last executing test programs: 2m31.227596603s ago: executing program 4 (id=1449): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f00000000c0)=0xa, 0x4) sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[], 0x30}, 0x1, 0x0, 0x0, 0xaa34a4cffb93b201}, 0x10) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'xfrm0\x00', 0x0}) sendto$packet(r0, &(0x7f0000000180)="10031212e4ff020002004788aa96a13bb100001100007fca1a00", 0xc24f, 0xb000000, &(0x7f0000000140)={0x11, 0x0, r1}, 0x14) 2m31.116507156s ago: executing program 4 (id=1450): r0 = fcntl$getown(0xffffffffffffffff, 0x9) getpgrp(r0) r1 = socket$nl_rdma(0x10, 0x3, 0x14) ioctl$sock_inet_SIOCGIFDSTADDR(r1, 0x8917, &(0x7f0000000000)={'veth0_to_batadv\x00', {0x2, 0x0, @multicast1}}) ioctl$int_in(r1, 0x5421, &(0x7f0000000040)=0x5) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080), 0x8001, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f00000000c0)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r2, &(0x7f0000002100)={0x50, 0xfffffffffffffff5, r3, {0x7, 0x2b, 0x8, 0x14004, 0x3ff, 0x5, 0x4, 0x2, 0x0, 0x0, 0x10, 0x7}}, 0x50) ioctl$sock_TIOCINQ(r1, 0x541b, &(0x7f0000002180)) ioctl$UFFDIO_ZEROPAGE(r2, 0xc020aa04, &(0x7f00000021c0)={{&(0x7f0000ffb000/0x4000)=nil, 0x4000}}) getsockname$unix(r2, &(0x7f0000002200)=@abs, &(0x7f0000002280)=0x6e) ioctl$SNDRV_RAWMIDI_IOCTL_DROP(0xffffffffffffffff, 0x40045730, &(0x7f00000022c0)=0x8) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000002340)={0x0, &(0x7f0000002300)}) ioctl$ifreq_SIOCGIFINDEX_wireguard(r1, 0x8933, &(0x7f00000023c0)={'wg2\x00', 0x0}) sendmsg$nl_route_sched_retired(r2, &(0x7f0000002500)={&(0x7f0000002380)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000024c0)={&(0x7f0000002400)=@newqdisc={0xac, 0x24, 0x4, 0x70bd28, 0x25dfdbfd, {0x0, 0x0, 0x0, r7, {0x1, 0x3}, {0xa, 0xfff2}, {0xfff2, 0x9}}, [@q_dsmark={{0xb}, {0x28, 0x2, [@TCA_DSMARK_DEFAULT_INDEX={0x6, 0x2, 0xfffc}, @TCA_DSMARK_SET_TC_INDEX={0x4}, @TCA_DSMARK_DEFAULT_INDEX={0x6, 0x2, 0x65b}, @TCA_DSMARK_DEFAULT_INDEX={0x6, 0x2, 0x2}, @TCA_DSMARK_INDICES={0x6, 0x1, 0xe}]}}, @q_dsmark={{0xb}, {0x28, 0x2, [@TCA_DSMARK_INDICES={0x6, 0x1, 0x26}, @TCA_DSMARK_INDICES={0x6, 0x1, 0xa}, @TCA_DSMARK_INDICES={0x6, 0x1, 0x1a}, @TCA_DSMARK_SET_TC_INDEX={0x4}, @TCA_DSMARK_INDICES={0x6, 0x1, 0x1a}]}}, @q_dsmark={{0xb}, {0x14, 0x2, [@TCA_DSMARK_DEFAULT_INDEX={0x6, 0x2, 0xdda4}, @TCA_DSMARK_INDICES={0x6, 0x1, 0xb653ba500f624bab}]}}]}, 0xac}, 0x1, 0x0, 0x0, 0x1}, 0x8000) gettid() connect$rds(r2, &(0x7f0000002540)={0x2, 0x4e21, @local}, 0x10) ioctl$TIOCSCTTY(r2, 0x540e, 0x347caa40) getsockopt$CAN_RAW_FILTER(r2, 0x65, 0x1, &(0x7f0000002580)=[{}, {}, {}, {}, {}, {}, {}], &(0x7f00000025c0)=0x38) r8 = openat$cuse(0xffffffffffffff9c, &(0x7f0000002600), 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000002640)={{{@in=@remote, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in6=@private1}}, &(0x7f0000002740)=0xe8) r10 = getegid() write$FUSE_DIRENTPLUS(r8, &(0x7f0000002780)={0x3e0, 0x0, r3, [{{0x4, 0x2, 0x8001, 0x4, 0x3, 0x1, {0x1, 0x5, 0x8, 0xc, 0x2, 0xb, 0x101, 0x10000, 0xfffffff0, 0xa000, 0x0, r4, 0xffffffffffffffff, 0x6, 0x200}}, {0x3, 0xadfb, 0x10, 0xea, 'veth0_to_batadv\x00'}}, {{0x0, 0x2, 0x2a90, 0x10000, 0x3, 0x5, {0x2, 0xc25, 0x1, 0x8, 0x4, 0x6, 0xffffffff, 0x100, 0x2, 0x1000, 0x3, r4, r5, 0x5a, 0xfffffeff}}, {0x5, 0x7, 0x4, 0x200, '$%\x1c\\'}}, {{0x3, 0x1, 0x5, 0xbb53, 0x2, 0x6, {0x0, 0xffffffffffffff7f, 0x1ff, 0xffffffffffff3625, 0x5, 0x4, 0x7, 0x401, 0xfff, 0x4000, 0x8, r4, r5, 0x5f, 0x1}}, {0x7, 0x5, 0x1, 0x7, '\x00'}}, {{0x5, 0x1, 0xfff0000000, 0x100000001, 0x1, 0x9, {0x5, 0xfffffffffffffffe, 0x506, 0x2, 0x9, 0x7, 0x6, 0x0, 0x5, 0xc000, 0x1, r4, r5, 0x7}}, {0x4, 0x1a, 0x10, 0x5, 'veth0_to_batadv\x00'}}, {{0x5, 0x1, 0xfffffffffffffff9, 0x3158, 0x2, 0x1, {0x0, 0x10000, 0x1ff, 0x8000000000000000, 0x7, 0x1, 0xdbcd, 0x8, 0xffffffff, 0x2000, 0x7ff, r9, r5, 0xf, 0x3}}, {0x4, 0xffffffffffffffff, 0x1, 0x78c, '\\'}}, {{0x0, 0x0, 0x1, 0x5, 0x1, 0x1, {0x5, 0x9, 0x4, 0x7fffffffffffffff, 0x10000, 0xccdb, 0x8, 0x80000001, 0x2, 0xa000, 0x40, r4, r10, 0x4, 0x14}}, {0x2, 0x8, 0x4, 0x7fffffff, '.)\xc4\''}}]}, 0x3e0) syslog(0x4, &(0x7f0000002b80)=""/104, 0x68) syslog(0x4, &(0x7f0000002c00)=""/24, 0x18) ioctl$IOMMU_DESTROY$ioas(r2, 0x3b80, &(0x7f0000002c40)={0x8}) ioctl$DRM_IOCTL_DMA(r2, 0xc0406429, &(0x7f0000002d80)={0x0, 0x2, &(0x7f0000002c80)=[0x1ff, 0x6], &(0x7f0000002cc0)=[0x7, 0xfffffffd, 0x400], 0x0, 0x8, 0x4, &(0x7f0000002d00)=[0x20e, 0x1, 0x81, 0x2, 0x7fffffff, 0x40, 0x2, 0x8], &(0x7f0000002d40)=[0x5, 0xd, 0x7ff]}) process_vm_writev(r6, &(0x7f0000002f40)=[{&(0x7f0000002dc0)=""/174, 0xae}, {&(0x7f0000002e80)=""/73, 0x49}, {&(0x7f0000002f00)=""/62, 0x3e}], 0x3, &(0x7f0000004340)=[{&(0x7f0000002f80)=""/133, 0x85}, {&(0x7f0000003040)=""/72, 0x48}, {&(0x7f00000030c0)=""/246, 0xf6}, {&(0x7f00000031c0)=""/17, 0x11}, {&(0x7f0000003200)=""/4096, 0x1000}, {&(0x7f0000004200)=""/74, 0x4a}, {&(0x7f0000004280)=""/171, 0xab}], 0x7, 0x0) socket$inet6(0xa, 0xa, 0xfffffffa) socket(0x11, 0x80000, 0x200) 2m30.992367363s ago: executing program 4 (id=1452): r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000040)={'batadv_slave_1\x00', {0x2, 0x0, @loopback=0x7f000000}}) close(0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000ac0)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000fdffffff850000002d000000"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xa, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r3}, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x6000) openat$comedi(0xffffffffffffff9c, 0x0, 0x40000, 0x0) r4 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$SEG6_CMD_DUMPHMAC(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x60, r4, 0x20, 0x70bd27, 0x25dfdbfd, {}, [@SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x6}, @SEG6_ATTR_SECRETLEN={0x5, 0x5, 0x5}, @SEG6_ATTR_SECRETLEN={0x5, 0x5, 0x1}, @SEG6_ATTR_DST={0x14, 0x1, @rand_addr=' \x01\x00'}, @SEG6_ATTR_SECRET={0xc, 0x4, [0x3, 0x9]}, @SEG6_ATTR_SECRET={0x4}, @SEG6_ATTR_SECRET={0x10, 0x4, [0x4, 0x8, 0x0]}]}, 0x60}, 0x1, 0x0, 0x0, 0x40004}, 0x4000840) sendmsg$ETHTOOL_MSG_FEATURES_SET(0xffffffffffffffff, 0x0, 0x20000004) r5 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r6 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0xb, 0x1c, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000ff9018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b702000014000000b70300001b0000008500000083000000bf0900000000000055090100000000009500000000000000bf080000000000007b9af8ff00000000b5090500000000007baaf0ff00000000bda804000000000007080000f8ffffffbfa400000000000007000000f0ffffffb70200000800000018220000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7050000080000004600000076000000bf91000000000000b6080000000000008500000085000000b70000000000000095"], &(0x7f0000000980)='GPL\x00', 0xb, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$sock_inet_SIOCSIFADDR(r0, 0x891c, &(0x7f0000000000)={'batadv_slave_1\x00', {0x2, 0x0, @empty}}) 2m29.068722524s ago: executing program 4 (id=1455): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$NL802154_CMD_GET_INTERFACE(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x14, r1, 0x901, 0x70bd2d, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x45001}, 0x8000) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) syz_open_dev$ndb(0x0, 0x0, 0x80) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000034000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) r3 = syz_usb_connect(0x2, 0x24, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r3, 0x0, &(0x7f0000000000)={0x1c, 0x0, 0x0, 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, 0x0) sendmsg$nl_route_sched(r4, 0x0, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000000140)=0x1, 0x4) connect$inet6(r0, &(0x7f00000007c0)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @loopback}, 0x7}, 0x1c) io_setup(0x6, &(0x7f0000000680)) mount(&(0x7f00000001c0)=@nullb, &(0x7f0000000000)='./cgroup\x00', &(0x7f0000000180)='qnx4\x00', 0x0, 0x0) 2m25.93211718s ago: executing program 4 (id=1470): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = dup(r0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180100"/13], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) r3 = signalfd4(0xffffffffffffffff, &(0x7f00000008c0), 0x8, 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='.\x00', &(0x7f0000000040), 0x0, &(0x7f0000000100)={'trans=fd,', {'rfdno', 0x3d, r3}, 0x2c, {'wfdno', 0x3d, r3}}) signalfd4(r3, &(0x7f0000000080), 0x8, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r2}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r7 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000680), r7) prctl$PR_MCE_KILL(0x4e, 0x1, 0x4000) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000500)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_NEWRULE={0x14, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x3c}, 0x1, 0x0, 0x0, 0x4000850}, 0x24044010) r8 = openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='.\x00', 0x0, 0x83) sendmsg$nl_route_sched_retired(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0xf0, 0x32, 0x205, 0x70bd2d, 0x25dfdbfc, {}, [{0xc9}]}, 0xf0}, 0x1, 0x0, 0x0, 0x85}, 0x8000) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r8, 0x40086602, &(0x7f0000000000)) fstat(r8, &(0x7f0000000340)) write$UHID_INPUT(r1, &(0x7f00000010c0)={0xc, {"a2e3ad21ed0d52f91b5d380987f70e06d038e7ff7fc6e5539b356d298b089b0708374b090890e0878f0e1ac6e7049b3350959bfc9a240d2567f3988f7ef319520100ffe8d178708c523c921b1b9b31070d074b0936cd3b78130daa61d8e809ea882f5802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb056d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498be0800000000000000f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6efcffac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ec126c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b8247068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c198045651cf4778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c5409711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af1079c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e24919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afae5136651b1b9bd522d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b75d63c3c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f00000000000000000000b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d53588a0f9455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d664130bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128ad2706f48261f7899484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe603000000e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0ab00800000269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ea4cd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f031755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c7e36bb2fc4c40e9cf96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb24ee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f9000", 0x1000}}, 0x1006) socket$inet_udp(0x2, 0x2, 0x0) r9 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_HWPT_ALLOC$NONE(r9, 0x3b89, &(0x7f00000000c0)={0x28, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000040)="ed61acee"}) 2m24.84889321s ago: executing program 4 (id=1474): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000bc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x4000000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, 0x0, &(0x7f0000000200)={0x30, 0x30, 0x30}}}], 0x0, 0x0, 0x0}) 2m9.808872073s ago: executing program 32 (id=1474): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000bc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x4000000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, 0x0, &(0x7f0000000200)={0x30, 0x30, 0x30}}}], 0x0, 0x0, 0x0}) 1m8.057996334s ago: executing program 2 (id=1769): ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000000)={'gre0\x00', &(0x7f0000000380)={'sit0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, {{0x24, 0x4, 0x0, 0x0, 0x90, 0x0, 0x0, 0x0, 0x0, 0x0, @loopback, @rand_addr, {[@timestamp={0x44, 0x1c, 0xff, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @timestamp_prespec={0x44, 0x34, 0x0, 0x3, 0x0, [{@multicast2}, {@empty}, {@broadcast, 0x10001}, {@empty}, {@multicast1}, {@private}]}, @rr={0x7, 0x23, 0xfe, [@remote, @initdev={0xac, 0x1e, 0x0, 0x0}, @empty, @multicast1, @remote, @dev, @initdev={0xac, 0x1e, 0x1, 0x0}, @rand_addr=0x64010100]}, @noop, @lsrr={0x83, 0x3}, @generic={0x0, 0x2}]}}}}}) r0 = syz_clone(0x2000000, 0x0, 0x60, 0x0, 0x0, 0x0) ptrace(0x10, r0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000240), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x280000b, 0x28011, r1, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000100)=ANY=[@ANYBLOB="dc01c6ba1cdcc12519250000000000007f007101001300000000000000000000000000000000000000000000000000000000000000dce600000000000000", @ANYRES32=0x0, @ANYBLOB="200100000000000000000000000000020000000032000000fe8000000000000000000000000000bb00"/168], 0x1dc}}, 0x0) r2 = syz_io_uring_setup(0x24fa, &(0x7f0000000080)={0x0, 0x0, 0x10100}, &(0x7f0000000240)=0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) write$UHID_CREATE2(r4, &(0x7f00000001c0)=ANY=[@ANYBLOB='2'], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r4, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000000)=@IORING_OP_READ_FIXED={0x4, 0x0, 0x4000, @fd_index=0x4, 0x0, 0x0, 0x0, 0x5}) io_uring_enter(r2, 0x2d3e, 0x0, 0x0, 0x0, 0x0) io_uring_register$IORING_REGISTER_SYNC_CANCEL(r2, 0x18, &(0x7f0000000200)={0x6, r4, 0x2, {0x400000, 0x7}, 0x10}, 0x1) 1m7.83286883s ago: executing program 1 (id=1770): r0 = syz_usb_connect(0x3, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000014da2108ab12a390eb1e000000010902240001b30000040904410017ff5d810009050f1f0104000081090583"], 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x8, &(0x7f0000000980)=ANY=[@ANYBLOB="bcea"]) r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0x40, 0x0) ioctl$EVIOCRMFF(r1, 0x40044581, 0x0) 1m7.022318265s ago: executing program 2 (id=1772): openat$kvm(0x0, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x1000008, 0x4000000000008b}, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22, 0x0, @private2, 0x108}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000200)=ANY=[@ANYBLOB="b700000081000000bfa30000000000000703000000feffff720a00fef8ffffff71a400fe0000000071101000000000001d300200000000004704000001ed030407030000060000001d440000000000006b0a20fe0000000072030000000a0000e500f9ff000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fe51bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616276fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a26048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00e10000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f6f096753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c2571f983e9673560000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d490cba8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e16e1461173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdec86f9b1eb93d491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b583cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd84990453f806694d461b76a58d88cf0f520310a1e80dc18cde9ad662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a090f3b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abae1cf01ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028ad0c74e2a9478fa3be18a1a2b65079cc1c00000000000000f59dd19e8d525206c0a728cfd42193abe8130bc01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ed1012fd7a8139166fd5e59c84f4ab279b1b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336d205c5913ef67cf0216e2d81e6127bd9d7fab28800eaab2355992f8ce4cd38add4b272c0bee4076ca4847ffa691cf78fb7ec212bad3bef29f577ea7159b7f3025b3d977ff7c91024cf71126233cb8791c3c"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x0, 0x60}, 0x0, 0x10, &(0x7f0000000000), 0xfffffffffffffd00}, 0x48) 1m6.269808999s ago: executing program 2 (id=1775): socket$inet_tcp(0x2, 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020204d2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000006592bba829"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x32, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0x44, 0x30, 0x1, 0x0, 0x0, {}, [{0x30, 0x1, [@m_ct={0x2c, 0x2, 0x0, 0x0, {{0x7}, {0x4}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$FBIOPUT_VSCREENINFO(0xffffffffffffffff, 0x4601, &(0x7f0000000380)={0x3c0, 0x300, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, {}, {0x3}, {0x0, 0x10000}, {}, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3, 0x8, 0x3, 0x1ff, 0x3d, 0x5, 0x3, 0x53, 0x202, 0x1, 0xc}) add_key$user(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x0}, &(0x7f00000000c0)="ff", 0x1, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r3 = socket(0x10, 0x3, 0x6) bpf$PROG_LOAD(0x5, 0x0, 0xffffffffffffffb9) r4 = socket(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r3, 0x8933, &(0x7f0000000040)={'team0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x2, [], 0x0, [0x4, 0x2, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c4, 0x0, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}]}, 0x88}}, 0x20000000) 1m6.16253736s ago: executing program 0 (id=1776): sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) syz_open_dev$sndctrl(0x0, 0x0, 0x801) futex(&(0x7f000000cffc)=0x1, 0x6, 0x0, 0x0, 0x0, 0x0) r0 = socket(0xa, 0x1, 0x0) setsockopt$inet6_group_source_req(r0, 0x29, 0x2b, &(0x7f0000000180)={0x0, {{0xa, 0x4e22, 0x6ef, @mcast1, 0x7ffffffd}}, {{0xa, 0x4e24, 0x21, @dev={0xfe, 0x80, '\x00', 0x41}, 0xfffffe01}}}, 0x108) r1 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000b00), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000b40)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_STATION(r1, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)={0x30, r2, 0x1, 0x70bd25, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_STA_FLAGS={0x8, 0x11, 0x0, 0x1, [@NL80211_STA_FLAG_WME={0x4}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x8010}, 0x488d4) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000080)=0x3) syz_emit_vhci(&(0x7f0000000280)=@HCI_EVENT_PKT={0x4, @HCI_EV_VENDOR={{0xff, 0x1}, "02"}}, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x0, 0x0, 0x0}, 0x94) r5 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x1a01, 0x0) ioctl$TIOCSIG(r4, 0x40045436, 0x29) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000540)=@newtaction={0x64, 0x30, 0xffff, 0x3, 0x0, {0x0, 0x0, 0x1300}, [{0x50, 0x1, [@m_csum={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_CSUM_PARMS={0x1c, 0x1, {{0x0, 0x2, 0x6, 0xa, 0xb}, 0x9}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x2, 0x2}}}}]}]}, 0x64}, 0x1, 0x0, 0x0, 0x80}, 0x4040000) ioctl$EVIOCGPROP(r5, 0x40047438, &(0x7f0000000180)=""/246) writev(r5, &(0x7f0000000440)=[{&(0x7f0000000280)="c021", 0x1700}], 0x1) 1m5.69200709s ago: executing program 1 (id=1779): ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000000)={'gre0\x00', &(0x7f0000000380)={'sit0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, {{0x24, 0x4, 0x0, 0x0, 0x90, 0x0, 0x0, 0x0, 0x0, 0x0, @loopback, @rand_addr, {[@timestamp={0x44, 0x1c, 0xff, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @timestamp_prespec={0x44, 0x34, 0x0, 0x3, 0x0, [{@multicast2}, {@empty}, {@broadcast, 0x10001}, {@empty}, {@multicast1}, {@private}]}, @rr={0x7, 0x23, 0xfe, [@remote, @initdev={0xac, 0x1e, 0x0, 0x0}, @empty, @multicast1, @remote, @dev, @initdev={0xac, 0x1e, 0x1, 0x0}, @rand_addr=0x64010100]}, @noop, @lsrr={0x83, 0x3}, @generic={0x0, 0x2}]}}}}}) r0 = syz_clone(0x2000000, 0x0, 0x60, 0x0, 0x0, 0x0) ptrace(0x10, r0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000240), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x280000b, 0x28011, r1, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000100)=ANY=[@ANYBLOB="dc01c6ba1cdcc12519250000000000007f007101001300"/47, @ANYRES32=0x0, @ANYBLOB="200100000000000000000000000000020000000032000000fe8000000000000000000000000000bb00"/168], 0x1dc}}, 0x0) r2 = syz_io_uring_setup(0x24fa, &(0x7f0000000080)={0x0, 0x0, 0x10100}, &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) write$UHID_CREATE2(r5, &(0x7f00000001c0)=ANY=[@ANYBLOB='2'], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r5, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000000)=@IORING_OP_READ_FIXED={0x4, 0x0, 0x4000, @fd_index=0x4, 0x0, 0x0, 0x0, 0x5}) io_uring_enter(r2, 0x2d3e, 0x0, 0x0, 0x0, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) 1m5.148781794s ago: executing program 0 (id=1782): ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000000)={'gre0\x00', &(0x7f0000000380)={'sit0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, {{0x24, 0x4, 0x0, 0x0, 0x90, 0x0, 0x0, 0x0, 0x0, 0x0, @loopback, @rand_addr, {[@timestamp={0x44, 0x1c, 0xff, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @timestamp_prespec={0x44, 0x34, 0x0, 0x3, 0x0, [{@multicast2}, {@empty}, {@broadcast, 0x10001}, {@empty}, {@multicast1}, {@private}]}, @rr={0x7, 0x23, 0xfe, [@remote, @initdev={0xac, 0x1e, 0x0, 0x0}, @empty, @multicast1, @remote, @dev, @initdev={0xac, 0x1e, 0x1, 0x0}, @rand_addr=0x64010100]}, @noop, @lsrr={0x83, 0x3}, @generic={0x0, 0x2}]}}}}}) r0 = syz_clone(0x2000000, 0x0, 0x60, 0x0, 0x0, 0x0) ptrace(0x10, r0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000240), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x280000b, 0x28011, r1, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000100)=ANY=[@ANYBLOB="dc01c6ba1cdcc12519250000000000007f007101001300000000000000000000000000000000000000000000000000000000000000dce600000000000000", @ANYRES32=0x0, @ANYBLOB="200100000000000000000000000000020000000032000000fe8000000000000000000000000000bb00"/168], 0x1dc}}, 0x0) r2 = syz_io_uring_setup(0x24fa, &(0x7f0000000080)={0x0, 0x0, 0x10100}, &(0x7f0000000240)=0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) write$UHID_CREATE2(r4, &(0x7f00000001c0)=ANY=[@ANYBLOB='2'], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r4, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f0000000000)=@IORING_OP_READ_FIXED={0x4, 0x0, 0x4000, @fd_index=0x4, 0x0, 0x0, 0x0, 0x5}) io_uring_enter(r2, 0x2d3e, 0x0, 0x0, 0x0, 0x0) io_uring_register$IORING_REGISTER_SYNC_CANCEL(r2, 0x18, &(0x7f0000000200)={0x6, r4, 0x2, {0x400000, 0x7}, 0x10}, 0x1) 1m4.859061874s ago: executing program 0 (id=1784): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, 0x0, 0x0, 0x2, 0x0) mount(0x0, &(0x7f0000000000)='./file0/file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x100000, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000f00000a64000000060a0b1600000000000000000200000838000480340001800b0001006e756d67656e0000240002800800034000000000080001400000000308000340000000000800024000000050090001007379"], 0x8c}, 0x1, 0x0, 0x0, 0x850}, 0x4040080) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) connect$bt_sco(r3, &(0x7f00000000c0)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x12}}, 0x8) (fail_nth: 1) 1m4.644555486s ago: executing program 1 (id=1786): openat$vcs(0xffffffffffffff9c, &(0x7f00000001c0), 0x500, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000005c0)={0x11, 0x5, &(0x7f0000000440)=ANY=[@ANYBLOB="fcffffff0000000000000000ff010000850000000e000000850000005000000095318ed036cc6d45c0f1ee32de39345321c386f39838902ace84298d66568ce134e5cb3083d19cf2c6e88af517ff49726135e40e4b8f5eee6f7142c0e9cd70dff536c89dca81ad9ae21125a6acff6944ed07cde5d787a7d37f915deadee6947d565bfb1ad5a43f094d3cc8198550a61c93ab13f0bf77c6a9c72bba2913f5b4e0"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000340)={&(0x7f0000000040)='kmem_cache_free\x00', r0}, 0x18) r1 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./bus\x00', 0x289c2, 0x1) fcntl$setlease(r1, 0x400, 0x1) socket$igmp6(0xa, 0x3, 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) request_key(&(0x7f0000000040)='asymmetric\x00', &(0x7f0000001ffb)={'syz', 0x1, 0xc}, &(0x7f0000001fee)='R\x10suse\x00\x00\x00\x00\x00\x00\x00dn\x00\x00\x00', 0x0) r5 = socket$inet6(0xa, 0x802, 0x0) setsockopt$inet6_buf(r5, 0x29, 0x39, &(0x7f0000000040)="ff02040000ffffffffffffffff1f2be82db1af0000000000", 0x18) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback, 0x3}, 0x31) sendmmsg$inet6(r5, &(0x7f0000002940), 0x40000000000017d, 0x811) r6 = openat$fb0(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) socket$l2tp6(0xa, 0x2, 0x73) ioctl$FBIOPUT_VSCREENINFO(r6, 0x4601, &(0x7f0000000380)={0x3c0, 0x78, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, {}, {}, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x1, 0x4, 0x8, 0x3, 0x1ff, 0x3d, 0x5, 0x3, 0x53, 0x202, 0x1, 0xc}) add_key$user(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x0}, &(0x7f00000000c0)="ff", 0x1, 0xffffffffffffffff) setsockopt(0xffffffffffffffff, 0x7, 0x81, &(0x7f0000000280)="1a000000", 0x4) sendto$inet6(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x40d4, &(0x7f0000000140)={0xa, 0x4e23, 0x4, @loopback, 0xffffffff}, 0x1c) setxattr$security_evm(&(0x7f0000000180)='./file0\x00', 0x0, 0x0, 0x0, 0x4) 1m3.031513696s ago: executing program 3 (id=1790): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) r2 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r2, 0x84, 0x12, &(0x7f0000000200), &(0x7f0000000280)=0x4) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) openat$sndseq(0xffffffffffffff9c, 0x0, 0x60240) r3 = creat(0x0, 0x4b) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) ioctl$sock_inet_SIOCGIFDSTADDR(r3, 0x8917, &(0x7f00000002c0)={'xfrm0\x00', {0x2, 0x0, @multicast1}}) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, 0x0) write$FUSE_NOTIFY_DELETE(r4, &(0x7f00000003c0)=ANY=[@ANYBLOB="72b88b870600000000000000e5c9de3301000000200000010000000200200000089d16e344546b544dbb47dab81e6caf342b9c6b7bd86cd4ba0196a7d5b9a828000000000000000000000000000000ff"], 0x2a) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="0e00000004000000040000000800000000000000", @ANYRES32, @ANYBLOB="004000000000010000000000007382c465716100578314e9d0f92846f95f62092f52d612c7b51e1e71b0a246a79c0e85a74cf8bfd409b8ae5596f7ac9231b31e011cc96a2f0e9f606c39e337b84c2e86e4309cb5ba7d2b6a29e8", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xd, &(0x7f0000000200)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000700000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bca2000000000000a6020000f8ffffffb703000008000000b704000000000400850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r6, 0x5, 0x3100, 0x3100, &(0x7f0000000000), 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000}, 0x50) bpf$TOKEN_CREATE(0x24, 0x0, 0x0) r7 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r7, 0x40045532, &(0x7f0000000040)=0x7) r8 = openat$audio(0xffffffffffffff9c, &(0x7f0000000140), 0x40000000040301, 0x0) r9 = syz_open_dev$sndpcmp(&(0x7f00000001c0), 0x0, 0xa2c65) write$RDMA_USER_CM_CMD_CREATE_ID(r8, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x1, 0x0, 0x106}}, 0x20) ioctl$SNDRV_PCM_IOCTL_REWIND(r9, 0x40044146, &(0x7f00000000c0)=0x7) mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='numa_maps\x00') r10 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000000), 0x402, 0x0) setsockopt$bt_BT_VOICE(r3, 0x112, 0xb, &(0x7f0000000380)=0x63, 0x2) write$binfmt_aout(r10, 0x0, 0x0) 1m2.425398075s ago: executing program 2 (id=1791): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000d00), 0xffffffffffffffff) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r2, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) fstat(r2, 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=ANY=[]) stat(&(0x7f0000004640)='./file0\x00', &(0x7f0000004680)) ioctl$IOCTL_VMCI_CTX_GET_CPT_STATE(0xffffffffffffffff, 0x7b1, 0x0) r3 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) read$FUSE(r3, 0x0, 0x0) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000000140)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0xe3}]}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000100)='bbr', 0x3) sendmmsg$inet(r2, &(0x7f0000000e80)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000000)="146f44", 0x3}], 0x1}}, {{0x0, 0x0, &(0x7f0000000c00)=[{&(0x7f0000000780)="040e8f45fffff50e4c7910c171b127963769ef24d84f082556fd1b43f878a65dcc23ad409d4ef51c3fa8622a5a36900c6a5ab314bb2a406d10a6a499793d7a2e03661510116d87dc79356005e01c7474b76cacaf8136be8cda811a39567f643c0612dc5d7cf19330c281bb05c1f040dd51aea0dc4d2afa3e4aaa6c3abce4cfaeb2ba130000000000000000", 0x8b}, {&(0x7f0000000b80)="6f0070751b7d82b11bf815a5a39052adc265313a00e70250de1cf2af793b6fa1f5c5d603cf3fc8a89b0bebd59dc535fe23b45ea92cc77c6bd1b9e06eeb847e70cf231771050820bdc0521f72ba507ad7241fe7e91a1575c01cb37892c93cf0ea46dfb147f330534806ab5374870e0762ef26", 0x72}, {&(0x7f0000000500)="38ebeb016e356fee4cda85d0cd971519cbb747f2f5dc8aa685667417945724349c2e53956a81cc01b96257be6cf756ee9a1dbdb4805aba", 0x37}, {&(0x7f00000012c0)="ab07cb5269eaac6a6d8297a151f6ff8a153e45bf2a870dfe905021cdda98e2d6477ec965f23931447052dc921b69a55a12335828601119c981897e5f9d23246304c348b44d28b95fe7fb2e3464e8cbca139ef88350e5009432e741b1e76efaf855d18b7583abc382ae1007611eb41150ce1a7244f400691426252a7da7033ed275dbfa75153d247ab17aed244023c89edc8dae89d2748d2a59a87e7062d3d17c7c5fe0cbf61e709d5d62181d7c8bd12d21ff6f437150ef26fc26bbab9c00f788e1", 0xc1}, {&(0x7f0000000a80)="7827d3e65741740426d89147d59fd333d253aded53fa8a969a0f05177236c017d4a616e2c81a", 0x26}], 0x5}}, {{0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000d80)="c8c9bb0395733c925946bc562a54294b423cabffedb1436e2eeafec0dd5c365ee1453384a53151ac4520d0219b79105da2854cf859b2c67258d1b6e49b896188564a215ed2d8e36b81b1752c752f2ac52c559f562459a8b2f1f3da79b25b40062732bca7bf5b651c411cec17ef07fab31d5762eaaea7eaf30a5f52423d6c923b2125809279561c8000dad1c6fd86f3a4439a72d085fee666a9e251a92bde44605d4bca2dcc5a9ed5b751ee3c30646752fbbc797f2b4d593ec4ca4f898eb6c60c3fac", 0xc2}], 0x1}}, {{&(0x7f00000000c0)={0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f0000000180)=[{&(0x7f00000002c0)="f9fa9f46c18a7c3fd84dce2caa7eac0d80210d015e0b07fb38b8da833e19b1f561447d751ad93ebcadd6ccb2d18692c3acfb3e5659fee30d915909a62d34c16eab35e16aaa3624317cb158ceb1e8dde674d08145c7ff4a9d62778014a7b1be90f4b4111f48ad6db13a7b82cae450f8a5118696f722f7cefaa58b92285ebbcd642ecb772f182d187ae474ac1c69b005b420cabbd2de2dc8b2b7bd3047c6c669eebbc42ad0892f8cd7", 0xa8}, {&(0x7f0000000540)}], 0x2}}, {{&(0x7f00000001c0)={0x2, 0x4e20, @loopback}, 0x10, &(0x7f0000000600)=[{&(0x7f0000000240)="c6244ada3d891d1aef4576b7e9fe55ee4540b0977a86cf6f92d5", 0x1a}, {&(0x7f0000000440)="e9794e997fecb13f1bad061b28c6f79e6b98ce49ae06fd171167155b6501d90d6e0e5d07e25af7f7be8ac10bc94af61d3f102abf40dd142a5eea9830bce0067849e79c5dc3f4fa3849dccfbdc50f5464518ee1ffe7b5ad2a5603334150e7a627ab26acfdbea504d1a1a55099248ef7d6c43024989e23c961382e", 0x7a}], 0x2}}, {{&(0x7f0000000680)={0x2, 0x4e21, @remote}, 0x10, &(0x7f0000000840)=[{&(0x7f00000006c0)="609ee12104653ef41adda6f0bac6631ce9b81de8eb79ae4e58e9d9b65c303413bdfab9118785daf93b15cdd319956f0e8c0d5aa4483451b50147e5fb", 0x3c}, {&(0x7f0000000700)="9da3b4dd712f72564c061776551980c5", 0x10}, {&(0x7f00000013c0)="00db3cf18c0c68018480ac7f553bf299c264ad70cbb0dca56f9765430fed104ee8af5d1e3a04c4597495ec1a814d8720dad709fa16f7637e84d2b9f1bdac0d972f02d82c6cdd7e9c65801ec83ebbee2c55296fb228c8d8ea5fa42d31aa3f36c7cdcf6c31bf95dda049a0d3965a87875d57040d33ee2e0264e9a9cd57399434694475ac0ba7b739d8e12324b3de1b2fda0efc588a75626607f737bb919de6fbf46badacf906bb3393d8bc0e67ebd51d1be72701892ebfbd49b92516759b1f599519aec6f7b42175dbbfabfb25b370ca57ddc79fc61f9e8fec16c79d5e86cf2a462cc30394bc3138e1f2200f4321786ac0efce3e767f298f6bd156070835a0c250a2fe2d2c329e725bac5b6674aa8d05b847e8d33e5a28994a8d7c8c4de5a25a9eb690c922141e6a0bd24b2ee1d694a6916d7ac0f070add6ef0659ed11a130df671cedbdc654cd82e3daec30f5201700e2952b9df2f3912759daef9d39b78431a515547f5ef768797064e6739dc47f131641b749bbcb3f828ee0644edab1834e7efcc29ddb7c9d34007bfb11e3b29e960d76b3830a12891131d09faee6bfa76625f84e0c8249b6407b31552254c159c7016db5944857caaf2ecc2298dd25b0e4728039b6e38915746b74102849b6ec0600bcc4d572f572c779ac60504cbed8fec12da1f7c45fbdc2594e4ff6727fac719d634828d7cf76cb201bd5feb08f1528b5d6da5ac6fcb865ef0ab2780b6e7494dc2d49efe8f295ba5b13c94451ed59db5ea2219e2f6f8e3c5744478e13d3bf9b96b48463e2b8842cf7182def76152749a7d85276be3e864a7aa3e4ca1c84f87de67e9342d6461a55c5587a7402cb4e4001bdd21c2afe5c92abd9866ef374aa1df30ac3c54a0ed40de807c929838ad4cefcc69fd584bf8f98f624cc7fd02739a4295605bcb3d2e01bb9d235ecce90bf36c6104edff0e7912677b1ee67eca2add4bc4e6700344a22a09f1f5f87cd94f82194d1dae753de346bf9ce9fb9f265ac0e3c768d6da5118c7a5e15426761deeb554b7569cf7c2a2f4ba89dd1142f68eeb20dbd852b6d27c6c5b99009e094597ba1dc4a0f412e920209a3dc293dea85ad3110ddd8648986b9011f142027132bc809ae8bf441a30a67717a060feef7c1b7b0b82542e7bdcefe7b531ee2a514e3fd05c759b7182014f0651f17287111ef80e7387617c9f6e7cef21bd1aaec00bd464820e4acbf7575b9760121beee1e8fd00787ea9110775398a6202866d45395cf49d483d3e5d96878e0e03435aa001731663b76868f4631967e9f4f11de200006a0c016", 0x3a1}, {&(0x7f0000000740)}], 0x4}}], 0x6, 0x40) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_LINK_GET(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000700)=ANY=[@ANYBLOB='|\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="030700000000000000000800000068000480040007801300010062726f6164636173742d6c696e6b00001900078008000300000000000800020000000000080003000000000008"], 0x7c}}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, 0x0, 0x24008000) r6 = accept$alg(0xffffffffffffffff, 0x0, 0x0) sendmmsg$alg(r6, &(0x7f0000003f00)=[{0x0, 0x0, &(0x7f0000000a40)=[{0x0}, {&(0x7f0000000100)="32d1c362be9b7b06297bcb485c32fdd42c9a77f87e68bbff3f1a765d0c67f16ad5580c", 0x23}, {&(0x7f00000004c0)="65064750605d8d8a2f9f4740e64460061fa09875bfe96b529a79fe107fa59d2c538733a5080851c7fe5110e6bdf662b320ad11b08e0df675f97aefd64731a3a91b30005637165181051470bea657203998d358d322bf5e1d8efff183855930001a4623904d616766e6782059afaa769860a4afb57662af5d1cdd953f", 0x7c}, {&(0x7f00000005c0)}, {&(0x7f0000000780)="f9ba48aebf1793fadd1ced8adda5511964cdd663225f102975de3335d3522d2f9ff80ac9effe7353746c62bd2d00e5d509e8adff39336545df126a05e78fd4a5fe084b56819a1c5edee8b8965e55ff1a0fd7efeb79cd9260d3c620692bdeae86d0131d581c0a6051ef82cc63bc0d2236a1908ae36b7c1693f4dfc16376faaa5c854df82950f07931", 0x88}, {&(0x7f0000000200)="a08a359a18a68146baeaf23a3cbaeb2b08051cdb7d57ff9f68", 0x19}, {&(0x7f0000000840)="365ef0f25792974eaab3050390de449299f806da5654ff021369379e49d4c524b1cb7d405c84415fc523d44ac09500c5ee1db7213dbcfbe7823420c3b92b22ebb5d178514f3271a0fc1cc0a92bc9cbf93713846b522a3380386d641f1ce8e51d7409fb168ae1d0554b2e7c2cfdc8cc4711d6ac2a95b1c317d748b5fcc6890781851723e6fc75beaca2fa13d58a8b25ca65f63fd6e92f", 0x96}, {&(0x7f0000000940)="052da4229af3114596c3251b437e1f24eb45bb7537b90134dba49361f77e09ec411f912abbac5f22d2fda28a554296d87c6501d9d5ed5317b2a47b37833e757c4ae766b0eecffc993134316c07e0616ad607aef3d0b75a1c625fa3a41d5fa2bd2f81f904d2ccd306012ea63d8b5381ae1ff5baec775113071ca5a27a697ccf02c45e71e3dc3e7bd583b5f7d41c5438ae4dddd7a4cc9d5e492b58a4af90c161bebef56a527ef70a495057936eddd814e9fdbc", 0xb2}], 0x8, &(0x7f0000000d40)=[@iv={0xf18, 0x117, 0x2, 0xf00, "7356d512f83fb4c1904efff76555825f28b717abc0f42b17760f5f7403c4c40af04d67cc23257820bb16cc6b3ac3346806f6865542c2baad899a9518b93152a1a5651a86c3f6339439a9b37480dd8329bd545293d567f2c601de51c9fced4254a3a871ec4e4183c486c4971b7fd85a4e00a2ac9be67f727235f5cceca78c64405632d5c7680ae8f428323c3f1022c27ef7c07c6f6ae1f93a193b2e6d2d154d457fcf5a3b3e2b226a3dc5a439a08057a7c3faf9ff0792bb8f034a754ba6d499f23400ad5faa92bdca00af961ab952c892956cfa402c0c50196f5043289b41a6ad1f96c68f6b2c4c244ba25da43aef8e362a7e93ef6404effa6d42343cd614ff4db6f088089767b623ab67ac16cc4f3aab89bb0bd2d982463646a872e5f3da132e0223cbed354b1af67d6c4f355e32c93e17375e21cb64030542e30afd20fafc468957e6b01a4a59dc7cd2ad2e071a8a44a9e1fa36db745d0cb5fdd835a4b2d79b485e4b57c079898cb91224e88c210886d3c2cd5c3109b6ba7e87f972c0133a51cc0a8eedba78a92d1f95189fea4917b983ec0a512d6ae3bee27c49eee48b5945bc6c3dc756d191e70916d460a25f825426e03a3042ec1ff22297e106984324750665b7288100968d5bd650777a4c122546b5afcc55647e341b14b7b3bf5ccc310f646fbe9f9eef2d58eb26c6de9316c3015744146d43d119c2a9eb88fcdf9f1ef78c3c51e4ce576ef2788c84946983dc26cada86c59c794802a4e342e377617385062fedff073cc5001df4811a00fd8d34e8642f6e605fa9ceb655148f1324da6de77f7b2ba75e3c3d672f3d2c1865bf5266f1859af5e5ebdc670a4aa59bccfe9a7ef4f2769035ed5ab4f43d8a2612005360090b4ceb91ff9b198727ac502cf9d33b8ff182a92a71d04af33336f47b4147535fd1b0742533c8b4add2d03cebbd1e9d73cd4861fe1c6795f0c9cc67b5179a0f00122f489792c65adfd14ee5b325fd98cc8871c6b1a5b7b9b361dff2922417b3009ea8f472cc8328c3f804de8d68571b7d18d73d59a7665853c7d581dac4f28bd4da9f98d80968865853db2cd995925b9283408fae0ede67e38b0954866218f18b44e3a05e5ab868c432592e5cb7ddd32a8518826679f899be9c95ab09f6df7f475cf95020ac15434690c3c1ad1d23fb78cf5cbb85aa4b2b5a90041e4a4e5901d6e3801ba2cb7f72a405522b661bb0db6e89ed50199153897ed799df4756b9a651cd75bcc67c95cc9ae8179e5514241e4d3f5766e20e6cea4ee559768f4431325d5b5585ae6c55db47142e323b05992e04791b0951a10575e3b4ec5b81949e19d44e42a56db31a40cb947ba303fd75e566c08cb8d451a5ea436cf3576b87e8caf5fe9228802f2db12c74751a445e2ea6a1bb16522292619cc7ad421b981055626dab82bafb3b24af4738532fc7973030532aab3080e2203ce7fbb25e800076cd8bd56f5f82d0a6c06e7ccf2dc98dc7d0190d447a2dba3109df3e7e6b53a26d8ca07fe997b7828daf4c7ef862dc195b4f3ee6fae97d79973b0a2523d985af756810e6132dd4475437b4566fa33d42da9652bbb2d78994440bf6386fd5088ce68a61332566981b3536cb614efb53cd5de99351d4b182c79a8a4eb4e8152c8afd884ebc9fb60fb0c4c2ffdef97d51fd2bb1ad8803b3c1ecd48419742d93f28d6c8bb49e6f01f52e0910c08950b9591c13930b4ade7892c7670e7d55bb8ea3575d7ff1b2ac1db8706a2c12efbc1f503fc278bb77a7bd9a517920e56268f15b8cb28e78512f3b85ea470f6e98ea2dd8b7adc830b50c80d763d11479139f084662a63043827243c3463dff0e35e066837e984355fd9b21053a8a5a224d6f6152e141c76ec101b746b1e2f401e41c0bd4abbeeba477bd423f1edae1772100d326cfa52f29dd7ed3f2e600f08ee651fd6f170a08eb5075c23cb3ae37c3bdabf605553366da365b103242fc083e5066cb8de56010107ab68bdf90b4f4d3600c58f2324ca4458da1f55e970be11a117696334f867558aa7824615bdc1f5204fd44ccaafe02942ea4a57f405f78896b9f93aea268da14a1ef889248b787e75a69981013c364608106a5f4289402f695f411a2c876abbe49198e2c255bb9126b664c6482721fd311fc562aef2cc1351395a3f7f5bab608945b81dd8b602bc35bf36bc277d08217725a7934f1a39ca9f4b7a306bc470cf1cf3b47946831806c018c4ced6c498e41e8261c5032ecb7ce9768b3c08087e28385132349a84daaa143ffb41c2a0e2b962732b87e63ce2119ca51c76a5700f85ad40efeb61222e7eb4144d2fde6e596de5baff892e3741cb492eb7484cd264c741eb089ca634bdc46bcbcba6dfb720190f9126e0d6d400173cbc3e9714e828b8a40771f6ef6d316063eebfb46a9b7965b6bd84d6cb6929175c1a73a86a74050bd46052e3ac44c56b1f841a720942cca0d390788a4c87e83e93655bc656efc57b53533896d8fb2e2b7dfaa209ba050c4685d00293ff1e75b980ce9b7498f3320a8d6c5bd43fe73463562a6873163806f54779550afe79b20b414154d88d60adcccf5ebed409bff21f265835bfa633b39bf9dedf4b8ff9543702921dd8cafe40405e9a5c06dca53d11a3788c33f720fff34b3c0980e91b7bc428b71d86bcaf23ee0a2a7091c4f784735b9d3982a1088437bcc17d145f312311ccca7c85096293a94797cb4331d3e966a23f43d55c595950e76d5f63aad574dc063c890652be616794d3c518ce84eb723739fe9b8167eab68091469056ee762fc583b5b1351b1a2e7d12e14001bee554f21b8ad8fb90e1a861857387036cc8aa617c4cf8d81a53c44c4c4e71959bc52e4f58e48efb11242e5572a91207870cdf42d76de702215a86ee08261841b10395f9550b5614792c84e4c7c45fea276fdb1d5f655299a3d941044002799676f827a1dac26614c3a6b5dd39be015d49ef5b6e6762623700ff982d82c191913b8a8afd6758560fecfb816013fcfb09a8c88e5b0db7fb8fa2817938f349e236ebc7a1836f733503b4c0ab13b1bdbfbc0eb223cec5cd954721d7913b613ac3a77747e32a819943499246a23bb95cde71fd50c2dd2d7b4bedda7181a219a1f9e8857f991c018e5bb74577c3eab06bab55a0a6782743b0940b90fd8807708ca7c2855d3a3402a3841f8e88ffe97c9c0f87437a2e83a963c7ab605823936a2229bbc13134762d132caff8335365632d254595b301da7de0096713d9d825c769988f48e770be029bc8728b97014462def1716ad86fb07cfd65da2984f0f547bb6094af828f6f37d17ea56644bcd17cca5ef18ea58b8d0d911945da3f0a0905c086fc7b755d5610712c67334775783016b0b016f50b4988dbe15941e788fdcbf83ce24e0c2eb8b380ce238697d8e29e0e486bf8e708f2d8480095a1819009c285c77fae1dd87bf47563d90abdc1700aacbabcfbbe5a85485a544199e2953c97b03983af0ef44b6961727cddddbcbdbbaa8b056449a84029983afaeb2381fe5b522092ea13f20550c6519c8fc8aa498494dbe8f59729f4b097bcf6a337c097a4cfdde360ba2c6dd78eb010f4b14f90f2ddccff30ad47610f3375eb115fc8273a8bebba2117ea3bd909717141da6a796c67b076f568bcf473b3d0d39cba041425b2e0a066cfca7b4b55f906bbd1e68668cecedd5d49f3fbac20a989093a80f92fee5ffac6ace4e4718c8c3a79f8848ca227d81e095ab834b407734db1ca358dae586871c3bcee6054eef06a75c6cc40b21be2645219297e1e162a620cd7ac18f50794bf641088d3b54e5cc44c575ec9b7c3d3115f098c3fde56bc64d8a2eb5431ac4df64776abb1dd9e5a314d2b52b93982c9e24c2d5a01f364f124fe5716bff7ade166dd15dd07c36e9bffbb864733ac1b0e2f550dd2c7d2f61d736411041b84483c5330e8c1bb8e03e15f3d557379f47331cb34339749d9237c9a9286635932ecc6426ec9b958ef5aeabb52e54a8882e5d19c50a93f2dfc6d05026ed9d1daf6142a35d42faccf97f7d36f6c9c9370b0353a342a855373df12f1596eef6550a8828a800e91c0211ed8d091bc5caff4265523e5adc88762c48ae39004522e4be64aa711057a08bac07c79fed4c30ea86c9fd9c34a237d6b5dcac919ef76bc140c22a081f6d178515f8ccb90b6b9a918d344091364efad8674de8436f35650649a4ec05e86bc5f9ca0fabdefbc4e1b1b7ae25c64eb52c0349dcef7ac18c6191eb1767507fe7ae61d82b19877ccc739a4be4009da5dd608b54fc4043d714b8009b9739abc4d2d79d74d36cf183135910eb84f0538018b6e0a15d2457b31d2920b3a3e06d0ca387ef0bb4b905a685f341f03cdf22a9c1709e2e12a45c5eed4d3a5dab378cba042be9ff45e0994db1923667fd20d2fdd0e145d5754fe86a72d3438309e28aaee46e32b029f23f61aae80683e7581bb3d5602cf5494b3e1f18483ea70120f550d8804506c35fc356a6ecb8ab3a6c1ac89c26e7c6ea15016a8d8e7345b4d40309304aeb8b146c174ebd60d24d2caf00ddbeacd2481f905c4db47b2d907333ecfb059c41f12f1090e3f87d3028c626cc9a94ee1139424487fb9e1dbc973d3542011d9b315238e397d62e516db2a93dac71117f8f433ad23955f68e03ebc42ff6deae6b9bdf39c884094d01547dd9c84f9c5c96d582df9ab97bb2c89c2bb06455cbebd3d4ba8601392a6948bdb8df410430e243a6255ac708ea18f0f3bbce524cf40691edd418d2a015c26187fb0e8e2ddc9830a818601d16db5df24a7beac253e189eb9a25138a42bdc1aa728bb62595cde7590bc5e7f39c67c7df7b34504c7f074e6aee21a4f4016c73c0d16c051ae5ffe3ca5f0bd71486b0f4c49b1aeddeca5cc368206744200bca33c59a77995716ab5f6888dcbb29020645136b5b75d5b0e9fac0bec0d529ac2117b3be92e3b18dc8837bc9899f6911d505dd3c95d33837233a1f9a1901e131d32c88a38594da69e439f3500dfeca828e42f0912fdcb25c19899794870ff4dea5ef881b372b566645d987d2e8c77d38ba6f534af869deb1ba625661e42ebe957e5d64804a5176b30bf7ef1db0a900c3c58bfa34d42030c1ecde441bd23fe243d55eb23bd7bc6bf82a5491e6e9145caab5cdc2fc1f35b952ffb435a47b8552a02a346edecf6b3e426b976a8cf84a6b3e5fe7e15e166b24323954d765c07eec9a215a08d0b71473f64078ec9901c60053efbaad1e7ca491d5ea2acdcaa5eb706137422a2b993ac0db9a3e083e95b62c8a7e9d7748a3592305fb199218b2cffa8aacee4b9753b39188854926b6070c1449c569555bbfb2d8026549c8828de963c0b8c1be887601ed00d34922e6842e024cbf619fce585a97e49a2f247f647a16183fef143dbddfdd901bc65cdfb4186b4192"}, @op={0x18, 0x117, 0x3, 0x1}, @iv={0x58, 0x117, 0x2, 0x3f, "dc841cb4ddc58c5945dfaffb40f8e0d5e7aca5186b0b2d650e74354f495758b365438c91845b89e5bd3f9f8f98ea78b1c4f736401f16cf19e2a82989906fe5"}], 0xf88, 0x20000081}, {0x0, 0x0, &(0x7f0000000240), 0x0, &(0x7f0000000b40)=[@op={0x18, 0x117, 0x3, 0x1}, @iv={0x30, 0x117, 0x2, 0x1a, "0baaeaae23441b1410b0928b28c9268af6afa19f61d4425e2a9e"}, @op={0x18, 0x117, 0x3, 0x1}], 0x60, 0x800}, {0x0, 0x0, &(0x7f00000022c0)=[{0x0}, {&(0x7f0000002080)}], 0x2, &(0x7f0000002300)=[@iv={0x50, 0x117, 0x2, 0x39, "e7053765c5d8894062f08a232d8a5de761531075ced6355bf23d4eefeea7b29c97af4d8408b312c8ba917fccd49ac2527149f9db26564e5f76"}, @iv={0x18}], 0x68, 0x2800c000}, {0x0, 0x0, &(0x7f0000002540)=[{&(0x7f0000002480)}], 0x1, &(0x7f0000002580)=[@op={0x18, 0x117, 0x3, 0x1}, @iv={0x18}], 0x30}, {0x0, 0x0, &(0x7f0000003740)=[{&(0x7f0000002680)="e45cc5982bddb2a00fe6303110185ab9e85723ce21ffd046eca3704ed34049cb4ae3d94c7b8a0f1740f9f116b91d4c3321e9cea4f2fb87fd", 0x38}, {0x0}, {&(0x7f0000002700)="60f0e8de665ca1b3884c25088932cb6f64b2bf88907bf7935d0b509aac3ed75ea27108fb0fa40cd4205d1d7889014fda1c4b422938e876eabf5bddfe79bf3c88e300e5bf2eaa941b28109e2c840d8a0f10f0ed8922643eed3fb1fdb21e0d9d86af054f2f78b49bd5ef4f029aa11bd7531f2aeade6d0cfb3c1e752a84d660a09e2423f27a290361a7e3cec0b521c15554e6ba1c6aca11cd9ed3b19f0030ded10a04ebcf31ba599daddb0b89a6b13df650e76ff3c09af33bf2b4d97daa4dcb23a0eae34c035fc59a1eee293a8efa14f612088ae57648efc8114b713190bc7218bbf600f7f47460923ef6ba025ecf108da6106f68f564e9006c7d77826e0b406497194a941a3e17b80d677160ed8febd2d1f902dbbbc11c3c8826a0f34938dc8c4aae30f76bf027f0a65a845c4881379bb629cae973568bc12c69dfcbcd1110c3a7f7b5899328a57f17280571d0036e30cea2a1eddb91052834093c13c4d7dc41128ac88b4739fae50214983e57c50c0c51767c0d4d0b1fcb0c5aa7ba4cb970aefd08e149ce3a2b797794ad02a0c756a4c49b8a9801c497e285fc6b7042330abf8e21525108bf4a7e3c6edf305136026c3f7a18ba550337df741e5ff3c21d13c1b1f89d3c216b147b0389b56da7831da50a1b04c3101ea6819163bcd6df6cfe0a2ff0c09cc765275746e7a7d775ae2a634debdd5948c84a30d527c23f81226cfac55508ec55fe5b18d56cc1db79e296d740aa43c58e483c65befffec8d2ba39091f09dd5ea153edfaef283686247a48f5e70496871a3a1127c0ed4627cd965577e58174adc3bfd215d044aad9bde4cb2d10da199e57381aa00614d4185c5bc14091be8a80533732b8b0812f459cf7a24ba6c44a511bc3308d430e6433ea959d6aafc37f781cf117f4eb697820434d084acb484a0b82b7b11638d272ab7c6004de87c58049c6ab59b20b959b98f450be1ad07e0edc736dfd37bdee6b924e5ed4881c45c947320a9f0ccec421f994def567e0dbe27ba92e67509978b33a430823bbca2e0d7eec147f4e655f2371f8a1c253f1e90c2a67d832c52bf787a8085480356739bb0e13a266f80be0b168f0bf18bde13549c887483a4eccaee96b28450536c123f7462554e35a53e8398cc2e7b14b12a9ee54a7911cff45605ac643969204ebe7fb8bfb7acc4f1e7aefa4f6dd24fc8855ea6a12acbf3e9347c618e5fd4863475a6e33dd6ff028077775c2a8472d9339939a45417074bbdf5175787d7883ecfad6bbb54143b3d7e7c76aacb5213153947aacf2cea7b2435dcb3545325411b04180d2de332836c83e3e4442afeb90d28028b25cdbccd48ebc47a85f6fd092d1a4990a56156d53004c562cc2575a6b25ff9952165252d5ab67767e6eb2058df26fc225b1b6d5a7dee5477b54019aace85755c60f4384f6054ad0cf66a503605174443b15eab1566f340a27d8de0ac0c0af80f311124b81da176bd474860480c9b57f716b349cc33ed7811c91ee45eb1051c5e70865cbd674bd10be19f9c1f2e03bd246b5b9cee962e7ec38d0756df9e0f0c940445346aaa277e0ba71c763d7e95190423f686ec595ab542340fa7bd4890d8a20fd7c1ad4af280640477de1514d9c17f23c992f6a63e416d799f2c66e6bf1915ed5ef536b73c42eee37430a9816d409286fb1a0bc838707a4f229fd82228a5a1f29164ec93ddd1357a09e712b21910aa806930d85840fec8d4556111c3895eeea261946fb960eb18a1658f4c51ae87e126e086946c115df97c2bcbb4f583bbacda76967ebe0b157f3f7b4057833add89f8dbb9d37019ae569c3b7631d31d08221ae82e7e9145e9f9c7637b393dd0579c7261bb158509f386469527b6b61a598fa1a999ced5db78bbc609a1101b53f5f44d41ce4193bd4e181b7babc14e3ca48fdae8eec9414596e944024f5a26119abd853e6ba3fb6832848ab30df20b91f9b59c988a3bc924495c04b8600b196ad05d145525f7528976292032f2e2d63f78a6b99cdb52eb0c43edc1a2f85cb5952ec1c5950bca289eeb3d3e5156707206bbf733a1c71df50cb4e208af07260c97df98efd990777d0b552d6ffe8cb0465b52c50ea7707c864d684640bbedafe170f51a32b6acc1de35d795e3f3789485a949570e015baada38c4a24ca16cd6b91d90d9801d09f302a1ef59aa2e245d7f85c60347a598f2bf4494345d8944934c1cadbd8371cd5e8356b8a62f4d1a2d9927657901a78f15dbfc71da6176edf6eda23ca4ab1ef417ad2a432dfbdfa47fa590a066e885812e9640ca34727ba1b0d8928055de75fe55cc81e8146734ae5b552e10dbdea9e68955621589ccfafb1a9d63890068d664ce193146127ae917111035c940d361128d43338567b8cc4210f69363e402568b618159cfc0f52882966bb23923170a0fb5f1969a8259a49ed5159b1aeffdca8e2068aa5ee8f1b05c5fb6e549df70a176db69fd7f59a53e13919a07ca768ea1ae16bad7aad1d57d12c45efa86d27937ed540e1114cb1a14ad0a01d64bc052281d23e35ab313c4ec899f0f6ecf937af4f99dc0d3d759638130e6769030566c887de143ae0d6899ceab182caafb401f27d186bf7e7f5a1bae997bdc21188c59883bfb2729f5fe062d2bd38a994f072b319db212c2a972a94c2737aa731aa932a259014844a7567fe8bd84cde0b49b4dfcf48faba68baf87d26ddc2bacba934d89cf7b9348f86c1ef4b1a124e6f33aba02953a9981ed0c1c1c093275063a1682a1b2b63a914ba0d3548d905d9b133eccf11fcca7284303d34472a8b8067fbe6172adfb2e342b253567a6aa671f40a78877f64744b20653a151bb75ba87325e3496a8c964e016af8c9810f9d112be84035a0489130ec57c84ddc9c8698dcc4c77750215e2f95e432c70951f10cdcd8f7229361220983ccbb2cc028636df07af6d0b6c66a915f13757f0418741d9554f0ddd05043eabf44e14777e8c8921b53e06bbe9afbc9704535d84431f152578269da5331633fbdc429f7303e4f11b72df1425349054021c43a0dd99a6cd7076524edb951845dc78f4dfb48bf9916b9e480d1b4b77e6544caaec920007039125cc3adcafab68152369e2fcfb9f53518bae59be2a4264ecafe8dbc08baec3256d129c13c048f6f4c5be1c85056622ddf0e1b4bb46ec4e9f4caa48719fd7d6c8d24e68580bf35d33bdf8103072340df01fb98ded360f888ac4714cb862cbbb83c815cf4713fbfcfa47cf6bdea9078d34f6c0da8ecb85e2e2cfbaa50764357a92a0d356773af3bc8d7ba7f7bb45baba2badbb49f059aecc8f712e7c1f2bb97b70ae7850e3e6c664187f96757b81db9f1c4fd3f0abf3bfebe98dd9cb373bdd870ff43e75f40ff7c0c1622e780a9e44e560e5da4ebac91660e70f912f19020343b0befdc41db305743b6b8fc4e1b41036fdc6e2dabccce8c6434512c37adca8a49cabad6fee920ae655be5859760ddc281c1d7f4476c7c6c56e0329870ed07638a268a6dfe7604d050e6f592502f83621ddceafc4f515189d9e5b45a6ca09c346e7693eeeb94ae282da3ec48cb65dbb84916c2fc827c39f3c55afccecc1e1972b012ad9cc1317df817596d08d45fae7c1e59a5ab771fd5e8d489b2b23e96ef6a29073b3b1fa5b62be25f6a2ff17b01c3bea511255f4625937d7a2b10f9e65bcc9fad3262330479e50c2d312802794d640bdded31ef9bd4ba68ab80c2e866562ee4d90532df52516bea16612a794ffa55b535c6ba37809f2e11f149e9f1d29af02a2e0680384ccf9aeada2c26d21af38d24b601bf920845c2b6572c3701668f5e98c4cc4cfdfc10b84ba91698a320755ca69dab269598e4e91fab90bec9c9522f1a032bb24878cfbb2a1a0929c9af3c191bb818cdc1487b44f21521026ceb9b5a698300d8b6a0d5af516933b0a22c3ab2ee52f765a2a213146df852b569cbd515caa5d96fc67c33ba45fbf82c9e86144f8b6af7487e6657cbc315e72a118e4be1d3f08366e87caf4535306b7b0295f91c49382387f08d6a9f1fad03f149eff96e51e28b96a51e7cf9ce5dfc2f181d263bce9b45103694fc02925341fdaf2f3405a18c39e2a22f5aa35fe4a13dad79df297e50e7ae1e98b18098e6c0b1a1bca7a480c36a2d2de7bb6706cc70c49e4d7d3caa06e2a585d2389791fcc1ee188eb1ab980c3c10fdff6e8749b0be83f01f1f81229603d60c39facf512845c90c60f8e65ce9840a679415f10041921167ad17a83e77a8165fd9dede2c242cfbbaeae378240a9459a8f19fbffbab126f1dadef0b36d8b1aca4842c3ae4a2956a5d6db7847da929f54ec351796f527dea16468d57d6a19a20db43e9899b78946919a6e99f7516d8f6be8236a7b2b8a8375994f069bdbdecd2b83905882ae98ad81b9fca6793dd260e1c9fb597430bf6ce5724a7428513df0e12df124153cb2cc94d318fd74d7b370741b38d135c005b155c5dab535f4638b10278172f2d1197e0d49de40930b98c0753d5c393df0215b22da27f664991e8c974527a39e232dd6aaaf9191de9dc6816a9ffb844c5c324c46866f2bd88863d2babd1b9d632c973a7ea464d045a28c8e2295da5e5e5b253be1906b6ae1b22a4bc8a06c326e2492a84e3019e42d744f7e0632e74c8b9594aff15ae78082f26c92762eeb3551627e213d6ad0c88cf0325aea9b53d78e4fa3a398bd3c95d2128cfbe8e33ad7024001147b36976a75b0254e399abff13a3a5a25d1856bf04578de3993e3ac728bdd3ba1423f4ef5aedbe96a2738ee956f15d992d045652b8ba8b42c9b12fb3228f95c15f9a2d3971e85e82a68b4699573c4cf8ca4f62801a4145c4b66d997f5029432a6da4a83e7f43e2ad212db1bd4c5f988c9a76cdb92e4154417c95bd75e241e3f45ea12711d049d5278ee8f04c4996de61f588d135e8b82eec9eaaa5024b9807c0d3f39d6c944ac269e05a067518bbd4072021ca70cc5542d6e77bdadd3ecba664f47ac1aa36718550d1a4466dc9f3530ec9d1603e4848baea7cb39bc606c57a48638dc75910146b36c726d075fd06d5abd332f62e2f1ed2d931e8a4848ea029c4479984b92547a6323653a324adb2b71179f5ca12b41f0419b3bc77892c37d0a05c47fccfe40eebe78c8bddf9c2d4cf43d8c212ff25339e6b3b279fc8cdf887c8f79abbdacf61e380918c02a922750d80d7a627841013837f5eea75cf34d0d0b611703901f630193b8238a4413109d17b83019411fc3c30b5665b333ae835ea70a83940354d0b67625d1b4b54b8ee37b24c83486a97e329e33a6dfa329f15c2a8af2717a98264ef362e5237b95e4bf41d1c319ff0ccdb82736b587235a22a53b5dbbd05d3a185e1492abd3e6ebd41e1599297fa28f4c7594fc5241e7f50fcd1beb9c3eb7d2825b0d0937c6ce08cc9ea3fb0ca8084e2975297e199dfa7a8c6797c961a80fb8957e7b5028f8d896a41f3e8dd4d5032d448eb63bd3c16ca07f7dd3bf47b930ce9f916e47ce23140428582cfb60bc005fe0bd812497a3f3310e9b6e21985ce9bcf29584d14f06417acc733c053ca6419fcf831a10fc43973ce23875433401ccfe01367661809e98873d9722ecf68303d588314", 0xf80}, {0x0}], 0x4, &(0x7f0000003780), 0x0, 0x48840}], 0x5, 0xc085) 1m2.34042558s ago: executing program 1 (id=1792): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x400448ca, 0x0) r1 = socket$isdn_base(0x22, 0x3, 0x0) bind$isdn_base(r1, &(0x7f0000000880)={0x22, 0xf8, 0x3, 0xb6, 0xb7}, 0x6) bind$bt_hci(r0, &(0x7f0000000280), 0x6) r2 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009210008000122010009058103"], 0x0) r3 = syz_usb_connect$hid(0x0, 0x3f, &(0x7f00000000c0)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x10, 0x20bc, 0x5500, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x1, 0x20, 0x1, [{{0x9, 0x4, 0x0, 0x85, 0x2, 0x3, 0x1, 0x0, 0xea, {0x9, 0x21, 0x8000, 0x1c, 0x1, {0x22, 0xfc8}}, {{{0x9, 0x5, 0x81, 0x3, 0x20, 0xf8, 0x1f, 0xe}}, [{{0x9, 0x5, 0x2, 0x3, 0x8, 0xc, 0x5, 0x4}}]}}}]}}]}}, &(0x7f0000000680)={0xa, &(0x7f0000000100)={0xa, 0x6, 0x300, 0x3, 0x7f, 0x8, 0x20, 0x3}, 0x28, &(0x7f0000000140)={0x5, 0xf, 0x28, 0x2, [@ssp_cap={0x1c, 0x10, 0xa, 0x81, 0x4, 0x2, 0xf00, 0x6, [0xc000, 0xc000, 0x30, 0xffc0f0]}, @ext_cap={0x7, 0x10, 0x2, 0x2, 0x2, 0x3, 0x6}]}, 0x8, [{0x83, &(0x7f0000000340)=@string={0x83, 0x3, "abfd176d3e2cec605695c7506db55943483577e585d62ef461f4ed79aec1e2f07ae4294bc01c74b150cdb581cf943c7563116246c6341e6f42f69a5d4de2cdd2b4a0cf8df72d83869f04e46604b415079920bf118f629b9c2b8aeb5eb3ee5ee9bd1d1e28a770e1b52d3a84b30dfecd6aace045c582f73e65b5322b17550bbd7c6c"}}, {0x4, &(0x7f0000000400)=@lang_id={0x4, 0x3, 0x42b}}, {0x4, &(0x7f0000000440)=@lang_id={0x4, 0x3, 0xc09}}, {0x4, &(0x7f0000000480)=@lang_id={0x4, 0x3, 0xc0c}}, {0x4, &(0x7f00000004c0)=@lang_id={0x4, 0x3, 0x2409}}, {0xfffffffffffffce0, &(0x7f0000000500)=@string={0x2f, 0x3, "42b659ea83020743beea2f5b7523337c2ea2d4b28f20b1495e44611c6c0657f6878adc1e347c1be087be25db46"}}, {0x4, &(0x7f0000000540)=@lang_id={0x4, 0x3, 0x41e}}, {0xcf, &(0x7f0000000580)=@string={0xcf, 0x3, "a257d8cf2bc2539c3b8c59ca9b2c7e310094e7a2902c9677858ba80087f21cf07e82c508593297aec995d9edf57e941a31c11bf5c52b9b251d388647e1b144f4d3b0b04d82088613caf58fe786728b90afa239240592a7e157f6bc9eb4bc0b0a435a861c33db62efbedf7fd1bd5df6a08f86be48329a227c359b95b493df2dc9f99c2666c00beeccc211566efa61da6d88d83510a88ef0a0f5003c9686c9a30c0abf0214efed794fe8ec428924a113d4913e884bf95ea0aecb03d698511e9c9ccdeb5cf43e4c7dea564638429d"}}]}) syz_usb_control_io$hid(r3, &(0x7f0000000240)={0x24, &(0x7f00000002c0)=ANY=[@ANYBLOB="00000c000000070001"], 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io(r2, 0x0, &(0x7f0000000180)={0x84, 0x0, 0x0, 0x0, 0x0, &(0x7f00000008c0)=ANY=[@ANYRES64=r2], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_connect$hid(0x6, 0x3f, &(0x7f0000000700)={{0x12, 0x1, 0x250, 0x0, 0x0, 0x0, 0x8, 0x5ac, 0x320, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x5, 0x30, 0xc5, [{{0x9, 0x4, 0x0, 0x2, 0x1, 0x3, 0x1, 0x0, 0x4, {0x9, 0x21, 0x9, 0x0, 0x1, {0x22, 0x73e}}, {{{0x9, 0x5, 0x81, 0x3, 0x8, 0xa5, 0x8, 0x4}}, [{{0x9, 0x5, 0x2, 0x3, 0x0, 0x9, 0x5, 0x3}}]}}}]}}]}}, &(0x7f0000000840)={0xa, &(0x7f0000000740)={0xa, 0x6, 0x201, 0xf9, 0x0, 0x3, 0x0, 0x7b}, 0x35, &(0x7f0000000780)={0x5, 0xf, 0x35, 0x5, [@ext_cap={0x7, 0x10, 0x2, 0x28, 0xd, 0xb, 0xad0b}, @wireless={0xb, 0x10, 0x1, 0xc, 0x1a2, 0x46, 0xd9, 0xffff, 0xaa}, @ptm_cap={0x3}, @ssp_cap={0x10, 0x10, 0xa, 0x6, 0x1, 0x39000, 0x0, 0xb, [0x0]}, @wireless={0xb, 0x10, 0x1, 0xc, 0x1, 0xf0, 0x2, 0xfff8, 0xf}]}, 0x1, [{0x65, &(0x7f00000007c0)=@string={0x65, 0x3, "4e6c96aa13f21932418301a6ce7cf1db64d2a4a4ab9e85ed0cc527f91a674b0ef3f17a65cdd05490f22e7b867435c9719f3024fc0973f30c19b3d2dcb06f3c9b7e8d5d80abdfa4ec6891a615ecb052a2e44ea91257d7cee1b87ba75b9d114c4b45e901"}}]}) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_control_io(r2, 0x0, &(0x7f0000001200)={0x84, 0x0, 0x0, 0x0, &(0x7f0000000040)={0x20, 0x0, 0x4, {0x1}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r2, 0x0, &(0x7f0000000000)={0x2c, &(0x7f0000000300)=ANY=[@ANYBLOB="20131b000000a1c8be"], 0x0, 0x0, 0x0, 0x0}) 1m2.139954811s ago: executing program 0 (id=1793): r0 = syz_open_pts(0xffffffffffffffff, 0x1) ioctl$KDGKBMODE(r0, 0x4b44, &(0x7f0000000000)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f00000001c0)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f0000000180)=0x1400200bd2) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r1 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) read$msr(r1, &(0x7f0000002700)=""/102392, 0x18ff8) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12}, 0x48) r5 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0xe, 0x4, &(0x7f0000000180)=ANY=[@ANYBLOB="18020000f0cd000000000000044e6900850000"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000080)={@map=r4, r5, 0x5}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000002c0)={{r4}, &(0x7f0000000300), &(0x7f0000000700)=r3}, 0x20) sendmsg$inet(r2, &(0x7f0000000980)={0x0, 0x0, 0x0}, 0x0) socket$inet6_icmp(0xa, 0x2, 0x3a) socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x44, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f00000002c0)={{}, &(0x7f0000000240), &(0x7f0000000280)='%pS \x00'}, 0x20) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000001380)={0xffffffffffffffff, &(0x7f00000004c0)}, 0x20) 1m1.284721389s ago: executing program 0 (id=1794): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4106-gcm-aesni\x00'}, 0x58) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000009c0)="ad56b6c5820fae9d6dcd3292ea54c7be8bbdadbb1632ea5704cae881ef915d374c90c200", 0x24) 1m1.195634637s ago: executing program 2 (id=1795): ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000000)={'gre0\x00', &(0x7f0000000380)={'sit0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, {{0x24, 0x4, 0x0, 0x0, 0x90, 0x0, 0x0, 0x0, 0x0, 0x0, @loopback, @rand_addr, {[@timestamp={0x44, 0x1c, 0xff, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @timestamp_prespec={0x44, 0x34, 0x0, 0x3, 0x0, [{@multicast2}, {@empty}, {@broadcast, 0x10001}, {@empty}, {@multicast1}, {@private}]}, @rr={0x7, 0x23, 0xfe, [@remote, @initdev={0xac, 0x1e, 0x0, 0x0}, @empty, @multicast1, @remote, @dev, @initdev={0xac, 0x1e, 0x1, 0x0}, @rand_addr=0x64010100]}, @noop, @lsrr={0x83, 0x3}, @generic={0x0, 0x2}]}}}}}) r0 = syz_clone(0x2000000, 0x0, 0x60, 0x0, 0x0, 0x0) ptrace(0x10, r0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000240), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x280000b, 0x28011, r1, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000100)=ANY=[@ANYBLOB="dc01c6ba1cdcc12519250000000000007f007101001300000000000000000000000000000000000000000000000000000000000000dce600000000000000", @ANYRES32=0x0, @ANYBLOB="200100000000000000000000000000020000000032000000fe8000000000000000000000000000bb00"/168], 0x1dc}}, 0x0) r2 = syz_io_uring_setup(0x24fa, &(0x7f0000000080)={0x0, 0x0, 0x10100}, &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) write$UHID_CREATE2(r5, &(0x7f00000001c0)=ANY=[@ANYBLOB='2'], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r5, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000000)=@IORING_OP_READ_FIXED={0x4, 0x0, 0x4000, @fd_index=0x4, 0x0, 0x0, 0x0, 0x5}) io_uring_enter(r2, 0x2d3e, 0x0, 0x0, 0x0, 0x0) io_uring_register$IORING_REGISTER_SYNC_CANCEL(r2, 0x18, &(0x7f0000000200)={0x6, r5, 0x2, {0x400000, 0x7}, 0x10}, 0x1) 1m0.632611294s ago: executing program 3 (id=1796): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x42}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000006080)=@newtfilter={0x40, 0x2c, 0xd27, 0x70bd24, 0x25dfdbfc, {0x0, 0x0, 0x0, r3, {0x4, 0xa}, {}, {0xfff2, 0x2}}, [@filter_kind_options=@f_matchall={{0xd}, {0xc, 0x2, [@TCA_MATCHALL_CLASSID={0x8, 0x1, {0x2, 0xfff2}}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x8848}, 0x80) sendmsg$nl_route_sched(r1, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000200)={0x0}, 0x1, 0x0, 0x0, 0x4000000}, 0x4041080) 1m0.631914605s ago: executing program 5 (id=1797): r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f00000007c0)=@mangle={'mangle\x00', 0x2, 0x6, 0x538, 0xd0, 0x280, 0x1b0, 0x1b0, 0x1b0, 0x468, 0x468, 0x468, 0x468, 0x468, 0x6, 0x0, {[{{@ipv6={@mcast1, @private1, [], [], 'bond_slave_0\x00', 'vlan1\x00', {}, {}, 0x21}, 0x0, 0xa8, 0xd0, 0x0, {0x7a00000010000000}}, @HL={0x28}}, {{@ipv6={@mcast2, @dev={0xfe, 0x80, '\x00', 0x2}, [], [0x0, 0xffffffff], 'bridge0\x00', 'veth1_vlan\x00', {}, {}, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{}, {0x0, 0x4}, {0x0, 0xfd}, 0x4, 0x4}}}, {{@ipv6={@ipv4, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [], [], 'bridge0\x00', 'bond_slave_0\x00', {0xff}, {}, 0x2}, 0x0, 0xa8, 0xd0, 0x48000000}, @common=@inet=@TCPMSS={0x28, 'TCPMSS\x00', 0x0, {0xabbc}}}, {{@ipv6={@loopback, @local, [0xff, 0x0, 0xffffffff, 0xff000000], [0xff000000, 0xff000000, 0xffffffff, 0xffffff00], 'macvlan0\x00', 'veth1_to_bridge\x00', {}, {0xff}, 0x8, 0x81, 0x1, 0x36}, 0x2000000, 0xa8, 0xf0}, @SNPT={0x48, 'SNPT\x00', 0x0, {@ipv4, @ipv6=@private1, 0x0, 0x37}}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @HL={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x598) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) sendmsg$NL80211_CMD_STOP_SCHED_SCAN(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000340)={0x0, 0x28}, 0x1, 0x0, 0x0, 0x80}, 0x800) 1m0.520431363s ago: executing program 5 (id=1798): bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x15, 0x4, &(0x7f00000001c0)=ANY=[@ANYBLOB="b4020000000000007911300000000000850000002e0000009500000000000000358bb9f43d86b13600"/50], &(0x7f0000000100)='syzkaller\x00', 0x4, 0xc5, &(0x7f0000000300)=""/197, 0x0, 0x0, '\x00', 0x0, @fallback=0x14, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f00000002c0), 0x10}, 0x94) 1m0.368573335s ago: executing program 5 (id=1799): sendmsg$DEVLINK_CMD_RATE_SET(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=ANY=[], 0x14}, 0x1, 0x0, 0x0, 0x4800}, 0x0) r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000740)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb010018000000000000001800000018000000050000000100000001000013040000000200000088060000ff0f0000002e2e"], 0x0, 0x35, 0x0, 0x1}, 0x28) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x11, 0x3, &(0x7f0000000040)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x8}}, &(0x7f0000000080)='GPL\x00', 0x5, 0x4fa, &(0x7f0000000cc0)=""/4096, 0x40f00, 0x5, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, &(0x7f00000002c0)={0x0, 0x2, 0x4, 0x9}, 0x1, 0x0, 0x0, 0x64, 0x0, 0x0, 0x10, 0xfffffffe}, 0x94) sendmsg$DEVLINK_CMD_RATE_NEW(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000240)=ANY=[], 0x34}, 0x1, 0x0, 0x0, 0x41}, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x11, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x40f00, 0x5, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0xd4, 0x0, 0x0, 0x0, 0x3000000}, 0x94) 1m0.264736834s ago: executing program 2 (id=1800): unshare(0x62040200) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000b80)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x4, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5}, 0xffffffffffffff61) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000400)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='GPL\x00'}, 0x94) syz_emit_ethernet(0x3e, &(0x7f0000000000)={@link_local={0x3}, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x4, 0x0, 0x12, 0x0, 0x3f18, {0x5, 0x2, 0x0, 0x0, 0x0, 0x68, 0x0, 0x0, 0x1, 0x1, @dev={0xac, 0x14, 0x14, 0x12}, @initdev={0xac, 0x1e, 0x1, 0x0}}}}}}}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0xb68, 0x4000, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) (fail_nth: 3) 1m0.260645799s ago: executing program 5 (id=1801): socket$inet_tcp(0x2, 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020204d2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000006592bba829"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x32, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0x44, 0x30, 0x1, 0x0, 0x0, {}, [{0x30, 0x1, [@m_ct={0x2c, 0x2, 0x0, 0x0, {{0x7}, {0x4}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$FBIOPUT_VSCREENINFO(0xffffffffffffffff, 0x4601, &(0x7f0000000380)={0x3c0, 0x300, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, {}, {0x3}, {0x0, 0x10000}, {}, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3, 0x8, 0x3, 0x1ff, 0x3d, 0x5, 0x3, 0x53, 0x202, 0x1, 0xc}) add_key$user(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x0}, &(0x7f00000000c0)="ff", 0x1, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r3 = socket(0x10, 0x3, 0x6) bpf$PROG_LOAD(0x5, 0x0, 0xffffffffffffffb9) r4 = socket(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r3, 0x8933, &(0x7f0000000040)={'team0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x2, [], 0x0, [0x4, 0x2, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c4, 0x0, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}]}, 0x88}}, 0x20000000) 1m0.225237449s ago: executing program 3 (id=1802): bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="dc3103d2e31b4e40c653578d846160b53578b08bd1420e99a381787bddea05116b76584fb8568df8c09be0a717255632aeb259b8cfc3f54ec0aaf07f84dee0ecc1331f4baf"], 0x50) r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000080), 0x101801, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, &(0x7f0000000240)={0x690, 0x0, 0x33e, 0x10, 0x800, 0x7, 0x10, 0x0, {0x5, 0x3, 0x1}, {0x8000, 0x8}, {0x80, 0xb3b}, {0x8, 0x4}, 0x1, 0x1, 0xffffff05, 0x2, 0x1, 0xa3, 0x5, 0x7, 0x4001000, 0x0, 0x2, 0x6, 0xb, 0x200, 0x0, 0xa}) 59.980560202s ago: executing program 3 (id=1803): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x11, 0x4, &(0x7f0000000280)=ANY=[@ANYBLOB="18000000000000000000c282f099e03bc74090000005000000"], &(0x7f0000000480)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000500)={0xffffffffffffffff}) (async, rerun: 32) close(0x3) (async, rerun: 32) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f00000002c0)={{r2, 0xffffffffffffffff}, &(0x7f0000000440), &(0x7f00000003c0)='%pI4 \x00'}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000000c0)={r3, 0xffffffffffffffff}, 0x4) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x16, 0x10, &(0x7f0000000100)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000ffff0b867b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000000000018230000", @ANYRES32=r4, @ANYBLOB="0000000000000000b70500000800000085000000a500000095"], &(0x7f0000000600)='GPL\x00', 0x8, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r5, 0x0, 0xe, 0x48000000, &(0x7f0000000300)="40f0538ef047b21fb60068305500", 0x0, 0xf00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) (async) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) r6 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0x1e1201, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r6, 0xc004500a, &(0x7f0000001340)) (async) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x40, 0x4, &(0x7f0000006680)) (async) flock(0xffffffffffffffff, 0x0) (async) ioctl$SNDCTL_DSP_CHANNELS(r6, 0xc0045006, &(0x7f0000000180)=0x6f) (async, rerun: 32) modify_ldt$write2(0x11, &(0x7f0000000040), 0x10) (async, rerun: 32) modify_ldt$read(0x0, &(0x7f0000000280)=""/66, 0x42) (async) write$dsp(r6, &(0x7f00000012c0)="a52876830a602214f6b4e928d758f38a5a7cb4b31c4c09289e9ebb6286784ca3", 0x4000) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) (async) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) (async) r7 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) read$msr(r7, &(0x7f0000002700)=""/102392, 0x18ff8) (async) r8 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$sock_int(r1, 0x1, 0x20, &(0x7f0000001740)=0x7ffffffd, 0x4) (async) r9 = add_key$keyring(&(0x7f0000000240), &(0x7f0000000280)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r9, &(0x7f0000000000)='asymmetric\x00', &(0x7f0000000140)=@chain) write$binfmt_script(r1, 0x0, 0x6f4000) (async) getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f0000000080)={0x0}, &(0x7f00000001c0)=0xc) prctl$PR_SCHED_CORE(0x3e, 0x4, r10, 0x0, &(0x7f0000000240)) (async, rerun: 64) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000200)='mm_migrate_pages\x00', r0, 0x0, 0x1005}, 0x18) (rerun: 64) 59.855874209s ago: executing program 3 (id=1804): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r0 = getpid() r1 = syz_open_procfs(0x0, &(0x7f0000000000)='ns\x00') fchdir(r1) ioctl$TIOCGPGRP(r1, 0x540f, &(0x7f00000001c0)) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) r2 = syz_open_dev$vim2m(&(0x7f0000000080), 0x7, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r2, 0xc008561c, &(0x7f0000000000)={0xc, 0xb}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = syz_open_dev$usbfs(&(0x7f0000000080), 0x76, 0x109301) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a010300000000000000000100fffd0900010073797a300000000040000000030a01020000000000000000010000000900030073797a3200000000140004800800024032658aeb08000140000000010900010073797a300000000044000000060a010400000000000001040100000008000b40000000000900010073797a30000000001c000480180001800d00010073796e70726f7879000000000400028014000000110001"], 0xcc}}, 0x0) ioctl$USBDEVFS_RESETEP(r5, 0x80045503, &(0x7f0000000000)={0x1, 0x1}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) keyctl$instantiate(0xc, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB='new default user:syz 000040', @ANYRES16=r6], 0x2a, 0x0) syz_usb_connect(0x3, 0x36, &(0x7f00000003c0)=ANY=[@ANYBLOB="1214da2108ab12a390eb1e00000001090224ffffffff00000000410017ff5d810009050fe45d1e67ac6e1356830300b300000053a290a3adcbd59a1b45d88796796a333dab643a74714459abf35f326f1f24e7567475300781998572ec1bbbfb2655af8d05bc8007cdb18bbd5f853c9dd8476281ae512a0000000000"], 0x0) mkdir(&(0x7f00000002c0)='./bus/file1\x00', 0x4) lsetxattr$trusted_overlay_origin(&(0x7f0000000180)='./file1\x00', &(0x7f0000000040), 0x0, 0x0, 0x0) 59.777081111s ago: executing program 1 (id=1805): ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000000)={'gre0\x00', &(0x7f0000000380)={'sit0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, {{0x24, 0x4, 0x0, 0x0, 0x90, 0x0, 0x0, 0x0, 0x0, 0x0, @loopback, @rand_addr, {[@timestamp={0x44, 0x1c, 0xff, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @timestamp_prespec={0x44, 0x34, 0x0, 0x3, 0x0, [{@multicast2}, {@empty}, {@broadcast, 0x10001}, {@empty}, {@multicast1}, {@private}]}, @rr={0x7, 0x23, 0xfe, [@remote, @initdev={0xac, 0x1e, 0x0, 0x0}, @empty, @multicast1, @remote, @dev, @initdev={0xac, 0x1e, 0x1, 0x0}, @rand_addr=0x64010100]}, @noop, @lsrr={0x83, 0x3}, @generic={0x0, 0x2}]}}}}}) r0 = syz_clone(0x2000000, 0x0, 0x60, 0x0, 0x0, 0x0) ptrace(0x10, r0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000240), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x280000b, 0x28011, r1, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000100)=ANY=[@ANYBLOB="dc01c6ba1cdcc12519250000000000007f007101001300000000000000000000000000000000000000000000000000000000000000dce6", @ANYRES32=0x0, @ANYBLOB="200100000000000000000000000000020000000032000000fe8000000000000000000000000000bb00"/168], 0x1dc}}, 0x0) r2 = syz_io_uring_setup(0x24fa, &(0x7f0000000080)={0x0, 0x0, 0x10100}, &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) write$UHID_CREATE2(r5, &(0x7f00000001c0)=ANY=[@ANYBLOB='2'], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r5, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000000)=@IORING_OP_READ_FIXED={0x4, 0x0, 0x4000, @fd_index=0x4, 0x0, 0x0, 0x0, 0x5}) io_uring_enter(r2, 0x2d3e, 0x0, 0x0, 0x0, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) 58.69726151s ago: executing program 0 (id=1806): unshare(0x62040200) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000b80)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x4, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5}, 0xffffffffffffff61) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000400)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='GPL\x00'}, 0x94) syz_emit_ethernet(0x3e, &(0x7f0000000000)={@link_local={0x3}, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x4, 0x0, 0x12, 0x0, 0x3f18, {0x5, 0x2, 0x0, 0x0, 0x0, 0x68, 0x0, 0x0, 0x1, 0x1, @dev={0xac, 0x14, 0x14, 0x12}, @initdev={0xac, 0x1e, 0x1, 0x0}}}}}}}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0xb68, 0x4000, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) 58.223237556s ago: executing program 1 (id=1807): r0 = syz_usb_connect(0x3, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000014da2108ab12a390eb1e000000010902240001b30000040904410017ff5d810009050f1f01040000810905830300"], 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x8, &(0x7f0000000980)=ANY=[@ANYBLOB="bcea"]) r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0x40, 0x0) ioctl$EVIOCRMFF(r1, 0x40044581, 0x0) 57.905497436s ago: executing program 5 (id=1808): socket$nl_generic(0x10, 0x3, 0x10) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = syz_open_dev$dri(&(0x7f0000000440), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x1494c0, 0x189) socket$key(0xf, 0x3, 0x2) syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) socket$rxrpc(0x21, 0x2, 0xa) syz_open_dev$tty1(0xc, 0x4, 0x2) socket$nl_audit(0x10, 0x3, 0x9) socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) pipe(&(0x7f0000000080)) pipe(&(0x7f0000000100)) pipe2(&(0x7f0000001040), 0x0) pipe2(&(0x7f0000000240), 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$packet(0x11, 0x3, 0x300) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c000000", @ANYRES16=0x0, @ANYRES8=r1], 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) pwrite64(0xffffffffffffffff, &(0x7f0000000000)='L', 0x1, 0x7ffffffe) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000040)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r2, &(0x7f0000000000), 0xd) (fail_nth: 5) 57.794212788s ago: executing program 5 (id=1809): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$NL802154_CMD_GET_INTERFACE(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x14, r1, 0x901, 0x70bd2d, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x45001}, 0x8000) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) syz_open_dev$ndb(0x0, 0x0, 0x80) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b40000000000000079104800000000006104000000de000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) r3 = syz_usb_connect(0x2, 0x24, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r3, 0x0, &(0x7f0000000000)={0x1c, 0x0, 0x0, 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, 0x0) sendmsg$nl_route_sched(r4, 0x0, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000000140)=0x1, 0x4) connect$inet6(r0, &(0x7f00000007c0)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @loopback}, 0x7}, 0x1c) io_setup(0x6, &(0x7f0000000680)) mount(&(0x7f00000001c0)=@nullb, &(0x7f0000000000)='./cgroup\x00', &(0x7f0000000180)='qnx4\x00', 0x0, 0x0) 56.638709054s ago: executing program 3 (id=1810): ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000000)={'gre0\x00', &(0x7f0000000380)={'sit0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, {{0x24, 0x4, 0x0, 0x0, 0x90, 0x0, 0x0, 0x0, 0x0, 0x0, @loopback, @rand_addr, {[@timestamp={0x44, 0x1c, 0xff, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @timestamp_prespec={0x44, 0x34, 0x0, 0x3, 0x0, [{@multicast2}, {@empty}, {@broadcast, 0x10001}, {@empty}, {@multicast1}, {@private}]}, @rr={0x7, 0x23, 0xfe, [@remote, @initdev={0xac, 0x1e, 0x0, 0x0}, @empty, @multicast1, @remote, @dev, @initdev={0xac, 0x1e, 0x1, 0x0}, @rand_addr=0x64010100]}, @noop, @lsrr={0x83, 0x3}, @generic={0x0, 0x2}]}}}}}) r0 = syz_clone(0x2000000, 0x0, 0x60, 0x0, 0x0, 0x0) ptrace(0x10, r0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000240), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x280000b, 0x28011, r1, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000100)=ANY=[@ANYBLOB="dc01c6ba1cdcc12519250000000000007f007101001300000000000000000000000000000000000000000000000000000000000000dce600000000000000", @ANYRES32=0x0, @ANYBLOB="200100000000000000000000000000020000000032000000fe8000000000000000000000000000bb00"/168], 0x1dc}}, 0x0) r2 = syz_io_uring_setup(0x24fa, &(0x7f0000000080)={0x0, 0x0, 0x10100}, &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) write$UHID_CREATE2(r5, &(0x7f00000001c0)=ANY=[@ANYBLOB='2'], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r5, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000000)=@IORING_OP_READ_FIXED={0x4, 0x0, 0x4000, @fd_index=0x4, 0x0, 0x0, 0x0, 0x5}) io_uring_enter(r2, 0x2d3e, 0x0, 0x0, 0x0, 0x0) io_uring_register$IORING_REGISTER_SYNC_CANCEL(r2, 0x18, &(0x7f0000000200)={0x6, r5, 0x2, {0x400000, 0x7}, 0x10}, 0x1) 0s ago: executing program 33 (id=1800): unshare(0x62040200) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000b80)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x4, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5}, 0xffffffffffffff61) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000400)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='GPL\x00'}, 0x94) syz_emit_ethernet(0x3e, &(0x7f0000000000)={@link_local={0x3}, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x4, 0x0, 0x12, 0x0, 0x3f18, {0x5, 0x2, 0x0, 0x0, 0x0, 0x68, 0x0, 0x0, 0x1, 0x1, @dev={0xac, 0x14, 0x14, 0x12}, @initdev={0xac, 0x1e, 0x1, 0x0}}}}}}}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0xb68, 0x4000, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) (fail_nth: 3) kernel console output (not intermixed with test programs): fr=0, Product=0, SerialNumber=0 [ 327.689266][T10137] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 327.864026][T10154] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1258'. [ 328.094919][T10156] fuse: Bad value for 'fd' [ 328.186654][T10126] Process accounting resumed [ 328.798483][ T5877] usb 2-1: new high-speed USB device number 25 using dummy_hcd [ 328.951364][ T5877] usb 2-1: Using ep0 maxpacket: 32 [ 328.963577][ T5877] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 328.998256][ T5877] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 329.014136][ T5877] usb 2-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 329.029018][T10170] lo speed is unknown, defaulting to 1000 [ 329.035669][ T5877] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 329.050370][ T5877] usb 2-1: config 0 descriptor?? [ 329.604883][T10191] usb usb8: usbfs: process 10191 (syz.0.1269) did not claim interface 0 before use [ 329.615346][T10191] trusted_key: encrypted_key: insufficient parameters specified [ 329.638482][ T5877] ft260 0003:0403:6030.000E: unknown main item tag 0x7 [ 329.661508][ T5934] usb 4-1: USB disconnect, device number 46 [ 329.816655][ T5877] ft260 0003:0403:6030.000E: chip code: 6424 8183 [ 329.871392][ T5916] usb 1-1: new high-speed USB device number 45 using dummy_hcd [ 330.021363][ T5916] usb 1-1: device descriptor read/64, error -71 [ 330.031427][ T5877] ft260 0003:0403:6030.000E: USB HID v0.00 Device [HID 0403:6030] on usb-dummy_hcd.1-1/input0 [ 330.134381][T10202] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 330.140815][T10202] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 330.229867][ T5877] ft260 0003:0403:6030.000E: failed to retrieve status: -32, no wakeup [ 330.243212][ T5877] ft260 0003:0403:6030.000E: failed to retrieve status: -32 [ 330.311383][ T5916] usb 1-1: new high-speed USB device number 46 using dummy_hcd [ 330.451401][ T5916] usb 1-1: device descriptor read/64, error -71 [ 330.490605][T10164] SELinux: failed to load policy [ 330.549443][ T5877] usb 2-1: USB disconnect, device number 25 [ 330.571637][ T5916] usb usb1-port1: attempt power cycle [ 330.626446][ T30] audit: type=1400 audit(1760639225.994:554): avc: denied { create } for pid=10207 comm="syz.4.1276" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=atmpvc_socket permissive=1 [ 330.961516][ T5916] usb 1-1: new high-speed USB device number 47 using dummy_hcd [ 331.012176][ T5916] usb 1-1: device descriptor read/8, error -71 [ 331.271642][ T5916] usb 1-1: new high-speed USB device number 48 using dummy_hcd [ 331.340941][ T5916] usb 1-1: device descriptor read/8, error -71 [ 331.481547][ T5916] usb usb1-port1: unable to enumerate USB device [ 331.981992][T10240] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1286'. [ 332.973479][T10260] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1293'. [ 333.011361][ T5916] usb 5-1: new high-speed USB device number 42 using dummy_hcd [ 333.202989][ T5916] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 333.228010][ T5916] usb 5-1: config 0 interface 0 has no altsetting 0 [ 333.253688][ T5916] usb 5-1: New USB device found, idVendor=05ac, idProduct=0323, bcdDevice= 0.00 [ 333.281202][ T5916] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 333.345771][ T5916] usb 5-1: config 0 descriptor?? [ 334.564040][ T5916] usbhid 5-1:0.0: can't add hid device: -71 [ 334.570535][ T5916] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 334.580781][ T5916] usb 5-1: USB disconnect, device number 42 [ 334.590971][T10282] lo speed is unknown, defaulting to 1000 [ 335.506852][T10300] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 335.513400][T10300] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 335.752853][T10303] qnx4: no qnx4 filesystem (no root dir). [ 336.150308][T10310] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1309'. [ 336.164486][T10310] netlink: 29 bytes leftover after parsing attributes in process `syz.1.1309'. [ 336.186795][T10312] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1011 sclass=netlink_route_socket pid=10312 comm=syz.0.1311 [ 336.202373][T10310] tipc: Invalid UDP bearer configuration [ 336.202425][T10310] tipc: Enabling of bearer rejected, failed to enable media [ 336.766600][ T30] audit: type=1400 audit(1760639232.134:555): avc: denied { create } for pid=10315 comm="syz.0.1312" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_nflog_socket permissive=1 [ 337.201407][ T934] usb 4-1: new high-speed USB device number 47 using dummy_hcd [ 337.361367][ T934] usb 4-1: Using ep0 maxpacket: 32 [ 337.374520][ T934] usb 4-1: config index 0 descriptor too short (expected 8210, got 18) [ 337.405976][ T934] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 337.434191][ T934] usb 4-1: config 0 has no interfaces? [ 337.454948][ T934] usb 4-1: New USB device found, idVendor=0b89, idProduct=0007, bcdDevice=ef.64 [ 337.477684][ T934] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 337.509483][ T934] usb 4-1: config 0 descriptor?? [ 337.571382][ T5870] usb 5-1: new high-speed USB device number 43 using dummy_hcd [ 337.811402][ T5870] usb 5-1: Using ep0 maxpacket: 8 [ 337.821258][ T5870] usb 5-1: config 179 has an invalid interface number: 65 but max is 0 [ 337.836947][ T5870] usb 5-1: config 179 has no interface number 0 [ 337.843621][ T5870] usb 5-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 337.844447][ T5877] usb 4-1: USB disconnect, device number 47 [ 337.854856][ T5870] usb 5-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 337.883625][ T5870] usb 5-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 337.906604][ T5870] usb 5-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 337.932765][ T5870] usb 5-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 337.942074][ T5870] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 337.955909][T10331] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 338.068398][T10337] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1317'. [ 338.186508][T10331] capability: warning: `syz.4.1315' uses deprecated v2 capabilities in a way that may be insecure [ 338.206897][ T30] audit: type=1400 audit(1760639233.574:556): avc: denied { map } for pid=10330 comm="syz.4.1315" path="socket:[27562]" dev="sockfs" ino=27562 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tcp_socket permissive=1 [ 338.244358][T10344] SET target dimension over the limit! [ 338.304982][T10331] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 338.317084][T10331] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 338.606238][ T5870] usb 5-1: USB disconnect, device number 43 [ 338.713232][T10356] lo speed is unknown, defaulting to 1000 [ 339.601348][ T5916] usb 1-1: new high-speed USB device number 49 using dummy_hcd [ 339.753207][ T5916] usb 1-1: Using ep0 maxpacket: 8 [ 339.765972][ T5916] usb 1-1: config index 0 descriptor too short (expected 301, got 45) [ 339.780100][ T5916] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 339.796199][ T5916] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 339.830811][ T5916] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 339.861702][ T5916] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 339.972572][ T5916] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 339.990389][T10378] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1330'. [ 340.036892][ T5916] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 340.407582][ T5916] usb 1-1: GET_CAPABILITIES returned 0 [ 340.441710][ T5916] usbtmc 1-1:16.0: can't read capabilities [ 340.890150][T10395] usb usb8: usbfs: process 10395 (syz.4.1336) did not claim interface 0 before use [ 340.900762][T10395] trusted_key: encrypted_key: insufficient parameters specified [ 341.124619][ T5869] usb 1-1: USB disconnect, device number 49 [ 341.151378][ T934] usb 5-1: new high-speed USB device number 44 using dummy_hcd [ 341.271690][ T5877] usb 2-1: new high-speed USB device number 26 using dummy_hcd [ 341.282048][ T934] usb 5-1: device descriptor read/64, error -71 [ 341.465461][ T5877] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023 [ 341.505443][ T5877] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A [ 341.533651][ T934] usb 5-1: new high-speed USB device number 45 using dummy_hcd [ 341.538766][ T5877] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8A has invalid wMaxPacketSize 0 [ 341.551322][ T5877] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8A has invalid maxpacket 0 [ 341.587017][ T5877] usb 2-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 341.602113][ T5877] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 341.610156][ T5877] usb 2-1: Product: syz [ 341.616875][T10411] lo speed is unknown, defaulting to 1000 [ 341.618419][ T5877] usb 2-1: Manufacturer: syz [ 341.637091][ T5877] usb 2-1: SerialNumber: syz [ 341.648453][ T5877] usb 2-1: config 0 descriptor?? [ 341.655767][T10400] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 341.681424][ T934] usb 5-1: device descriptor read/64, error -71 [ 341.684670][ T5877] usb 2-1: ucan: probing device on interface #0 [ 341.705009][ T5877] usb 2-1: ucan: invalid in_ep MaxPacketSize [ 341.711082][ T5877] usb 2-1: ucan: probe failed; try to update the device firmware [ 341.791764][ T934] usb usb5-port1: attempt power cycle [ 341.804475][T10414] FAULT_INJECTION: forcing a failure. [ 341.804475][T10414] name failslab, interval 1, probability 0, space 0, times 0 [ 341.831401][T10414] CPU: 0 UID: 0 PID: 10414 Comm: syz.0.1344 Not tainted syzkaller #0 PREEMPT(full) [ 341.831429][T10414] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 341.831439][T10414] Call Trace: [ 341.831445][T10414] [ 341.831452][T10414] dump_stack_lvl+0x16c/0x1f0 [ 341.831475][T10414] should_fail_ex+0x512/0x640 [ 341.831495][T10414] ? fs_reclaim_acquire+0xae/0x150 [ 341.831520][T10414] should_failslab+0xc2/0x120 [ 341.831545][T10414] __kmalloc_noprof+0xdd/0x880 [ 341.831562][T10414] ? tomoyo_encode2+0x100/0x3e0 [ 341.831588][T10414] ? tomoyo_encode2+0x100/0x3e0 [ 341.831609][T10414] tomoyo_encode2+0x100/0x3e0 [ 341.831635][T10414] tomoyo_encode+0x29/0x50 [ 341.831657][T10414] tomoyo_realpath_from_path+0x18f/0x6e0 [ 341.831689][T10414] tomoyo_path_number_perm+0x245/0x580 [ 341.831708][T10414] ? tomoyo_path_number_perm+0x237/0x580 [ 341.831730][T10414] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 341.831750][T10414] ? find_held_lock+0x2b/0x80 [ 341.831789][T10414] ? find_held_lock+0x2b/0x80 [ 341.831804][T10414] ? hook_file_ioctl_common+0x145/0x410 [ 341.831827][T10414] ? __fget_files+0x20e/0x3c0 [ 341.831854][T10414] security_file_ioctl+0x9b/0x240 [ 341.831879][T10414] __x64_sys_ioctl+0xb7/0x210 [ 341.831900][T10414] do_syscall_64+0xcd/0xfa0 [ 341.831923][T10414] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 341.831941][T10414] RIP: 0033:0x7ff92918eec9 [ 341.831957][T10414] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 341.831973][T10414] RSP: 002b:00007ff929f4e038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 341.831990][T10414] RAX: ffffffffffffffda RBX: 00007ff9293e5fa0 RCX: 00007ff92918eec9 [ 341.832001][T10414] RDX: 0000200000000240 RSI: 0000000000004601 RDI: 0000000000000003 [ 341.832012][T10414] RBP: 00007ff929f4e090 R08: 0000000000000000 R09: 0000000000000000 [ 341.832022][T10414] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 341.832032][T10414] R13: 00007ff9293e6038 R14: 00007ff9293e5fa0 R15: 00007ffea2c63768 [ 341.832058][T10414] [ 341.832090][T10414] ERROR: Out of memory at tomoyo_realpath_from_path. [ 341.921146][T10400] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 342.131871][T10400] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 342.192616][ T934] usb 5-1: new high-speed USB device number 46 using dummy_hcd [ 342.390208][ T934] usb 5-1: device descriptor read/8, error -71 [ 342.561705][T10422] fuse: Bad value for 'fd' [ 342.585481][ T5870] usb 2-1: USB disconnect, device number 26 [ 342.791398][ T934] usb 5-1: new high-speed USB device number 47 using dummy_hcd [ 342.822154][ T934] usb 5-1: device descriptor read/8, error -71 [ 342.956643][ T934] usb usb5-port1: unable to enumerate USB device [ 343.925590][ T934] usb 2-1: new high-speed USB device number 27 using dummy_hcd [ 344.104547][T10443] Cannot find add_set index 0 as target [ 344.179927][ T934] usb 2-1: Using ep0 maxpacket: 8 [ 344.197035][ T934] usb 2-1: config 179 has an invalid interface number: 65 but max is 0 [ 344.219594][ T934] usb 2-1: config 179 has no interface number 0 [ 344.247249][ T934] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 344.514742][ T934] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 344.556607][ T934] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 344.601981][ T934] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 344.617901][ T934] usb 2-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 344.651395][ T5870] usb 3-1: new high-speed USB device number 54 using dummy_hcd [ 344.683135][ T934] usb 2-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 344.727542][ T934] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 344.742470][T10435] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 344.841636][ T5870] usb 3-1: device descriptor read/64, error -71 [ 344.848209][ T30] audit: type=1326 audit(1760639240.214:557): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10452 comm="syz.3.1358" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f49e678eec9 code=0x7fc00000 [ 344.901907][ T30] audit: type=1326 audit(1760639240.214:558): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10452 comm="syz.3.1358" exe="/root/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7f49e678eec9 code=0x7fc00000 [ 345.022518][ T5934] input: Generic X-Box pad as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:179.65/input/input47 [ 345.121458][ T5870] usb 3-1: new high-speed USB device number 55 using dummy_hcd [ 345.171483][ T934] usb 1-1: new high-speed USB device number 50 using dummy_hcd [ 345.234293][ T5934] usb 2-1: USB disconnect, device number 27 [ 345.240268][ C0] xpad 2-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 345.240316][ C0] xpad 2-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 345.261971][ T5870] usb 3-1: device descriptor read/64, error -71 [ 345.333582][ T934] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023 [ 345.343985][ T934] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A [ 345.356065][ T934] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8A has invalid wMaxPacketSize 0 [ 345.365993][ T934] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8A has invalid maxpacket 0 [ 345.376456][ T5870] usb usb3-port1: attempt power cycle [ 345.385302][ T934] usb 1-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 345.394913][ T934] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 345.403155][ T934] usb 1-1: Product: syz [ 345.407667][ T934] usb 1-1: Manufacturer: syz [ 345.412369][ T934] usb 1-1: SerialNumber: syz [ 345.420197][ T934] usb 1-1: config 0 descriptor?? [ 345.426724][T10459] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 345.438494][ T934] usb 1-1: ucan: probing device on interface #0 [ 345.445516][ T934] usb 1-1: ucan: invalid in_ep MaxPacketSize [ 345.452758][ T934] usb 1-1: ucan: probe failed; try to update the device firmware [ 345.513200][ T30] audit: type=1326 audit(1760639240.884:559): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10452 comm="syz.3.1358" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f49e678eec9 code=0x7fc00000 [ 345.537610][ T30] audit: type=1326 audit(1760639240.884:560): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10452 comm="syz.3.1358" exe="/root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f49e678eec9 code=0x7fc00000 [ 345.561502][ T30] audit: type=1326 audit(1760639240.884:561): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10452 comm="syz.3.1358" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f49e678eec9 code=0x7fc00000 [ 345.585450][ T30] audit: type=1326 audit(1760639240.884:562): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10452 comm="syz.3.1358" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f49e678eec9 code=0x7fc00000 [ 345.609546][ T30] audit: type=1326 audit(1760639240.884:563): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10452 comm="syz.3.1358" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f49e678eec9 code=0x7fc00000 [ 345.633688][ T30] audit: type=1326 audit(1760639240.884:564): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10452 comm="syz.3.1358" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f49e678eec9 code=0x7fc00000 [ 345.651690][T10466] lo speed is unknown, defaulting to 1000 [ 345.663807][ T30] audit: type=1326 audit(1760639240.884:565): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10452 comm="syz.3.1358" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f49e678eec9 code=0x7fc00000 [ 345.667319][T10459] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 345.689081][ T30] audit: type=1326 audit(1760639240.884:566): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10452 comm="syz.3.1358" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f49e678eec9 code=0x7fc00000 [ 345.703557][T10459] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 345.803574][ T5870] usb 3-1: new high-speed USB device number 56 using dummy_hcd [ 345.879448][ T5870] usb 3-1: device descriptor read/8, error -71 [ 346.151486][ T5870] usb 3-1: new high-speed USB device number 57 using dummy_hcd [ 346.160798][ T5916] usb 1-1: USB disconnect, device number 50 [ 346.182047][ T5870] usb 3-1: device descriptor read/8, error -71 [ 346.304613][T10472] usb usb8: usbfs: process 10472 (syz.1.1363) did not claim interface 0 before use [ 346.314953][T10472] trusted_key: encrypted_key: insufficient parameters specified [ 346.324620][ T5870] usb usb3-port1: unable to enumerate USB device [ 346.571383][ T5877] usb 2-1: new high-speed USB device number 28 using dummy_hcd [ 346.651594][ T5869] usb 5-1: new high-speed USB device number 48 using dummy_hcd [ 346.730622][ T5877] usb 2-1: device descriptor read/64, error -71 [ 346.811631][ T5869] usb 5-1: device descriptor read/64, error -71 [ 346.924728][T10481] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1366'. [ 347.057960][ T5877] usb 2-1: new high-speed USB device number 29 using dummy_hcd [ 347.131353][ T5869] usb 5-1: new high-speed USB device number 49 using dummy_hcd [ 347.191342][ T5877] usb 2-1: device descriptor read/64, error -71 [ 347.271603][ T5869] usb 5-1: device descriptor read/64, error -71 [ 347.303101][ T5877] usb usb2-port1: attempt power cycle [ 347.392264][ T5869] usb usb5-port1: attempt power cycle [ 347.531527][ T5916] usb 4-1: new high-speed USB device number 48 using dummy_hcd [ 347.633051][T10492] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1369'. [ 347.674978][ T5877] usb 2-1: new high-speed USB device number 30 using dummy_hcd [ 347.711526][ T5916] usb 4-1: Using ep0 maxpacket: 32 [ 347.719304][ T5877] usb 2-1: device descriptor read/8, error -71 [ 347.730817][ T5916] usb 4-1: config 0 has an invalid interface number: 130 but max is 0 [ 347.741900][ T5869] usb 5-1: new high-speed USB device number 50 using dummy_hcd [ 347.750921][ T5916] usb 4-1: config 0 has no interface number 0 [ 347.759350][ T5916] usb 4-1: config 0 interface 130 has no altsetting 0 [ 347.770609][ T5869] usb 5-1: device descriptor read/8, error -71 [ 347.785334][ T5916] usb 4-1: New USB device found, idVendor=1bc7, idProduct=1201, bcdDevice=69.37 [ 347.811650][ T5916] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 347.819760][ T5916] usb 4-1: Product: syz [ 347.827221][ T5916] usb 4-1: Manufacturer: syz [ 347.836395][ T5916] usb 4-1: SerialNumber: syz [ 347.863660][ T5916] usb 4-1: config 0 descriptor?? [ 347.971651][ T5877] usb 2-1: new high-speed USB device number 31 using dummy_hcd [ 348.022133][ T5877] usb 2-1: device descriptor read/8, error -71 [ 348.041576][ T5869] usb 5-1: new high-speed USB device number 51 using dummy_hcd [ 348.099457][ T5869] usb 5-1: device descriptor read/8, error -71 [ 348.135062][ T5916] option 4-1:0.130: GSM modem (1-port) converter detected [ 348.144257][ T5877] usb usb2-port1: unable to enumerate USB device [ 348.182510][ T5916] usb 4-1: USB disconnect, device number 48 [ 348.253539][ T5869] usb usb5-port1: unable to enumerate USB device [ 348.271869][ T5916] option 4-1:0.130: device disconnected [ 348.919209][T10508] FAULT_INJECTION: forcing a failure. [ 348.919209][T10508] name failslab, interval 1, probability 0, space 0, times 0 [ 348.934183][T10508] CPU: 1 UID: 0 PID: 10508 Comm: syz.3.1375 Not tainted syzkaller #0 PREEMPT(full) [ 348.934208][T10508] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 348.934218][T10508] Call Trace: [ 348.934224][T10508] [ 348.934231][T10508] dump_stack_lvl+0x16c/0x1f0 [ 348.934258][T10508] should_fail_ex+0x512/0x640 [ 348.934279][T10508] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 348.934304][T10508] should_failslab+0xc2/0x120 [ 348.934331][T10508] kmem_cache_alloc_noprof+0x75/0x6e0 [ 348.934353][T10508] ? skb_clone+0x190/0x3f0 [ 348.934379][T10508] ? skb_clone+0x190/0x3f0 [ 348.934397][T10508] skb_clone+0x190/0x3f0 [ 348.934419][T10508] netlink_deliver_tap+0xabd/0xd30 [ 348.934453][T10508] netlink_unicast+0x71f/0x870 [ 348.934481][T10508] ? __pfx_netlink_unicast+0x10/0x10 [ 348.934501][T10508] ? __pfx_tc_modify_qdisc+0x10/0x10 [ 348.934538][T10508] netlink_ack+0x696/0xb80 [ 348.934568][T10508] netlink_rcv_skb+0x332/0x420 [ 348.934591][T10508] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 348.934616][T10508] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 348.934649][T10508] ? netlink_deliver_tap+0x1ae/0xd30 [ 348.934675][T10508] netlink_unicast+0x5aa/0x870 [ 348.934702][T10508] ? __pfx_netlink_unicast+0x10/0x10 [ 348.934735][T10508] netlink_sendmsg+0x8c8/0xdd0 [ 348.934763][T10508] ? __pfx_netlink_sendmsg+0x10/0x10 [ 348.934796][T10508] ____sys_sendmsg+0xa98/0xc70 [ 348.934824][T10508] ? copy_msghdr_from_user+0x10a/0x160 [ 348.934845][T10508] ? __pfx_____sys_sendmsg+0x10/0x10 [ 348.934874][T10508] ? __pfx__kstrtoull+0x10/0x10 [ 348.934908][T10508] ___sys_sendmsg+0x134/0x1d0 [ 348.934931][T10508] ? __pfx____sys_sendmsg+0x10/0x10 [ 348.934964][T10508] ? find_held_lock+0x2b/0x80 [ 348.934999][T10508] __sys_sendmmsg+0x200/0x420 [ 348.935024][T10508] ? __pfx___sys_sendmmsg+0x10/0x10 [ 348.935054][T10508] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 348.935088][T10508] ? fput+0x9b/0xd0 [ 348.935104][T10508] ? ksys_write+0x1ac/0x250 [ 348.935125][T10508] ? __pfx_ksys_write+0x10/0x10 [ 348.935149][T10508] __x64_sys_sendmmsg+0x9c/0x100 [ 348.935166][T10508] ? lockdep_hardirqs_on+0x7c/0x110 [ 348.935186][T10508] do_syscall_64+0xcd/0xfa0 [ 348.935209][T10508] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 348.935227][T10508] RIP: 0033:0x7f49e678eec9 [ 348.935240][T10508] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 348.935257][T10508] RSP: 002b:00007f49e7546038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 348.935275][T10508] RAX: ffffffffffffffda RBX: 00007f49e69e5fa0 RCX: 00007f49e678eec9 [ 348.935286][T10508] RDX: 040000000000009f RSI: 00002000000002c0 RDI: 0000000000000003 [ 348.935296][T10508] RBP: 00007f49e7546090 R08: 0000000000000000 R09: 0000000000000000 [ 348.935306][T10508] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 348.935316][T10508] R13: 00007f49e69e6038 R14: 00007f49e69e5fa0 R15: 00007ffe8c14b7b8 [ 348.935342][T10508] [ 348.935637][T10508] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1375'. [ 349.261417][T10508] netlink: 'syz.3.1375': attribute type 22 has an invalid length. [ 349.275759][T10508] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1375'. [ 349.352169][ T69] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 349.361239][T10508] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1375'. [ 349.391423][ T69] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 349.400244][ T69] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 349.409207][T10508] netlink: 'syz.3.1375': attribute type 22 has an invalid length. [ 349.449550][T10508] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1375'. [ 349.510871][ T69] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 349.523958][T10511] lo speed is unknown, defaulting to 1000 [ 349.571354][ T5869] usb 1-1: new high-speed USB device number 51 using dummy_hcd [ 349.792579][T10524] tipc: Started in network mode [ 349.797536][T10524] tipc: Node identity 8e0678f7e4e8, cluster identity 4711 [ 349.806523][ T5869] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023 [ 349.811384][ T5934] usb 2-1: new full-speed USB device number 32 using dummy_hcd [ 349.817448][ T5869] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A [ 349.837286][T10524] tipc: Enabled bearer , priority 0 [ 349.847472][ T5869] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8A has invalid wMaxPacketSize 0 [ 349.851150][T10528] syzkaller0: entered promiscuous mode [ 349.857812][ T5869] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8A has invalid maxpacket 0 [ 349.875207][T10528] syzkaller0: entered allmulticast mode [ 349.883068][ T5869] usb 1-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 349.893241][ T5869] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 349.903220][ T5869] usb 1-1: Product: syz [ 349.909668][ T5869] usb 1-1: Manufacturer: syz [ 349.914769][ T5869] usb 1-1: SerialNumber: syz [ 349.922289][ T5869] usb 1-1: config 0 descriptor?? [ 349.928116][T10513] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 349.938494][ T5869] usb 1-1: ucan: probing device on interface #0 [ 349.946108][ T5869] usb 1-1: ucan: invalid in_ep MaxPacketSize [ 349.955600][ T5869] usb 1-1: ucan: probe failed; try to update the device firmware [ 349.973073][ T5934] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 349.984816][T10528] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1380'. [ 349.997336][ T5934] usb 2-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 350.011190][ T5934] usb 2-1: New USB device found, idVendor=12d1, idProduct=42f7, bcdDevice=aa.47 [ 350.020970][ T5934] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 350.033011][ T5934] usb 2-1: config 0 descriptor?? [ 350.041203][ T5934] qmi_wwan 2-1:0.0: probe with driver qmi_wwan failed with error -22 [ 350.148734][T10513] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 350.158222][T10513] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 350.557345][ T934] usb 1-1: USB disconnect, device number 51 [ 350.577873][T10523] tipc: Resetting bearer [ 350.600072][T10523] tipc: Disabling bearer [ 350.832702][T10534] netlink: 40 bytes leftover after parsing attributes in process `syz.4.1382'. [ 351.052294][ T5877] usb 2-1: USB disconnect, device number 32 [ 351.926600][T10551] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1387'. [ 352.043126][T10548] usb usb8: usbfs: process 10548 (syz.1.1388) did not claim interface 0 before use [ 352.054644][T10548] trusted_key: encrypted_key: insufficient parameters specified [ 352.127311][T10559] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1391'. [ 352.172459][T10556] qnx4: no qnx4 filesystem (no root dir). [ 352.351379][ T5934] usb 2-1: new high-speed USB device number 33 using dummy_hcd [ 352.805843][ T5934] usb 2-1: device descriptor read/64, error -71 [ 353.081898][T10570] netlink: 'syz.3.1394': attribute type 1 has an invalid length. [ 353.108088][T10570] bond2: entered promiscuous mode [ 353.114601][T10570] 8021q: adding VLAN 0 to HW filter on device bond2 [ 353.201899][ T5934] usb 2-1: new high-speed USB device number 34 using dummy_hcd [ 353.371675][T10574] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1395'. [ 353.491382][ T5934] usb 2-1: device descriptor read/64, error -71 [ 353.493395][T10577] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 353.601696][ T5934] usb usb2-port1: attempt power cycle [ 353.960844][T10586] tipc: Enabled bearer , priority 0 [ 353.969476][T10586] syzkaller0: entered promiscuous mode [ 353.979862][T10586] syzkaller0: entered allmulticast mode [ 354.009833][T10586] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1398'. [ 354.094429][T10586] syzkaller0: mtu greater than device maximum [ 354.103075][T10585] tipc: Resetting bearer [ 354.124985][T10585] tipc: Disabling bearer [ 354.143395][ T5934] usb 2-1: new high-speed USB device number 35 using dummy_hcd [ 354.182963][ T5934] usb 2-1: device descriptor read/8, error -71 [ 354.421369][ T5934] usb 2-1: new high-speed USB device number 36 using dummy_hcd [ 354.471840][ T5934] usb 2-1: device descriptor read/8, error -71 [ 354.598515][ T5934] usb usb2-port1: unable to enumerate USB device [ 354.674241][ T30] kauditd_printk_skb: 61 callbacks suppressed [ 354.674257][ T30] audit: type=1400 audit(1760639250.044:628): avc: denied { read write } for pid=10604 comm="syz.2.1407" name="btrfs-control" dev="devtmpfs" ino=1316 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 354.727447][T10606] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1407'. [ 354.775542][ T30] audit: type=1400 audit(1760639250.044:629): avc: denied { open } for pid=10604 comm="syz.2.1407" path="/dev/btrfs-control" dev="devtmpfs" ino=1316 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 354.891913][ T30] audit: type=1400 audit(1760639250.084:630): avc: denied { ioctl } for pid=10604 comm="syz.2.1407" path="/dev/btrfs-control" dev="devtmpfs" ino=1316 ioctlcmd=0x5414 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 355.084837][T10610] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 355.091365][T10610] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 355.735284][T10629] FAULT_INJECTION: forcing a failure. [ 355.735284][T10629] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 355.757634][T10629] CPU: 1 UID: 0 PID: 10629 Comm: syz.3.1414 Not tainted syzkaller #0 PREEMPT(full) [ 355.757660][T10629] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 355.757671][T10629] Call Trace: [ 355.757677][T10629] [ 355.757683][T10629] dump_stack_lvl+0x16c/0x1f0 [ 355.757711][T10629] should_fail_ex+0x512/0x640 [ 355.757736][T10629] _copy_from_user+0x2e/0xd0 [ 355.757764][T10629] copy_msghdr_from_user+0x98/0x160 [ 355.757786][T10629] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 355.757810][T10629] ? kfree+0x252/0x6d0 [ 355.757827][T10629] ? __pfx__kstrtoull+0x10/0x10 [ 355.757858][T10629] ___sys_sendmsg+0xfe/0x1d0 [ 355.757880][T10629] ? __pfx____sys_sendmsg+0x10/0x10 [ 355.757926][T10629] ? __pfx___might_resched+0x10/0x10 [ 355.757949][T10629] __sys_sendmmsg+0x200/0x420 [ 355.757977][T10629] ? __pfx___sys_sendmmsg+0x10/0x10 [ 355.758006][T10629] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 355.758038][T10629] ? fput+0x9b/0xd0 [ 355.758054][T10629] ? ksys_write+0x1ac/0x250 [ 355.758075][T10629] ? __pfx_ksys_write+0x10/0x10 [ 355.758101][T10629] __x64_sys_sendmmsg+0x9c/0x100 [ 355.758122][T10629] ? lockdep_hardirqs_on+0x7c/0x110 [ 355.758143][T10629] do_syscall_64+0xcd/0xfa0 [ 355.758166][T10629] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 355.758185][T10629] RIP: 0033:0x7f49e678eec9 [ 355.758200][T10629] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 355.758217][T10629] RSP: 002b:00007f49e7546038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 355.758234][T10629] RAX: ffffffffffffffda RBX: 00007f49e69e5fa0 RCX: 00007f49e678eec9 [ 355.758245][T10629] RDX: 040000000000009f RSI: 00002000000002c0 RDI: 0000000000000003 [ 355.758256][T10629] RBP: 00007f49e7546090 R08: 0000000000000000 R09: 0000000000000000 [ 355.758266][T10629] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 355.758276][T10629] R13: 00007f49e69e6038 R14: 00007f49e69e5fa0 R15: 00007ffe8c14b7b8 [ 355.758307][T10629] [ 356.037090][T10631] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1416'. [ 356.115156][T10636] Cannot find add_set index 0 as target [ 356.291753][ T30] audit: type=1400 audit(1760639251.664:631): avc: denied { ioctl } for pid=10640 comm="syz.3.1420" path="socket:[30211]" dev="sockfs" ino=30211 ioctlcmd=0x5604 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 356.691358][ T934] usb 4-1: new full-speed USB device number 49 using dummy_hcd [ 356.853004][ T934] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 356.883615][ T934] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 356.897425][ T934] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x82 has invalid maxpacket 1024, setting to 64 [ 356.916334][ T934] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid maxpacket 512, setting to 64 [ 356.972571][ T934] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 357.001527][ T934] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 357.019739][ T934] usb 4-1: Product: syz [ 357.178684][T10660] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1429'. [ 357.322990][ T934] usb 4-1: Manufacturer: syz [ 357.328113][ T934] usb 4-1: SerialNumber: syz [ 357.673992][T10643] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 357.686866][ T934] cdc_mbim 4-1:1.0: skipping garbage [ 357.902151][T10643] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 357.922386][T10643] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 358.257828][T10679] FAULT_INJECTION: forcing a failure. [ 358.257828][T10679] name failslab, interval 1, probability 0, space 0, times 0 [ 358.330624][T10679] CPU: 0 UID: 0 PID: 10679 Comm: syz.1.1434 Not tainted syzkaller #0 PREEMPT(full) [ 358.330652][T10679] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 358.330663][T10679] Call Trace: [ 358.330670][T10679] [ 358.330678][T10679] dump_stack_lvl+0x16c/0x1f0 [ 358.330709][T10679] should_fail_ex+0x512/0x640 [ 358.330730][T10679] ? fs_reclaim_acquire+0xae/0x150 [ 358.330759][T10679] should_failslab+0xc2/0x120 [ 358.330785][T10679] __kmalloc_noprof+0xdd/0x880 [ 358.330806][T10679] ? tomoyo_realpath_from_path+0xc2/0x6e0 [ 358.330837][T10679] ? tomoyo_realpath_from_path+0xc2/0x6e0 [ 358.330861][T10679] tomoyo_realpath_from_path+0xc2/0x6e0 [ 358.330887][T10679] ? tomoyo_profile+0x47/0x60 [ 358.330918][T10679] tomoyo_path_number_perm+0x245/0x580 [ 358.330938][T10679] ? tomoyo_path_number_perm+0x237/0x580 [ 358.330961][T10679] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 358.330985][T10679] ? find_held_lock+0x2b/0x80 [ 358.331026][T10679] ? find_held_lock+0x2b/0x80 [ 358.331043][T10679] ? hook_file_ioctl_common+0x145/0x410 [ 358.331066][T10679] ? __fget_files+0x20e/0x3c0 [ 358.331101][T10679] security_file_ioctl+0x9b/0x240 [ 358.331126][T10679] __x64_sys_ioctl+0xb7/0x210 [ 358.331148][T10679] do_syscall_64+0xcd/0xfa0 [ 358.331171][T10679] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 358.331189][T10679] RIP: 0033:0x7f1e8c98eec9 [ 358.331203][T10679] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 358.331220][T10679] RSP: 002b:00007f1e8d82e038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 358.331238][T10679] RAX: ffffffffffffffda RBX: 00007f1e8cbe5fa0 RCX: 00007f1e8c98eec9 [ 358.331249][T10679] RDX: 0000200000000480 RSI: 00000000c0306201 RDI: 0000000000000004 [ 358.331260][T10679] RBP: 00007f1e8d82e090 R08: 0000000000000000 R09: 0000000000000000 [ 358.331269][T10679] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 358.331279][T10679] R13: 00007f1e8cbe6038 R14: 00007f1e8cbe5fa0 R15: 00007ffe758813e8 [ 358.331304][T10679] [ 358.535890][ T5934] usb 1-1: new high-speed USB device number 52 using dummy_hcd [ 358.553263][ T934] cdc_mbim 4-1:1.0: failed GET_NTB_PARAMETERS [ 358.560017][ T934] cdc_mbim 4-1:1.0: bind() failure [ 358.570696][ T934] cdc_ncm 4-1:1.1: CDC Union missing and no IAD found [ 358.578269][ T934] cdc_ncm 4-1:1.1: bind() failure [ 358.593755][T10679] ERROR: Out of memory at tomoyo_realpath_from_path. [ 358.694148][ T5934] usb 1-1: New USB device found, idVendor=05ac, idProduct=b301, bcdDevice=e4.00 [ 358.703369][ T5934] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 358.711633][ T5934] usb 1-1: Product: syz [ 358.715781][ T5934] usb 1-1: Manufacturer: syz [ 358.720351][ T5934] usb 1-1: SerialNumber: syz [ 358.755109][ T5934] usb 1-1: config 0 descriptor?? [ 359.031118][T10687] netlink: 'syz.1.1437': attribute type 1 has an invalid length. [ 359.040812][T10687] netlink: 224 bytes leftover after parsing attributes in process `syz.1.1437'. [ 359.598438][ T9] usb 4-1: USB disconnect, device number 49 [ 360.731699][ T5934] usb 1-1: USB disconnect, device number 52 [ 360.983076][T10710] netlink: 'syz.0.1444': attribute type 1 has an invalid length. [ 361.176831][T10710] bond2: entered promiscuous mode [ 361.304676][T10710] 8021q: adding VLAN 0 to HW filter on device bond2 [ 361.390311][T10721] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1446'. [ 361.561392][ T30] audit: type=1400 audit(1760639256.904:632): avc: denied { ioctl } for pid=10726 comm="syz.4.1450" path="socket:[30494]" dev="sockfs" ino=30494 ioctlcmd=0x8917 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 361.697698][ T30] audit: type=1400 audit(1760639256.904:633): avc: denied { write } for pid=10726 comm="syz.4.1450" name="hwrng" dev="devtmpfs" ino=83 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:random_device_t tclass=chr_file permissive=1 [ 361.813555][ T5934] usb 1-1: new full-speed USB device number 53 using dummy_hcd [ 362.173524][ T5934] usb 1-1: unable to get BOS descriptor or descriptor too short [ 362.207117][ T5934] usb 1-1: not running at top speed; connect to a high speed hub [ 362.232526][ T5934] usb 1-1: config 129 has an invalid interface number: 28 but max is 0 [ 362.249600][ T5934] usb 1-1: config 129 has an invalid descriptor of length 0, skipping remainder of the config [ 362.261978][ T5934] usb 1-1: config 129 has no interface number 0 [ 362.268504][ T5934] usb 1-1: config 129 interface 28 altsetting 250 has an endpoint descriptor with address 0xFD, changing to 0x8D [ 362.292818][ T5934] usb 1-1: config 129 interface 28 altsetting 250 endpoint 0x8D has invalid wMaxPacketSize 0 [ 362.305791][ T5934] usb 1-1: config 129 interface 28 has no altsetting 0 [ 362.399432][ T5934] usb 1-1: New USB device found, idVendor=108c, idProduct=0159, bcdDevice=db.57 [ 362.408783][T10740] usb usb8: usbfs: process 10740 (syz.3.1453) did not claim interface 0 before use [ 362.409005][ T5934] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 362.426581][ T5934] usb 1-1: Product: syz [ 362.430832][ T5934] usb 1-1: Manufacturer: syz [ 362.435610][ T5934] usb 1-1: SerialNumber: syz [ 362.440461][T10740] trusted_key: encrypted_key: insufficient parameters specified [ 362.728028][ T5877] usb 4-1: new high-speed USB device number 50 using dummy_hcd [ 362.900637][T10723] ref_ctr going negative. vaddr: 0x200000ffc002, curr val: -29824, delta: 1 [ 362.906117][ T30] audit: type=1804 audit(1760639258.264:634): pid=10723 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz.0.1448" name="/newroot/299/file0" dev="tmpfs" ino=1654 res=1 errno=0 [ 362.909678][T10723] ref_ctr increment failed for inode: 0x676 offset: 0x5 ref_ctr_offset: 0x2 of mm: 0xffff88807b836b80 [ 363.005749][ T5934] etas_es58x 1-1:129.28: Starting syz syz (Serial Number syz) [ 363.015241][ T5934] etas_es58x 1-1:129.28: could not retrieve the product info string [ 363.106774][ T5877] usb 4-1: device descriptor read/64, error -71 [ 363.111489][ T934] usb 3-1: new high-speed USB device number 58 using dummy_hcd [ 363.123923][ T5934] usb 1-1: USB disconnect, device number 53 [ 363.142695][ T5934] etas_es58x 1-1:129.28: Disconnecting syz syz [ 363.305889][ T934] usb 3-1: New USB device found, idVendor=05ac, idProduct=b301, bcdDevice=e4.00 [ 363.336384][ T934] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 363.368709][ T934] usb 3-1: Product: syz [ 363.378017][ T934] usb 3-1: Manufacturer: syz [ 363.399570][ T934] usb 3-1: SerialNumber: syz [ 363.402054][ T5877] usb 4-1: new high-speed USB device number 51 using dummy_hcd [ 363.414176][ T934] usb 3-1: config 0 descriptor?? [ 363.683360][ T5877] usb 4-1: device descriptor read/64, error -71 [ 363.730453][T10756] qnx4: no qnx4 filesystem (no root dir). [ 363.921562][ T5877] usb usb4-port1: attempt power cycle [ 364.331389][ T5877] usb 4-1: new high-speed USB device number 52 using dummy_hcd [ 364.353980][ T5877] usb 4-1: device descriptor read/8, error -71 [ 364.731399][ T5877] usb 4-1: new high-speed USB device number 53 using dummy_hcd [ 364.772141][ T5877] usb 4-1: device descriptor read/8, error -71 [ 364.805465][T10785] SET target dimension over the limit! [ 364.895345][ T5877] usb usb4-port1: unable to enumerate USB device [ 365.643557][ T934] usb 3-1: USB disconnect, device number 58 [ 367.121681][ T5877] usb 2-1: new high-speed USB device number 37 using dummy_hcd [ 367.742535][ T5877] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023 [ 367.761381][ T5877] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A [ 367.787669][ T30] audit: type=1400 audit(1760639263.154:635): avc: denied { setattr } for pid=5820 comm="syz-executor" path="/dev/binderfs" dev="binder" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 367.791617][ T5877] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8A has invalid wMaxPacketSize 0 [ 367.955271][ T5877] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8A has invalid maxpacket 0 [ 367.986379][ T5877] usb 2-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 367.995803][ T5877] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 368.008569][ T5877] usb 2-1: Product: syz [ 368.042867][ T5877] usb 2-1: Manufacturer: syz [ 368.047774][ T5877] usb 2-1: SerialNumber: syz [ 368.070651][ T5877] usb 2-1: config 0 descriptor?? [ 368.090418][T10824] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 368.099096][ T5877] usb 2-1: ucan: probing device on interface #0 [ 368.114208][ T5877] usb 2-1: ucan: invalid in_ep MaxPacketSize [ 368.458800][T10839] usb usb8: usbfs: process 10839 (syz.2.1475) did not claim interface 0 before use [ 368.469197][T10839] trusted_key: encrypted_key: insufficient parameters specified [ 368.485680][T10824] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 368.497395][ T5877] usb 2-1: ucan: probe failed; try to update the device firmware [ 368.575372][T10824] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 368.712266][ T5821] usb 3-1: new high-speed USB device number 59 using dummy_hcd [ 369.133768][ T934] usb 2-1: USB disconnect, device number 37 [ 369.153428][ T5821] usb 3-1: device descriptor read/64, error -71 [ 369.621433][ T5821] usb 3-1: new high-speed USB device number 60 using dummy_hcd [ 369.872886][ T5821] usb 3-1: device descriptor read/64, error -71 [ 370.218964][ T5821] usb usb3-port1: attempt power cycle [ 370.591577][ T5877] usb 2-1: new high-speed USB device number 38 using dummy_hcd [ 370.631481][ T5821] usb 3-1: new high-speed USB device number 61 using dummy_hcd [ 370.672545][ T5821] usb 3-1: device descriptor read/8, error -71 [ 371.207810][T10857] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 371.218153][ T5821] usb 3-1: new high-speed USB device number 62 using dummy_hcd [ 371.280102][ T5877] usb 2-1: New USB device found, idVendor=05ac, idProduct=b301, bcdDevice=e4.00 [ 371.301512][ T5877] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 371.326403][ T5877] usb 2-1: Product: syz [ 371.336986][ T5877] usb 2-1: Manufacturer: syz [ 371.347137][ T5877] usb 2-1: SerialNumber: syz [ 371.364380][ T5877] usb 2-1: config 0 descriptor?? [ 371.449352][T10866] FAULT_INJECTION: forcing a failure. [ 371.449352][T10866] name failslab, interval 1, probability 0, space 0, times 0 [ 371.464100][T10866] CPU: 0 UID: 0 PID: 10866 Comm: syz.2.1482 Not tainted syzkaller #0 PREEMPT(full) [ 371.464124][T10866] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 371.464134][T10866] Call Trace: [ 371.464140][T10866] [ 371.464146][T10866] dump_stack_lvl+0x16c/0x1f0 [ 371.464170][T10866] should_fail_ex+0x512/0x640 [ 371.464190][T10866] ? fs_reclaim_acquire+0xae/0x150 [ 371.464217][T10866] should_failslab+0xc2/0x120 [ 371.464241][T10866] __kmalloc_noprof+0xdd/0x880 [ 371.464259][T10866] ? tomoyo_encode2+0x100/0x3e0 [ 371.464286][T10866] ? tomoyo_encode2+0x100/0x3e0 [ 371.464306][T10866] tomoyo_encode2+0x100/0x3e0 [ 371.464332][T10866] tomoyo_encode+0x29/0x50 [ 371.464352][T10866] tomoyo_realpath_from_path+0x18f/0x6e0 [ 371.464383][T10866] tomoyo_path_number_perm+0x245/0x580 [ 371.464401][T10866] ? tomoyo_path_number_perm+0x237/0x580 [ 371.464422][T10866] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 371.464443][T10866] ? find_held_lock+0x2b/0x80 [ 371.464483][T10866] ? find_held_lock+0x2b/0x80 [ 371.464497][T10866] ? hook_file_ioctl_common+0x145/0x410 [ 371.464518][T10866] ? __fget_files+0x20e/0x3c0 [ 371.464545][T10866] security_file_ioctl+0x9b/0x240 [ 371.464569][T10866] __x64_sys_ioctl+0xb7/0x210 [ 371.464590][T10866] do_syscall_64+0xcd/0xfa0 [ 371.464611][T10866] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 371.464627][T10866] RIP: 0033:0x7f43ab58eec9 [ 371.464642][T10866] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 371.464657][T10866] RSP: 002b:00007f43ac3cd038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 371.464674][T10866] RAX: ffffffffffffffda RBX: 00007f43ab7e5fa0 RCX: 00007f43ab58eec9 [ 371.464686][T10866] RDX: 0000200000000480 RSI: 00000000c0306201 RDI: 0000000000000004 [ 371.464695][T10866] RBP: 00007f43ac3cd090 R08: 0000000000000000 R09: 0000000000000000 [ 371.464705][T10866] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 371.464713][T10866] R13: 00007f43ab7e6038 R14: 00007f43ab7e5fa0 R15: 00007ffff4b67bc8 [ 371.464737][T10866] [ 371.465142][T10866] ERROR: Out of memory at tomoyo_realpath_from_path. [ 371.472275][ T5821] usb 3-1: device not accepting address 62, error -71 [ 371.527920][T10868] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1483'. [ 371.624965][ T5821] usb usb3-port1: unable to enumerate USB device [ 371.701422][ T934] usb 1-1: new high-speed USB device number 54 using dummy_hcd [ 372.013356][ T934] usb 1-1: New USB device found, idVendor=16c0, idProduct=05e1, bcdDevice= 0.00 [ 372.042805][ T934] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 372.072009][ T934] usb 1-1: config 0 descriptor?? [ 372.296894][T10873] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 372.532509][ T934] usbhid 1-1:0.0: can't add hid device: -32 [ 372.553881][ T934] usbhid 1-1:0.0: probe with driver usbhid failed with error -32 [ 372.574652][ T934] usb 1-1: USB disconnect, device number 54 [ 372.647726][T10876] ptrace attach of "./syz-executor exec"[5816] was attempted by "./syz-executor exec"[10876] [ 372.775338][T10877] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1484'. [ 372.784398][T10877] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1484'. [ 373.149594][ T5877] usb 2-1: USB disconnect, device number 38 [ 373.940064][ T934] usb 4-1: new high-speed USB device number 54 using dummy_hcd [ 374.021509][ T5869] usb 3-1: new high-speed USB device number 63 using dummy_hcd [ 374.217075][ T5869] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023 [ 374.314986][ T5869] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A [ 374.448758][ T5869] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8A has invalid wMaxPacketSize 0 [ 374.459093][ T5869] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8A has invalid maxpacket 0 [ 374.471837][ T5869] usb 3-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 374.481882][ T5869] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 374.482428][ T934] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023 [ 374.490007][ T5869] usb 3-1: Product: syz [ 374.504144][ T934] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A [ 374.621898][ T5869] usb 3-1: Manufacturer: syz [ 374.626857][ T5869] usb 3-1: SerialNumber: syz [ 374.646527][ T934] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8A has invalid wMaxPacketSize 0 [ 374.652260][ T5869] usb 3-1: config 0 descriptor?? [ 374.671343][ T934] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8A has invalid maxpacket 0 [ 374.693471][ T934] usb 4-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 374.711464][ T934] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 374.744629][T10889] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 374.762412][ T5869] usb 3-1: ucan: probing device on interface #0 [ 374.769195][ T5869] usb 3-1: ucan: invalid in_ep MaxPacketSize [ 374.777221][ T934] usb 4-1: Product: syz [ 374.779471][ T5869] usb 3-1: ucan: probe failed; try to update the device firmware [ 374.877963][ T934] usb 4-1: Manufacturer: syz [ 375.045506][ T934] usb 4-1: SerialNumber: syz [ 375.180772][T10889] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 375.181334][ T934] usb 4-1: config 0 descriptor?? [ 375.461973][T10889] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 375.510382][T10893] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 375.532198][ T934] usb 4-1: ucan: probing device on interface #0 [ 375.538565][ T934] usb 4-1: ucan: invalid in_ep MaxPacketSize [ 375.544933][ T934] usb 4-1: ucan: probe failed; try to update the device firmware [ 375.765154][T10893] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 375.811923][T10893] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 376.232726][T10926] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1498'. [ 376.545741][ T30] audit: type=1400 audit(1760639271.914:636): avc: denied { bind } for pid=10929 comm="syz.1.1500" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 376.581525][ T30] audit: type=1400 audit(1760639271.954:637): avc: denied { listen } for pid=10929 comm="syz.1.1500" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 376.604510][T10930] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 377.371654][ T30] audit: type=1400 audit(1760639272.744:638): avc: denied { ioctl } for pid=10934 comm="syz.1.1502" path="/dev/fuse" dev="devtmpfs" ino=99 ioctlcmd=0xf50a scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 377.695150][ T5869] usb 4-1: USB disconnect, device number 54 [ 377.757774][ T5877] usb 3-1: USB disconnect, device number 63 [ 378.144652][ T1296] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.151109][ T1296] ieee802154 phy1 wpan1: encryption failed: -22 [ 380.073866][ T9] usb 1-1: new high-speed USB device number 55 using dummy_hcd [ 380.282628][ T9] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023 [ 380.312770][ T9] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A [ 380.347245][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8A has invalid wMaxPacketSize 0 [ 380.389720][ T9] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8A has invalid maxpacket 0 [ 380.420447][ T9] usb 1-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 380.429580][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 380.447561][ T9] usb 1-1: Product: syz [ 380.452683][ T9] usb 1-1: Manufacturer: syz [ 380.457832][ T9] usb 1-1: SerialNumber: syz [ 380.490093][ T9] usb 1-1: config 0 descriptor?? [ 380.502682][T10980] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 380.519218][ T9] usb 1-1: ucan: probing device on interface #0 [ 380.530094][ T9] usb 1-1: ucan: invalid in_ep MaxPacketSize [ 380.550999][ T9] usb 1-1: ucan: probe failed; try to update the device firmware [ 380.591393][ T5821] usb 2-1: new high-speed USB device number 39 using dummy_hcd [ 380.722664][T10980] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 380.732122][T10980] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 380.740184][ T5821] usb 2-1: device descriptor read/64, error -71 [ 381.001363][ T5821] usb 2-1: new high-speed USB device number 40 using dummy_hcd [ 381.151370][ T5821] usb 2-1: device descriptor read/64, error -71 [ 381.261963][ T5821] usb usb2-port1: attempt power cycle [ 381.525723][T11014] kvm: kvm [11010]: vcpu0, guest rIP: 0x9114 Unhandled WRMSR(0xc2) = 0x9d00 [ 381.534636][T11014] kvm: kvm [11010]: vcpu0, guest rIP: 0x9114 Unhandled WRMSR(0xc1) = 0x9d00 [ 382.107241][ T5821] usb 2-1: new high-speed USB device number 41 using dummy_hcd [ 382.144970][ T5821] usb 2-1: device descriptor read/8, error -71 [ 382.431353][ T5821] usb 2-1: new high-speed USB device number 42 using dummy_hcd [ 382.487979][ T5821] usb 2-1: device descriptor read/8, error -71 [ 382.559258][ T9] usb 1-1: USB disconnect, device number 55 [ 382.591361][ T5869] usb 3-1: new high-speed USB device number 64 using dummy_hcd [ 382.622203][ T5821] usb usb2-port1: unable to enumerate USB device [ 382.771381][ T5869] usb 3-1: Using ep0 maxpacket: 32 [ 382.800363][ T5869] usb 3-1: config index 0 descriptor too short (expected 8210, got 18) [ 382.822213][ T5869] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 382.841777][ T5869] usb 3-1: config 0 has no interfaces? [ 382.847276][ T5869] usb 3-1: New USB device found, idVendor=0b89, idProduct=0007, bcdDevice=ef.64 [ 382.890121][ T5869] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 382.900934][T11028] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1529'. [ 382.933585][ T5869] usb 3-1: config 0 descriptor?? [ 382.961428][T11028] netlink: 'syz.3.1529': attribute type 22 has an invalid length. [ 382.969340][T11028] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1529'. [ 383.062997][T11028] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1529'. [ 383.091425][T11028] netlink: 'syz.3.1529': attribute type 22 has an invalid length. [ 383.164095][T11028] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1529'. [ 383.197190][ T5869] usb 3-1: USB disconnect, device number 64 [ 383.723132][T11043] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 383.791532][T11043] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 383.804525][T11043] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 383.840853][T11043] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 383.848557][T11043] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 383.883563][ T5806] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 383.891004][ T5806] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 383.898635][ T5806] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 383.923325][ T5806] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 383.931472][ T5806] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 383.952002][ T30] audit: type=1400 audit(1760639279.314:639): avc: denied { mounton } for pid=11042 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 384.234175][T11042] lo speed is unknown, defaulting to 1000 [ 384.477706][ T934] usb 2-1: new high-speed USB device number 43 using dummy_hcd [ 384.672500][ T934] usb 2-1: config 0 has no interfaces? [ 384.681080][ T934] usb 2-1: New USB device found, idVendor=10d6, idProduct=2200, bcdDevice= 0.02 [ 384.709643][ T934] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 384.729916][ T934] usb 2-1: SerialNumber: syz [ 384.770560][ T934] usb 2-1: config 0 descriptor?? [ 384.995107][T11053] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1534'. [ 385.131727][T11060] FAULT_INJECTION: forcing a failure. [ 385.131727][T11060] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 385.182330][T11060] CPU: 0 UID: 0 PID: 11060 Comm: syz.2.1536 Not tainted syzkaller #0 PREEMPT(full) [ 385.182354][T11060] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 385.182364][T11060] Call Trace: [ 385.182369][T11060] [ 385.182376][T11060] dump_stack_lvl+0x16c/0x1f0 [ 385.182403][T11060] should_fail_ex+0x512/0x640 [ 385.182428][T11060] _copy_from_user+0x2e/0xd0 [ 385.182451][T11060] binder_ioctl+0x57a/0x73b0 [ 385.182487][T11060] ? tomoyo_path_number_perm+0x18d/0x580 [ 385.182517][T11060] ? __pfx_binder_ioctl+0x10/0x10 [ 385.182544][T11060] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 385.182575][T11060] ? do_vfs_ioctl+0x128/0x14f0 [ 385.182594][T11060] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 385.182613][T11060] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 385.182646][T11060] ? hook_file_ioctl_common+0x145/0x410 [ 385.182670][T11060] ? selinux_file_ioctl+0x180/0x270 [ 385.182692][T11060] ? selinux_file_ioctl+0xb4/0x270 [ 385.182716][T11060] ? __pfx_binder_ioctl+0x10/0x10 [ 385.182740][T11060] __x64_sys_ioctl+0x18e/0x210 [ 385.182760][T11060] do_syscall_64+0xcd/0xfa0 [ 385.182782][T11060] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 385.182800][T11060] RIP: 0033:0x7f43ab58eec9 [ 385.182819][T11060] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 385.182836][T11060] RSP: 002b:00007f43ac3cd038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 385.182853][T11060] RAX: ffffffffffffffda RBX: 00007f43ab7e5fa0 RCX: 00007f43ab58eec9 [ 385.182864][T11060] RDX: 0000200000000480 RSI: 00000000c0306201 RDI: 0000000000000004 [ 385.182874][T11060] RBP: 00007f43ac3cd090 R08: 0000000000000000 R09: 0000000000000000 [ 385.182884][T11060] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 385.182894][T11060] R13: 00007f43ab7e6038 R14: 00007f43ab7e5fa0 R15: 00007ffff4b67bc8 [ 385.182920][T11060] [ 385.182927][T11060] binder: 11059:11060 ioctl c0306201 200000000480 returned -14 [ 385.512202][ T7366] bond0: (slave syz_tun): Releasing backup interface [ 385.595783][ T5821] usb 2-1: USB disconnect, device number 43 [ 386.078150][T11043] Bluetooth: hci5: command tx timeout [ 386.112857][ T6185] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 386.441421][ T5821] usb 3-1: new high-speed USB device number 65 using dummy_hcd [ 386.513076][ T6185] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 386.661008][ T5821] usb 3-1: device descriptor read/64, error -71 [ 386.725928][T11080] usb usb8: usbfs: process 11080 (syz.1.1542) did not claim interface 0 before use [ 386.737760][T11080] trusted_key: encrypted_key: insufficient parameters specified [ 386.825034][T11085] netlink: 44 bytes leftover after parsing attributes in process `syz.0.1543'. [ 386.846100][ T6185] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 386.921513][ T5821] usb 3-1: new high-speed USB device number 66 using dummy_hcd [ 386.981332][ T5934] usb 2-1: new high-speed USB device number 44 using dummy_hcd [ 387.050423][ T6185] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 387.061490][ T5821] usb 3-1: device descriptor read/64, error -71 [ 387.107763][T11042] chnl_net:caif_netlink_parms(): no params data found [ 387.141399][ T5934] usb 2-1: device descriptor read/64, error -71 [ 387.191761][ T5821] usb usb3-port1: attempt power cycle [ 387.211421][ T934] usb 4-1: new high-speed USB device number 55 using dummy_hcd [ 387.381471][ T934] usb 4-1: Using ep0 maxpacket: 16 [ 387.391681][ T5934] usb 2-1: new high-speed USB device number 45 using dummy_hcd [ 387.406440][T11099] netlink: 'syz.0.1547': attribute type 1 has an invalid length. [ 387.424867][ T934] usb 4-1: descriptor type invalid, skip [ 387.430553][ T934] usb 4-1: descriptor type invalid, skip [ 387.461701][ T934] usb 4-1: descriptor type invalid, skip [ 387.467374][ T934] usb 4-1: descriptor type invalid, skip [ 387.504143][ T934] usb 4-1: config 192 has an invalid interface number: 253 but max is 0 [ 387.515621][T11099] bond3: entered promiscuous mode [ 387.521492][T11099] 8021q: adding VLAN 0 to HW filter on device bond3 [ 387.529308][T11042] bridge0: port 1(bridge_slave_0) entered blocking state [ 387.536809][ T934] usb 4-1: config 192 has no interface number 0 [ 387.543527][ T5934] usb 2-1: device descriptor read/64, error -71 [ 387.551442][ T5821] usb 3-1: new high-speed USB device number 67 using dummy_hcd [ 387.581659][T11042] bridge0: port 1(bridge_slave_0) entered disabled state [ 387.588907][T11042] bridge_slave_0: entered allmulticast mode [ 387.595002][ T934] usb 4-1: config 192 interface 253 has no altsetting 0 [ 387.601820][ T5821] usb 3-1: device descriptor read/8, error -71 [ 387.613544][T11042] bridge_slave_0: entered promiscuous mode [ 387.651890][ T5934] usb usb2-port1: attempt power cycle [ 387.689640][T11042] bridge0: port 2(bridge_slave_1) entered blocking state [ 387.698560][T11042] bridge0: port 2(bridge_slave_1) entered disabled state [ 387.716083][T11042] bridge_slave_1: entered allmulticast mode [ 387.724542][ T934] usb 4-1: string descriptor 0 read error: -22 [ 387.730916][ T934] usb 4-1: New USB device found, idVendor=045e, idProduct=00f5, bcdDevice=b8.4b [ 387.751896][T11042] bridge_slave_1: entered promiscuous mode [ 387.767932][ T934] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 387.797591][ T934] gspca_main: sonixj-2.14.0 probing 045e:00f5 [ 387.851373][ T5821] usb 3-1: new high-speed USB device number 68 using dummy_hcd [ 387.890377][ T5821] usb 3-1: device descriptor read/8, error -71 [ 387.955843][T11042] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 387.992515][ T5934] usb 2-1: new high-speed USB device number 46 using dummy_hcd [ 388.013346][ T5821] usb usb3-port1: unable to enumerate USB device [ 388.026997][ T934] gspca_sonixj: reg_w1 err -71 [ 388.031980][ T5934] usb 2-1: device descriptor read/8, error -71 [ 388.042511][ T934] sonixj 4-1:192.253: probe with driver sonixj failed with error -71 [ 388.061989][T11042] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 388.092998][ T934] usb 4-1: USB disconnect, device number 55 [ 388.142614][T11043] Bluetooth: hci5: command tx timeout [ 388.180226][ T6185] bridge_slave_1: left allmulticast mode [ 388.187777][ T6185] bridge_slave_1: left promiscuous mode [ 388.204284][ T6185] bridge0: port 2(bridge_slave_1) entered disabled state [ 388.239250][ T6185] bridge_slave_0: left allmulticast mode [ 388.256034][ T6185] bridge_slave_0: left promiscuous mode [ 388.266255][ T6185] bridge0: port 1(bridge_slave_0) entered disabled state [ 388.275972][ T5934] usb 2-1: new high-speed USB device number 47 using dummy_hcd [ 388.303199][ T5934] usb 2-1: device descriptor read/8, error -71 [ 388.411817][ T5934] usb usb2-port1: unable to enumerate USB device [ 389.002626][T11109] delete_channel: no stack [ 390.044072][T11145] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1553'. [ 390.223557][T11043] Bluetooth: hci5: command tx timeout [ 390.244890][ T30] audit: type=1400 audit(1760639285.604:640): avc: denied { create } for pid=11146 comm="syz.2.1554" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 390.435646][ T6185] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 390.452226][ T6185] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 390.467490][ T6185] bond0 (unregistering): Released all slaves [ 390.593361][ T6185] bond1 (unregistering): Released all slaves [ 390.607776][T11042] team0: Port device team_slave_0 added [ 390.615245][T11110] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1550'. [ 390.697029][T11042] team0: Port device team_slave_1 added [ 390.737654][ T6185] tipc: Left network mode [ 391.181817][T11042] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 391.188838][T11042] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 391.676302][T11042] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 391.795303][T11042] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 391.806976][T11042] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 391.883131][T11042] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 392.244613][T11175] lo speed is unknown, defaulting to 1000 [ 392.262295][T11042] hsr_slave_0: entered promiscuous mode [ 392.301451][T11043] Bluetooth: hci5: command tx timeout [ 392.304678][T11042] hsr_slave_1: entered promiscuous mode [ 392.393185][T11042] debugfs: 'hsr0' already exists in 'hsr' [ 392.430281][T11042] Cannot create hsr debugfs directory [ 392.870513][T11195] tipc: Enabled bearer , priority 0 [ 392.952737][T11192] tipc: Disabling bearer [ 393.120667][T11198] ptm ptm0: ldisc open failed (-12), clearing slot 0 [ 393.160156][ T6185] hsr_slave_0: left promiscuous mode [ 393.200941][ T6185] hsr_slave_1: left promiscuous mode [ 393.208102][ T6185] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 393.216852][ T6185] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 393.234437][ T6185] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 393.243779][ T6185] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 393.333300][ T6185] veth1_macvtap: left promiscuous mode [ 393.338982][ T6185] veth0_macvtap: left promiscuous mode [ 393.375831][ T6185] veth1_vlan: left promiscuous mode [ 393.391015][ T6185] veth0_vlan: left promiscuous mode [ 393.850791][ T5934] usb 2-1: new high-speed USB device number 48 using dummy_hcd [ 393.895882][ T6185] team0 (unregistering): Port device team_slave_1 removed [ 393.935173][ T6185] team0 (unregistering): Port device team_slave_0 removed [ 394.001458][ T5934] usb 2-1: Using ep0 maxpacket: 32 [ 394.008186][ T5934] usb 2-1: no configurations [ 394.018733][ T5934] usb 2-1: can't read configurations, error -22 [ 394.151400][ T5934] usb 2-1: new high-speed USB device number 49 using dummy_hcd [ 394.280267][T11206] tc_dump_action: action bad kind [ 394.312285][ T5934] usb 2-1: Using ep0 maxpacket: 32 [ 394.330557][ T5934] usb 2-1: no configurations [ 394.349624][ T5934] usb 2-1: can't read configurations, error -22 [ 394.373834][ T5934] usb usb2-port1: attempt power cycle [ 394.837874][ T5934] usb 2-1: new high-speed USB device number 50 using dummy_hcd [ 394.885420][ T5934] usb 2-1: Using ep0 maxpacket: 32 [ 394.894990][ T5934] usb 2-1: no configurations [ 394.899624][ T5934] usb 2-1: can't read configurations, error -22 [ 394.955037][T11042] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 395.009078][T11042] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 395.046617][T11042] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 395.067317][ T5934] usb 2-1: new high-speed USB device number 51 using dummy_hcd [ 395.097167][T11042] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 395.127331][ T5934] usb 2-1: Using ep0 maxpacket: 32 [ 395.148002][ T5934] usb 2-1: no configurations [ 395.178134][ T5934] usb 2-1: can't read configurations, error -22 [ 395.201748][ T5934] usb usb2-port1: unable to enumerate USB device [ 395.430635][T11042] 8021q: adding VLAN 0 to HW filter on device bond0 [ 395.527320][T11042] 8021q: adding VLAN 0 to HW filter on device team0 [ 395.573533][ T6197] bridge0: port 1(bridge_slave_0) entered blocking state [ 395.580718][ T6197] bridge0: port 1(bridge_slave_0) entered forwarding state [ 395.639274][ T6185] bridge0: port 2(bridge_slave_1) entered blocking state [ 395.646563][ T6185] bridge0: port 2(bridge_slave_1) entered forwarding state [ 395.781860][ T5877] usb 1-1: new high-speed USB device number 56 using dummy_hcd [ 395.945125][ T5877] usb 1-1: New USB device found, idVendor=05ac, idProduct=b301, bcdDevice=e4.00 [ 395.965636][ T5877] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 395.998932][ T5877] usb 1-1: Product: syz [ 396.011380][ T5877] usb 1-1: Manufacturer: syz [ 396.016012][ T5877] usb 1-1: SerialNumber: syz [ 396.032677][ T5877] usb 1-1: config 0 descriptor?? [ 396.115053][T11042] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 396.241794][ T5869] usb 3-1: new high-speed USB device number 69 using dummy_hcd [ 396.405008][ T5869] usb 3-1: Using ep0 maxpacket: 8 [ 396.424006][T11042] veth0_vlan: entered promiscuous mode [ 396.430980][ T5869] usb 3-1: config 179 has an invalid descriptor of length 0, skipping remainder of the config [ 396.450700][ T5869] usb 3-1: config 179 has 0 interfaces, different from the descriptor's value: 1 [ 396.455893][T11042] veth1_vlan: entered promiscuous mode [ 396.460863][ T5869] usb 3-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 396.475695][ T5869] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 396.527505][T11042] veth0_macvtap: entered promiscuous mode [ 396.537800][T11042] veth1_macvtap: entered promiscuous mode [ 396.569382][T11042] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 396.589568][T11042] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 396.620531][ T6185] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 396.636623][ T6185] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 396.667989][ T6185] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 396.683582][ T6185] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 396.708902][ T42] usb 3-1: USB disconnect, device number 69 [ 396.833356][ T2969] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 396.865409][ T2969] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 396.940204][T11291] FAULT_INJECTION: forcing a failure. [ 396.940204][T11291] name failslab, interval 1, probability 0, space 0, times 0 [ 396.949269][ T6185] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 396.962479][ T6185] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 396.975230][T11291] CPU: 1 UID: 0 PID: 11291 Comm: syz.1.1578 Not tainted syzkaller #0 PREEMPT(full) [ 396.975258][T11291] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 396.975269][T11291] Call Trace: [ 396.975274][T11291] [ 396.975281][T11291] dump_stack_lvl+0x16c/0x1f0 [ 396.975307][T11291] should_fail_ex+0x512/0x640 [ 396.975326][T11291] ? __kmalloc_cache_noprof+0x5f/0x780 [ 396.975348][T11291] should_failslab+0xc2/0x120 [ 396.975373][T11291] __kmalloc_cache_noprof+0x72/0x780 [ 396.975389][T11291] ? __might_fault+0xe3/0x190 [ 396.975407][T11291] ? __might_fault+0x13b/0x190 [ 396.975423][T11291] ? binder_thread_write+0x2d2a/0x4e70 [ 396.975452][T11291] ? binder_thread_write+0x2d2a/0x4e70 [ 396.975475][T11291] binder_thread_write+0x2d2a/0x4e70 [ 396.975506][T11291] ? __pfx_binder_thread_write+0x10/0x10 [ 396.975527][T11291] ? binder_debug+0xde/0x1a0 [ 396.975546][T11291] ? binder_debug+0xde/0x1a0 [ 396.975561][T11291] ? __pfx_binder_debug+0x10/0x10 [ 396.975577][T11291] ? find_held_lock+0x2b/0x80 [ 396.975591][T11291] ? __might_fault+0xe3/0x190 [ 396.975606][T11291] ? __might_fault+0x13b/0x190 [ 396.975629][T11291] binder_ioctl+0x26db/0x73b0 [ 396.975657][T11291] ? tomoyo_path_number_perm+0x18d/0x580 [ 396.975683][T11291] ? __pfx_binder_ioctl+0x10/0x10 [ 396.975704][T11291] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 396.975730][T11291] ? do_vfs_ioctl+0x128/0x14f0 [ 396.975745][T11291] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 396.975760][T11291] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 396.975788][T11291] ? hook_file_ioctl_common+0x145/0x410 [ 396.975808][T11291] ? selinux_file_ioctl+0x180/0x270 [ 396.975826][T11291] ? selinux_file_ioctl+0xb4/0x270 [ 396.975846][T11291] ? __pfx_binder_ioctl+0x10/0x10 [ 396.975865][T11291] __x64_sys_ioctl+0x18e/0x210 [ 396.975882][T11291] do_syscall_64+0xcd/0xfa0 [ 396.975901][T11291] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 396.975920][T11291] RIP: 0033:0x7f1e8c98eec9 [ 396.975933][T11291] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 396.975949][T11291] RSP: 002b:00007f1e8d82e038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 396.975965][T11291] RAX: ffffffffffffffda RBX: 00007f1e8cbe5fa0 RCX: 00007f1e8c98eec9 [ 396.975974][T11291] RDX: 0000200000000480 RSI: 00000000c0306201 RDI: 0000000000000004 [ 396.975983][T11291] RBP: 00007f1e8d82e090 R08: 0000000000000000 R09: 0000000000000000 [ 396.975991][T11291] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 396.975999][T11291] R13: 00007f1e8cbe6038 R14: 00007f1e8cbe5fa0 R15: 00007ffe758813e8 [ 396.976019][T11291] [ 397.603432][T11300] usb usb8: usbfs: process 11300 (syz.3.1582) did not claim interface 0 before use [ 397.614510][T11300] trusted_key: encrypted_key: insufficient parameters specified [ 398.338532][ T5877] usb 1-1: USB disconnect, device number 56 [ 398.831527][ T5877] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 399.061374][ T5877] usb 6-1: Using ep0 maxpacket: 32 [ 399.075135][ T5877] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 399.101327][ T5877] usb 6-1: config 0 has no interfaces? [ 399.106935][ T5877] usb 6-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 399.131517][ T5877] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 399.144030][T11331] netlink: 'syz.0.1592': attribute type 21 has an invalid length. [ 399.179386][ T5877] usb 6-1: config 0 descriptor?? [ 399.180500][T11331] IPv6: NLM_F_CREATE should be specified when creating new route [ 399.357924][T11335] qnx4: no qnx4 filesystem (no root dir). [ 399.395593][T11331] IPv6: Can't replace route, no match found [ 399.661868][ T5870] usb 1-1: new high-speed USB device number 57 using dummy_hcd [ 399.817623][T11341] usb usb8: usbfs: process 11341 (syz.2.1594) did not claim interface 0 before use [ 399.829325][T11341] trusted_key: encrypted_key: insufficient parameters specified [ 399.918633][ T5870] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 399.938676][ T5870] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 399.948118][ T5934] usb 2-1: new high-speed USB device number 52 using dummy_hcd [ 399.966778][ T5870] usb 1-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 399.981036][ T5870] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 399.989561][ T5870] usb 1-1: SerialNumber: syz [ 400.152759][ T5934] usb 2-1: Using ep0 maxpacket: 8 [ 400.159378][ T5934] usb 2-1: config 179 has an invalid descriptor of length 0, skipping remainder of the config [ 400.176956][ T5934] usb 2-1: config 179 has 0 interfaces, different from the descriptor's value: 1 [ 400.736742][ T5934] usb 2-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 400.745908][ T5934] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 400.984753][ T5821] usb 2-1: USB disconnect, device number 52 [ 401.363642][T11350] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1596'. [ 401.573686][ T5821] usb 6-1: USB disconnect, device number 2 [ 402.223856][ T5821] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 402.401349][ T5821] usb 6-1: Using ep0 maxpacket: 8 [ 402.512959][ T5877] usb 2-1: new high-speed USB device number 53 using dummy_hcd [ 402.816982][ T5821] usb 6-1: New USB device found, idVendor=2770, idProduct=9120, bcdDevice=6c.77 [ 402.837220][ T5821] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=239 [ 402.855112][ T5821] usb 6-1: Product: syz [ 402.863948][ T5821] usb 6-1: Manufacturer: syz [ 402.868580][ T5821] usb 6-1: SerialNumber: syz [ 402.933185][ T5870] usb 1-1: 0:2 : does not exist [ 402.935776][ T5821] usb 6-1: config 0 descriptor?? [ 402.938115][ T5870] usb 1-1: unit 5 not found! [ 402.986064][ T5821] gspca_main: sq905-2.14.0 probing 2770:9120 [ 403.003952][ T5870] usb 1-1: USB disconnect, device number 57 [ 403.030956][ T5877] usb 2-1: New USB device found, idVendor=05ac, idProduct=b301, bcdDevice=e4.00 [ 403.063825][ T5877] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 403.064327][ T5946] udevd[5946]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 403.094212][ T5877] usb 2-1: Product: syz [ 403.108798][ T5877] usb 2-1: Manufacturer: syz [ 403.131912][ T5877] usb 2-1: SerialNumber: syz [ 403.174158][ T5877] usb 2-1: config 0 descriptor?? [ 403.278982][ T5821] gspca_sq905: sq905_command: usb_control_msg failed (-71) [ 403.302679][ T5821] sq905 6-1:0.0: probe with driver sq905 failed with error -71 [ 403.374268][ T5821] usb 6-1: USB disconnect, device number 3 [ 403.405661][T11377] usb usb8: usbfs: process 11377 (syz.0.1605) did not claim interface 0 before use [ 403.416642][T11377] trusted_key: encrypted_key: insufficient parameters specified [ 403.841459][ T5934] usb 1-1: new high-speed USB device number 58 using dummy_hcd [ 404.013580][ T5934] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023 [ 404.031353][ T5934] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A [ 404.048915][ T5934] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8A has invalid wMaxPacketSize 0 [ 404.200942][ T5821] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 404.447272][ T5934] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8A has invalid maxpacket 0 [ 404.464567][ T5934] usb 1-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 404.474271][ T5934] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 404.484131][ T5934] usb 1-1: Product: syz [ 404.488515][ T5934] usb 1-1: Manufacturer: syz [ 404.498582][ T5934] usb 1-1: SerialNumber: syz [ 404.514076][ T5821] usb 6-1: Using ep0 maxpacket: 32 [ 404.522435][ T5821] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 404.526073][ T5934] usb 1-1: config 0 descriptor?? [ 404.532980][ T5821] usb 6-1: config 0 has no interfaces? [ 404.545871][T11382] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 404.573133][ T5934] usb 1-1: ucan: probing device on interface #0 [ 404.580032][ T5934] usb 1-1: ucan: invalid in_ep MaxPacketSize [ 404.580320][ T5821] usb 6-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 404.598333][ T5934] usb 1-1: ucan: probe failed; try to update the device firmware [ 404.615545][ T5821] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 404.644392][ T5821] usb 6-1: config 0 descriptor?? [ 404.829347][ T5877] usb 2-1: USB disconnect, device number 53 [ 404.907577][T11382] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 404.947775][T11382] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 405.219420][T11408] Cannot find add_set index 0 as target [ 405.441734][ T30] audit: type=1400 audit(1760639300.764:641): avc: denied { write } for pid=11411 comm="syz.1.1616" path="socket:[33367]" dev="sockfs" ino=33367 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 405.741370][ T5806] Bluetooth: hci5: command 0x0405 tx timeout [ 405.953382][ T30] audit: type=1400 audit(1760639301.314:642): avc: denied { listen } for pid=11421 comm="syz.1.1619" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_dgram_socket permissive=1 [ 406.469446][ T5877] usb 1-1: USB disconnect, device number 58 [ 406.821979][T11435] 8021q: VLANs not supported on sit0 [ 406.870406][ T5821] usb 6-1: USB disconnect, device number 4 [ 408.507477][ T5916] usb 1-1: new high-speed USB device number 59 using dummy_hcd [ 408.699164][ T5916] usb 1-1: New USB device found, idVendor=05ac, idProduct=b301, bcdDevice=e4.00 [ 408.731908][ T5916] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 408.766980][ T5916] usb 1-1: Product: syz [ 408.771204][ T5916] usb 1-1: Manufacturer: syz [ 408.827926][ T5916] usb 1-1: SerialNumber: syz [ 408.859710][ T5916] usb 1-1: config 0 descriptor?? [ 409.195957][T11477] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1628'. [ 409.359723][T11482] netlink: 232 bytes leftover after parsing attributes in process `syz.2.1630'. [ 409.376804][T11482] xt_ecn: cannot match TCP bits for non-tcp packets [ 409.436125][T11485] tipc: Started in network mode [ 409.492837][T11485] tipc: Node identity 82953cec1678, cluster identity 4711 [ 409.602769][T11485] tipc: Enabled bearer , priority 0 [ 409.655530][T11488] syzkaller0: entered promiscuous mode [ 409.744800][T11488] syzkaller0: entered allmulticast mode [ 409.811669][ T5870] usb 3-1: new high-speed USB device number 70 using dummy_hcd [ 409.962220][ T5870] usb 3-1: Using ep0 maxpacket: 32 [ 409.972938][ T5870] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 409.999650][ T5870] usb 3-1: config 0 has no interfaces? [ 410.280040][ T5870] usb 3-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 410.303756][T11484] tipc: Resetting bearer [ 410.310373][ T5870] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 410.395793][ T5870] usb 3-1: config 0 descriptor?? [ 410.442319][T11484] tipc: Disabling bearer [ 410.613547][ T5821] tipc: Node number set to 2498575596 [ 410.798367][ T5916] usb 1-1: USB disconnect, device number 59 [ 411.261456][ T934] usb 1-1: new high-speed USB device number 60 using dummy_hcd [ 411.423862][ T934] usb 1-1: Using ep0 maxpacket: 16 [ 411.443144][ T934] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 411.467117][ T934] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 411.521328][ T934] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 411.565828][ T934] usb 1-1: New USB device found, idVendor=1781, idProduct=0898, bcdDevice= 0.00 [ 411.591334][ T934] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 411.619485][ T934] usb 1-1: config 0 descriptor?? [ 411.640771][ T934] input: PXRC Flight Controller Adapter as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/input/input49 [ 411.690424][ T5166] pxrc 1-1:0.0: pxrc_open - usb_submit_urb failed, error: -90 [ 411.800592][ T5166] pxrc 1-1:0.0: pxrc_open - usb_submit_urb failed, error: -90 [ 411.841588][ T5810] pxrc 1-1:0.0: pxrc_open - usb_submit_urb failed, error: -90 [ 411.931397][T11519] pxrc 1-1:0.0: pxrc_open - usb_submit_urb failed, error: -90 [ 412.067400][ T5166] pxrc 1-1:0.0: pxrc_open - usb_submit_urb failed, error: -90 [ 412.099371][ T5916] usb 1-1: USB disconnect, device number 60 [ 412.567158][ T934] usb 3-1: USB disconnect, device number 70 [ 412.608699][ T30] audit: type=1400 audit(1760639307.974:643): avc: denied { mounton } for pid=11566 comm="syz.3.1642" path="/329/file0" dev="binder" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 412.651873][T11568] overlayfs: The uuid=off requires a single fs for lower and upper, falling back to uuid=null. [ 412.703189][T11571] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 412.722476][ T30] audit: type=1400 audit(1760639308.024:644): avc: denied { getattr } for pid=11566 comm="syz.3.1642" name="/" dev="binder" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 412.769012][ T30] audit: type=1400 audit(1760639308.074:645): avc: denied { mounton } for pid=11566 comm="syz.3.1642" path="/329/file0" dev="overlay" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 413.384946][T11583] netlink: 44 bytes leftover after parsing attributes in process `syz.0.1648'. [ 413.412087][ T30] audit: type=1400 audit(1760639308.784:646): avc: denied { unmount } for pid=5816 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 413.780397][T11597] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1651'. [ 413.995591][ T30] audit: type=1400 audit(1760639309.334:647): avc: denied { accept } for pid=11587 comm="syz.0.1650" lport=44921 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 414.144651][ T30] audit: type=1400 audit(1760639309.484:648): avc: denied { ioctl } for pid=11602 comm="syz.2.1654" path="socket:[34621]" dev="sockfs" ino=34621 ioctlcmd=0x940c scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 414.291387][ T5821] usb 4-1: new high-speed USB device number 56 using dummy_hcd [ 414.319240][T11605] netlink: 'syz.1.1656': attribute type 1 has an invalid length. [ 414.442551][ T5821] usb 4-1: Using ep0 maxpacket: 32 [ 414.454099][ T5821] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 414.471327][ T5821] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 414.481509][T11605] bond1: entered promiscuous mode [ 414.500846][T11605] 8021q: adding VLAN 0 to HW filter on device bond1 [ 414.507666][ T5821] usb 4-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 414.531382][ T5821] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 414.646957][ T5821] usb 4-1: config 0 descriptor?? [ 415.205296][T11622] lo speed is unknown, defaulting to 1000 [ 415.494818][T11625] lo speed is unknown, defaulting to 1000 [ 415.534928][T11628] lo speed is unknown, defaulting to 1000 [ 416.829336][T11638] FAULT_INJECTION: forcing a failure. [ 416.829336][T11638] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 416.851769][T11638] CPU: 0 UID: 0 PID: 11638 Comm: syz.1.1663 Not tainted syzkaller #0 PREEMPT(full) [ 416.851796][T11638] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 416.851806][T11638] Call Trace: [ 416.851812][T11638] [ 416.851819][T11638] dump_stack_lvl+0x16c/0x1f0 [ 416.851844][T11638] should_fail_ex+0x512/0x640 [ 416.851871][T11638] _copy_from_user+0x2e/0xd0 [ 416.851894][T11638] __sys_bpf+0x248/0x4980 [ 416.851920][T11638] ? __pfx___sys_bpf+0x10/0x10 [ 416.851938][T11638] ? find_held_lock+0x2b/0x80 [ 416.851961][T11638] ? find_held_lock+0x2b/0x80 [ 416.851983][T11638] ? __mutex_unlock_slowpath+0x161/0x7b0 [ 416.852021][T11638] ? fput+0x9b/0xd0 [ 416.852037][T11638] ? ksys_write+0x1ac/0x250 [ 416.852058][T11638] ? __pfx_ksys_write+0x10/0x10 [ 416.852084][T11638] __x64_sys_bpf+0x78/0xc0 [ 416.852104][T11638] ? lockdep_hardirqs_on+0x7c/0x110 [ 416.852124][T11638] do_syscall_64+0xcd/0xfa0 [ 416.852146][T11638] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 416.852163][T11638] RIP: 0033:0x7f1e8c98eec9 [ 416.852177][T11638] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 416.852194][T11638] RSP: 002b:00007f1e8d80d038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 416.852211][T11638] RAX: ffffffffffffffda RBX: 00007f1e8cbe6090 RCX: 00007f1e8c98eec9 [ 416.852222][T11638] RDX: 0000000000000048 RSI: 0000200000000600 RDI: 000000000000000a [ 416.852232][T11638] RBP: 00007f1e8d80d090 R08: 0000000000000000 R09: 0000000000000000 [ 416.852242][T11638] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 416.852251][T11638] R13: 00007f1e8cbe6128 R14: 00007f1e8cbe6090 R15: 00007ffe758813e8 [ 416.852277][T11638] [ 417.081648][ T5870] usb 4-1: USB disconnect, device number 56 [ 417.473095][T11637] lo speed is unknown, defaulting to 1000 [ 418.407627][T11652] netlink: 40 bytes leftover after parsing attributes in process `syz.5.1667'. [ 418.542409][T11661] qnx4: no qnx4 filesystem (no root dir). [ 419.641346][ T5821] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 419.849257][ T5821] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023 [ 419.895767][ T5821] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A [ 419.954736][ T5821] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8A has invalid wMaxPacketSize 0 [ 419.999430][ T5821] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8A has invalid maxpacket 0 [ 420.070042][ T5821] usb 6-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 420.107514][ T5821] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 420.131421][ T5821] usb 6-1: Product: syz [ 420.180045][ T5821] usb 6-1: Manufacturer: syz [ 420.210832][ T5821] usb 6-1: SerialNumber: syz [ 420.249292][ T5821] usb 6-1: config 0 descriptor?? [ 420.276927][T11665] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 420.363329][ T5821] usb 6-1: ucan: probing device on interface #0 [ 420.370827][ T5821] usb 6-1: ucan: invalid in_ep MaxPacketSize [ 420.379491][ T5821] usb 6-1: ucan: probe failed; try to update the device firmware [ 420.554387][T11669] usb usb8: usbfs: process 11669 (syz.2.1672) did not claim interface 0 before use [ 420.593926][T11675] netlink: 'syz.1.1673': attribute type 3 has an invalid length. [ 420.618031][T11675] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.1673'. [ 420.639238][T11665] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 420.654421][T11665] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 420.814150][ T934] usb 3-1: new high-speed USB device number 71 using dummy_hcd [ 421.071356][ T934] usb 3-1: device descriptor read/64, error -71 [ 421.080304][ T5870] usb 6-1: USB disconnect, device number 5 [ 421.351444][ T934] usb 3-1: new high-speed USB device number 72 using dummy_hcd [ 421.491408][ T934] usb 3-1: device descriptor read/64, error -71 [ 421.631870][ T5916] usb 1-1: new high-speed USB device number 61 using dummy_hcd [ 421.631926][ T934] usb usb3-port1: attempt power cycle [ 421.815600][T11696] FAULT_INJECTION: forcing a failure. [ 421.815600][T11696] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 421.835047][ T5916] usb 1-1: New USB device found, idVendor=05ac, idProduct=b301, bcdDevice=e4.00 [ 421.870223][ T5916] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 421.875337][T11696] CPU: 0 UID: 0 PID: 11696 Comm: syz.5.1678 Not tainted syzkaller #0 PREEMPT(full) [ 421.875366][T11696] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 421.875375][T11696] Call Trace: [ 421.875381][T11696] [ 421.875387][T11696] dump_stack_lvl+0x16c/0x1f0 [ 421.875411][T11696] should_fail_ex+0x512/0x640 [ 421.875434][T11696] _copy_from_iter+0x29f/0x1720 [ 421.875455][T11696] ? __pfx_avc_has_perm+0x10/0x10 [ 421.875474][T11696] ? __pfx__copy_from_iter+0x10/0x10 [ 421.875496][T11696] ? sock_has_perm+0x259/0x2f0 [ 421.875513][T11696] ? __pfx_sock_has_perm+0x10/0x10 [ 421.875537][T11696] hci_sock_sendmsg+0x46d/0x25f0 [ 421.875561][T11696] ? __pfx_hci_sock_sendmsg+0x10/0x10 [ 421.875585][T11696] sock_write_iter+0x566/0x610 [ 421.875608][T11696] ? __pfx_sock_write_iter+0x10/0x10 [ 421.875638][T11696] ? bpf_lsm_file_permission+0x9/0x10 [ 421.875659][T11696] ? security_file_permission+0x71/0x210 [ 421.875688][T11696] ? rw_verify_area+0xcf/0x6c0 [ 421.875708][T11696] vfs_write+0x7d3/0x11d0 [ 421.875727][T11696] ? __pfx_sock_write_iter+0x10/0x10 [ 421.875751][T11696] ? __pfx_vfs_write+0x10/0x10 [ 421.875768][T11696] ? find_held_lock+0x2b/0x80 [ 421.875797][T11696] ksys_write+0x1f8/0x250 [ 421.875815][T11696] ? __pfx_ksys_write+0x10/0x10 [ 421.875840][T11696] do_syscall_64+0xcd/0xfa0 [ 421.875860][T11696] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 421.875875][T11696] RIP: 0033:0x7f51bfb8eec9 [ 421.875888][T11696] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 421.875902][T11696] RSP: 002b:00007f51c0997038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 421.875918][T11696] RAX: ffffffffffffffda RBX: 00007f51bfde5fa0 RCX: 00007f51bfb8eec9 [ 421.875928][T11696] RDX: 000000000000000d RSI: 0000200000000000 RDI: 000000000000001d [ 421.875937][T11696] RBP: 00007f51c0997090 R08: 0000000000000000 R09: 0000000000000000 [ 421.875946][T11696] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 421.875955][T11696] R13: 00007f51bfde6038 R14: 00007f51bfde5fa0 R15: 00007ffff7c6b2b8 [ 421.875979][T11696] [ 422.063972][ T934] usb 3-1: new high-speed USB device number 73 using dummy_hcd [ 422.251813][ T5916] usb 1-1: Product: syz [ 422.256212][ T5916] usb 1-1: Manufacturer: syz [ 422.282057][ T5916] usb 1-1: SerialNumber: syz [ 422.501011][ T5916] usb 1-1: config 0 descriptor?? [ 422.572193][T11701] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1680'. [ 423.001760][ C0] raw-gadget.1 gadget.2: ignoring, device is not running [ 423.009966][ T934] usb 3-1: device descriptor read/8, error -32 [ 424.402316][ T9] usb 4-1: new high-speed USB device number 57 using dummy_hcd [ 424.605334][ T5916] usb 1-1: USB disconnect, device number 61 [ 425.010291][ T9] usb 4-1: config 14 has an invalid interface number: 21 but max is 0 [ 425.021444][ T9] usb 4-1: config 14 has no interface number 0 [ 425.031968][ T9] usb 4-1: config 14 interface 21 has no altsetting 0 [ 425.048194][ T9] usb 4-1: New USB device found, idVendor=c880, idProduct=760e, bcdDevice=35.fc [ 425.081477][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 425.091646][ T9] usb 4-1: Product: syz [ 425.095853][ T9] usb 4-1: Manufacturer: syz [ 425.100441][ T9] usb 4-1: SerialNumber: syz [ 425.125892][T11737] netlink: 16 bytes leftover after parsing attributes in process `syz.5.1690'. [ 425.522488][T11744] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1692'. [ 425.621894][ T30] audit: type=1400 audit(1760639320.964:649): avc: denied { map } for pid=11739 comm="syz.1.1693" path="/332" dev="tmpfs" ino=1803 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 425.694100][T11743] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=11743 comm=syz.1.1693 [ 425.959262][T11719] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1685'. [ 426.062568][ T9] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 426.090356][ T9] usb 4-1: MIDIStreaming interface descriptor not found [ 426.507476][T11753] usb usb8: usbfs: process 11753 (syz.2.1696) did not claim interface 0 before use [ 426.539448][ T9] usb 4-1: USB disconnect, device number 57 [ 426.663622][ T6400] udevd[6400]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:14.21/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 426.766096][ T5916] usb 3-1: new high-speed USB device number 75 using dummy_hcd [ 426.922825][ T5916] usb 3-1: device descriptor read/64, error -71 [ 427.481367][ T5916] usb 3-1: new high-speed USB device number 76 using dummy_hcd [ 427.555625][T11770] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1703'. [ 427.570246][T11770] netlink: 'syz.0.1703': attribute type 22 has an invalid length. [ 427.578876][T11770] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1703'. [ 427.621896][ T69] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 427.630721][ T5916] usb 3-1: device descriptor read/64, error -71 [ 427.637258][T11770] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1703'. [ 427.651801][T11770] netlink: 'syz.0.1703': attribute type 22 has an invalid length. [ 427.654268][ T69] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 427.661876][T11770] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1703'. [ 427.729054][ T69] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 427.746152][ T69] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 427.761719][ T5916] usb usb3-port1: attempt power cycle [ 428.193997][ T5916] usb 3-1: new high-speed USB device number 77 using dummy_hcd [ 428.332094][ T5916] usb 3-1: device descriptor read/8, error -71 [ 428.516127][T11789] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=65535 sclass=netlink_route_socket pid=11789 comm=syz.5.1707 [ 428.593651][ T5916] usb 3-1: new high-speed USB device number 78 using dummy_hcd [ 428.632176][ T5916] usb 3-1: device descriptor read/8, error -71 [ 429.011640][ T5821] usb 4-1: new high-speed USB device number 58 using dummy_hcd [ 429.020012][ T42] usb 6-1: new full-speed USB device number 6 using dummy_hcd [ 429.030159][ T5916] usb usb3-port1: unable to enumerate USB device [ 429.203831][ T42] usb 6-1: config 0 has an invalid interface number: 235 but max is 0 [ 429.234993][ T42] usb 6-1: config 0 has no interface number 0 [ 429.247693][ T5821] usb 4-1: New USB device found, idVendor=05ac, idProduct=b301, bcdDevice=e4.00 [ 429.273407][ T42] usb 6-1: config 0 interface 235 altsetting 16 endpoint 0x5 has invalid wMaxPacketSize 0 [ 429.287758][ T5821] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 429.296654][ T42] usb 6-1: config 0 interface 235 has no altsetting 0 [ 429.303759][ T5821] usb 4-1: Product: syz [ 429.308124][ T5821] usb 4-1: Manufacturer: syz [ 429.313469][ T5821] usb 4-1: SerialNumber: syz [ 429.321382][ T42] usb 6-1: New USB device found, idVendor=06cd, idProduct=0112, bcdDevice=3e.18 [ 429.332000][ T42] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 429.340577][ T42] usb 6-1: Product: syz [ 429.345190][ T42] usb 6-1: Manufacturer: syz [ 429.350034][ T42] usb 6-1: SerialNumber: syz [ 429.475990][ T5821] usb 4-1: config 0 descriptor?? [ 429.490887][ T42] usb 6-1: config 0 descriptor?? [ 429.757234][ T42] keyspan 6-1:0.235: Keyspan 1 port adapter converter detected [ 429.778329][ T42] keyspan 6-1:0.235: found no endpoint descriptor for endpoint 87 [ 429.786565][ T42] keyspan 6-1:0.235: found no endpoint descriptor for endpoint 7 [ 429.797360][ T42] keyspan 6-1:0.235: found no endpoint descriptor for endpoint 81 [ 429.816476][ T42] keyspan 6-1:0.235: found no endpoint descriptor for endpoint 1 [ 429.849516][T11804] FAULT_INJECTION: forcing a failure. [ 429.849516][T11804] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 429.868190][T11804] CPU: 0 UID: 0 PID: 11804 Comm: syz.1.1710 Not tainted syzkaller #0 PREEMPT(full) [ 429.868217][T11804] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 429.868228][T11804] Call Trace: [ 429.868235][T11804] [ 429.868243][T11804] dump_stack_lvl+0x16c/0x1f0 [ 429.868270][T11804] should_fail_ex+0x512/0x640 [ 429.868297][T11804] _copy_to_user+0x32/0xd0 [ 429.868331][T11804] simple_read_from_buffer+0xcb/0x170 [ 429.868357][T11804] proc_fail_nth_read+0x197/0x240 [ 429.868383][T11804] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 429.868411][T11804] ? rw_verify_area+0xcf/0x6c0 [ 429.868429][T11804] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 429.868454][T11804] vfs_read+0x1e4/0xcf0 [ 429.868478][T11804] ? __pfx___mutex_lock+0x10/0x10 [ 429.868500][T11804] ? __pfx_vfs_read+0x10/0x10 [ 429.868528][T11804] ? __fget_files+0x20e/0x3c0 [ 429.868560][T11804] ksys_read+0x12a/0x250 [ 429.868580][T11804] ? __pfx_ksys_read+0x10/0x10 [ 429.868601][T11804] ? fput+0x9b/0xd0 [ 429.868619][T11804] do_syscall_64+0xcd/0xfa0 [ 429.868642][T11804] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 429.868660][T11804] RIP: 0033:0x7f1e8c98d8dc [ 429.868674][T11804] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 429.868692][T11804] RSP: 002b:00007f1e8d82e030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 429.868710][T11804] RAX: ffffffffffffffda RBX: 00007f1e8cbe5fa0 RCX: 00007f1e8c98d8dc [ 429.868720][T11804] RDX: 000000000000000f RSI: 00007f1e8d82e0a0 RDI: 0000000000000005 [ 429.868730][T11804] RBP: 00007f1e8d82e090 R08: 0000000000000000 R09: 0000000000000000 [ 429.868740][T11804] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 429.868749][T11804] R13: 00007f1e8cbe6038 R14: 00007f1e8cbe5fa0 R15: 00007ffe758813e8 [ 429.868774][T11804] [ 429.973829][ T42] keyspan 6-1:0.235: found no endpoint descriptor for endpoint 85 [ 430.662362][ T42] usb 6-1: Keyspan 1 port adapter converter now attached to ttyUSB0 [ 430.791545][ T9] usb 1-1: new high-speed USB device number 62 using dummy_hcd [ 430.810638][ T5821] usb 4-1: USB disconnect, device number 58 [ 430.905719][T11819] netlink: 'syz.2.1716': attribute type 1 has an invalid length. [ 430.956887][T11819] bond4: entered promiscuous mode [ 430.962754][T11819] 8021q: adding VLAN 0 to HW filter on device bond4 [ 431.043268][ T9] usb 1-1: Using ep0 maxpacket: 32 [ 431.055628][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 431.071381][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 431.090891][ T9] usb 1-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 431.126853][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 431.291392][T11829] usb usb8: usbfs: process 11829 (syz.3.1720) did not claim interface 0 before use [ 431.302173][ T9] usb 1-1: config 0 descriptor?? [ 431.361834][ T42] usb 6-1: USB disconnect, device number 6 [ 431.436243][ T42] keyspan_1 ttyUSB0: Keyspan 1 port adapter converter now disconnected from ttyUSB0 [ 431.516336][ T42] keyspan 6-1:0.235: device disconnected [ 431.576911][ T5934] usb 4-1: new high-speed USB device number 59 using dummy_hcd [ 431.603693][T11834] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1721'. [ 431.801678][ T9] savu 0003:1E7D:2D5A.000F: hiddev0,hidraw0: USB HID v0.00 Device [HID 1e7d:2d5a] on usb-dummy_hcd.0-1/input0 [ 431.851600][ T5934] usb 4-1: device descriptor read/64, error -71 [ 432.251351][ T5934] usb 4-1: new high-speed USB device number 60 using dummy_hcd [ 432.255764][ T50] Bluetooth: hci4: Frame reassembly failed (-84) [ 432.272962][ T30] audit: type=1400 audit(1760639327.614:650): avc: denied { bind } for pid=11809 comm="syz.0.1713" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 432.295181][ T30] audit: type=1400 audit(1760639327.664:651): avc: denied { listen } for pid=11809 comm="syz.0.1713" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 432.354255][T11842] Bluetooth: received HCILL_WAKE_UP_IND in state 2 [ 432.411341][ T5934] usb 4-1: device descriptor read/64, error -71 [ 432.521688][ T5934] usb usb4-port1: attempt power cycle [ 432.951346][ T5934] usb 4-1: new high-speed USB device number 61 using dummy_hcd [ 432.973648][ T5934] usb 4-1: device descriptor read/8, error -71 [ 433.197154][ T934] usb 1-1: USB disconnect, device number 62 [ 433.237206][ T5934] usb 4-1: new high-speed USB device number 62 using dummy_hcd [ 433.312356][ T5934] usb 4-1: device descriptor read/8, error -71 [ 433.438651][ T5934] usb usb4-port1: unable to enumerate USB device [ 434.301573][T11043] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 434.362984][T11867] lo speed is unknown, defaulting to 1000 [ 434.416913][ T30] audit: type=1326 audit(1760639329.784:652): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11874 comm="syz.5.1732" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f51bfb8eec9 code=0x0 [ 434.469293][T11878] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 436.485916][T11897] Cannot find add_set index 0 as target [ 437.013464][T11913] qnx4: no qnx4 filesystem (no root dir). [ 437.289152][T11912] usb usb8: usbfs: process 11912 (syz.5.1743) did not claim interface 0 before use [ 437.551344][ T934] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 437.721380][ T934] usb 6-1: device descriptor read/64, error -71 [ 437.971330][ T934] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 438.132072][ T934] usb 6-1: device descriptor read/64, error -71 [ 438.261679][ T934] usb usb6-port1: attempt power cycle [ 438.643379][ T934] usb 6-1: new high-speed USB device number 9 using dummy_hcd [ 438.733987][ T934] usb 6-1: device descriptor read/8, error -71 [ 438.910322][T11918] tipc: Enabled bearer , priority 0 [ 438.952496][T11918] syzkaller0: entered promiscuous mode [ 438.974682][T11918] syzkaller0: entered allmulticast mode [ 439.025830][T11917] tipc: Resetting bearer [ 439.027523][ T934] usb 6-1: new high-speed USB device number 10 using dummy_hcd [ 439.061998][ T934] usb 6-1: device descriptor read/8, error -71 [ 439.091714][T11917] tipc: Disabling bearer [ 439.152926][T11924] FAULT_INJECTION: forcing a failure. [ 439.152926][T11924] name failslab, interval 1, probability 0, space 0, times 0 [ 439.168141][T11924] CPU: 1 UID: 0 PID: 11924 Comm: syz.0.1746 Not tainted syzkaller #0 PREEMPT(full) [ 439.168166][T11924] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 439.168176][T11924] Call Trace: [ 439.168181][T11924] [ 439.168188][T11924] dump_stack_lvl+0x16c/0x1f0 [ 439.168220][T11924] should_fail_ex+0x512/0x640 [ 439.168240][T11924] ? trace_contention_end+0xdd/0x130 [ 439.168265][T11924] should_failslab+0xc2/0x120 [ 439.168290][T11924] kmem_cache_alloc_node_noprof+0x78/0x770 [ 439.168310][T11924] ? __alloc_skb+0x2b2/0x380 [ 439.168335][T11924] ? __alloc_skb+0x2b2/0x380 [ 439.168349][T11924] ? do_raw_spin_lock+0x12c/0x2b0 [ 439.168372][T11924] __alloc_skb+0x2b2/0x380 [ 439.168388][T11924] ? __pfx___alloc_skb+0x10/0x10 [ 439.168416][T11924] hci_sock_sendmsg+0x1a6f/0x25f0 [ 439.168443][T11924] ? __pfx_hci_sock_sendmsg+0x10/0x10 [ 439.168470][T11924] sock_write_iter+0x566/0x610 [ 439.168496][T11924] ? __pfx_sock_write_iter+0x10/0x10 [ 439.168518][T11924] ? bpf_lsm_file_permission+0x9/0x10 [ 439.168533][T11924] ? security_file_permission+0x71/0x210 [ 439.168549][T11924] ? rw_verify_area+0xcf/0x6c0 [ 439.168563][T11924] vfs_write+0x7d3/0x11d0 [ 439.168577][T11924] ? __pfx_sock_write_iter+0x10/0x10 [ 439.168594][T11924] ? __pfx_vfs_write+0x10/0x10 [ 439.168606][T11924] ? find_held_lock+0x2b/0x80 [ 439.168625][T11924] ksys_write+0x1f8/0x250 [ 439.168638][T11924] ? __pfx_ksys_write+0x10/0x10 [ 439.168655][T11924] do_syscall_64+0xcd/0xfa0 [ 439.168670][T11924] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 439.168681][T11924] RIP: 0033:0x7ff92918eec9 [ 439.168691][T11924] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 439.168702][T11924] RSP: 002b:00007ff929f4e038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 439.168712][T11924] RAX: ffffffffffffffda RBX: 00007ff9293e5fa0 RCX: 00007ff92918eec9 [ 439.168719][T11924] RDX: 000000000000000d RSI: 0000200000000000 RDI: 000000000000001d [ 439.168725][T11924] RBP: 00007ff929f4e090 R08: 0000000000000000 R09: 0000000000000000 [ 439.168731][T11924] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 439.168737][T11924] R13: 00007ff9293e6038 R14: 00007ff9293e5fa0 R15: 00007ffea2c63768 [ 439.168752][T11924] [ 439.229386][ T934] usb usb6-port1: unable to enumerate USB device [ 439.584647][ T1296] ieee802154 phy0 wpan0: encryption failed: -22 [ 439.591129][ T1296] ieee802154 phy1 wpan1: encryption failed: -22 [ 439.651360][ T42] usb 4-1: new high-speed USB device number 63 using dummy_hcd [ 439.801393][ T42] usb 4-1: Using ep0 maxpacket: 8 [ 439.822774][ T42] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 13 [ 439.842620][ T42] usb 4-1: New USB device found, idVendor=046d, idProduct=08ae, bcdDevice=11.58 [ 439.858297][ T42] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 439.909454][ T42] usb 4-1: Product: syz [ 439.966274][ T42] usb 4-1: Manufacturer: syz [ 440.117231][ T42] usb 4-1: SerialNumber: syz [ 440.141623][ T42] usb 4-1: config 0 descriptor?? [ 440.239381][ T42] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08ae [ 440.344178][T11942] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1751'. [ 440.921598][ T42] gspca_zc3xx: reg_w_i err -110 [ 441.302017][T11954] lo speed is unknown, defaulting to 1000 [ 441.461359][ T5821] usb 1-1: new high-speed USB device number 63 using dummy_hcd [ 441.511300][ T42] gspca_zc3xx: Unknown sensor - set to TAS5130C [ 441.541942][ T42] gspca_zc3xx 4-1:0.0: probe with driver gspca_zc3xx failed with error -110 [ 441.624368][ T5821] usb 1-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 441.640116][ T5821] usb 1-1: config 220 has 1 interface, different from the descriptor's value: 3 [ 441.668425][ T5821] usb 1-1: config 220 interface 0 has no altsetting 0 [ 441.706334][ T5821] usb 1-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 441.735655][ T5821] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 441.754248][ T5821] usb 1-1: Product: syz [ 441.765436][ T5821] usb 1-1: Manufacturer: syz [ 441.776643][ T5821] usb 1-1: SerialNumber: syz [ 442.202689][T11970] netlink: 16 bytes leftover after parsing attributes in process `syz.5.1760'. [ 443.056563][T11978] usb usb8: usbfs: process 11978 (syz.5.1762) did not claim interface 0 before use [ 443.182723][ T5821] uvcvideo 1-1:220.0: Found UVC 0.00 device syz (8086:0b07) [ 443.210728][ T5821] uvcvideo 1-1:220.0: No valid video chain found. [ 443.230668][ T5821] usb 1-1: USB disconnect, device number 63 [ 443.331319][ T5877] usb 6-1: new high-speed USB device number 11 using dummy_hcd [ 443.366597][ T934] usb 4-1: USB disconnect, device number 63 [ 443.483106][ T5877] usb 6-1: device descriptor read/64, error -71 [ 443.656044][T11986] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1765'. [ 443.731547][ T5877] usb 6-1: new high-speed USB device number 12 using dummy_hcd [ 444.264349][ T5877] usb 6-1: device descriptor read/64, error -71 [ 444.444633][ T5877] usb usb6-port1: attempt power cycle [ 444.901325][ T5877] usb 6-1: new high-speed USB device number 13 using dummy_hcd [ 444.951807][ T5877] usb 6-1: device descriptor read/8, error -71 [ 445.253450][ T5877] usb 6-1: new high-speed USB device number 14 using dummy_hcd [ 445.313556][ T5877] usb 6-1: device descriptor read/8, error -71 [ 445.331337][ T5821] usb 2-1: new high-speed USB device number 54 using dummy_hcd [ 445.451708][ T5877] usb usb6-port1: unable to enumerate USB device [ 445.494382][T12011] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1771'. [ 445.510384][T12011] netlink: 'syz.0.1771': attribute type 22 has an invalid length. [ 445.529285][ T5821] usb 2-1: Using ep0 maxpacket: 8 [ 445.541422][T12011] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1771'. [ 445.558288][ T5821] usb 2-1: config 179 has an invalid interface number: 65 but max is 0 [ 445.567937][ T5821] usb 2-1: config 179 has no interface number 0 [ 445.575432][T12011] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1771'. [ 445.584480][ T5821] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 445.584540][ T5821] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 445.584590][ T5821] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 445.584612][ T5821] usb 2-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 445.584650][ T5821] usb 2-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 445.584671][ T5821] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 445.596247][T12008] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 445.771846][T12011] netlink: 'syz.0.1771': attribute type 22 has an invalid length. [ 445.790288][T12011] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1771'. [ 445.917488][ T934] usb 2-1: USB disconnect, device number 54 [ 446.633305][T12025] netlink: 44 bytes leftover after parsing attributes in process `syz.5.1777'. [ 447.002910][T12028] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1778'. [ 449.890590][T12072] FAULT_INJECTION: forcing a failure. [ 449.890590][T12072] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 449.903747][T12072] CPU: 0 UID: 0 PID: 12072 Comm: syz.0.1784 Not tainted syzkaller #0 PREEMPT(full) [ 449.903773][T12072] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 449.903784][T12072] Call Trace: [ 449.903791][T12072] [ 449.903797][T12072] dump_stack_lvl+0x16c/0x1f0 [ 449.903827][T12072] should_fail_ex+0x512/0x640 [ 449.903853][T12072] _copy_from_user+0x2e/0xd0 [ 449.903878][T12072] move_addr_to_kernel+0x65/0x170 [ 449.903907][T12072] __sys_connect+0xb1/0x160 [ 449.903925][T12072] ? __pfx___sys_connect+0x10/0x10 [ 449.903952][T12072] ? __pfx_ksys_write+0x10/0x10 [ 449.903981][T12072] __x64_sys_connect+0x72/0xb0 [ 449.903997][T12072] ? lockdep_hardirqs_on+0x7c/0x110 [ 449.904018][T12072] do_syscall_64+0xcd/0xfa0 [ 449.904040][T12072] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 449.904058][T12072] RIP: 0033:0x7ff92918eec9 [ 449.904072][T12072] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 449.904090][T12072] RSP: 002b:00007ff9273f6038 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 449.904108][T12072] RAX: ffffffffffffffda RBX: 00007ff9293e6090 RCX: 00007ff92918eec9 [ 449.904120][T12072] RDX: 0000000000000008 RSI: 00002000000000c0 RDI: 0000000000000006 [ 449.904131][T12072] RBP: 00007ff9273f6090 R08: 0000000000000000 R09: 0000000000000000 [ 449.904141][T12072] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 449.904151][T12072] R13: 00007ff9293e6128 R14: 00007ff9293e6090 R15: 00007ffea2c63768 [ 449.904177][T12072] [ 450.381191][ T934] usb 6-1: new high-speed USB device number 15 using dummy_hcd [ 450.390305][T12075] nvme_fabrics: missing parameter 'transport=%s' [ 450.401337][T12075] nvme_fabrics: missing parameter 'nqn=%s' [ 450.563501][ T934] usb 6-1: Using ep0 maxpacket: 8 [ 450.731485][ T5821] usb 2-1: new high-speed USB device number 55 using dummy_hcd [ 450.851916][ T934] usb 6-1: config 179 has an invalid interface number: 65 but max is 0 [ 450.860179][ T934] usb 6-1: config 179 has no interface number 0 [ 450.891353][ T934] usb 6-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 450.901368][ T5821] usb 2-1: Using ep0 maxpacket: 32 [ 450.923753][ T5821] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 450.945819][ T934] usb 6-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 450.951374][ T5821] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 451.228657][ T934] usb 6-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 451.241349][ T934] usb 6-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 451.253336][ T934] usb 6-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 451.266687][ T934] usb 6-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 451.277038][ T934] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 451.292321][T12070] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 451.300916][ T934] xpad 6-1:179.65: probe with driver xpad failed with error -5 [ 451.465697][ T5821] usb 2-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 451.492052][ T5821] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 451.508926][ T934] usb 6-1: USB disconnect, device number 15 [ 451.534547][ T5821] usb 2-1: config 0 descriptor?? [ 451.570297][ T5821] hub 2-1:0.0: USB hub found [ 451.810462][T12078] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 451.851411][T12078] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 451.930767][ T5821] hub 2-1:0.0: config failed, can't read hub descriptor (err -22) [ 452.100635][T12094] Cannot find add_set index 0 as target [ 452.171941][ T5821] usbhid 2-1:0.0: can't add hid device: -71 [ 452.177991][ T5821] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 452.236471][ T5821] usb 2-1: USB disconnect, device number 55 [ 452.864282][T12113] FAULT_INJECTION: forcing a failure. [ 452.864282][T12113] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 452.948013][T12113] CPU: 0 UID: 0 PID: 12113 Comm: syz.2.1800 Not tainted syzkaller #0 PREEMPT(full) [ 452.948040][T12113] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 452.948052][T12113] Call Trace: [ 452.948058][T12113] [ 452.948066][T12113] dump_stack_lvl+0x16c/0x1f0 [ 452.948093][T12113] should_fail_ex+0x512/0x640 [ 452.948120][T12113] _copy_from_user+0x2e/0xd0 [ 452.948145][T12113] bpf_test_init.isra.0+0xce/0x130 [ 452.948170][T12113] bpf_prog_test_run_xdp+0x556/0x1670 [ 452.948200][T12113] ? __fget_files+0x204/0x3c0 [ 452.948226][T12113] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 452.948256][T12113] ? __might_fault+0xa0/0x190 [ 452.948282][T12113] ? fput+0x9b/0xd0 [ 452.948299][T12113] ? __bpf_prog_get+0x97/0x2a0 [ 452.948326][T12113] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 452.948349][T12113] __sys_bpf+0x1035/0x4980 [ 452.948376][T12113] ? __pfx___sys_bpf+0x10/0x10 [ 452.948396][T12113] ? find_held_lock+0x2b/0x80 [ 452.948420][T12113] ? find_held_lock+0x2b/0x80 [ 452.948444][T12113] ? __mutex_unlock_slowpath+0x161/0x7b0 [ 452.948484][T12113] ? fput+0x9b/0xd0 [ 452.948501][T12113] ? ksys_write+0x1ac/0x250 [ 452.948523][T12113] ? __pfx_ksys_write+0x10/0x10 [ 452.948550][T12113] __x64_sys_bpf+0x78/0xc0 [ 452.948571][T12113] ? lockdep_hardirqs_on+0x7c/0x110 [ 452.948593][T12113] do_syscall_64+0xcd/0xfa0 [ 452.948616][T12113] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 452.948634][T12113] RIP: 0033:0x7f43ab58eec9 [ 452.948649][T12113] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 452.948667][T12113] RSP: 002b:00007f43ac3ac038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 452.948685][T12113] RAX: ffffffffffffffda RBX: 00007f43ab7e6090 RCX: 00007f43ab58eec9 [ 452.948696][T12113] RDX: 0000000000000048 RSI: 0000200000000600 RDI: 000000000000000a [ 452.948708][T12113] RBP: 00007f43ac3ac090 R08: 0000000000000000 R09: 0000000000000000 [ 452.948718][T12113] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 452.948729][T12113] R13: 00007f43ab7e6128 R14: 00007f43ab7e6090 R15: 00007ffff4b67bc8 [ 452.948756][T12113] [ 453.223325][T12118] usb usb8: usbfs: process 12118 (syz.3.1804) did not claim interface 0 before use [ 453.621491][ T9] usb 4-1: new high-speed USB device number 64 using dummy_hcd [ 453.771553][ T9] usb 4-1: device descriptor read/64, error -71 [ 454.021330][ T9] usb 4-1: new high-speed USB device number 65 using dummy_hcd [ 454.401353][ T9] usb 4-1: device descriptor read/64, error -71 [ 454.521730][ T9] usb usb4-port1: attempt power cycle [ 454.586097][T12108] lo speed is unknown, defaulting to 1000 [ 454.652072][T12126] lo speed is unknown, defaulting to 1000 [ 454.781577][ T5934] usb 2-1: new high-speed USB device number 56 using dummy_hcd [ 454.881340][ T9] usb 4-1: new high-speed USB device number 66 using dummy_hcd [ 454.902300][ T9] usb 4-1: device descriptor read/8, error -71 [ 454.942260][ T5934] usb 2-1: Using ep0 maxpacket: 8 [ 454.961341][ T5934] usb 2-1: config 179 has an invalid interface number: 65 but max is 0 [ 454.970419][ T5934] usb 2-1: config 179 has no interface number 0 [ 455.200216][T12136] qnx4: no qnx4 filesystem (no root dir). [ 455.315328][ T5934] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 455.358743][ T5934] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 455.400304][ T5934] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 455.433650][ T5934] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 455.459247][ T9] usb 4-1: new high-speed USB device number 67 using dummy_hcd [ 455.472120][ T5934] usb 2-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 455.552159][ T9] usb 4-1: device descriptor read/8, error -71 [ 455.568014][ T5934] usb 2-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 455.600757][ T5934] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 455.661722][T12129] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 455.698190][ T9] usb usb4-port1: unable to enumerate USB device [ 455.730213][ T5934] xpad 2-1:179.65: probe with driver xpad failed with error -5 [ 455.941639][ T5869] usb 2-1: USB disconnect, device number 56 [ 460.069876][ C1] sched: DL replenish lagged too much [ 491.971367][ T5821] page_pool_release_retry() stalled pool shutdown: id 42, 50 inflight 75 sec [ 501.942159][ T1296] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.954579][ T1296] ieee802154 phy1 wpan1: encryption failed: -22 [ 542.957455][T11043] Bluetooth: hci5: command 0x0405 tx timeout [ 570.531206][ C0] rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: [ 570.538177][ C0] rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P12108/1:b..l [ 570.546732][ C0] rcu: (detected by 0, t=10503 jiffies, g=50469, q=2202 ncpus=2) [ 570.554537][ C0] task:syz.2.1800 state:R running task stack:25848 pid:12108 tgid:12106 ppid:5813 task_flags:0x400140 flags:0x00080003 [ 570.569186][ C0] Call Trace: [ 570.572482][ C0] [ 570.575416][ C0] __schedule+0x1190/0x5de0 [ 570.579927][ C0] ? __update_page_owner_handle+0x395/0x550 [ 570.585845][ C0] ? __pfx___schedule+0x10/0x10 [ 570.590719][ C0] ? mark_held_locks+0x49/0x80 [ 570.595761][ C0] preempt_schedule_irq+0x51/0x90 [ 570.600808][ C0] irqentry_exit+0x36/0x90 [ 570.605232][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 570.611208][ C0] RIP: 0010:lock_release+0x183/0x2f0 [ 570.616489][ C0] Code: 0f c1 05 38 9e 0b 12 83 f8 01 0f 85 1d 01 00 00 9c 58 f6 c4 02 0f 85 08 01 00 00 41 f7 c5 00 02 00 00 74 01 fb 48 8b 44 24 10 <65> 48 2b 05 4d 5c 0b 12 0f 85 58 01 00 00 48 83 c4 18 5b 41 5c 41 [ 570.636099][ C0] RSP: 0018:ffffc90013517178 EFLAGS: 00000206 [ 570.642351][ C0] RAX: 4b839254f74f3800 RBX: ffffffff8e3c4460 RCX: ffffc90013517184 [ 570.650319][ C0] RDX: 0000000000000005 RSI: ffffffff8dadd953 RDI: ffffffff8bf1e3c0 [ 570.658299][ C0] RBP: 0000000000000001 R08: 0000000000000001 R09: 0000000000000000 [ 570.666274][ C0] R10: 0000000000000000 R11: 0000000000010176 R12: ffffffff816c4914 [ 570.674248][ C0] R13: 0000000000000202 R14: ffff8880358e8000 R15: 0000000000000006 [ 570.682227][ C0] ? unwind_next_frame+0x3f4/0x20a0 [ 570.687478][ C0] unwind_next_frame+0x3f9/0x20a0 [ 570.692534][ C0] ? kstrdup_const+0x63/0x80 [ 570.697146][ C0] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 570.703311][ C0] arch_stack_walk+0x94/0x100 [ 570.707999][ C0] ? __kernfs_new_node+0x9b/0x8e0 [ 570.713035][ C0] stack_trace_save+0x8e/0xc0 [ 570.717715][ C0] ? __pfx_stack_trace_save+0x10/0x10 [ 570.723088][ C0] ? __lock_acquire+0x622/0x1c90 [ 570.728033][ C0] save_stack+0x160/0x1f0 [ 570.732363][ C0] ? __pfx_save_stack+0x10/0x10 [ 570.737209][ C0] ? __free_frozen_pages+0x7df/0x1160 [ 570.742574][ C0] ? __put_partials+0x130/0x170 [ 570.747422][ C0] ? qlist_free_all+0x4d/0x120 [ 570.752198][ C0] ? kasan_quarantine_reduce+0x195/0x1e0 [ 570.757836][ C0] ? __kasan_kmalloc+0x8a/0xb0 [ 570.762604][ C0] ? __kmalloc_node_track_caller_noprof+0x345/0x8a0 [ 570.769215][ C0] ? kstrdup+0x53/0x100 [ 570.773369][ C0] ? kstrdup_const+0x63/0x80 [ 570.777964][ C0] ? page_ext_put+0x3e/0xd0 [ 570.782558][ C0] __reset_page_owner+0x84/0x1a0 [ 570.787504][ C0] __free_frozen_pages+0x7df/0x1160 [ 570.792704][ C0] ? mark_held_locks+0x49/0x80 [ 570.797483][ C0] __put_partials+0x130/0x170 [ 570.802169][ C0] qlist_free_all+0x4d/0x120 [ 570.806764][ C0] kasan_quarantine_reduce+0x195/0x1e0 [ 570.812234][ C0] __kasan_kmalloc+0x8a/0xb0 [ 570.816828][ C0] __kmalloc_node_track_caller_noprof+0x345/0x8a0 [ 570.823247][ C0] ? kstrdup_const+0x63/0x80 [ 570.827845][ C0] ? kstrdup+0x53/0x100 [ 570.832005][ C0] kstrdup+0x53/0x100 [ 570.835989][ C0] kstrdup_const+0x63/0x80 [ 570.840403][ C0] __kernfs_new_node+0x9b/0x8e0 [ 570.845250][ C0] ? wake_up_q+0xae/0x130 [ 570.849581][ C0] ? __pfx___kernfs_new_node+0x10/0x10 [ 570.855041][ C0] ? find_held_lock+0x2b/0x80 [ 570.859713][ C0] ? kernfs_root+0xee/0x2a0 [ 570.864213][ C0] kernfs_new_node+0x13c/0x1e0 [ 570.868990][ C0] __kernfs_create_file+0x53/0x350 [ 570.874104][ C0] sysfs_add_file_mode_ns+0x207/0x3c0 [ 570.879504][ C0] internal_create_group+0x578/0xf30 [ 570.884819][ C0] ? __pfx_internal_create_group+0x10/0x10 [ 570.890627][ C0] ? __pfx_kobject_add+0x10/0x10 [ 570.895578][ C0] internal_create_groups+0x9d/0x150 [ 570.900864][ C0] ib_setup_port_attrs+0x41f/0x600 [ 570.905985][ C0] ? __pfx_ib_setup_port_attrs+0x10/0x10 [ 570.911630][ C0] ? __init_waitqueue_head+0xca/0x150 [ 570.917011][ C0] add_one_compat_dev+0x558/0x7d0 [ 570.922039][ C0] rdma_dev_init_net+0x2b1/0x530 [ 570.926974][ C0] ? __pfx_rdma_dev_init_net+0x10/0x10 [ 570.932459][ C0] ? ops_init+0x77/0x5f0 [ 570.936703][ C0] ? __pfx_rdma_dev_init_net+0x10/0x10 [ 570.942161][ C0] ops_init+0x1e2/0x5f0 [ 570.946321][ C0] setup_net+0x100/0x390 [ 570.950566][ C0] ? __pfx_setup_net+0x10/0x10 [ 570.955353][ C0] ? debug_mutex_init+0x37/0x70 [ 570.960224][ C0] copy_net_ns+0x2f8/0x690 [ 570.964645][ C0] create_new_namespaces+0x3ea/0xa90 [ 570.969932][ C0] unshare_nsproxy_namespaces+0xc0/0x1f0 [ 570.975568][ C0] ksys_unshare+0x45b/0xa40 [ 570.980077][ C0] ? __pfx_ksys_unshare+0x10/0x10 [ 570.985101][ C0] ? do_user_addr_fault+0x843/0x1370 [ 570.990390][ C0] __x64_sys_unshare+0x31/0x40 [ 570.995150][ C0] do_syscall_64+0xcd/0xfa0 [ 570.999656][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 571.005544][ C0] RIP: 0033:0x7f43ab58eec9 [ 571.009949][ C0] RSP: 002b:00007f43ac3cd038 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 571.018354][ C0] RAX: ffffffffffffffda RBX: 00007f43ab7e5fa0 RCX: 00007f43ab58eec9 [ 571.026317][ C0] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000062040200 [ 571.034284][ C0] RBP: 00007f43ab611f91 R08: 0000000000000000 R09: 0000000000000000 [ 571.042249][ C0] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 571.050213][ C0] R13: 00007f43ab7e6038 R14: 00007f43ab7e5fa0 R15: 00007ffff4b67bc8 [ 571.058196][ C0] [ 571.061235][ C0] rcu: rcu_preempt kthread starved for 937 jiffies! g50469 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=1 [ 571.072260][ C0] rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior. [ 571.082307][ C0] rcu: RCU grace-period kthread stack dump: [ 571.088192][ C0] task:rcu_preempt state:R running task stack:28232 pid:16 tgid:16 ppid:2 task_flags:0x208040 flags:0x00080000 [ 571.101693][ C0] Call Trace: [ 571.104996][ C0] [ 571.107932][ C0] __schedule+0x1190/0x5de0 [ 571.112450][ C0] ? __lock_acquire+0x622/0x1c90 [ 571.117417][ C0] ? __pfx___schedule+0x10/0x10 [ 571.122273][ C0] ? find_held_lock+0x2b/0x80 [ 571.126949][ C0] ? schedule+0x2d7/0x3a0 [ 571.131371][ C0] schedule+0xe7/0x3a0 [ 571.135437][ C0] schedule_timeout+0x123/0x290 [ 571.140285][ C0] ? __pfx_schedule_timeout+0x10/0x10 [ 571.145659][ C0] ? __pfx_process_timeout+0x10/0x10 [ 571.151030][ C0] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 571.156919][ C0] ? prepare_to_swait_event+0xf5/0x480 [ 571.162383][ C0] rcu_gp_fqs_loop+0x1ea/0xaf0 [ 571.167172][ C0] ? __pfx_rcu_gp_fqs_loop+0x10/0x10 [ 571.172460][ C0] ? lockdep_hardirqs_on+0x7c/0x110 [ 571.177661][ C0] ? __pfx_rcu_gp_init+0x10/0x10 [ 571.182598][ C0] ? rcu_gp_cleanup+0x7c1/0xd90 [ 571.187453][ C0] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 571.193283][ C0] rcu_gp_kthread+0x26d/0x380 [ 571.197964][ C0] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 571.203180][ C0] ? rcu_is_watching+0x12/0xc0 [ 571.207940][ C0] ? lockdep_hardirqs_on+0x7c/0x110 [ 571.213144][ C0] ? __kthread_parkme+0x19e/0x250 [ 571.218187][ C0] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 571.223391][ C0] kthread+0x3c5/0x780 [ 571.227464][ C0] ? __pfx_kthread+0x10/0x10 [ 571.232053][ C0] ? rcu_is_watching+0x12/0xc0 [ 571.236829][ C0] ? __pfx_kthread+0x10/0x10 [ 571.241417][ C0] ret_from_fork+0x675/0x7d0 [ 571.246015][ C0] ? __pfx_kthread+0x10/0x10 [ 571.250605][ C0] ret_from_fork_asm+0x1a/0x30 [ 571.255384][ C0] [ 571.258397][ C0] rcu: Stack dump where RCU GP kthread last ran: [ 571.264703][ C0] Sending NMI from CPU 0 to CPUs 1: [ 571.269988][ C1] NMI backtrace for cpu 1 [ 571.270000][ C1] CPU: 1 UID: 0 PID: 7032 Comm: kworker/u8:18 Not tainted syzkaller #0 PREEMPT(full) [ 571.270017][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 571.270027][ C1] Workqueue: wg-kex-wg0 wg_packet_handshake_send_worker [ 571.270052][ C1] RIP: 0010:mark_held_locks+0x13/0x80 [ 571.270076][ C1] Code: 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 8b 87 28 0b 00 00 85 c0 7e 5e 41 55 4c 8d af 30 0b 00 00 <41> 54 41 89 f4 55 48 89 fd 53 31 db 48 63 c3 48 8d 04 80 49 8d 74 [ 571.270090][ C1] RSP: 0018:ffffc90000a08308 EFLAGS: 00000006 [ 571.270101][ C1] RAX: 0000000000000006 RBX: ffff88802c09a480 RCX: ffffffff81c5395f [ 571.270110][ C1] RDX: 0000000000000000 RSI: 0000000000000002 RDI: ffff88802c09a480 [ 571.270119][ C1] RBP: ffff888035bdb1e0 R08: 0000000000000000 R09: 0000000000000001 [ 571.270128][ C1] R10: ffffffff90832dd7 R11: 0000000000000001 R12: dffffc0000000000 [ 571.270137][ C1] R13: ffff88802c09afb0 R14: ffff888035bdb000 R15: ffff888035bdb1e8 [ 571.270147][ C1] FS: 0000000000000000(0000) GS:ffff888124ad9000(0000) knlGS:0000000000000000 [ 571.270162][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 571.270172][ C1] CR2: 00007ffe8c14afc0 CR3: 00000000355c7000 CR4: 00000000003526f0 [ 571.270181][ C1] Call Trace: [ 571.270187][ C1] [ 571.270193][ C1] lockdep_hardirqs_on_prepare+0xb8/0x1d0 [ 571.270210][ C1] trace_hardirqs_on+0x36/0x40 [ 571.270223][ C1] ip_finish_output2+0x1ade/0x21a0 [ 571.270243][ C1] ? __ip_finish_output.part.0+0x1b4/0x350 [ 571.270264][ C1] ? __pfx_ip_finish_output2+0x10/0x10 [ 571.270283][ C1] ? __pfx_ip_skb_dst_mtu+0x10/0x10 [ 571.270300][ C1] ? __pfx_ip_finish_output+0x10/0x10 [ 571.270320][ C1] __ip_finish_output.part.0+0x1b4/0x350 [ 571.270340][ C1] ip_output+0x35f/0xa90 [ 571.270358][ C1] ip_local_out+0x38d/0x4d0 [ 571.270378][ C1] synproxy_send_tcp.isra.0+0x491/0x6a0 [ 571.270399][ C1] synproxy_send_client_synack+0x6f6/0x8f0 [ 571.270419][ C1] ? __pfx_synproxy_send_client_synack+0x10/0x10 [ 571.270437][ C1] ? nft_socket_cgroup_subtree_level+0x2c8/0x3e0 [ 571.270459][ C1] nft_synproxy_do_eval+0xa63/0xd80 [ 571.270481][ C1] ? __pfx_nft_synproxy_do_eval+0x10/0x10 [ 571.270501][ C1] ? do_raw_spin_lock+0x12c/0x2b0 [ 571.270520][ C1] ? find_held_lock+0x2b/0x80 [ 571.270535][ C1] ? __pfx_nft_synproxy_eval+0x10/0x10 [ 571.270554][ C1] nft_do_chain+0x2e9/0x1920 [ 571.270576][ C1] ? __pfx_nft_do_chain+0x10/0x10 [ 571.270593][ C1] ? mark_held_locks+0x49/0x80 [ 571.270609][ C1] ? lockdep_hardirqs_on+0x7c/0x110 [ 571.270629][ C1] ? lockdep_hardirqs_on+0x7c/0x110 [ 571.270644][ C1] ? ipt_do_table+0xd48/0x1ae0 [ 571.270664][ C1] nft_do_chain_inet+0x18a/0x340 [ 571.270682][ C1] ? __pfx_nft_do_chain_inet+0x10/0x10 [ 571.270700][ C1] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 571.270722][ C1] ? __pfx_ipt_do_table+0x10/0x10 [ 571.270736][ C1] ? nf_nat_ipv4_local_in+0x181/0x720 [ 571.270751][ C1] ? __pfx_nft_do_chain_inet+0x10/0x10 [ 571.270768][ C1] nf_hook_slow+0xbe/0x200 [ 571.270785][ C1] nf_hook.constprop.0+0x424/0x750 [ 571.270800][ C1] ? __pfx_ip_local_deliver_finish+0x10/0x10 [ 571.270816][ C1] ? __pfx_nf_hook.constprop.0+0x10/0x10 [ 571.270831][ C1] ? __pfx_ip_rcv_finish+0x10/0x10 [ 571.270847][ C1] ? __pfx_ip_local_deliver_finish+0x10/0x10 [ 571.270866][ C1] ip_local_deliver+0x169/0x1f0 [ 571.270882][ C1] ip_rcv+0x2e0/0x600 [ 571.270896][ C1] ? __pfx_ip_rcv+0x10/0x10 [ 571.270910][ C1] __netif_receive_skb_one_core+0x197/0x1e0 [ 571.270924][ C1] ? __pfx___netif_receive_skb_one_core+0x10/0x10 [ 571.270939][ C1] ? lock_acquire+0x179/0x350 [ 571.270957][ C1] ? process_backlog+0x3e7/0x15e0 [ 571.270969][ C1] __netif_receive_skb+0x1d/0x160 [ 571.270983][ C1] process_backlog+0x439/0x15e0 [ 571.270999][ C1] __napi_poll.constprop.0+0xba/0x550 [ 571.271012][ C1] ? skb_defer_free_flush+0x149/0x280 [ 571.271030][ C1] net_rx_action+0x97f/0xef0 [ 571.271046][ C1] ? __pfx_net_rx_action+0x10/0x10 [ 571.271064][ C1] ? __print_lock_name+0xb0/0xe0 [ 571.271078][ C1] ? kvm_sched_clock_read+0x11/0x20 [ 571.271092][ C1] ? sched_clock+0x38/0x60 [ 571.271106][ C1] ? sched_clock_cpu+0x6c/0x530 [ 571.271126][ C1] ? mark_held_locks+0x49/0x80 [ 571.271143][ C1] handle_softirqs+0x219/0x8e0 [ 571.271165][ C1] ? __pfx_handle_softirqs+0x10/0x10 [ 571.271186][ C1] ? mod_peer_timer+0x16f/0x2c0 [ 571.271207][ C1] do_softirq+0xb2/0xf0 [ 571.271219][ C1] [ 571.271223][ C1] [ 571.271228][ C1] __local_bh_enable_ip+0x100/0x120 [ 571.271241][ C1] wg_timers_any_authenticated_packet_traversal+0x96/0xc0 [ 571.271262][ C1] wg_packet_send_handshake_initiation+0x1cc/0x360 [ 571.271283][ C1] ? __pfx_wg_packet_send_handshake_initiation+0x10/0x10 [ 571.271313][ C1] wg_packet_handshake_send_worker+0x1c/0x30 [ 571.271333][ C1] process_one_work+0x9cf/0x1b70 [ 571.271354][ C1] ? __pfx_flush_memcg_stats_dwork+0x10/0x10 [ 571.271376][ C1] ? __pfx_process_one_work+0x10/0x10 [ 571.271397][ C1] ? assign_work+0x1a0/0x250 [ 571.271415][ C1] worker_thread+0x6c8/0xf10 [ 571.271438][ C1] ? __pfx_worker_thread+0x10/0x10 [ 571.271456][ C1] kthread+0x3c5/0x780 [ 571.271473][ C1] ? __pfx_kthread+0x10/0x10 [ 571.271491][ C1] ? rcu_is_watching+0x12/0xc0 [ 571.271504][ C1] ? __pfx_kthread+0x10/0x10 [ 571.271521][ C1] ret_from_fork+0x675/0x7d0 [ 571.271537][ C1] ? __pfx_kthread+0x10/0x10 [ 571.271553][ C1] ret_from_fork_asm+0x1a/0x30 [ 571.271573][ C1] [ 575.115083][ T42] page_pool_release_retry() stalled pool shutdown: id 42, 50 inflight 159 sec