last executing test programs: 12.927214111s ago: executing program 4 (id=804): r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x42, 0x70) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/power/pm_trace', 0x1, 0x0) r2 = getpgrp(0xffffffffffffffff) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000100)={0x0, 0x0, 0x10001, 0x4, r2}) r3 = openat$cgroup_pressure(0xffffffffffffffff, 0x0, 0x2, 0x0) ioctl$OCFS2_IOC_RESVSP64(r3, 0x4030582a, &(0x7f0000000140)={0x1, 0x0, 0x3, 0x9, 0x8b, 0xed1}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f00000001c0), 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount$fuse(0x0, 0x0, &(0x7f0000000280), 0x404, &(0x7f0000000180)=ANY=[@ANYRESOCT=r0]) openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x1c00000, 0x200000f, 0x401d031, 0xffffffffffffffff, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, 0x0}, 0x40080c0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = syz_ublk_setup_io_uring(0xd, &(0x7f0000000400)={0x0, 0x30b5, 0x400, 0x2, 0x154}, &(0x7f0000000480)=0x0, &(0x7f00000004c0)=0x0, &(0x7f0000000540)=0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000600)={{0x14}, [@NFT_MSG_NEWTABLE={0x14, 0x0, 0xa, 0x702, 0x0, 0x0, {0x7}}, @NFT_MSG_NEWSET={0x44, 0x9, 0xa, 0x401, 0x0, 0x0, {0x3}, [@NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_EXPR={0x10, 0x11, 0x0, 0x1, @match={{0xa}, @void}}, @NFTA_SET_TIMEOUT={0xc, 0xb, 0x1, 0x0, 0x338a9c9f}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x38}]}, @NFT_MSG_DELFLOWTABLE={0x30, 0x18, 0xa, 0x801, 0x0, 0x0, {0x3}, [@NFTA_FLOWTABLE_FLAGS={0x8, 0x7, 0x1, 0x0, 0x3}, @NFTA_FLOWTABLE_FLAGS={0x8, 0x7, 0x1, 0x0, 0x1}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x7, 0x84}}}, 0xb0}, 0x1, 0x0, 0x0, 0x40000}, 0x0) syz_ublk_add_dev(r5, r6, r7, r8, &(0x7f00000006c0)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000740)=@any_dev={0x4, 0xa22, 0x0, 0x0, 0x1000, 0x2, 0x0, 0x0, 0xe0}}}, &(0x7f0000000780)=0x0) dup(r4) syz_ublk_setup_queues(r1, r11, &(0x7f00000007c0)={0x0, 0x3e80, 0x800, 0x0, 0x32c, 0x0, r5}, &(0x7f0000000840)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xd7f3, 0x200, 0x1006, 0x200015a, 0x0, r5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed7d, 0x20, 0x0, 0x2a5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x88de, 0x10000, 0x7, 0xffffffff}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x2000, 0x2, 0xbe, 0x0, r5}}], 0x1, &(0x7f0000000ac0)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x700, 0x0, {}, 0x1f, r10, '\x00', {0x4, 0x5c0, 0x0, 0x0}}, 0x0) keyctl$instantiate(0xc, 0x0, &(0x7f0000000b40)=@encrypted_new={'new ', 'default', 0x20, 'user:', 'syz', 0x20, 0x1000}, 0x2a, 0xfffffffffffffff9) add_key(&(0x7f0000000b80)='encrypted\x00', &(0x7f0000000bc0), &(0x7f0000000c00), 0xca, 0xfffffffffffffffe) keyctl$instantiate(0xc, 0x0, &(0x7f0000000c40)=@encrypted_update={'update ', 'default', 0x20, 'user:', '\x1f\t'}, 0x17, 0xfffffffffffffffd) add_key(&(0x7f0000000c80)='encrypted\x00', &(0x7f0000000cc0), &(0x7f0000000d00), 0xca, 0xfffffffffffffffe) socket$inet6_tcp(0xa, 0x1, 0x0) io_submit(0x0, 0x1, &(0x7f0000000d40)=[&(0x7f0000000d80)={0x1000000, 0x0, 0x0, 0x1, 0x6, r1, &(0x7f0000000dc0)="0162fbeafeb0e0c25205", 0xa, 0x2}]) r12 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r12, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r12, &(0x7f0000006380)={0x2020}, 0x2020) 12.274124949s ago: executing program 3 (id=808): r0 = syz_open_procfs(0x0, &(0x7f0000000040)='net/ip_vs\x00') bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000180)={@map=r0, 0x15, 0x1, 0x1b42, &(0x7f0000000000)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x6, 0x0, &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000100)=[0x0], &(0x7f0000000140)=[0x0, 0x0, 0x0, 0x0], 0x0}, 0x40) bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f00000002c0)={0x4, 0x0}, 0x8) bpf$BPF_PROG_DETACH(0x9, &(0x7f00000001c0)={@map=r0, r0, 0x34, 0x2038, 0x0, @void, @void, @value=r2, @void, r1}, 0x20) readv(r0, &(0x7f0000000080)=[{&(0x7f0000000200)=""/147, 0x93}], 0x1) 11.782001454s ago: executing program 3 (id=810): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x0, 0x0, 0x0, 0x0, 0xb49, 0xa, 0xfffffffffffffff7, 0xfffffffc, 0x3e}, 0x0) syz_clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0, 0x0) bind$rds(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x80801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x54}) r1 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r1, 0x7a7, &(0x7f00000009c0)=0x80000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r1, 0x7a0, &(0x7f0000000140)={@my=0x1}) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r1, 0x7a8, &(0x7f00000001c0)={{@host}, @host, 0x0, 0x2000000, 0x2449, 0xfffffffffffffffd}) ioctl$IOCTL_VMCI_VERSION2(r1, 0x7a7, &(0x7f00000000c0)=0xb0000) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x4}) ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000280)={&(0x7f0000800000/0x800000)=nil, &(0x7f0000199000/0x800000)=nil, 0x800000}) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000040)={0x1, 0x2, 0xf000, 0x2000, &(0x7f0000f8d000/0x2000)=nil}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r5 = add_key$keyring(&(0x7f0000000300), &(0x7f0000000340)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffe) r6 = add_key$keyring(&(0x7f0000000380), &(0x7f00000003c0)={'syz', 0x3}, 0x0, 0x0, r5) add_key(&(0x7f0000000400)='asymmetric\x00', 0x0, &(0x7f0000000440)="308201d43082017ba00302010202142eea648d7f17e62e9e5869c887c68e1bd0f86fde300a06082a8648ce3d040302303a3138303606035504030c82f5ec41d99324146361746520766572696669636174696f6e2045434453412073656c662d74657374696e67206b65793020170d3235c218ce4c3232313632365a180f32313234303332303232313632365a303a3138303606035504030c3f436572746966696361746520766572696669636174696f6e2045434453412073656c662d74206b65793059301306072a8648ce3d020106082affff00000000000042000407e56b51affc19412c88926b775771039ee2fe6e6a714ec7299f90e177189fc2e70a82d08ae181a9717c5a73fb25b95b1e248c739ff838f848b4ad1619c022c6a35d305b301d0603551d0e041604142900bcea1deb7bc8479a84a23d758efdfdd2b2d3301f0603551d230418301680142900bcea1deb7bc8479a84a23d758efdfdd2b2d330800603551d130101ff04023000300b0603551d0f040403020780300a06082a8648ce3d040302034700304402201ad7ac07c89738f489437ec7666ea5007c121db409760c996b8c265de9705cb4022073b7c77a5adb670a964219cf4f674f356aee2925f24fc810149d79691c7ad75dc74a35af50b2", 0x1d8, r6) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r7 = socket(0x400000000010, 0x3, 0x0) openat$binderfs_log(0xffffff9c, &(0x7f00000000c0)='./binderfs/binder_logs/transactions_hashed\x00', 0x0, 0x0) r8 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x42}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x5}, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000038c0)=@newtfilter={0x40, 0x2c, 0xd27, 0x70bd24, 0x25dfdbfc, {0x0, 0x0, 0x0, r9, {0x4, 0xfff3}, {}, {0x9, 0x8}}, [@filter_kind_options=@f_matchall={{0xd}, {0xc, 0x2, [@TCA_MATCHALL_CLASSID={0x8, 0x1, {0x3, 0xc}}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x10}, 0x20000000) sendmsg$nl_route_sched(r7, 0x0, 0x4041080) 11.764675396s ago: executing program 4 (id=811): socket$nl_route(0x10, 0x3, 0x0) r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000d00), 0x800, 0x0) ioctl$TIOCSSOFTCAR(r0, 0x541a, 0x0) set_mempolicy(0x8006, 0x0, 0x5) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, 0x0) syz_open_dev$vim2m(&(0x7f0000000d40), 0x8e, 0x2) r1 = socket$inet6(0xa, 0xa, 0x8) connect$inet6(r1, 0x0, 0x0) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_INITMSG(0xffffffffffffffff, 0x84, 0x2, &(0x7f0000000100), &(0x7f0000000800)=0x8) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000d80)={0x0, 0x0, &(0x7f0000000dc0)={&(0x7f0000000e00)=ANY=[@ANYBLOB="300000001000010800000000fbdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="d1889e250000000008000a00", @ANYRES32=0x0, @ANYBLOB='q'], 0x30}, 0x1, 0x0, 0x0, 0x200400c0}, 0x20040004) r4 = syz_open_dev$dri(&(0x7f0000000e40), 0xb, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000e80)={0x9, 0x5, 0x2}) mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x2000004, 0x4004012, r4, 0x100300) bind$inet(r2, &(0x7f0000000ec0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x17}}, 0x10) connect$inet(r2, &(0x7f0000000f00)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r2, &(0x7f0000000f40), 0x800001d, 0x0) setsockopt$inet6_IPV6_DSTOPTS(0xffffffffffffffff, 0x29, 0x3b, &(0x7f0000000140)=ANY=[@ANYBLOB="2b2e00000000000001020000010700000000000000040102c91000000000000000000000ffffffffffff03e05948754a1849e0ef74d52894a1f51b87141a6e6ab953b509b21085eb1f1b6bbf7a652cbf8268fd53ac6ff8005f2b36810de20d80053d35767f7096c8a902466b385510e8ac30620fe081f930fe0edf330109438335250dbcadbd2d4d25be438bd98f1e3b850f1e036bc319aaf7ef7ed6ed6b3940e8f8a0762949044913288f67ca10eade038709ffd962fafd429752b5cadb350b513e991150d44667fa1826e016943c3920c5b2c00c0c239aa6fa11c51f5bbccc4a771a3c3c1a56ae7d973b9570995d7b36f5e41888dc2d104b69a92eff085c20bede72feea40b1c15ca7abfb30bb4994cb75c5e9d6e49c20d7716f1da8dc406e9cd33f17fbd8fd5063c94d6ee516d61e6e450046863e8d741c324ef852ede17c4866c66e8323d0f5cf515bebf3500bc3ef93ff8a9fc32d67fed6370103000000040102c2040000000100"/376], 0x178) socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wg2\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r5, {0x0, 0xfff3}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x4c840) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)=@newtfilter={0x50, 0x2c, 0xf3f, 0x30bd29, 0x25dfdc01, {0x0, 0x0, 0x0, r5, {0x5, 0xfff1}, {0x0, 0xfff3}, {0x9, 0x302}}, [@filter_kind_options=@f_flower={{0xb}, {0x20, 0x2, [@TCA_FLOWER_KEY_ETH_TYPE={0x6, 0x8, 0x4}, @TCA_FLOWER_KEY_IPV6_SRC={0x14, 0xe, @private1={0xfc, 0x1, '\x00', 0x1}}]}}]}, 0x50}, 0x1, 0x0, 0x0, 0x20041891}, 0x0) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f00000004c0)={'ip6tnl0\x00', &(0x7f0000000440)={'ip6_vti0\x00', 0x0, 0x4, 0x1, 0x8, 0x8, 0x2, @remote, @mcast1, 0x8, 0x700, 0x1, 0x8000}}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000580)={'ip6gre0\x00', &(0x7f0000000500)={'syztnl0\x00', 0x0, 0x4, 0x3, 0x8, 0x1, 0x50, @mcast2, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x700, 0x8000, 0xff1, 0x2}}) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000640)={0xffffffffffffffff, 0x58, &(0x7f00000005c0)}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000700)={'syztnl1\x00', &(0x7f0000000680)={'gre0\x00', 0x0, 0x80, 0x20, 0x4, 0x7, {{0xc, 0x4, 0x1, 0x5, 0x30, 0x65, 0x0, 0x0, 0x2f, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @multicast1, {[@lsrr={0x83, 0x7, 0xf9, [@private=0xa010101]}, @ra={0x94, 0x4, 0x1}, @noop, @generic={0x82, 0xf, "dc4c122398c92b8b39d84c31a5"}]}}}}}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f00000007c0)={'syztnl2\x00', &(0x7f0000000740)={'ip6_vti0\x00', 0x0, 0x4, 0x0, 0x7, 0x1, 0x40, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @private2={0xfc, 0x2, '\x00', 0x1}, 0x8, 0x7, 0x8893, 0xffffffff}}) socket$nl_route(0x10, 0x3, 0x0) 10.136358229s ago: executing program 0 (id=814): r0 = syz_usb_connect(0x5, 0x46, &(0x7f0000000040)={{0x12, 0x1, 0x310, 0x8e, 0x3a, 0xc6, 0x20, 0x694, 0x1, 0x7813, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x34, 0x1, 0xe, 0x6, 0x10, 0x3, "", [{{0x9, 0x4, 0xe4, 0x5, 0x3, 0xb9, 0x56, 0xda, 0x2, [], [{{0x9, 0x5, 0x8, 0x0, 0x400, 0x1, 0x12, 0xfc}}, {{0x9, 0x5, 0xb, 0x0, 0x20, 0x7, 0x3, 0x9a, [@generic={0x7, 0x5, "d15b89f26d"}]}}, {{0x9, 0x5, 0x9, 0x3, 0x40, 0x7a, 0xa, 0x84}}]}}]}}]}}, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000000140)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x1c01}}, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000180)={0x24, 0x0, &(0x7f00000001c0)={0x0, 0x3, 0x2, @string={0x2}}, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000200)={0x24, 0x0, &(0x7f0000000240)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x44a}}, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000280)={0x2c, &(0x7f00000002c0)={0x40, 0x8, 0x8, "003cb3a4aa50323f"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000300)={0x84, &(0x7f00000003c0)={0x40, 0x14, 0x4, "008b35a5"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000440)=""/99, 0x63) write$char_usb(r1, 0x0, 0x0) 9.330043311s ago: executing program 3 (id=816): r0 = socket$netlink(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000c40)={&(0x7f0000000c80)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x98, 0x6, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x6c, 0x4, 0x0, 0x1, [{0x68, 0x1, 0x0, 0x1, @match={{0xa}, @val={0x58, 0x2, 0x0, 0x1, [@NFTA_MATCH_NAME={0xe, 0x1, 'hashlimit\x00'}, @NFTA_MATCH_REV={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_MATCH_INFO={0x3c, 0x3, "2e6f00000000000000000000000000002000000010270000050000001000000010000000e8030000e8030000202000"/56}]}}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x10c}}, 0x0) (fail_nth: 1) 8.623979914s ago: executing program 1 (id=818): r0 = syz_open_dev$loop(&(0x7f0000000000), 0x100, 0x80000) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040), 0x483, 0x0) ioctl$RTC_UIE_ON(r1, 0x7003) ioctl$RTC_WKALM_SET(r1, 0x4028700f, &(0x7f0000000080)={0x1, 0x3, {0x0, 0x22, 0xd, 0x17, 0x3, 0x800, 0x1, 0x5a, 0x1}}) ioctl$RTC_AIE_OFF(r1, 0x7002) r2 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$LOOP_SET_FD(r0, 0x4c00, r2) r3 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet6_int(r3, 0x29, 0x4e, &(0x7f00000000c0)=0x1, 0x4) bind$inet6(r3, &(0x7f0000000100)={0xa, 0x4e22, 0x80, @loopback={0x0, 0xa8aaaafffeaaaa1e}, 0x8000}, 0x1c) r4 = socket$netlink(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000c40)={&(0x7f0000000c80)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x30, 0x6, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x4}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0xa4}}, 0x0) 8.533221413s ago: executing program 3 (id=819): socket$inet6_sctp(0xa, 0x801, 0x84) socket$nl_xfrm(0x10, 0x3, 0x6) r0 = openat$nsim_new_device(0xffffff9c, &(0x7f0000000000), 0x1, 0x0) write$nsim_new_device(r0, &(0x7f0000000080)={0x0, 0x20, 0x33, 0x20, 0x33}, 0x5) socket$nl_generic(0x10, 0x3, 0x10) syz_open_dev$loop(&(0x7f00000000c0), 0x4, 0x200002) msgrcv(0x0, 0x0, 0x0, 0x0, 0xa1e3a9fe3eb9c551) socket$unix(0x1, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x802) socket$pppl2tp(0x18, 0x1, 0x1) openat$fuse(0xffffffffffffff9c, &(0x7f0000000200), 0x42, 0x0) socket$packet(0x11, 0x3, 0x300) socket(0x10, 0x3, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket$packet(0x11, 0x2, 0x300) socket$inet_tcp(0x2, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x10, 0x803, 0x0) r1 = socket$key(0xf, 0x3, 0x2) syz_usb_connect$uac1(0x3, 0xdc, &(0x7f0000000700)=ANY=[@ANYBLOB="12010000000000106b1d01014000010203010902ca0003010070000904000000010100000a24010800000201020d240600000308", @ANYRES8=r1, @ANYBLOB='\a'], 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), r2) sendmsg$NL80211_CMD_START_AP(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01022abd7000000000000f00000008000300", @ANYRES32=0x0, @ANYBLOB="0c009900000000002500000029000e002a23"], 0x54}, 0x1, 0x0, 0x0, 0x20000050}, 0x48000) 8.398633894s ago: executing program 0 (id=820): r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000a40)='net\x00') seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0) fchdir(r0) r1 = openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='.\x00', 0x40000, 0x0) fcntl$notify(r1, 0x402, 0x40000029) r2 = open(&(0x7f0000000140)='.\x00', 0x163100, 0x0) getdents64(r2, 0x0, 0x0) 8.143063141s ago: executing program 4 (id=821): socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)) (async) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000c80)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f0000000d00)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000010000000900010073797a300000000034000000030a010200000000000000000100fffb0900030073797a3236ad00000900010073797a300000000008000a400000000420000000080a01080000040000000000010000000900010073797a30"], 0x9c}, 0x1, 0x0, 0x0, 0x4000884}, 0x4) (async, rerun: 64) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000140)=ANY=[@ANYBLOB="00082dbd7000fbd8df25"], 0x14}, 0x1, 0x0, 0x0, 0x8004}, 0xa4) (rerun: 64) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x8000, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r3 = socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x12, 0x0, 0x0, 0x0, 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) sendmsg$nl_route(r3, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000840)=ANY=[@ANYBLOB="200000006900030000000000000000000000000000c48400080001"], 0x20}}, 0x4000040) (async) listns(&(0x7f0000000000)={0x20, 0x0, 0x5, 0x40000000, 0x0, 0x3}, 0x0, 0x0, 0x0) (async, rerun: 32) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) (async, rerun: 32) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080), r4) syz_usb_connect$uac2(0x2, 0x7b, &(0x7f0000000bc0)={{0x12, 0x1, 0x250, 0x0, 0x0, 0x0, 0x10, 0x1235, 0x8211, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x69, 0x3, 0x1, 0x7, 0x0, 0x9, {0x8, 0xb, 0x0, 0x1, 0x1, 0x9, 0x20, 0x40}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x8, 0x6, 0x9}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x10, 0x2, 0x0, 0xfe, {0x8, 0x25, 0x1, 0x2, 0x3, 0xc8, 0x7ff}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x10, 0x9, 0xf, 0x3, {0x8, 0x25, 0x1, 0x81, 0x14, 0xfb, 0x1}}}}}}}}]}}, &(0x7f0000000c40)={0x0, 0x0, 0x0, 0x0}) sendmsg$TIPC_CMD_GET_LINKS(r4, &(0x7f0000000200)={0x0, 0xa6, &(0x7f0000000240)={&(0x7f0000000280)={0x24, r5, 0x1, 0x70bd29, 0x25dfdbff, {{}, {}, {0x8, 0x11, 0x6}}}, 0x24}, 0x1, 0x0, 0x0, 0xc0}, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) (async) r7 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000300), 0xffffffffffffffff) r8 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000880), 0xc0202, 0x0) writev(r8, &(0x7f00000008c0)=[{&(0x7f0000000900)="e406247cce54f1bf1e68fde89a67b3dfea3060f92bb7f4243fda118f4f153550b02022b6f8d5148b465b98fd98f7bd9cc44c9631e975f0552476c44f6c2e85c70acfd0ee1d4a2486d002534cf671599667b69c27d027198b6e4369905809d7df3c37513302ccaf882c23b2ddc05506f68d138c17c039f397c4d0c911c794cb1e7edb8e9d822f3409078cad3ec5f1b3c04ea91cf1371d13496bf89170b951b39ee0a60c91a0c9e339165c209da032c42733c037e500a37c14c9c092ff95988e88d79fd27a90968b436dd98f842300c363878a55b86f0caf802c06ca3c69bcbfff80c9492d264c4e90c0758cbbf313c3824b97af8a787ac54aea77f1128e2b65c13cb6d8f465f2da8d1b6b5c871a14647244e3f4f44241a02e49ae978c1a5a8a78bd727455136f9524d086ee15d3d5b29ca5d2b112136fa5663c0fcdec7e491d0eae70dad83bb95100e05619fdce4b689cd98a13c281f0c0f0358631f3789f982e9ead2881377b706a198a85c65a0b4473e96adc7b8d247df03db08ee9c3eb966db91b1248174389ad7591c00e8862c604b99c69d6e8410d26fb467056d64794c9feec3b8a90180d57922dd4684d6b39b454aba577ec24da7a957366803fc8083573e7aed698172719a4968fa8e9e23ec939ba27eaeabb3bb2d1e0112f4e3b2ef9d68d808dcb1f4c6cb60aa659f26e8e1682ad13d85a3a3147415a18c1bb746bbf", 0x20000}, {0x0, 0x20000}], 0x2) (async, rerun: 32) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000dc0)='cpu.stat\x00', 0x275a, 0x0) (async, rerun: 32) io_setup(0xa, &(0x7f0000000e00)=0x0) (async) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) io_submit(r10, 0x2, &(0x7f0000000e40)=[&(0x7f0000000e80)={0x0, 0x0, 0x0, 0x1, 0x3, r11, 0x0, 0x0, 0x2, 0x0, 0x0, r9}, &(0x7f0000000ec0)={0x0, 0x0, 0x0, 0x3, 0x4, r9, 0x0, 0x0, 0x850, 0x0, 0x0, r9}]) syz_usb_connect(0x5, 0x24, &(0x7f0000000b00)={{0x12, 0x1, 0x200, 0x3e, 0x89, 0x69, 0x10, 0x5032, 0xbc7, 0xf4ca, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x9, 0x7a, 0x80, 0x2, "", [{{0x9, 0x4, 0x6e, 0x8f, 0x0, 0x96, 0xa4, 0x89, 0x9}}]}}]}}, 0x0) (async) sendmsg$IPVS_CMD_GET_SERVICE(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000500)={0x30, r7, 0x10, 0x70bd27, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_DEST={0xc, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x4}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x3}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x3}]}, 0x30}, 0x1, 0x0, 0x0, 0x4011}, 0x0) (async, rerun: 64) sendmsg$IPVS_CMD_DEL_DAEMON(r4, &(0x7f00000006c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000680)={&(0x7f0000000540)={0x104, r7, 0x400, 0x70bd29, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x40}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xb3f}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x7}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x3ff}]}, @IPVS_CMD_ATTR_DAEMON={0x54, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @remote}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @mcast1}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x8}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x1}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @ipv4={'\x00', '\xff\xff', @local}}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e24}]}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@mcast1}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x5}]}, @IPVS_CMD_ATTR_DAEMON={0x48, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x4}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'dvmrp0\x00'}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0xf7}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0xe6}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x100}]}]}, 0x104}, 0x1, 0x0, 0x0, 0xd87a3052c16e5291}, 0x800) (async, rerun: 64) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000440)=[@text64={0x40, &(0x7f0000000180)="66baa000ecc744240011000000c7442402b16e0000ff2c2443f466baf80cb8f2c96789ef66bafc0c66ed0f072e0f01c248b820450000000000000f23d00f21f835000000010f23f8c46289900cabb9f9080000b8c93c0000ba000000000f30c4816857a601000000", 0x68}], 0x1, 0x4, 0x0, 0x0) (async) openat$ttyprintk(0xffffff9c, &(0x7f0000000b40), 0x0, 0x0) 7.909120024s ago: executing program 2 (id=822): r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x42, 0x70) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/power/pm_trace', 0x1, 0x0) r2 = getpgrp(0xffffffffffffffff) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000100)={0x0, 0x0, 0x10001, 0x4, r2}) r3 = openat$cgroup_pressure(0xffffffffffffffff, 0x0, 0x2, 0x0) ioctl$OCFS2_IOC_RESVSP64(r3, 0x4030582a, &(0x7f0000000140)={0x1, 0x0, 0x3, 0x9, 0x8b, 0xed1}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f00000001c0), 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount$fuse(0x0, 0x0, &(0x7f0000000280), 0x404, &(0x7f0000000180)=ANY=[@ANYRESOCT=r0]) openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x1c00000, 0x200000f, 0x401d031, 0xffffffffffffffff, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, 0x0}, 0x40080c0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = syz_ublk_setup_io_uring(0xd, &(0x7f0000000400)={0x0, 0x30b5, 0x400, 0x2, 0x154}, &(0x7f0000000480)=0x0, &(0x7f00000004c0)=0x0, &(0x7f0000000540)=0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000600)={{0x14}, [@NFT_MSG_NEWTABLE={0x14, 0x0, 0xa, 0x702, 0x0, 0x0, {0x7}}, @NFT_MSG_NEWSET={0x44, 0x9, 0xa, 0x401, 0x0, 0x0, {0x3}, [@NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_EXPR={0x10, 0x11, 0x0, 0x1, @match={{0xa}, @void}}, @NFTA_SET_TIMEOUT={0xc, 0xb, 0x1, 0x0, 0x338a9c9f}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x38}]}, @NFT_MSG_DELFLOWTABLE={0x30, 0x18, 0xa, 0x801, 0x0, 0x0, {0x3}, [@NFTA_FLOWTABLE_FLAGS={0x8, 0x7, 0x1, 0x0, 0x3}, @NFTA_FLOWTABLE_FLAGS={0x8, 0x7, 0x1, 0x0, 0x1}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x7, 0x84}}}, 0xb0}, 0x1, 0x0, 0x0, 0x40000}, 0x0) syz_ublk_add_dev(r5, r6, r7, r8, &(0x7f00000006c0)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000740)=@any_dev={0x4, 0xa22, 0x0, 0x0, 0x1000, 0x2, 0x0, 0x0, 0xe0}}}, &(0x7f0000000780)=0x0) dup(r4) syz_ublk_setup_queues(r1, r11, &(0x7f00000007c0)={0x0, 0x3e80, 0x800, 0x0, 0x32c, 0x0, r5}, &(0x7f0000000840)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xd7f3, 0x200, 0x1006, 0x200015a, 0x0, r5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed7d, 0x20, 0x0, 0x2a5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x88de, 0x10000, 0x7, 0xffffffff}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x2000, 0x2, 0xbe, 0x0, r5}}], 0x1, &(0x7f0000000ac0)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x700, 0x0, {}, 0x1f, r10, '\x00', {0x4, 0x5c0, 0x0, 0x0}}, 0x0) keyctl$instantiate(0xc, 0x0, &(0x7f0000000b40)=@encrypted_new={'new ', 'default', 0x20, 'user:', 'syz', 0x20, 0x1000}, 0x2a, 0xfffffffffffffff9) add_key(&(0x7f0000000b80)='encrypted\x00', &(0x7f0000000bc0), &(0x7f0000000c00), 0xca, 0xfffffffffffffffe) keyctl$instantiate(0xc, 0x0, &(0x7f0000000c40)=@encrypted_update={'update ', 'default', 0x20, 'user:', '\x1f\t'}, 0x17, 0xfffffffffffffffd) add_key(&(0x7f0000000c80)='encrypted\x00', &(0x7f0000000cc0), &(0x7f0000000d00), 0xca, 0xfffffffffffffffe) socket$inet6_tcp(0xa, 0x1, 0x0) io_submit(0x0, 0x1, &(0x7f0000000d40)=[&(0x7f0000000d80)={0x1000000, 0x0, 0x0, 0x1, 0x6, r1, &(0x7f0000000dc0)="0162fbeafeb0e0c25205", 0xa, 0x2}]) r12 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r12, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r12, &(0x7f0000006380)={0x2020}, 0x2020) 7.903028285s ago: executing program 1 (id=823): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x0, 0x0, 0x0, 0x0, 0xb49, 0xa, 0xfffffffffffffff7, 0xfffffffc, 0x3e}, 0x0) syz_clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0, 0x0) bind$rds(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x80801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x54}) r1 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r1, 0x7a7, &(0x7f00000009c0)=0x80000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r1, 0x7a0, &(0x7f0000000140)={@my=0x1}) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r1, 0x7a8, &(0x7f00000001c0)={{@host}, @host, 0x0, 0x2000000, 0x2449, 0xfffffffffffffffd}) ioctl$IOCTL_VMCI_VERSION2(r1, 0x7a7, &(0x7f00000000c0)=0xb0000) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x4}) ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000280)={&(0x7f0000800000/0x800000)=nil, &(0x7f0000199000/0x800000)=nil, 0x800000}) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000040)={0x1, 0x2, 0xf000, 0x2000, &(0x7f0000f8d000/0x2000)=nil}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r5 = add_key$keyring(&(0x7f0000000300), &(0x7f0000000340)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffe) r6 = add_key$keyring(&(0x7f0000000380), &(0x7f00000003c0)={'syz', 0x3}, 0x0, 0x0, r5) add_key(&(0x7f0000000400)='asymmetric\x00', 0x0, &(0x7f0000000440)="308201d43082017ba00302010202142eea648d7f17e62e9e5869c887c68e1bd0f86fde300a06082a8648ce3d040302303a3138303606035504030c82f5ec41d99324146361746520766572696669636174696f6e2045434453412073656c662d74657374696e67206b65793020170d3235c218ce4c3232313632365a180f32313234303332303232313632365a303a3138303606035504030c3f436572746966696361746520766572696669636174696f6e2045434453412073656c662d74206b65793059301306072a8648ce3d020106082affff00000000000042000407e56b51affc19412c88926b775771039ee2fe6e6a714ec7299f90e177189fc2e70a82d08ae181a9717c5a73fb25b95b1e248c739ff838f848b4ad1619c022c6a35d305b301d0603551d0e041604142900bcea1deb7bc8479a84a23d758efdfdd2b2d3301f0603551d230418301680142900bcea1deb7bc8479a84a23d758efdfdd2b2d330800603551d130101ff04023000300b0603551d0f040403020780300a06082a8648ce3d040302034700304402201ad7ac07c89738f489437ec7666ea5007c121db409760c996b8c265de9705cb4022073b7c77a5adb670a964219cf4f674f356aee2925f24fc810149d79691c7ad75dc74a35af50b2", 0x1d8, r6) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r7 = socket(0x400000000010, 0x3, 0x0) openat$binderfs_log(0xffffff9c, &(0x7f00000000c0)='./binderfs/binder_logs/transactions_hashed\x00', 0x0, 0x0) r8 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x42}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x5}, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000038c0)=@newtfilter={0x40, 0x2c, 0xd27, 0x70bd24, 0x25dfdbfc, {0x0, 0x0, 0x0, r9, {0x4, 0xfff3}, {}, {0x9, 0x8}}, [@filter_kind_options=@f_matchall={{0xd}, {0xc, 0x2, [@TCA_MATCHALL_CLASSID={0x8, 0x1, {0x3, 0xc}}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x10}, 0x20000000) sendmsg$nl_route_sched(r7, &(0x7f0000006040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20000801}, 0x4041080) 6.531841295s ago: executing program 0 (id=824): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=@deltaction={0x30, 0x18, 0x3, 0x70bd29, 0x25dfdbfe, {0xa}, [@TCA_ACT_TAB={0x1c, 0x1, [{0xc, 0x80, 0x0, 0x0, @TCA_ACT_INDEX={0x8}}, {0xc, 0x5, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'nat\x00'}}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x4000}, 0x0) 6.41837871s ago: executing program 3 (id=825): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00800000000000000000fcffffffff82d60cbf9349a3640000000000"], 0x50) r1 = signalfd4(r0, &(0x7f0000000240)={[0x2, 0x1]}, 0x8, 0x0) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f00000027c0), 0x1c3902, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendfile(r2, r2, 0x0, 0x20000005) openat$nullb(0xffffffffffffff9c, 0x0, 0xa4242, 0x0) sched_setattr(0x0, &(0x7f0000002800)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000002840)=0x0) sched_getattr(r3, 0x0, 0x0, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000094d000/0x3000)=nil) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) timer_create(0x0, &(0x7f0000002880)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f00000028c0)=0x0) bpf$MAP_CREATE(0x0, &(0x7f0000002900)=ANY=[@ANYBLOB="230000000800000002000000ffff000005"], 0x48) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000002940)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r5, 0x1, &(0x7f0000002980)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f00000a7000/0x4000)=nil, 0x4000, 0x200000b, 0x10, r1, 0xdad89000) mkdirat(0xffffffffffffff9c, &(0x7f00000029c0)='./file0\x00', 0x1c0) open(&(0x7f0000002a00)='.\x00', 0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) syz_usb_connect(0x0, 0x36, &(0x7f0000002a40)=ANY=[@ANYBLOB], 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) rename(0x0, &(0x7f0000002a80)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') close_range(r4, 0xffffffffffffffff, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f00000004c0)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) ioctl$SG_BLKTRACESETUP(r1, 0xc0401273, &(0x7f0000002500)={'\x00', 0x7, 0x699, 0x100, 0x2, 0x80000000, r6}) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x13, &(0x7f0000000140)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x107a655, 0x0, 0x0, 0x0, 0xeffffffc}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x3}}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r7, 0xfca804a0, 0x10, 0x38, &(0x7f00000003c0)="b800000500000000", &(0x7f0000000400)=""/8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) 6.359490252s ago: executing program 2 (id=826): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000031c0), 0x80, 0x0) close(r0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000003200), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r1, 0xc004743e, 0x110e22fff6) ioctl$TUNGETVNETLE(r0, 0x4004743c, &(0x7f0000003240)) 5.557866178s ago: executing program 0 (id=827): mmap(&(0x7f0000384000/0x3000)=nil, 0x3000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000000000/0x9000)=nil, 0x600002, 0x600002, 0x7, &(0x7f0000a00000/0x600000)=nil) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="090d2000000000f0ff000700d84589e4a539", @ANYRES32=r2, @ANYRES32=r0], 0x58}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000140), 0x88002, 0x0) pwritev(r3, &(0x7f0000000180)=[{&(0x7f00000001c0)='X', 0x1}], 0x35, 0x72, 0x40000) openat$cgroup_subtree(r3, &(0x7f0000000200), 0x2, 0x0) mbind(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1, 0x0, 0x0, 0x0) 5.332442016s ago: executing program 1 (id=828): openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r1, 0x11b, 0x4, &(0x7f0000000340)={&(0x7f0000000000)=""/62, 0x328000, 0x800, 0x9, 0x3}, 0x20) setsockopt$XDP_UMEM_COMPLETION_RING(r1, 0x11b, 0x6, &(0x7f0000000080)=0x1, 0x4) setsockopt$XDP_RX_RING(r1, 0x11b, 0x2, &(0x7f0000001980)=0x100, 0x4) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000580)={'batadv_slave_1\x00', 0x0}) setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, &(0x7f0000000300)=0x2, 0x4) socket$nl_generic(0x10, 0x3, 0x10) syz_open_dev$usbmon(&(0x7f0000000040), 0x40, 0x440) add_key$fscrypt_v1(0x0, &(0x7f0000000380)={'fscrypt:', @desc1}, &(0x7f0000000080)={0x0, "4d0916cb7a186d2a2e55ba48ad3f796547502777ff87f76b395c692150689bb4a628a9f3aa873e97ebd2a2089456afed727eaa0e6eaaad8669a20c12ac48c3fc", 0x2f}, 0x48, 0xffffffffffffffff) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000480), 0x141c80, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000180)={0x1, 0x1, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f00000003c0)={[0x60000000004, 0x1000000000, 0x5, 0x41, 0x2000000, 0x0, 0x2004cb, 0x0, 0xa1d, 0x2000000068ff, 0x5, 0x0, 0x3, 0x2], 0x10000, 0x202}) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_SET_SREGS(r5, 0x4138ae84, &(0x7f0000000100)={{0xd000, 0x0, 0x4, 0x0, 0x8, 0x0, 0xfc, 0x3, 0x0, 0x8, 0x6, 0x40}, {0x4, 0x10000, 0xa, 0x3, 0x2, 0x0, 0x0, 0x0, 0x7, 0xff}, {0xe6ee2000, 0x3000, 0xc, 0x0, 0x8, 0xc4, 0x0, 0x0, 0x48, 0x3, 0x0, 0xfc}, {0xeeef0000, 0xeee96000, 0xa, 0x0, 0x1, 0xa6, 0x9, 0x0, 0x8, 0xfe, 0x7, 0x4}, {0xf000, 0xffff1000, 0xe, 0x0, 0x0, 0xde, 0x0, 0xfd, 0x0, 0x3c}, {0x8000000, 0x0, 0xb, 0x78, 0x5, 0x2, 0x0, 0x0, 0x3, 0xff, 0x1}, {0x0, 0xeeee0000, 0xa, 0x4, 0x0, 0x0, 0xa1, 0x20, 0x0, 0x0, 0x8}, {0x81a0002, 0x6000, 0xf, 0x0, 0x0, 0x5, 0x8, 0x40, 0x26, 0x0, 0x0, 0x2}, {0x41000, 0x8cc}, {0xdddd1000}, 0xddf8ffdb, 0x0, 0x0, 0x114, 0xd, 0x0, 0x0, [0x80000005, 0x8, 0x1]}) ioctl$KVM_RUN(r5, 0xae80, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) r6 = syz_open_procfs$pagemap(0x0, &(0x7f0000001080)) set_mempolicy(0x4005, &(0x7f00000002c0)=0x80000004, 0x7) getsockopt$inet_sctp6_SCTP_ADAPTATION_LAYER(0xffffffffffffffff, 0x84, 0x7, &(0x7f0000000240), &(0x7f0000000280)=0x4) r7 = socket(0x15, 0x80005, 0x0) getsockopt(r7, 0x200000000114, 0x271a, 0xffffffffffffffff, &(0x7f0000000000)=0x7ffff000) ioctl$PAGEMAP_SCAN(r6, 0xc0606610, &(0x7f00000001c0)={0x60, 0x0, &(0x7f0000087000/0x3000)=nil, &(0x7f0000678000/0x3000)=nil, 0x6948, 0x0, 0x0, 0x3ff, 0x0, 0x0, 0x3}) bind$xdp(r1, &(0x7f0000000100)={0x2c, 0x0, r2}, 0x10) 5.320289074s ago: executing program 2 (id=829): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x3, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x8, 0x0, 0x0, 0xd, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) setsockopt(0xffffffffffffffff, 0xff, 0x24, 0x0, 0x0) syz_clone(0x20000, &(0x7f00000002c0), 0x0, 0x0, 0x0, 0x0) sendmsg$IPCTNL_MSG_CT_GET_UNCONFIRMED(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x90}, 0x40) r1 = openat$vim2m(0xffffffffffffff9c, &(0x7f00000007c0), 0x2, 0x0) ioctl$vim2m_VIDIOC_S_FMT(r1, 0xc0d05605, &(0x7f0000000880)={0x1, @vbi={0x174, 0xfffff800, 0x31384142, 0x3136564e, [0x6, 0xa], [0x0, 0x741], 0x1}}) r2 = syz_open_dev$vim2m(&(0x7f0000000080), 0x2, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r2, 0xc0405602, &(0x7f0000000140)={0x7, 0x1, 0x4, "3a000000000016d613b40c2a36a6000000000002000000ff00", 0x38414261}) r3 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000680)={&(0x7f0000000380)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000cf7f329caaf00f254503510906088c04e6f96d4b3795741774c0b34323f95d8de0000000000001201005b98e0317e15459c87ba2c7aeec78c4e79f5e60f995c40f677544d7175694544df334b8913750d484665e022ffed1d298ba52e51083cedee5202530ba54b82a1f1d3af339976ce"], &(0x7f0000000580)=""/197, 0x2b, 0xc5, 0x1, 0x6, 0x10000}, 0x28) bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYRES32=r3, @ANYBLOB='!\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00!\x00\x00\x00\x00\x00\x00\x00', @ANYBLOB="0300"/20, @ANYRES32=0x0, @ANYRES64=r3, @ANYBLOB="050000000200000004000000000000000000000000000000000000d1"], 0x50) setsockopt$inet6_udp_encap(r0, 0x11, 0x64, 0x0, 0x0) syz_pidfd_open(0x0, 0x0) ioctl$FAT_IOCTL_GET_VOLUME_ID(0xffffffffffffffff, 0x80047213, &(0x7f0000000240)) r4 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000040), 0xc400) write$binfmt_aout(r4, 0x0, 0x31c8) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)) socket$inet6_tcp(0xa, 0x1, 0x0) r5 = dup(0xffffffffffffffff) r6 = socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$sock_SIOCETHTOOL(r6, 0x8946, &(0x7f00000000c0)={'netdevsim0\x00', &(0x7f00000002c0)=@ethtool_pauseparam={0x3d}}) syz_usb_connect(0x5, 0x53, &(0x7f0000000000)=ANY=[@ANYBLOB="120110038e3ac6209406010013780102030109024100020e061003090439d8011adaa80905090000000709800904e40503b956da02"], &(0x7f0000000a40)={0x0, 0x0, 0x0, 0x0}) socket$inet6(0xa, 0x3, 0x9) fsconfig$FSCONFIG_SET_STRING(r5, 0x1, &(0x7f0000000ac0)='g\xf1`', &(0x7f0000000f40)='0\x00#\x00\xd0\x00 \x00\x001S\x00\x00\x00\x00\x00\x00\x00\x00$\xf6_\xbdI\x1c\xf2\xa9]\xcc\xe0*\xef\x01\x8d\x15\xd2h\x93\xc9\xb57\xc3\xea\\Eb\xf8\xe6,\xdf\xd4\xfae\x84\xcc\xd5\"d\xf0\xc4-\x98\x9f\x81{\xfc$\xc4\xbcF\xf8\xc8\x8d\xcb\xb8\xf2\x1e\xe4\'U\xb3\xb8\xd3\xe6\xd7\x80Y\xc2\xeb\n\xb8_\xe8\x96YY\xe3\xc7\xe6\xf28\x19\xa6\xa7\xfa\xdb\x1ce\xc1\x03\x86J\xb2fh\x19\xee\xb4?\xc3nh#\xcc\x0f\xed\xfea\xdc\x88\xcb%bW\xd35\xda=\xac\x1d\xae\x93\xfd\'T6\x94\n\xa4\x9cU\xc4\fA~[\xbf\x8b\x90\xfe\x04\xe7U\xf3h\x81\x14l7u\x95\x96t\\\x0f\xef;\x03\xa4C\xbc(Vc!a\xc1\xde9\xc6b\x905\xf8\xc9@h\x01\xf5\xcb\x88\xdf9\xaf5\xc8a:z\xe4\xcbag&67\x814\xf6}\xe10v6l\xd6,\x1e\xa0\xcc\xbf\xfdkm\b?\x839\x85N\x1c\xc1\xcb\xfc\x85\xd2\n\xff\"\xf2\x81g\x90\x01n%\x7f_\xe1.f>>\xa5\xfb\"\xab\xdb\x06\x12e\x14\x11~\x9f\bR-\x85\xc3\xa9\xe6\xf6R\x11\"\xc3\xc9\xfc\x14s X\xec\xdd\xc2qB\x85\xf0\xd7\x04\xdd<\x9a\x84\'\xa3\xf1\xd9<\xb9kj\xfb\x91^\xcba\xbfU\xf8\xad8\xf0?\xd9\xca&\x02d\xc6\xf1\a\x1e/h\xca\xc3m\x1fF\xca\xfa\x8dU\x8b5\xb3=~-\xe8p\xd2o~\a\xde\x0e\xe1\xc8\x18\x9b\x7fV\xf5\xafQ\\\x91\xa5\xaf\xa3\xabde!\xeb\xab\xa2\xff\x10\x01\xf14,Z3\xfbE\xc3\x8fx\xebnZ\x836A>X\xa2\xc3\x7f\x15C6\xfc9\xa3{\n\xf1\xaf\xfe2\x13\xa4j.\x15\xbbj\x13\x06sz\xcf\xfd\x04k\x04=\x9d\xe8}\xd19\v\r\x9a\xe5\x96\xb1B@x\x92S\x8c\xe7:\xc0&\xe7^i\x92Wn\xb2(\xad\xc1\x04i\\\xb2\xd2\x04P)\xea.\x9c\n\xf3\xb2\xdcv~\f~\xf2\xf5L\x93T\xb6w\xac\x90K\xf4\xc8t\x10\xa6\f\xd3=\x9c\x0e\x7f>Ha\xe7\xbcGz(', 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$NL80211_CMD_START_AP(r5, &(0x7f0000000340)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x80000000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x22d00}, 0x24004010) socket(0x2, 0x80805, 0x0) openat$nullb(0xffffffffffffff9c, 0x0, 0x400000000a882, 0x0) 4.988974323s ago: executing program 4 (id=830): r0 = syz_usb_connect(0x5, 0x46, &(0x7f0000000040)={{0x12, 0x1, 0x310, 0x8e, 0x3a, 0xc6, 0x20, 0x694, 0x1, 0x7813, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x34, 0x1, 0xe, 0x6, 0x10, 0x3, "", [{{0x9, 0x4, 0xe4, 0x5, 0x3, 0xb9, 0x56, 0xda, 0x2, [], [{{0x9, 0x5, 0x8, 0x0, 0x400, 0x1, 0x12, 0xfc}}, {{0x9, 0x5, 0xb, 0x0, 0x20, 0x7, 0x3, 0x9a, [@generic={0x7, 0x5, "d15b89f26d"}]}}, {{0x9, 0x5, 0x9, 0x3, 0x40, 0x7a, 0xa, 0x84}}]}}]}}]}}, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000000140)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x1c01}}, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000180)={0x24, 0x0, &(0x7f00000001c0)={0x0, 0x3, 0x2, @string={0x2}}, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000200)={0x24, 0x0, &(0x7f0000000240)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x44a}}, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000280)={0x2c, &(0x7f00000002c0)={0x40, 0x8, 0x8, "003cb3a4aa50323f"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000300)={0x84, &(0x7f00000003c0)={0x40, 0x14, 0x4, "008b35a5"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000440)=""/99, 0x63) write$char_usb(r1, 0x0, 0x0) 3.229282571s ago: executing program 2 (id=831): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000680)=ANY=[@ANYBLOB="18000000260001031dbd7002fadbdf25010000000400ae"], 0x18}}, 0x2000c804) recvmmsg(r0, &(0x7f00000018c0)=[{{0x0, 0x0, &(0x7f0000001a80)=[{&(0x7f0000001ac0)=""/138, 0x8a}, {&(0x7f0000001b80)=""/209, 0xd1}, {&(0x7f0000001c80)=""/4092, 0xffc}, {&(0x7f0000002c80)=""/258, 0x102}], 0x4}, 0x2}, {{0x0, 0x0, 0x0}, 0x3}, {{0x0, 0x0, 0x0}, 0x2}, {{0x0, 0x0, 0x0}, 0x5}, {{0x0, 0x0, 0x0}, 0x1}], 0x5, 0x0, 0x0) socket$kcm(0x29, 0x0, 0x0) 2.821671305s ago: executing program 3 (id=832): syz_usb_control_io$sierra_net(0xffffffffffffffff, &(0x7f0000000340)={0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="0010dd"], 0x0}, 0x0) r0 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000000)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000080)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f00000001c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$EVIOCGMASK(r1, 0x5b03, 0x0) 2.753382889s ago: executing program 1 (id=833): r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000040), 0x0, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0], 0x0, 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000280)='./file0\x00', 0x0, 0x100000, 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x89901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) open_tree(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x89901) r2 = getpid() r3 = syz_pidfd_open(r2, 0x0) setns(r3, 0x24020000) mount_setattr(0xffffffffffffff9c, &(0x7f0000000180)='.\x00', 0x8000, &(0x7f0000001dc0)={0x8, 0x70, 0x80000}, 0x20) 2.515712146s ago: executing program 2 (id=834): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000000000)={0x0, 0x4, 0x8, 0x6, 0x0, 0x0, 0x3, 0x0, 0x1, 0x1, 0x0, 0x10}, 0xe) shutdown(r0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_int(r2, 0x0, 0x17, &(0x7f0000000140)=0xff, 0x2) sendmsg$NFT_BATCH(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="14000000100001000000000000000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000170900010073797a31000000000900030073797a3200000000140000001100010000000000"], 0x7c}}, 0x2000c450) r3 = socket$rds(0x15, 0x5, 0x0) setsockopt$RDS_RECVERR(r3, 0x114, 0x5, &(0x7f0000000280)=0x1, 0x4) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000002c0)={'team_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000c00)=@deltfilter={0x21d4, 0x2d, 0x400, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r5, {0xfff9, 0x2}, {0xc, 0xa}, {0xffe1, 0xa}}, [@filter_kind_options=@f_flow={{0x9}, {0x1ab4, 0x2, [@TCA_FLOW_POLICE={0x10, 0xa, 0x0, 0x1, [@TCA_POLICE_RATE64={0xc, 0x8, 0x9}]}, @TCA_FLOW_EMATCHES={0x204, 0xb, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x9}}, @TCA_EMATCH_TREE_LIST={0x70, 0x2, 0x0, 0x1, [@TCF_EM_IPSET={0x10, 0x3, 0x0, 0x0, {{0x5, 0x8, 0x3}, {0xffffffffffffffff, 0x5, 0x2}}}, @TCF_EM_CMP={0x18, 0x2, 0x0, 0x0, {{0x9, 0x1, 0x3}, {0x2, 0x7, 0x7, 0x0, 0x0, 0x0, 0x2}}}, @TCF_EM_NBYTE={0x18, 0x1, 0x0, 0x0, {{0x3, 0x2, 0x4}, {0x1, 0x7, 0x0, "a88a13c8d5642d"}}}, @TCF_EM_CANID={0x14, 0x1, 0x0, 0x0, {{0x9, 0x7, 0x1ea}, {{0x3, 0x1, 0x0, 0x1}, {0x0, 0x1, 0x1}}}}, @TCF_EM_CMP={0x18, 0x1, 0x0, 0x0, {{0xff, 0x1, 0x3ff}, {0x18e1b1b8, 0x9, 0x4, 0x1, 0x8, 0x0, 0x2}}}]}, @TCA_EMATCH_TREE_LIST={0x14, 0x2, 0x0, 0x1, [@TCF_EM_NBYTE={0x10, 0x2, 0x0, 0x0, {{0x286, 0x2, 0x6}, {0x4, 0x0, 0x1}}}]}, @TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x7}}, @TCA_EMATCH_TREE_LIST={0x16c, 0x2, 0x0, 0x1, [@TCF_EM_NBYTE={0x18, 0x1, 0x0, 0x0, {{0xc34a, 0x2, 0x80}, {0x70a7, 0x7, 0x1, "15f8538af660f2"}}}, @TCF_EM_NBYTE={0x18, 0x1, 0x0, 0x0, {{0x40, 0x2, 0x9}, {0x5, 0x6, 0x2, "43f9f3547711"}}}, @TCF_EM_NBYTE={0x14, 0x3, 0x0, 0x0, {{0xd11, 0x2, 0xb6a6}, {0x40, 0x2, 0x0, "b91c"}}}, @TCF_EM_CONTAINER={0xe0, 0x1, 0x0, 0x0, {{0xc, 0x0, 0x3}, "17cf5b0e9b6c364d4f8916c7c6112f7f7e23ec0ca2aa23cba9207695c7c2044798d88e7fa0f29518e3fc130443429dd266f9dbe950ba2e0638d5027e1f939370453ba3ad71095f4cbdcbfa1b44b94ec36b55b28c6cb4f52c17b188d887572eca3e056c1f70a855c0aea59f2473f6ce541549489229e0c1f05f76cd44c67139935ef66885d00ec60c985bbf73c18d692d0e0bea82beb8b53bce32d33f6bf446f693fa7fd2b56eafa893f898b1cc6ddaef16abedce852313be0bd477336473ee746621db59d08f19427ee30c21285a84ad00c7bd9c"}}, @TCF_EM_IPT={0x2c, 0x2, 0x0, 0x0, {{0x2, 0x9, 0x8000}, [@TCA_EM_IPT_MATCH_NAME={0xb}, @TCA_EM_IPT_MATCH_NAME={0xb}, @TCA_EM_IPT_NFPROTO={0x5}]}}, @TCF_EM_IPT={0x18, 0x3, 0x0, 0x0, {{0x4, 0x9, 0x4}, [@TCA_EM_IPT_MATCH_NAME={0xb}]}}]}]}, @TCA_FLOW_BASECLASS={0x8, 0x3, {0xe, 0x8}}, @TCA_FLOW_MASK={0x8, 0x6, 0xd}, @TCA_FLOW_POLICE={0x1048, 0xa, 0x0, 0x1, [@TCA_POLICE_PEAKRATE64={0xc, 0x9, 0x1ff}, @TCA_POLICE_RATE64={0xc, 0x8, 0x10000000000000}, @TCA_POLICE_RATE={0x404, 0x2, [0xe000000, 0xed96, 0x398, 0x1, 0x8, 0xaa, 0x4, 0x1, 0x7ff, 0x10, 0x0, 0x2, 0x8293, 0x2, 0x9, 0xe69, 0x6, 0x10, 0x6, 0x81, 0x0, 0xcc, 0x1386, 0xffff, 0x5541, 0x7, 0x3, 0xfffffffd, 0x795, 0xa1, 0x8, 0x101, 0x1, 0xdde, 0x200, 0xc7, 0x3a, 0x6, 0x7, 0x7, 0x3, 0x2, 0x10001, 0x9, 0x4, 0x7f, 0x8001, 0x5, 0x9, 0xf2, 0x3ff, 0x3, 0x5, 0x4, 0x4, 0xdcfb, 0x80000000, 0x6, 0xb, 0x2, 0x0, 0xffffffff, 0x7, 0xffffff00, 0x889, 0x2, 0x5, 0xd22, 0x8, 0x1bbb, 0x7ff, 0x35, 0x9, 0x7, 0x80000fff, 0x2, 0xed, 0x1000, 0x9, 0xff, 0x1, 0x7d79, 0xc0e0, 0x9, 0x6, 0x1, 0x6, 0x66, 0x3, 0x18d0, 0x7, 0xffffffff, 0xa7, 0x9, 0x58, 0x3, 0x9, 0x10, 0x8a0, 0xbcf6, 0xc, 0x1, 0xffff, 0xd, 0x8, 0x5, 0xfffffff7, 0xffffffff, 0x13b4, 0x9, 0x4, 0xfb9, 0xffff8a5a, 0x4, 0x8, 0x6, 0xffffbcbd, 0x9, 0x7f, 0xa, 0x4, 0x40000000, 0x0, 0x2, 0x5, 0x3, 0xec3, 0x1, 0xa378, 0x4, 0x2, 0x8a5, 0x5, 0x6, 0x6, 0x6, 0x6, 0x4, 0x8, 0x3, 0x8, 0x1, 0x0, 0x5, 0x3, 0x10000, 0x8001, 0x6, 0x2, 0x794, 0x5, 0x2, 0x9, 0x7, 0x6, 0x3, 0x5, 0x9, 0xfffffff8, 0x4, 0xe5c8000, 0x8, 0x1, 0x10001, 0xd14f, 0xc215, 0x4, 0x10000, 0x2, 0x3ff, 0x7, 0xffff713f, 0x1, 0xbd, 0x6, 0x1, 0x7f, 0xfffffff7, 0x3, 0x9, 0x5, 0x4, 0x7, 0x8, 0x400, 0xc0000000, 0x81, 0x8f, 0x19, 0x81, 0x3, 0x4, 0x2, 0x3, 0xfffff800, 0x6, 0xffffffff, 0x7, 0x79, 0xe7b, 0x6, 0x7, 0x7f, 0x8, 0x6, 0x78, 0xffffffff, 0x9, 0x8, 0x8001, 0x2f70481a, 0x8, 0xf23a, 0x7, 0x4, 0x4, 0x6, 0x8, 0xfffffffd, 0x80000000, 0x4, 0x0, 0x9, 0x8, 0x3, 0xfff, 0x0, 0x9, 0x400, 0x4, 0x3, 0x100, 0x6, 0x5885, 0xee, 0x7d6, 0x9, 0xfffffffc, 0x10000, 0x7, 0xfffffffa, 0x3, 0x41f9, 0x3, 0x15, 0x4, 0x2, 0x5, 0x8, 0xf8, 0x10001, 0x5, 0xb, 0x4, 0xfffffff8, 0x2]}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x3, 0x80, 0x1, 0x401, 0x3, 0x0, 0x654c, 0x2, 0xffff, 0x7fff, 0x3, 0x1, 0x1, 0x7, 0x2, 0x6, 0x7fff, 0x7, 0x5, 0x400, 0x9, 0x4, 0x7, 0x7fff, 0x12, 0xfffffffd, 0x80000001, 0x3, 0x5, 0x5, 0xfff, 0x1, 0x5, 0x4, 0x2, 0x0, 0x8000000, 0x6, 0x4, 0x8, 0xfffffff9, 0xc4, 0x6, 0x1ff, 0x6, 0x80, 0xffff0e8c, 0xfffffffd, 0x0, 0x0, 0x101, 0x9860, 0x6, 0x800, 0x3ff, 0x80000000, 0x5, 0x0, 0xbd0, 0x2, 0xc, 0x2, 0x5, 0xffff7fff, 0x8, 0x9, 0x9, 0x9, 0x105, 0xec, 0x9, 0x401, 0x0, 0x3, 0x2, 0x2, 0xb29e, 0x1, 0x2b8, 0x1, 0x6, 0x9, 0x6, 0x98b, 0x1, 0x8, 0x0, 0xe, 0xf, 0x9, 0x3, 0xb, 0x1, 0x0, 0xdeb, 0x710, 0x5, 0x100, 0xb, 0x5, 0x8, 0xbd61, 0x6a1, 0xf5, 0x6, 0x2, 0x5, 0xfff, 0xa78, 0x6, 0x80, 0x0, 0x99, 0x7, 0x7fffffff, 0x1, 0x1, 0x6, 0x1, 0x4, 0x911, 0x4, 0xb3ba, 0x810, 0x9, 0x42, 0x7, 0x1, 0x3, 0x457, 0x8, 0x5b, 0x5, 0x7ff, 0x9, 0x7, 0x1, 0x10000, 0xa, 0x9, 0xa4f, 0x5, 0x2, 0x2, 0x2, 0x7, 0x6, 0x1a9, 0x3, 0xedb, 0x0, 0x8, 0x8001, 0xfffff7bb, 0x9, 0x5, 0x266, 0x8000, 0x3, 0x3, 0x7, 0x3ff, 0x10000000, 0x9519, 0x0, 0x3, 0x9, 0x341f, 0x3, 0x40, 0x6, 0x2, 0x0, 0xfffff264, 0x6, 0x1, 0x1885, 0x9, 0x1, 0x1, 0x5, 0x0, 0x5, 0xfffffff9, 0xf, 0x3, 0x6, 0x8, 0x7, 0xc1, 0x9, 0x5, 0x1, 0x0, 0x1c7, 0x1c000000, 0xfffffffe, 0x7ff, 0x4, 0xcc, 0x2, 0x2, 0x7fff, 0x2, 0x3, 0x9, 0x2, 0x6, 0x1, 0xdf, 0x101, 0x7f, 0x9, 0x80, 0x0, 0x10000, 0x3, 0xe2b, 0xff, 0x10001, 0x1, 0x3, 0x1, 0x4, 0x2, 0x4, 0x8, 0xc, 0x5f, 0x3ff, 0x0, 0x0, 0xe, 0x5, 0xfffffff7, 0x3, 0xffff, 0xf, 0x5, 0x5e94, 0x9, 0x0, 0xc0000, 0x8001, 0xd, 0x4, 0x2, 0xd, 0x0, 0x4, 0x4, 0x3, 0x4, 0x6, 0x1, 0x800]}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x8, 0x0, 0x1, 0x0, 0x7, 0x8001, 0x363, 0x1ff, 0x9, 0x3ff, 0x2, 0x6, 0x3a271edb, 0xa6, 0x693, 0x1, 0x7, 0x2beb, 0x7ff, 0x8, 0x7ca1, 0x3, 0x6, 0x0, 0x80000001, 0xd04, 0x4, 0x9b49, 0x0, 0x0, 0xa1e, 0x0, 0x1b360000, 0x9, 0x3, 0x0, 0x60000, 0xe, 0x543, 0x8, 0x3ff, 0x1000, 0xfffffa0c, 0x2, 0x3, 0x4, 0x6, 0x3, 0x9, 0x4, 0x4, 0x76, 0xffffffff, 0x7, 0x8, 0x6e69, 0x1, 0x112, 0x353, 0x6, 0x99, 0x7, 0x6, 0xb4, 0x8, 0x4, 0x4, 0x539, 0x5, 0x8000, 0xcf3, 0x4, 0x9, 0x3, 0x9, 0x6, 0xf000, 0x4, 0xa, 0x8001, 0x4321, 0x8, 0x6, 0x4d35, 0xa0, 0x60000000, 0x4117, 0x5, 0xe23a, 0x4, 0x2bc7, 0x7, 0x0, 0x7, 0x8, 0x1, 0x6, 0x4, 0x7, 0xc0000, 0x13a3d211, 0x7, 0x100, 0x7, 0xffff0001, 0xb, 0x9, 0x80, 0x4, 0x7, 0x2, 0x2, 0x100, 0x4e12197, 0x9, 0x2, 0x8000, 0x1000, 0x573, 0x4, 0x5, 0x5, 0x9, 0x100, 0xe, 0x1000, 0x1, 0x2, 0xa, 0x7, 0x2, 0x1000, 0x4, 0x2, 0x5, 0xc212, 0x7, 0x5, 0xd1, 0xc, 0xfffff800, 0x6, 0x5, 0x428b, 0x5, 0x4, 0x1, 0xb, 0x0, 0x4, 0x6e4, 0x9, 0x4, 0x9, 0x0, 0x6, 0x6, 0x4, 0x0, 0x4, 0xd4, 0x7, 0x964e, 0x4, 0x6, 0xfffffff5, 0x4, 0x6b, 0x4, 0x80, 0xb60000, 0x401, 0x2, 0x2, 0x0, 0x483, 0x6, 0x7, 0x40, 0x5, 0x2, 0x696, 0x3, 0x9, 0x1, 0x54, 0x1, 0x3, 0x6, 0x7, 0x9, 0xd8f6, 0x81, 0x8, 0x67b, 0x8, 0x5, 0x1, 0x305d, 0x8973, 0x4, 0x80000001, 0x2, 0x4, 0x83, 0x0, 0x0, 0xe, 0x367, 0x10000, 0xf, 0x7, 0x3, 0x800, 0xffffff80, 0x0, 0x2, 0xe, 0x1, 0x9, 0x9, 0xffff11f7, 0x8, 0x5, 0x4ee, 0x7, 0x4, 0x5, 0xf94d, 0x4, 0x3, 0x4, 0x9, 0x1, 0xb7a, 0x8, 0x1, 0x2, 0x7b15, 0x7, 0xfff, 0x1, 0xe371, 0x6dc, 0x0, 0xfd, 0x7, 0x7fffffff, 0x40, 0x9, 0x3, 0x5, 0x0, 0x400, 0x6ea67d5a, 0xd01]}, @TCA_POLICE_RESULT={0x8, 0x5, 0x9}, @TCA_POLICE_RATE={0x404, 0x2, [0x81, 0x3, 0x9, 0x80000001, 0xb, 0x200, 0x3, 0xce5, 0x1ff, 0xfffffff8, 0xd, 0x1, 0x9e4, 0xede, 0x2, 0xf4c, 0x8, 0x4, 0x0, 0x3, 0xc1e, 0x6, 0x0, 0x4, 0x4, 0x1, 0x8, 0x5, 0x4, 0xffffffff, 0x400, 0x1, 0xcc69, 0x5, 0x9, 0x0, 0xfffffbff, 0x8, 0x0, 0xf421, 0x8, 0x5, 0x4, 0x100, 0x0, 0xfffff800, 0x2, 0x9, 0x1, 0xd, 0x0, 0x10001, 0xb, 0x67008e8e, 0xfffffff2, 0x1, 0x4, 0x5f1adf5b, 0x9, 0x1, 0xc2, 0xa, 0x6, 0x3, 0x1, 0x40, 0x57e4, 0x77, 0x0, 0xfffffffb, 0x4b3, 0x8, 0x6, 0x5, 0x3, 0x4, 0x4, 0x8, 0x7, 0xfffffe01, 0x8, 0x2, 0xc, 0xffffffd5, 0x8, 0x1, 0x5, 0x2, 0x2, 0x2, 0x7fffffff, 0xf, 0x5, 0xfffffffe, 0x5, 0xd874, 0xe1, 0x0, 0x3, 0xe0de, 0x48, 0x9, 0x4, 0x7, 0x10001, 0x3b9, 0x10001, 0xed, 0x5d7a2580, 0x1000, 0xb8, 0x8, 0x0, 0x40, 0x1, 0x4, 0x3, 0x9, 0x10001, 0x10001, 0xfffffffe, 0x27, 0xe98a, 0x640, 0x1, 0x8, 0x1a0d, 0x6, 0xfffffffa, 0x10000, 0xa3, 0x5, 0xb, 0x1ff, 0x401, 0x0, 0xffffff00, 0x81, 0xffff, 0x6, 0x5, 0x0, 0x3, 0x88, 0x4, 0x5, 0x4, 0x6052, 0x200, 0x1fe6ec8f, 0xb55, 0x800000, 0x9, 0x4, 0x778, 0x5, 0x9, 0x5, 0x7fff, 0x2, 0x10000, 0x6, 0x2, 0x3, 0x6, 0x0, 0x80000001, 0xb98, 0x5, 0x0, 0x7, 0x55a, 0x9, 0x5, 0x400, 0x1, 0x4, 0x6, 0xff, 0x11ee, 0x84, 0x70b, 0x8, 0x6, 0x8, 0x5, 0x8, 0x0, 0x9, 0x40, 0x5, 0x100, 0x2, 0x7, 0x9, 0xe, 0x85b4, 0x6, 0xd, 0x8, 0x6, 0x3e0b, 0x5, 0x9, 0x0, 0x1000, 0xe, 0x7ff, 0x8, 0x1, 0xfffffff7, 0x5, 0xdf, 0x2, 0x6, 0x7, 0x7, 0x80000001, 0x2be1, 0x9, 0xffffffff, 0xca3e, 0xf, 0x3, 0x4d7, 0x0, 0x7, 0x4, 0xfffffff7, 0x6, 0x7, 0x7f, 0xffffffff, 0x3, 0x8, 0x2, 0x8, 0x6, 0x4, 0x3, 0x9, 0x4, 0x1, 0x3, 0x170, 0x3, 0x401, 0x80000001, 0x7fff, 0xeb, 0x1, 0x0, 0x5, 0x4, 0x0, 0x9]}, @TCA_POLICE_RATE64={0xc, 0x8, 0x100000001}, @TCA_POLICE_RESULT={0x8, 0x5, 0xffff}]}, @TCA_FLOW_POLICE={0x834, 0xa, 0x0, 0x1, [@TCA_POLICE_AVRATE={0x8, 0x4, 0x10}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x4, 0x80000001, 0x0, 0xe, 0x6, 0x1, 0x2, 0x2, 0x1, 0x3, 0xf6f, 0x3, 0xffffffff, 0xd8df, 0x5, 0x8e0, 0x1, 0x4, 0x7ff, 0x5, 0x7, 0x3, 0x6, 0x2, 0xfff, 0x8, 0x9, 0xb2ad, 0x7, 0x0, 0x1, 0x7fff, 0x9, 0x6, 0xffffffff, 0x4aa, 0x29c0000, 0x2, 0x1, 0x1, 0x7, 0x8, 0x1, 0x1, 0x8, 0x2715, 0x6, 0xffff8001, 0x7, 0xffffffd3, 0x80000001, 0x6, 0x9, 0x7fffffff, 0x4, 0x3, 0x3, 0x3, 0x7fffffff, 0x40000, 0x3, 0x9, 0x6, 0xa, 0x5, 0x3, 0x7, 0xf, 0x2, 0x5, 0x8, 0xffffffff, 0x1, 0x6, 0x200, 0x0, 0x1, 0xfffff409, 0x7fffffff, 0x60400000, 0xaffe, 0x8a60, 0x9, 0x9, 0x401, 0x3422, 0xbb, 0x7ff, 0x10000, 0x2, 0x6, 0x3, 0x64ae, 0x5, 0x40, 0x7, 0xe16, 0x0, 0x5, 0x6, 0x3c1e, 0x8, 0x8a, 0x3, 0xf1, 0x5, 0x3, 0x91b5, 0x8, 0xf, 0xfffffff9, 0x6, 0xffffffff, 0x5, 0x7, 0x9, 0x8000, 0x6, 0xa956, 0x4, 0x6, 0x2, 0x3, 0x1, 0xfff, 0x6, 0x9, 0xfffffff7, 0x2, 0x9, 0x9, 0x6, 0x2, 0xd, 0x0, 0x4f14, 0x8, 0xce, 0x68, 0x7ff, 0x4, 0x0, 0x8, 0x7, 0x0, 0xd, 0x4, 0x3, 0xea, 0x9, 0x2d2c497b, 0x8b3c, 0x8000, 0x7, 0x6000, 0xa75400, 0x7, 0xffffffff, 0x8, 0x6, 0x5, 0x9, 0x1, 0x3ff, 0x2, 0x5, 0xffffffff, 0xe23a, 0x80000000, 0x8000, 0xfffffffe, 0x1, 0x983e, 0x7, 0x1, 0xffffffff, 0x9, 0x6, 0x12000, 0x8, 0xffffffff, 0x6, 0x6, 0x4, 0x3, 0x4e, 0xffff, 0x1, 0x77, 0x100, 0x9, 0x5, 0x2, 0x8, 0x6, 0xc, 0x75d, 0x8, 0x0, 0xff, 0xfffffff9, 0x9, 0x5, 0x4a0, 0x7, 0x3, 0x10, 0x3, 0x6, 0xfff, 0x8, 0x3, 0x1, 0xfffffff8, 0x5, 0x401, 0x3, 0x7, 0x2, 0xfffff14b, 0xa3, 0x524, 0x80000001, 0x39, 0xa, 0x2, 0x7, 0x2cd, 0x8, 0x7, 0x6000000, 0x2, 0x10000, 0x1, 0x101, 0x0, 0x3, 0xfff, 0x10000, 0x400, 0x24, 0x7, 0x5, 0xc000, 0xf, 0x0, 0x9, 0x4, 0xffff, 0x7, 0x6, 0x7f, 0x1000, 0x7b0000, 0x186da742, 0x4]}, @TCA_POLICE_RATE64={0xc, 0x8, 0x7}, @TCA_POLICE_RATE={0x404, 0x2, [0x1, 0xc749, 0x5, 0xd6, 0x5, 0x10000, 0xa2, 0x5, 0xca68, 0x8001, 0x3, 0x8, 0x1, 0x8, 0x8ce, 0x2000, 0x0, 0x0, 0xfffffffa, 0x0, 0x5, 0xfffffff7, 0x5, 0x8, 0x9f0, 0x5ac, 0xfb07, 0x8, 0x5, 0xfffffff6, 0x11, 0x5, 0xfffffff4, 0x64a4, 0x0, 0xa, 0x7, 0x7, 0x1, 0x7fffffff, 0x5, 0x7316639f, 0x2d, 0x7, 0x4, 0x7, 0x5, 0x0, 0x0, 0x0, 0x1000, 0x6, 0x1, 0x1, 0x1, 0x9, 0x6, 0xa83, 0x1, 0x9, 0x401, 0x5, 0x3, 0x3, 0x1, 0x1000, 0xc30b, 0x1ff, 0xe307, 0x2000006, 0xb, 0xce, 0x2, 0xf18a, 0xee6, 0x1, 0x5936, 0xfffffff8, 0x6, 0x2, 0x1, 0x5, 0xdb, 0x3, 0x6, 0x80, 0xfffffff7, 0x0, 0x5, 0x8, 0x7, 0x8, 0x1, 0x7, 0x6, 0xfffff800, 0xb, 0x9, 0x1, 0x3, 0x4, 0x5, 0x2, 0x4, 0xea4e, 0x4, 0x2, 0x1, 0x8, 0x40, 0x0, 0x3, 0x6, 0x9, 0x54, 0x1, 0x9, 0xc, 0x7, 0x0, 0x2, 0x5, 0x9, 0xbb, 0x8, 0xaafa, 0xc4f1, 0xca, 0xfff, 0x5, 0x7fffffff, 0x3, 0xfff, 0x3, 0x0, 0xb5, 0x3ff, 0x3, 0x1ff, 0x9, 0x5, 0x80000001, 0x400, 0x7f, 0x6, 0x9, 0x7, 0x8, 0x4, 0x7, 0xffff, 0x8000, 0x9a7, 0xe, 0x4, 0x3, 0x4, 0x0, 0x8000, 0x3ff, 0x7346, 0xa0c, 0x401, 0x95c, 0x4, 0x2, 0x9d29, 0x2, 0xc, 0x4, 0x9, 0x9, 0x4, 0x10000, 0x1, 0x7824, 0xd, 0x7fff, 0x3ff, 0x9, 0x80, 0x1600, 0x1, 0x8001, 0x8, 0x65, 0x709, 0x51, 0x4, 0x0, 0x234, 0x1, 0x200, 0x9, 0x74, 0x6da, 0x10, 0x1, 0x3, 0x7, 0x7f, 0x1, 0x62c8, 0x101, 0x2, 0x0, 0xffff, 0x0, 0xffffff7f, 0xb7, 0x2, 0x4, 0x0, 0x7f, 0xb, 0x94f3, 0x7, 0x759e, 0x1, 0x6, 0xa, 0x7, 0x1, 0x4, 0x54, 0xb, 0xb853, 0xc, 0x0, 0x8, 0x5, 0x6, 0x8, 0xff, 0xfffffff8, 0x79, 0x9, 0xf, 0xffff, 0x4, 0x2, 0x0, 0xffffffe9, 0xfffffffe, 0x0, 0x0, 0x7f, 0x4, 0x100, 0x0, 0x7, 0x8, 0x4, 0x4, 0x8, 0x10]}, @TCA_POLICE_RATE64={0xc, 0x8, 0x3228}, @TCA_POLICE_AVRATE={0x8, 0x4, 0x6}]}, @TCA_FLOW_BASECLASS={0x8, 0x3, {0x8, 0x6}}, @TCA_FLOW_MODE={0x8}]}}, @filter_kind_options=@f_u32={{0x8}, {0x6e8, 0x2, [@TCA_U32_LINK={0x8, 0x3, 0x6b45}, @TCA_U32_FLAGS={0x8, 0xb, 0x2}, @TCA_U32_DIVISOR={0x8, 0x4, 0xdf}, @TCA_U32_LINK={0x8, 0x3, 0x7f}, @TCA_U32_SEL={0x6c4, 0x5, {0x7, 0xfc, 0x4, 0x9e33, 0xd055, 0x2, 0x8, 0x60, [{0xffffffff, 0x3, 0x1000, 0x3}, {0x400, 0x5a, 0xfffffffb, 0x5a}, {0x0, 0xffffff0b, 0x9, 0xe}, {0xa, 0xffffffff, 0x0, 0x80000001}, {0x400, 0x6, 0x7ff, 0x7}, {0x2, 0x3, 0x1ff, 0x6}, {0x190e, 0x682f7c79, 0x2, 0xdd3}, {0x1, 0x3, 0x6, 0xfffffff8}, {0x100, 0x8, 0x100, 0xfffffffd}, {0xfffffffa, 0x2, 0x8, 0x729}, {0xfffffff7, 0x67d0, 0x8001, 0xde35}, {0x2, 0x1, 0x0, 0x8}, {0x3, 0x4, 0x101, 0x7f}, {0x5, 0xdfdb, 0x1, 0x9}, {0x3, 0x1ff, 0x6, 0x5}, {0x4, 0x1, 0x8, 0xd3e0}, {0x1, 0x401, 0x81, 0x1}, {0x1, 0x8, 0x10, 0x193}, {0x8000, 0x6, 0x0, 0xb2}, {0x0, 0x7, 0x2}, {0x1f, 0x1, 0xdfe, 0x8}, {0x80000001, 0x6, 0xffffffff, 0x6}, {0x7, 0x7d5, 0x7, 0x6}, {0x9, 0x81, 0x3, 0x1}, {0xc719, 0xdc, 0x5, 0x3}, {0x7, 0x4, 0x8, 0x9}, {0x8001, 0x80000000, 0x10001, 0x5}, {0x80, 0x401, 0x8, 0x7d03e4fb}, {0x4a8, 0x80000000, 0x2, 0x8}, {0x7, 0x8, 0x4, 0xb8c}, {0x1, 0x9, 0x5056, 0xfffffff9}, {0x48d, 0x7, 0x0, 0x800}, {0x10, 0x2, 0x1, 0x2}, {0x3, 0x6, 0xffff, 0x7e5}, {0x8, 0x101, 0xfffffff7, 0x6}, {0x1, 0x9, 0xc, 0x58500000}, {0xf, 0xffff, 0x3, 0x10001}, {0x0, 0x8, 0x8, 0x4}, {0x3, 0x9, 0xb6c5, 0x8}, {0x7, 0x3, 0x1, 0x6}, {0x1, 0x3, 0x1, 0x3ff}, {0x7, 0xffff, 0x9, 0xffff}, {0x5bb2c360, 0x3, 0x5, 0x1000}, {0x5, 0x7, 0x1, 0x6}, {0x10, 0x0, 0xacb, 0x1}, {0x1, 0x5, 0x200, 0x7}, {0x3, 0x6, 0xe5, 0x3}, {0x2, 0x8, 0x5}, {0x9, 0x3, 0x81, 0xf}, {0x400, 0x0, 0x2, 0x5}, {0x1, 0x4}, {0xffff, 0xaf66, 0xfffffb36, 0x1}, {0x7f, 0x3, 0x4}, {0x63, 0x6, 0xffff, 0x400}, {0x1, 0xc, 0xd, 0x8}, {0x401, 0x10000, 0x7, 0xf34}, {0x9, 0x8000, 0x2, 0x6}, {0x9, 0x1, 0x0, 0x7fff}, {0x641, 0x8, 0x9, 0x8}, {0x800, 0x3, 0x9, 0xe}, {0x9, 0x4, 0xc57e, 0x5}, {0x33, 0xfff, 0x2, 0x10}, {0x3, 0x6, 0xec6, 0x1}, {0xfffffffb, 0x50, 0x50, 0x3}, {0x8000, 0x8001, 0x400, 0x8}, {0x8001, 0x101, 0xd70, 0x6}, {0x5, 0xffff, 0x3, 0x5}, {0x7fffffff, 0x31d5, 0x9, 0x48f7}, {0x1, 0x9a9, 0x0, 0x5}, {0x10, 0x0, 0x10000, 0x3}, {0x0, 0xe, 0xc, 0x4}, {0x5, 0xef15, 0x1, 0xd0}, {0x8000, 0x7fff, 0xfffffffb, 0x1}, {0x759817b1, 0x4000, 0x1, 0x100}, {0x7, 0x7fffffff, 0x873, 0xff}, {0xfffffff7, 0x6, 0x9}, {0x6, 0x81f, 0xffff0001, 0xf0}, {0x7, 0x9, 0x9, 0x80000001}, {0x43b55911, 0x6, 0x6, 0x17c6}, {0x1e, 0x4, 0x8, 0xff}, {0x7ebc, 0x7, 0xab, 0x4}, {0x0, 0xfffffff9, 0x8001}, {0x9, 0x3, 0x5, 0x5}, {0x6, 0x3, 0xffffff35, 0x5}, {0x51f9, 0x737, 0x100, 0x8}, {0x60, 0x32f3, 0x9, 0x9}, {0x4, 0x7, 0x6, 0xffff}, {0x2, 0x9e3, 0x2, 0x9}, {0x5, 0x9, 0x9, 0x9}, {0x7, 0x4, 0x10000, 0x42d}, {0x3, 0x81, 0x0, 0x6}, {0x7, 0x80, 0xffffffff, 0x7}, {0x6, 0x8001, 0x4, 0x3}, {0xf, 0x5, 0x4097, 0x80000000}, {0x5, 0x0, 0x0, 0x1}, {0x1, 0x500, 0x80000001, 0x4}, {0x80000000, 0x80, 0x80000001, 0x8}, {0x8, 0x3, 0x0, 0x5}, {0xfffffffc, 0x40, 0x5, 0xa3a4}, {0x0, 0x6, 0x7d76ff92, 0x8000}, {0xe, 0x0, 0x80000000, 0x2}, {0x3, 0x6, 0x2, 0x3}, {0x7f, 0x9, 0xfff, 0xfff}, {0xffff, 0x8, 0x6, 0xffff5a9d}, {0x7, 0x8, 0x7ff, 0xf46}, {0x81, 0x7f, 0x7, 0x8}, {0x8c8, 0x2, 0xe5d, 0x8001}]}}]}}]}, 0x21d4}, 0x1, 0x0, 0x0, 0x50}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=@newlink={0x4c, 0x10, 0xffffffffffffffff, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, 0x224, 0x52030}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @erspan={{0xb}, {0x1c, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}, @IFLA_GRE_ERSPAN_HWID={0x6, 0x18, 0xffff}, @IFLA_GRE_ENCAP_TYPE={0x6, 0xe, 0x1}, @IFLA_GRE_COLLECT_METADATA={0x4}]}}}]}, 0x4c}}, 0x8000) syz_emit_ethernet(0x8e, &(0x7f0000000500)={@local, @empty, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "0a8435", 0x58, 0x6, 0x1, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x16, 0x2, 0x0, 0x0, 0x800, {[@exp_fastopen={0xfe, 0x7, 0xf989, "e7cee3"}, @exp_fastopen={0xfe, 0xb, 0xf989, "9151d81bf9e6f9"}, @window={0x3, 0x3, 0xd3}, @fastopen={0x22, 0x10, "914f582261c20c124cb47312e973"}, @timestamp={0x8, 0xa, 0x4, 0xac}, @md5sig={0x13, 0x12, "8098cf093cc9cd7b8ec814f9bcfdfea9"}, @sack={0x5, 0x2}]}}}}}}}}, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000640)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r7, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000700)={0x0}, 0x1, 0x0, 0x0, 0x4000850}, 0x20044010) openat$dir(0xffffffffffffff9c, &(0x7f0000000740)='./file0\x00', 0x40, 0xab) r8 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000780), 0x2, 0x0) write$UHID_CREATE2(r8, &(0x7f00000007c0)={0xb, {'syz0\x00', 'syz1\x00', 'syz0\x00', 0x33, 0x5, 0x46d, 0xb012, 0x0, 0x0, "0600ff0901a10185100901150026ff007508950681000901910085110901951381000901910085120901953f810009019100c0"}}, 0x14b) read(r8, &(0x7f0000000940), 0x111c) write$UHID_INPUT2(r8, &(0x7f0000000980)=ANY=[@ANYBLOB="0c00000006e210"], 0xd) r9 = socket$nl_generic(0x10, 0x3, 0x10) openat$procfs(0xffffff9c, &(0x7f0000000040)='/proc/schedstat\x00', 0x0, 0x0) r10 = syz_genetlink_get_family_id$mptcp(&(0x7f00000009c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_REMOVE(r9, &(0x7f0000000a00)={&(0x7f0000000a40)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000a80)={&(0x7f0000000ac0)={0x24, r10, 0x100, 0x70bd27, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x3}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x1}]}, 0x24}}, 0x24004040) sendmsg$NFT_BATCH(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000b40)={&(0x7f0000000b80)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a64000000060a010400000000000000000a0000050900020073797a32000000003800048034000180090001007866726d000000002400028008000140000000100800024000000002050003000000000008000440000000030900010073797a31"], 0x8c}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) r11 = open(&(0x7f0000000940)='.\x00', 0x2000, 0x0) fcntl$notify(r11, 0x402, 0x8000003d) 2.154065569s ago: executing program 1 (id=835): socket$inet6_sctp(0xa, 0x801, 0x84) socket$nl_xfrm(0x10, 0x3, 0x6) r0 = openat$nsim_new_device(0xffffff9c, &(0x7f0000000000), 0x1, 0x0) write$nsim_new_device(r0, &(0x7f0000000080)={0x0, 0x20, 0x33, 0x20, 0x33}, 0x5) socket$nl_generic(0x10, 0x3, 0x10) syz_open_dev$loop(&(0x7f00000000c0), 0x4, 0x200002) msgrcv(0x0, 0x0, 0x0, 0x0, 0xa1e3a9fe3eb9c551) socket$unix(0x1, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x802) socket$pppl2tp(0x18, 0x1, 0x1) openat$fuse(0xffffffffffffff9c, &(0x7f0000000200), 0x42, 0x0) socket$packet(0x11, 0x3, 0x300) socket(0x10, 0x3, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket$packet(0x11, 0x2, 0x300) socket$inet_tcp(0x2, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x10, 0x803, 0x0) r1 = socket$key(0xf, 0x3, 0x2) syz_usb_connect$uac1(0x3, 0xdc, &(0x7f0000000700)=ANY=[@ANYBLOB="12010000000000106b1d01014000010203010902ca0003010070000904000000010100000a24010800000201020d240600000308", @ANYRES8=r1, @ANYBLOB='\a'], 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), r2) sendmsg$NL80211_CMD_START_AP(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01022abd7000000000000f00000008000300", @ANYRES32=0x0, @ANYBLOB="0c009900000000002500000029000e002a23"], 0x54}, 0x1, 0x0, 0x0, 0x20000050}, 0x48000) 1.29839225s ago: executing program 2 (id=836): madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r0 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(r0, 0x0, 0xc8, &(0x7f0000000000), 0x4) setsockopt$MRT_ADD_VIF(r0, 0x0, 0xca, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, @vifc_lcl_addr=@local, @dev}, 0x10) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_VIF(r2, 0x0, 0xca, &(0x7f00000000c0)={0x6, 0x4, 0x0, 0x20000000, @vifc_lcl_ifindex, @multicast2}, 0x10) setsockopt$inet_mreq(r1, 0x0, 0x23, &(0x7f0000000100)={@multicast1=0xe0000300, @local}, 0x8) gettid() syz_emit_ethernet(0x3e, &(0x7f0000000140)=ANY=[@ANYBLOB="aaaaaaaaaaaabbbbbbbbbbbb080045000030fffe00008002907800000000e00003000304907800020c5826455fa03bf04bef4e24000c7f000001ac141444"], 0x0) setsockopt$MRT_ADD_MFC_PROXY(r2, 0x0, 0xd2, &(0x7f0000000180)={@empty, @multicast2=0xe0000300, 0x0, "028a3f6c58b274e6d8451697efe42811ee1df06e9264f7d866b1970548fc3c7b", 0xb2, 0xffffeff7, 0x7f, 0x40000006}, 0x3c) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) pause() mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) munlockall() madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x8) openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) munmap(&(0x7f0000002000/0x1000)=nil, 0x1000) 917.334693ms ago: executing program 0 (id=837): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(0xffffffffffffffff, 0xc0189378, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0, {r0}}, './file0\x00'}) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000040)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_NOACK_MAP(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000580)={0x24, r3, 0x1, 0x70bd2d, 0x25dfdbff, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_NOACK_MAP={0x6, 0x95, 0x40}]}, 0x24}, 0x1, 0x0, 0x0, 0x240000c0}, 0x24044048) 561.154888ms ago: executing program 4 (id=838): socket$nl_rdma(0x10, 0x3, 0x14) bpf$MAP_CREATE(0x0, &(0x7f0000000500)=@base={0x9, 0x9, 0x8, 0x40, 0x42, 0x1}, 0x48) r0 = socket$kcm(0x2, 0x3, 0x106) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000680)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000700)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a70000000060a0b160000000000000000020000084400048018000180080001006f7366000c000280080001400000000428000180080001006e6174001c0002800800014000000000080003400000001408000240000000020900010073797a30000000000900020073797a320000000014000000110001"], 0x98}, 0x1, 0x0, 0x0, 0x850}, 0x4040080) sendmsg$inet(r0, &(0x7f00000007c0)={&(0x7f0000000800)={0x2, 0x0, @remote}, 0x10, &(0x7f0000000840)=[{&(0x7f0000000880)}], 0x1}, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) 476.260337ms ago: executing program 0 (id=839): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x0, 0x0, 0x0, 0x0, 0xb49, 0xa, 0xfffffffffffffff7, 0xfffffffc, 0x3e}, 0x0) syz_clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0, 0x0) bind$rds(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x80801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x54}) r1 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r1, 0x7a7, &(0x7f00000009c0)=0x80000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r1, 0x7a0, &(0x7f0000000140)={@my=0x1}) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r1, 0x7a8, &(0x7f00000001c0)={{@host}, @host, 0x0, 0x2000000, 0x2449, 0xfffffffffffffffd}) ioctl$IOCTL_VMCI_VERSION2(r1, 0x7a7, &(0x7f00000000c0)=0xb0000) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x4}) ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000280)={&(0x7f0000800000/0x800000)=nil, &(0x7f0000199000/0x800000)=nil, 0x800000}) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000040)={0x1, 0x2, 0xf000, 0x2000, &(0x7f0000f8d000/0x2000)=nil}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r5 = add_key$keyring(&(0x7f0000000300), &(0x7f0000000340)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffe) r6 = add_key$keyring(&(0x7f0000000380), &(0x7f00000003c0)={'syz', 0x3}, 0x0, 0x0, r5) add_key(&(0x7f0000000400)='asymmetric\x00', 0x0, &(0x7f0000000440)="308201d43082017ba00302010202142eea648d7f17e62e9e5869c887c68e1bd0f86fde300a06082a8648ce3d040302303a3138303606035504030c82f5ec41d99324146361746520766572696669636174696f6e2045434453412073656c662d74657374696e67206b65793020170d3235c218ce4c3232313632365a180f32313234303332303232313632365a303a3138303606035504030c3f436572746966696361746520766572696669636174696f6e2045434453412073656c662d74206b65793059301306072a8648ce3d020106082affff00000000000042000407e56b51affc19412c88926b775771039ee2fe6e6a714ec7299f90e177189fc2e70a82d08ae181a9717c5a73fb25b95b1e248c739ff838f848b4ad1619c022c6a35d305b301d0603551d0e041604142900bcea1deb7bc8479a84a23d758efdfdd2b2d3301f0603551d230418301680142900bcea1deb7bc8479a84a23d758efdfdd2b2d330800603551d130101ff04023000300b0603551d0f040403020780300a06082a8648ce3d040302034700304402201ad7ac07c89738f489437ec7666ea5007c121db409760c996b8c265de9705cb4022073b7c77a5adb670a964219cf4f674f356aee2925f24fc810149d79691c7ad75dc74a35af50b2", 0x1d8, r6) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r7 = socket(0x400000000010, 0x3, 0x0) openat$binderfs_log(0xffffff9c, &(0x7f00000000c0)='./binderfs/binder_logs/transactions_hashed\x00', 0x0, 0x0) r8 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x42}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x5}, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000038c0)=@newtfilter={0x40, 0x2c, 0xd27, 0x70bd24, 0x25dfdbfc, {0x0, 0x0, 0x0, r9, {0x4, 0xfff3}, {}, {0x9, 0x8}}, [@filter_kind_options=@f_matchall={{0xd}, {0xc, 0x2, [@TCA_MATCHALL_CLASSID={0x8, 0x1, {0x3, 0xc}}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x10}, 0x20000000) sendmsg$nl_route_sched(r7, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={0x0}, 0x1, 0x0, 0x0, 0x20000801}, 0x4041080) 15.010827ms ago: executing program 4 (id=840): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) r1 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000000c0)={'veth0_macvtap\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000004c0)=@newtfilter={0x24, 0x11, 0x1, 0x70bd29, 0x25dfdbff, {0x0, 0x0, 0x74, r4, {0x4, 0xfff2}, {0xafabc05531515610, 0xd}, {0x8, 0x2}}}, 0x48}, 0x1, 0xf0ffffffffffff, 0x0, 0x1c005}, 0x24048004) fchdir(r0) r5 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r5, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r6 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r6, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r6, 0x1, 0x8, &(0x7f0000000000)=0x80, 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r6, 0x10e, 0x4, &(0x7f0000000180)=0x800, 0x4) r7 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r7, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000440)=[{&(0x7f0000000340)="2e00000010008188e6b62aa73772cc9f1ba1f848430000005e140602ffa100000e000a000f000000028000001294", 0x2e}], 0x1}, 0x40) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r1, 0xc0845657, &(0x7f0000000500)={0x0, @bt={0xa91, 0x156, 0x1, 0x1, 0xd59f80, 0x9, 0x2800, 0xa, 0x3, 0x5, 0x27fd, 0x2800, 0x440, 0x3, 0x9, 0x4, {0x5, 0xffffffff}, 0x5, 0x7}}) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0xfffffffc, @empty, 0x7}, 0x1c) r8 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={0x0}, 0x1, 0x0, 0x0, 0x4}, 0x0) listen(r0, 0xc) r9 = socket$inet_mptcp(0x2, 0x1, 0x106) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r11 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r11, 0x8933, &(0x7f0000000480)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_NEW_KEY(r11, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000002c0)={0x30, r10, 0x801, 0x500, 0x0, {{}, {@val={0x8, 0x3, r12}, @void}}, [@NL80211_ATTR_KEY={0x14, 0x50, 0x0, 0x1, [@NL80211_KEY_TYPE={0x8, 0x7, 0x2}, @NL80211_KEY_DATA_WEP104]}]}, 0x53}}, 0x0) connect$inet(r9, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r13, &(0x7f0000000400)={0x0, 0x2f, &(0x7f00000003c0)={&(0x7f0000000300)={0x30, r14, 0x1, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x1c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @private=0xa010102}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x3}]}]}, 0x30}}, 0x0) 0s ago: executing program 1 (id=841): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x0, 0x0, 0x0, 0x0, 0xb49, 0xa, 0xfffffffffffffff7, 0xfffffffc, 0x3e}, 0x0) syz_clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0, 0x0) bind$rds(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x80801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x54}) r1 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r1, 0x7a7, &(0x7f00000009c0)=0x80000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r1, 0x7a0, &(0x7f0000000140)={@my=0x1}) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r1, 0x7a8, &(0x7f00000001c0)={{@host}, @host, 0x0, 0x2000000, 0x2449, 0xfffffffffffffffd}) ioctl$IOCTL_VMCI_VERSION2(r1, 0x7a7, &(0x7f00000000c0)=0xb0000) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x4}) ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000280)={&(0x7f0000800000/0x800000)=nil, &(0x7f0000199000/0x800000)=nil, 0x800000}) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000040)={0x1, 0x2, 0xf000, 0x2000, &(0x7f0000f8d000/0x2000)=nil}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r5 = add_key$keyring(&(0x7f0000000300), &(0x7f0000000340)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffe) r6 = add_key$keyring(&(0x7f0000000380), &(0x7f00000003c0)={'syz', 0x3}, 0x0, 0x0, r5) add_key(&(0x7f0000000400)='asymmetric\x00', 0x0, &(0x7f0000000440)="308201d43082017ba00302010202142eea648d7f17e62e9e5869c887c68e1bd0f86fde300a06082a8648ce3d040302303a3138303606035504030c82f5ec41d99324146361746520766572696669636174696f6e2045434453412073656c662d74657374696e67206b65793020170d3235c218ce4c3232313632365a180f32313234303332303232313632365a303a3138303606035504030c3f436572746966696361746520766572696669636174696f6e2045434453412073656c662d74206b65793059301306072a8648ce3d020106082affff00000000000042000407e56b51affc19412c88926b775771039ee2fe6e6a714ec7299f90e177189fc2e70a82d08ae181a9717c5a73fb25b95b1e248c739ff838f848b4ad1619c022c6a35d305b301d0603551d0e041604142900bcea1deb7bc8479a84a23d758efdfdd2b2d3301f0603551d230418301680142900bcea1deb7bc8479a84a23d758efdfdd2b2d330800603551d130101ff04023000300b0603551d0f040403020780300a06082a8648ce3d040302034700304402201ad7ac07c89738f489437ec7666ea5007c121db409760c996b8c265de9705cb4022073b7c77a5adb670a964219cf4f674f356aee2925f24fc810149d79691c7ad75dc74a35af50b2", 0x1d8, r6) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r7 = socket(0x400000000010, 0x3, 0x0) openat$binderfs_log(0xffffff9c, &(0x7f00000000c0)='./binderfs/binder_logs/transactions_hashed\x00', 0x0, 0x0) r8 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x42}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x5}, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000038c0)=@newtfilter={0x40, 0x2c, 0xd27, 0x70bd24, 0x25dfdbfc, {0x0, 0x0, 0x0, r9, {0x4, 0xfff3}, {}, {0x9, 0x8}}, [@filter_kind_options=@f_matchall={{0xd}, {0xc, 0x2, [@TCA_MATCHALL_CLASSID={0x8, 0x1, {0x3, 0xc}}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x10}, 0x20000000) sendmsg$nl_route_sched(r7, &(0x7f0000006040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20000801}, 0x4041080) kernel console output (not intermixed with test programs): 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 249.185347][ T7478] RSP: 002b:00000000f53f650c EFLAGS: 00000206 ORIG_RAX: 0000000000000036 [ 249.185364][ T7478] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000c028aa03 [ 249.185375][ T7478] RDX: 0000000080000800 RSI: 0000000000000000 RDI: 0000000000000000 [ 249.185385][ T7478] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 249.185408][ T7478] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 249.185422][ T7478] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 249.185456][ T7478] [ 250.059599][ T30] usb 2-1: USB disconnect, device number 29 [ 250.310219][ T7488] netlink: 24 bytes leftover after parsing attributes in process `syz.1.482'. [ 250.378522][ T5359] scsi host1: usb-storage 5-1:3.20 [ 250.427716][ T5359] usb 5-1: USB disconnect, device number 26 [ 250.877259][ T5626] corsair-cpro 0003:1B1C:0C10.0007: probe with driver corsair-cpro failed with error -71 [ 250.921096][ T5626] usb 4-1: USB disconnect, device number 25 [ 251.177977][ T5359] usb 5-1: new high-speed USB device number 27 using dummy_hcd [ 251.180938][ T31] kauditd_printk_skb: 129 callbacks suppressed [ 251.180952][ T31] audit: type=1326 audit(1792789406.084:1246): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7501 comm="syz.3.486" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7f74f1c code=0x0 [ 251.321860][ T5359] usb 5-1: Using ep0 maxpacket: 16 [ 251.322630][ T5359] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 251.324712][ T5359] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 251.324738][ T5359] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 251.338180][ T5359] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 251.338201][ T5359] usb 5-1: Product: syz [ 251.338211][ T5359] usb 5-1: Manufacturer: syz [ 251.338222][ T5359] usb 5-1: SerialNumber: syz [ 251.421873][ T5359] usb 5-1: 0:2 : does not exist [ 251.622991][ T5359] usb 5-1: 5:0: failed to get current value for ch 0 (-22) [ 251.678032][ T7505] netlink: 4 bytes leftover after parsing attributes in process `syz.1.488'. [ 251.678097][ T7505] bridge_slave_1: left allmulticast mode [ 251.678113][ T7505] bridge_slave_1: left promiscuous mode [ 251.678294][ T7505] bridge0: port 2(bridge_slave_1) entered disabled state [ 251.735046][ T7505] bridge_slave_0: left allmulticast mode [ 251.735236][ T7505] bridge0: port 1(bridge_slave_0) entered disabled state [ 251.847300][ T5359] usb 5-1: USB disconnect, device number 27 [ 252.017704][ T5645] udevd[5645]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 252.422101][ T5359] usb 4-1: new high-speed USB device number 26 using dummy_hcd [ 252.596862][ T5359] usb 4-1: New USB device found, idVendor=0572, idProduct=cafe, bcdDevice= 1.00 [ 252.612963][ T5359] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 252.613017][ T5359] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 229, setting to 64 [ 252.613038][ T5359] usb 4-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 4 [ 252.613069][ T5359] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 252.965871][ T7507] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 252.995453][ T7516] netlink: 72 bytes leftover after parsing attributes in process `syz.3.490'. [ 253.065188][ T7507] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 253.112754][ T7525] fuse: Bad value for 'fd' [ 253.232226][ T10] usb 5-1: new high-speed USB device number 28 using dummy_hcd [ 253.321140][ T7527] FAULT_INJECTION: forcing a failure. [ 253.321140][ T7527] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 253.325113][ T7527] CPU: 1 UID: 0 PID: 7527 Comm: syz.2.494 Tainted: G L syzkaller #0 PREEMPT(full) [ 253.325140][ T7527] Tainted: [L]=SOFTLOCKUP [ 253.325146][ T7527] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 253.325156][ T7527] Call Trace: [ 253.325162][ T7527] [ 253.325169][ T7527] dump_stack_lvl+0xe8/0x150 [ 253.325199][ T7527] should_fail_ex+0x410/0x560 [ 253.325224][ T7527] _copy_to_iter+0x59c/0x1810 [ 253.325255][ T7527] ? __pfx__copy_to_iter+0x10/0x10 [ 253.325277][ T7527] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 253.325298][ T7527] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 253.325320][ T7527] __skb_datagram_iter+0xf8/0x980 [ 253.325343][ T7527] ? __pfx_sk_busy_loop_end+0x10/0x10 [ 253.325360][ T7527] ? __pfx_simple_copy_to_iter+0x10/0x10 [ 253.325390][ T7527] skb_copy_datagram_iter+0xb5/0x240 [ 253.325416][ T7527] netlink_recvmsg+0x2c8/0xa70 [ 253.325442][ T7527] ? __pfx_netlink_recvmsg+0x10/0x10 [ 253.325472][ T7527] ? __pfx_netlink_recvmsg+0x10/0x10 [ 253.325489][ T7527] sock_recvmsg_nosec+0x130/0x170 [ 253.325507][ T7527] ____sys_recvmsg+0x466/0x530 [ 253.325535][ T7527] ? __pfx_____sys_recvmsg+0x10/0x10 [ 253.325566][ T7527] ? kfree+0x4d/0x650 [ 253.325589][ T7527] ___sys_recvmsg+0x213/0x5a0 [ 253.325614][ T7527] ? __pfx____sys_recvmsg+0x10/0x10 [ 253.325639][ T7527] ? lock_acquire+0x115/0x350 [ 253.325679][ T7527] do_recvmmsg+0x38b/0x800 [ 253.325707][ T7527] ? __pfx_do_recvmmsg+0x10/0x10 [ 253.325729][ T7527] ? __lock_acquire+0x747/0x2de0 [ 253.325753][ T7527] ? __mutex_unlock_slowpath+0x731/0x900 [ 253.325777][ T7527] ? __fget_files+0x3a2/0x420 [ 253.325799][ T7527] __sys_recvmmsg+0x1a5/0x290 [ 253.325823][ T7527] ? __pfx___sys_recvmmsg+0x10/0x10 [ 253.325853][ T7527] __ia32_compat_sys_recvmmsg_time32+0xbf/0xe0 [ 253.325873][ T7527] __do_fast_syscall_32+0x28b/0x6c0 [ 253.325896][ T7527] ? do_fast_syscall_32+0x33/0x70 [ 253.325918][ T7527] ? asm_int80_emulation+0x1a/0x20 [ 253.325932][ T7527] ? do_int80_emulation+0x299/0x500 [ 253.325965][ T7527] do_fast_syscall_32+0x33/0x70 [ 253.325988][ T7527] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 253.326007][ T7527] RIP: 0023:0xf743ef1c [ 253.326022][ T7527] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 253.326035][ T7527] RSP: 002b:00000000f545650c EFLAGS: 00000206 ORIG_RAX: 0000000000000151 [ 253.326052][ T7527] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000240 [ 253.326063][ T7527] RDX: 0000000000000003 RSI: 0000000000000020 RDI: 0000000000000000 [ 253.326073][ T7527] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 253.326082][ T7527] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 253.326091][ T7527] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 253.326113][ T7527] [ 253.399584][ T10] usb 5-1: Using ep0 maxpacket: 32 [ 253.530223][ T10] usb 5-1: unable to get BOS descriptor or descriptor too short [ 253.530445][ T10] usb 5-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 253.698474][ T10] usb 5-1: config 14 has an invalid interface number: 57 but max is 1 [ 253.698504][ T10] usb 5-1: config 14 has an invalid interface number: 228 but max is 1 [ 253.698531][ T10] usb 5-1: config 14 has no interface number 0 [ 253.698543][ T10] usb 5-1: config 14 has no interface number 1 [ 253.698606][ T10] usb 5-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 253.698633][ T10] usb 5-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 253.698661][ T10] usb 5-1: config 14 interface 57 has no altsetting 0 [ 253.698681][ T10] usb 5-1: config 14 interface 228 has no altsetting 0 [ 253.767359][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 253.767452][ T10] usb 5-1: Product: syz [ 253.767494][ T10] usb 5-1: Manufacturer: syz [ 253.767538][ T10] usb 5-1: SerialNumber: syz [ 253.985498][ T7531] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 253.986075][ T7531] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 254.173898][ T62] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 254.173953][ T62] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 254.174009][ T62] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 254.174076][ T62] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 254.191583][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 254.254031][ T10] legousbtower 5-1:14.57: interrupt endpoints not found [ 254.454565][ T10] legousbtower 5-1:14.228: interrupt endpoints not found [ 254.843313][ T31] audit: type=1326 audit(1792789409.754:1247): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7540 comm="syz.2.500" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf743ef1c code=0x0 [ 254.992007][ T5359] cxacru 4-1:1.0: send of cm 0x91 failed (-104) [ 254.992301][ T5359] ATM dev 0: cxacru_atm_start: CARD_GET_MAC_ADDRESS returned -104 [ 254.992320][ T5359] ATM dev 0: usbatm_atm_init: atm_start failed: -104! [ 255.076502][ T7547] fuse: Bad value for 'fd' [ 255.107758][ T5359] cxacru 4-1:1.0: probe with driver cxacru failed with error -104 [ 255.248699][ T10] hid-generic 0005:057E:24000002.0008: hidraw0: BLUETOOTH HID v0.00 Gamepad [syz0] on syz0 [ 255.417717][ T7549] fido_id[7549]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 255.649422][ T10] usb 4-1: USB disconnect, device number 26 [ 255.713352][ T1319] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.713416][ T1319] ieee802154 phy1 wpan1: encryption failed: -22 [ 256.040243][ T7559] netlink: 56 bytes leftover after parsing attributes in process `syz.1.505'. [ 256.111813][ T5626] usb 1-1: new high-speed USB device number 22 using dummy_hcd [ 256.263417][ T5626] usb 1-1: Using ep0 maxpacket: 32 [ 256.267980][ T5626] usb 1-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 256.301918][ T5626] usb 1-1: config 32 has an invalid interface number: 85 but max is 0 [ 256.301951][ T5626] usb 1-1: config 32 has no interface number 0 [ 256.301980][ T5626] usb 1-1: config 32 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 256.302001][ T5626] usb 1-1: config 32 interface 85 has no altsetting 0 [ 256.310453][ T5626] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 256.310482][ T5626] usb 1-1: Product: syz [ 256.310498][ T5626] usb 1-1: Manufacturer: syz [ 256.310514][ T5626] usb 1-1: SerialNumber: syz [ 256.554167][ T5706] usb 5-1: USB disconnect, device number 28 [ 256.805969][ T5626] appletouch 1-1:32.85: Failed to read mode from device. [ 256.806486][ T5626] appletouch 1-1:32.85: probe with driver appletouch failed with error -5 [ 256.858729][ T5626] usb 1-1: USB disconnect, device number 22 [ 257.332244][ T5626] usb 5-1: new high-speed USB device number 29 using dummy_hcd [ 257.340421][ T63] IPVS: starting estimator thread 0... [ 257.451660][ T7584] IPVS: using max 37 ests per chain, 88800 per kthread [ 257.483161][ T5626] usb 5-1: Using ep0 maxpacket: 8 [ 257.484089][ T5626] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 257.485938][ T5626] usb 5-1: config index 0 descriptor too short (expected 301, got 45) [ 257.485957][ T5626] usb 5-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 257.485989][ T5626] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 257.799520][ T31] audit: type=1326 audit(1792789412.704:1248): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7585 comm="syz.2.515" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf743ef1c code=0x0 [ 257.843812][ T7588] netlink: 56 bytes leftover after parsing attributes in process `syz.0.516'. [ 258.604252][ T63] IPVS: starting estimator thread 0... [ 258.629638][ T7583] IPVS: set_ctl: invalid protocol: 94 127.0.0.1:20002 [ 258.712122][ T7603] IPVS: using max 37 ests per chain, 88800 per kthread [ 258.787982][ T7605] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 258.788473][ T7605] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 259.148855][ T7611] netlink: 4 bytes leftover after parsing attributes in process `syz.3.521'. [ 259.148920][ T7611] bridge_slave_1: left allmulticast mode [ 259.148935][ T7611] bridge_slave_1: left promiscuous mode [ 259.149098][ T7611] bridge0: port 2(bridge_slave_1) entered disabled state [ 259.203043][ T7611] bridge_slave_0: left allmulticast mode [ 259.203064][ T7611] bridge_slave_0: left promiscuous mode [ 259.203268][ T7611] bridge0: port 1(bridge_slave_0) entered disabled state [ 260.181236][ T5359] usb 5-1: USB disconnect, device number 29 [ 260.480639][ T7628] IPv6: NLM_F_REPLACE set, but no existing node found! [ 261.113947][ T7633] ksmbd: Unknown IPC event: 4, ignore. [ 261.189132][ T7633] tipc: Started in network mode [ 261.189158][ T7633] tipc: Node identity 0010000000000000002, cluster identity 4711 [ 261.281799][ T6885] usb 1-1: new full-speed USB device number 23 using dummy_hcd [ 261.459559][ T6885] usb 1-1: New USB device found, idVendor=067b, idProduct=27a1, bcdDevice=b0.9b [ 261.460698][ T6885] usb 1-1: config 0 has an invalid interface number: 231 but max is 0 [ 261.460718][ T6885] usb 1-1: config 0 has no interface number 0 [ 261.460758][ T6885] usb 1-1: config 0 interface 231 altsetting 0 endpoint 0x6 has invalid maxpacket 1023, setting to 64 [ 261.514624][ T6885] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 261.514651][ T6885] usb 1-1: Product: syz [ 261.514662][ T6885] usb 1-1: Manufacturer: syz [ 261.514673][ T6885] usb 1-1: SerialNumber: syz [ 261.552398][ T6885] usb 1-1: config 0 descriptor?? [ 261.554072][ T7635] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 261.687092][ T7643] FAULT_INJECTION: forcing a failure. [ 261.687092][ T7643] name failslab, interval 1, probability 0, space 0, times 0 [ 261.687128][ T7643] CPU: 1 UID: 0 PID: 7643 Comm: syz.2.533 Tainted: G L syzkaller #0 PREEMPT(full) [ 261.687150][ T7643] Tainted: [L]=SOFTLOCKUP [ 261.687155][ T7643] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 261.687165][ T7643] Call Trace: [ 261.687171][ T7643] [ 261.687177][ T7643] dump_stack_lvl+0xe8/0x150 [ 261.687206][ T7643] should_fail_ex+0x410/0x560 [ 261.687232][ T7643] should_failslab+0xa8/0x100 [ 261.687258][ T7643] __kmalloc_noprof+0xf9/0x710 [ 261.687279][ T7643] ? genl_family_rcv_msg_attrs_parse+0xd0/0x2f0 [ 261.687302][ T7643] ? genl_family_rcv_msg_attrs_parse+0xd0/0x2f0 [ 261.687330][ T7643] genl_family_rcv_msg_attrs_parse+0xd0/0x2f0 [ 261.687358][ T7643] genl_family_rcv_msg_doit+0xda/0x340 [ 261.687385][ T7643] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 261.687413][ T7643] ? apparmor_capable+0x126/0x170 [ 261.687438][ T7643] ? bpf_lsm_capable+0x9/0x20 [ 261.687456][ T7643] ? security_capable+0x7e/0x2c0 [ 261.687478][ T7643] genl_rcv_msg+0x614/0x7a0 [ 261.687504][ T7643] ? __pfx_genl_rcv_msg+0x10/0x10 [ 261.687524][ T7643] ? __pfx_tipc_nl_bearer_enable+0x10/0x10 [ 261.687558][ T7643] netlink_rcv_skb+0x226/0x4a0 [ 261.687575][ T7643] ? __pfx_genl_rcv_msg+0x10/0x10 [ 261.687597][ T7643] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 261.687626][ T7643] ? down_read+0x2b9/0x320 [ 261.687653][ T7643] genl_rcv+0x28/0x40 [ 261.687672][ T7643] netlink_unicast+0x8ef/0xa80 [ 261.687733][ T7643] netlink_sendmsg+0x7f0/0xb20 [ 261.687765][ T7643] ? __pfx_netlink_sendmsg+0x10/0x10 [ 261.687804][ T7643] ? aa_sock_msg_perm+0x144/0x210 [ 261.687828][ T7643] ? apparmor_socket_sendmsg+0x98/0x360 [ 261.687845][ T7643] ? __pfx_netlink_sendmsg+0x10/0x10 [ 261.687861][ T7643] sock_sendmsg_nosec+0x14e/0x190 [ 261.687889][ T7643] ____sys_sendmsg+0x54e/0x850 [ 261.687914][ T7643] ? __pfx_____sys_sendmsg+0x10/0x10 [ 261.687947][ T7643] ___sys_sendmsg+0x2a5/0x360 [ 261.687966][ T7643] ? __lock_acquire+0x747/0x2de0 [ 261.687987][ T7643] ? __pfx____sys_sendmsg+0x10/0x10 [ 261.688007][ T7643] ? get_pid_task+0x20/0x1f0 [ 261.688022][ T7643] ? get_pid_task+0x20/0x1f0 [ 261.688036][ T7643] ? get_pid_task+0x20/0x1f0 [ 261.688075][ T7643] ? __fget_files+0x3a2/0x420 [ 261.688091][ T7643] ? __fget_files+0x2a/0x420 [ 261.688119][ T7643] __sys_sendmsg+0x177/0x240 [ 261.688143][ T7643] ? __pfx___sys_sendmsg+0x10/0x10 [ 261.688173][ T7643] ? __might_fault+0xaf/0x130 [ 261.688194][ T7643] __do_fast_syscall_32+0x28b/0x6c0 [ 261.688217][ T7643] ? do_fast_syscall_32+0x33/0x70 [ 261.688239][ T7643] ? asm_int80_emulation+0x1a/0x20 [ 261.688254][ T7643] ? do_int80_emulation+0x299/0x500 [ 261.688279][ T7643] do_fast_syscall_32+0x33/0x70 [ 261.688302][ T7643] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 261.688321][ T7643] RIP: 0023:0xf743ef1c [ 261.688336][ T7643] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 261.688350][ T7643] RSP: 002b:00000000f545650c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 261.688367][ T7643] RAX: ffffffffffffffda RBX: 000000000000000b RCX: 0000000080000540 [ 261.688378][ T7643] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 261.688387][ T7643] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 261.688396][ T7643] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 261.688405][ T7643] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 261.688429][ T7643] [ 262.186589][ T6885] plusb 1-1:0.231 usb0: register 'plusb' at usb-dummy_hcd.0-1, Prolific PL-2301/PL-2302/PL-25A1/PL-27A1, f2:34:b5:d8:c5:1a [ 262.412340][ T30] usb 2-1: new high-speed USB device number 30 using dummy_hcd [ 262.593872][ T30] usb 2-1: Using ep0 maxpacket: 16 [ 262.595541][ T30] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 262.628696][ T30] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 262.628728][ T30] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 262.690614][ T30] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 262.690651][ T30] usb 2-1: Product: syz [ 262.690662][ T30] usb 2-1: Manufacturer: syz [ 262.690672][ T30] usb 2-1: SerialNumber: syz [ 262.768432][ T30] usb 2-1: 0:2 : does not exist [ 262.912438][ T5626] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 263.006458][ T1269] nvmet: connect request for invalid subsystem nqn.2014-08.org.nvmexpress.discovery! [ 263.009243][ T7654] nvme nvme0: Connect Invalid Data Parameter, subsysnqn "nqn.2014-08.org.nvmexpress.discovery" [ 263.072204][ T5626] usb 4-1: Using ep0 maxpacket: 32 [ 263.072358][ T5706] usb 5-1: new high-speed USB device number 30 using dummy_hcd [ 263.079756][ T5626] usb 4-1: unable to get BOS descriptor or descriptor too short [ 263.079811][ T5626] usb 4-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 263.086997][ T5626] usb 4-1: config 14 has an invalid interface number: 57 but max is 1 [ 263.087020][ T5626] usb 4-1: config 14 has an invalid interface number: 228 but max is 1 [ 263.087056][ T5626] usb 4-1: config 14 has no interface number 0 [ 263.087074][ T5626] usb 4-1: config 14 has no interface number 1 [ 263.087154][ T5626] usb 4-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 263.087173][ T5626] usb 4-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 263.087211][ T5626] usb 4-1: config 14 interface 57 has no altsetting 0 [ 263.087232][ T5626] usb 4-1: config 14 interface 228 has no altsetting 0 [ 263.196585][ T5626] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 263.196616][ T5626] usb 4-1: Product: syz [ 263.196633][ T5626] usb 4-1: Manufacturer: syz [ 263.196650][ T5626] usb 4-1: SerialNumber: syz [ 263.242367][ T7667] netlink: 24 bytes leftover after parsing attributes in process `syz.2.539'. [ 263.279226][ T5706] usb 5-1: unable to get BOS descriptor or descriptor too short [ 263.279279][ T5706] usb 5-1: New USB device found, idVendor=8086, idProduct=0ad2, bcdDevice= 0.00 [ 263.311254][ T5706] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 263.311282][ T5706] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 263.311353][ T5706] usb 5-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 263.360362][ T5706] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 263.360394][ T5706] usb 5-1: Product: syz [ 263.360410][ T5706] usb 5-1: Manufacturer: syz [ 263.455824][ T5706] uvcvideo 5-1:1.0: Found UVC 1.00 device syz (8086:0ad2) [ 263.481277][ T30] usb 2-1: 5:0: failed to get current value for ch 0 (-22) [ 263.829139][ T5626] legousbtower 4-1:14.57: interrupt endpoints not found [ 263.858466][ T30] usb 2-1: USB disconnect, device number 30 [ 264.041678][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 264.046920][ T5626] legousbtower 4-1:14.228: interrupt endpoints not found [ 264.184648][ T5645] udevd[5645]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 264.297087][ T30] usb 1-1: USB disconnect, device number 23 [ 264.326311][ T30] plusb 1-1:0.231 usb0: unregister 'plusb' usb-dummy_hcd.0-1, Prolific PL-2301/PL-2302/PL-25A1/PL-27A1 [ 264.697208][ T7682] netlink: 12 bytes leftover after parsing attributes in process `syz.0.541'. [ 264.972749][ T5626] usb 2-1: new high-speed USB device number 31 using dummy_hcd [ 265.124328][ T5626] usb 2-1: Using ep0 maxpacket: 32 [ 265.125152][ T5626] usb 2-1: New USB device found, idVendor=1b1c, idProduct=0c10, bcdDevice= 0.00 [ 265.129150][ T5626] usb 2-1: config 0 interface 0 altsetting 128 endpoint 0x2 has an invalid bInterval 0, changing to 7 [ 265.129175][ T5626] usb 2-1: config 0 interface 0 has no altsetting 0 [ 265.129272][ T5626] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 265.183643][ T5626] usb 2-1: config 0 descriptor?? [ 265.696185][ T5626] corsair-cpro 0003:1B1C:0C10.0009: unknown main item tag 0x0 [ 265.696257][ T5626] corsair-cpro 0003:1B1C:0C10.0009: unknown main item tag 0x0 [ 265.696290][ T5626] corsair-cpro 0003:1B1C:0C10.0009: unknown main item tag 0x0 [ 265.696319][ T5626] corsair-cpro 0003:1B1C:0C10.0009: unknown main item tag 0x0 [ 265.772596][ T5626] corsair-cpro 0003:1B1C:0C10.0009: hidraw0: USB HID v4.06 Device [HID 1b1c:0c10] on usb-dummy_hcd.1-1/input0 [ 265.815904][ T5706] uvcvideo 5-1:1.0: Failed to query (GET_INFO) UVC control 2 on unit 48: -71 (exp. 1). [ 265.831851][ T5706] uvcvideo 5-1:1.0: Failed to query (GET_INFO) UVC control 3 on unit 48: -71 (exp. 1). [ 265.849404][ T5706] uvcvideo 5-1:1.0: Failed to query (GET_INFO) UVC control 6 on unit 48: -71 (exp. 1). [ 265.868383][ T5706] uvcvideo 5-1:1.0: Failed to query (GET_INFO) UVC control 8 on unit 48: -71 (exp. 1). [ 265.882702][ T5706] uvcvideo 5-1:1.0: Failed to query (GET_INFO) UVC control 9 on unit 48: -71 (exp. 1). [ 265.893703][ T5706] uvcvideo 5-1:1.0: Failed to query (GET_INFO) UVC control 1 on unit 48: -71 (exp. 1). [ 265.920307][ T5706] uvcvideo 5-1:1.0: Failed to query (GET_INFO) UVC control 4 on unit 48: -71 (exp. 1). [ 265.931885][ T5706] uvcvideo 5-1:1.0: Failed to query (GET_INFO) UVC control 5 on unit 48: -71 (exp. 1). [ 265.935877][ T5706] uvcvideo 5-1:1.0: Failed to query (GET_CUR) UVC control 5 on unit 48: -71 (exp. 1). [ 265.939804][ T5706] uvcvideo 5-1:1.0: Failed to query (GET_INFO) UVC control 11 on unit 48: -71 (exp. 1). [ 265.941426][ T5706] uvcvideo 5-1:1.0: Failed to query (GET_INFO) UVC control 13 on unit 48: -71 (exp. 1). [ 265.951672][ T0] NOHZ tick-stop error: local softirq work is pending, handler #102!!! [ 265.992907][ T5706] uvcvideo 5-1:1.0: Failed to query (GET_INFO) UVC control 17 on unit 48: -71 (exp. 1). [ 265.994775][ T5706] uvcvideo 5-1:1.0: Failed to query (GET_INFO) UVC control 18 on unit 48: -71 (exp. 1). [ 265.995057][ T5706] uvcvideo 5-1:1.0: No streaming interface found for terminal 32770. [ 266.081878][ T5706] usb 5-1: USB disconnect, device number 30 [ 266.331605][ T6885] usb 4-1: USB disconnect, device number 27 [ 267.103228][ T7703] ksmbd: Unknown IPC event: 4, ignore. [ 267.500564][ T7703] tipc: Started in network mode [ 267.500600][ T7703] tipc: Node identity 0010000000000000002, cluster identity 4711 [ 267.972491][ T5626] corsair-cpro 0003:1B1C:0C10.0009: probe with driver corsair-cpro failed with error -71 [ 268.019234][ T5626] usb 2-1: USB disconnect, device number 31 [ 268.164963][ T5706] usb 4-1: new high-speed USB device number 28 using dummy_hcd [ 268.314003][ T5706] usb 4-1: device descriptor read/64, error -71 [ 268.536099][ T7726] IPv6: NLM_F_REPLACE set, but no existing node found! [ 268.552429][ T5706] usb 4-1: new high-speed USB device number 29 using dummy_hcd [ 268.684695][ T5706] usb 4-1: device descriptor read/64, error -71 [ 268.754945][ T7736] netlink: 56 bytes leftover after parsing attributes in process `syz.4.552'. [ 268.793174][ T5706] usb usb4-port1: attempt power cycle [ 268.863250][ T7727] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 269.137019][ T5706] usb 4-1: new high-speed USB device number 30 using dummy_hcd [ 269.158332][ T5706] usb 4-1: device descriptor read/8, error -71 [ 269.393975][ T5706] usb 4-1: new high-speed USB device number 31 using dummy_hcd [ 269.413339][ T5706] usb 4-1: device descriptor read/8, error -71 [ 269.494094][ T5626] usb 2-1: new high-speed USB device number 32 using dummy_hcd [ 269.524967][ T5706] usb usb4-port1: unable to enumerate USB device [ 269.645208][ T5626] usb 2-1: Using ep0 maxpacket: 8 [ 269.646582][ T5626] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 269.655732][ T5626] usb 2-1: config index 0 descriptor too short (expected 301, got 45) [ 269.655812][ T5626] usb 2-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 269.655936][ T5626] usb 2-1: config 16 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 269.656051][ T5626] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 269.756391][ T5626] usbtmc 2-1:16.0: bulk endpoints not found [ 271.253002][ T5706] usb 5-1: new high-speed USB device number 31 using dummy_hcd [ 271.403099][ T5706] usb 5-1: Using ep0 maxpacket: 32 [ 271.434502][ T5706] usb 5-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 271.454501][ T5706] usb 5-1: config 32 has an invalid interface number: 85 but max is 0 [ 271.454523][ T5706] usb 5-1: config 32 has no interface number 0 [ 271.454572][ T5706] usb 5-1: config 32 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 271.454594][ T5706] usb 5-1: config 32 interface 85 has no altsetting 0 [ 271.500268][ T5706] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 271.500299][ T5706] usb 5-1: Product: syz [ 271.500316][ T5706] usb 5-1: Manufacturer: syz [ 271.500332][ T5706] usb 5-1: SerialNumber: syz [ 271.546525][ T1291] nvmet: connect request for invalid subsystem nqn.2014-08.org.nvmexpress.discovery! [ 271.548567][ T7755] nvme nvme0: Connect Invalid Data Parameter, subsysnqn "nqn.2014-08.org.nvmexpress.discovery" [ 271.872941][ T10] usb 1-1: new high-speed USB device number 24 using dummy_hcd [ 271.898592][ T7766] netlink: 8 bytes leftover after parsing attributes in process `syz.2.558'. [ 271.898695][ T7766] bond0: option arp_all_targets: invalid value (808464432) [ 271.931092][ T7766] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 271.946820][ T7766] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 272.024326][ T10] usb 1-1: Using ep0 maxpacket: 32 [ 272.025577][ T10] usb 1-1: New USB device found, idVendor=1b1c, idProduct=0c10, bcdDevice= 0.00 [ 272.042554][ T10] usb 1-1: config 0 interface 0 altsetting 128 endpoint 0x2 has an invalid bInterval 0, changing to 7 [ 272.042702][ T10] usb 1-1: config 0 interface 0 has no altsetting 0 [ 272.042867][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 272.091687][ T6885] usb 4-1: new high-speed USB device number 32 using dummy_hcd [ 272.097117][ T10] usb 1-1: config 0 descriptor?? [ 272.133381][ T5706] appletouch 5-1:32.85: Failed to read mode from device. [ 272.133601][ T5706] appletouch 5-1:32.85: probe with driver appletouch failed with error -5 [ 272.191044][ T5706] usb 5-1: USB disconnect, device number 31 [ 272.256886][ T6885] usb 4-1: unable to get BOS descriptor or descriptor too short [ 272.256944][ T6885] usb 4-1: New USB device found, idVendor=8086, idProduct=0ad2, bcdDevice= 0.00 [ 272.297580][ T6885] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 272.297619][ T6885] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 272.297665][ T6885] usb 4-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 272.312674][ T30] usb 2-1: USB disconnect, device number 32 [ 272.352885][ T6885] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 272.352915][ T6885] usb 4-1: Product: syz [ 272.352930][ T6885] usb 4-1: Manufacturer: syz [ 272.361746][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 272.401227][ T6885] uvcvideo 4-1:1.0: Found UVC 1.00 device syz (8086:0ad2) [ 272.736552][ T10] corsair-cpro 0003:1B1C:0C10.000A: unknown main item tag 0x0 [ 272.736596][ T10] corsair-cpro 0003:1B1C:0C10.000A: unknown main item tag 0x0 [ 272.736627][ T10] corsair-cpro 0003:1B1C:0C10.000A: unknown main item tag 0x0 [ 272.736656][ T10] corsair-cpro 0003:1B1C:0C10.000A: unknown main item tag 0x0 [ 272.813168][ T10] corsair-cpro 0003:1B1C:0C10.000A: hidraw0: USB HID v4.06 Device [HID 1b1c:0c10] on usb-dummy_hcd.0-1/input0 [ 274.223253][ T6885] uvcvideo 4-1:1.0: Failed to query (GET_INFO) UVC control 2 on unit 48: -71 (exp. 1). [ 274.225445][ T6885] uvcvideo 4-1:1.0: Failed to query (GET_INFO) UVC control 3 on unit 48: -71 (exp. 1). [ 274.254052][ T6885] uvcvideo 4-1:1.0: Failed to query (GET_INFO) UVC control 6 on unit 48: -71 (exp. 1). [ 274.265129][ T6885] uvcvideo 4-1:1.0: Failed to query (GET_INFO) UVC control 8 on unit 48: -71 (exp. 1). [ 274.269747][ T6885] uvcvideo 4-1:1.0: Failed to query (GET_INFO) UVC control 9 on unit 48: -71 (exp. 1). [ 274.296210][ T6885] uvcvideo 4-1:1.0: Failed to query (GET_INFO) UVC control 1 on unit 48: -71 (exp. 1). [ 274.297286][ T6885] uvcvideo 4-1:1.0: Failed to query (GET_INFO) UVC control 4 on unit 48: -71 (exp. 1). [ 274.299689][ T6885] uvcvideo 4-1:1.0: Failed to query (GET_INFO) UVC control 5 on unit 48: -71 (exp. 1). [ 274.300723][ T6885] uvcvideo 4-1:1.0: Failed to query (GET_CUR) UVC control 5 on unit 48: -71 (exp. 1). [ 274.332070][ T6885] uvcvideo 4-1:1.0: Failed to query (GET_INFO) UVC control 11 on unit 48: -71 (exp. 1). [ 274.356654][ T6885] uvcvideo 4-1:1.0: Failed to query (GET_INFO) UVC control 13 on unit 48: -71 (exp. 1). [ 274.358603][ T6885] uvcvideo 4-1:1.0: Failed to query (GET_INFO) UVC control 17 on unit 48: -71 (exp. 1). [ 274.361197][ T6885] uvcvideo 4-1:1.0: Failed to query (GET_INFO) UVC control 18 on unit 48: -71 (exp. 1). [ 274.393264][ T6885] uvcvideo 4-1:1.0: No streaming interface found for terminal 32770. [ 274.399493][ T6885] usb 4-1: USB disconnect, device number 32 [ 274.736483][ T10] corsair-cpro 0003:1B1C:0C10.000A: probe with driver corsair-cpro failed with error -71 [ 274.790102][ T10] usb 1-1: USB disconnect, device number 24 [ 274.900990][ T7783] netlink: 56 bytes leftover after parsing attributes in process `syz.0.564'. [ 275.419184][ T7789] openvswitch: netlink: Message has 8 unknown bytes. [ 276.431826][ T10] usb 4-1: new high-speed USB device number 33 using dummy_hcd [ 276.595465][ T10] usb 4-1: Using ep0 maxpacket: 8 [ 276.599033][ T10] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 276.621986][ T10] usb 4-1: config index 0 descriptor too short (expected 301, got 45) [ 276.622019][ T10] usb 4-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 276.622065][ T10] usb 4-1: config 16 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 276.622112][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 276.693178][ T10] usbtmc 4-1:16.0: bulk endpoints not found [ 277.985195][ T6885] usb 1-1: new high-speed USB device number 25 using dummy_hcd [ 278.059928][ T7854] netlink: 56 bytes leftover after parsing attributes in process `syz.1.576'. [ 278.131697][ T6885] usb 1-1: Using ep0 maxpacket: 32 [ 278.132474][ T6885] usb 1-1: New USB device found, idVendor=1b1c, idProduct=0c10, bcdDevice= 0.00 [ 278.135937][ T6885] usb 1-1: config 0 interface 0 altsetting 128 endpoint 0x2 has an invalid bInterval 0, changing to 7 [ 278.135973][ T6885] usb 1-1: config 0 interface 0 has no altsetting 0 [ 278.136010][ T6885] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 278.140816][ T6885] usb 1-1: config 0 descriptor?? [ 278.507291][ T7858] input: syz1 as /devices/virtual/input/input29 [ 278.748541][ T6885] corsair-cpro 0003:1B1C:0C10.000B: unknown main item tag 0x0 [ 278.748571][ T6885] corsair-cpro 0003:1B1C:0C10.000B: unknown main item tag 0x0 [ 278.748592][ T6885] corsair-cpro 0003:1B1C:0C10.000B: unknown main item tag 0x0 [ 278.748612][ T6885] corsair-cpro 0003:1B1C:0C10.000B: unknown main item tag 0x0 [ 278.816972][ T6885] corsair-cpro 0003:1B1C:0C10.000B: hidraw0: USB HID v4.06 Device [HID 1b1c:0c10] on usb-dummy_hcd.0-1/input0 [ 278.952119][ T7809] nvmet: connect request for invalid subsystem t! [ 278.958592][ T7859] nvme nvme0: Connect Invalid Data Parameter, subsysnqn "t" [ 279.360909][ T30] usb 4-1: USB disconnect, device number 33 [ 280.922401][ T6885] corsair-cpro 0003:1B1C:0C10.000B: probe with driver corsair-cpro failed with error -71 [ 280.973663][ T6885] usb 1-1: USB disconnect, device number 25 [ 281.140773][ T7882] FAULT_INJECTION: forcing a failure. [ 281.140773][ T7882] name failslab, interval 1, probability 0, space 0, times 0 [ 281.140825][ T7882] CPU: 0 UID: 0 PID: 7882 Comm: syz.3.583 Tainted: G L syzkaller #0 PREEMPT(full) [ 281.140859][ T7882] Tainted: [L]=SOFTLOCKUP [ 281.140868][ T7882] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 281.140883][ T7882] Call Trace: [ 281.140892][ T7882] [ 281.140901][ T7882] dump_stack_lvl+0xe8/0x150 [ 281.140943][ T7882] should_fail_ex+0x410/0x560 [ 281.140980][ T7882] should_failslab+0xa8/0x100 [ 281.141018][ T7882] __kmalloc_cache_node_noprof+0xa5/0x620 [ 281.141052][ T7882] ? vm_map_ram+0x686/0xe70 [ 281.141073][ T7882] ? vm_map_ram+0x686/0xe70 [ 281.141103][ T7882] vm_map_ram+0x686/0xe70 [ 281.141129][ T7882] ? vm_map_ram+0x6b/0xe70 [ 281.141158][ T7882] fuse_readdir+0x20b2/0x3550 [ 281.141188][ T7882] ? is_bpf_text_address+0x292/0x2b0 [ 281.141227][ T7882] ? __kernel_text_address+0xd/0x30 [ 281.141247][ T7882] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 281.141277][ T7882] ? stack_trace_save+0xa9/0x100 [ 281.141294][ T7882] ? __pfx_stack_trace_save+0x10/0x10 [ 281.141319][ T7882] ? check_path+0x21/0x40 [ 281.141343][ T7882] ? __pfx_fuse_readdir+0x10/0x10 [ 281.141393][ T7882] ? add_lock_to_list+0xc7/0x100 [ 281.141425][ T7882] ? lockdep_unlock+0x5c/0xd0 [ 281.141445][ T7882] ? __lock_acquire+0x1511/0x2de0 [ 281.141517][ T7882] ? iterate_dir+0x287/0x880 [ 281.141558][ T7882] iterate_dir+0x3db/0x880 [ 281.141592][ T7882] __se_sys_getdents64+0xf1/0x280 [ 281.141617][ T7882] ? __pfx___se_sys_getdents64+0x10/0x10 [ 281.141639][ T7882] ? __pfx_filldir64+0x10/0x10 [ 281.141668][ T7882] ? __might_fault+0xaf/0x130 [ 281.141688][ T7882] __do_fast_syscall_32+0x28b/0x6c0 [ 281.141712][ T7882] ? do_fast_syscall_32+0x33/0x70 [ 281.141734][ T7882] ? asm_int80_emulation+0x1a/0x20 [ 281.141749][ T7882] ? do_int80_emulation+0x299/0x500 [ 281.141792][ T7882] ? trace_irq_disable+0x3b/0x140 [ 281.141841][ T7882] do_fast_syscall_32+0x33/0x70 [ 281.141864][ T7882] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 281.141884][ T7882] RIP: 0023:0xf7f74f1c [ 281.141899][ T7882] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 281.141912][ T7882] RSP: 002b:00000000f540550c EFLAGS: 00000206 ORIG_RAX: 00000000000000dc [ 281.141929][ T7882] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000800067c0 [ 281.141941][ T7882] RDX: 0000000000000086 RSI: 0000000000000000 RDI: 0000000000000000 [ 281.141950][ T7882] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 281.141959][ T7882] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 281.141968][ T7882] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 281.141991][ T7882] [ 282.042809][ T6885] usb 1-1: new high-speed USB device number 26 using dummy_hcd [ 282.201566][ T6885] usb 1-1: Using ep0 maxpacket: 32 [ 282.204194][ T6885] usb 1-1: unable to get BOS descriptor or descriptor too short [ 282.204230][ T6885] usb 1-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 282.206527][ T7897] netlink: 104 bytes leftover after parsing attributes in process `syz.3.588'. [ 282.230434][ T6885] usb 1-1: config 14 has an invalid interface number: 57 but max is 1 [ 282.230457][ T6885] usb 1-1: config 14 has an invalid interface number: 228 but max is 1 [ 282.230473][ T6885] usb 1-1: config 14 has no interface number 0 [ 282.230484][ T6885] usb 1-1: config 14 has no interface number 1 [ 282.230529][ T6885] usb 1-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 282.230547][ T6885] usb 1-1: config 14 interface 228 altsetting 5 has an invalid endpoint descriptor of length 2, skipping [ 282.230564][ T6885] usb 1-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 282.230583][ T6885] usb 1-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 282.230602][ T6885] usb 1-1: config 14 interface 57 has no altsetting 0 [ 282.230615][ T6885] usb 1-1: config 14 interface 228 has no altsetting 0 [ 282.342343][ T6885] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 282.342375][ T6885] usb 1-1: Product: syz [ 282.342612][ T6885] usb 1-1: Manufacturer: syz [ 282.342631][ T6885] usb 1-1: SerialNumber: syz [ 282.855628][ T6885] legousbtower 1-1:14.57: interrupt endpoints not found [ 283.061162][ T6885] legousbtower 1-1:14.228: interrupt endpoints not found [ 284.197421][ T7913] netlink: 8 bytes leftover after parsing attributes in process `syz.3.593'. [ 284.238135][ T7765] syz.2.558 (7765): drop_caches: 1 [ 284.541650][ T6885] usb 4-1: new high-speed USB device number 34 using dummy_hcd [ 284.639549][ T7915] FAULT_INJECTION: forcing a failure. [ 284.639549][ T7915] name failslab, interval 1, probability 0, space 0, times 0 [ 284.659132][ T7915] CPU: 0 UID: 0 PID: 7915 Comm: syz.2.594 Tainted: G L syzkaller #0 PREEMPT(full) [ 284.659169][ T7915] Tainted: [L]=SOFTLOCKUP [ 284.659178][ T7915] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 284.659192][ T7915] Call Trace: [ 284.659202][ T7915] [ 284.659213][ T7915] dump_stack_lvl+0xe8/0x150 [ 284.659252][ T7915] should_fail_ex+0x410/0x560 [ 284.659288][ T7915] ? __alloc_skb+0x1db/0x7a0 [ 284.659323][ T7915] should_failslab+0xa8/0x100 [ 284.659371][ T7915] ? __alloc_skb+0x1db/0x7a0 [ 284.659403][ T7915] kmem_cache_alloc_node_noprof+0x9c/0x600 [ 284.659444][ T7915] ? __alloc_skb+0x18d/0x7a0 [ 284.659481][ T7915] ? __alloc_skb+0x1db/0x7a0 [ 284.659537][ T7915] __alloc_skb+0x1db/0x7a0 [ 284.659579][ T7915] ethnl_default_notify+0x5b8/0xb00 [ 284.659633][ T7915] ? __pfx_ethnl_default_notify+0x10/0x10 [ 284.659693][ T7915] ? ethnl_notify+0x1a3/0x300 [ 284.659733][ T7915] ethnl_default_set_doit+0xa9c/0x10b0 [ 284.659780][ T7915] genl_family_rcv_msg_doit+0x233/0x340 [ 284.659831][ T7915] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 284.659892][ T7915] ? bpf_lsm_capable+0x9/0x20 [ 284.659927][ T7915] ? security_capable+0x7e/0x2c0 [ 284.659968][ T7915] genl_rcv_msg+0x614/0x7a0 [ 284.660026][ T7915] ? __pfx_genl_rcv_msg+0x10/0x10 [ 284.660068][ T7915] ? __pfx_ethnl_default_set_doit+0x10/0x10 [ 284.660127][ T7915] netlink_rcv_skb+0x226/0x4a0 [ 284.660160][ T7915] ? __pfx_genl_rcv_msg+0x10/0x10 [ 284.660203][ T7915] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 284.660257][ T7915] ? down_read+0x2b9/0x320 [ 284.660304][ T7915] genl_rcv+0x28/0x40 [ 284.660332][ T7915] netlink_unicast+0x8ef/0xa80 [ 284.660385][ T7915] netlink_sendmsg+0x7f0/0xb20 [ 284.660418][ T7915] ? __pfx_netlink_sendmsg+0x10/0x10 [ 284.660448][ T7915] ? aa_sock_msg_perm+0x144/0x210 [ 284.660479][ T7915] ? apparmor_socket_sendmsg+0x98/0x360 [ 284.660504][ T7915] ? __pfx_netlink_sendmsg+0x10/0x10 [ 284.660527][ T7915] sock_sendmsg_nosec+0x14e/0x190 [ 284.660567][ T7915] ____sys_sendmsg+0x54e/0x850 [ 284.660605][ T7915] ? __pfx_____sys_sendmsg+0x10/0x10 [ 284.660655][ T7915] ___sys_sendmsg+0x2a5/0x360 [ 284.660685][ T7915] ? __lock_acquire+0x747/0x2de0 [ 284.660717][ T7915] ? __pfx____sys_sendmsg+0x10/0x10 [ 284.660748][ T7915] ? get_pid_task+0x20/0x1f0 [ 284.660771][ T7915] ? get_pid_task+0x20/0x1f0 [ 284.660792][ T7915] ? get_pid_task+0x20/0x1f0 [ 284.660851][ T7915] ? __fget_files+0x3a2/0x420 [ 284.660877][ T7915] ? __fget_files+0x2a/0x420 [ 284.660913][ T7915] __sys_sendmsg+0x177/0x240 [ 284.660958][ T7915] ? __pfx___sys_sendmsg+0x10/0x10 [ 284.661024][ T7915] ? __might_fault+0xaf/0x130 [ 284.661064][ T7915] __do_fast_syscall_32+0x28b/0x6c0 [ 284.661110][ T7915] ? do_fast_syscall_32+0x33/0x70 [ 284.661151][ T7915] ? asm_int80_emulation+0x1a/0x20 [ 284.661182][ T7915] ? do_int80_emulation+0x299/0x500 [ 284.661224][ T7915] ? trace_irq_disable+0x3b/0x140 [ 284.661261][ T7915] do_fast_syscall_32+0x33/0x70 [ 284.661301][ T7915] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 284.661339][ T7915] RIP: 0023:0xf743ef1c [ 284.661368][ T7915] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 284.661394][ T7915] RSP: 002b:00000000f545650c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 284.661425][ T7915] RAX: ffffffffffffffda RBX: 000000000000001a RCX: 00000000800004c0 [ 284.661443][ T7915] RDX: 0000000000040090 RSI: 0000000000000000 RDI: 0000000000000000 [ 284.661459][ T7915] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 284.661472][ T7915] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 284.661486][ T7915] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 284.661522][ T7915] [ 284.673863][ T6885] usb 4-1: device descriptor read/64, error -71 [ 284.983142][ T6885] usb 4-1: new high-speed USB device number 35 using dummy_hcd [ 285.211674][ T6885] usb 4-1: device descriptor read/64, error -71 [ 285.229199][ T5706] usb 1-1: USB disconnect, device number 26 [ 285.323531][ T6885] usb usb4-port1: attempt power cycle [ 285.661666][ T5706] usb 1-1: new high-speed USB device number 27 using dummy_hcd [ 285.681657][ T6885] usb 4-1: new high-speed USB device number 36 using dummy_hcd [ 285.702399][ T6885] usb 4-1: device descriptor read/8, error -71 [ 285.811744][ T5706] usb 1-1: Using ep0 maxpacket: 32 [ 285.813431][ T5706] usb 1-1: New USB device found, idVendor=1b1c, idProduct=0c10, bcdDevice= 0.00 [ 285.815640][ T5706] usb 1-1: config 0 interface 0 altsetting 128 endpoint 0x2 has an invalid bInterval 0, changing to 7 [ 285.815675][ T5706] usb 1-1: config 0 interface 0 has no altsetting 0 [ 285.815712][ T5706] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 285.866271][ T5706] usb 1-1: config 0 descriptor?? [ 285.943469][ T6885] usb 4-1: new high-speed USB device number 37 using dummy_hcd [ 285.965622][ T6885] usb 4-1: device descriptor read/8, error -71 [ 286.074534][ T6885] usb usb4-port1: unable to enumerate USB device [ 286.324352][ T5706] corsair-cpro 0003:1B1C:0C10.000C: unknown main item tag 0x0 [ 286.324381][ T5706] corsair-cpro 0003:1B1C:0C10.000C: unknown main item tag 0x0 [ 286.324401][ T5706] corsair-cpro 0003:1B1C:0C10.000C: unknown main item tag 0x0 [ 286.361748][ T5706] corsair-cpro 0003:1B1C:0C10.000C: hidraw0: USB HID v4.06 Device [HID 1b1c:0c10] on usb-dummy_hcd.0-1/input0 [ 286.651804][ T7924] binder: BINDER_SET_CONTEXT_MGR already set [ 286.651847][ T7924] binder: 7922:7924 ioctl 4018620d 800002c0 returned -16 [ 286.675723][ T7924] binder: 7922:7924 ioctl c0306201 80000140 returned -14 [ 287.170752][ T7930] netlink: 104 bytes leftover after parsing attributes in process `syz.2.600'. [ 288.648978][ T5706] corsair-cpro 0003:1B1C:0C10.000C: probe with driver corsair-cpro failed with error -71 [ 288.671807][ T31] audit: type=1326 audit(1792789443.574:1249): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7934 comm="syz.2.602" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=31 arch=40000003 syscall=354 compat=1 ip=0xf743ef1c code=0x0 [ 288.733427][ T5706] usb 1-1: USB disconnect, device number 27 [ 289.431110][ T31] audit: type=1326 audit(1792789444.334:1250): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7966 comm="syz.3.609" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7f74f1c code=0x0 [ 289.751918][ T7970] netlink: 4 bytes leftover after parsing attributes in process `syz.2.610'. [ 289.786725][ T7970] netlink: 4 bytes leftover after parsing attributes in process `syz.2.610'. [ 290.122053][ T5626] usb 5-1: new high-speed USB device number 32 using dummy_hcd [ 290.273788][ T5626] usb 5-1: Using ep0 maxpacket: 8 [ 290.290233][ T5626] usb 5-1: New USB device found, idVendor=084e, idProduct=1001, bcdDevice=ed.ae [ 290.306988][ T5626] usb 5-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 290.307011][ T5626] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x94, changing to 0x84 [ 290.307050][ T5626] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x84 has an invalid bInterval 0, changing to 7 [ 290.307076][ T5626] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 290.307102][ T5626] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 290.385022][ T5626] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 290.385905][ T5626] usb 5-1: Product: syz [ 290.385925][ T5626] usb 5-1: Manufacturer: syz [ 290.385942][ T5626] usb 5-1: SerialNumber: syz [ 290.418845][ T5626] usb 5-1: config 0 descriptor?? [ 290.446377][ T5626] input: KB Gear Tablet as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/input/input30 [ 290.624044][ T7976] netlink: 104 bytes leftover after parsing attributes in process `syz.2.612'. [ 290.726095][ T5359] usb 5-1: USB disconnect, device number 32 [ 291.523571][ T5359] usb 2-1: new high-speed USB device number 33 using dummy_hcd [ 291.691643][ T5359] usb 2-1: Using ep0 maxpacket: 8 [ 291.692383][ T5359] usb 2-1: New USB device found, idVendor=084e, idProduct=1001, bcdDevice=ed.ae [ 291.693438][ T5359] usb 2-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 291.693458][ T5359] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x94, changing to 0x84 [ 291.693476][ T5359] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x84 has an invalid bInterval 0, changing to 7 [ 291.693495][ T5359] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 291.693511][ T5359] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 291.788462][ T5359] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 291.788497][ T5359] usb 2-1: Product: syz [ 291.788509][ T5359] usb 2-1: Manufacturer: syz [ 291.788519][ T5359] usb 2-1: SerialNumber: syz [ 291.825823][ T5359] usb 2-1: config 0 descriptor?? [ 291.893580][ T5359] input: KB Gear Tablet as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/input/input31 [ 291.989797][ T7992] netlink: 136 bytes leftover after parsing attributes in process `syz.0.617'. [ 291.989818][ T7992] openvswitch: netlink: Flow actions attr not present in new flow. [ 292.172276][ T6885] usb 5-1: new high-speed USB device number 33 using dummy_hcd [ 292.308159][ T7985] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 292.323869][ T7985] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 292.341656][ T6885] usb 5-1: Using ep0 maxpacket: 32 [ 292.364563][ T6885] usb 5-1: New USB device found, idVendor=1b1c, idProduct=0c10, bcdDevice= 0.00 [ 292.401262][ T6885] usb 5-1: config 0 interface 0 altsetting 128 endpoint 0x2 has an invalid bInterval 0, changing to 7 [ 292.401290][ T6885] usb 5-1: config 0 interface 0 has no altsetting 0 [ 292.401315][ T6885] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 292.473965][ T6885] usb 5-1: config 0 descriptor?? [ 292.520974][ T5359] usb 2-1: USB disconnect, device number 33 [ 293.048962][ T6885] corsair-cpro 0003:1B1C:0C10.000D: unknown main item tag 0x0 [ 293.048992][ T6885] corsair-cpro 0003:1B1C:0C10.000D: unknown main item tag 0x0 [ 293.049013][ T6885] corsair-cpro 0003:1B1C:0C10.000D: unknown main item tag 0x0 [ 293.104992][ T6885] corsair-cpro 0003:1B1C:0C10.000D: hidraw0: USB HID v4.06 Device [HID 1b1c:0c10] on usb-dummy_hcd.4-1/input0 [ 293.924490][ T5706] usb 2-1: new high-speed USB device number 34 using dummy_hcd [ 294.071640][ T5706] usb 2-1: Using ep0 maxpacket: 8 [ 294.074221][ T5706] usb 2-1: New USB device found, idVendor=a4dd, idProduct=3104, bcdDevice=40.90 [ 294.103813][ T5706] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 294.103860][ T5706] usb 2-1: can't read configurations, error -61 [ 294.232054][ T5706] usb 2-1: new high-speed USB device number 35 using dummy_hcd [ 294.383235][ T5706] usb 2-1: Using ep0 maxpacket: 8 [ 294.399602][ T5706] usb 2-1: New USB device found, idVendor=a4dd, idProduct=3104, bcdDevice=40.90 [ 294.423530][ T5706] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 294.423560][ T5706] usb 2-1: can't read configurations, error -61 [ 294.426130][ T5706] usb usb2-port1: attempt power cycle [ 294.761684][ T5706] usb 2-1: new high-speed USB device number 36 using dummy_hcd [ 294.806345][ T5706] usb 2-1: Using ep0 maxpacket: 8 [ 294.809648][ T5706] usb 2-1: New USB device found, idVendor=a4dd, idProduct=3104, bcdDevice=40.90 [ 294.837979][ T5706] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 294.838020][ T5706] usb 2-1: can't read configurations, error -61 [ 294.982340][ T5706] usb 2-1: new high-speed USB device number 37 using dummy_hcd [ 295.012633][ T5706] usb 2-1: Using ep0 maxpacket: 8 [ 295.013758][ T5706] usb 2-1: New USB device found, idVendor=a4dd, idProduct=3104, bcdDevice=40.90 [ 295.020667][ T5706] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 295.020715][ T5706] usb 2-1: can't read configurations, error -61 [ 295.021224][ T5706] usb usb2-port1: unable to enumerate USB device [ 295.298668][ T6885] corsair-cpro 0003:1B1C:0C10.000D: probe with driver corsair-cpro failed with error -71 [ 295.363847][ T6885] usb 5-1: USB disconnect, device number 33 [ 296.061573][ T5626] usb 5-1: new high-speed USB device number 34 using dummy_hcd [ 296.226036][ T5626] usb 5-1: Using ep0 maxpacket: 16 [ 296.243923][ T5626] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 296.249821][ T5626] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 296.249855][ T5626] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 296.310392][ T5626] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 296.310425][ T5626] usb 5-1: Product: syz [ 296.310437][ T5626] usb 5-1: Manufacturer: syz [ 296.310450][ T5626] usb 5-1: SerialNumber: syz [ 296.397546][ T5626] usb 5-1: 0:2 : does not exist [ 296.515234][ T8028] FAULT_INJECTION: forcing a failure. [ 296.515234][ T8028] name failslab, interval 1, probability 0, space 0, times 0 [ 296.515280][ T8028] CPU: 1 UID: 0 PID: 8028 Comm: syz.2.625 Tainted: G L syzkaller #0 PREEMPT(full) [ 296.515302][ T8028] Tainted: [L]=SOFTLOCKUP [ 296.515307][ T8028] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 296.515334][ T8028] Call Trace: [ 296.515344][ T8028] [ 296.515354][ T8028] dump_stack_lvl+0xe8/0x150 [ 296.515393][ T8028] should_fail_ex+0x410/0x560 [ 296.515435][ T8028] ? __alloc_skb+0x1db/0x7a0 [ 296.515454][ T8028] should_failslab+0xa8/0x100 [ 296.515499][ T8028] ? __alloc_skb+0x1db/0x7a0 [ 296.515523][ T8028] kmem_cache_alloc_node_noprof+0x9c/0x600 [ 296.515551][ T8028] ? __alloc_skb+0x18d/0x7a0 [ 296.515582][ T8028] ? __alloc_skb+0x1db/0x7a0 [ 296.515606][ T8028] __alloc_skb+0x1db/0x7a0 [ 296.515628][ T8028] br_vlan_notify+0x271/0x700 [ 296.515690][ T8028] ? br_vlan_delete+0x1c8/0x220 [ 296.515727][ T8028] __br_vlan_set_default_pvid+0x681/0x12d0 [ 296.515757][ T8028] ? __local_bh_enable_ip+0xd6/0x140 [ 296.515777][ T8028] ? br_stp_set_enabled+0x496/0x7c0 [ 296.515821][ T8028] br_changelink+0x62c/0x18e0 [ 296.515863][ T8028] ? __mutex_lock+0x10de/0x15a0 [ 296.515895][ T8028] ? __pfx_br_changelink+0x10/0x10 [ 296.515931][ T8028] ? __mutex_lock+0x5cd/0x15a0 [ 296.515983][ T8028] ? rtnl_newlink+0xc1d/0x1c30 [ 296.516016][ T8028] ? __pfx___mutex_lock+0x10/0x10 [ 296.516056][ T8028] ? ns_capable+0x84/0xe0 [ 296.516087][ T8028] ? rtnl_nets_add+0x16c/0x300 [ 296.516107][ T8028] ? refcount_inc+0x46/0x70 [ 296.516127][ T8028] rtnl_newlink+0x160b/0x1c30 [ 296.516184][ T8028] ? __pfx_rtnl_newlink+0x10/0x10 [ 296.516210][ T8028] ? __netlink_deliver_tap+0x4f1/0x6e0 [ 296.516236][ T8028] ? netlink_deliver_tap+0x19c/0x1b0 [ 296.516251][ T8028] ? netlink_unicast+0x8c1/0xa80 [ 296.516273][ T8028] ? netlink_sendmsg+0x7f0/0xb20 [ 296.516301][ T8028] ? sock_sendmsg_nosec+0x14e/0x190 [ 296.516336][ T8028] ? ____sys_sendmsg+0x54e/0x850 [ 296.516362][ T8028] ? ___sys_sendmsg+0x2a5/0x360 [ 296.516389][ T8028] ? __sys_sendmsg+0x177/0x240 [ 296.516416][ T8028] ? __do_fast_syscall_32+0x28b/0x6c0 [ 296.516451][ T8028] ? do_fast_syscall_32+0x33/0x70 [ 296.516485][ T8028] ? entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 296.516552][ T8028] ? kasan_quarantine_put+0xbb/0x1f0 [ 296.516582][ T8028] ? lockdep_hardirqs_on+0x7b/0x110 [ 296.516606][ T8028] ? nlmon_xmit+0xb0/0x100 [ 296.516646][ T8028] ? kmem_cache_free+0x182/0x650 [ 296.516686][ T8028] ? __lock_acquire+0x747/0x2de0 [ 296.516719][ T8028] ? __pfx_hook_capable+0x10/0x10 [ 296.516744][ T8028] ? __dev_queue_xmit+0x29b/0x3920 [ 296.516770][ T8028] ? __pfx_hook_capable+0x10/0x10 [ 296.516808][ T8028] ? lockdep_hardirqs_on+0x7b/0x110 [ 296.516865][ T8028] ? __pfx_rtnl_newlink+0x10/0x10 [ 296.516893][ T8028] rtnetlink_rcv_msg+0x802/0xc00 [ 296.516917][ T8028] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 296.516955][ T8028] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 296.516989][ T8028] ? __copy_skb_header+0xa3/0x4a0 [ 296.517033][ T8028] netlink_rcv_skb+0x226/0x4a0 [ 296.517057][ T8028] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 296.517087][ T8028] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 296.517145][ T8028] ? netlink_deliver_tap+0x2e/0x1b0 [ 296.517168][ T8028] ? netlink_deliver_tap+0x2e/0x1b0 [ 296.517196][ T8028] netlink_unicast+0x8ef/0xa80 [ 296.517242][ T8028] netlink_sendmsg+0x7f0/0xb20 [ 296.517278][ T8028] ? __pfx_netlink_sendmsg+0x10/0x10 [ 296.517308][ T8028] ? aa_sock_msg_perm+0x144/0x210 [ 296.517339][ T8028] ? apparmor_socket_sendmsg+0x98/0x360 [ 296.517369][ T8028] ? __pfx_netlink_sendmsg+0x10/0x10 [ 296.517386][ T8028] sock_sendmsg_nosec+0x14e/0x190 [ 296.517414][ T8028] ____sys_sendmsg+0x54e/0x850 [ 296.517466][ T8028] ? __pfx_____sys_sendmsg+0x10/0x10 [ 296.517513][ T8028] ___sys_sendmsg+0x2a5/0x360 [ 296.517541][ T8028] ? __lock_acquire+0x747/0x2de0 [ 296.517562][ T8028] ? __pfx____sys_sendmsg+0x10/0x10 [ 296.517598][ T8028] ? get_pid_task+0x20/0x1f0 [ 296.517622][ T8028] ? get_pid_task+0x20/0x1f0 [ 296.517641][ T8028] ? get_pid_task+0x20/0x1f0 [ 296.517696][ T8028] ? __fget_files+0x3a2/0x420 [ 296.517714][ T8028] ? __fget_files+0x2a/0x420 [ 296.517753][ T8028] __sys_sendmsg+0x177/0x240 [ 296.517787][ T8028] ? __pfx___sys_sendmsg+0x10/0x10 [ 296.517834][ T8028] ? __might_fault+0xaf/0x130 [ 296.517876][ T8028] __do_fast_syscall_32+0x28b/0x6c0 [ 296.517911][ T8028] ? do_fast_syscall_32+0x33/0x70 [ 296.517942][ T8028] ? asm_int80_emulation+0x1a/0x20 [ 296.517964][ T8028] ? do_int80_emulation+0x299/0x500 [ 296.517994][ T8028] ? trace_irq_disable+0x3b/0x140 [ 296.518027][ T8028] do_fast_syscall_32+0x33/0x70 [ 296.518074][ T8028] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 296.518103][ T8028] RIP: 0023:0xf743ef1c [ 296.518124][ T8028] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 296.518144][ T8028] RSP: 002b:00000000f545650c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 296.518168][ T8028] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000080000280 [ 296.518184][ T8028] RDX: 0000000000040004 RSI: 0000000000000000 RDI: 0000000000000000 [ 296.518196][ T8028] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 296.518213][ T8028] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 296.518241][ T8028] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 296.518275][ T8028] [ 296.682295][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 297.149321][ T5626] usb 5-1: 5:0: failed to get current value for ch 0 (-22) [ 297.239083][ T8028] bridge0: port 2(bridge_slave_1) entered disabled state [ 297.240071][ T8028] bridge0: port 1(bridge_slave_0) entered disabled state [ 297.445791][ T5626] usb 5-1: USB disconnect, device number 34 [ 297.590242][ T5645] udevd[5645]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 297.706418][ T8031] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 297.706863][ T8031] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 297.732047][ T8031] netlink: 104 bytes leftover after parsing attributes in process `syz.2.627'. [ 298.042733][ T30] usb 2-1: new high-speed USB device number 38 using dummy_hcd [ 298.072454][ T8035] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3780442281 (7560884562 ns) > initial count (4669583980 ns). Using initial count to start timer. [ 298.104566][ T8035] FAULT_INJECTION: forcing a failure. [ 298.104566][ T8035] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 298.104596][ T8035] CPU: 1 UID: 0 PID: 8035 Comm: syz.3.628 Tainted: G L syzkaller #0 PREEMPT(full) [ 298.104624][ T8035] Tainted: [L]=SOFTLOCKUP [ 298.104630][ T8035] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 298.104640][ T8035] Call Trace: [ 298.104646][ T8035] [ 298.104653][ T8035] dump_stack_lvl+0xe8/0x150 [ 298.104683][ T8035] should_fail_ex+0x410/0x560 [ 298.104710][ T8035] prepare_alloc_pages+0x21e/0x5f0 [ 298.104737][ T8035] __alloc_frozen_pages_noprof+0x185/0x5a0 [ 298.104766][ T8035] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 298.104794][ T8035] ? __pfx_policy_nodemask+0x10/0x10 [ 298.104822][ T8035] ? do_raw_spin_lock+0x12b/0x2f0 [ 298.104848][ T8035] alloc_pages_mpol+0x21e/0x390 [ 298.104877][ T8035] folio_alloc_mpol_noprof+0x39/0x160 [ 298.104904][ T8035] shmem_alloc_and_add_folio+0x43e/0xf60 [ 298.104921][ T8035] ? filemap_get_entry+0xcd/0x3f0 [ 298.104954][ T8035] ? __pfx_filemap_get_entry+0x10/0x10 [ 298.104980][ T8035] ? __pfx_shmem_alloc_and_add_folio+0x10/0x10 [ 298.104999][ T8035] ? shmem_allowable_huge_orders+0x61e/0x6c0 [ 298.105030][ T8035] shmem_get_folio_gfp+0x5d5/0x16d0 [ 298.105069][ T8035] shmem_fault+0x179/0x390 [ 298.105092][ T8035] __do_fault+0x138/0x2a0 [ 298.105114][ T8035] do_pte_missing+0x684/0x34b0 [ 298.105143][ T8035] ? handle_mm_fault+0xf1/0x3750 [ 298.105163][ T8035] handle_mm_fault+0x1a53/0x3750 [ 298.105187][ T8035] ? handle_mm_fault+0xf1/0x3750 [ 298.105212][ T8035] ? __pfx_handle_mm_fault+0x10/0x10 [ 298.105229][ T8035] ? follow_page_pte+0x748/0xf10 [ 298.105253][ T8035] ? __pfx_follow_page_pte+0x10/0x10 [ 298.105285][ T8035] __get_user_pages+0x1670/0x2750 [ 298.105336][ T8035] get_user_pages_unlocked+0x1ee/0x750 [ 298.105369][ T8035] hva_to_pfn+0x360/0xf10 [ 298.105388][ T8035] ? __pfx_stack_trace_save+0x10/0x10 [ 298.105414][ T8035] ? __pfx_hva_to_pfn+0x10/0x10 [ 298.105429][ T8035] ? add_lock_to_list+0xc7/0x100 [ 298.105453][ T8035] ? __lock_acquire+0x747/0x2de0 [ 298.105472][ T8035] ? __lock_acquire+0x1511/0x2de0 [ 298.105498][ T8035] ? kvm_follow_pfn+0x21a/0x3c0 [ 298.105518][ T8035] __kvm_faultin_pfn+0xaa/0x100 [ 298.105542][ T8035] vmx_set_apic_access_page_addr+0x512/0xab0 [ 298.105565][ T8035] ? kvm_irq_has_notifier+0x4e/0x1b0 [ 298.105586][ T8035] ? __pfx_vmx_set_apic_access_page_addr+0x10/0x10 [ 298.105607][ T8035] ? __bitmap_or+0x2f5/0x300 [ 298.105634][ T8035] vcpu_run+0x27c3/0x7aa0 [ 298.105665][ T8035] ? trace_pelt_se_tp+0x3b/0x150 [ 298.105725][ T8035] ? __pfx_vcpu_run+0x10/0x10 [ 298.105756][ T8035] kvm_arch_vcpu_ioctl_run+0xe87/0x19c0 [ 298.105779][ T8035] ? kvm_arch_vcpu_ioctl_run+0x1f8/0x19c0 [ 298.105798][ T8035] ? kvm_vcpu_ioctl+0xe8f/0xfd0 [ 298.105821][ T8035] kvm_vcpu_ioctl+0xa61/0xfd0 [ 298.105844][ T8035] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 298.105861][ T8035] ? do_vfs_ioctl+0x116f/0x1530 [ 298.105886][ T8035] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 298.105935][ T8035] kvm_vcpu_compat_ioctl+0x204/0x390 [ 298.105953][ T8035] ? __fget_files+0x2a/0x420 [ 298.105972][ T8035] ? __pfx_kvm_vcpu_compat_ioctl+0x10/0x10 [ 298.105990][ T8035] ? __fget_files+0x2a/0x420 [ 298.106005][ T8035] ? __fget_files+0x3a2/0x420 [ 298.106021][ T8035] ? __fget_files+0x2a/0x420 [ 298.106041][ T8035] ? bpf_lsm_file_ioctl_compat+0x9/0x20 [ 298.106062][ T8035] __ia32_compat_sys_ioctl+0x5ea/0x950 [ 298.106086][ T8035] ? __pfx___ia32_compat_sys_ioctl+0x10/0x10 [ 298.106107][ T8035] ? __fget_files+0x3a2/0x420 [ 298.106124][ T8035] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 298.106150][ T8035] ? lock_acquire+0x115/0x350 [ 298.106179][ T8035] ? __might_fault+0xaf/0x130 [ 298.106199][ T8035] __do_fast_syscall_32+0x28b/0x6c0 [ 298.106222][ T8035] ? do_fast_syscall_32+0x33/0x70 [ 298.106244][ T8035] ? asm_int80_emulation+0x1a/0x20 [ 298.106259][ T8035] ? do_int80_emulation+0x299/0x500 [ 298.106287][ T8035] ? trace_irq_disable+0x3b/0x140 [ 298.106310][ T8035] do_fast_syscall_32+0x33/0x70 [ 298.106332][ T8035] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 298.106351][ T8035] RIP: 0023:0xf7f74f1c [ 298.106367][ T8035] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 298.106380][ T8035] RSP: 002b:00000000f542650c EFLAGS: 00000206 ORIG_RAX: 0000000000000036 [ 298.106397][ T8035] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 000000000000ae80 [ 298.106408][ T8035] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 298.106417][ T8035] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 298.106426][ T8035] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 298.106435][ T8035] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 298.106458][ T8035] [ 298.384889][ T30] usb 2-1: device descriptor read/64, error -71 [ 298.743051][ T30] usb 2-1: new high-speed USB device number 39 using dummy_hcd [ 298.882072][ T30] usb 2-1: device descriptor read/64, error -71 [ 298.993717][ T30] usb usb2-port1: attempt power cycle [ 299.299517][ T7775] syz.1.560 (7775) used greatest stack depth: 17840 bytes left [ 299.353634][ T30] usb 2-1: new high-speed USB device number 40 using dummy_hcd [ 299.396544][ T30] usb 2-1: device descriptor read/8, error -71 [ 299.648478][ T8046] netlink: 136 bytes leftover after parsing attributes in process `syz.3.631'. [ 299.648500][ T8046] openvswitch: netlink: Flow actions attr not present in new flow. [ 299.651659][ T30] usb 2-1: new high-speed USB device number 41 using dummy_hcd [ 299.683417][ T30] usb 2-1: device descriptor read/8, error -71 [ 299.794917][ T30] usb usb2-port1: unable to enumerate USB device [ 299.907912][ T8046] netlink: 36 bytes leftover after parsing attributes in process `syz.3.631'. [ 299.961844][ T8046] netlink: 20 bytes leftover after parsing attributes in process `syz.3.631'. [ 299.984529][ T8046] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 300.002875][ T5359] usb 5-1: new high-speed USB device number 35 using dummy_hcd [ 300.022777][ T8046] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 300.046171][ T8053] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 300.046618][ T8053] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 300.152335][ T5359] usb 5-1: Using ep0 maxpacket: 8 [ 300.153440][ T5359] usb 5-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 300.174925][ T5359] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 300.259876][ T5359] pvrusb2: Hardware description: Terratec Grabster AV400 [ 300.259895][ T5359] pvrusb2: ********** [ 300.259900][ T5359] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 300.259910][ T5359] pvrusb2: Important functionality might not be entirely working. [ 300.259916][ T5359] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 300.259924][ T5359] pvrusb2: ********** [ 300.474446][ T2368] pvrusb2: Invalid write control endpoint [ 300.754531][ T5706] usb 5-1: USB disconnect, device number 35 [ 301.112826][ T2368] pvrusb2: Invalid write control endpoint [ 301.112844][ T2368] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 301.112855][ T2368] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 301.112870][ T2368] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 301.112883][ T2368] pvrusb2: Device being rendered inoperable [ 301.169991][ T2368] cx25840 2-0044: Unable to detect h/w, assuming cx23887 [ 301.170047][ T2368] cx25840 2-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_a) [ 301.223786][ T2368] pvrusb2: Attached sub-driver cx25840 [ 301.223806][ T2368] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 301.223818][ T2368] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 301.539731][ T8061] FAULT_INJECTION: forcing a failure. [ 301.539731][ T8061] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 301.539782][ T8061] CPU: 0 UID: 0 PID: 8061 Comm: syz.3.637 Tainted: G L syzkaller #0 PREEMPT(full) [ 301.539814][ T8061] Tainted: [L]=SOFTLOCKUP [ 301.539822][ T8061] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 301.539840][ T8061] Call Trace: [ 301.539847][ T8061] [ 301.539853][ T8061] dump_stack_lvl+0xe8/0x150 [ 301.539882][ T8061] should_fail_ex+0x410/0x560 [ 301.539907][ T8061] _copy_from_user+0x2d/0xb0 [ 301.539930][ T8061] get_compat_msghdr+0xb3/0x4c0 [ 301.539949][ T8061] ? __pfx_get_compat_msghdr+0x10/0x10 [ 301.539974][ T8061] ___sys_sendmsg+0x201/0x360 [ 301.540000][ T8061] ? __lock_acquire+0x747/0x2de0 [ 301.540022][ T8061] ? __pfx____sys_sendmsg+0x10/0x10 [ 301.540042][ T8061] ? get_pid_task+0x20/0x1f0 [ 301.540058][ T8061] ? get_pid_task+0x20/0x1f0 [ 301.540071][ T8061] ? get_pid_task+0x20/0x1f0 [ 301.540108][ T8061] ? __fget_files+0x3a2/0x420 [ 301.540125][ T8061] ? __fget_files+0x2a/0x420 [ 301.540148][ T8061] __sys_sendmsg+0x177/0x240 [ 301.540170][ T8061] ? __pfx___sys_sendmsg+0x10/0x10 [ 301.540200][ T8061] ? __might_fault+0xaf/0x130 [ 301.540220][ T8061] __do_fast_syscall_32+0x28b/0x6c0 [ 301.540244][ T8061] ? do_fast_syscall_32+0x33/0x70 [ 301.540265][ T8061] ? asm_int80_emulation+0x1a/0x20 [ 301.540280][ T8061] ? do_int80_emulation+0x299/0x500 [ 301.540302][ T8061] ? trace_irq_disable+0x3b/0x140 [ 301.540324][ T8061] do_fast_syscall_32+0x33/0x70 [ 301.540346][ T8061] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 301.540365][ T8061] RIP: 0023:0xf7f74f1c [ 301.540379][ T8061] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 301.540393][ T8061] RSP: 002b:00000000f542650c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 301.540410][ T8061] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800005c0 [ 301.540421][ T8061] RDX: 0000000000000080 RSI: 0000000000000000 RDI: 0000000000000000 [ 301.540430][ T8061] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 301.540439][ T8061] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 301.540448][ T8061] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 301.540470][ T8061] [ 303.147190][ T8058] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 303.222403][ T8058] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 304.211869][ T5720] usb 1-1: new high-speed USB device number 28 using dummy_hcd [ 304.365086][ T1155] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 304.365133][ T1155] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 304.365159][ T1155] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 304.365439][ T5720] usb 1-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice= 0.00 [ 304.379007][ T50] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 304.420419][ T5720] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 304.979058][ T5720] usb 1-1: Firmware version (0.0) predates our first public release. [ 304.979079][ T5720] usb 1-1: Please update to version 0.2 or newer [ 305.217747][ T5720] usb 1-1: USB disconnect, device number 28 [ 305.277724][ T8100] netlink: 136 bytes leftover after parsing attributes in process `syz.2.648'. [ 305.277776][ T8100] openvswitch: netlink: Flow actions attr not present in new flow. [ 305.323594][ T30] usb 2-1: new high-speed USB device number 42 using dummy_hcd [ 305.383432][ T5706] usb 5-1: new high-speed USB device number 36 using dummy_hcd [ 305.475734][ T8100] netlink: 36 bytes leftover after parsing attributes in process `syz.2.648'. [ 305.501366][ T8100] netlink: 20 bytes leftover after parsing attributes in process `syz.2.648'. [ 305.512644][ T30] usb 2-1: Using ep0 maxpacket: 8 [ 305.513644][ T30] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 305.516431][ T30] usb 2-1: config index 0 descriptor too short (expected 301, got 45) [ 305.516487][ T30] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 305.516513][ T30] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 305.516539][ T30] usb 2-1: config 16 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 305.516562][ T30] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 305.516606][ T30] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 305.562767][ T5706] usb 5-1: Using ep0 maxpacket: 32 [ 305.602337][ T5706] usb 5-1: New USB device found, idVendor=1b1c, idProduct=0c10, bcdDevice= 0.00 [ 305.605021][ T5706] usb 5-1: config 0 interface 0 altsetting 128 endpoint 0x2 has an invalid bInterval 0, changing to 7 [ 305.605054][ T5706] usb 5-1: config 0 interface 0 has no altsetting 0 [ 305.605089][ T5706] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 305.610900][ T8100] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 305.610918][ T8100] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 305.667606][ T5706] usb 5-1: config 0 descriptor?? [ 305.684559][ T30] usbtmc 2-1:16.0: bulk endpoints not found [ 305.705979][ T8100] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 305.706005][ T8100] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 306.150391][ T5706] corsair-cpro 0003:1B1C:0C10.000E: hidraw0: USB HID v4.06 Device [HID 1b1c:0c10] on usb-dummy_hcd.4-1/input0 [ 306.557980][ T5706] corsair-cpro 0003:1B1C:0C10.000E: probe with driver corsair-cpro failed with error -71 [ 306.596353][ T5706] usb 5-1: USB disconnect, device number 36 [ 306.685733][ T8116] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 306.690588][ T8116] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 306.902512][ T8118] FAULT_INJECTION: forcing a failure. [ 306.902512][ T8118] name failslab, interval 1, probability 0, space 0, times 0 [ 306.902541][ T8118] CPU: 1 UID: 0 PID: 8118 Comm: syz.0.653 Tainted: G L syzkaller #0 PREEMPT(full) [ 306.902562][ T8118] Tainted: [L]=SOFTLOCKUP [ 306.902568][ T8118] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 306.902586][ T8118] Call Trace: [ 306.902592][ T8118] [ 306.902598][ T8118] dump_stack_lvl+0xe8/0x150 [ 306.902626][ T8118] should_fail_ex+0x410/0x560 [ 306.902650][ T8118] ? __alloc_skb+0x1db/0x7a0 [ 306.902668][ T8118] should_failslab+0xa8/0x100 [ 306.902694][ T8118] ? __alloc_skb+0x1db/0x7a0 [ 306.902710][ T8118] kmem_cache_alloc_node_noprof+0x9c/0x600 [ 306.902731][ T8118] ? __alloc_skb+0x18d/0x7a0 [ 306.902752][ T8118] ? __alloc_skb+0x1db/0x7a0 [ 306.902775][ T8118] __alloc_skb+0x1db/0x7a0 [ 306.902797][ T8118] netlink_ack+0x136/0xb30 [ 306.902812][ T8118] ? __lock_acquire+0x747/0x2de0 [ 306.902833][ T8118] ? hook_capable+0x1c3/0x5e0 [ 306.902860][ T8118] netlink_rcv_skb+0x2a4/0x4a0 [ 306.902908][ T8118] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 306.902946][ T8118] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 306.902980][ T8118] ? bpf_lsm_capable+0x9/0x20 [ 306.903005][ T8118] ? security_capable+0x7e/0x2c0 [ 306.903035][ T8118] nfnetlink_rcv+0x2b9/0x28c0 [ 306.903072][ T8118] ? is_bpf_text_address+0x292/0x2b0 [ 306.903105][ T8118] ? is_bpf_text_address+0x26/0x2b0 [ 306.903139][ T8118] ? kernel_text_address+0xa5/0xe0 [ 306.903163][ T8118] ? __kernel_text_address+0xd/0x30 [ 306.903187][ T8118] ? unwind_get_return_address+0x4d/0x90 [ 306.903216][ T8118] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 306.903241][ T8118] ? arch_stack_walk+0xfb/0x150 [ 306.903281][ T8118] ? __lock_acquire+0x747/0x2de0 [ 306.903307][ T8118] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 306.903346][ T8118] ? __lock_acquire+0x747/0x2de0 [ 306.903385][ T8118] ? __lock_acquire+0x747/0x2de0 [ 306.903424][ T8118] ? __netlink_lookup+0xe6/0x8f0 [ 306.903461][ T8118] ? lock_acquire+0x115/0x350 [ 306.903486][ T8118] ? netlink_deliver_tap+0x2e/0x1b0 [ 306.903517][ T8118] ? netlink_deliver_tap+0x2e/0x1b0 [ 306.903541][ T8118] ? netlink_deliver_tap+0x2e/0x1b0 [ 306.903579][ T8118] netlink_unicast+0x8ef/0xa80 [ 306.903633][ T8118] netlink_sendmsg+0x7f0/0xb20 [ 306.903665][ T8118] ? __pfx_netlink_sendmsg+0x10/0x10 [ 306.903693][ T8118] ? aa_sock_msg_perm+0x144/0x210 [ 306.903726][ T8118] ? apparmor_socket_sendmsg+0x98/0x360 [ 306.903752][ T8118] ? __pfx_netlink_sendmsg+0x10/0x10 [ 306.903775][ T8118] sock_sendmsg_nosec+0x14e/0x190 [ 306.903815][ T8118] ____sys_sendmsg+0x54e/0x850 [ 306.903853][ T8118] ? __pfx_____sys_sendmsg+0x10/0x10 [ 306.903901][ T8118] ___sys_sendmsg+0x2a5/0x360 [ 306.903929][ T8118] ? __lock_acquire+0x747/0x2de0 [ 306.903960][ T8118] ? __pfx____sys_sendmsg+0x10/0x10 [ 306.903989][ T8118] ? get_pid_task+0x20/0x1f0 [ 306.904011][ T8118] ? get_pid_task+0x20/0x1f0 [ 306.904031][ T8118] ? get_pid_task+0x20/0x1f0 [ 306.904091][ T8118] ? __fget_files+0x3a2/0x420 [ 306.904115][ T8118] ? __fget_files+0x2a/0x420 [ 306.904150][ T8118] __sys_sendmsg+0x177/0x240 [ 306.904183][ T8118] ? __pfx___sys_sendmsg+0x10/0x10 [ 306.904228][ T8118] ? __might_fault+0xaf/0x130 [ 306.904257][ T8118] __do_fast_syscall_32+0x28b/0x6c0 [ 306.904290][ T8118] ? do_fast_syscall_32+0x33/0x70 [ 306.904321][ T8118] ? asm_int80_emulation+0x1a/0x20 [ 306.904344][ T8118] ? do_int80_emulation+0x299/0x500 [ 306.904375][ T8118] ? trace_irq_disable+0x3b/0x140 [ 306.904407][ T8118] do_fast_syscall_32+0x33/0x70 [ 306.904440][ T8118] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 306.904467][ T8118] RIP: 0023:0xf7f44f1c [ 306.904489][ T8118] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 306.904513][ T8118] RSP: 002b:00000000f53d550c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 306.904531][ T8118] RAX: ffffffffffffffda RBX: 0000000000000007 RCX: 0000000080000780 [ 306.904542][ T8118] RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000 [ 306.904551][ T8118] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 306.904560][ T8118] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 306.904574][ T8118] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 306.904598][ T8118] [ 307.633188][ T8116] loop6: detected capacity change from 0 to 2640 [ 307.639170][ T8116] Buffer I/O error on dev loop6, logical block 0, async page read [ 307.639227][ T8116] Buffer I/O error on dev loop6, logical block 0, async page read [ 307.639251][ T8116] Buffer I/O error on dev loop6, logical block 0, async page read [ 307.639507][ T8116] Buffer I/O error on dev loop6, logical block 0, async page read [ 307.639546][ T8116] Buffer I/O error on dev loop6, logical block 0, async page read [ 307.639599][ T8116] Buffer I/O error on dev loop6, logical block 0, async page read [ 307.639633][ T8116] Buffer I/O error on dev loop6, logical block 0, async page read [ 307.639655][ T8116] Buffer I/O error on dev loop6, logical block 0, async page read [ 307.639667][ T8116] ldm_validate_partition_table(): Disk read failed. [ 307.639689][ T8116] Buffer I/O error on dev loop6, logical block 0, async page read [ 307.639710][ T8116] Buffer I/O error on dev loop6, logical block 0, async page read [ 307.639745][ T8116] Dev loop6: unable to read RDB block 0 [ 307.639938][ T8116] loop6: unable to read partition table [ 307.640103][ T8116] loop_reread_partitions: partition scan of loop6 (3 ) failed (rc=-5) [ 307.832099][ T8116] loop6: detected capacity change from 2640 to 524288000 [ 308.178406][ T8134] netlink: 'syz.0.657': attribute type 21 has an invalid length. [ 308.178521][ T8134] netlink: 156 bytes leftover after parsing attributes in process `syz.0.657'. [ 308.201794][ T5706] usb 1-1: new high-speed USB device number 29 using dummy_hcd [ 308.351529][ T5706] usb 1-1: Using ep0 maxpacket: 32 [ 308.355775][ T5706] usb 1-1: unable to get BOS descriptor or descriptor too short [ 308.355828][ T5706] usb 1-1: New USB device found, idVendor=1c40, idProduct=0534, bcdDevice=27.24 [ 308.384826][ T5706] usb 1-1: config 165 has an invalid interface number: 162 but max is 0 [ 308.384847][ T5706] usb 1-1: config 165 has no interface number 0 [ 308.384878][ T5706] usb 1-1: config 165 interface 162 has no altsetting 0 [ 308.390562][ T5706] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 308.390583][ T5706] usb 1-1: Product: syz [ 308.390593][ T5706] usb 1-1: Manufacturer: syz [ 308.390604][ T5706] usb 1-1: SerialNumber: syz [ 308.768376][ T30] usb 2-1: USB disconnect, device number 42 [ 309.549135][ T8140] syzkaller0: entered promiscuous mode [ 309.549163][ T8140] syzkaller0: entered allmulticast mode [ 309.997237][ T5706] usb 1-1: USB disconnect, device number 29 [ 310.108510][ T8155] netlink: 'syz.4.660': attribute type 10 has an invalid length. [ 310.544305][ T30] usb 5-1: new high-speed USB device number 37 using dummy_hcd [ 310.733792][ T30] usb 5-1: New USB device found, idVendor=04d8, idProduct=0082, bcdDevice= 1.00 [ 310.742265][ T30] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 59391, setting to 1024 [ 310.742394][ T30] usb 5-1: config 1 interface 1 altsetting 0 endpoint 0x2 has invalid maxpacket 65535, setting to 1024 [ 310.742467][ T30] usb 5-1: config 1 interface 1 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 1024 [ 310.742530][ T30] usb 5-1: config 1 interface 1 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 310.742584][ T30] usb 5-1: config 1 interface 1 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 310.742720][ T30] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 310.799308][ T8164] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 310.836248][ T30] ims_pcu 5-1:1.0: Max IN packet size is too small (0) [ 310.836296][ T30] ims_pcu 5-1:1.0: probe with driver ims_pcu failed with error -22 [ 311.398649][ T8169] netlink: 68 bytes leftover after parsing attributes in process `syz.0.665'. [ 313.936154][ T4993] udevd[4993]: worker [5639] /devices/platform/dummy_hcd.2/usb3/3-1 is taking a long time [ 314.269969][ T30] usb 5-1: USB disconnect, device number 37 [ 314.332570][ T8182] fuse: Bad value for 'user_id' [ 314.332593][ T8182] fuse: Bad value for 'user_id' [ 314.432485][ T8183] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3780442281 (7560884562 ns) > initial count (4669583980 ns). Using initial count to start timer. [ 314.478013][ T31] audit: type=1326 audit(1792789469.384:1251): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8188 comm="syz.3.671" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7f74f1c code=0x0 [ 314.806990][ T8202] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1588326286 (12706610288 ns) > initial count (90444488 ns). Using initial count to start timer. [ 315.771695][ T30] usb 5-1: new low-speed USB device number 38 using dummy_hcd [ 315.904468][ T30] usb 5-1: device descriptor read/64, error -71 [ 316.097870][ T8213] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 316.141714][ T30] usb 5-1: new low-speed USB device number 39 using dummy_hcd [ 316.271600][ T30] usb 5-1: device descriptor read/64, error -71 [ 316.301243][ T8224] syzkaller0: entered promiscuous mode [ 316.301272][ T8224] syzkaller0: entered allmulticast mode [ 316.364142][ T8229] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 316.369180][ T8229] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 316.389931][ T30] usb usb5-port1: attempt power cycle [ 316.735089][ T30] usb 5-1: new low-speed USB device number 40 using dummy_hcd [ 316.752634][ T30] usb 5-1: device descriptor read/8, error -71 [ 316.992261][ T30] usb 5-1: new low-speed USB device number 41 using dummy_hcd [ 317.012526][ T30] usb 5-1: device descriptor read/8, error -71 [ 317.122959][ T30] usb usb5-port1: unable to enumerate USB device [ 317.144125][ T8238] netlink: 12 bytes leftover after parsing attributes in process `syz.3.684'. [ 317.153158][ T1319] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.153228][ T1319] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.718304][ T8242] FAULT_INJECTION: forcing a failure. [ 317.718304][ T8242] name failslab, interval 1, probability 0, space 0, times 0 [ 317.718335][ T8242] CPU: 1 UID: 0 PID: 8242 Comm: syz.0.686 Tainted: G L syzkaller #0 PREEMPT(full) [ 317.718357][ T8242] Tainted: [L]=SOFTLOCKUP [ 317.718363][ T8242] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 317.718373][ T8242] Call Trace: [ 317.718379][ T8242] [ 317.718386][ T8242] dump_stack_lvl+0xe8/0x150 [ 317.718415][ T8242] should_fail_ex+0x410/0x560 [ 317.718439][ T8242] ? __alloc_skb+0x1db/0x7a0 [ 317.718458][ T8242] should_failslab+0xa8/0x100 [ 317.718483][ T8242] ? __alloc_skb+0x1db/0x7a0 [ 317.718499][ T8242] kmem_cache_alloc_node_noprof+0x9c/0x600 [ 317.718519][ T8242] ? __alloc_skb+0x18d/0x7a0 [ 317.718560][ T8242] ? __alloc_skb+0x1db/0x7a0 [ 317.718603][ T8242] __alloc_skb+0x1db/0x7a0 [ 317.718635][ T8242] skb_copy_expand+0x1aa/0xc00 [ 317.718668][ T8242] ? __pfx_do_ulpq_tail_event+0x10/0x10 [ 317.718703][ T8242] sctp_ulpevent_make_send_failed_event+0x5c/0xaf0 [ 317.718728][ T8242] sctp_datamsg_put+0x356/0x520 [ 317.718758][ T8242] sctp_chunk_free+0x4a/0x60 [ 317.718779][ T8242] __sctp_outq_teardown+0x7ab/0x9a0 [ 317.718802][ T8242] sctp_association_free+0x240/0x7f0 [ 317.718821][ T8242] sctp_do_sm+0x4029/0x5dd0 [ 317.718846][ T8242] ? register_lock_class+0x31/0x2e0 [ 317.718868][ T8242] ? __pfx_sctp_do_sm+0x10/0x10 [ 317.718917][ T8242] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 317.718937][ T8242] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 317.718959][ T8242] sctp_primitive_SHUTDOWN+0x98/0xc0 [ 317.718988][ T8242] sctp_close+0x3bc/0x930 [ 317.719021][ T8242] ? __pfx_sctp_close+0x10/0x10 [ 317.719050][ T8242] ? down_write+0x166/0x200 [ 317.719075][ T8242] ? __pfx_down_write+0x10/0x10 [ 317.719096][ T8242] ? ip_mc_drop_socket+0x25e/0x280 [ 317.719117][ T8242] inet_release+0x143/0x190 [ 317.719138][ T8242] __sock_release+0xa0/0x1f0 [ 317.719163][ T8242] ? __pfx_sock_close+0x10/0x10 [ 317.719187][ T8242] sock_close+0x1c/0x30 [ 317.719209][ T8242] __fput+0x408/0xa40 [ 317.719230][ T8242] fput_close_sync+0x11f/0x240 [ 317.719245][ T8242] ? __pfx_fput_close_sync+0x10/0x10 [ 317.719270][ T8242] __se_sys_close+0xa2/0x160 [ 317.719287][ T8242] __do_fast_syscall_32+0x28b/0x6c0 [ 317.719311][ T8242] ? do_fast_syscall_32+0x33/0x70 [ 317.719332][ T8242] ? asm_int80_emulation+0x1a/0x20 [ 317.719348][ T8242] ? do_int80_emulation+0x299/0x500 [ 317.719373][ T8242] do_fast_syscall_32+0x33/0x70 [ 317.719395][ T8242] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 317.719415][ T8242] RIP: 0023:0xf7f44f1c [ 317.719430][ T8242] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 317.719444][ T8242] RSP: 002b:00000000f53f650c EFLAGS: 00000206 ORIG_RAX: 0000000000000006 [ 317.719460][ T8242] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000000000 [ 317.719471][ T8242] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 317.719480][ T8242] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 317.719489][ T8242] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 317.719498][ T8242] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 317.719522][ T8242] [ 318.492618][ T31] audit: type=1326 audit(1792789473.404:1252): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8245 comm="syz.4.688" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7f27f1c code=0x0 [ 319.589514][ T8258] nvme_fabrics: unknown parameter or missing value '#! 1R?&n%~[6=p͊yz\Uj@5NfWrs)q' in ctrl creation request [ 319.968233][ T8264] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 319.968600][ T8264] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 321.019231][ T8258] nvme nvme0: failed to connect socket: -512 [ 323.702828][ T30] usb 5-1: new high-speed USB device number 42 using dummy_hcd [ 323.862235][ T30] usb 5-1: Using ep0 maxpacket: 16 [ 323.864392][ T30] usb 5-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 323.878384][ T30] usb 5-1: config 0 interface 0 altsetting 64 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 323.878410][ T30] usb 5-1: config 0 interface 0 altsetting 64 endpoint 0x81 has invalid wMaxPacketSize 0 [ 323.878427][ T30] usb 5-1: config 0 interface 0 has no altsetting 0 [ 323.878451][ T30] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 323.881121][ T30] usb 5-1: config 0 descriptor?? [ 324.343098][ T30] mcp2221 0003:04D8:00DD.000F: unknown main item tag 0x0 [ 324.343145][ T30] mcp2221 0003:04D8:00DD.000F: unknown main item tag 0x0 [ 324.343182][ T30] mcp2221 0003:04D8:00DD.000F: unknown main item tag 0x0 [ 324.343211][ T30] mcp2221 0003:04D8:00DD.000F: unknown main item tag 0x0 [ 324.343240][ T30] mcp2221 0003:04D8:00DD.000F: unknown main item tag 0x0 [ 324.345670][ T30] mcp2221 0003:04D8:00DD.000F: USB HID v0.01 Device [HID 04d8:00dd] on usb-dummy_hcd.4-1/input0 [ 324.562560][ T30] usb 5-1: USB disconnect, device number 42 [ 325.457371][ T8285] netlink: 12 bytes leftover after parsing attributes in process `syz.4.698'. [ 326.569170][ T8303] netlink: 4 bytes leftover after parsing attributes in process `syz.3.704'. [ 326.758298][ T8306] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 326.760346][ T8306] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 326.788010][ T8306] netlink: 104 bytes leftover after parsing attributes in process `syz.2.705'. [ 326.965450][ T8315] netlink: 4 bytes leftover after parsing attributes in process `syz.4.707'. [ 326.991147][ T31] audit: type=1326 audit(1792789481.894:1253): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8307 comm="syz.3.706" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf7f74f1c code=0x0 [ 327.841622][ T8333] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 327.846800][ T8333] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 328.602757][ T5706] usb 1-1: new high-speed USB device number 30 using dummy_hcd [ 328.754951][ T5706] usb 1-1: Using ep0 maxpacket: 8 [ 328.755904][ T5706] usb 1-1: New USB device found, idVendor=99fa, idProduct=8988, bcdDevice=54.41 [ 328.780948][ T5706] usb 1-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 328.810677][ T5706] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 328.810709][ T5706] usb 1-1: Product: syz [ 328.810720][ T5706] usb 1-1: Manufacturer: syz [ 328.810730][ T5706] usb 1-1: SerialNumber: syz [ 329.638619][ T8360] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 329.640824][ T8360] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 329.744186][ T8362] syzkaller0: entered promiscuous mode [ 329.744204][ T8362] syzkaller0: entered allmulticast mode [ 330.079735][ T8373] netlink: 24 bytes leftover after parsing attributes in process `syz.1.724'. [ 330.614077][ T8381] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 330.614519][ T8381] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 331.304291][ T5720] usb 4-1: new high-speed USB device number 38 using dummy_hcd [ 331.375957][ T8389] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 331.377596][ T8389] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 331.410065][ T8389] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 331.410446][ T8389] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 331.432673][ T5720] usb 4-1: device descriptor read/64, error -71 [ 331.519514][ T5706] gspca_main: spca506-2.14.0 probing 99fa:8988 [ 331.672614][ T5720] usb 4-1: new high-speed USB device number 39 using dummy_hcd [ 331.721571][ T5626] usb 5-1: new high-speed USB device number 43 using dummy_hcd [ 331.785716][ T5706] usb 1-1: USB disconnect, device number 30 [ 331.812421][ T5720] usb 4-1: device descriptor read/64, error -71 [ 331.896573][ T5626] usb 5-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 331.898255][ T5626] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 331.898311][ T5626] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 331.931788][ T5720] usb usb4-port1: attempt power cycle [ 331.939234][ T5626] usb 5-1: config 0 descriptor?? [ 331.965217][ T5626] pwc: Askey VC010 type 2 USB webcam detected. [ 332.197903][ T5626] pwc: send_video_command error -71 [ 332.197931][ T5626] pwc: Failed to set video mode CIF@30 fps; return code = -71 [ 332.198014][ T5626] Philips webcam 5-1:0.0: probe with driver Philips webcam failed with error -71 [ 332.235608][ T5626] usb 5-1: USB disconnect, device number 43 [ 332.282306][ T5720] usb 4-1: new high-speed USB device number 40 using dummy_hcd [ 332.312315][ T5720] usb 4-1: device descriptor read/8, error -71 [ 332.563460][ T5720] usb 4-1: new high-speed USB device number 41 using dummy_hcd [ 332.583107][ T5720] usb 4-1: device descriptor read/8, error -71 [ 332.691878][ T5720] usb usb4-port1: unable to enumerate USB device [ 332.751978][ T5626] usb 5-1: new high-speed USB device number 44 using dummy_hcd [ 332.904182][ T5626] usb 5-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 332.908105][ T5626] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 332.908143][ T5626] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 332.941956][ T5626] usb 5-1: config 0 descriptor?? [ 332.957414][ T5626] pwc: Askey VC010 type 2 USB webcam detected. [ 333.184615][ T5720] usb 1-1: new high-speed USB device number 31 using dummy_hcd [ 333.322046][ T5720] usb 1-1: device descriptor read/64, error -71 [ 333.351911][ T5626] pwc: recv_control_msg error -32 req 02 val 2b00 [ 333.352945][ T5626] pwc: recv_control_msg error -32 req 02 val 2700 [ 333.353914][ T5626] pwc: recv_control_msg error -32 req 02 val 2c00 [ 333.356883][ T5626] pwc: recv_control_msg error -32 req 04 val 1000 [ 333.359571][ T5626] pwc: recv_control_msg error -32 req 04 val 1300 [ 333.397481][ T5626] pwc: recv_control_msg error -32 req 04 val 1400 [ 333.399020][ T5626] pwc: recv_control_msg error -32 req 02 val 2000 [ 333.401788][ T5626] pwc: recv_control_msg error -32 req 02 val 2100 [ 333.429824][ T5626] pwc: recv_control_msg error -32 req 04 val 1500 [ 333.454101][ T5626] pwc: recv_control_msg error -32 req 02 val 2500 [ 333.477586][ T5626] pwc: recv_control_msg error -32 req 02 val 2400 [ 333.571625][ T5720] usb 1-1: new high-speed USB device number 32 using dummy_hcd [ 333.689293][ T31] audit: type=1326 audit(1792789488.594:1254): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8411 comm="syz.1.740" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7f72f1c code=0x0 [ 333.715298][ T5720] usb 1-1: device descriptor read/64, error -71 [ 333.765478][ T5626] pwc: recv_control_msg error -71 req 02 val 2900 [ 333.766340][ T5626] pwc: recv_control_msg error -71 req 02 val 2800 [ 333.767605][ T5626] pwc: recv_control_msg error -71 req 04 val 1100 [ 333.768724][ T5626] pwc: recv_control_msg error -71 req 04 val 1200 [ 333.814211][ T5626] pwc: Registered as video103. [ 333.827141][ T5720] usb usb1-port1: attempt power cycle [ 333.830318][ T5626] input: PWC snapshot button as /devices/platform/dummy_hcd.4/usb5/5-1/input/input33 [ 333.858378][ T5626] usb 5-1: USB disconnect, device number 44 [ 334.163351][ T5720] usb 1-1: new high-speed USB device number 33 using dummy_hcd [ 334.193372][ T5720] usb 1-1: device descriptor read/8, error -71 [ 334.226275][ T8419] netlink: 212408 bytes leftover after parsing attributes in process `syz.2.741'. [ 334.226309][ T8419] openvswitch: netlink: Message has 512 unknown bytes. [ 334.431608][ T5720] usb 1-1: new high-speed USB device number 34 using dummy_hcd [ 334.462417][ T5720] usb 1-1: device descriptor read/8, error -71 [ 334.575188][ T5720] usb usb1-port1: unable to enumerate USB device [ 334.753182][ T5626] usb 4-1: new high-speed USB device number 42 using dummy_hcd [ 334.902281][ T5626] usb 4-1: Using ep0 maxpacket: 8 [ 334.903440][ T5626] usb 4-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 334.905485][ T5626] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 334.971620][ T5720] usb 5-1: new high-speed USB device number 45 using dummy_hcd [ 334.974110][ T5626] pvrusb2: Hardware description: Terratec Grabster AV400 [ 334.974123][ T5626] pvrusb2: ********** [ 334.974128][ T5626] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 334.974137][ T5626] pvrusb2: Important functionality might not be entirely working. [ 334.974144][ T5626] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 334.974152][ T5626] pvrusb2: ********** [ 335.063855][ T8434] netlink: Conntrack attr has 4 unknown bytes [ 335.063895][ T8434] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 335.115063][ T8434] pim6reg1: entered promiscuous mode [ 335.115099][ T8434] pim6reg1: entered allmulticast mode [ 335.133332][ T5720] usb 5-1: Using ep0 maxpacket: 32 [ 335.134462][ T5720] usb 5-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 335.138399][ T5720] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 335.179128][ T5720] usb 5-1: config 0 descriptor?? [ 335.270974][ T2368] pvrusb2: Invalid write control endpoint [ 335.423227][ T5720] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 335.463684][ T5720] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 335.465925][ T5720] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 335.465965][ T5720] usb 5-1: media controller created [ 335.525472][ T5720] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 335.526944][ T2368] pvrusb2: Invalid write control endpoint [ 335.526958][ T2368] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 335.526970][ T2368] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 335.526980][ T2368] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 335.526991][ T2368] pvrusb2: Device being rendered inoperable [ 335.585177][ T2368] cx25840 2-0044: Unable to detect h/w, assuming cx23887 [ 335.585234][ T2368] cx25840 2-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_a) [ 335.622491][ T8426] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 335.622852][ T8426] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 335.661194][ T2368] pvrusb2: Attached sub-driver cx25840 [ 335.661217][ T2368] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 335.661226][ T2368] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 335.703471][ T5626] usb 4-1: USB disconnect, device number 42 [ 336.170805][ T8439] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 336.187888][ T8439] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 336.413353][ T5720] az6027: usb out operation failed. (-71) [ 336.417902][ T5720] az6027: usb out operation failed. (-71) [ 336.417921][ T5720] stb0899_attach: Driver disabled by Kconfig [ 336.417929][ T5720] az6027: no front-end attached [ 336.417929][ T5720] [ 336.418644][ T5720] az6027: usb out operation failed. (-71) [ 336.418656][ T5720] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 336.468338][ T5720] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.4/usb5/5-1/input/input34 [ 336.487647][ T5720] dvb-usb: schedule remote query interval to 400 msecs. [ 336.487672][ T5720] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 336.490195][ T5720] usb 5-1: USB disconnect, device number 45 [ 336.679728][ T5720] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 336.895075][ T30] usb 4-1: new high-speed USB device number 43 using dummy_hcd [ 337.042530][ T30] usb 4-1: Using ep0 maxpacket: 8 [ 337.043269][ T30] usb 4-1: New USB device found, idVendor=99fa, idProduct=8988, bcdDevice=54.41 [ 337.048434][ T30] usb 4-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 337.082750][ T30] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 337.082772][ T30] usb 4-1: Product: syz [ 337.082783][ T30] usb 4-1: Manufacturer: syz [ 337.082800][ T30] usb 4-1: SerialNumber: syz [ 337.168147][ T8441] netlink: 68 bytes leftover after parsing attributes in process `syz.2.748'. [ 337.631660][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 339.083670][ T8469] netlink: 4 bytes leftover after parsing attributes in process `syz.1.754'. [ 339.203078][ T8473] netlink: 28 bytes leftover after parsing attributes in process `syz.2.758'. [ 339.203156][ T8473] netlink: 28 bytes leftover after parsing attributes in process `syz.2.758'. [ 339.292101][ T8474] netlink: 24 bytes leftover after parsing attributes in process `syz.0.756'. [ 339.564054][ T8477] netlink: 60 bytes leftover after parsing attributes in process `syz.0.756'. [ 340.257714][ T31] audit: type=1326 audit(1792789495.164:1255): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8486 comm="syz.1.761" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7f72f1c code=0x0 [ 340.332123][ T30] gspca_main: spca506-2.14.0 probing 99fa:8988 [ 340.601657][ T5720] usb 5-1: new high-speed USB device number 46 using dummy_hcd [ 340.679650][ T30] usb 4-1: USB disconnect, device number 43 [ 340.761842][ T5720] usb 5-1: Using ep0 maxpacket: 32 [ 340.762591][ T5720] usb 5-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 340.777302][ T5720] usb 5-1: config index 0 descriptor too short (expected 35577, got 27) [ 340.777324][ T5720] usb 5-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 340.777339][ T5720] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 340.777355][ T5720] usb 5-1: config 1 has no interface number 0 [ 340.777388][ T5720] usb 5-1: config 1 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 340.777408][ T5720] usb 5-1: config 1 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 340.777438][ T5720] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 340.876356][ T5720] snd_usb_pod 5-1:1.1: Line 6 Pocket POD found [ 341.192994][ T5720] snd_usb_pod 5-1:1.1: Line 6 Pocket POD now attached [ 341.954038][ T5720] usb 4-1: new high-speed USB device number 44 using dummy_hcd [ 342.046264][ T8468] tunl0: entered promiscuous mode [ 342.046469][ T8468] netlink: 'syz.4.755': attribute type 4 has an invalid length. [ 342.046491][ T8468] netlink: 9 bytes leftover after parsing attributes in process `syz.4.755'. [ 342.112644][ T5720] usb 4-1: Using ep0 maxpacket: 8 [ 342.113680][ T5720] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 342.117267][ T5720] usb 4-1: config index 0 descriptor too short (expected 301, got 45) [ 342.117350][ T5720] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 342.117369][ T5720] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 342.117397][ T5720] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 342.117416][ T5720] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 342.117451][ T5720] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 342.283915][ T5706] snd_usb_pod 5-1:1.1: line6_send_raw_message_async_part: usb_submit_urb failed (-22) [ 342.358580][ T30] usb 5-1: USB disconnect, device number 46 [ 342.376330][ T30] snd_usb_pod 5-1:1.1: Line 6 Pocket POD now disconnected [ 342.448248][ T5720] usb 4-1: usb_control_msg returned -32 [ 342.448286][ T5720] usbtmc 4-1:16.0: can't read capabilities [ 342.505420][ T8509] netlink: 8 bytes leftover after parsing attributes in process `syz.0.765'. [ 343.225189][ T8518] usbtmc 4-1:16.0: usb_control_msg returned -32 [ 343.295666][ T8520] fuse: Bad value for 'fd' [ 344.770554][ T30] usb 4-1: USB disconnect, device number 44 [ 345.072638][ T8538] FAULT_INJECTION: forcing a failure. [ 345.072638][ T8538] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 345.072678][ T8538] CPU: 0 UID: 0 PID: 8538 Comm: syz.3.775 Tainted: G L syzkaller #0 PREEMPT(full) [ 345.072700][ T8538] Tainted: [L]=SOFTLOCKUP [ 345.072706][ T8538] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 345.072716][ T8538] Call Trace: [ 345.072722][ T8538] [ 345.072729][ T8538] dump_stack_lvl+0xe8/0x150 [ 345.072792][ T8538] should_fail_ex+0x410/0x560 [ 345.072828][ T8538] _copy_from_user+0x2d/0xb0 [ 345.072862][ T8538] copy_from_sockptr+0x5e/0x90 [ 345.072888][ T8538] do_ip_setsockopt+0x1f7b/0x2e30 [ 345.072916][ T8538] ? __pfx_do_ip_setsockopt+0x10/0x10 [ 345.072939][ T8538] ? ksys_write+0x1e6/0x270 [ 345.072961][ T8538] ? lock_acquire+0x115/0x350 [ 345.072992][ T8538] ip_setsockopt+0x66/0x110 [ 345.073014][ T8538] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 345.073033][ T8538] do_sock_setsockopt+0x17c/0x1b0 [ 345.073058][ T8538] __ia32_sys_setsockopt+0x13d/0x1b0 [ 345.073082][ T8538] __do_fast_syscall_32+0x28b/0x6c0 [ 345.073106][ T8538] ? do_fast_syscall_32+0x33/0x70 [ 345.073128][ T8538] ? asm_int80_emulation+0x1a/0x20 [ 345.073143][ T8538] ? do_int80_emulation+0x299/0x500 [ 345.073167][ T8538] ? trace_irq_disable+0x3b/0x140 [ 345.073192][ T8538] do_fast_syscall_32+0x33/0x70 [ 345.073215][ T8538] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 345.073235][ T8538] RIP: 0023:0xf7f74f1c [ 345.073249][ T8538] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 345.073263][ T8538] RSP: 002b:00000000f542650c EFLAGS: 00000206 ORIG_RAX: 000000000000016e [ 345.073281][ T8538] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000000000 [ 345.073292][ T8538] RDX: 0000000000000024 RSI: 0000000080000140 RDI: 0000000000000008 [ 345.073301][ T8538] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 345.073310][ T8538] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 345.073320][ T8538] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 345.073343][ T8538] [ 346.294224][ T30] usb 5-1: new high-speed USB device number 47 using dummy_hcd [ 346.421849][ T30] usb 5-1: device descriptor read/64, error -71 [ 346.548797][ T8552] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 346.673223][ T30] usb 5-1: new high-speed USB device number 48 using dummy_hcd [ 346.821643][ T30] usb 5-1: device descriptor read/64, error -71 [ 346.932545][ T30] usb usb5-port1: attempt power cycle [ 347.157355][ T8559] fuse: Bad value for 'fd' [ 347.285159][ T30] usb 5-1: new high-speed USB device number 49 using dummy_hcd [ 347.302603][ T30] usb 5-1: device descriptor read/8, error -71 [ 347.543800][ T30] usb 5-1: new high-speed USB device number 50 using dummy_hcd [ 347.566212][ T30] usb 5-1: device descriptor read/8, error -71 [ 347.677232][ T30] usb usb5-port1: unable to enumerate USB device [ 347.789002][ T8566] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 347.806592][ T8566] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 347.891717][ T5720] usb 1-1: new high-speed USB device number 35 using dummy_hcd [ 348.051806][ T5720] usb 1-1: Using ep0 maxpacket: 16 [ 348.056387][ T5720] usb 1-1: New USB device found, idVendor=05ac, idProduct=024b, bcdDevice= 0.00 [ 348.084310][ T5720] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 348.084339][ T5720] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 348.084369][ T5720] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 348.104157][ T5720] usb 1-1: config 0 descriptor?? [ 348.669153][ T5720] apple 0003:05AC:024B.0010: unknown global tag 0xe [ 348.669173][ T5720] apple 0003:05AC:024B.0010: item 0 1 1 14 parsing failed [ 348.669690][ T5720] apple 0003:05AC:024B.0010: parse failed [ 348.699762][ T5720] apple 0003:05AC:024B.0010: probe with driver apple failed with error -22 [ 348.895759][ T1291] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 348.895779][ T1291] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 349.202447][ T5720] usb 4-1: new high-speed USB device number 45 using dummy_hcd [ 349.371581][ T5720] usb 4-1: Using ep0 maxpacket: 32 [ 349.373887][ T5720] usb 4-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 349.375034][ T5720] usb 4-1: config 32 has an invalid interface number: 85 but max is 0 [ 349.375063][ T5720] usb 4-1: config 32 has no interface number 0 [ 349.375091][ T5720] usb 4-1: config 32 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 349.375112][ T5720] usb 4-1: config 32 interface 85 has no altsetting 0 [ 349.423394][ T5720] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 349.423415][ T5720] usb 4-1: Product: syz [ 349.423426][ T5720] usb 4-1: Manufacturer: syz [ 349.423437][ T5720] usb 4-1: SerialNumber: syz [ 349.579752][ T8586] fuse: Bad value for 'fd' [ 349.719683][ T8576] netlink: 104 bytes leftover after parsing attributes in process `syz.3.790'. [ 349.833334][ T30] usb 5-1: new high-speed USB device number 51 using dummy_hcd [ 349.896628][ T5720] appletouch 4-1:32.85: Failed to read mode from device. [ 349.896827][ T5720] appletouch 4-1:32.85: probe with driver appletouch failed with error -5 [ 349.928563][ T5720] usb 4-1: USB disconnect, device number 45 [ 350.002098][ T30] usb 5-1: Using ep0 maxpacket: 32 [ 350.039133][ T30] usb 5-1: unable to get BOS descriptor or descriptor too short [ 350.039186][ T30] usb 5-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 350.074991][ T30] usb 5-1: config 14 has an invalid interface number: 228 but max is 0 [ 350.075014][ T30] usb 5-1: config 14 has no interface number 0 [ 350.075045][ T30] usb 5-1: config 14 interface 228 altsetting 5 endpoint 0x8 has invalid maxpacket 1024, setting to 64 [ 350.075066][ T30] usb 5-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 350.075084][ T30] usb 5-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 350.075104][ T30] usb 5-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 350.075123][ T30] usb 5-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 350.075143][ T30] usb 5-1: config 14 interface 228 has no altsetting 0 [ 350.172593][ T30] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 350.172615][ T30] usb 5-1: Product: syz [ 350.172626][ T30] usb 5-1: Manufacturer: syz [ 350.172637][ T30] usb 5-1: SerialNumber: syz [ 350.269872][ T8591] netlink: 24 bytes leftover after parsing attributes in process `syz.1.794'. [ 350.517545][ T8595] netlink: 60 bytes leftover after parsing attributes in process `syz.1.794'. [ 350.680947][ T30] legousbtower 5-1:14.228: interrupt endpoints not found [ 351.588661][ T8602] netlink: 68 bytes leftover after parsing attributes in process `syz.1.797'. [ 351.745789][ T8598] netlink: 68 bytes leftover after parsing attributes in process `syz.3.796'. [ 352.726913][ T8621] FAULT_INJECTION: forcing a failure. [ 352.726913][ T8621] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 352.726951][ T8621] CPU: 0 UID: 0 PID: 8621 Comm: syz.1.800 Tainted: G L syzkaller #0 PREEMPT(full) [ 352.726976][ T8621] Tainted: [L]=SOFTLOCKUP [ 352.726982][ T8621] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 352.726991][ T8621] Call Trace: [ 352.726997][ T8621] [ 352.727004][ T8621] dump_stack_lvl+0xe8/0x150 [ 352.727033][ T8621] should_fail_ex+0x410/0x560 [ 352.727058][ T8621] _copy_from_user+0x2d/0xb0 [ 352.727081][ T8621] get_compat_msghdr+0xb3/0x4c0 [ 352.727100][ T8621] ? __pfx_get_compat_msghdr+0x10/0x10 [ 352.727119][ T8621] ? kfree+0x4d/0x650 [ 352.727141][ T8621] ___sys_recvmsg+0x1db/0x5a0 [ 352.727168][ T8621] ? __pfx____sys_recvmsg+0x10/0x10 [ 352.727193][ T8621] ? lock_acquire+0x115/0x350 [ 352.727233][ T8621] do_recvmmsg+0x38b/0x800 [ 352.727261][ T8621] ? __pfx_do_recvmmsg+0x10/0x10 [ 352.727284][ T8621] ? __lock_acquire+0x747/0x2de0 [ 352.727308][ T8621] ? __mutex_unlock_slowpath+0x731/0x900 [ 352.727334][ T8621] ? __fget_files+0x3a2/0x420 [ 352.727356][ T8621] __sys_recvmmsg+0x1a5/0x290 [ 352.727380][ T8621] ? __pfx___sys_recvmmsg+0x10/0x10 [ 352.727410][ T8621] __ia32_compat_sys_recvmmsg_time32+0xbf/0xe0 [ 352.727432][ T8621] __do_fast_syscall_32+0x28b/0x6c0 [ 352.727456][ T8621] ? do_fast_syscall_32+0x33/0x70 [ 352.727477][ T8621] ? asm_int80_emulation+0x1a/0x20 [ 352.727492][ T8621] ? do_int80_emulation+0x299/0x500 [ 352.727513][ T8621] ? trace_irq_disable+0x3b/0x140 [ 352.727535][ T8621] do_fast_syscall_32+0x33/0x70 [ 352.727558][ T8621] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 352.727577][ T8621] RIP: 0023:0xf7f72f1c [ 352.727591][ T8621] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 352.727605][ T8621] RSP: 002b:00000000f542650c EFLAGS: 00000206 ORIG_RAX: 0000000000000151 [ 352.727621][ T8621] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800018c0 [ 352.727632][ T8621] RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000000 [ 352.727641][ T8621] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 352.727650][ T8621] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 352.727660][ T8621] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 352.727683][ T8621] [ 353.354259][ T5720] usb 5-1: USB disconnect, device number 51 [ 353.522575][ T8627] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 353.522944][ T8627] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 353.926375][ T8632] trusted_key: encrypted_key: insufficient parameters specified [ 353.972693][ T8632] trusted_key: encrypted_key: insufficient parameters specified [ 354.162253][ T30] usb 2-1: new high-speed USB device number 43 using dummy_hcd [ 354.325872][ T30] usb 2-1: Using ep0 maxpacket: 32 [ 354.327894][ T30] usb 2-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 354.375146][ T30] usb 2-1: config 32 has an invalid interface number: 85 but max is 0 [ 354.375170][ T30] usb 2-1: config 32 has no interface number 0 [ 354.375199][ T30] usb 2-1: config 32 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 354.375219][ T30] usb 2-1: config 32 interface 85 has no altsetting 0 [ 354.428791][ T30] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 354.428826][ T30] usb 2-1: Product: syz [ 354.428843][ T30] usb 2-1: Manufacturer: syz [ 354.428860][ T30] usb 2-1: SerialNumber: syz [ 354.734607][ T8635] netlink: 104 bytes leftover after parsing attributes in process `syz.1.806'. [ 355.031596][ T30] appletouch 2-1:32.85: Failed to read mode from device. [ 355.031808][ T30] appletouch 2-1:32.85: probe with driver appletouch failed with error -5 [ 355.093130][ T30] usb 2-1: USB disconnect, device number 43 [ 355.116250][ T8652] netlink: 8 bytes leftover after parsing attributes in process `syz.4.811'. [ 355.175015][ T8649] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 355.225781][ T8649] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 355.318634][ T8649] fuse: Bad value for 'fd' [ 356.747729][ T8663] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 356.773944][ T8663] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 357.315288][ T8667] FAULT_INJECTION: forcing a failure. [ 357.315288][ T8667] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 357.315319][ T8667] CPU: 0 UID: 0 PID: 8667 Comm: syz.3.816 Tainted: G L syzkaller #0 PREEMPT(full) [ 357.315340][ T8667] Tainted: [L]=SOFTLOCKUP [ 357.315346][ T8667] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 357.315356][ T8667] Call Trace: [ 357.315362][ T8667] [ 357.315369][ T8667] dump_stack_lvl+0xe8/0x150 [ 357.315399][ T8667] should_fail_ex+0x410/0x560 [ 357.315424][ T8667] _copy_from_user+0x2d/0xb0 [ 357.315447][ T8667] get_compat_msghdr+0xb3/0x4c0 [ 357.315466][ T8667] ? __pfx_get_compat_msghdr+0x10/0x10 [ 357.315491][ T8667] ___sys_sendmsg+0x201/0x360 [ 357.315512][ T8667] ? __lock_acquire+0x747/0x2de0 [ 357.315533][ T8667] ? __pfx____sys_sendmsg+0x10/0x10 [ 357.315556][ T8667] ? get_pid_task+0x20/0x1f0 [ 357.315571][ T8667] ? get_pid_task+0x20/0x1f0 [ 357.315584][ T8667] ? get_pid_task+0x20/0x1f0 [ 357.315625][ T8667] ? __fget_files+0x3a2/0x420 [ 357.315642][ T8667] ? __fget_files+0x2a/0x420 [ 357.315666][ T8667] __sys_sendmsg+0x177/0x240 [ 357.315688][ T8667] ? __pfx___sys_sendmsg+0x10/0x10 [ 357.315718][ T8667] ? __might_fault+0xaf/0x130 [ 357.315763][ T8667] __do_fast_syscall_32+0x28b/0x6c0 [ 357.315797][ T8667] ? do_fast_syscall_32+0x33/0x70 [ 357.315832][ T8667] ? asm_int80_emulation+0x1a/0x20 [ 357.315848][ T8667] ? do_int80_emulation+0x299/0x500 [ 357.315869][ T8667] ? trace_irq_disable+0x3b/0x140 [ 357.315891][ T8667] do_fast_syscall_32+0x33/0x70 [ 357.315913][ T8667] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 357.315933][ T8667] RIP: 0023:0xf7f74f1c [ 357.315948][ T8667] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 357.315962][ T8667] RSP: 002b:00000000f542650c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 357.315979][ T8667] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800009c0 [ 357.315990][ T8667] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 357.315999][ T8667] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 357.316008][ T8667] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 357.316018][ T8667] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 357.316040][ T8667] [ 357.624626][ T8669] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 357.625061][ T8669] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 358.371654][ T5720] usb 4-1: new high-speed USB device number 46 using dummy_hcd [ 358.488585][ T31] audit: type=1326 audit(1792789513.394:1256): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8674 comm="syz.0.820" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7f44f1c code=0x0 [ 358.541724][ T5720] usb 4-1: Using ep0 maxpacket: 16 [ 358.542484][ T5720] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 358.544667][ T5720] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 358.545274][ T5720] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 358.586896][ T5720] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 358.586917][ T5720] usb 4-1: Product: syz [ 358.586927][ T5720] usb 4-1: Manufacturer: syz [ 358.586938][ T5720] usb 4-1: SerialNumber: syz [ 358.643903][ T5720] usb 4-1: 0:2 : does not exist [ 358.962714][ T5720] usb 4-1: USB disconnect, device number 46 [ 358.982822][ T30] usb 5-1: new full-speed USB device number 52 using dummy_hcd [ 359.162381][ T8685] trusted_key: encrypted_key: insufficient parameters specified [ 359.180176][ T8685] trusted_key: encrypted_key: insufficient parameters specified [ 359.207289][ T30] usb 5-1: unable to get BOS descriptor or descriptor too short [ 359.212093][ T30] usb 5-1: not running at top speed; connect to a high speed hub [ 359.212199][ T30] usb 5-1: New USB device found, idVendor=1235, idProduct=8211, bcdDevice= 0.40 [ 359.280433][ T30] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 359.280470][ T30] usb 5-1: Product: syz [ 359.280486][ T30] usb 5-1: Manufacturer: syz [ 359.280506][ T30] usb 5-1: SerialNumber: syz [ 359.724375][ T8681] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 359.724995][ T8681] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 360.066974][ T30] usb 5-1: Focusrite Scarlett Gen 3 Mixer Driver enabled (pid=0x8211); report any issues to https://github.com/geoffreybennett/scarlett-gen2/issues [ 360.067027][ T30] usb 5-1: Error initialising Scarlett Gen 3 Mixer Driver: -22 [ 360.405696][ T8701] syz.2.826 (8701) used obsolete PPPIOCDETACH ioctl [ 360.434224][ T30] snd-usb-audio 5-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 360.544399][ T30] usb 5-1: USB disconnect, device number 52 [ 360.891720][ T6885] usb 4-1: new high-speed USB device number 47 using dummy_hcd [ 361.049872][ T6885] usb 4-1: device descriptor read/64, error -71 [ 361.291700][ T6885] usb 4-1: new high-speed USB device number 48 using dummy_hcd [ 361.431715][ T6885] usb 4-1: device descriptor read/64, error -71 [ 361.543952][ T6885] usb usb4-port1: attempt power cycle [ 361.901654][ T6885] usb 4-1: new high-speed USB device number 49 using dummy_hcd [ 361.925758][ T6885] usb 4-1: device descriptor read/8, error -71 [ 362.020303][ T8705] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 362.031821][ T5706] usb 5-1: new high-speed USB device number 53 using dummy_hcd [ 362.055999][ T8705] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 362.175108][ T6885] usb 4-1: new high-speed USB device number 50 using dummy_hcd [ 362.189636][ T5706] usb 5-1: Using ep0 maxpacket: 32 [ 362.205313][ T6885] usb 4-1: device descriptor read/8, error -71 [ 362.217453][ T5706] usb 5-1: unable to get BOS descriptor or descriptor too short [ 362.217507][ T5706] usb 5-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 362.229879][ T5706] usb 5-1: config 14 has an invalid interface number: 228 but max is 0 [ 362.229899][ T5706] usb 5-1: config 14 has no interface number 0 [ 362.229929][ T5706] usb 5-1: config 14 interface 228 altsetting 5 endpoint 0x8 has invalid maxpacket 1024, setting to 64 [ 362.229950][ T5706] usb 5-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 362.229968][ T5706] usb 5-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 362.229987][ T5706] usb 5-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 362.230006][ T5706] usb 5-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 362.230025][ T5706] usb 5-1: config 14 interface 228 has no altsetting 0 [ 362.335088][ T6885] usb usb4-port1: unable to enumerate USB device [ 362.361047][ T5706] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 362.361079][ T5706] usb 5-1: Product: syz [ 362.361096][ T5706] usb 5-1: Manufacturer: syz [ 362.361111][ T5706] usb 5-1: SerialNumber: syz [ 362.950578][ T5706] legousbtower 5-1:14.228: interrupt endpoints not found [ 363.231697][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 363.664270][ T8709] netlink: 68 bytes leftover after parsing attributes in process `syz.0.827'. [ 364.113789][ T5706] usb 4-1: new high-speed USB device number 51 using dummy_hcd [ 364.283672][ T5706] usb 4-1: Using ep0 maxpacket: 8 [ 364.284210][ T5706] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 364.290436][ T5706] usb 4-1: config index 0 descriptor too short (expected 301, got 45) [ 364.290493][ T5706] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 364.290518][ T5706] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 364.291114][ T5706] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 364.291134][ T5706] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 364.291167][ T5706] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 364.599664][ T5720] logitech-hidpp-device 0005:046D:B012.0011: hidraw0: BLUETOOTH HID v0.00 Device [syz0] on syz1 [ 364.669878][ T5706] usb 4-1: usb_control_msg returned -32 [ 364.669914][ T5706] usbtmc 4-1:16.0: can't read capabilities [ 364.903860][ T5359] usb 2-1: new high-speed USB device number 44 using dummy_hcd [ 365.064893][ T8733] fido_id[8733]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 365.088974][ T5359] usb 2-1: Using ep0 maxpacket: 16 [ 365.098419][ T5359] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 365.115749][ T5359] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 365.115782][ T5359] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 365.154232][ T5359] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 365.154264][ T5359] usb 2-1: Product: syz [ 365.154280][ T5359] usb 2-1: Manufacturer: syz [ 365.154297][ T5359] usb 2-1: SerialNumber: syz [ 365.236450][ T5359] usb 2-1: 0:2 : does not exist [ 365.263941][ T8736] syz_tun: entered allmulticast mode [ 365.311349][ T8736] pimreg: entered allmulticast mode [ 365.538495][ T8739] usbtmc 4-1:16.0: usb_control_msg returned -32 [ 365.586551][ T5359] usb 2-1: USB disconnect, device number 44 [ 365.744381][ T6885] usb 5-1: USB disconnect, device number 53 [ 366.118772][ T8735] syz_tun: left allmulticast mode [ 366.431917][ T33] INFO: task kworker/1:4:5685 blocked for more than 143 seconds. [ 366.431949][ T33] Tainted: G L syzkaller #0 [ 366.431962][ T33] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 366.431972][ T33] task:kworker/1:4 state:D stack:22144 pid:5685 tgid:5685 ppid:2 task_flags:0x4208060 flags:0x00080000 [ 366.432034][ T33] Workqueue: usb_hub_wq hub_event [ 366.432092][ T33] Call Trace: [ 366.432107][ T33] [ 366.432122][ T33] __schedule+0x17dd/0x5820 [ 366.432179][ T33] ? __pfx___schedule+0x10/0x10 [ 366.432206][ T33] ? schedule+0x90/0x2b0 [ 366.432228][ T33] schedule+0x164/0x2b0 [ 366.432249][ T33] schedule_timeout+0xc0/0x2c0 [ 366.432266][ T33] ? __pfx_schedule_timeout+0x10/0x10 [ 366.432289][ T33] ? do_raw_spin_lock+0x12b/0x2f0 [ 366.432322][ T33] ? _raw_spin_unlock_irq+0x23/0x50 [ 366.432341][ T33] ? wait_for_completion+0x26d/0x5d0 [ 366.432362][ T33] wait_for_completion+0x2c5/0x5d0 [ 366.432625][ T33] ? __pfx_wait_for_completion+0x10/0x10 [ 366.432669][ T33] ? kobject_put+0x50f/0x550 [ 366.432689][ T33] i2c_del_adapter+0x292/0x440 [ 366.432718][ T33] ? __pfx_i2c_del_adapter+0x10/0x10 [ 366.432769][ T33] ? dvb_usbv2_exit+0x94d/0xb80 [ 366.432797][ T33] dvb_usbv2_probe+0x4bb/0x3950 [ 366.432848][ T33] ? __pfx_dvb_usbv2_probe+0x10/0x10 [ 366.432864][ T33] ? __pm_runtime_set_status+0xa96/0xd80 [ 366.432897][ T33] usb_probe_interface+0x788/0xe50 [ 366.432924][ T33] ? __pfx_usb_probe_interface+0x10/0x10 [ 366.432941][ T33] ? kernfs_create_link+0x1cd/0x240 [ 366.432961][ T33] ? sysfs_do_create_link_sd+0xe0/0x110 [ 366.432984][ T33] ? driver_sysfs_add+0x1fe/0x210 [ 366.433009][ T33] ? __pfx_usb_probe_interface+0x10/0x10 [ 366.433026][ T33] really_probe+0x254/0xae0 [ 366.433054][ T33] __driver_probe_device+0x1e8/0x360 [ 366.433081][ T33] driver_probe_device+0x4f/0x240 [ 366.433108][ T33] __device_attach_driver+0x270/0x410 [ 366.433136][ T33] bus_for_each_drv+0x258/0x2f0 [ 366.433155][ T33] ? __pfx___device_attach_driver+0x10/0x10 [ 366.433181][ T33] ? __pfx_bus_for_each_drv+0x10/0x10 [ 366.433202][ T33] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 366.433224][ T33] __device_attach+0x2c4/0x450 [ 366.433250][ T33] ? __pfx___device_attach+0x10/0x10 [ 366.433272][ T33] ? do_raw_spin_unlock+0xf5/0x200 [ 366.433305][ T33] ? _raw_spin_unlock+0x28/0x50 [ 366.433337][ T33] device_initial_probe+0xa1/0xd0 [ 366.433363][ T33] bus_probe_device+0x12a/0x220 [ 366.433386][ T33] device_add+0x7d7/0xb80 [ 366.433410][ T33] usb_set_configuration+0x1bb5/0x2260 [ 366.433448][ T33] usb_generic_driver_probe+0x8d/0x150 [ 366.433467][ T33] usb_probe_device+0x1c3/0x3b0 [ 366.433489][ T33] ? __pfx_usb_probe_device+0x10/0x10 [ 366.451204][ T33] really_probe+0x254/0xae0 [ 366.451245][ T33] __driver_probe_device+0x1e8/0x360 [ 366.451273][ T33] driver_probe_device+0x4f/0x240 [ 366.451317][ T33] __device_attach_driver+0x270/0x410 [ 366.451346][ T33] bus_for_each_drv+0x258/0x2f0 [ 366.451366][ T33] ? __pfx___device_attach_driver+0x10/0x10 [ 366.451392][ T33] ? __pfx_bus_for_each_drv+0x10/0x10 [ 366.451413][ T33] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 366.458663][ T33] __device_attach+0x2c4/0x450 [ 366.458698][ T33] ? __pfx___device_attach+0x10/0x10 [ 366.458723][ T33] ? do_raw_spin_unlock+0xf5/0x200 [ 366.458782][ T33] ? _raw_spin_unlock+0x28/0x50 [ 366.458810][ T33] device_initial_probe+0xa1/0xd0 [ 366.458836][ T33] bus_probe_device+0x12a/0x220 [ 366.458858][ T33] device_add+0x7d7/0xb80 [ 366.458882][ T33] usb_new_device+0x9aa/0x1690 [ 366.458914][ T33] ? __pfx_usb_new_device+0x10/0x10 [ 366.458940][ T33] ? _raw_spin_unlock_irq+0x23/0x50 [ 366.458962][ T33] hub_event+0x28e8/0x4d30 [ 366.458977][ T33] ? do_raw_spin_unlock+0xf5/0x200 [ 366.459037][ T33] ? __pfx_hub_event+0x10/0x10 [ 366.459059][ T33] ? rcu_is_watching+0x16/0xb0 [ 366.459083][ T33] ? process_scheduled_works+0x97a/0x1630 [ 366.459105][ T33] process_scheduled_works+0xc3d/0x1630 [ 366.459151][ T33] ? __pfx_process_scheduled_works+0x10/0x10 [ 366.459177][ T33] ? assign_work+0x3cf/0x5d0 [ 366.459202][ T33] worker_thread+0xa47/0xfb0 [ 366.459245][ T33] kthread+0x38b/0x480 [ 366.459262][ T33] ? __pfx_worker_thread+0x10/0x10 [ 366.459290][ T33] ? __pfx_kthread+0x10/0x10 [ 366.459307][ T33] ret_from_fork+0x514/0xb70 [ 366.459327][ T33] ? __pfx_ret_from_fork+0x10/0x10 [ 366.459344][ T33] ? __switch_to+0xc78/0x1410 [ 366.459370][ T33] ? __pfx_kthread+0x10/0x10 [ 366.459387][ T33] ret_from_fork_asm+0x1a/0x30 [ 366.459416][ T33] [ 366.459463][ T33] [ 366.459463][ T33] Showing all locks held in the system: [ 366.459473][ T33] locks held by pr/ttyS0/32: 1, last CPU#0: [ 366.459485][ T33] #0: ffffffff8fc33858 (console_srcu){....}-{0:0}, at: console_srcu_read_lock+0x30/0x60 [ 366.459535][ T33] locks held by khungtaskd/33: 1, last CPU#0: [ 366.459546][ T33] #0: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 366.459607][ T33] locks held by getty/5385: 2, on CPU#0: [ 366.459618][ T33] #0: ffff8880331410a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 366.459658][ T33] #1: ffffc900032432e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45a/0x1360 [ 366.459706][ T33] locks held by udevd/5639: 4, on CPU#0: [ 366.459716][ T33] #0: ffff8880772592d8 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xa4/0xca0 [ 366.560533][ T33] #1: ffff88807a841c80 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x5d/0x420 [ 366.560595][ T33] #2: ffff88805821ed28 (kn->active#19){.+.+}-{0:0}, at: kernfs_seq_start+0xb2/0x420 [ 366.560643][ T33] #3: ffff88807b40e1d8 (&dev->mutex){....}-{4:4}, at: manufacturer_show+0x26/0xa0 [ 366.560704][ T33] locks held by syz-executor/5640: 4, last CPU#0: [ 366.560716][ T33] #0: ffffffff8fe33fd0 (dup_mmap_sem){.+.+}-{0:0}, at: copy_mm+0x10a/0x470 [ 366.560804][ T33] #1: ffff88807fe39bc0 (&mm->mmap_lock){++++}-{4:4}, at: dup_mmap+0x195/0x1dc0 [ 366.560849][ T33] #2: ffff8880367ff180 (&mm->mmap_lock/1){+.+.}-{4:4}, at: dup_mmap+0x221/0x1dc0 [ 366.560897][ T33] #3: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x240 [ 366.560939][ T33] locks held by syz-executor/5642: 4, last CPU#1: [ 366.560951][ T33] #0: ffffffff8fe33fd0 (dup_mmap_sem){.+.+}-{0:0}, at: copy_mm+0x10a/0x470 [ 366.560995][ T33] #1: ffff88807de8f180 (&mm->mmap_lock){++++}-{4:4}, at: dup_mmap+0x195/0x1dc0 [ 366.561039][ T33] #2: ffff88807fbf9bc0 (&mm->mmap_lock/1){+.+.}-{4:4}, at: dup_mmap+0x221/0x1dc0 [ 366.561086][ T33] #3: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550 [ 366.561137][ T33] locks held by kworker/1:4/5685: 5, on CPU#1: [ 366.561149][ T33] #0: ffff888022ee4d48 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 366.561201][ T33] #1: ffffc90004a8fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 366.561249][ T33] #2: ffff88802ab771d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 [ 366.561290][ T33] #3: ffff88807b40e1d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 [ 366.561339][ T33] #4: ffff888029ca61a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 [ 366.561397][ T33] locks held by kworker/u8:31/7828: 3, last CPU#1: [ 366.561409][ T33] #0: ffff88801c0ac148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 366.644138][ T33] #1: ffffc900208afc40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 366.644319][ T33] #2: ffff88807845e258 (&devlink->lock_key#2){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x57/0xb30 [ 366.677994][ T33] locks held by syz.0.760/8485: 1, last CPU#1: [ 366.678050][ T33] #0: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550 [ 366.678241][ T33] locks held by syz.0.777/8549: 3, last CPU#1: [ 366.678331][ T33] #0: ffff888055b0c460 (sb_writers#5){.+.+}-{0:0}, at: vfs_coredump+0xac3/0x10c0 [ 366.678534][ T33] #1: ffff888021f60890 (&sb->s_type->i_mutex_key#16){+.+.}-{4:4}, at: shmem_file_write_iter+0x7f/0x120 [ 366.678697][ T33] #2: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550 [ 366.678907][ T33] locks held by syz.2.791/8583: 2, last CPU#1: [ 366.678956][ T33] #0: ffff888055c0c460 (sb_writers#5){.+.+}-{0:0}, at: vfs_coredump+0xac3/0x10c0 [ 366.679131][ T33] #1: ffff88802ce726b8 (&sb->s_type->i_mutex_key#16){+.+.}-{4:4}, at: shmem_file_write_ite ** replaying previous printk message ** [ 366.679131][ T33] #1: ffff88802ce726b8 (&sb->s_type->i_mutex_key#16){+.+.}-{4:4}, at: shmem_file_write_iter+0x7f/0x120 [ 366.679302][ T33] locks held by syz.0.795/8599: 2, last CPU#1: [ 366.679344][ T33] #0: ffff888055b0c460 (sb_writers#5){.+.+}-{0:0}, at: vfs_coredump+0xac3/0x10c0 [ 366.757229][ T33] #1: ffff8880778dfb28 (&sb->s_type->i_mutex_key#16){+.+.}-{4:4}, at: shmem_file_write_iter+0x7f/0x120 [ 366.757444][ T33] locks held by syz.3.810/8644: 2, last CPU#1: [ 366.757486][ T33] #0: ffff88802a820460 (sb_writers#5){.+.+}-{0:0}, at: vfs_coredump+0xac3/0x10c0 [ 366.757610][ T33] #1: ffff88807cdf94a0 (&sb->s_type->i_mutex_key#16){+.+.}-{4:4}, at: shmem_file_write_iter+0x7f/0x120 [ 366.757876][ T33] locks held by syz.2.812/8653: 1, last CPU#1: [ 366.757919][ T33] #0: ffff888055c0c460 (sb_writers#5){.+.+}-{0:0}, at: vfs_coredump+0xac3/0x10c0 [ 366.758111][ T33] locks held by syz.1.823/8686: 2, last CPU#1: [ 366.825940][ T33] #0: ffff888028550460 (sb_writers#5){.+.+}-{0:0}, at: vfs_coredump+0xac3/0x10c0 [ 366.826171][ T33] #1: ffff88805351acc0 (&sb->s_type->i_mutex_key#16){+.+.}-{4:4}, at: shmem_file_write_iter+0x7f/0x120 [ 366.826348][ T33] locks held by syz.2.829/8711: 3, last CPU#1: [ 366.826391][ T33] #0: ffff888055c0c460 (sb_writers#5){.+.+}-{0:0}, at: vfs_coredump+0xac3/0x10c0 [ 366.839426][ T33] #1: ffff888037f88890 (&sb->s_type->i_mutex_key#16){+.+.}-{4:4}, at: shmem_file_write_iter+0x7f/0x120 [ 366.839596][ T33] #2: ffff8880b843bea0 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0xb2/0x160 [ 366.839839][ T33] locks held by syz.2.836/8735: 1, on CPU#1: [ 366.839875][ T33] #0: ffff8880367f9bc0 (&mm->mmap_lock){++++}-{4:4}, at: exit_mm+0x77/0x240 [ 366.840051][ T33] locks held by syz.2.836/8736: 3, last CPU#1: [ 366.840094][ T33] #0: ffff888077f0b088 (vm_lock){++++}-{0:0}, at: lock_vma_under_rcu+0x1d1/0x500 [ 366.840243][ T33] #1: ffff88807a3a8490 (&anon_vma->rwsem){++++}-{4:4}, at: __folio_split+0x68b/0x1a40 [ 366.840398][ T33] #2: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550 [ 366.840565][ T33] locks held by syz.2.836/8737: 2, on CPU#0: [ 366.840608][ T33] #0: ffff8880367f9bc0 (&mm->mmap_lock){++++}-{4:4}, at: __vm_munmap+0x163/0x3e0 [ 366.957159][ T33] #1: ffff888077f0b088 (vm_lock){++++}-{0:0}, at: __vma_start_write+0xdc/0x290 [ 366.957388][ T33] locks held by syz.2.836/8742: 1, on CPU#1: [ 366.957445][ T33] #0: ffff8880367f9bc0 (&mm->mmap_lock){++++}-{4:4}, at: exit_mm+0x77/0x240 [ 366.957663][ T33] locks held by syz.0.839/8746: 1, on CPU#0: [ 366.957710][ T33] #0: ffff88805559c080 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock_killable+0x1d/0x70 [ 366.957930][ T33] locks held by syz.0.839/8747: 4, last CPU#1: [ 366.957987][ T33] #0: ffffffff8fe33fd0 (dup_mmap_sem){.+.+}-{0:0}, at: copy_mm+0x10a/0x470 [ 366.958156][ T33] #1: ffff88805559c080 (&mm->mmap_lock){++++}-{4:4}, at: dup_mmap+0x195/0x1dc0 [ 366.958328][ T33] #2: ffff88807fbfccc0 (&mm->mmap_lock/1){+.+.}-{4:4}, at: dup_mmap+0x221/0x1dc0 [ 366.958526][ T33] #3: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x240 [ 367.067426][ T33] locks held by syz-executor/8748: 4, last CPU#1: [ 367.067479][ T33] #0: ffff88802bb48460 (sb_writers#5){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 [ 367.067695][ T33] #1: ffff88804e11acc0 (&type->i_mutex_dir_key#5/1){+.+.}-{4:4}, at: filename_create+0x200/0x370 [ 367.067944][ T33] #2: ffffffff904f4d38 (tomoyo_ss){.+.+}-{0:0}, at: tomoyo_path_perm+0x251/0x560 [ 367.068090][ T33] #3: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550 [ 367.111561][ T33] [ 367.111586][ T33] ============================================= [ 367.111586][ T33] [ 367.111647][ T33] NMI backtrace for cpu 1 [ 367.111699][ T33] CPU: 1 UID: 0 PID: 33 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 367.111784][ T33] Tainted: [L]=SOFTLOCKUP [ 367.111804][ T33] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 367.111845][ T33] Call Trace: [ 367.111873][ T33] [ 367.111901][ T33] dump_stack_lvl+0xe8/0x150 [ 367.112035][ T33] nmi_cpu_backtrace+0x274/0x2d0 [ 367.112108][ T33] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 367.112186][ T33] nmi_trigger_cpumask_backtrace+0x17d/0x390 [ 367.112266][ T33] sys_info+0x135/0x170 [ 367.112317][ T33] watchdog+0xfd2/0x1030 [ 367.112410][ T33] ? watchdog+0x1c7/0x1030 [ 367.112503][ T33] kthread+0x38b/0x480 [ 367.112559][ T33] ? __pfx_watchdog+0x10/0x10 [ 367.112624][ T33] ? __pfx_kthread+0x10/0x10 [ 367.112714][ T33] ret_from_fork+0x514/0xb70 [ 367.112780][ T33] ? __pfx_ret_from_fork+0x10/0x10 [ 367.112850][ T33] ? __switch_to+0xc78/0x1410 [ 367.112946][ T33] ? __pfx_kthread+0x10/0x10 [ 367.113007][ T33] ret_from_fork_asm+0x1a/0x30 [ 367.113113][ T33] [ 367.113221][ T33] Sending NMI from CPU 1 to CPUs 0: [ 367.113292][ C0] NMI backtrace for cpu 0 [ 367.113309][ C0] CPU: 0 UID: 0 PID: 32 Comm: pr/ttyS0 Tainted: G L syzkaller #0 PREEMPT(full) [ 367.113335][ C0] Tainted: [L]=SOFTLOCKUP [ 367.113342][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 367.113353][ C0] RIP: 0010:io_serial_out+0x7c/0xc0 [ 367.113384][ C0] Code: 53 50 fc 44 89 f9 d3 e5 49 83 c6 40 4c 89 f0 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 f7 e8 ec 4a c1 fc 41 03 2e 89 d8 89 ea ee <5b> 41 5c 41 5e 41 5f 5d e9 d7 7a 82 06 cc 44 89 f9 80 e1 07 38 c1 [ 367.113400][ C0] RSP: 0000:ffffc90000a87900 EFLAGS: 00000002 [ 367.113417][ C0] RAX: 000000000000006f RBX: 000000000000006f RCX: 0000000000000000 [ 367.113429][ C0] RDX: 00000000000003f8 RSI: 0000000000000000 RDI: 0000000000000020 [ 367.113441][ C0] RBP: 00000000000003f8 R08: 0000000000000003 R09: 0000000000000004 [ 367.113452][ C0] R10: dffffc0000000000 R11: ffffffff85781280 R12: dffffc0000000000 [ 367.113467][ C0] R13: 000000000000006f R14: ffffffff9bdbaae0 R15: 0000000000000000 [ 367.113480][ C0] FS: 0000000000000000(0000) GS:ffff888123a52000(0000) knlGS:0000000000000000 [ 367.113496][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 367.113510][ C0] CR2: 00000000f70191de CR3: 0000000034b2e000 CR4: 00000000003526f0 [ 367.113527][ C0] Call Trace: [ 367.113534][ C0] [ 367.113543][ C0] __serial8250_console_fifo_write+0x1e6/0x3e0 [ 367.113570][ C0] serial8250_console_write+0xa7e/0x1200 [ 367.113603][ C0] ? __pfx_serial8250_console_write+0x10/0x10 [ 367.113629][ C0] ? __schedule+0x17f3/0x5820 [ 367.113661][ C0] nbcon_emit_next_record+0xef5/0x1a90 [ 367.113692][ C0] ? __pfx_nbcon_emit_next_record+0x10/0x10 [ 367.113718][ C0] ? nbcon_context_try_acquire+0x819/0xbd0 [ 367.113752][ C0] ? _raw_spin_lock_irqsave+0x4c/0x60 [ 367.113776][ C0] nbcon_kthread_func+0x6d9/0x8d0 [ 367.113801][ C0] ? nbcon_kthread_func+0x163/0x8d0 [ 367.113822][ C0] ? __pfx_nbcon_kthread_func+0x10/0x10 [ 367.113847][ C0] ? __kthread_parkme+0x71/0x1f0 [ 367.113875][ C0] ? __kthread_parkme+0x199/0x1f0 [ 367.113905][ C0] kthread+0x38b/0x480 [ 367.113922][ C0] ? __pfx_nbcon_kthread_func+0x10/0x10 [ 367.113942][ C0] ? __pfx_kthread+0x10/0x10 [ 367.113961][ C0] ret_from_fork+0x514/0xb70 [ 367.113981][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 367.114001][ C0] ? __switch_to+0xc78/0x1410 [ 367.114029][ C0] ? __pfx_kthread+0x10/0x10 [ 367.114048][ C0] ret_from_fork_asm+0x1a/0x30 [ 367.114075][ C0] [ 367.291927][ T33] Kernel panic - not syncing: hung_task: blocked tasks [ 368.005342][ T33] CPU: 1 UID: 0 PID: 33 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 368.016112][ T33] Tainted: [L]=SOFTLOCKUP [ 368.020453][ T33] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 368.030513][ T33] Call Trace: [ 368.033807][ T33] [ 368.036763][ T33] vpanic+0x56d/0xa60 [ 368.040765][ T33] ? __pfx___schedule+0x10/0x10 [ 368.045634][ T33] ? __pfx_vpanic+0x10/0x10 [ 368.050168][ T33] panic+0xc5/0xd0 [ 368.053925][ T33] ? __pfx_panic+0x10/0x10 [ 368.058368][ T33] ? preempt_schedule_common+0x7f/0xd0 [ 368.063874][ T33] ? preempt_schedule_thunk+0x16/0x40 [ 368.069272][ T33] ? nmi_trigger_cpumask_backtrace+0x31a/0x390 [ 368.075448][ T33] ? nmi_trigger_cpumask_backtrace+0x31f/0x390 [ 368.081630][ T33] watchdog+0x102b/0x1030 [ 368.086031][ T33] ? watchdog+0x1c7/0x1030 [ 368.090484][ T33] kthread+0x38b/0x480 [ 368.094561][ T33] ? __pfx_watchdog+0x10/0x10 [ 368.099270][ T33] ? __pfx_kthread+0x10/0x10 [ 368.103867][ T33] ret_from_fork+0x514/0xb70 [ 368.108475][ T33] ? __pfx_ret_from_fork+0x10/0x10 [ 368.113591][ T33] ? __switch_to+0xc78/0x1410 [ 368.118289][ T33] ? __pfx_kthread+0x10/0x10 [ 368.122889][ T33] ret_from_fork_asm+0x1a/0x30 [ 368.127675][ T33] [ 368.131302][ T33] Kernel Offset: disabled [ 368.135649][ T33] Rebooting in 86400 seconds..