usb 6-1: new high-speed USB device number 113 using dummy_hcd [ 773.607362][T19419] usb 4-1: new high-speed USB device number 40 using dummy_hcd [ 773.757025][T19425] usb 6-1: Using ep0 maxpacket: 16 [ 773.759444][T19419] usb 4-1: Using ep0 maxpacket: 8 [ 773.768781][T19425] usb 6-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 773.781225][T19419] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 773.795244][T19425] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 773.800322][T19419] usb 4-1: config 0 has no interfaces? [ 773.813670][T19425] usb 6-1: Product: syz [ 773.826846][T19425] usb 6-1: Manufacturer: syz [ 773.833652][T19419] usb 4-1: New USB device found, idVendor=110a, idProduct=1450, bcdDevice=62.cb [ 773.843016][T19419] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 773.843654][T19425] usb 6-1: SerialNumber: syz [ 773.855114][T19419] usb 4-1: Product: syz [ 773.864993][T19419] usb 4-1: Manufacturer: syz [ 773.870276][T19425] usb 6-1: config 0 descriptor?? [ 773.894968][T19419] usb 4-1: SerialNumber: syz [ 773.901436][T19419] usb 4-1: config 0 descriptor?? [ 773.936594][T22193] forcing mempool usage for bio_alloc_bioset+0x631/0xc80 [ 773.992783][T22195] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5413'. [ 774.116929][T19420] usb 1-1: new high-speed USB device number 127 using dummy_hcd [ 774.272803][T19425] dvb-usb: found a 'AME DTV-5100 USB2.0 DVB-T' in warm state. [ 774.277052][T19420] usb 1-1: Using ep0 maxpacket: 32 [ 774.283385][T19425] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 774.287263][T19420] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 774.295965][T19425] dvbdev: DVB: registering new adapter (AME DTV-5100 USB2.0 DVB-T) [ 774.303451][T19420] usb 1-1: config 0 has no interface number 0 [ 774.311094][T19425] usb 6-1: media controller created [ 774.323106][T19420] usb 1-1: config 0 interface 1 altsetting 9 has an invalid descriptor for endpoint zero, skipping [ 774.331116][T19425] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 774.334064][T19420] usb 1-1: config 0 interface 1 has no altsetting 0 [ 774.350991][T19420] usb 1-1: New USB device found, idVendor=0572, idProduct=58a5, bcdDevice=27.0a [ 774.360648][T19420] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 774.368766][T19420] usb 1-1: Product: syz [ 774.373035][T19420] usb 1-1: Manufacturer: syz [ 774.377424][T19425] zl10353_read_register: readreg error (reg=127, ret==0) [ 774.378388][T19420] usb 1-1: SerialNumber: syz [ 774.385205][T19425] dvb-usb: no frontend was attached by 'AME DTV-5100 USB2.0 DVB-T' [ 774.397622][T19420] usb 1-1: config 0 descriptor?? [ 774.401032][T19425] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully initialized and connected. [ 774.550112][T22211] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 774.559560][T22211] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 774.614827][T19420] cx231xx 1-1:0.1: New device syz syz @ 480 Mbps (0572:58a5) with 1 interfaces [ 774.637455][T19420] cx231xx 1-1:0.1: Failed to read PCB config [ 774.643546][T19420] cx231xx 1-1:0.1: probe with driver cx231xx failed with error -71 [ 774.669627][T19420] usb 1-1: USB disconnect, device number 127 [ 774.729992][T22172] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 774.740419][T22172] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 775.136901][T19420] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 775.286878][T19420] usb 1-1: Using ep0 maxpacket: 32 [ 775.293656][T19420] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 775.301960][T19420] usb 1-1: config 0 has no interface number 0 [ 775.308383][T19420] usb 1-1: config 0 interface 1 altsetting 9 has an invalid descriptor for endpoint zero, skipping [ 775.319314][T19420] usb 1-1: config 0 interface 1 has no altsetting 0 [ 775.327843][T19420] usb 1-1: New USB device found, idVendor=0572, idProduct=58a5, bcdDevice=27.0a [ 775.337060][T19420] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 775.345274][T19420] usb 1-1: Product: syz [ 775.349770][T19420] usb 1-1: Manufacturer: syz [ 775.354390][T19420] usb 1-1: SerialNumber: syz [ 775.360276][T19420] usb 1-1: config 0 descriptor?? [ 775.573019][T19420] cx231xx 1-1:0.1: New device syz syz @ 480 Mbps (0572:58a5) with 1 interfaces [ 775.582733][T19420] cx231xx 1-1:0.1: bad scenario!!!!! [ 775.582733][T19420] config_info=0 [ 775.591549][T19420] cx231xx 1-1:0.1: Failed to read PCB config [ 775.848117][T19409] usb 1-1: USB disconnect, device number 2 [ 775.891131][T22224] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 775.901490][T22224] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 775.926976][T22224] ------------[ cut here ]------------ [ 775.932544][T22224] usb 6-1: BOGUS control dir, pipe 80007180 doesn't match bRequestType c0 [ 775.941252][T22224] WARNING: drivers/usb/core/urb.c:413 at usb_submit_urb+0x1057/0x18b0, CPU#0: syz.1.5422/22224 [ 775.951644][T22224] Modules linked in: [ 775.955537][T22224] CPU: 0 UID: 0 PID: 22224 Comm: syz.1.5422 Tainted: G L syzkaller #0 PREEMPT(full) [ 775.966735][T22224] Tainted: [L]=SOFTLOCKUP [ 775.971687][T22224] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 775.981962][T22224] RIP: 0010:usb_submit_urb+0x1100/0x18b0 [ 775.987971][T22224] Code: b8 00 00 00 00 00 fc ff df 41 0f b6 04 04 84 c0 0f 85 b2 05 00 00 45 0f b6 45 00 48 8b 3c 24 48 8b 74 24 18 4c 89 f2 44 89 f9 <67> 48 0f b9 3a 48 bd 00 00 00 00 00 fc ff df e9 ba f2 ff ff 44 89 [ 776.007795][T22224] RSP: 0000:ffffc90004247698 EFLAGS: 00010246 [ 776.014080][T22224] RAX: 0000000000000000 RBX: ffff88807dfe5300 RCX: 0000000080007180 [ 776.022117][T22224] RDX: ffff88807b453ce0 RSI: ffffffff8c8143c0 RDI: ffffffff903e6810 [ 776.030187][T22224] RBP: dffffc0000000000 R08: 00000000000000c0 R09: 0000000000000000 [ 776.038209][T22224] R10: ffffc90004247780 R11: fffff52000848efc R12: 1ffff110041dd4d4 [ 776.046209][T22224] R13: ffff888020eea6a0 R14: ffff88807b453ce0 R15: 0000000080007180 [ 776.054270][T22224] FS: 00007f9d7a37e6c0(0000) GS:ffff88812528f000(0000) knlGS:0000000000000000 [ 776.063592][T22224] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 776.070366][T22224] CR2: 00007fa6a6d5ce10 CR3: 000000002ac36000 CR4: 00000000003526f0 [ 776.078518][T22224] Call Trace: [ 776.081826][T22224] [ 776.084777][T22224] usb_start_wait_urb+0x13f/0x5b0 [ 776.089905][T22224] ? rcu_is_watching+0x15/0xb0 [ 776.094709][T22224] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 776.100350][T22224] usb_control_msg+0x234/0x3e0 [ 776.105143][T22224] dtv5100_i2c_msg+0x231/0x2f0 [ 776.110008][T22224] dtv5100_i2c_xfer+0x1a5/0x610 [ 776.114882][T22224] ? kasan_save_track+0x4f/0x80 [ 776.119826][T22224] ? kasan_save_free_info+0x40/0x50 [ 776.125068][T22224] ? security_file_ioctl+0xc3/0x2a0 [ 776.130387][T22224] ? __se_sys_ioctl+0x47/0x170 [ 776.135172][T22224] __i2c_transfer+0x7be/0x1fe0 [ 776.136286][ T29] kauditd_printk_skb: 80 callbacks suppressed [ 776.136301][ T29] audit: type=1326 audit(1781679975.494:2089): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22225 comm="syz.4.5423" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa6a6d9ce59 code=0x7ffc0000 [ 776.140026][T22224] __i2c_smbus_xfer+0x1584/0x27d0 [ 776.140057][T22224] ? __pfx___i2c_smbus_xfer+0x10/0x10 [ 776.140077][T22224] ? 0xffffffff81000000 [ 776.140094][T22224] ? rcu_is_watching+0x15/0xb0 [ 776.140114][T22224] ? rt_mutex_lock_nested+0x156/0x1c0 [ 776.148372][ T29] audit: type=1326 audit(1781679975.494:2090): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22225 comm="syz.4.5423" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa6a6d9ce59 code=0x7ffc0000 [ 776.170911][T22224] i2c_smbus_xfer+0x1f4/0x310 [ 776.170945][T22224] i2cdev_ioctl_smbus+0x407/0x700 [ 776.170967][T22224] ? rcu_is_watching+0x15/0xb0 [ 776.170987][T22224] ? hook_file_ioctl+0x1f0/0x5c0 [ 776.171011][T22224] ? __pfx_i2cdev_ioctl_smbus+0x10/0x10 [ 776.171034][T22224] ? lock_release+0x4b/0x3c0 [ 776.171056][T22224] ? __might_fault+0xaf/0x130 [ 776.204217][T19409] usb 4-1: USB disconnect, device number 40 [ 776.220278][T22224] ? __might_fault+0xcb/0x130 [ 776.220313][T22224] i2cdev_ioctl+0x615/0x880 [ 776.220335][T22224] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 776.220359][T22224] ? rcu_is_watching+0x15/0xb0 [ 776.220377][T22224] ? bpf_lsm_file_ioctl+0x9/0x20 [ 776.220400][T22224] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 776.220421][T22224] __se_sys_ioctl+0xfc/0x170 [ 776.220443][T22224] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 776.220459][T22224] do_syscall_64+0x174/0x580 [ 776.220481][T22224] ? trace_irq_disable+0x3b/0x140 [ 776.310777][T22224] ? clear_bhb_loop+0x40/0x90 [ 776.310879][ T29] audit: type=1326 audit(1781679975.504:2091): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22225 comm="syz.4.5423" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa6a6d9ce59 code=0x7ffc0000 [ 776.315475][T22224] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 776.315498][T22224] RIP: 0033:0x7f9d7959ce59 [ 776.315516][T22224] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 776.370280][T22224] RSP: 002b:00007f9d7a37e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 776.371759][T19425] usb 6-1: USB disconnect, device number 113 [ 776.378772][T22224] RAX: ffffffffffffffda RBX: 00007f9d79815fa0 RCX: 00007f9d7959ce59 [ 776.378794][T22224] RDX: 0000200000000200 RSI: 0000000000000720 RDI: 0000000000000008 [ 776.378805][T22224] RBP: 00007f9d79632d6f R08: 0000000000000000 R09: 0000000000000000 [ 776.378816][T22224] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 776.378825][T22224] R13: 00007f9d79816038 R14: 00007f9d79815fa0 R15: 00007f9d7993fa48 [ 776.378844][T22224] [ 776.378865][T22224] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 776.378880][T22224] CPU: 0 UID: 0 PID: 22224 Comm: syz.1.5422 Tainted: G L syzkaller #0 PREEMPT(full) [ 776.378903][T22224] Tainted: [L]=SOFTLOCKUP [ 776.378909][T22224] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 776.378919][T22224] Call Trace: [ 776.378926][T22224] [ 776.378940][T22224] vpanic+0x56c/0xa60 [ 776.378964][T22224] ? __pfx__printk+0x10/0x10 [ 776.378986][T22224] ? __pfx_vpanic+0x10/0x10 [ 776.379003][T22224] ? is_bpf_text_address+0x292/0x2b0 [ 776.379027][T22224] ? is_bpf_text_address+0x26/0x2b0 [ 776.379053][T22224] panic+0xc5/0xd0 [ 776.379068][T22224] ? __pfx_panic+0x10/0x10 [ 776.379091][T22224] __warn+0x315/0x4c0 [ 776.379108][T22224] ? usb_submit_urb+0x1057/0x18b0 [ 776.379126][T22224] ? usb_submit_urb+0x1057/0x18b0 [ 776.379142][T22224] __report_bug+0x331/0x530 [ 776.379167][T22224] ? usb_submit_urb+0x1057/0x18b0 [ 776.379184][T22224] ? __pfx___report_bug+0x10/0x10 [ 776.379206][T22224] ? stack_depot_save_flags+0x3ec/0x800 [ 776.379230][T22224] report_bug_entry+0x19a/0x290 [ 776.379250][T22224] ? usb_submit_urb+0x1100/0x18b0 [ 776.379266][T22224] ? usb_submit_urb+0x1105/0x18b0 [ 776.379282][T22224] handle_bug+0xce/0x200 [ 776.379306][T22224] exc_invalid_op+0x1a/0x50 [ 776.379327][T22224] asm_exc_invalid_op+0x1a/0x20 [ 776.379343][T22224] RIP: 0010:usb_submit_urb+0x1100/0x18b0 [ 776.379361][T22224] Code: b8 00 00 00 00 00 fc ff df 41 0f b6 04 04 84 c0 0f 85 b2 05 00 00 45 0f b6 45 00 48 8b 3c 24 48 8b 74 24 18 4c 89 f2 44 89 f9 <67> 48 0f b9 3a 48 bd 00 00 00 00 00 fc ff df e9 ba f2 ff ff 44 89 [ 776.379376][T22224] RSP: 0000:ffffc90004247698 EFLAGS: 00010246 [ 776.379393][T22224] RAX: 0000000000000000 RBX: ffff88807dfe5300 RCX: 0000000080007180 [ 776.379405][T22224] RDX: ffff88807b453ce0 RSI: ffffffff8c8143c0 RDI: ffffffff903e6810 [ 776.379418][T22224] RBP: dffffc0000000000 R08: 00000000000000c0 R09: 0000000000000000 [ 776.379430][T22224] R10: ffffc90004247780 R11: fffff52000848efc R12: 1ffff110041dd4d4 [ 776.379442][T22224] R13: ffff888020eea6a0 R14: ffff88807b453ce0 R15: 0000000080007180 [ 776.379460][T22224] ? usb_submit_urb+0x1091/0x18b0 [ 776.379480][T22224] usb_start_wait_urb+0x13f/0x5b0 [ 776.379500][T22224] ? rcu_is_watching+0x15/0xb0 [ 776.379518][T22224] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 776.379544][T22224] usb_control_msg+0x234/0x3e0 [ 776.379563][T22224] dtv5100_i2c_msg+0x231/0x2f0 [ 776.379588][T22224] dtv5100_i2c_xfer+0x1a5/0x610 [ 776.379607][T22224] ? kasan_save_track+0x4f/0x80 [ 776.379629][T22224] ? kasan_save_free_info+0x40/0x50 [ 776.379647][T22224] ? security_file_ioctl+0xc3/0x2a0 [ 776.379667][T22224] ? __se_sys_ioctl+0x47/0x170 [ 776.379690][T22224] __i2c_transfer+0x7be/0x1fe0 [ 776.379718][T22224] __i2c_smbus_xfer+0x1584/0x27d0 [ 776.379742][T22224] ? __pfx___i2c_smbus_xfer+0x10/0x10 [ 776.379768][T22224] ? 0xffffffff81000000 [ 776.379785][T22224] ? rcu_is_watching+0x15/0xb0 [ 776.379804][T22224] ? rt_mutex_lock_nested+0x156/0x1c0 [ 776.379829][T22224] i2c_smbus_xfer+0x1f4/0x310 [ 776.379847][T22224] i2cdev_ioctl_smbus+0x407/0x700 [ 776.379869][T22224] ? rcu_is_watching+0x15/0xb0 [ 776.379886][T22224] ? hook_file_ioctl+0x1f0/0x5c0 [ 776.379910][T22224] ? __pfx_i2cdev_ioctl_smbus+0x10/0x10 [ 776.379938][T22224] ? lock_release+0x4b/0x3c0 [ 776.379960][T22224] ? __might_fault+0xaf/0x130 [ 776.379978][T22224] ? __might_fault+0xcb/0x130 [ 776.379999][T22224] i2cdev_ioctl+0x615/0x880 [ 776.380020][T22224] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 776.380042][T22224] ? rcu_is_watching+0x15/0xb0 [ 776.380060][T22224] ? bpf_lsm_file_ioctl+0x9/0x20 [ 776.380082][T22224] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 776.380102][T22224] __se_sys_ioctl+0xfc/0x170 [ 776.380124][T22224] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 776.380141][T22224] do_syscall_64+0x174/0x580 [ 776.380161][T22224] ? trace_irq_disable+0x3b/0x140 [ 776.380182][T22224] ? clear_bhb_loop+0x40/0x90 [ 776.380200][T22224] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 776.380217][T22224] RIP: 0033:0x7f9d7959ce59 [ 776.380233][T22224] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 776.380247][T22224] RSP: 002b:00007f9d7a37e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 776.380264][T22224] RAX: ffffffffffffffda RBX: 00007f9d79815fa0 RCX: 00007f9d7959ce59 [ 776.380278][T22224] RDX: 0000200000000200 RSI: 0000000000000720 RDI: 0000000000000008 [ 776.380288][T22224] RBP: 00007f9d79632d6f R08: 0000000000000000 R09: 0000000000000000 [ 776.380300][T22224] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 776.380310][T22224] R13: 00007f9d79816038 R14: 00007f9d79815fa0 R15: 00007f9d7993fa48 [ 776.380329][T22224] [ 776.385163][T22224] Kernel Offset: disabled