last executing test programs: 1m22.443972701s ago: executing program 4 (id=914): socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, 0x0, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r2, 0x8933, &(0x7f0000000000)={'batadv_slave_1\x00'}) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=ANY=[@ANYBLOB="54000000100003040000820000fcdbdf25000074", @ANYRES32=0x0, @ANYBLOB="1018000007500500340012800b0001006272696467650000240002800500170000000000080004008400000005001600010000000500260001000000"], 0x54}, 0x1, 0x0, 0x0, 0x800}, 0x4800) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=ANY=[], 0x38}, 0x1, 0x0, 0x0, 0x58840}, 0x0) ioctl$sock_SIOCGIFVLAN_DEL_VLAN_CMD(r0, 0x8982, &(0x7f0000000140)={0x1, 'ip6tnl0\x00', {}, 0x7ff}) ioctl$VIDIOC_G_EXT_CTRLS(0xffffffffffffffff, 0xc0205649, &(0x7f00000000c0)={0x4, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x0, 0x0, '\x00', @string=&(0x7f0000000540)=0x8}}) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x101, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) r4 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r4, &(0x7f0000000400)={0x18, 0x0, {0x4, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1a}, 'lo\x00'}}, 0x1e) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=ANY=[@ANYRES64=r1, @ANYRES32=0x0, @ANYRES32=r4], 0x28}}, 0x0) r6 = socket$inet6_sctp(0xa, 0x1, 0x84) r7 = dup(r6) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r7, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @empty, 0x3}], 0x1c) sendmsg$inet6(r6, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0x8, @loopback, 0x4}, 0x1c, &(0x7f0000000380)=[{&(0x7f00000000c0)="80", 0x1}], 0x1}, 0x4048043) r8 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r8, 0x84, 0xd, &(0x7f0000000180)=@assoc_value, 0x0) setsockopt$inet_sctp6_SCTP_AUTH_DEACTIVATE_KEY(r7, 0x84, 0x23, &(0x7f0000000100)={0x0, 0x3}, 0x8) connect$pppoe(r4, &(0x7f0000000040)={0x18, 0x0, {0x0, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x15}, 'lo\x00'}}, 0x1e) syz_emit_ethernet(0x4e, &(0x7f0000000480)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff86dd64fde9e200180000fc010000000000000000000000010000000000000000e5000000ffffac1414aa3b02010300000000fc010000000000000000000000000001142898668544aeedc06d4d65e229b6c2c2d4dd10527981d07d5b7896f6e65a784c84369f0000000040372221650f22cd5177cd0600000000000000"], 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000c00)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03080000000000000000070000000900010073797a30000000003c000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a30000000000800054000000021440000000c0a09030000000000000000070000000900020073797a31000000000900010073797a300000000018000380140000800800034000000002050006405200000014000000110001"], 0xc8}, 0x1, 0x0, 0x0, 0x4000010}, 0x4000804) openat$vim2m(0xffffffffffffff9c, &(0x7f00000003c0), 0x2, 0x0) 1m20.975152751s ago: executing program 4 (id=919): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) shutdown(r0, 0x1) userfaultfd(0x1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat$qat_adf_ctl(0xffffffffffffff9c, 0x0, 0xe0d00, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, &(0x7f0000000140)={0x2, 0x1}, 0x2) r3 = socket$inet(0x2, 0x3, 0x9) shutdown(r3, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000140), 0x40000000040201, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) r4 = fsopen(&(0x7f00000000c0)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r4, 0x6, 0x0, 0x0, 0x0) ioctl$FS_IOC_FSSETXATTR(r1, 0x401c5820, &(0x7f0000000440)={0x80000000, 0xc011, 0x462}) r5 = fsmount(r4, 0x0, 0x0) r6 = openat$cgroup_subtree(r5, &(0x7f0000000100), 0x2, 0x0) write$cgroup_subtree(r6, &(0x7f0000000040)={[{0x2b, 'cpuset'}]}, 0x8) syz_clone(0x8a140600, &(0x7f00000001c0)="07b5e42d30226aba87697ce3ff665d7cb4bdf0381b74230609ad5a0c5b8a9d5c2f3277994317083b76b0aedef0afef4267cf265f61c257cdf6b2b4f80e41dc603103f166", 0x44, &(0x7f0000000240), &(0x7f0000000340), &(0x7f0000000380)="646a21c1314836dab1375dc5370b85967842427f74c7fdda0fb7ef9233f6099289037fa8ede14a0147999b5b523275ef4abe7ff27941f54759b8ecf4d9f02b8e7d4d9dfadc80893ce8f09ba0bcc31b1ba7191c0c1c71e4bb4b162e670308b4d33e0f02aa5e24636f9c2d0db8a006018c1225f05d35d6e969f5fabf0a8c6ba2ea8675fa596d5d008285bc2bc52fea5fdafb52bfa310ecb3056c7f3288") sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000001100)={0x0}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000580), 0x80802, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f00000002c0)='children\x00') bind$inet6(r0, &(0x7f0000000240)={0xa, 0x4e20, 0x2, @ipv4={'\x00', '\xff\xff', @loopback}, 0x5}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000000140)=[{{&(0x7f0000000100)={0xa, 0x4e20, 0x2, @empty, 0xfefffffe}, 0x1c, 0x0}}], 0x1, 0x20080058) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000000)={&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0}, &(0x7f0000000080)=0x40) 1m18.350193382s ago: executing program 4 (id=928): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f00000000c0)=@req={0x8000, 0xb4f, 0x300, 0x1daf6}, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000600)=ANY=[@ANYBLOB="3001000040000100fcff07000400000001000000040048800c010180390018800c0045003a5b29f5215dbf00e868069c9ab125eac194db0b6bb732fae1af8cddffb89c30168faebd40cfdda30440ecd3d73e174817000000920098adfe24ad89a5d919ccc197c48c1f7168d82ca6ee1c32ee125eb967e5da08c94f1662fdce05ed89f78c96401e0de0bd596f1bf5140ea5bc41852e67d87074ab8e1419a1849b934d7283e8c502d7c32f0e133c8fd89f287f32f0e37357db54db0f368638643eaf83fefadfc325c76f95ada1df70d8f818146cab78a851b06b53221c843d6e7872d5a574d590b102b24df661ed3ffaa259e5b9ec0b340463f328009be8b436902677e8ecb61b0b3fe984a1d1ce507a39c7cbd8d0b04759e1004741b00c000200"/304], 0x130}, 0x1, 0x0, 0x0, 0x400c801}, 0x4008094) r2 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0xc, &(0x7f0000000040)={0x6}, 0x10) r3 = syz_open_dev$dvb_demux(&(0x7f0000001e00), 0x0, 0x2000) r4 = syz_open_dev$dvb_demux(&(0x7f0000000080), 0x0, 0x41) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r4, 0x40146f2c, &(0x7f0000000100)={0x2, 0x1, 0x3, 0x14, 0x4}) ioctl$DVB_DEMUX_DMX_SET_FILTER(r3, 0x403c6f2b, &(0x7f0000001e40)={0x6, {"2ac78e02ff04856af9fb71f0d3fe13be", "3dfab043e15fad27a639f105b5e9f977", "47eb0b1889b90f105d66b3e5a7c94742"}, 0x4, 0x4}) ioctl$DVB_DEMUX_DMX_SET_FILTER(r3, 0x403c6f2b, &(0x7f00000001c0)={0x401, {"ac0e6bc507fae10f0cabd07969a0a850", "5b0b1778095b1bc658889b108a3b2b39", "9041c3b5d94e4fbe421b980141e57c01"}, 0x906, 0x5}) r5 = socket(0xa, 0x5, 0x0) setsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(r5, 0x84, 0xc, 0x0, 0x0) write(r2, &(0x7f0000000280)="1c0000001a009b8a3c90f4ae0009042400000000ff02000000000000", 0x1c) recvmmsg$unix(r2, &(0x7f0000006440)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81ff}}], 0x11, 0x10002, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r6, &(0x7f00000bd000), 0x318, 0x0) recvmmsg$unix(r6, &(0x7f0000001a00)=[{{&(0x7f0000000100)=@abs, 0x6e, &(0x7f0000000240)=[{&(0x7f0000000180)=""/114, 0x72}, {&(0x7f00000002c0)=""/167, 0xa7}, {&(0x7f0000000080)}, {&(0x7f0000000380)=""/4096, 0x1000}, {&(0x7f0000000200)=""/42, 0x2a}], 0x5, &(0x7f0000001380)=[@rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x18}}, @cred={{0x18}}, @cred={{0x18}}, @cred={{0x18}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x18}}], 0xb4}}, {{0x0, 0x0, &(0x7f00000016c0)=[{&(0x7f0000001440)=""/197, 0xc5}, {&(0x7f0000001540)=""/236, 0xec}, {&(0x7f0000001640)=""/111, 0x6f}], 0x3}}, {{&(0x7f0000001700), 0x6e, &(0x7f0000001980)=[{&(0x7f0000001780)=""/64, 0x40}, {&(0x7f00000017c0)=""/140, 0x8c}, {&(0x7f0000001880)=""/253, 0xfd}], 0x3, &(0x7f00000019c0)=[@rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x1c}}], 0x3, 0x10000, &(0x7f0000001a80)={0x77359400}) 1m16.591642896s ago: executing program 4 (id=932): openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) (async) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) r1 = syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000002200)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}}, 0x0, 0x0, 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) prctl$PR_GET_SECCOMP(0x15) (async) prctl$PR_GET_SECCOMP(0x15) ioctl$AUTOFS_IOC_ASKUMOUNT(r1, 0x80049370, &(0x7f0000000080)) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x9801) move_mount(r3, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) openat2$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000380)={0x28880, 0x0, 0x12}, 0x18) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r3, 0xc25c4111, &(0x7f00000003c0)={0x7bad, [[0x7, 0x3b00000, 0x7, 0x3, 0x3ff4, 0x800, 0x615f, 0x2], [0x6, 0x8000, 0x7, 0x4, 0xffff0000, 0x5, 0x6, 0x5], [0x3, 0x8, 0x9, 0x3, 0x7ff, 0x6, 0x4, 0x80]], '\x00', [{0x7, 0x61d1, 0x0, 0x1, 0x0, 0x1}, {0x80000000, 0x7, 0x0, 0x1, 0x0, 0x1}, {0x6, 0x9, 0x0, 0x0, 0x1}, {0x3ff, 0x5, 0x0, 0x1, 0x0, 0x1}, {0x2, 0x6, 0x1, 0x0, 0x1}, {0x6, 0x9, 0x0, 0x1, 0x1}, {0x6, 0x8, 0x1, 0x1}, {0xa4, 0x8000}, {0x10000006, 0x4, 0x1}, {0x4, 0x0, 0x1, 0x0, 0x0, 0x1}, {0x3, 0x5, 0x1, 0x0, 0x0, 0x1}, {0xfffffffe, 0x9, 0x0, 0x0, 0x1, 0x1}], '\x00', 0x1ff}) (async) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r3, 0xc25c4111, &(0x7f00000003c0)={0x7bad, [[0x7, 0x3b00000, 0x7, 0x3, 0x3ff4, 0x800, 0x615f, 0x2], [0x6, 0x8000, 0x7, 0x4, 0xffff0000, 0x5, 0x6, 0x5], [0x3, 0x8, 0x9, 0x3, 0x7ff, 0x6, 0x4, 0x80]], '\x00', [{0x7, 0x61d1, 0x0, 0x1, 0x0, 0x1}, {0x80000000, 0x7, 0x0, 0x1, 0x0, 0x1}, {0x6, 0x9, 0x0, 0x0, 0x1}, {0x3ff, 0x5, 0x0, 0x1, 0x0, 0x1}, {0x2, 0x6, 0x1, 0x0, 0x1}, {0x6, 0x9, 0x0, 0x1, 0x1}, {0x6, 0x8, 0x1, 0x1}, {0xa4, 0x8000}, {0x10000006, 0x4, 0x1}, {0x4, 0x0, 0x1, 0x0, 0x0, 0x1}, {0x3, 0x5, 0x1, 0x0, 0x0, 0x1}, {0xfffffffe, 0x9, 0x0, 0x0, 0x1, 0x1}], '\x00', 0x1ff}) 1m15.527946165s ago: executing program 4 (id=940): r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x20, 0x5ac, 0x269, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0xf8, 0xb, "", [{{0x9, 0x4, 0x0, 0x9, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0xa, 0x0, 0x1, {0x22, 0x1e3}}, {{{0x9, 0x5, 0x81, 0x3, 0x38d707d343173689, 0x5, 0xa, 0x70}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(0xffffffffffffffff, 0x0, &(0x7f0000000400)={0x18, 0x0, 0x0, 0x0, &(0x7f0000000380), 0x0}) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) r5 = openat$tcp_mem(0xffffff9c, &(0x7f0000000340)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0) fdatasync(r5) ioctl$KVM_CREATE_PIT2(r4, 0x4040ae77, &(0x7f0000000040)) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000000)={[0x800038, 0x7, 0x3, 0x180, 0x6, 0x10, 0xf1, 0x100000001, 0x1, 0xca0, 0xffffffffffffffff, 0x2000000002c, 0x0, 0x6, 0x0, 0xbd9], 0xffff1001, 0x43100}) r6 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r6, 0x4090ae82, &(0x7f00000003c0)={[0x7, 0x1000000000, 0x0, 0x200000000000043, 0x2000004, 0x0, 0x2004cb, 0x7ff, 0xa7c, 0x68ff, 0x7, 0x100008000000006, 0x803, 0x0, 0x9], 0xeeee8000, 0x202}) ioctl$KVM_SET_SREGS(0xffffffffffffffff, 0x4138ae84, &(0x7f00000001c0)={{0x3000, 0x1, 0x8, 0x8, 0xb, 0xe6, 0x40, 0x0, 0x0, 0x81, 0x80}, {0x5000, 0x3000, 0x3, 0xff, 0x42, 0x9, 0x75, 0x6, 0x36, 0x0, 0x2, 0xb4}, {0x40000, 0xdddd0000, 0xe, 0x5, 0x3, 0x7, 0x0, 0x21, 0x1, 0xa2, 0x5, 0x5}, {0x200000, 0xeeee0000, 0x9, 0x7, 0x5, 0x42, 0xb, 0xff, 0x8, 0x7, 0xe, 0x7}, {0xf000, 0x1000, 0xf, 0x3, 0x16, 0x7, 0xab, 0xb, 0xc, 0x9, 0xf7, 0x97}, {0xeeefa000, 0xdddd0000, 0x6, 0xa0, 0xb, 0x8, 0x1, 0xa8, 0x82, 0x2, 0x1, 0x7}, {0xeeee8000, 0x3000, 0xf, 0x5, 0x7, 0x5, 0x7, 0x3, 0x8, 0x0, 0x40, 0x74}, {0xdddd0000, 0x25000, 0xa, 0x5, 0xcd, 0x7, 0x1, 0x9, 0x2, 0xc, 0xb0, 0xa1}, {0xeeee0000, 0x30}, {0x40000, 0x7}, 0xa0000039, 0x0, 0x4, 0x2024, 0x2, 0x0, 0x100000, [0x6800000000000000, 0x4, 0x3, 0x8]}) ioctl$KVM_RUN(r6, 0xae80, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) ioctl$KVM_SET_ONE_REG(r7, 0x4048aecb, &(0x7f0000000540)=@arm64_ccsidr={0x6020000000110005, 0x0}) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x22, 0x371, {0x9}}}, &(0x7f0000000080)={0xffffffffffffffeb, 0x0, 0x0, 0x0, 0x0, 0x0}) r8 = socket$unix(0x1, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000003880)={0x0, 0x0}) recvmmsg$unix(r8, &(0x7f0000003780)=[{{&(0x7f0000000100)=@abs, 0x6e, &(0x7f0000000000)=[{&(0x7f0000000240)=""/100, 0x64}], 0x1, &(0x7f00000002c0)=[@cred={{0x18}}, @cred={{0x18}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x48}}, {{&(0x7f0000000440), 0x6e, &(0x7f0000000180)=[{&(0x7f0000000580)=""/160, 0xa0}], 0x1, &(0x7f0000000340)}}, {{&(0x7f00000004c0), 0x6e, &(0x7f0000000b00)=[{&(0x7f0000000640)=""/253, 0xfd}, {&(0x7f0000000740)=""/132, 0x84}, {0xfffffffffffffffe}, {&(0x7f0000000800)=""/156, 0x9c}, {&(0x7f0000002600)=""/74, 0x4a}, {&(0x7f00000008c0)=""/248, 0xf8}, {&(0x7f00000009c0)=""/255, 0xff}, {&(0x7f0000000ac0)=""/7, 0x7}], 0x8, &(0x7f0000000b40)=[@cred={{0x18}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x34}}, {{&(0x7f0000000b80)=@abs, 0x6e, &(0x7f0000000c40)=[{&(0x7f0000000c00)=""/61, 0x3d}], 0x1}}, {{&(0x7f0000000c80), 0x6e, &(0x7f00000010c0)=[{&(0x7f0000000d00)=""/74, 0x4a}, {&(0x7f0000000d80)=""/93, 0x5d}, {&(0x7f0000000e00)=""/82, 0x52}, {&(0x7f0000000e80)=""/24, 0x18}, {&(0x7f0000000ec0)=""/244, 0xf4}, {&(0x7f0000002680)=""/214, 0xd6}], 0x6, &(0x7f0000001100)=[@cred={{0x18}}, @cred={{0x18}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}], 0x44}}, {{0x0, 0x0, &(0x7f00000023c0)=[{&(0x7f0000001180)=""/127, 0x7f}, {&(0x7f0000001200)=""/113, 0x71}, {&(0x7f0000001280)=""/4096, 0x1000}, {&(0x7f0000002280)=""/144, 0x90}, {&(0x7f0000002340)=""/84, 0x54}], 0x5}}, {{&(0x7f0000002400), 0x6e, &(0x7f0000002540)=[{&(0x7f0000002480)=""/169, 0xa9}], 0x1, &(0x7f0000002580)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x50}}, {{0x0, 0x0, &(0x7f0000003680)=[{0x0}, {&(0x7f0000003600)=""/103, 0x67}], 0x2, &(0x7f00000036c0)=[@rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x18}}, @cred={{0x18}}, @cred={{0x18}}, @cred={{0x18}}], 0x90}}], 0x8, 0x10040, &(0x7f00000038c0)={r9, r10+60000000}) 1m14.631916803s ago: executing program 4 (id=942): r0 = fsopen(&(0x7f00000000c0)='msdos\x00', 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000480)=""/74, 0x4a) dup3(r1, r0, 0x0) 1m14.052295364s ago: executing program 32 (id=942): r0 = fsopen(&(0x7f00000000c0)='msdos\x00', 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000480)=""/74, 0x4a) dup3(r1, r0, 0x0) 13.873681439s ago: executing program 5 (id=1146): r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x20, 0x5ac, 0x269, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0xf8, 0xb, "", [{{0x9, 0x4, 0x0, 0x9, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0xa, 0x0, 0x1, {0x22, 0x1e3}}, {{{0x9, 0x5, 0x81, 0x3, 0x38d707d343173689, 0x5, 0xa, 0x70}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(0xffffffffffffffff, 0x0, &(0x7f0000000400)={0x18, 0x0, 0x0, 0x0, &(0x7f0000000380), 0x0}) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) r5 = openat$tcp_mem(0xffffff9c, &(0x7f0000000340)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0) fdatasync(r5) ioctl$KVM_CREATE_PIT2(r4, 0x4040ae77, &(0x7f0000000040)) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000000)={[0x800038, 0x7, 0x3, 0x180, 0x6, 0x10, 0xf1, 0x100000001, 0x1, 0xca0, 0xffffffffffffffff, 0x2000000002c, 0x0, 0x6, 0x0, 0xbd9], 0xffff1001, 0x43100}) r6 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r6, 0x4090ae82, &(0x7f00000003c0)={[0x7, 0x1000000000, 0x0, 0x200000000000043, 0x2000004, 0x0, 0x2004cb, 0x7ff, 0xa7c, 0x68ff, 0x7, 0x100008000000006, 0x803, 0x0, 0x9], 0xeeee8000, 0x202}) ioctl$KVM_SET_SREGS(0xffffffffffffffff, 0x4138ae84, &(0x7f00000001c0)={{0x3000, 0x1, 0x8, 0x8, 0xb, 0xe6, 0x40, 0x0, 0x0, 0x81, 0x80}, {0x5000, 0x3000, 0x3, 0xff, 0x42, 0x9, 0x75, 0x6, 0x36, 0x0, 0x2, 0xb4}, {0x40000, 0xdddd0000, 0xe, 0x5, 0x3, 0x7, 0x0, 0x21, 0x1, 0xa2, 0x5, 0x5}, {0x200000, 0xeeee0000, 0x9, 0x7, 0x5, 0x42, 0xb, 0xff, 0x8, 0x7, 0xe, 0x7}, {0xf000, 0x1000, 0xf, 0x3, 0x16, 0x7, 0xab, 0xb, 0xc, 0x9, 0xf7, 0x97}, {0xeeefa000, 0xdddd0000, 0x6, 0xa0, 0xb, 0x8, 0x1, 0xa8, 0x82, 0x2, 0x1, 0x7}, {0xeeee8000, 0x3000, 0xf, 0x5, 0x7, 0x5, 0x7, 0x3, 0x8, 0x0, 0x40, 0x74}, {0xdddd0000, 0x25000, 0xa, 0x5, 0xcd, 0x7, 0x1, 0x9, 0x2, 0xc, 0xb0, 0xa1}, {0xeeee0000, 0x30}, {0x40000, 0x7}, 0xa0000039, 0x0, 0x4, 0x2024, 0x2, 0x0, 0x100000, [0x6800000000000000, 0x4, 0x3, 0x8]}) ioctl$KVM_RUN(r6, 0xae80, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) ioctl$KVM_SET_ONE_REG(r7, 0x4048aecb, &(0x7f0000000540)=@arm64_ccsidr={0x6020000000110005, 0x0}) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x22, 0x371, {0x9}}}, &(0x7f0000000080)={0xffffffffffffffeb, 0x0, 0x0, 0x0, 0x0, 0x0}) r8 = socket$unix(0x1, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000003880)={0x0, 0x0}) recvmmsg$unix(r8, &(0x7f0000003780)=[{{&(0x7f0000000100)=@abs, 0x6e, &(0x7f0000000000)=[{&(0x7f0000000240)=""/100, 0x64}], 0x1, &(0x7f00000002c0)=[@cred={{0x18}}, @cred={{0x18}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x48}}, {{&(0x7f0000000440), 0x6e, &(0x7f0000000180)=[{&(0x7f0000000580)=""/160, 0xa0}], 0x1, &(0x7f0000000340)}}, {{&(0x7f00000004c0), 0x6e, &(0x7f0000000b00)=[{&(0x7f0000000640)=""/253, 0xfd}, {&(0x7f0000000740)=""/132, 0x84}, {0xfffffffffffffffe}, {&(0x7f0000000800)=""/156, 0x9c}, {&(0x7f0000002600)=""/74, 0x4a}, {&(0x7f00000008c0)=""/248, 0xf8}, {&(0x7f00000009c0)=""/255, 0xff}, {&(0x7f0000000ac0)=""/7, 0x7}], 0x8, &(0x7f0000000b40)=[@cred={{0x18}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x34}}, {{&(0x7f0000000b80)=@abs, 0x6e, &(0x7f0000000c40)=[{&(0x7f0000000c00)=""/61, 0x3d}], 0x1}}, {{&(0x7f0000000c80), 0x6e, &(0x7f00000010c0)=[{&(0x7f0000000d00)=""/74, 0x4a}, {&(0x7f0000000d80)=""/93, 0x5d}, {&(0x7f0000000e00)=""/82, 0x52}, {&(0x7f0000000e80)=""/24, 0x18}, {&(0x7f0000000ec0)=""/244, 0xf4}, {&(0x7f0000002680)=""/214, 0xd6}], 0x6, &(0x7f0000001100)=[@cred={{0x18}}, @cred={{0x18}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}], 0x44}}, {{0x0, 0x0, &(0x7f00000023c0)=[{&(0x7f0000001180)=""/127, 0x7f}, {&(0x7f0000001200)=""/113, 0x71}, {&(0x7f0000001280)=""/4096, 0x1000}, {&(0x7f0000002280)=""/144, 0x90}, {&(0x7f0000002340)=""/84, 0x54}], 0x5}}, {{&(0x7f0000002400), 0x6e, &(0x7f0000002540)=[{&(0x7f0000002480)=""/169, 0xa9}], 0x1, &(0x7f0000002580)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x50}}, {{0x0, 0x0, &(0x7f0000003680)=[{&(0x7f0000003900)=""/4096, 0x1000}, {&(0x7f0000003600)=""/103, 0x67}], 0x2, &(0x7f00000036c0)=[@rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x18}}, @cred={{0x18}}, @cred={{0x18}}], 0x78}}], 0x8, 0x10040, &(0x7f00000038c0)={r9, r10+60000000}) 12.156486634s ago: executing program 3 (id=1151): r0 = socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, r0) sched_setattr(0x0, &(0x7f00000001c0)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x19, 0x0, 0xe, 0xfa11, 0xffffffff}, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) openat2$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) openat$sequencer2(0xffffff9c, &(0x7f0000000080), 0x200080, 0x0) r3 = openat$ppp(0xffffffffffffff9c, 0x0, 0x48a200, 0x0) ioctl$PPPIOCNEWUNIT(r3, 0xc004743e, &(0x7f0000000140)) readv(r3, &(0x7f00000006c0)=[{&(0x7f0000000580)=""/90, 0x5a}], 0x1) bpf$PROG_LOAD(0x5, 0x0, 0x0) r4 = socket$inet_sctp(0x2, 0x1, 0x84) r5 = socket(0x2, 0x80805, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$ARPT_SO_SET_REPLACE(r4, 0x0, 0x60, &(0x7f00000002c0)={'filter\x00', 0x7, 0x4, 0x3ac, 0x0, 0x2cc, 0xe0, 0x2cc, 0x2cc, 0x2cc, 0x4, 0x0, {[{{@arp={@multicast1, @empty, 0x0, 0xffffff00, 0xc, 0x0, {@mac=@local, {[0xff, 0x80, 0x0, 0x1fe, 0xff, 0xff]}}, {@mac=@broadcast, {[0xff, 0x0, 0xff, 0x0, 0xff]}}, 0xdfe, 0x2, 0x7, 0xe, 0xfa, 0x8a5c, 'batadv0\x00', 'team0\x00', {0xff}, {}, 0x0, 0x12}, 0xbc, 0xe0}, @unspec=@NFQUEUE0={0x24, 'NFQUEUE\x00', 0x0, {0x9}}}, {{@arp={@empty, @multicast1, 0xff, 0x0, 0x4, 0x2, {@empty, {[0xff, 0x0, 0xff, 0x0, 0xff, 0x101]}}, {@mac=@broadcast, {[0x0, 0xff, 0x0, 0x0, 0x0, 0xff]}}, 0x9, 0x5, 0x5, 0x2, 0x7, 0xa7c, 'wlan0\x00', 'bond_slave_0\x00', {}, {0xb50cca1d00497645}, 0x0, 0x202}, 0xbc, 0xe0, 0x1000000}, @unspec=@CLASSIFY={0x24, 'CLASSIFY\x00', 0x0, {0xfff}}}, {{@arp={@multicast1, @remote, 0xff, 0xff000000, 0xa, 0x6, {@empty, {[0xff, 0xff, 0x0, 0xff]}}, {@empty, {[0xff, 0xff, 0xff, 0xff]}}, 0x1, 0x10, 0x3, 0x5, 0x4, 0x9e, 'gre0\x00', 'wg0\x00', {}, {0xff}, 0x0, 0x8}, 0xbc, 0x10c}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @multicast2, @rand_addr=0x64010100, 0x2}}}], {{'\x00', 0xbc, 0xe0}, {0x24}}}}, 0x3f8) getsockopt$inet_sctp_SCTP_MAX_BURST(r5, 0x84, 0xc, &(0x7f0000000040)=@assoc_value={0x0}, &(0x7f0000000000)=0x8) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r4, 0x84, 0x7b, &(0x7f0000000080)={r6, 0x6}, 0x0) setsockopt$MRT6_ADD_MIF(r0, 0x29, 0xca, &(0x7f0000000040)={0x1, 0x1, 0x40}, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={0x0}, 0x1, 0x0, 0x0, 0x4}, 0x0) setsockopt$MRT6_FLUSH(r0, 0x29, 0xd4, 0x0, 0x0) socket$kcm(0x11, 0x2, 0x0) r7 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000100)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) read$FUSE(r7, &(0x7f00000034c0)={0x2020}, 0x2020) setsockopt$sock_attach_bpf(r2, 0x107, 0x14, &(0x7f0000000000)=r7, 0x4) 11.153707845s ago: executing program 5 (id=1155): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0xffffe000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) r0 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8802) fcntl$dupfd(r0, 0x406, r0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="440000002000010001000000000000000a144004000000061700000014000200fc02000000000000000000000000000114000100200100"/68], 0x44}, 0x1, 0x0, 0x0, 0xc011}, 0x40000) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000002c0)=@newlink={0x5c, 0x10, 0x439, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x3c, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0x2c, 0x2, 0x0, 0x1, [@IFLA_IPTUN_REMOTE={0x14, 0x3, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @IFLA_IPTUN_LOCAL={0x14, 0x2, @private2}]}}}]}, 0x5c}}, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, 0x0) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r2, 0x107, 0xf, &(0x7f0000006ffc)=0x4000000000000200, 0xe50fb6c50bc849c9) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000003c0)={0x0, 0x24}}, 0x0) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) sendmsg$inet6(r5, &(0x7f0000002280)={&(0x7f0000001e40)={0xa, 0x4e24, 0x0, @mcast1}, 0x1c, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="b005"], 0x5b0}, 0x20008001) sendmmsg$inet6(r5, &(0x7f0000007d00)=[{{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000400)="4c43f868", 0x4}], 0x1}}, {{0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000440)="d51234ba977bb9e5c12f8d834f13d6237d26460748d6933219def36c215585e1676d4abb63df6179cc6df0358301932726803805bf67fde6d452c67bcb02f2991be12424f93f66c56b7a592eed49b5d4e60fca4f541539cd053229ded13933833e015259ce6dfc263a1e0669a8396a76540b4fb154f459a60975891cf83a48c461876ebd0fcf5c92d9110b4c1bbaedc58428da5f480efea0da68dad35e8fb3b385f8", 0xa2}, {&(0x7f0000000500)="fd6ec59ad2f97407d3694c9a9c464b7e2099c74cb6085724bea4211eeb3263eaec4ed9a1f7f7f4c9a2522ab2fd99c61edad49100c9af2505a816b6306b52773fed6dc1bc77ebb8bd9b0067e03f008381fa24d54a21fc980b65d1cd1b29ebcd32d71be7427435e9308efcf5bed5852638d7a3c49dbad31924a6a3c003621be1d97497975f3ba10045c42426356cbaf28d5d60cf67b8b44f7b89f455f69eb92d14896937867b8e734309c2fbb9e0cd9070b805c407d4680bf3e0821b4dbaa2106d7c880efa73fbb92aabfc3987736a604191f6d33b7e76d842c83ecef971117cc69d41", 0xe2}, {&(0x7f00000001c0)="6e15e198668be6d8092933e644ff0c62edfd048aa0ad33677954c81f0f6d4179c4572f4776af228c6f56b6c88bfaa312ffa6d5ffa6140dad7985e900e3898ef688992c992374f6e024c9cfafdede153a9f863e525de8e31eb633a6943d88695af1dff06e3798d20ea8a08b07ec30", 0x69}, {&(0x7f0000000100)="005858ec548b459ef291cf737fa0c04785936a8c75253d7208ba4ec75c69bbd6cba23fec1abf6ba5ff07d5e04341bbca62ea6774217764154909", 0x3a}], 0x4, 0x0, 0x2c}}, {{0x0, 0x0, &(0x7f00000008c0)=[{&(0x7f0000000800)="1d9ceee49731604f5da9049e0b7bb7ce6e9dd0775991b98513ccec0638e0f8834068123e63009a2b52615c5eafeb8c2d15bffdc05a0fd14973e49ae4e19426a6812a47550ab06c9937e0e462bed0b2046ea7611b905c", 0x56}, {&(0x7f0000000980)="99261f7bcb7a7581800eb64000cd857b2a857db391994d97cbb2b7054548da83bed00b7f861cd5a91397b5a8efced7d9a2440827f26b6c9315d33db0ee3b81c7ae7c5ec38a07625d759b607e980edd8eee25e133d6c2d062c5bd2ca073727bf67c2e83cf2ce604085f8b5a4dfb0a92831b2743dacfec623b9b6cbb518dba3de8f0c27bff389bf57bfacc3ee0c18dd05d2a7f2d58f97a09227b275a07e3615f6ade538585e6e94a05cc5b7ac4f10f0c0f38220598b4ce02602affdbe19cbc00fc91107ef2d49ac63cb01695ce88d9303536595b5cefa9847de37b11e43900413f600fd5e398eb6fb7a3b6855a86a9f5bd6ac5beadb14305859665e6dc4802ca821bfe9a956464ef8cd80253faad955c428d1f539206d366a5c27549b69958bad90670246f45600dcd388cfa3c98b0d550a8fb43133ad5e33212cf6d804b2ebaf1980eea082ec84cafd4d09e9f9a55afa23e1392a8cdba11312649da708c2880a570a1509a416d0b011fa62d2a5afa98409c2ae8837be92c69e6ec92e6b09ec3a6fd4525ef72dddafea0a7965919804f95a0108c7f007a30b867e1cded82ae7ab07a392fbabca14c38f1bcca65ca248d1264b82976eb341bc1d6b01efedbe6b7f04950f7371a22d9ff6376c78e4a1ca1cf970e2dcc2dad8425fe08c9282bea4a85b791194ef2a8c46946f48a37c52d0552fca727c5bd8c3b04942706b4fd27cb352a9ceea6d70761a1737bfd183c975f7487b90a164c33d38c5d4f5be5b433a9282e9358348a8a13cfb800d84951c4ab1b35641f0ffb7375cccbf9e60a0de124baea8cddd73ae0570e7968d91dede5669bd6faccbaba3336f311ef60fb034f6b48c95d8e5d22423b9240dc89da3d12a3aa2bed55e1338f05d6b3d6ab7373357d5610a8aa6f9f519240009c9481b5877766ea066d175bdf70f0d1de5884949b48fe12fed3168762d8a654c76066fb603d69d65c6d067d8c0412f51d5c3dd7451a0941e787555cef3d7a4c31fe19086d69d2188d2bc6237d5d756c1fc8554987049292120e666823287ef13de88ab5fc477504e4ea13c8fbcb4090a0fc6d982498e4a5822d0eae0892075f0fecf8c3093704583034a375da688ca14e5c99d43d94f08405acdfb1136f83a2f31ee3bfe468df818af047dd0f08f74acae5114993040b2b0b48b8fa6b2a198251536cb3029f8e7fa9398e1b4065ee736044221fb768819a7190311fa9c00ef564ea0e915f91f8681df0953188e8fe0789932333f7ecaa1a4f5d9a42405d3d62ae1343244885255153bbe5458384a50f6e1de0b070791075d50e9bdfa78f45c0707df2d9433e8611a5a6a0d19894ffef2e37ec8e7b06ad0a26f6ae74888d23b82347b7377085b634296b033f89592366de18aeb8cc1367183e7d9ea4fe7bfe1c0279e2d5981da4a21e920ee198dc8f5fbf2a6a3930acc2af349fa6b51534bcfd5b06c6912637fc9ccff81943c9c968b87e0dc7de7bfa80554f674fc54fd9cc0369dda7b5750d2cfeb2d2da8c35386d8b6b1b4ace09691f719bd8e2f0a2784eebd501ab3e4fe501b353d005443670be40890551947f38ca2a6d4f10967de1d969707881ba7e2bf03ba587dd64f2351d5e514a9e413a88c08cc0527b1f4458a0ffdfd3e4e7de13220f3a5f590eb80d283649b82025480270b12f2bf6c99c91fe0de98b0bc6170b500b418fc9cf169ba034216b8142458c07e4a002c8e20c2ad4db790875ff3226319b60072a3e795f41f96397baecb5c6965edf980b55d1ca59c0fb60cd363033fe6d8555d87d14ee4ddc74870d7d1e972fa275351970b93e3057bf2526cb7699821e1c3a1c32b9272ad95998de0bac2f78e3242555088043159ab6981634484e130d81168bcc23c445ebccbe262eba079f3f0c193afeb5b42aaa74f6d046167f6d045bafa1debbe309efe74299d0d6348b83e0617f0ed73dcfce2c81c95bcb8390fa5f11c5eafe0a8327c60a4dbe4f6fb0f6e88438f0d376d8117c350982aa1a0a4b7c082f8a273ba26ae5f01d78ecea3e2d57f259c439d1907a8ab56b23c5d78219ebbd47362c8a055f520cabc22f98a6c1a95aae738f2591051f2ffde1d33ef425d5353351ca0b315e6f9c3c6cebdc4181f8fb4a6b9bb7c2ef0da7bb0372da18e91ac4dd8eda76dac7dedb113db041a8d37c21357f0d5aafbe5a676151bba5a9d4491506b105b82e5e8eacb4a1d123a4a815cbafa5c0dcdf4e2111d04e916264a14e2864df61a4a9f4b26551e247af66518a1fba894822e14865ae94bf4b5eaabdd11afad2da4514e9d5df3000f2d82fa2a30264b61377e064f6add4bf07d3d05b7cf9a448d740f64ddbf36044554bd8e061aed614c4cb0dec056dbfc3cb7b6e63c8c3116e294102442cc70313ebc98ca5245ff8d2027626786c902f6d5eed9d91fe5d379034f812197fdb49ea5c8f02f069fb54c51805f375d7d3c72aee1fd44b4879d7a1a8ac83e250bd70386994cab477505578aa6b0a113253841a800deb7be052090278c4ee0ba72ecc0406e28c4715118a7a20d884c453e9a22849004de96246f04b1bae8ed02adca9a6ddc38a49d712f813dcda94a76703ace6c803bf04b03f0a280401d643e5dbfd851427c1433a597d36a9bb64a4557f9c8115451deca7639dcf7896ff56cf722bb2567b011ff3ea8bb4110a9cd40ffbaaa69a75f64cdcc0341ddd3d513afdd4b980ef80b6f581d202248ceddaace5f228a893695959f6ed7bfad909b7daaa2b9c79ca6abb7a7c02c1c72254ec763bfd0d199259cee855c53db3b50c660eba056106a1e9717ef27d6b0ece04c63f9a4936146eed8962012ee653cf9b2dba80259116999e15bcd08169aa1781be001759401a5273df47bda7da7db34cd6f0024fcb7105be3b436e3a1642d4093e78c0135292db88fc77055c47b6042537d6d0feacd1c1f0c1e85c11b97f70acb3aeff27bd7de5d2e85f7f0b63c31e0e390344a37097c20984b800faaba6dfc7f0e3eaa0df6f5f2d11dc0818e857ad8383438067bd4cc3bd199a0ddce3aa29275459be30c3e657ff504a35f99c916c40692b80c39d7cca3e1d0b188c65f4fabd8c734bcd224be35322051de5b164c835e18c1237d46f58fabbe479b077c41cba511c883eeae7d875288d9577d59c0d363ec2566bfe00f2c2fb71eab97b512b9670", 0x8c8}], 0x2}}], 0x3, 0x2008000) getsockname$packet(r4, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x7) r7 = syz_usb_connect(0x2, 0x24, &(0x7f0000000600)=ANY=[@ANYBLOB="120100001d9167204f17316a3f26010203010902120001000000000904"], 0x0) syz_usb_control_io$rtl8150(r7, 0x0, 0x0) syz_usb_control_io$printer(r7, 0x0, 0x0) syz_usb_control_io$uac1(r7, 0x0, 0x0) syz_usb_control_io$lan78xx(r7, 0x0, 0x0) syz_usb_control_io$rtl8150(r7, 0x0, 0x0) syz_usb_control_io$rtl8150(r7, 0x0, 0x0) syz_usb_control_io(r7, 0x0, 0x0) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffff00f687000000", @ANYRES32=r6, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000440)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=@newqdisc={0x3c, 0x24, 0xe0b, 0x70bd2d, 0x0, {0x0, 0x0, 0x0, r6, {}, {0xffff, 0xffff}, {0xd, 0xe}}, [@qdisc_kind_options=@q_cake={{0x9}, {0xc, 0x2, [@TCA_CAKE_SPLIT_GSO={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24020080}, 0x4044080) bind$packet(r2, &(0x7f0000000040)={0x11, 0x0, r6, 0x1, 0x0, 0x6, @remote}, 0x14) sendto$inet6(r2, &(0x7f0000000800)="4103082c1116480401020200c52cf7c25975e005b02f88a8068986dd0300897c6b118777faffffff3066090cb600c5471d130a66321a54e7df305fbe258161b6fd8f2428652265d94c6fdbaefc57376a57c2feffff188be9427c323ef024a37016d2a7f9ab6e7941a6fc4f95aa73c1dfff4941f6503b5bd8c91db22cd33795481c94085fa12cdc679ac2a5d7b5d99b93fb07acb0da680e78b74c74aae8d7690d5986a9af81622a0ac210bc7b5ca5fed11cb54d046642670041e846bb184ff5d39fe8516d2d2a8d84e6e7dfcb2b8a8023444db513a3d7a124b59f0a5cd36489dbbb75cce3145d0ea3c3aa21af7cbcbc7a7575db782e757ca543109f5ddcec4930aa91f4119ea3d1f56140cb86cfe0724b23904ef5d05c725ee23918a502b1afe09fb0757d", 0xfc13, 0x880, 0x0, 0xfffffffffffffef0) socket$nl_rdma(0x10, 0x3, 0x14) 10.714100315s ago: executing program 3 (id=1157): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = getpid() syz_pidfd_open(r1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x4, r1, 0x1, &(0x7f0000000100)) (async) sendmsg$nl_xfrm(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000000)=@newsa={0xec, 0x1a, 0x7, 0x0, 0x0, {{@in6=@private2={0xfc, 0x2, '\x00', 0x1}, @in=@private=0xa010100, 0xfffd, 0x0, 0x4e21, 0x0, 0x0, 0xe0, 0x0, 0x73, 0x0, 0xee00}, {@in6=@mcast1, 0x0, 0xff}, @in6=@private0={0xfc, 0x0, '\x00', 0x1}, {0x0, 0x10000000000000b5, 0x2, 0x0, 0x0, 0x2000000, 0xffffffffffffffff}, {0x0, 0x200000, 0x3, 0xfffffffffffffffd}, {0x40000, 0x0, 0x2c12}, 0x8, 0x0, 0xa, 0x2, 0x0, 0x68}}, 0xec}, 0x1, 0x0, 0x0, 0x400}, 0x0) (async) syz_usb_connect(0x5, 0x24, &(0x7f0000000140)=ANY=[@ANYRESOCT=r1], 0xfffffffffffffffe) 10.579658855s ago: executing program 0 (id=1159): r0 = socket$inet6(0xa, 0x3, 0x7) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r2, 0x7a7, &(0x7f0000000040)=0x90000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r2, 0x7a0, &(0x7f0000000000)={@local}) r3 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r3, 0x0, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x218, 0x90, 0x11, 0x148, 0x0, 0x0, 0x184, 0x2a8, 0x2a8, 0x184, 0x2a8, 0x3, 0x0, {[{{@ip={@broadcast, @multicast2, 0xffffff00, 0x0, 'vlan1\x00', 'geneve1\x00', {}, {0xff}, 0x4, 0x1, 0x46}, 0x0, 0x70, 0x90}, @unspec=@TRACE={0x20}}, {{@ip={@initdev={0xac, 0x1e, 0x5, 0x0}, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0xffffffff, 'vlan0\x00', 'netdevsim0\x00', {}, {}, 0x0, 0x3}, 0x0, 0xd4, 0xf4, 0x0, {}, [@common=@inet=@ecn={{0x24}, {0x11, 0x1, 0x9, 0x5e}}, @common=@set={{0x40}, {{0x2, [0x1, 0x4, 0x0, 0x5, 0x1], 0x4, 0x5}}}]}, @unspec=@TRACE={0x20}}], {{'\x00', 0x0, 0x70, 0x94}, {0x24}}}}, 0x274) ioctl$IOCTL_VMCI_VERSION2(r2, 0x7a7, &(0x7f0000000500)=0x10000) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r2, 0x7a8, &(0x7f0000000540)={{@hyper, 0x2}, @hyper, 0x0, 0x0, 0x5e}) ioctl$IOCTL_VMCI_CTX_ADD_NOTIFICATION(r2, 0x7af, &(0x7f0000000080)={@hyper, 0x2}) r4 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r6, 0x8933, &(0x7f00000000c0)={'vcan0\x00', 0x0}) bind$can_j1939(r6, &(0x7f0000000340)={0x1d, r7, 0x0, {0x2, 0x0, 0x6}, 0xfe}, 0x18) setsockopt$sock_int(r6, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4) sendmsg$inet(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000280)="81b641f1f3843704b6", 0x9}], 0x1}, 0x4048081) setsockopt$SO_J1939_PROMISC(r6, 0x6b, 0x2, &(0x7f0000000200)=0x1, 0x4) setsockopt$SO_J1939_FILTER(r6, 0x6b, 0x1, &(0x7f0000000180)=[{0x2, 0x1, {0x0, 0x1, 0x1}, {0x2, 0xf0, 0x4}, 0x0, 0x1}, {0x2, 0x2, {0x0, 0xff, 0x2}, {0x1, 0x1, 0x1}, 0x1}], 0x40) sendmsg$nl_route_sched(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)=@newtfilter={0x24, 0x11, 0x1, 0x70bd26, 0x25dfdbfc, {0x0, 0x0, 0x74, r7, {0xb, 0xfff2}, {0xfff1, 0x9}, {0x2, 0xd}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x4012}, 0x20000050) ioctl$IOCTL_VMCI_VERSION2(r4, 0x7a7, &(0x7f0000000040)=0x90000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r4, 0x7a0, &(0x7f0000000240)={@hyper}) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r4, 0x7a8, &(0x7f0000000540)={{@hyper, 0x2}, @hyper, 0x0, 0x0, 0x5e}) r8 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r8, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000600)=ANY=[@ANYBLOB="88010000100001000000000000000000ac1414bb000000000000000000000000ac14142600"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ffffffff0000000000000000000000000000000033000000ac1414bb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000cdcee80c6b00000000000004000000000000ff0100000000000000000000000000000000000000000000000000000000818bb300000000000000000006000000000000000000000000000000000000000a000000000000004c9d5b0c9b62faeddc2e17253e40322237ddd2bb306469660000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000c00000004c00120061656769733235360000000000000022000000000000000000000000000000000000000000000000fcffffffffffffff00"/329], 0x188}, 0x1, 0x0, 0x0, 0x24040880}, 0x0) close_range(r1, 0xffffffffffffffff, 0x0) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f00000005c0)=0x7fff, 0x4) r9 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r9, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000040)=[{0x30, 0x2, 0xfe, 0xfffff004}, {0x80000006}]}, 0x8) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000440)={'batadv_slave_0\x00'}) 10.084421383s ago: executing program 0 (id=1161): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet6(r0, &(0x7f0000000000)=[{{&(0x7f0000000240)={0xa, 0x4e21, 0x4, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x3}, 0x1c, &(0x7f00000003c0)}}], 0x1, 0x931766f6319eed40) shutdown(r0, 0x1) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_MAX_BURST(r1, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f00000004c0)=0x8) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000300)={r2, 0x3}, &(0x7f0000000340)=0x8) 10.06991264s ago: executing program 0 (id=1162): r0 = socket$nl_route(0x10, 0x3, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x100, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs={0x1, 0x0, 0x4e22}, 0x6e) r1 = syz_open_dev$vbi(&(0x7f0000000000), 0x2, 0x2) ioctl$VIDIOC_S_CTRL(r1, 0xc008561c, &(0x7f0000000080)={0xf0f041}) ioctl$VIDIOC_G_TUNER(r1, 0xc054561d, 0x0) r2 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x820200, 0x0) ioctl$BTRFS_IOC_FS_INFO(r2, 0x8400941f, &(0x7f0000000480)) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000400)=@newtaction={0x50, 0x30, 0x48b, 0x70bd26, 0x22000, {}, [{0x3c, 0x1, [@m_ctinfo={0x38, 0x402, 0x0, 0x0, {{0xb}, {0xc, 0x2, 0x0, 0x1, [@TCA_CTINFO_PARMS_CPMARK_MASK={0x8, 0x7, 0x100}]}, {0x4}, {0xc, 0x7, {0x1}}, {0xc}}}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x4000000}, 0x48195) sendmsg$nl_generic(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=ANY=[@ANYBLOB="340000003e0007010000000000000000017c00000400fc800c0001800600060065580000080002"], 0x34}, 0x1, 0x0, 0x0, 0xc000}, 0xc010) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f0000009b40)=[{{&(0x7f0000000300)=@nfc_llcp, 0x80, &(0x7f0000009cc0)=[{&(0x7f0000002280)=""/4096, 0x1000}, {&(0x7f0000000100)=""/33, 0x21}, {&(0x7f0000000880)=""/131, 0x83}, {&(0x7f0000000200)=""/63, 0x3f}, {&(0x7f0000000940)=""/254, 0xfe}, {&(0x7f0000009c80)=""/19, 0x13}], 0x6, &(0x7f0000000a40)=""/73, 0x49}, 0x669}, {{0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000ac0)=""/107, 0x6b}, {&(0x7f0000000b40)=""/69, 0x45}, {&(0x7f0000001100)=""/140, 0x8c}], 0x3, &(0x7f0000000c80)=""/194, 0xc2}, 0xc}, {{0x0, 0x0, &(0x7f0000001080)=[{&(0x7f0000000d80)=""/69, 0x45}, {&(0x7f00000014c0)=""/197, 0xc5}, {&(0x7f0000000ec0)=""/118, 0x76}, {&(0x7f0000000f40)=""/77, 0x4d}, {&(0x7f0000001240)=""/181, 0xb5}], 0x5, &(0x7f00000010c0)=""/46, 0x2e}, 0x9}, {{0x0, 0x0, &(0x7f0000001180), 0x0, &(0x7f0000003280)=""/4096, 0x1000}, 0x4}, {{&(0x7f00000011c0)=@l2tp6={0xa, 0x0, 0x0, @private0}, 0x80, &(0x7f0000001400)=[{&(0x7f0000000bc0)=""/141, 0x8d}, {&(0x7f0000000380)=""/32, 0x20}, {&(0x7f0000001340)=""/148, 0x94}], 0x3, &(0x7f0000004280)=""/4096, 0x1000}, 0x956}, {{&(0x7f0000001440)=@x25, 0x80, &(0x7f0000001800)=[{&(0x7f0000009d00)=""/209, 0xd1}, {&(0x7f00000015c0)=""/80, 0x50}, {&(0x7f0000001700)=""/238, 0xee}, {&(0x7f0000001880)=""/142, 0x8e}, {&(0x7f0000001640)=""/83, 0x53}, {&(0x7f0000005280)=""/4096, 0x1000}], 0x6, &(0x7f0000001940)=""/199, 0xc7}}, {{&(0x7f0000001a40)=@nl, 0x80, &(0x7f0000001c00)=[{&(0x7f0000001ac0)=""/131, 0x83}, {&(0x7f0000001b80)=""/11, 0xb}, {&(0x7f0000001bc0)=""/2, 0x2}], 0x3, &(0x7f0000001c40)=""/175, 0xaf}, 0x1}, {{&(0x7f0000001d00)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}}}, 0x80, &(0x7f00000021c0)=[{&(0x7f0000001d80)=""/172, 0xac}, {&(0x7f0000001e40)=""/182, 0xb6}, {&(0x7f0000001f00)=""/90, 0x5a}, {&(0x7f0000001f80)=""/25, 0x19}, {&(0x7f0000001fc0)=""/218, 0xda}, {&(0x7f00000020c0)=""/119, 0x77}, {&(0x7f0000002140)=""/90, 0x5a}, {&(0x7f0000006280)=""/4096, 0x1000}], 0x8, &(0x7f0000007280)=""/191, 0xbf}, 0x8}, {{&(0x7f0000007340)=@caif=@rfm, 0x80, &(0x7f00000077c0)=[{&(0x7f00000073c0)=""/231, 0xe7}, {&(0x7f00000074c0)=""/22, 0x16}, {&(0x7f0000007500)=""/157, 0x9d}, {&(0x7f00000075c0)=""/160, 0xa0}, {&(0x7f0000007680)=""/184, 0xb8}, {&(0x7f0000007740)=""/71, 0x47}], 0x6, &(0x7f0000007800)=""/42, 0x2a}, 0xfffffffb}, {{&(0x7f0000007840)=@rc={0x1f, @fixed}, 0x80, &(0x7f0000009a80)=[{&(0x7f00000078c0)=""/13, 0xd}, {&(0x7f0000007900)=""/200, 0xc8}, {&(0x7f0000007a00)=""/4096, 0x1000}, {&(0x7f0000008a00)=""/4096, 0x1000}, {&(0x7f0000009a00)=""/76, 0x4c}], 0x5, &(0x7f0000009ac0)=""/70, 0x46}, 0x6}], 0xa, 0x2, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="4c000000020681010000000000000000000000000500050002000000050001"], 0x4c}, 0x1, 0x0, 0x0, 0x4040000}, 0x800) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="24000000190001002cbd700000c8c3532d"], 0x24}}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0xe, 0x8000, 0x0, 0x9, 0x1, 0xfffffdffffffffff, 0xfa0f, 0xffffffff}, 0x0) r5 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$FUSE_INTERRUPT(r5, &(0x7f0000002240)={0x10, 0xffffffffffffffda}, 0x10) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x2982, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/timer_list\x00', 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x129, 0x0, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x1, 0x3}, {}, {0x8, 0xfff1}}}, 0x24}}, 0x40004) syz_io_uring_setup(0x6167, &(0x7f0000000400)={0x0, 0xfffffffe, 0x10100}, &(0x7f0000000100), &(0x7f0000000140)) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='net_prio.prioidx\x00', 0x275a, 0x0) write$UHID_CREATE2(r6, &(0x7f00000001c0)=ANY=[@ANYBLOB='6'], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r6, 0x0) 9.120105107s ago: executing program 1 (id=1165): socket$kcm(0x2, 0x200000000000001, 0x106) socket$kcm(0x10, 0x2, 0x4) r0 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000380), 0x121682, 0x0) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x82200, 0x0) ioctl$SNDCTL_SYNTH_ID(r1, 0xc08c5114, 0x0) read$nci(r0, &(0x7f0000000100)=""/107, 0x6b) write$nci(r0, &(0x7f0000000100)=ANY=[], 0x4) ioctl$KVM_CLEAR_DIRTY_LOG(0xffffffffffffffff, 0xc018aec0, &(0x7f0000000040)={0x1, 0x3c0, 0xc0, &(0x7f0000000340)=[0x5, 0x0, 0x9, 0x80, 0xe6b4, 0x0, 0xfffffffffffffffa, 0x1, 0xa, 0x2, 0x2, 0x700000000000000, 0x3, 0x2, 0xfffffffffffffffe, 0x5, 0x6fffffff, 0x2, 0x4, 0x9883, 0xb, 0x6, 0x8, 0x102, 0x4, 0x9, 0x2, 0x1fd, 0x18, 0x81, 0x1, 0x5, 0x5, 0x2, 0x101, 0x40, 0x1, 0x4, 0x9, 0x81, 0x0, 0x6, 0x6, 0x2e2, 0x101, 0x6, 0x8000000000000001, 0xfffffffffffffff9, 0x8, 0x401, 0x5, 0x9, 0x7fff, 0xec, 0x8000000000000000, 0x5, 0x94e, 0x7, 0x7fffffffffffffff, 0x6, 0xffffffffffffffff, 0xa, 0x11, 0xa, 0x5, 0xa8, 0x2, 0xffffffffffffffff, 0x5, 0x87f, 0x7, 0x7, 0xae8e, 0x1e30fa4c, 0xb, 0xfffffffffffffffd, 0x4, 0x49f, 0x3, 0x7, 0xfffffffffffffad7, 0x3, 0xba00, 0x3, 0xd, 0xad65, 0x1, 0x100, 0x7, 0xe, 0x3, 0x1000000003ff, 0x5, 0x21, 0x9, 0xfffffffffffffffe, 0x401, 0x8, 0x1e4b, 0x2, 0x7fffffff, 0xf, 0x10000, 0xe, 0x2, 0x6, 0x3, 0xfffffffffffffff9, 0x0, 0x4, 0xa, 0x1, 0x9, 0x2, 0x1000, 0x80, 0xb, 0xd, 0x4, 0x3, 0x2000020006, 0x8, 0x401, 0x7f, 0x1, 0x7, 0xea7, 0x1]}) syz_usb_connect(0x5, 0x4c, &(0x7f0000000580)=ANY=[@ANYBLOB="1201100335fe6510ca1a8eb232920102030109023a00010d019002090432a70201039e080929eebdc65cb9a2db082387ac33afe3410725010305f804090507020002040266072501"], &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0}) unshare(0x28000600) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'ipvlan0\x00', 0x0}) unshare(0x8040600) r6 = openat$dsp1(0xffffffffffffff9c, &(0x7f0000000000), 0x20080, 0x0) r7 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0xa0201, 0x0) ioctl$SNDCTL_DSP_CHANNELS(r6, 0xc0045006, &(0x7f0000000180)=0x6f) write$dsp(r7, &(0x7f00000012c0)="a5", 0x1) write$uinput_user_dev(r0, &(0x7f0000000080)={'syz1\x00', {0x4, 0x4, 0x5, 0xfff8}, 0xb, [0x8, 0x76, 0x3, 0x5, 0x5, 0x0, 0x7, 0x5, 0x5, 0x5, 0x40, 0x5, 0x7, 0xfffffffd, 0x9, 0x7fffffff, 0x2, 0x8000, 0xee, 0x8, 0x7f, 0x0, 0x0, 0x2, 0x4b1, 0x80008, 0x4, 0x5, 0xb, 0x4, 0x4, 0x5, 0xfffffffd, 0x1, 0xc6a, 0xc, 0x7, 0xe, 0x4, 0xffffff81, 0x62, 0x7, 0x0, 0x4, 0x3, 0x8, 0x3, 0x4, 0x3669, 0x1, 0x401, 0x0, 0x3, 0x6, 0x4, 0x10000, 0x7, 0x8, 0x60000000, 0x4, 0x6, 0x2, 0x0, 0x77a], [0x10000, 0xf2e, 0x2, 0x9, 0x1, 0x1000, 0x3, 0xc44, 0x7, 0x8905, 0x7fffffff, 0x10, 0xffff, 0x8, 0xe, 0xad, 0x48, 0xf8, 0x7fff, 0x31, 0x8, 0x0, 0x8, 0xbb6, 0x0, 0xfffeffff, 0x101, 0x401, 0x1, 0x3, 0x6, 0x7, 0x5, 0xfffffffd, 0x400, 0x5, 0x1fe9, 0x3eb2028c, 0x4, 0x1, 0x7, 0x4352be89, 0x3ff, 0x7fff, 0x5, 0x6, 0x8, 0xcac, 0x90f, 0x5, 0x7ff, 0x6, 0x11a, 0x4, 0xbf6, 0x6, 0xb, 0x8, 0x3, 0x0, 0x7fffffff, 0x7efa182a, 0x3, 0x401], [0x4394, 0x6, 0x5, 0x9, 0x3, 0x2, 0x1, 0x7, 0xfffffff9, 0x7fffffff, 0x8, 0x7, 0xc, 0x100, 0x6, 0x6, 0x10001, 0x9ed, 0x1f, 0x9, 0xc20, 0x1, 0x9, 0xc0, 0x7, 0x5, 0x2, 0x2, 0x1, 0x0, 0x6, 0x0, 0x100, 0x8067, 0x3e46, 0x2, 0x1, 0x2, 0x9, 0x7, 0x1ff, 0xfa9, 0x8, 0x6, 0x6, 0x7, 0x6df, 0x100, 0x3ff, 0x0, 0x1, 0x68c2, 0x0, 0x1, 0x2, 0x7fff, 0x1, 0x3, 0x7fff, 0x1e0b, 0x103, 0xea18, 0x400000, 0x1ff], [0x7, 0x2b500, 0x44a9, 0x3, 0x1, 0x1, 0x4, 0x6, 0x2cfe, 0x8, 0x6, 0x5, 0x16a, 0x6, 0x0, 0x9c5, 0x3, 0x7fffffff, 0xf49, 0x1, 0x40, 0x0, 0x8, 0x7, 0x6, 0x3, 0x0, 0x1000, 0x7, 0xe32, 0x7ff, 0xe, 0x9, 0x7, 0xdd63, 0xfffffff5, 0x6196bb21, 0x1, 0x2, 0x1, 0x2, 0x900000, 0x81, 0xb58, 0x7, 0x7, 0x4, 0x6, 0x9, 0x7, 0x8, 0xa2, 0x0, 0x8, 0xa, 0x8, 0x1, 0x0, 0xd6, 0x95, 0x9, 0x3, 0x80, 0x3]}, 0x45c) poll(&(0x7f0000000000), 0x20000000000000b5, 0x9) socket$nl_route(0x10, 0x3, 0x0) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000340)={0x20, r4, 0x7, 0x0, 0xfffffffe, {}, [@ETHTOOL_A_LINKMODES_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x80d1}, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_add_memb(r8, 0x107, 0x1, &(0x7f0000000100)={0x0, 0x2, 0x20, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x39}}, 0x10) io_setup(0x3, &(0x7f0000000180)=0x0) r10 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) openat$sequencer2(0xffffff9c, &(0x7f00000008c0), 0x430881, 0x0) io_submit(r9, 0x1, &(0x7f0000002340)=[&(0x7f0000000040)={0x0, 0x300, 0x0, 0x5, 0xd8, r10, 0x0}]) pselect6(0x40, &(0x7f0000000740)={0x8, 0x4, 0x1ff, 0x100000001, 0x2, 0x10001, 0x5d52, 0x3}, &(0x7f0000000780)={0xc10, 0x0, 0x7, 0x3, 0x4, 0x8, 0x5, 0x2}, &(0x7f00000007c0)={0x4, 0x4, 0x6, 0x5, 0x6, 0x4b, 0xb, 0x2}, &(0x7f0000000800), &(0x7f0000000880)={&(0x7f0000000840)={[0x9, 0x3]}, 0x8}) 9.063619789s ago: executing program 0 (id=1166): r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x20, 0x5ac, 0x269, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0xf8, 0xb, "", [{{0x9, 0x4, 0x0, 0x9, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0xa, 0x0, 0x1, {0x22, 0x1e3}}, {{{0x9, 0x5, 0x81, 0x3, 0x38d707d343173689, 0x5, 0xa, 0x70}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(0xffffffffffffffff, 0x0, &(0x7f0000000400)={0x18, 0x0, 0x0, 0x0, &(0x7f0000000380), 0x0}) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) r5 = openat$tcp_mem(0xffffff9c, &(0x7f0000000340)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0) fdatasync(r5) ioctl$KVM_CREATE_PIT2(r4, 0x4040ae77, &(0x7f0000000040)) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000000)={[0x800038, 0x7, 0x3, 0x180, 0x6, 0x10, 0xf1, 0x100000001, 0x1, 0xca0, 0xffffffffffffffff, 0x2000000002c, 0x0, 0x6, 0x0, 0xbd9], 0xffff1001, 0x43100}) r6 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r6, 0x4090ae82, &(0x7f00000003c0)={[0x7, 0x1000000000, 0x0, 0x200000000000043, 0x2000004, 0x0, 0x2004cb, 0x7ff, 0xa7c, 0x68ff, 0x7, 0x100008000000006, 0x803, 0x0, 0x9], 0xeeee8000, 0x202}) ioctl$KVM_SET_SREGS(0xffffffffffffffff, 0x4138ae84, &(0x7f00000001c0)={{0x3000, 0x1, 0x8, 0x8, 0xb, 0xe6, 0x40, 0x0, 0x0, 0x81, 0x80}, {0x5000, 0x3000, 0x3, 0xff, 0x42, 0x9, 0x75, 0x6, 0x36, 0x0, 0x2, 0xb4}, {0x40000, 0xdddd0000, 0xe, 0x5, 0x3, 0x7, 0x0, 0x21, 0x1, 0xa2, 0x5, 0x5}, {0x200000, 0xeeee0000, 0x9, 0x7, 0x5, 0x42, 0xb, 0xff, 0x8, 0x7, 0xe, 0x7}, {0xf000, 0x1000, 0xf, 0x3, 0x16, 0x7, 0xab, 0xb, 0xc, 0x9, 0xf7, 0x97}, {0xeeefa000, 0xdddd0000, 0x6, 0xa0, 0xb, 0x8, 0x1, 0xa8, 0x82, 0x2, 0x1, 0x7}, {0xeeee8000, 0x3000, 0xf, 0x5, 0x7, 0x5, 0x7, 0x3, 0x8, 0x0, 0x40, 0x74}, {0xdddd0000, 0x25000, 0xa, 0x5, 0xcd, 0x7, 0x1, 0x9, 0x2, 0xc, 0xb0, 0xa1}, {0xeeee0000, 0x30}, {0x40000, 0x7}, 0xa0000039, 0x0, 0x4, 0x2024, 0x2, 0x0, 0x100000, [0x6800000000000000, 0x4, 0x3, 0x8]}) ioctl$KVM_RUN(r6, 0xae80, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) ioctl$KVM_SET_ONE_REG(r7, 0x4048aecb, &(0x7f0000000540)=@arm64_ccsidr={0x6020000000110005, 0x0}) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x22, 0x371, {0x9}}}, &(0x7f0000000080)={0xffffffffffffffeb, 0x0, 0x0, 0x0, 0x0, 0x0}) r8 = socket$unix(0x1, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000003880)={0x0, 0x0}) recvmmsg$unix(r8, &(0x7f0000003780)=[{{&(0x7f0000000100)=@abs, 0x6e, &(0x7f0000000000)=[{&(0x7f0000000240)=""/100, 0x64}], 0x1, &(0x7f00000002c0)=[@cred={{0x18}}, @cred={{0x18}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x48}}, {{&(0x7f0000000440), 0x6e, &(0x7f0000000180)=[{&(0x7f0000000580)=""/160, 0xa0}], 0x1, &(0x7f0000000340)}}, {{&(0x7f00000004c0), 0x6e, &(0x7f0000000b00)=[{&(0x7f0000000640)=""/253, 0xfd}, {&(0x7f0000000740)=""/132, 0x84}, {0xfffffffffffffffe}, {&(0x7f0000000800)=""/156, 0x9c}, {&(0x7f0000002600)=""/74, 0x4a}, {&(0x7f00000008c0)=""/248, 0xf8}, {&(0x7f00000009c0)=""/255, 0xff}, {&(0x7f0000000ac0)=""/7, 0x7}], 0x8, &(0x7f0000000b40)=[@cred={{0x18}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x34}}, {{&(0x7f0000000b80)=@abs, 0x6e, &(0x7f0000000c40)=[{&(0x7f0000000c00)=""/61, 0x3d}], 0x1}}, {{&(0x7f0000000c80), 0x6e, &(0x7f00000010c0)=[{&(0x7f0000000d00)=""/74, 0x4a}, {&(0x7f0000000d80)=""/93, 0x5d}, {&(0x7f0000000e00)=""/82, 0x52}, {&(0x7f0000000e80)=""/24, 0x18}, {&(0x7f0000000ec0)=""/244, 0xf4}, {&(0x7f0000002680)=""/214, 0xd6}], 0x6, &(0x7f0000001100)=[@cred={{0x18}}, @cred={{0x18}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}], 0x44}}, {{0x0, 0x0, &(0x7f00000023c0)=[{&(0x7f0000001180)=""/127, 0x7f}, {&(0x7f0000001200)=""/113, 0x71}, {&(0x7f0000001280)=""/4096, 0x1000}, {&(0x7f0000002280)=""/144, 0x90}, {&(0x7f0000002340)=""/84, 0x54}], 0x5}}, {{&(0x7f0000002400), 0x6e, &(0x7f0000002540)=[{&(0x7f0000002480)=""/169, 0xa9}], 0x1, &(0x7f0000002580)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x50}}, {{0x0, 0x0, &(0x7f0000003680)=[{&(0x7f0000003900)=""/4096, 0x1000}, {&(0x7f0000003600)=""/103, 0x67}], 0x2, &(0x7f00000036c0)=[@cred={{0x18}}, @cred={{0x18}}, @cred={{0x18}}, @cred={{0x18}}], 0x60}}], 0x8, 0x10040, &(0x7f00000038c0)={r9, r10+60000000}) 7.481218525s ago: executing program 3 (id=1167): r0 = socket$kcm(0x2, 0x3, 0x106) r1 = syz_open_dev$sg(&(0x7f00000060c0), 0xaa, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x0, 0x5d032, 0xffffffffffffffff, 0x0) r2 = syz_open_procfs$pagemap(0x0, &(0x7f0000001080)) ioctl$PAGEMAP_SCAN(r2, 0xc0606610, &(0x7f00000001c0)={0x60, 0x0, &(0x7f0000001000/0x3000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, &(0x7f0000000000)=[{0x7, 0x0, 0x83}, {0x9, 0x0, 0xb187}], 0x2, 0xfffffffffffffffe, 0x0, 0x0, 0x42, 0x5c}) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x2012, r1, 0x0) ioctl$SG_SET_RESERVED_SIZE(r1, 0x2275, &(0x7f0000000000)=0x19) r3 = openat$vicodec0(0xffffff9c, &(0x7f0000000140), 0x2, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r6, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000003c0)={0x0, 0x24}}, 0x0) getsockname$packet(r6, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffff00f687000000", @ANYRES32=r7, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) bind$packet(r4, &(0x7f0000000040)={0x11, 0x0, r7, 0x1, 0x0, 0x6, @remote}, 0x14) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r9 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r9, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) r11 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r11, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="010000000000000000200200000008000300", @ANYRES32=r10, @ANYBLOB="0c009900f40000002e000000080026007f17000008009f0007"], 0x38}, 0x1, 0x0, 0x0, 0xd37697ff2c0d3c1b}, 0x8090) sendmsg$NL80211_CMD_START_AP(r6, &(0x7f0000000440)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000400)={&(0x7f00000002c0)={0xbc, r8, 0x2, 0x70bd26, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_SSID={0x21, 0x34, @random="ad98c0b6c2002bedb435db54971906c4c51b21239bb93ff912bdba2833"}, @chandef_params=[@NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0x8}, @NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x976}, @NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x1}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x9}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x62}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x6}], @crypto_settings=[@NL80211_ATTR_AKM_SUITES={0x4}, @NL80211_ATTR_PMK={0x31, 0xfe, "625f9996612fad6a026e74b2758b1243bf60b080eb2fd36e0404013c00b06503d3e580ddbb261eb6665d2a22a6"}, @NL80211_ATTR_CONTROL_PORT_ETHERTYPE={0x6, 0x66, 0x9100}, @NL80211_ATTR_CONTROL_PORT={0x4}]]}, 0xbc}, 0x1, 0x0, 0x0, 0x20040010}, 0x4081) r12 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ptype\x00') r13 = socket(0x10, 0x803, 0x0) sendmmsg$alg(r13, &(0x7f0000000740)=[{0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="ed", 0x1}], 0x1, 0x0, 0x0, 0x40041d0}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}], 0x2, 0x4000000) preadv(r12, &(0x7f0000000240)=[{&(0x7f00000001c0)=""/40, 0x28}], 0x1, 0x38, 0x9) ioctl$VIDIOC_G_FMT(r3, 0xc0cc5604, &(0x7f00000001c0)={0xb, @pix={0x81, 0x4, 0x20303159, 0x6, 0x9, 0x7, 0x5, 0xa5, 0x1, 0x3, 0x1, 0x4}}) sendmsg$inet(r0, &(0x7f0000000040)={&(0x7f0000000380)={0x2, 0x0, @remote}, 0x10, &(0x7f0000000480)=[{&(0x7f0000000080)="fbd2b9ed29d8974a6ce75f08916ac3b4da11bc1a", 0x14}, {&(0x7f0000000280)="5dea8c759012bd24b12caab4e4ad2730", 0x10}], 0x2}, 0x0) 7.296577747s ago: executing program 5 (id=1168): r0 = socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, r0) sched_setattr(0x0, &(0x7f00000001c0)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x19, 0x0, 0xe, 0xfa11, 0xffffffff}, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) openat2$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) openat$sequencer2(0xffffff9c, &(0x7f0000000080), 0x200080, 0x0) r3 = openat$ppp(0xffffffffffffff9c, 0x0, 0x48a200, 0x0) ioctl$PPPIOCNEWUNIT(r3, 0xc004743e, &(0x7f0000000140)) readv(r3, &(0x7f00000006c0)=[{&(0x7f0000000580)=""/90, 0x5a}], 0x1) bpf$PROG_LOAD(0x5, 0x0, 0x0) r4 = socket$inet_sctp(0x2, 0x1, 0x84) r5 = socket(0x2, 0x80805, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$ARPT_SO_SET_REPLACE(r4, 0x0, 0x60, &(0x7f00000002c0)={'filter\x00', 0x7, 0x4, 0x3ac, 0x0, 0x2cc, 0xe0, 0x2cc, 0x2cc, 0x2cc, 0x4, 0x0, {[{{@arp={@multicast1, @empty, 0x0, 0xffffff00, 0xc, 0x0, {@mac=@local, {[0xff, 0x80, 0x0, 0x1fe, 0xff, 0xff]}}, {@mac=@broadcast, {[0xff, 0x0, 0xff, 0x0, 0xff]}}, 0xdfe, 0x2, 0x7, 0xe, 0xfa, 0x8a5c, 'batadv0\x00', 'team0\x00', {0xff}, {}, 0x0, 0x12}, 0xbc, 0xe0}, @unspec=@NFQUEUE0={0x24, 'NFQUEUE\x00', 0x0, {0x9}}}, {{@arp={@empty, @multicast1, 0xff, 0x0, 0x4, 0x2, {@empty, {[0xff, 0x0, 0xff, 0x0, 0xff, 0x101]}}, {@mac=@broadcast, {[0x0, 0xff, 0x0, 0x0, 0x0, 0xff]}}, 0x9, 0x5, 0x5, 0x2, 0x7, 0xa7c, 'wlan0\x00', 'bond_slave_0\x00', {}, {0xb50cca1d00497645}, 0x0, 0x202}, 0xbc, 0xe0, 0x1000000}, @unspec=@CLASSIFY={0x24, 'CLASSIFY\x00', 0x0, {0xfff}}}, {{@arp={@multicast1, @remote, 0xff, 0xff000000, 0xa, 0x6, {@empty, {[0xff, 0xff, 0x0, 0xff]}}, {@empty, {[0xff, 0xff, 0xff, 0xff]}}, 0x1, 0x10, 0x3, 0x5, 0x4, 0x9e, 'gre0\x00', 'wg0\x00', {}, {0xff}, 0x0, 0x8}, 0xbc, 0x10c}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @multicast2, @rand_addr=0x64010100, 0x2}}}], {{'\x00', 0xbc, 0xe0}, {0x24}}}}, 0x3f8) getsockopt$inet_sctp_SCTP_MAX_BURST(r5, 0x84, 0xc, &(0x7f0000000040)=@assoc_value={0x0}, &(0x7f0000000000)=0x8) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r4, 0x84, 0x7b, &(0x7f0000000080)={r6, 0x6}, &(0x7f0000000100)=0x8) setsockopt$MRT6_ADD_MIF(r0, 0x29, 0xca, 0x0, 0x0) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={0x0}, 0x1, 0x0, 0x0, 0x4}, 0x0) setsockopt$MRT6_FLUSH(r0, 0x29, 0xd4, 0x0, 0x0) socket$kcm(0x11, 0x2, 0x0) r7 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000100)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) read$FUSE(r7, &(0x7f00000034c0)={0x2020}, 0x2020) setsockopt$sock_attach_bpf(r2, 0x107, 0x14, &(0x7f0000000000)=r7, 0x4) 7.295431968s ago: executing program 3 (id=1169): socket$inet6_sctp(0xa, 0x5, 0x84) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), 0xffffffffffffffff) openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x8001, 0x0, 0x9, 0x40000, 0xfffffe0000000003, 0xfa11, 0xfffffffe}, 0x0) bpf$OBJ_PIN_MAP(0x6, &(0x7f0000000300)=@o_path={&(0x7f0000000240)='./file0\x00', 0x1, 0x4000, r1}, 0x14) syz_open_dev$dri(&(0x7f0000000040), 0x1, 0x0) r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0xc80, 0x0) close(r2) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x82a540, 0x0) r3 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$IP_VS_SO_SET_STARTDAEMON(r3, 0x0, 0x48b, &(0x7f0000000000)={0x2, 'bond0\x00', 0x8}, 0x18) r4 = syz_usb_connect(0x0, 0x24, &(0x7f00000002c0)=ANY=[@ANYBLOB="1201000009003940422c021664da010203010902120001000000040904"], 0x0) syz_usb_control_io$cdc_ncm(r4, 0x0, 0x0) getpid() capset(&(0x7f0000000100)={0x20071026}, &(0x7f00000001c0)={0x0, 0x1000, 0x0, 0x81, 0x8, 0x1}) r5 = syz_clone(0x400, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r5) ptrace(0x10, r5) ptrace$peeksig(0x4209, r5, &(0x7f0000000140)={0x2}, 0x0) ioctl$PTP_SYS_OFFSET_PRECISE(0xffffffffffffffff, 0xc0403d08, &(0x7f0000000380)) setpriority(0x1, r5, 0x6) r6 = socket$rds(0x15, 0x5, 0x0) bind$rds(r6, &(0x7f0000000200)={0x2, 0x4e21, @loopback}, 0x10) 6.903410225s ago: executing program 1 (id=1170): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb47, 0x9, 0x8, 0x80000001, 0x3}, 0x0) r2 = socket$kcm(0x2, 0x0, 0x0) setsockopt$sock_attach_bpf(r2, 0x1, 0x50, 0x0, 0x0) ioctl$TIOCMGET(0xffffffffffffffff, 0x541e, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000002600)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a78000000060a0b040000000000000000020000004c000480480001800a0001006d6174636800000038ae41bd891a0eb73674617469737469630000001c0003004cb4fc4ba7906e8f58c2052fade1bc2c62cdeb7521cf85ee08000240000000000900010073797a30000000000900020073797a3200000000140000001100010000000000000000000300000a"], 0xa0}}, 0x0) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x60240) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r4, 0xc0a85320, 0x0) r5 = epoll_create(0x101) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r4, &(0x7f0000000080)={0x40000014}) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140), 0x8417f, 0x0) r6 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) socket$igmp(0x2, 0x3, 0x2) rt_sigqueueinfo(0x0, 0xe, &(0x7f00000004c0)={0x22, 0x6, 0x7}) ioctl$BTRFS_IOC_SUBVOL_SETFLAGS(r6, 0x4008941a, &(0x7f0000000180)=0x2) syz_emit_ethernet(0x212, &(0x7f0000000540)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xb}, @void, {@ipv6={0x86dd, @generic={0xc, 0x6, "0cb9f8", 0x1dc, 0x2, 0xff, @private1={0xfc, 0x1, '\x00', 0x1}, @local, {[@dstopts={0x87, 0x14, '\x00', [@pad1, @pad1, @padn={0x1, 0x2, [0x0, 0x0]}, @generic={0x8, 0x97, "b327721822bdda53e5895205a8bad7f2ec2b2ec1d42bda9f26583d2e5581ef47d8225eb27656956a3de288d6d6b9aa11b168001ef0960fa112109c76b2032c89740201cd675ec46806c848d454afa637ae5f473dec33e3267d49f9dbcc6ef226cc9975cf3cdbd6ce89af91d36ae1b7ec0d7af28dbfed8ef4e43bf58685bffb6b07a05746337cb0a68845289378801e59451cbf4cbfdf22"}, @ra={0x5, 0x2, 0x2}]}, @hopopts={0x3c}, @dstopts={0x0, 0x5, '\x00', [@hao={0xc9, 0x10, @mcast1}, @padn={0x1, 0x1, [0x0]}, @enc_lim={0x4, 0x1, 0x4}, @calipso={0x7, 0x10, {0x0, 0x2, 0x37, 0x7, [0x5]}}, @enc_lim={0x4, 0x1, 0x2}]}, @fragment={0x2e, 0x0, 0x9, 0x0, 0x0, 0x2, 0x68}, @fragment={0x5c, 0x0, 0xd8, 0x0, 0x0, 0x1, 0x66}, @fragment={0x3e, 0x0, 0x22, 0x0, 0x0, 0x0, 0x65}, @srh={0xc, 0xc, 0x4, 0x6, 0xfd, 0x0, 0x1, [@private0, @dev={0xfe, 0x80, '\x00', 0x12}, @empty, @private0={0xfc, 0x0, '\x00', 0x1}, @private0={0xfc, 0x0, '\x00', 0x1}, @empty]}], "ee28a156960c50d657ab38d856c5fba56b9666074c0595c00f0b8736188c616652f2bdcd5e93ae294ede701c3aa48e188114000c6849b0707e596234f9f992d2c358db82e4ea64919f09bdc18454b0a2d1f3d97bd058c5c291a9f96aa3fb5c78e2565afa39039634811c4f61"}}}}}, &(0x7f0000000240)={0x0, 0x1, [0x43e, 0xcbb, 0x7a6, 0x1ed]}) syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) socket$kcm(0xa, 0x3, 0x3a) 6.829559003s ago: executing program 0 (id=1171): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) fchdir(0xffffffffffffffff) exit(0xffff) open(&(0x7f0000000340)='./bus\x00', 0x4c27e, 0x2) connect$unix(r0, &(0x7f0000000380)=@abs={0x0, 0x0, 0x4e23}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r2, &(0x7f0000001500)={0x28, 0x0, 0x0, @my=0x1}, 0x10) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_emit_ethernet(0x7c, &(0x7f0000000000)=ANY=[@ANYBLOB="ffffffffffff00000000000086dd6914006390666d1425ae808000462f0020010000000000000000000000000001ff0200000000000000000000000000010c2088be000000030c000800fffd080086dd080088be00000104162cfcfb010000000000007f080022eb0000000128f19309020000000000000200c41812"], 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x9, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1\x00', 0x8042, 0x0) fcntl$setlease(r3, 0x400, 0x1) r4 = socket$can_bcm(0x1d, 0x2, 0x2) socket$kcm(0x29, 0x2, 0x0) r5 = socket$inet(0xa, 0x801, 0x84) listen(r5, 0xfffffffd) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000040)) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f0000000100)={'vcan0\x00'}) sendmsg$can_bcm(r4, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000180)={0x1, 0x400, 0x0, {0x0, 0x2710}, {0x0, 0x2710}, {}, 0x1, @can={{0x4, 0x0, 0x1}, 0x2, 0x3, 0x0, 0x0, "7b442856bfec870b"}}, 0x48}, 0x1, 0x0, 0x0, 0x4004040}, 0x0) sendmsg$can_bcm(r4, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000580)=ANY=[@ANYBLOB="010000000202000019000000", @ANYRES32=0x77359400, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000001000000000000e004cfe8004c86b8b1f25c1517258e91eff8d103a5f6dc2e09e708fba3be5c61e0ceb6be169a245640fbbe5376da83779dc5f6511c8ab6af047a0877f69a7ea5508e7115affaf5bbed70ab36ade87b0a772079888350890218aa87d877aab7e5c1c5e91e82a1455d82e7e2c1e535194efe1a4660279b8f70e927c99079a863aa7b40491ab2befee758e30136213596ec704e230c61d485d5be4e87ca7cf48da30c27036b964103"], 0x48}}, 0x40000) openat$nullb(0xffffffffffffff9c, &(0x7f00000002c0), 0x20a000, 0x0) syz_io_uring_setup(0xb, 0x0, &(0x7f0000000040)=0x0, &(0x7f00000000c0)=0x0) syz_io_uring_submit(r6, r7, 0x0) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000000)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) syz_genetlink_get_family_id$batadv(0x0, r3) r8 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x14d802, 0x0) r9 = syz_open_dev$loop(&(0x7f0000000140), 0x8, 0x40) ioctl$LOOP_CONFIGURE(r9, 0x4c0a, &(0x7f0000000400)={r8, 0x0, {0x2a00, 0x80010000, 0x0, 0x0, 0x7, 0x0, 0x0, 0x16, 0x15, "fee8a2ab78fc979fd1e00d96f72000000ba89de2b7fb0000e6a180b8785d960001000000000041eb8109af0000000000000000002900", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "f422741b13103e52f400003fe2000000000000000000000000000000002000", [0x8, 0x2000000000001]}}) 5.791397933s ago: executing program 2 (id=1173): r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_ro(r0, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) read$watch_queue(r1, &(0x7f0000000540)=""/146, 0x92) (async) write$binfmt_elf64(r1, &(0x7f0000000b80)=ANY=[@ANYBLOB="7f454c46e801007a03000000000000000300060009000000e80100000000000040000000000000003c0300000000000007000000ff0738000100010007007800000000700600000008000000000000000700000000000000ffffffffffffffff020000000000000001010000000000008d0000000000000037beb0eebb7f34ce721e7f90f650b6587e5f496c80a8e39286dedeee1ae8371af7c9aebd829c2c6f51bf7b5ec16665b5666ef891e16a4c5ca6338022c4dd363634fb2bfc7c14f90d914f74de6db90c4aac82a8a49612528ce6a4ae9956ff5ef6be28515b43e43ecfc85680ac03c4bacbe9e5d9dd43e9917db5def04ad1944f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ea4ddaee7decb0e30000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004000"/2047], 0x7f7) socket$nl_netfilter(0x10, 0x3, 0xc) (async) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r4, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x1, {0x0, 0x3, 0x3}}, 0x10) (async, rerun: 32) r5 = socket$pppl2tp(0x18, 0x1, 0x1) (async, rerun: 32) r6 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r5, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r6, {0x2, 0x4e25, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e) (async) r7 = syz_genetlink_get_family_id$l2tp(&(0x7f00000005c0), 0xffffffffffffffff) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000600)={0x40, r7, 0x1, 0x1070bd0c, 0x4, {0x5}, [@L2TP_ATTR_CONN_ID={0x8, 0x9, 0x2}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0xaa8}, @L2TP_ATTR_SESSION_ID={0x8}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x7}, @L2TP_ATTR_COOKIE={0xc, 0xf, 0x5}]}, 0x40}, 0x1, 0x0, 0x0, 0x40811}, 0x20) (async) r9 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r9, &(0x7f0000000040)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @private2}}}, 0x32) (async) sendmmsg(r9, &(0x7f0000004380)=[{{0x0, 0x0, 0x0}}], 0x34000, 0x0) (async) connect$unix(r2, &(0x7f0000000300)=@file={0x0, './file0\x00'}, 0x6e) (async, rerun: 32) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) (async, rerun: 32) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async, rerun: 32) r10 = creat(&(0x7f0000000240)='./file0\x00', 0x122) (rerun: 32) r11 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$IPT_SO_SET_REPLACE(r11, 0x4000000000000, 0x40, &(0x7f0000002700)=@raw={'raw\x00', 0x4001, 0x3, 0x53c, 0x2fc, 0x0, 0x148, 0x0, 0x148, 0x4a8, 0x240, 0x240, 0x4a8, 0x240, 0x7fffffe, 0x0, {[{{@ip={@broadcast, @local, 0x0, 0x0, 'ip6gretap0\x00', 'batadv_slave_0\x00', {}, {}, 0x88, 0x3, 0x10}, 0x0, 0x2cc, 0x2fc, 0x0, {}, [@common=@unspec=@bpf1={{0x230}, @fd={0x2, 0x0, r10}}, @common=@unspec=@connmark={{0x2c}, {0xfffffffc, 0x8}}]}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0xa, 0x3, 0x8, 0x1}}}, {{@uncond, 0x0, 0x188, 0x1ac, 0x0, {}, [@common=@inet=@recent0={{0xf4}, {0x8, 0x0, 0x1, 0x1, 'syz1\x00'}}, @inet=@rpfilter={{0x24}, {0x8}}]}, @common=@inet=@SYNPROXY={0x24, 'SYNPROXY\x00', 0x0, {0x4, 0x0, 0x3ff}}}], {{'\x00', 0x0, 0x70, 0x94}, {0x24}}}}, 0x598) fsync(r11) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$sock_FIOGETOWN(r2, 0x8903, &(0x7f0000000100)=0x0) tkill(r12, 0x2c) (async) r13 = syz_open_dev$video(&(0x7f0000000040), 0x8, 0x101840) ioctl$VIDIOC_S_SELECTION(r13, 0xc040565f, &(0x7f0000000080)={0xa, 0x0, 0x1, {0xe7ff, 0x1, 0x406, 0x870}}) (async) setrlimit(0x2, &(0x7f00000000c0)={0x0, 0x2400000}) 5.114274893s ago: executing program 1 (id=1174): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, 0x0}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r2 = eventfd2(0x0, 0x0) writev(r2, &(0x7f0000000480)=[{&(0x7f0000000000)="f67804e83b4e100b", 0x8}, {0x0, 0x8}], 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./file0\x00', 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000180), 0x42, 0x0) mount$fuse(0x0, 0x0, &(0x7f0000000080), 0x2000002, 0x0) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') read$FUSE(r3, &(0x7f0000004100)={0x2020}, 0x2020) socket$nl_route(0x10, 0x3, 0x0) r4 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_buf(r5, 0x0, 0x10, &(0x7f0000000340)="17000000020001000003be8c5e687a8a6a002b00020100ecff3f0000000300000a7f1c000098fc5a53d3f5b7e4a96c6b06169da9c0f8d9485bbb6a880a00243c5197b29f9368bdd6c8db0000dba67e06000000e289c46f8ab8b4028a7a63c900000200df0180000000000100000000000080c457681f009cee4a5acb3dac00001fa1315033bf79ac2df5bc080236e2b68c8eec25a02aff06011500000000010000000affff02dfccebf6ba00085d024f0298e9e90554062a", 0xb8) r6 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000380), 0x101040) ioctl$SNDRV_TIMER_IOCTL_SELECT(r6, 0x40345410, &(0x7f0000000300)={{0x0, 0x2}}) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r6, 0x54a2) r7 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000600), 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r7, 0xc08c5332, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r7, 0x40605346, 0x0) r8 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000018c0), 0xa8c01) write$sndseq(r8, &(0x7f0000000000), 0x0) close_range(r4, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) 5.114048409s ago: executing program 2 (id=1175): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$packet(0x11, 0x3, 0x300) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x5, 0x1ff003, 0x66, 0x7f, 0x1}, 0x48) bpf$MAP_GET_NEXT_KEY(0x15, &(0x7f0000000580)={r1, 0x0, 0x0}, 0x1c) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x300000c, 0x204031, 0xffffffffffffffff, 0xffffd000) r2 = socket(0xa, 0x3, 0xff) setsockopt$inet6_int(r2, 0x29, 0x24, &(0x7f0000000040)=0x9, 0x4) socket$kcm(0x11, 0xa, 0x300) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) sendto$inet6(r0, &(0x7f0000000340)="8832", 0x2, 0x24000045, &(0x7f00000001c0)={0xa, 0x2, 0xfffffff7, @loopback, 0x9}, 0x1c) 5.021508569s ago: executing program 5 (id=1176): socket$inet_icmp_raw(0x2, 0x3, 0x1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x0, &(0x7f0000000080)={0x2, &(0x7f0000000180)=[{0x3, 0x1, 0x1b, 0x2}, {0x3, 0xf, 0x9, 0x7}]}) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) syz_open_dev$usbfs(&(0x7f0000000140), 0x400076, 0x484100) fsopen(&(0x7f00000000c0)='msdos\x00', 0x0) r2 = syz_open_dev$dvb_demux(&(0x7f0000000080), 0x0, 0x41) r3 = syz_open_dev$dvb_demux(&(0x7f0000001e00), 0x0, 0x0) ioctl$DVB_DEMUX_DMX_SET_FILTER(r2, 0x403c6f2b, &(0x7f0000000100)={0x1, {"5b00000000000000000000000600", "241e6a0b37e28869f574458eb6417d55", "a34d3bcc4817356e5c266b26fc7430de"}, 0x7, 0x7}) ioctl$DVB_DEMUX_DMX_SET_FILTER(r3, 0x403c6f2b, &(0x7f0000000040)={0x9, {"4772ffacff04856ec9e8776f8ee906be", '\x00', "e600000600800000088000"}, 0x3, 0x4}) ioctl$DVB_DEMUX_DMX_SET_FILTER(r2, 0x403c6f2b, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x80101, 0x8) syz_open_dev$sg(&(0x7f00000060c0), 0xfffffffffffffffd, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x200000b, 0x12, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x4000, &(0x7f0000000300)=0x2, 0x7797, 0x3) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x20200, 0x0) r6 = syz_usb_connect(0x0, 0x2d, &(0x7f00000012c0)=ANY=[@ANYBLOB="120100001ddf8208c007121522300000000109021b0001000000010904000001faf40d000905820349"], 0x0) syz_usb_control_io(r6, 0x0, 0x0) r7 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r7, &(0x7f0000000480)=""/74, 0x4a) syz_usb_ep_write$ath9k_ep1(r6, 0x82, 0x0, 0x0) ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x8002) ioctl$KVM_SET_CPUID2(r4, 0x4048aecb, &(0x7f0000002400)) 4.905000848s ago: executing program 2 (id=1177): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) mremap(&(0x7f00007f1000/0x4000)=nil, 0x4000, 0x800000, 0x0, &(0x7f0000130000/0x800000)=nil) getdents(0xffffffffffffffff, &(0x7f0000000140)=""/177, 0xb1) r2 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r2, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/65, 0x328000, 0x800}, 0x20) syz_clone(0xa2540400, 0x0, 0x0, 0x0, 0x0, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000040), 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/timer_list\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_PAGE_FLIP(r3, 0xc01864b0, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) openat$fb0(0xffffffffffffff9c, &(0x7f0000000000), 0x402, 0x0) getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0) syz_io_uring_setup(0x39, &(0x7f0000000580)={0x0, 0xffad, 0x12, 0x1, 0x127}, 0x0, &(0x7f0000001880)) 4.741170288s ago: executing program 0 (id=1178): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r3, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)=@newtfilter={0x3c, 0x2c, 0xd3f, 0x70bd28, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0xb, 0xfff3}, {}, {0x7, 0x300}}, [@filter_kind_options=@f_flower={{0xb}, {0xc, 0x2, [@TCA_FLOWER_FLAGS={0x8, 0x16, 0x1}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x10}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) r5 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000035ffaa20cd0caf104a380102030109021b0001000010000904590201801e2a00090582"], 0x0) syz_usb_control_io$uac1(r5, 0x0, 0x0) syz_usb_control_io$printer(r5, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r5, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r5, 0x0, 0x0) syz_usb_control_io$uac2(r5, 0x0, 0x0) syz_usb_control_io$printer(r5, 0x0, &(0x7f0000000bc0)={0x34, &(0x7f0000000880)=ANY=[@ANYBLOB="13c5bd86a100"], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r5, 0x0, 0x0) syz_usb_control_io$hid(r5, 0x0, &(0x7f0000000a40)={0x2c, &(0x7f0000000700)={0x0, 0x16}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r5, 0x0, &(0x7f0000002380)={0x24, &(0x7f0000001080)={0x40, 0x17, 0x1, "9f"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000040)={0x1, 0x0, 0x6000, 0x2000, &(0x7f0000fa2000/0x2000)=nil}) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000580)=@ipv4_newroute={0x38, 0x18, 0x35f32a6dfa748ddd, 0x0, 0xfffbfffd, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x400}, [@RTA_ENCAP_TYPE={0x6, 0x15, 0x4}, @RTA_ENCAP={0x14, 0x16, 0x0, 0x1, @SEG6_LOCAL_BPF={0x10, 0x8, 0x0, 0x1, @SEG6_LOCAL_BPF_PROG_NAME={0xa, 0x2, '*/^\\^\x00'}}}]}, 0x38}}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000080)={0x26e8, 0x0, 0x0, 0x2000, &(0x7f0000ffe000/0x2000)=nil}) setsockopt$inet_MCAST_JOIN_GROUP(r4, 0x0, 0x2a, &(0x7f0000000240)={0x2, {{0x2, 0x4, @empty}}}, 0x84) r9 = open_tree(0xffffffffffffffff, &(0x7f00000001c0)='./file0\x00', 0x9002) ioctl$KVM_SET_REGS(r9, 0x4090ae82, &(0x7f0000000300)={[0x9, 0x7fff, 0xfffffffffffffffc, 0x9, 0xf79d, 0x9, 0x0, 0x0, 0x8, 0x6, 0xffffffffffff10ab, 0x4, 0x3, 0x4, 0x5, 0x8000000000000001], 0x2, 0xa0283}) syz_usb_connect(0x0, 0x2d, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000d5e9bd40eb030200c0ba050000010902115c01000000000904000001b504b100090581"], 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x6, 0x8031, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000000000/0x9000)=nil, 0x600002, 0x600002, 0x7, &(0x7f0000a00000/0x600000)=nil) 3.440096489s ago: executing program 3 (id=1179): prlimit64(0x0, 0x7, &(0x7f0000000440), 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x1, 0x3, &(0x7f0000000280)=ANY=[@ANYBLOB="18007f0000b5000000000000bd9d00109539a2cfc3eb5700"], &(0x7f00000003c0)='syzkaller\x00', 0x2}, 0x94) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=ANY=[@ANYBLOB="6c0100001000130700000000fcdbdf25ff02000000000000000000000000000120010000000000000000000000000001000000004e2100020200000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fc010000000000000000000000000000000000fe32000000fe863830e3569c64780000000000001b0000000000000000000d000a000000000000000000000000080000000000000000000000000000000300000000000000000000000000008043050000000000000400000000000000ffffffffffffff7ffcffffffffffffff000000000000000000000000000000000000000028bd700000350000020004000000000060001200726663343130362867636d2861657329290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000080000000217d66d38547aa140db8a200000000c538c7cb7a1c00040000004e244e240000ac1e010100"/288], 0x16c}, 0x1, 0x0, 0x0, 0x880}, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000000)=0xffb, 0x0, 0x4) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000040)={0x0, 0x1c, &(0x7f0000000080)=[@in6={0xa, 0x0, 0x0, @rand_addr=' \x01\x00'}]}, &(0x7f0000000180)=0x10) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, 0x0, &(0x7f0000000140)='7', 0x0) r3 = syz_io_uring_setup(0x10d2, &(0x7f0000000540)={0x0, 0x7734, 0x80, 0x0, 0xdc}, &(0x7f0000000600)=0x0, &(0x7f00000005c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) r6 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080), 0x802, 0x0) write$input_event(r6, &(0x7f0000000040)={{0x0, 0xea60}, 0x11, 0x1ff, 0x1}, 0x18) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) syz_io_uring_submit(r4, r5, &(0x7f0000000140)=@IORING_OP_SEND={0x1a, 0x11, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x8014}) io_uring_enter(r3, 0x47bc, 0x0, 0x0, 0x0, 0x0) r7 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r7, 0x84, 0xd, &(0x7f00000000c0)=@assoc_value={0x0}, &(0x7f00000002c0)=0x8) getsockopt$inet_sctp6_SCTP_RTOINFO(r1, 0x84, 0x0, &(0x7f0000000100)={r8, 0x101, 0x8, 0x80000001}, &(0x7f0000000140)=0x10) 3.327548349s ago: executing program 1 (id=1180): r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x34) ioctl$KVM_SET_USER_MEMORY_REGION(r0, 0x4020ae46, &(0x7f0000000000)={0x2710, 0x1, 0x6000, 0x2000, &(0x7f0000ffe000/0x2000)=nil}) r1 = getpid() ptrace$setsig(0x4203, r1, 0x3, &(0x7f0000000040)={0x21, 0x6, 0x4}) r2 = open(&(0x7f00000000c0)='./file0\x00', 0x180, 0x128) io_uring_enter(r2, 0x3d0f, 0xebbb, 0x50, &(0x7f0000000100)={[0x1, 0xff]}, 0x8) ioctl$KVM_GET_VCPU_MMAP_SIZE(r2, 0xae04) r3 = openat$kvm(0xffffff9c, &(0x7f0000000140), 0x410000, 0x0) waitid(0x1, r1, &(0x7f0000000180), 0x1, &(0x7f0000000200)) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f00000002c0), r2) sendmsg$NL80211_CMD_REGISTER_FRAME(r2, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000380)={&(0x7f0000000300)={0x5c, r4, 0x20, 0x70bd28, 0x25dfdbfc, {{}, {@void, @val={0xc, 0x99, {0x4, 0x3c}}}}, [@NL80211_ATTR_FRAME_TYPE={0x6, 0x65, 0xe}, @NL80211_ATTR_FRAME_MATCH={0x33, 0x5b, "649470e44424477f0c8652d57f438389b320f9fe4c8e027d50015bbcc5238703eb3fc524b134ab43bbf8bff7786f4f"}]}, 0x5c}, 0x1, 0x0, 0x0, 0x20000000}, 0x40) mprotect(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x1000001) r5 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000500)={&(0x7f0000000400)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x3, [@func={0x2, 0x0, 0x0, 0xc, 0x3}, @fwd={0x10}]}, {0x0, [0x5f]}}, &(0x7f0000000440)=""/143, 0x33, 0x8f, 0x0, 0x4, 0x10000, @value=r2}, 0x28) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000540)=@base={0x16, 0x9, 0x4, 0x5, 0x4, r2, 0x6, '\x00', 0x0, r5, 0x5, 0x2, 0x3}, 0x50) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000600)={0x0, 0x18, 0xfa00, {0x2, &(0x7f00000005c0)={0xffffffffffffffff}, 0x13f, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(r2, &(0x7f0000000640)={0xa, 0x4, 0xfa00, {r7}}, 0xc) sendmsg$NFQNL_MSG_VERDICT(r2, &(0x7f0000000940)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000900)={&(0x7f00000006c0)={0x21c, 0x1, 0x3, 0x101, 0x0, 0x0, {0x1, 0x0, 0xa}, [@NFQA_EXP={0x164, 0xf, 0x0, 0x1, [@CTA_EXPECT_TUPLE={0x30, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @remote}, {0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}}}]}, @CTA_EXPECT_MASTER={0x8c, 0x1, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3a}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private2={0xfc, 0x2, '\x00', 0x1}}, {0x14, 0x4, @empty}}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @private=0xa010102}, {0x8, 0x2, @dev={0xac, 0x14, 0x14, 0x2a}}}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast2}, {0x14, 0x4, @local}}}]}, @CTA_EXPECT_ID={0x8, 0x5, 0x1, 0x0, 0x5}, @CTA_EXPECT_CLASS={0x8, 0x9, 0x1, 0x0, 0x96d4}, @CTA_EXPECT_ZONE={0x6, 0x7, 0x1, 0x0, 0x3}, @CTA_EXPECT_NAT={0x7c, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_DIR={0x8}, @CTA_EXPECT_NAT_DIR={0x8}, @CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_EXPECT_NAT_DIR={0x8}, @CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_EXPECT_NAT_TUPLE={0x50, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @dev={0xfe, 0x80, '\x00', 0x27}}, {0x14, 0x4, @rand_addr=' \x01\x00'}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x88}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @loopback}, {0x8, 0x2, @rand_addr=0x64010101}}}]}]}, @CTA_EXPECT_FLAGS={0x8, 0x8, 0x1, 0x0, 0x2}, @CTA_EXPECT_HELP_NAME={0x5, 0x6, '\x00'}]}, @NFQA_EXP={0xa4, 0xf, 0x0, 0x1, [@CTA_EXPECT_NAT={0x90, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_EXPECT_NAT_TUPLE={0x10, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x6}}]}, @CTA_EXPECT_NAT_TUPLE={0x74, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x88}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @remote}, {0x14, 0x4, @empty}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x21}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}]}]}, @CTA_EXPECT_FLAGS={0x8}, @CTA_EXPECT_ID={0x8, 0x5, 0x1, 0x0, 0x1680}]}]}, 0x21c}, 0x1, 0x0, 0x0, 0x4000000}, 0x91) setsockopt$inet_tcp_TCP_REPAIR(r3, 0x6, 0x13, &(0x7f0000000980)=0xffffffffffffffff, 0x4) quotactl_fd$Q_QUOTAON(r2, 0x0, 0xffffffffffffffff, &(0x7f00000009c0)='./file0\x00') r8 = dup3(r2, r3, 0x0) sendmsg$nl_generic(r8, &(0x7f0000000d80)={&(0x7f0000000a00), 0xc, &(0x7f0000000d40)={&(0x7f0000000a40)={0x2f4, 0x27, 0x300, 0x70bd25, 0x25dfdbfe, {0x19}, [@generic="d8c21e0231c5e743a039a0e0668f624decc69941e843b48e601dd3f3e0bf8f0035d5ac117f58dee6fe330df99cc55713cb01bf6f7e080424eb33166975c5d8f9c90fd94846e9bfa5d4d5e13a227b4f9a56313dfc31f0ed4d75b1ce0c5cc50ddf05c768f3f6dc1bdbe4a0b3dbee1407917c74eeda8066f55addedd01acc03109548009fd4ed624dedb34d617c06fd16ea27e436ae04874ffb0025c7e82d69cb52d00ad06f1af2de8c49bb6844732e5371b53f9092af27c04b2900cc82ce271b43ba558f5a1377a58d71180a8bfbb6678caae380300c380a54688ad39a416fd5e2b195102ef17539e14d3123", @typed={0x14, 0xf7, 0x0, 0x0, @ipv6=@ipv4={'\x00', '\xff\xff', @rand_addr=0x64010100}}, @generic="66db706a11a4d2eb062860be51f0806f0c6b9fa775d6ae9c8b4b3dba", @generic, @generic="377d154033c5b5388d9813f35efcd5c7dff47bb6a15c4a33298cb5d90c8dc6c3d1a690e7a1d51d9ea03169141b8e2ca12388d357b63a69dcf6f6f5f6f4be2e68ce608175713220a2866a7896c11d147d0c77a76492b7289f3c5d30147fda04839bf135b723fb33890f56c636c580d768fb626694dd144b6c10343dc3f0a47246a3d98d6dfe37610fda1d8edbaf541b1f9f9e1bbe82192c8899f250afa548f3a78c68113954adb5b2cdf0ceb15360d3fddc5c999c776298380a2cc47a25ad2061f4919f5eb148d47f28ec176b76bb334aa7892a71945e0b8b", @generic="784d578792cf0c3ac4c234e694c4896cbf72c3e2c06dcdadfa947e27d1b940eb7360c95c339826057cbbe3d9fd563e2d30470c6396b8b4a1b52b646ad6f4a2270683329d5a17576037676a693a9bdc6e8bfb833bc228695d766e8cade0bca3622ffb5e2f664204ef62ba0427307537de39ab821f4c3cc14140057267f54f97ead174a81b488b05146cbca583295eabdb3818a3c5389a0567fa901dc44363589caff56b54ac493685e2e4776b7caa0d662eb13d192415b035537ade3c2878ce136af68b39bcd37b8d30c51396a077", @typed={0x8, 0xe8, 0x0, 0x0, @fd=r6}, @generic="215f596396b2628a7d6eb9304cc920ad4528dcbe"]}, 0x2f4}, 0x1, 0x0, 0x0, 0x40}, 0x41) r9 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x1) ioctl$KVM_SET_VCPU_EVENTS(r9, 0x4040aea0, &(0x7f0000000dc0)=@arm64={0xb, 0x8, 0x3, '\x00', 0x4}) write$binfmt_script(r2, &(0x7f0000000e00)={'#! ', './file0', [{0x20, ' \x01\x00'}, {0x20, '\xff\xff'}, {0x20, '-\''}, {0x20, '/dev/kvm\x00'}, {0x20, '\xff\xff'}], 0xa, "db9dff465064ebe7266f5bf05b56c951027506baabf58e638b48cd4a6ffa3c06bcb5c907d9acb61485e7c5de6797de2bec08cfaebb6574cc6cb83d210c78351d8e3c1d4e5362729f045aecdfa6e7859626a7859b81c293f065d5880b0945347adf1fe8eeb2d2fea787f191aa83c1d2ac5e580f7d73060c17d8a3b1d5aa0f84c5ee40abfece9bb2ac7c21f03c66511fb549bd3f8b13f3fdde72b75e6623a48dceab7f72f18fad3d6c9efe3e2b400ef0708a2e1095b7bc2cf2"}, 0xda) ioctl$XFS_IOC_PATH_TO_HANDLE(r8, 0xc01c5869, &(0x7f0000001000)={r2, &(0x7f0000000f00)='\'}\'!@%-\x00', 0x40040, &(0x7f0000000f40)={@_ha_fsid={[0x2, 0x100]}, {0x2, 0xf, 0x10000, 0x15e501c4}}, 0x8001, &(0x7f0000000f80), &(0x7f0000000fc0)=0xffff}) r10 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) ioctl$KVM_TDX_GET_CPUID(r10, 0xc004aeba, &(0x7f0000001080)={0x5, 0x0, &(0x7f0000001040)={0x1, 0x0, [{0x0, 0x6, 0x0, 0x9, 0x4133, 0xfff, 0x8001}]}}) r11 = syz_usb_connect$cdc_ncm(0x4, 0xa1, &(0x7f00000010c0)={{0x12, 0x1, 0x110, 0x2, 0x0, 0x0, 0xdf, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x8f, 0x2, 0x1, 0x2e, 0xd0, 0x8, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0xa, 0x24, 0x6, 0x0, 0x1, "f61f1bfe71"}, {0x5, 0x24, 0x0, 0x7}, {0xd, 0x24, 0xf, 0x1, 0x401, 0x3, 0x5dc, 0x8}, {0x6, 0x24, 0x1a, 0xfdd}, [@dmm={0x7, 0x24, 0x14, 0x5, 0x7}, @mbim_extended={0x8, 0x24, 0x1c, 0x2e, 0x8, 0x3}, @mbim={0xc, 0x24, 0x1b, 0x8, 0x6bec, 0xd8, 0x2, 0x9, 0x3}, @mbim={0xc, 0x24, 0x1b, 0x2a7, 0x2, 0x0, 0x7, 0x800, 0x5}, @network_terminal={0x7, 0x24, 0xa, 0x3, 0x2, 0x1, 0x10}]}, {{0x9, 0x5, 0x81, 0x3, 0x10, 0x3, 0x6, 0x6}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0xe40, 0xff, 0xb, 0x1}}, {{0x9, 0x5, 0x3, 0x2, 0x20, 0x72, 0xe, 0x1}}}}}}}]}}, &(0x7f0000001400)={0xa, &(0x7f0000001180)={0xa, 0x6, 0x200, 0x0, 0x7f, 0x1, 0xff, 0x9}, 0x4b, &(0x7f00000011c0)={0x5, 0xf, 0x4b, 0x4, [@ssp_cap={0x18, 0x10, 0xa, 0xf5, 0x3, 0x1, 0xff00, 0x10, [0xcf, 0xff3f00, 0xff0000]}, @ext_cap={0x7, 0x10, 0x2, 0x2, 0x7, 0x5, 0x1}, @ssp_cap={0x18, 0x10, 0xa, 0xd, 0x3, 0x4, 0x0, 0xaeb, [0x3f30, 0x0, 0x3f3f]}, @generic={0xf, 0x10, 0xa, "9209da0c53f8b0e5920ba5b7"}]}, 0x5, [{0x4, &(0x7f0000001240)=@lang_id={0x4, 0x3, 0x2401}}, {0x17, &(0x7f0000001280)=@string={0x17, 0x3, "23eec2b2d2079727a7feaf1a8e15b8dab807916795"}}, {0xb3, &(0x7f00000012c0)=@string={0xb3, 0x3, "3bee4458d2384c82c82e3df2274c6d613ada164e77647bd59ef440f9c974f02dd92b1ee2e513a0f4c5852da71f8ceefdeb0fd7f42ba9420c9f347971786afadd921c86089fd6143ef05e4fd43ae79bade953167bf1ef99c53e016275c9df299f579bff537757596a8e49380bd09eed180b02f36912636b01e706bbda27d0aee7ca2cb3bebfea97435197e85ecb75d258fe0f916bfbbc8c1494325b27c3c32735f20b2eb9eaa9e229df3bed9050b51b7ef2"}}, {0x4, &(0x7f0000001380)=@lang_id={0x4, 0x3, 0x140c}}, {0x4, &(0x7f00000013c0)=@lang_id={0x4, 0x3, 0x480a}}]}) syz_usb_control_io$cdc_ncm(r11, &(0x7f0000001540)={0xc, &(0x7f0000001440)={0x0, 0x31, 0x7c, {0x7c, 0x2, "00059298e1931cb4be2a05a855247cac2fc78f644da71c155dace99cfc50630eb4e14f829f60eae6f8c0ae2e70989057f55d69e69673f123ad117668063b4577efdb8f30c2235ba024631f3d4ac414466890f26c25b2ffae306bea0a620e38b41be06e72a17de6aee1e58cfe0c69f855ec56fb69efde2180582f"}}, &(0x7f0000001500)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000001800)={0x24, &(0x7f0000001580)={0x40, 0x16, 0xb4, "0987d5ff24fe8836301a48e9c73adb5e11237f8bcd264f13597a319e073f9d6b477c5d2c34c734f992e8a15a819f25a347073663ebf7d659e0e2822d8e4dc038ad0345b619a5ed50b287fa548c6fafaa4339b3f965a7a7061a342670da6a74947a578bcb94296eb62f192ffb874e0b6dc2d51e8fd1d0be11f253b793f5e79946355d60bf65569bd283f550878728c4e7b709f21f38f5f184c623612a14a54add8e1aa3dac83f4dc9682109b6ddbe0c71bed11d5e"}, &(0x7f0000001640)={0x0, 0xa, 0x1, 0x4f}, &(0x7f0000001680)={0x0, 0x8, 0x1}, &(0x7f00000016c0)={0x20, 0x80, 0x1c, {0x8, 0x3, 0x4, 0xc, 0x3, 0x8, 0x5, 0xfffffffa, 0x205, 0x9, 0x3, 0x730}}, &(0x7f0000001700)={0x20, 0x85, 0x4, 0x9}, &(0x7f0000001740)={0x20, 0x83, 0x2}, &(0x7f0000001780)={0x20, 0x87, 0x2, 0x1000}, &(0x7f00000017c0)={0x20, 0x89, 0x2}}) ioctl$KVM_SET_SREGS(0xffffffffffffffff, 0x4138ae84, &(0x7f0000001840)={{0x58000, 0x10000, 0xe, 0x0, 0x8, 0x1, 0x2, 0x1, 0x80, 0xce, 0x7, 0x2}, {0xffff1000, 0x2001, 0x2, 0x3, 0x1a, 0x2, 0x4, 0x7, 0xc0, 0xf, 0x3, 0x3}, {0x41000, 0xc000, 0xa, 0x4, 0x2, 0x3, 0xff, 0x53, 0xa0, 0xf9, 0x11, 0x9}, {0xeeee0006, 0x50000, 0x8, 0x2, 0x0, 0xb6, 0xa6, 0xcd, 0x4, 0xde, 0xc3, 0x7}, {0x58000, 0x25000, 0xf, 0xf8, 0x7, 0x46, 0x4, 0xd8, 0x3, 0x2, 0x40, 0x8}, {0x41000, 0xd000, 0x3, 0xf, 0x50, 0xc, 0xb, 0x4, 0x8, 0xe, 0xc, 0x9}, {0xffffffff, 0x30000, 0xb, 0x0, 0x3, 0xf3, 0x1, 0x7, 0x9, 0x9a, 0x5, 0x10}, {0x0, 0xeeef0000, 0x0, 0x7, 0x80, 0x1, 0x1, 0xff, 0x1, 0x5a, 0x6, 0x9}, {0x2, 0xcb}, {0xeeee8000, 0x3f}, 0x20, 0x0, 0x70000, 0x210000, 0xf, 0x2000, 0x8000000, [0xc, 0x5, 0x4, 0x8]}) 3.003926218s ago: executing program 3 (id=1181): r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x20, 0x5ac, 0x269, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0xf8, 0xb, "", [{{0x9, 0x4, 0x0, 0x9, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0xa, 0x0, 0x1, {0x22, 0x1e3}}, {{{0x9, 0x5, 0x81, 0x3, 0x38d707d343173689, 0x5, 0xa, 0x70}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(0xffffffffffffffff, 0x0, &(0x7f0000000400)={0x18, 0x0, 0x0, 0x0, &(0x7f0000000380), 0x0}) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) r5 = openat$tcp_mem(0xffffff9c, &(0x7f0000000340)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0) fdatasync(r5) ioctl$KVM_CREATE_PIT2(r4, 0x4040ae77, &(0x7f0000000040)) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000000)={[0x800038, 0x7, 0x3, 0x180, 0x6, 0x10, 0xf1, 0x100000001, 0x1, 0xca0, 0xffffffffffffffff, 0x2000000002c, 0x0, 0x6, 0x0, 0xbd9], 0xffff1001, 0x43100}) r6 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r6, 0x4090ae82, &(0x7f00000003c0)={[0x7, 0x1000000000, 0x0, 0x200000000000043, 0x2000004, 0x0, 0x2004cb, 0x7ff, 0xa7c, 0x68ff, 0x7, 0x100008000000006, 0x803, 0x0, 0x9], 0xeeee8000, 0x202}) ioctl$KVM_SET_SREGS(0xffffffffffffffff, 0x4138ae84, &(0x7f00000001c0)={{0x3000, 0x1, 0x8, 0x8, 0xb, 0xe6, 0x40, 0x0, 0x0, 0x81, 0x80}, {0x5000, 0x3000, 0x3, 0xff, 0x42, 0x9, 0x75, 0x6, 0x36, 0x0, 0x2, 0xb4}, {0x40000, 0xdddd0000, 0xe, 0x5, 0x3, 0x7, 0x0, 0x21, 0x1, 0xa2, 0x5, 0x5}, {0x200000, 0xeeee0000, 0x9, 0x7, 0x5, 0x42, 0xb, 0xff, 0x8, 0x7, 0xe, 0x7}, {0xf000, 0x1000, 0xf, 0x3, 0x16, 0x7, 0xab, 0xb, 0xc, 0x9, 0xf7, 0x97}, {0xeeefa000, 0xdddd0000, 0x6, 0xa0, 0xb, 0x8, 0x1, 0xa8, 0x82, 0x2, 0x1, 0x7}, {0xeeee8000, 0x3000, 0xf, 0x5, 0x7, 0x5, 0x7, 0x3, 0x8, 0x0, 0x40, 0x74}, {0xdddd0000, 0x25000, 0xa, 0x5, 0xcd, 0x7, 0x1, 0x9, 0x2, 0xc, 0xb0, 0xa1}, {0xeeee0000, 0x30}, {0x40000, 0x7}, 0xa0000039, 0x0, 0x4, 0x2024, 0x2, 0x0, 0x100000, [0x6800000000000000, 0x4, 0x3, 0x8]}) ioctl$KVM_RUN(r6, 0xae80, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) ioctl$KVM_SET_ONE_REG(r7, 0x4048aecb, &(0x7f0000000540)=@arm64_ccsidr={0x6020000000110005, 0x0}) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x22, 0x371, {0x9}}}, &(0x7f0000000080)={0xffffffffffffffeb, 0x0, 0x0, 0x0, 0x0, 0x0}) r8 = socket$unix(0x1, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000003880)={0x0, 0x0}) recvmmsg$unix(r8, &(0x7f0000003780)=[{{&(0x7f0000000100)=@abs, 0x6e, &(0x7f0000000000)=[{&(0x7f0000000240)=""/100, 0x64}], 0x1, &(0x7f00000002c0)=[@cred={{0x18}}, @cred={{0x18}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x48}}, {{&(0x7f0000000440), 0x6e, &(0x7f0000000180)=[{&(0x7f0000000580)=""/160, 0xa0}], 0x1, &(0x7f0000000340)}}, {{&(0x7f00000004c0), 0x6e, &(0x7f0000000b00)=[{&(0x7f0000000640)=""/253, 0xfd}, {&(0x7f0000000740)=""/132, 0x84}, {0xfffffffffffffffe}, {&(0x7f0000000800)=""/156, 0x9c}, {&(0x7f0000002600)=""/74, 0x4a}, {&(0x7f00000008c0)=""/248, 0xf8}, {&(0x7f00000009c0)=""/255, 0xff}, {&(0x7f0000000ac0)=""/7, 0x7}], 0x8, &(0x7f0000000b40)=[@cred={{0x18}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x34}}, {{&(0x7f0000000b80)=@abs, 0x6e, &(0x7f0000000c40)=[{&(0x7f0000000c00)=""/61, 0x3d}], 0x1}}, {{&(0x7f0000000c80), 0x6e, &(0x7f00000010c0)=[{&(0x7f0000000d00)=""/74, 0x4a}, {&(0x7f0000000d80)=""/93, 0x5d}, {&(0x7f0000000e00)=""/82, 0x52}, {&(0x7f0000000e80)=""/24, 0x18}, {&(0x7f0000000ec0)=""/244, 0xf4}, {&(0x7f0000002680)=""/214, 0xd6}], 0x6, &(0x7f0000001100)=[@cred={{0x18}}, @cred={{0x18}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}], 0x44}}, {{0x0, 0x0, &(0x7f00000023c0)=[{&(0x7f0000001180)=""/127, 0x7f}, {&(0x7f0000001200)=""/113, 0x71}, {&(0x7f0000001280)=""/4096, 0x1000}, {&(0x7f0000002280)=""/144, 0x90}, {&(0x7f0000002340)=""/84, 0x54}], 0x5}}, {{&(0x7f0000002400), 0x6e, &(0x7f0000002540)=[{&(0x7f0000002480)=""/169, 0xa9}], 0x1, &(0x7f0000002580)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x50}}, {{0x0, 0x0, &(0x7f0000003680)=[{&(0x7f0000003900)=""/4096, 0x1000}, {&(0x7f0000003600)=""/103, 0x67}], 0x2, &(0x7f00000036c0)=[@cred={{0x18}}, @cred={{0x18}}, @cred={{0x18}}, @cred={{0x18}}], 0x60}}], 0x8, 0x10040, &(0x7f00000038c0)={r9, r10+60000000}) 2.459027815s ago: executing program 1 (id=1182): r0 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000280)={'vcan0\x00', 0x0}) bind$can_j1939(r0, &(0x7f0000000100)={0x1d, r1, 0x0, {}, 0xfd}, 0x18) connect$can_j1939(r0, &(0x7f0000000080)={0x1d, r1, 0x0, {0x0, 0xff, 0x2}, 0xfe}, 0x18) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000002c0)=@file={0x1, './file0\x00'}, 0xfffffffffffffd8f) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) ioctl$USBDEVFS_REAPURBNDELAY(0xffffffffffffffff, 0x4004550c, 0x0) r4 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$int_in(r4, 0x40000000af01, 0x0) ioctl$VHOST_SET_FEATURES(r4, 0x4008af00, &(0x7f00000001c0)=0x304008000) ioctl$VHOST_NET_SET_BACKEND(r4, 0x4008af30, 0x0) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2a, 0x0, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000009c0)={0xdc, 0x1, 0x1, 0x801, 0x0, 0x0, {0x0, 0x0, 0x3}, [@CTA_STATUS={0x8, 0x3, 0x1, 0x0, 0x402}, @CTA_HELP={0x10, 0x5, 0x0, 0x1, {0x9, 0x1, 'syz0\x00'}}, @CTA_MARK_MASK={0x8, 0x15, 0x1, 0x0, 0x4}, @CTA_ZONE={0x6, 0x12, 0x1, 0x0, 0x1}, @CTA_MARK_MASK={0x8, 0x15, 0x1, 0x0, 0x1}, @CTA_STATUS_MASK={0x8, 0x1a, 0x1, 0x0, 0x3}, @CTA_TUPLE_REPLY={0x78, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr=' \x01\x00'}, {0x14, 0x4, @local}}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @private=0xa010102}, {0x8, 0x2, @multicast2}}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}}}]}, @CTA_PROTOINFO={0x18, 0x4, 0x0, 0x1, @CTA_PROTOINFO_DCCP={0x14, 0x2, 0x0, 0x1, [@CTA_PROTOINFO_DCCP_STATE={0x5, 0x1, 0x45}, @CTA_PROTOINFO_DCCP_STATE={0x5, 0x1, 0xb8}]}}]}, 0xdc}, 0x1, 0x0, 0x0, 0x200000d0}, 0x4000040) setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2e, &(0x7f0000000080)={0x20, {{0xa, 0x4e22, 0x0, @mcast2, 0x3}}, {{0xa, 0x4a24, 0x6, @remote, 0x5}}}, 0x104) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$qrtr(0x2a, 0x2, 0x0) connect$qrtr(r7, &(0x7f0000000040), 0xc) r8 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000080), 0x2) write$binfmt_aout(r8, &(0x7f00000001c0)=ANY=[@ANYBLOB="03010000b5"], 0xc8) writev(r7, &(0x7f0000000180)=[{&(0x7f0000002680)="1e", 0xfdef}], 0x1) close_range(r6, 0xffffffffffffffff, 0x0) write(r0, &(0x7f00000002c0)="572adce1376014324f3e78922ef1c815107102e2b1a59afbc0c4a0fddb8cd000b24314e9785d6cc279c71a0dee4b7fd6edb692b5265ef0e964a4157ccb328f6628be940fac9b8415122cb2ff9316cfe8d0020fdb87311336ac174002c0f5eb04247c98f07915075ea97265ae864bb8b023b8d0f3fc74ad8269c96b1cff3b8cb097823f3570887eb564fe3f0ccb3a133f59dd7f600dc7de1fd422a1b507da8c7389dd1ab35db3d6d157022e5bd48060a0f73e243595da3caa43feca2b16780b648b2564853d4abbc9a689a5834755ac6f0b3d39d7a5a4627a9a76d9f01a725d6a7f92dd5c8ae9fdeab09fed8df64381df77dea837b212e3b54dc7f83c32a25d3aaceeaa0f27a0eb9a36d6eef7b44d199376c6563079f36826c12bd337934a33489dabe279e566c6b3e5c1aaed085bf664a1a3708480f169a8079259412e1caeefee8612fddf1013a1f6cf9609f6b71d038932735080c1d39be467c729c0a7e1def86e1e4c5be65499e93f4ee79f42bf99ff14f254016d07a785f2f8b494c7d582e4ad474f32631b41b06375d58c9624191cc32e69c02d7479a21a2d7c4db593325cd3ba67cdf28f63a5e8fe850e9da693bed318a59648ab9e7d86c50699581a8f69dbd6ce89ac1c75587327fd4754b5f67d5958357adf4a9d09539392ea2ae923e34ee23e74fa514fea6ec12d325ba29c146e0721afbc32f4cd5252e5a77ec24ff97a2403c041d81deb6f29ff7eae383b543f34c2a796d4c429428db374ad0c2a13dfc3a1acd35993f195001073b6f813cea5a2a906e3de93a9c796f9ba486269ff2d4b22a5b2205c6b7cb46c7ca5b1a8622fdf0f6a2201b3a0248f2ad3801a752e6613abb094f322da5cfaf61a89bdf24ffb50cff1f5e1155e893c2a746f4272dc14fd6bb26e2f806e9f00e700149dc23977636dae234d80e6c5e040071bfd4dd7b1d2db05454386a6541ac0921d9d64356baf4299e1283c7be6ebbe7afaa2ca1057c492bb9ea65510e3354b5151083d4739ced243372e853fc4902638d3054d78bd8ec8bef994af9c48605eccfd6a420162aef005521925728c24c807bfcf2c792f2264d5868d8af6fcae2765081eba8d1eafb9defdeb1b1bb59a40778a12c460b8c5720c63607a4ecfc5d509201c18674cb768450e4ef40acb861b82d12177a6ab022c9304cd8e3297558c3c3c28da48a865fe3589676e2364b9e60ed9df5e970c3f07af55bc38898f1b4478ed13903b84968c9e19bab54ead948d404dd25b9d32753535b7a9c6d6087744866bd3e4164d987e5d1c173613c8e02e03ae048c494b74427dc2c543507cced6f8251f877f4a01539cd8e027ed6d7edb6874fb96d353b80a28ee7a127bcace8a013a93a2df02abc6ffc2452b470898c91226d4ecea8f8900365e79dee8b49a1cbd5ded2210a7264ef6327236c9c9c5ae13602fc616bcc97ce294b6bf0e70113266ad538e0092d4b9ac80240b10bb02477f7f98889564ed3965fa72448f42b2e1942d80901db8ee4051570069cde161b000f244ff664a8b2b62975e3862cbf9b876256e36e6adcdb1e8c5f99be1857cfd0bff8b21546cac263f0da652dd4d6338944715349ecccfe69e831ae67a17438ff184172770fe254360f7acac4a4fbe07433861a00040dc7c18144a528e6c02328de9d5d31262703e307d7883b3c7345dd4b55766bb295ade657f756667e0a7a256129a4ded93f5b2e790fbbb84e764986426664b912322a9000a03d89cb7f542fa44ac6fb6dd6e5e352f43b4cb48f098ddb0e90d644dfc372483df5fa4c9f5a137baabc4d3e3822b933ab8198be48a58cbb1c56432c5fe625d0bd031a5f92e8b2d087863e5c4248f5753d534ee4607549988bcdfc1633730709480b2091f69ebb59a7af94dac81ac39e5069db22e402ead6a354562143a907d7cbdd0c4869401784652e7650811a237764fef988face1052ab9194003268b232b29c208778edbc2a60c75ec633edc49fffe68b540ec4cb00e9c7f7427676b51aeebb778d06a40d964b0084c026c6f80e6a37deae4f93f6eb5c31d7c7760a5c797ec9ce76dae4336b313ef73fa300a3421b8fff582241f8f6aa3d6d2842094cba2454a691875a4e63781047d07595861aad1d9e113fc7baecd28c3bd4e5bcb7b4c66567cac76f347e13c3358d8907af9e9c62fdc729fedc656412b0fd4361f037461a6860abff3ccc64899b8ead02650d81d4cfc738330c5c1aa5866918b23529d7f1d3d870f197a6d75a66f4b646d8fe9726966a33b2649a2bc8ba174fa78dfac1bd06777dc548fdd314b012b911d25343ccb40d6b9faafcbd452793ac2be235b8160ab9ad62c609db24f7d2d3d8c859670b805bb5922084337292ddba38f334a68cc4a17f1ec3ff40d02c9ff52ca02b0e74e837189e166479a97b519b454357982840266e1043ef9d71889289da0b36eeac9e94ba6428b4be7b2bb42e1cf8e4e083316391115a4a69114d4f8c7808c784e8f992720b8dd48d782445983716cabfd5f46e4", 0x6fa) 2.239524853s ago: executing program 2 (id=1183): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet6(r0, &(0x7f0000000000)=[{{&(0x7f0000000240)={0xa, 0x4e21, 0x4, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x3}, 0x1c, &(0x7f00000003c0)=[{0x0}], 0x1}}], 0x1, 0x931766f6319eed40) shutdown(r0, 0x1) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_MAX_BURST(r1, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f00000004c0)=0x8) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000300)={r2, 0x3}, &(0x7f0000000340)=0x8) 2.091874228s ago: executing program 2 (id=1184): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb47, 0x9, 0x8, 0x80000001, 0x3}, 0x0) r2 = socket$kcm(0x2, 0x0, 0x0) setsockopt$sock_attach_bpf(r2, 0x1, 0x50, 0x0, 0x0) ioctl$TIOCMGET(0xffffffffffffffff, 0x541e, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000002600)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a78000000060a0b040000000000000000020000004c000480480001800a0001006d6174636800000038ae41bd891a0eb73674617469737469630000001c0003004cb4fc4ba7906e8f58c2052fade1bc2c62cdeb7521cf85ee08000240000000000900010073797a30000000000900020073797a3200000000140000001100010000000000000000000300000a"], 0xa0}}, 0x0) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x60240) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r4, 0xc0a85320, 0x0) r5 = epoll_create(0x101) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r4, &(0x7f0000000080)={0x40000014}) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140), 0x8417f, 0x0) r6 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) socket$igmp(0x2, 0x3, 0x2) rt_sigqueueinfo(0x0, 0xe, &(0x7f00000004c0)={0x22, 0x6, 0x7}) ioctl$BTRFS_IOC_SUBVOL_SETFLAGS(r6, 0x4008941a, &(0x7f0000000180)=0x2) syz_emit_ethernet(0x212, &(0x7f0000000540)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xb}, @void, {@ipv6={0x86dd, @generic={0xc, 0x6, "0cb9f8", 0x1dc, 0x2, 0xff, @private1={0xfc, 0x1, '\x00', 0x1}, @local, {[@dstopts={0x87, 0x14, '\x00', [@pad1, @pad1, @padn={0x1, 0x2, [0x0, 0x0]}, @generic={0x8, 0x97, "b327721822bdda53e5895205a8bad7f2ec2b2ec1d42bda9f26583d2e5581ef47d8225eb27656956a3de288d6d6b9aa11b168001ef0960fa112109c76b2032c89740201cd675ec46806c848d454afa637ae5f473dec33e3267d49f9dbcc6ef226cc9975cf3cdbd6ce89af91d36ae1b7ec0d7af28dbfed8ef4e43bf58685bffb6b07a05746337cb0a68845289378801e59451cbf4cbfdf22"}, @ra={0x5, 0x2, 0x2}]}, @hopopts={0x3c}, @dstopts={0x0, 0x5, '\x00', [@hao={0xc9, 0x10, @mcast1}, @padn={0x1, 0x1, [0x0]}, @enc_lim={0x4, 0x1, 0x4}, @calipso={0x7, 0x10, {0x0, 0x2, 0x37, 0x7, [0x5]}}, @enc_lim={0x4, 0x1, 0x2}]}, @fragment={0x2e, 0x0, 0x9, 0x0, 0x0, 0x2, 0x68}, @fragment={0x5c, 0x0, 0xd8, 0x0, 0x0, 0x1, 0x66}, @fragment={0x3e, 0x0, 0x22, 0x0, 0x0, 0x0, 0x65}, @srh={0xc, 0xc, 0x4, 0x6, 0xfd, 0x0, 0x1, [@private0, @dev={0xfe, 0x80, '\x00', 0x12}, @empty, @private0={0xfc, 0x0, '\x00', 0x1}, @private0={0xfc, 0x0, '\x00', 0x1}, @empty]}], "ee28a156960c50d657ab38d856c5fba56b9666074c0595c00f0b8736188c616652f2bdcd5e93ae294ede701c3aa48e188114000c6849b0707e596234f9f992d2c358db82e4ea64919f09bdc18454b0a2d1f3d97bd058c5c291a9f96aa3fb5c78e2565afa39039634811c4f61"}}}}}, &(0x7f0000000240)={0x0, 0x1, [0x43e, 0xcbb, 0x7a6, 0x1ed]}) syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) socket$kcm(0xa, 0x3, 0x3a) 813.775254ms ago: executing program 2 (id=1185): socket$inet_icmp_raw(0x2, 0x3, 0x1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x0, &(0x7f0000000080)={0x2, &(0x7f0000000180)=[{0x3, 0x1, 0x1b, 0x2}, {0x3, 0xf, 0x9, 0x7}]}) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) syz_open_dev$usbfs(&(0x7f0000000140), 0x400076, 0x484100) fsopen(&(0x7f00000000c0)='msdos\x00', 0x0) r2 = syz_open_dev$dvb_demux(&(0x7f0000000080), 0x0, 0x41) r3 = syz_open_dev$dvb_demux(&(0x7f0000001e00), 0x0, 0x0) ioctl$DVB_DEMUX_DMX_SET_FILTER(r2, 0x403c6f2b, &(0x7f0000000100)={0x1, {"5b00000000000000000000000600", "241e6a0b37e28869f574458eb6417d55", "a34d3bcc4817356e5c266b26fc7430de"}, 0x7, 0x7}) ioctl$DVB_DEMUX_DMX_SET_FILTER(r3, 0x403c6f2b, &(0x7f0000000040)={0x9, {"4772ffacff04856ec9e8776f8ee906be", '\x00', "e600000600800000088000"}, 0x3, 0x4}) ioctl$DVB_DEMUX_DMX_SET_FILTER(r2, 0x403c6f2b, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x80101, 0x8) syz_open_dev$sg(&(0x7f00000060c0), 0xfffffffffffffffd, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x200000b, 0x12, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x4000, &(0x7f0000000300)=0x2, 0x7797, 0x3) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x20200, 0x0) r6 = syz_usb_connect(0x0, 0x2d, &(0x7f00000012c0)=ANY=[@ANYBLOB="120100001ddf8208c007121522300000000109021b0001000000010904000001faf40d000905820349"], 0x0) syz_usb_control_io(r6, 0x0, 0x0) r7 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r7, &(0x7f0000000480)=""/74, 0x4a) syz_usb_ep_write$ath9k_ep1(r6, 0x82, 0x0, 0x0) ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x8002) ioctl$KVM_SET_CPUID2(r4, 0x4048aecb, &(0x7f0000002400)) 591.935699ms ago: executing program 5 (id=1186): r0 = syz_open_dev$usbfs(&(0x7f0000000000), 0x4, 0xd00) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x4004550d, &(0x7f0000000040)) r1 = socket$packet(0x11, 0x2, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000000080)={'batadv0\x00', 0x0}) r3 = socket$netlink(0x10, 0x3, 0x0) writev(r3, &(0x7f0000000180)=[{&(0x7f0000000300)="580000001500add427323b472545b4562d0200ffffff81000e22d991000000000000a80013007b00090080007f000001e809000000ff0000f03ac7100003ffffffffffffffffffffffe7ee000000deff0000000200000000", 0x58}], 0x1) sendto$packet(r1, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x11, 0x0, r2, 0x1, 0x0, 0x6, @link_local}, 0x14) 108.55955ms ago: executing program 1 (id=1187): r0 = socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, r0) sched_setattr(0x0, &(0x7f00000001c0)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x19, 0x0, 0xe, 0xfa11, 0xffffffff}, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) openat2$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) openat$sequencer2(0xffffff9c, &(0x7f0000000080), 0x200080, 0x0) r3 = openat$ppp(0xffffffffffffff9c, 0x0, 0x48a200, 0x0) ioctl$PPPIOCNEWUNIT(r3, 0xc004743e, &(0x7f0000000140)) readv(r3, &(0x7f00000006c0)=[{&(0x7f0000000580)=""/90, 0x5a}], 0x1) bpf$PROG_LOAD(0x5, 0x0, 0x0) r4 = socket$inet_sctp(0x2, 0x1, 0x84) r5 = socket(0x2, 0x80805, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$ARPT_SO_SET_REPLACE(r4, 0x0, 0x60, &(0x7f00000002c0)={'filter\x00', 0x7, 0x4, 0x3ac, 0x0, 0x2cc, 0xe0, 0x2cc, 0x2cc, 0x2cc, 0x4, 0x0, {[{{@arp={@multicast1, @empty, 0x0, 0xffffff00, 0xc, 0x0, {@mac=@local, {[0xff, 0x80, 0x0, 0x1fe, 0xff, 0xff]}}, {@mac=@broadcast, {[0xff, 0x0, 0xff, 0x0, 0xff]}}, 0xdfe, 0x2, 0x7, 0xe, 0xfa, 0x8a5c, 'batadv0\x00', 'team0\x00', {0xff}, {}, 0x0, 0x12}, 0xbc, 0xe0}, @unspec=@NFQUEUE0={0x24, 'NFQUEUE\x00', 0x0, {0x9}}}, {{@arp={@empty, @multicast1, 0xff, 0x0, 0x4, 0x2, {@empty, {[0xff, 0x0, 0xff, 0x0, 0xff, 0x101]}}, {@mac=@broadcast, {[0x0, 0xff, 0x0, 0x0, 0x0, 0xff]}}, 0x9, 0x5, 0x5, 0x2, 0x7, 0xa7c, 'wlan0\x00', 'bond_slave_0\x00', {}, {0xb50cca1d00497645}, 0x0, 0x202}, 0xbc, 0xe0, 0x1000000}, @unspec=@CLASSIFY={0x24, 'CLASSIFY\x00', 0x0, {0xfff}}}, {{@arp={@multicast1, @remote, 0xff, 0xff000000, 0xa, 0x6, {@empty, {[0xff, 0xff, 0x0, 0xff]}}, {@empty, {[0xff, 0xff, 0xff, 0xff]}}, 0x1, 0x10, 0x3, 0x5, 0x4, 0x9e, 'gre0\x00', 'wg0\x00', {}, {0xff}, 0x0, 0x8}, 0xbc, 0x10c}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @multicast2, @rand_addr=0x64010100, 0x2}}}], {{'\x00', 0xbc, 0xe0}, {0x24}}}}, 0x3f8) getsockopt$inet_sctp_SCTP_MAX_BURST(r5, 0x84, 0xc, &(0x7f0000000040)=@assoc_value={0x0}, &(0x7f0000000000)=0x8) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r4, 0x84, 0x7b, &(0x7f0000000080)={r6, 0x6}, &(0x7f0000000100)=0x8) setsockopt$MRT6_ADD_MIF(r0, 0x29, 0xca, 0x0, 0x0) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={0x0}, 0x1, 0x0, 0x0, 0x4}, 0x0) setsockopt$MRT6_FLUSH(r0, 0x29, 0xd4, 0x0, 0x0) socket$kcm(0x11, 0x2, 0x0) r7 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000100)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) read$FUSE(r7, &(0x7f00000034c0)={0x2020}, 0x2020) setsockopt$sock_attach_bpf(r2, 0x107, 0x14, &(0x7f0000000000)=r7, 0x4) 0s ago: executing program 5 (id=1188): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="300000003f000701feffffff00000000037c00000400428010000180040042"], 0x30}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f00000001c0)={0x38, 0x0, 0x9, 0x8001, 0x0, 0x9, 0x8000000000, 0xffffffff, 0xfa11, 0xffffffff}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'virt_wifi0\x00', 0x0}) r5 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r5, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0}, 0x1, 0x0, 0x0, 0x8000}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=ANY=[@ANYBLOB="5800000010001ffffcfff7fffddbdf2500020000", @ANYRES32=0x0, @ANYBLOB="0000010000000000280012800b00010067726574617000001800028004001200050009000900000005000a000000000008000a00", @ANYRES32=r6, @ANYBLOB="08001f0009000000"], 0x58}, 0x1, 0x0, 0x0, 0x40}, 0x0) sendmsg$nl_route(r3, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000340)=ANY=[@ANYBLOB="4400000010000304000000000000000000000400", @ANYRES32=0x0, @ANYRES32=r4, @ANYBLOB="6f29ddb3367429041da8b92d95adcd5efb970f7f62"], 0x44}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) shutdown(0xffffffffffffffff, 0x0) r7 = syz_mount_image$fuse(&(0x7f0000000100), &(0x7f00000003c0)='./file0/file0\x00', 0x100008, &(0x7f0000000140)=ANY=[@ANYRESHEX=r3], 0x1, 0x0, 0x0) statx(r7, 0x0, 0x6000, 0x7ff, 0x0) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) prctl$PR_SET_SECCOMP(0x16, 0x2, 0x0) openat2$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0) r8 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r8, 0x7a7, &(0x7f0000000100)=0x80000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r8, 0x7a0, &(0x7f00000002c0)={@host}) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r8, 0x7a8, &(0x7f0000000200)={{@host}, @host, 0x6, 0x0, 0x2449, 0x0, 0x2000000000000000, 0x0, 0x100000}) ioctl$IOCTL_VMCI_VERSION2(r8, 0x7a7, &(0x7f00000000c0)=0xb0000) ioctl$IOCTL_VMCI_QUEUEPAIR_SETVA(r8, 0x7a4, &(0x7f0000000180)={{@host}, 0xfffffffffffffffc, 0x800000000000002, 0x1000000, 0x8}) kernel console output (not intermixed with test programs): 20250][ T5831] hid-generic 0000:0004:0000.0033: unknown main item tag 0x0 [ 402.720312][ T5831] hid-generic 0000:0004:0000.0033: unknown main item tag 0x0 [ 402.720335][ T5831] hid-generic 0000:0004:0000.0033: unknown main item tag 0x0 [ 402.730111][ T5831] hid-generic 0000:0004:0000.0033: hidraw0: HID v0.00 Device [syz0] on syz0 [ 402.802567][ T5831] m920x_read = error: -19 [ 402.802611][ T5831] dvb-usb: error while querying for an remote control event. [ 402.838160][ T3457] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 402.838183][ T3457] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 402.889341][ T49] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 402.889364][ T49] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 402.909609][ T24] m920x_read = error: -19 [ 402.909635][ T24] dvb-usb: error while querying for an remote control event. [ 402.937666][ T5831] usb 1-1: new high-speed USB device number 47 using dummy_hcd [ 402.967601][ T5914] usb 2-1: new high-speed USB device number 42 using dummy_hcd [ 403.017647][ T24] m920x_read = error: -19 [ 403.017674][ T24] dvb-usb: error while querying for an remote control event. [ 403.121772][ T5914] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 403.127651][ T24] m920x_read = error: -19 [ 403.138740][ T5831] usb 1-1: Using ep0 maxpacket: 32 [ 403.148704][ T5916] plantronics 0003:047F:FFFF.0034: hiddev0,hidraw1: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 403.162454][ T24] dvb-usb: error while querying for an remote control event. [ 403.207313][ T5831] usb 1-1: config 0 interface 0 altsetting 9 endpoint 0x81 has invalid maxpacket 9865, setting to 1024 [ 403.245586][ T5914] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 403.270945][ T5831] usb 1-1: config 0 interface 0 altsetting 9 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 403.276499][ T5914] usb 2-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 403.298101][ T5916] m920x_read = error: -19 [ 403.302475][ T5916] dvb-usb: error while querying for an remote control event. [ 403.324039][T10041] netlink: 56 bytes leftover after parsing attributes in process `syz.5.943'. [ 403.333380][T10041] netlink: 56 bytes leftover after parsing attributes in process `syz.5.943'. [ 403.354287][ T5831] usb 1-1: config 0 interface 0 has no altsetting 0 [ 403.367586][ T5831] usb 1-1: New USB device found, idVendor=05ac, idProduct=0269, bcdDevice= 0.00 [ 403.387613][ T5831] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 403.393025][ T5914] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 403.407348][ T5914] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 403.470755][ T24] m920x_read = error: -19 [ 403.963973][ T24] dvb-usb: error while querying for an remote control event. [ 403.991557][ T5831] usb 1-1: config 0 descriptor?? [ 403.998189][T10028] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 404.026717][ T5914] usb 2-1: Product: syz [ 404.033266][ T5914] usb 2-1: Manufacturer: syz [ 404.049561][ T5914] usb 2-1: SerialNumber: syz [ 404.100440][ T24] m920x_read = error: -19 [ 404.104871][ T24] dvb-usb: error while querying for an remote control event. [ 404.312421][ T24] m920x_read = error: -19 [ 404.397832][ T24] dvb-usb: error while querying for an remote control event. [ 404.400549][ T5914] usblp 2-1:1.0: usblp1: USB Unidirectional printer dev 42 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 404.507784][ T29] m920x_read = error: -19 [ 404.512389][ T29] dvb-usb: error while querying for an remote control event. [ 404.581992][T10028] kvm: requested 79619 ns i8254 timer period limited to 200000 ns [ 404.612062][T10028] kvm: requested 72914 ns i8254 timer period limited to 200000 ns [ 404.631974][T10028] kvm: requested 81295 ns i8254 timer period limited to 200000 ns [ 404.642063][T10028] kvm: requested 180190 ns i8254 timer period limited to 200000 ns [ 404.663344][T10028] kvm: requested 81295 ns i8254 timer period limited to 200000 ns [ 404.671618][ T29] m920x_read = error: -19 [ 404.676107][ T29] dvb-usb: error while querying for an remote control event. [ 404.686351][ T5831] hid (null): global environment stack underflow [ 404.693590][ T5831] hid (null): invalid report_count -274726912 [ 404.701487][ T5831] hid (null): invalid report_size 7169389 [ 404.712877][T10028] kvm: requested 120685 ns i8254 timer period limited to 200000 ns [ 404.718097][T10055] netlink: 24 bytes leftover after parsing attributes in process `syz.5.973'. [ 404.721359][ T5831] magicmouse 0003:05AC:0269.0035: unknown main item tag 0x0 [ 404.742784][ T5831] magicmouse 0003:05AC:0269.0035: unknown main item tag 0x0 [ 404.757636][T10028] kvm: requested 60342 ns i8254 timer period limited to 200000 ns [ 404.765780][ T5831] magicmouse 0003:05AC:0269.0035: unknown main item tag 0x0 [ 404.777624][ T5831] magicmouse 0003:05AC:0269.0035: unknown main item tag 0x0 [ 404.787584][ T29] m920x_read = error: -19 [ 404.791958][ T29] dvb-usb: error while querying for an remote control event. [ 404.800307][T10028] kvm: requested 117333 ns i8254 timer period limited to 200000 ns [ 404.808841][ T5831] magicmouse 0003:05AC:0269.0035: unknown main item tag 0x0 [ 404.823779][ T5831] magicmouse 0003:05AC:0269.0035: unknown main item tag 0x0 [ 404.850124][ T5831] magicmouse 0003:05AC:0269.0035: unknown main item tag 0x0 [ 404.867299][T10028] kvm: requested 13409 ns i8254 timer period limited to 200000 ns [ 404.876133][ T5831] magicmouse 0003:05AC:0269.0035: global environment stack underflow [ 404.888618][T10028] kvm: requested 838 ns i8254 timer period limited to 200000 ns [ 404.896459][ T5831] magicmouse 0003:05AC:0269.0035: item 0 0 1 11 parsing failed [ 404.917158][ T5831] magicmouse 0003:05AC:0269.0035: magicmouse hid parse failed [ 404.927538][ T29] m920x_read = error: -19 [ 404.931969][ T29] dvb-usb: error while querying for an remote control event. [ 404.966068][ T5831] magicmouse 0003:05AC:0269.0035: probe with driver magicmouse failed with error -22 [ 405.073657][ T5827] m920x_read = error: -19 [ 405.093085][ T5827] dvb-usb: error while querying for an remote control event. [ 405.120923][ T30] kauditd_printk_skb: 31 callbacks suppressed [ 405.120935][ T30] audit: type=1326 audit(1773599325.656:1825): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10060 comm="syz.3.975" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fc5f6c code=0x7ffc0000 [ 405.183347][ T5831] usb 2-1: USB disconnect, device number 42 [ 405.200296][ T5831] usblp1: removed [ 405.205577][T10066] netlink: 12 bytes leftover after parsing attributes in process `syz.5.974'. [ 405.218449][T10066] RDS: rds_bind could not find a transport for fc01::, load rds_tcp or rds_rdma? [ 405.238262][ T5916] usb 3-1: USB disconnect, device number 32 [ 405.305674][ T24] m920x_read = error: -19 [ 405.321603][ T24] dvb-usb: error while querying for an remote control event. [ 405.328007][ T30] audit: type=1326 audit(1773599325.656:1826): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10060 comm="syz.3.975" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fc5f6c code=0x7ffc0000 [ 405.330741][ T29] usb 1-1: USB disconnect, device number 47 [ 405.467537][ T30] audit: type=1326 audit(1773599325.656:1827): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10060 comm="syz.3.975" exe="/root/syz-executor" sig=0 arch=40000003 syscall=437 compat=1 ip=0xf7fc5f6c code=0x7ffc0000 [ 405.516587][ T30] audit: type=1326 audit(1773599325.656:1828): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10060 comm="syz.3.975" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fc5f6c code=0x7ffc0000 [ 405.566210][ T30] audit: type=1326 audit(1773599325.726:1829): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10060 comm="syz.3.975" exe="/root/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf7fc5f6c code=0x7ffc0000 [ 405.577730][ T24] m920x_read = error: -19 [ 405.680267][T10080] netlink: 20 bytes leftover after parsing attributes in process `syz.2.980'. [ 405.690310][ T30] audit: type=1326 audit(1773599325.726:1830): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10060 comm="syz.3.975" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fc5f6c code=0x7ffc0000 [ 405.806783][ T24] dvb-usb: error while querying for an remote control event. [ 406.190524][ T24] m920x_read = error: -19 [ 406.221860][ T24] dvb-usb: error while querying for an remote control event. [ 406.283741][ T30] audit: type=1326 audit(1773599325.726:1831): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10060 comm="syz.3.975" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fc5f6c code=0x7ffc0000 [ 406.345187][ T30] audit: type=1326 audit(1773599325.926:1832): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10060 comm="syz.3.975" exe="/root/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf7fc5f6c code=0x7ffc0000 [ 406.377318][ T5916] m920x_read = error: -19 [ 406.386888][ T5916] dvb-usb: error while querying for an remote control event. [ 406.458072][ T30] audit: type=1326 audit(1773599325.926:1833): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10060 comm="syz.3.975" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fc5f6c code=0x7ffc0000 [ 406.537651][ T5916] m920x_read = error: -19 [ 406.562393][ T5916] dvb-usb: error while querying for an remote control event. [ 406.643464][ T30] audit: type=1326 audit(1773599325.926:1834): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10060 comm="syz.3.975" exe="/root/syz-executor" sig=0 arch=40000003 syscall=145 compat=1 ip=0xf7fc5f6c code=0x7ffc0000 [ 406.688397][ T24] m920x_read = error: -19 [ 406.692790][ T24] dvb-usb: error while querying for an remote control event. [ 406.727550][ T5916] usb 1-1: new high-speed USB device number 48 using dummy_hcd [ 406.829779][ T24] m920x_read = error: -19 [ 406.840491][ T24] dvb-usb: error while querying for an remote control event. [ 406.897557][ T5916] usb 1-1: device descriptor read/64, error -71 [ 406.927850][T10086] netlink: 'syz.3.982': attribute type 10 has an invalid length. [ 406.958670][T10089] FAULT_INJECTION: forcing a failure. [ 406.958670][T10089] name failslab, interval 1, probability 0, space 0, times 0 [ 406.959120][T10086] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 406.972318][T10089] CPU: 0 UID: 0 PID: 10089 Comm: syz.1.983 Not tainted syzkaller #0 PREEMPT(full) [ 406.972348][T10089] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 406.972358][T10089] Call Trace: [ 406.972364][T10089] [ 406.972371][T10089] dump_stack_lvl+0xe8/0x150 [ 406.972407][T10089] should_fail_ex+0x412/0x560 [ 406.972433][T10089] should_failslab+0xa8/0x100 [ 406.972454][T10089] __kvmalloc_node_noprof+0x178/0x8a0 [ 406.972472][T10089] ? rhashtable_init_noprof+0x52e/0xa70 [ 406.972575][T10089] ? rhashtable_init_noprof+0x12d/0xa70 [ 406.972600][T10089] rhashtable_init_noprof+0x52e/0xa70 [ 406.972627][T10089] rhltable_init_noprof+0x1e/0x60 [ 406.972642][T10089] nf_tables_newtable+0x68f/0x1910 [ 406.972719][T10089] nfnetlink_rcv+0x1240/0x27b0 [ 406.972772][T10089] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 406.972805][T10089] ? ref_tracker_free+0x693/0x840 [ 406.972850][T10089] ? __netlink_deliver_tap+0x807/0x850 [ 406.972872][T10089] ? netlink_deliver_tap+0x2e/0x1b0 [ 406.972907][T10089] netlink_unicast+0x80f/0x9b0 [ 406.972934][T10089] ? __pfx_netlink_unicast+0x10/0x10 [ 406.972956][T10089] ? netlink_sendmsg+0x650/0xb40 [ 406.972975][T10089] ? skb_put+0x11b/0x210 [ 406.972994][T10089] netlink_sendmsg+0x813/0xb40 [ 406.973023][T10089] ? __pfx_netlink_sendmsg+0x10/0x10 [ 406.973047][T10089] ? aa_sock_msg_perm+0xf1/0x1b0 [ 406.973070][T10089] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 406.973098][T10089] ____sys_sendmsg+0x972/0x9f0 [ 406.973124][T10089] ? __pfx_____sys_sendmsg+0x10/0x10 [ 406.973145][T10089] ? kstrtoull+0x12f/0x1d0 [ 406.973171][T10089] ___sys_sendmsg+0x2a5/0x360 [ 406.973192][T10089] ? __pfx____sys_sendmsg+0x10/0x10 [ 406.973211][T10089] ? get_pid_task+0x20/0x1f0 [ 406.973226][T10089] ? get_pid_task+0x20/0x1f0 [ 406.973238][T10089] ? get_pid_task+0x20/0x1f0 [ 406.973274][T10089] ? __fget_files+0x2a/0x420 [ 406.973294][T10089] ? __fget_files+0x3a0/0x420 [ 406.973323][T10089] __sys_sendmsg+0x183/0x260 [ 406.973343][T10089] ? __pfx___sys_sendmsg+0x10/0x10 [ 406.973377][T10089] __do_fast_syscall_32+0x20d/0x640 [ 406.973397][T10089] ? do_fast_syscall_32+0x33/0x70 [ 406.973414][T10089] ? asm_int80_emulation+0x1a/0x20 [ 406.973428][T10089] ? do_int80_emulation+0x274/0x4d0 [ 406.973444][T10089] ? trace_irq_disable+0x3b/0x150 [ 406.973468][T10089] do_fast_syscall_32+0x33/0x70 [ 406.973485][T10089] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 406.973502][T10089] RIP: 0023:0xf706ef6c [ 406.973518][T10089] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 406.973530][T10089] RSP: 002b:00000000f545d50c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 406.973548][T10089] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000080 [ 406.973559][T10089] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 406.973567][T10089] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 406.973576][T10089] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 406.973584][T10089] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 406.973609][T10089] [ 407.298090][ T24] m920x_read = error: -19 [ 407.302972][ T24] dvb-usb: error while querying for an remote control event. [ 407.418381][ T24] m920x_read = error: -19 [ 407.424890][ T24] dvb-usb: error while querying for an remote control event. [ 407.437684][ T5916] usb 1-1: new high-speed USB device number 49 using dummy_hcd [ 407.567857][ T5831] m920x_read = error: -19 [ 407.572242][ T5831] dvb-usb: error while querying for an remote control event. [ 407.597585][ T5916] usb 1-1: device descriptor read/64, error -71 [ 407.687578][ T5827] m920x_read = error: -19 [ 407.692011][ T5827] dvb-usb: error while querying for an remote control event. [ 407.717524][ T24] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 407.790399][T10106] netlink: 56 bytes leftover after parsing attributes in process `syz.2.987'. [ 407.807106][ T5916] usb usb1-port1: attempt power cycle [ 407.807325][T10106] netlink: 56 bytes leftover after parsing attributes in process `syz.2.987'. [ 407.812674][ T5831] usb 4-1: new high-speed USB device number 40 using dummy_hcd [ 407.901155][T10100] netlink: 56 bytes leftover after parsing attributes in process `syz.1.985'. [ 407.910499][T10100] netlink: 56 bytes leftover after parsing attributes in process `syz.1.985'. [ 407.928128][ T5827] m920x_read = error: -19 [ 407.934075][ T5827] dvb-usb: error while querying for an remote control event. [ 407.989592][ T24] usb 6-1: device descriptor read/64, error -71 [ 408.050022][ T5827] m920x_read = error: -19 [ 408.054697][ T5827] dvb-usb: error while querying for an remote control event. [ 408.064121][ T5831] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 408.075971][ T5831] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 408.086146][ T5831] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 408.102970][ T5831] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 408.114529][ T5831] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 408.155905][ T5831] usb 4-1: config 0 descriptor?? [ 408.178090][ T5827] m920x_read = error: -19 [ 408.182586][ T5827] dvb-usb: error while querying for an remote control event. [ 408.197525][ T5916] usb 1-1: new high-speed USB device number 50 using dummy_hcd [ 408.218797][ T5916] usb 1-1: device descriptor read/8, error -71 [ 408.237673][ T24] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 408.298005][ T5827] m920x_read = error: -19 [ 408.303170][ T5827] dvb-usb: error while querying for an remote control event. [ 408.373288][ T24] usb 6-1: device descriptor read/64, error -71 [ 408.417620][ T5827] m920x_read = error: -19 [ 408.422051][ T5827] dvb-usb: error while querying for an remote control event. [ 408.500971][ T24] usb usb6-port1: attempt power cycle [ 408.506567][ T5916] usb 1-1: new high-speed USB device number 51 using dummy_hcd [ 408.549990][ T5916] usb 1-1: device descriptor read/8, error -71 [ 408.580050][ T5831] plantronics 0003:047F:FFFF.0036: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 408.592702][ T29] m920x_read = error: -19 [ 408.597053][ T29] dvb-usb: error while querying for an remote control event. [ 408.668742][ T5916] usb usb1-port1: unable to enumerate USB device [ 408.720423][ T5916] m920x_read = error: -19 [ 408.736256][ T5916] dvb-usb: error while querying for an remote control event. [ 408.857579][ T5916] m920x_read = error: -19 [ 408.861976][ T5916] dvb-usb: error while querying for an remote control event. [ 408.869907][ T24] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 408.908622][ T24] usb 6-1: device descriptor read/8, error -71 [ 408.987599][ T5916] m920x_read = error: -19 [ 408.992197][ T5916] dvb-usb: error while querying for an remote control event. [ 409.124444][ T5916] m920x_read = error: -19 [ 409.129698][ T5916] dvb-usb: error while querying for an remote control event. [ 409.343333][ T24] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 409.378137][ T24] usb 6-1: device descriptor read/8, error -71 [ 409.544292][ T5916] m920x_read = error: -19 [ 409.554417][ T24] usb usb6-port1: unable to enumerate USB device [ 409.561989][ T5916] dvb-usb: error while querying for an remote control event. [ 409.678929][ T5916] m920x_read = error: -19 [ 409.694218][ T5916] dvb-usb: error while querying for an remote control event. [ 409.807554][ T24] m920x_read = error: -19 [ 409.812007][ T24] dvb-usb: error while querying for an remote control event. [ 410.183329][ T24] m920x_read = error: -19 [ 410.187853][ T24] dvb-usb: error while querying for an remote control event. [ 410.327562][ T24] m920x_read = error: -19 [ 410.332024][ T24] dvb-usb: error while querying for an remote control event. [ 410.527597][ T24] m920x_read = error: -19 [ 410.532060][ T24] dvb-usb: error while querying for an remote control event. [ 410.698119][ T24] m920x_read = error: -19 [ 410.702532][ T24] dvb-usb: error while querying for an remote control event. [ 410.718298][T10144] netlink: 12 bytes leftover after parsing attributes in process `syz.1.995'. [ 410.732886][T10144] RDS: rds_bind could not find a transport for fc01::, load rds_tcp or rds_rdma? [ 410.818559][ T10] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 410.867594][ T24] m920x_read = error: -19 [ 410.938422][ T24] dvb-usb: error while querying for an remote control event. [ 410.948413][ T5914] usb 4-1: USB disconnect, device number 40 [ 411.047551][ T24] m920x_read = error: -19 [ 411.051970][ T24] dvb-usb: error while querying for an remote control event. [ 411.063975][T10161] netlink: 56 bytes leftover after parsing attributes in process `syz.3.998'. [ 411.073405][T10161] netlink: 56 bytes leftover after parsing attributes in process `syz.3.998'. [ 411.140895][ T10] usb 6-1: config 0 has too many interfaces: 253, using maximum allowed: 32 [ 411.262055][ T10] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 253 [ 411.303196][ T10] usb 6-1: New USB device found, idVendor=055f, idProduct=c630, bcdDevice=b6.ac [ 411.322478][ T10] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 411.388130][ T24] m920x_read = error: -19 [ 411.392540][ T24] dvb-usb: error while querying for an remote control event. [ 411.439546][ T10] usb 6-1: Product: syz [ 411.443758][ T10] usb 6-1: Manufacturer: syz [ 411.453529][ T10] usb 6-1: SerialNumber: syz [ 411.461112][ T10] usb 6-1: config 0 descriptor?? [ 411.491154][ T10] gspca_main: sunplus-2.14.0 probing 055f:c630 [ 411.547587][ T24] m920x_read = error: -19 [ 411.553264][ T24] dvb-usb: error while querying for an remote control event. [ 411.830369][ T24] m920x_read = error: -19 [ 411.835506][ T24] dvb-usb: error while querying for an remote control event. [ 412.357699][ T24] m920x_read = error: -19 [ 412.528943][ T24] dvb-usb: error while querying for an remote control event. [ 412.647651][ T5831] m920x_read = error: -19 [ 412.652330][ T5831] dvb-usb: error while querying for an remote control event. [ 412.787953][ T5831] m920x_read = error: -19 [ 412.792339][ T5831] dvb-usb: error while querying for an remote control event. [ 412.917545][ T5831] m920x_read = error: -19 [ 412.921938][ T5831] dvb-usb: error while querying for an remote control event. [ 413.070815][ T5831] m920x_read = error: -19 [ 413.087490][ T5831] dvb-usb: error while querying for an remote control event. [ 413.227581][ T5831] m920x_read = error: -19 [ 413.231965][ T5831] dvb-usb: error while querying for an remote control event. [ 413.477958][ T5831] m920x_read = error: -19 [ 413.484838][ T5831] dvb-usb: error while querying for an remote control event. [ 413.576298][ T10] gspca_sunplus: reg_r err -71 [ 413.581561][ T10] sunplus 6-1:0.0: probe with driver sunplus failed with error -71 [ 413.611047][ T10] usb 6-1: USB disconnect, device number 6 [ 413.638513][ T5831] m920x_read = error: -19 [ 413.651616][ T5831] dvb-usb: error while querying for an remote control event. [ 413.787574][ T5831] m920x_read = error: -19 [ 413.791962][ T5831] dvb-usb: error while querying for an remote control event. [ 414.215196][ T5831] m920x_read = error: -19 [ 414.252475][ T5831] dvb-usb: error while querying for an remote control event. [ 414.354606][T10213] faux_driver vkms: [drm] Unknown color mode 13; guessing buffer size. [ 414.447520][ T24] usb 2-1: new high-speed USB device number 43 using dummy_hcd [ 414.537379][ T5831] m920x_read = error: -19 [ 414.550020][ T5831] dvb-usb: error while querying for an remote control event. [ 414.718382][ T5831] m920x_read = error: -19 [ 414.729718][ T5831] dvb-usb: error while querying for an remote control event. [ 414.820757][ T24] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 414.831912][ T24] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 414.877630][ T29] m920x_read = error: -19 [ 414.883841][ T29] dvb-usb: error while querying for an remote control event. [ 414.991182][ T24] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 415.059590][ T29] m920x_read = error: -19 [ 415.063988][ T29] dvb-usb: error while querying for an remote control event. [ 415.077598][ T24] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 415.097568][ T24] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 415.164699][ T24] usb 2-1: config 0 descriptor?? [ 415.207580][ T29] m920x_read = error: -19 [ 415.255628][ T29] dvb-usb: error while querying for an remote control event. [ 415.387662][ T29] m920x_read = error: -19 [ 415.392599][ T29] dvb-usb: error while querying for an remote control event. [ 415.606983][ T24] plantronics 0003:047F:FFFF.0037: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0 [ 415.627549][ T29] m920x_read = error: -19 [ 415.631928][ T29] dvb-usb: error while querying for an remote control event. [ 415.944898][ T24] m920x_read = error: -19 [ 415.951304][T10243] ip_tunnel: non-ECT from 172.20.20.187 with TOS=0x2 [ 415.981308][ T5900] usb 2-1: USB disconnect, device number 43 [ 416.087488][ T24] dvb-usb: error while querying for an remote control event. [ 416.237765][ T5831] m920x_read = error: -19 [ 416.242330][ T5831] dvb-usb: error while querying for an remote control event. [ 416.357626][ T5831] m920x_read = error: -19 [ 416.364742][ T5831] dvb-usb: error while querying for an remote control event. [ 416.429314][ T5823] Bluetooth: hci0: ISO packet for unknown connection handle 0 [ 416.497570][ T5831] m920x_read = error: -19 [ 416.502168][ T5831] dvb-usb: error while querying for an remote control event. [ 416.617811][ T5831] m920x_read = error: -19 [ 416.626789][ T5831] dvb-usb: error while querying for an remote control event. [ 416.753562][T10278] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1021'. [ 417.207272][ T5831] m920x_read = error: -19 [ 417.212062][ T5831] dvb-usb: error while querying for an remote control event. [ 417.241350][T10279] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1022'. [ 417.601134][ T5831] m920x_read = error: -19 [ 417.605525][ T5831] dvb-usb: error while querying for an remote control event. [ 417.807665][ T5831] m920x_read = error: -19 [ 417.816734][ T5831] dvb-usb: error while querying for an remote control event. [ 418.042195][T10302] netlink: 'syz.1.1026': attribute type 29 has an invalid length. [ 418.270738][ T5831] m920x_read = error: -19 [ 418.278632][ T5831] dvb-usb: error while querying for an remote control event. [ 418.705381][ T5831] m920x_read = error: -19 [ 418.711179][ T5831] dvb-usb: error while querying for an remote control event. [ 418.877594][ T5831] m920x_read = error: -19 [ 418.881985][ T5831] dvb-usb: error while querying for an remote control event. [ 418.972394][T10316] netlink: 'syz.2.1028': attribute type 1 has an invalid length. [ 419.024226][T10320] netlink: 56 bytes leftover after parsing attributes in process `syz.5.1027'. [ 419.033797][T10320] netlink: 56 bytes leftover after parsing attributes in process `syz.5.1027'. [ 419.057593][ T5831] m920x_read = error: -19 [ 419.061982][ T5831] dvb-usb: error while querying for an remote control event. [ 419.313101][ T5831] m920x_read = error: -19 [ 419.322820][ T5831] dvb-usb: error while querying for an remote control event. [ 419.470346][ T5831] m920x_read = error: -19 [ 419.518189][ T5831] dvb-usb: error while querying for an remote control event. [ 419.648650][ T5831] m920x_read = error: -19 [ 419.807685][ T5831] dvb-usb: error while querying for an remote control event. [ 419.920234][T10342] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1033'. [ 419.938906][ T5831] m920x_read = error: -19 [ 419.945385][ T5831] dvb-usb: error while querying for an remote control event. [ 420.057588][ T29] m920x_read = error: -19 [ 420.062070][ T29] dvb-usb: error while querying for an remote control event. [ 420.137553][ T5831] usb 1-1: new high-speed USB device number 52 using dummy_hcd [ 420.189925][ T24] m920x_read = error: -19 [ 420.194487][ T24] dvb-usb: error while querying for an remote control event. [ 420.217524][ T29] usb 2-1: new high-speed USB device number 44 using dummy_hcd [ 420.327917][ T5916] m920x_read = error: -19 [ 420.332385][ T5916] dvb-usb: error while querying for an remote control event. [ 420.343444][ T5831] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 420.360124][ T5831] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 420.370360][ T5831] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 420.397578][ T29] usb 2-1: Using ep0 maxpacket: 32 [ 420.467560][ T5916] m920x_read = error: -19 [ 420.471961][ T5916] dvb-usb: error while querying for an remote control event. [ 420.536920][ T5831] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 420.546620][ T5831] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 420.556826][ T29] usb 2-1: unable to get BOS descriptor or descriptor too short [ 420.571513][ T29] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 420.592984][ T29] usb 2-1: can't read configurations, error -61 [ 420.634103][ T5831] usb 1-1: config 0 descriptor?? [ 420.647554][ T5916] m920x_read = error: -19 [ 420.652275][ T5916] dvb-usb: error while querying for an remote control event. [ 420.757548][ T29] usb 2-1: new high-speed USB device number 45 using dummy_hcd [ 420.879152][ T5916] m920x_read = error: -19 [ 420.883573][ T5916] dvb-usb: error while querying for an remote control event. [ 420.997630][ T5916] m920x_read = error: -19 [ 421.002274][ T5916] dvb-usb: error while querying for an remote control event. [ 421.058493][ T29] usb 2-1: Using ep0 maxpacket: 32 [ 421.081453][ T5831] plantronics 0003:047F:FFFF.0038: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 421.099343][ T29] usb 2-1: unable to get BOS descriptor or descriptor too short [ 421.127590][ T5916] m920x_read = error: -19 [ 421.132437][ T5916] dvb-usb: error while querying for an remote control event. [ 421.167000][ T29] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 421.185534][ T29] usb 2-1: can't read configurations, error -61 [ 421.232503][ T29] usb usb2-port1: attempt power cycle [ 421.259494][ T5831] m920x_read = error: -19 [ 421.263874][ T5831] dvb-usb: error while querying for an remote control event. [ 421.471109][ T5831] m920x_read = error: -19 [ 421.505761][ T5831] dvb-usb: error while querying for an remote control event. [ 421.617647][ T5831] m920x_read = error: -19 [ 421.622225][ T5831] dvb-usb: error while querying for an remote control event. [ 421.668449][ T29] usb 2-1: new high-speed USB device number 46 using dummy_hcd [ 421.702177][ T29] usb 2-1: Using ep0 maxpacket: 32 [ 421.710553][ T29] usb 2-1: unable to get BOS descriptor or descriptor too short [ 421.737970][ T5831] m920x_read = error: -19 [ 421.742871][ T5831] dvb-usb: error while querying for an remote control event. [ 421.751776][ T29] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 421.764751][ T29] usb 2-1: can't read configurations, error -61 [ 421.867767][ T5831] m920x_read = error: -19 [ 421.872594][ T5831] dvb-usb: error while querying for an remote control event. [ 421.957939][ T29] usb 2-1: new high-speed USB device number 47 using dummy_hcd [ 421.987613][ T5831] m920x_read = error: -19 [ 421.992179][ T5831] dvb-usb: error while querying for an remote control event. [ 422.000143][ T29] usb 2-1: Using ep0 maxpacket: 32 [ 422.007792][ T29] usb 2-1: unable to get BOS descriptor or descriptor too short [ 422.019803][ T29] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 422.040035][ T29] usb 2-1: can't read configurations, error -61 [ 422.056241][ T29] usb usb2-port1: unable to enumerate USB device [ 422.287563][ T29] m920x_read = error: -19 [ 422.291974][ T29] dvb-usb: error while querying for an remote control event. [ 422.417582][ T29] m920x_read = error: -19 [ 422.421971][ T29] dvb-usb: error while querying for an remote control event. [ 422.546341][ T29] m920x_read = error: -19 [ 422.550913][ T29] dvb-usb: error while querying for an remote control event. [ 422.686057][ T24] m920x_read = error: -19 [ 422.690686][ T24] dvb-usb: error while querying for an remote control event. [ 422.807583][ T24] m920x_read = error: -19 [ 422.813762][ T24] dvb-usb: error while querying for an remote control event. [ 422.932802][ T24] m920x_read = error: -19 [ 422.938157][ T24] dvb-usb: error while querying for an remote control event. [ 422.974473][ T29] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 423.047326][T10389] bridge0: entered promiscuous mode [ 423.055230][T10389] macvtap1: default qdisc (pfifo_fast) fail, fallback to noqueue [ 423.108393][ T24] m920x_read = error: -19 [ 423.113165][ T24] dvb-usb: error while querying for an remote control event. [ 423.148375][ T5907] usb 1-1: USB disconnect, device number 52 [ 423.174890][ T29] usb 6-1: Using ep0 maxpacket: 8 [ 423.236506][ T29] usb 6-1: unable to get BOS descriptor or descriptor too short [ 423.252418][ T24] m920x_read = error: -19 [ 423.257193][ T24] dvb-usb: error while querying for an remote control event. [ 423.267259][ T29] usb 6-1: config 4 interface 0 has no altsetting 0 [ 423.378475][ T29] usb 6-1: string descriptor 0 read error: -22 [ 423.399924][T10393] netlink: 7064 bytes leftover after parsing attributes in process `syz.1.1043'. [ 423.409218][T10393] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 423.421596][ T29] usb 6-1: New USB device found, idVendor=058f, idProduct=6610, bcdDevice=48.05 [ 423.431214][ T24] m920x_read = error: -19 [ 423.435587][ T24] dvb-usb: error while querying for an remote control event. [ 423.506392][ T29] usb 6-1: New USB device strings: Mfr=2, Product=0, SerialNumber=3 [ 423.610348][ T24] m920x_read = error: -19 [ 423.614725][ T24] dvb-usb: error while querying for an remote control event. [ 423.695796][ T29] usb 6-1: dvb_usb_v2: found a 'Sigmatek DVB-110' in warm state [ 423.777540][ T5907] usb 1-1: new high-speed USB device number 53 using dummy_hcd [ 423.781701][ T29] usb 6-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 423.802224][ T29] dvbdev: DVB: registering new adapter (Sigmatek DVB-110) [ 423.847941][ T24] m920x_read = error: -19 [ 423.860526][ T24] dvb-usb: error while querying for an remote control event. [ 423.878089][ T29] usb 6-1: media controller created [ 423.902373][ T29] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 423.941328][ T5907] usb 1-1: device descriptor read/64, error -71 [ 423.989018][ T24] m920x_read = error: -19 [ 423.994839][ T24] dvb-usb: error while querying for an remote control event. [ 424.098342][ T10] usb 3-1: new high-speed USB device number 33 using dummy_hcd [ 424.129433][ T24] m920x_read = error: -19 [ 424.138706][ T24] dvb-usb: error while querying for an remote control event. [ 424.171045][T10404] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1047'. [ 424.207746][ T5907] usb 1-1: new high-speed USB device number 54 using dummy_hcd [ 424.258065][ T24] m920x_read = error: -19 [ 424.279159][ T10] usb 3-1: config 0 has too many interfaces: 253, using maximum allowed: 32 [ 424.335585][ T10] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 253 [ 424.386300][ T10] usb 3-1: New USB device found, idVendor=055f, idProduct=c630, bcdDevice=b6.ac [ 424.399867][ T5907] usb 1-1: device descriptor read/64, error -71 [ 424.417295][ T24] dvb-usb: error while querying for an remote control event. [ 424.425281][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 424.433818][ T10] usb 3-1: Product: syz [ 424.438306][ T10] usb 3-1: Manufacturer: syz [ 424.443010][ T10] usb 3-1: SerialNumber: syz [ 424.503108][ T10] usb 3-1: config 0 descriptor?? [ 424.510443][T10415] Cannot find add_set index 32771 as target [ 424.515242][ T10] gspca_main: sunplus-2.14.0 probing 055f:c630 [ 424.523128][ T5907] usb usb1-port1: attempt power cycle [ 424.537611][ T5916] m920x_read = error: -19 [ 424.542016][ T5916] dvb-usb: error while querying for an remote control event. [ 424.657639][ T5916] m920x_read = error: -19 [ 424.683573][ T5916] dvb-usb: error while querying for an remote control event. [ 424.808686][ T5916] m920x_read = error: -19 [ 424.813597][ T5916] dvb-usb: error while querying for an remote control event. [ 424.877546][ T5907] usb 1-1: new high-speed USB device number 55 using dummy_hcd [ 424.899619][ T5907] usb 1-1: device descriptor read/8, error -71 [ 424.937946][ T5916] m920x_read = error: -19 [ 424.942322][ T5916] dvb-usb: error while querying for an remote control event. [ 425.032642][ T29] zl10353_read_register: readreg error (reg=127, ret==0) [ 425.067979][ T24] m920x_read = error: -19 [ 425.080134][ T24] dvb-usb: error while querying for an remote control event. [ 425.122388][T10399] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 425.132498][T10399] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 425.147628][ T5907] usb 1-1: new high-speed USB device number 56 using dummy_hcd [ 425.188682][ T5907] usb 1-1: device descriptor read/8, error -71 [ 425.208499][ T29] m920x_read = error: -19 [ 425.212976][ T29] dvb-usb: error while querying for an remote control event. [ 425.298057][ T5907] usb usb1-port1: unable to enumerate USB device [ 425.331244][ T29] m920x_read = error: -19 [ 425.348010][ T29] dvb-usb: error while querying for an remote control event. [ 425.467594][ T29] m920x_read = error: -19 [ 425.475423][ T29] dvb-usb: error while querying for an remote control event. [ 425.499086][ T29] usb 6-1: USB disconnect, device number 7 [ 425.588981][ T5916] m920x_read = error: -19 [ 425.593511][ T5916] dvb-usb: error while querying for an remote control event. [ 425.687548][ T5907] usb 4-1: new high-speed USB device number 41 using dummy_hcd [ 425.707593][ T29] m920x_read = error: -19 [ 425.711982][ T29] dvb-usb: error while querying for an remote control event. [ 425.807555][ T5914] usb 2-1: new high-speed USB device number 48 using dummy_hcd [ 425.828241][ T29] m920x_read = error: -19 [ 425.839335][ T5907] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 425.846260][ T29] dvb-usb: error while querying for an remote control event. [ 425.859587][ T5907] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 425.870385][ T5907] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 425.883934][ T5907] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 425.894189][ T5907] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 425.915327][ T5907] usb 4-1: config 0 descriptor?? [ 425.972088][ T5914] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 425.977658][ T29] m920x_read = error: -19 [ 425.987369][ T29] dvb-usb: error while querying for an remote control event. [ 425.996404][ T5914] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 426.008548][ T5914] usb 2-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 426.027537][ T5914] usb 2-1: New USB device strings: Mfr=2, Product=0, SerialNumber=0 [ 426.037467][ T5914] usb 2-1: Manufacturer: syz [ 426.050052][ T5914] usb 2-1: config 0 descriptor?? [ 426.117572][ T29] m920x_read = error: -19 [ 426.122186][ T29] dvb-usb: error while querying for an remote control event. [ 426.155913][ T10] gspca_sunplus: reg_r err -71 [ 426.164267][ T10] sunplus 3-1:0.0: probe with driver sunplus failed with error -71 [ 426.187024][ T30] kauditd_printk_skb: 51 callbacks suppressed [ 426.187040][ T30] audit: type=1326 audit(1773599346.716:1886): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10425 comm="syz.5.1054" exe="/root/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf7f97f6c code=0x0 [ 426.192366][ T10] usb 3-1: USB disconnect, device number 33 [ 426.238072][ T29] m920x_read = error: -19 [ 426.242453][ T29] dvb-usb: error while querying for an remote control event. [ 426.343707][ T5907] plantronics 0003:047F:FFFF.0039: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 426.357576][ T29] m920x_read = error: -19 [ 426.362741][ T29] dvb-usb: error while querying for an remote control event. [ 426.477629][ T29] m920x_read = error: -19 [ 426.482038][ T29] dvb-usb: error while querying for an remote control event. [ 426.598156][ T29] m920x_read = error: -19 [ 426.605898][ T29] dvb-usb: error while querying for an remote control event. [ 426.739544][ T29] m920x_read = error: -19 [ 426.800293][ T29] dvb-usb: error while querying for an remote control event. [ 426.927611][ T29] m920x_read = error: -19 [ 426.933946][ T29] dvb-usb: error while querying for an remote control event. [ 427.047786][ T29] m920x_read = error: -19 [ 427.056647][ T29] dvb-usb: error while querying for an remote control event. [ 427.084305][ T5914] input: syz as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:256C:006D.003A/input/input32 [ 427.168907][T10441] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1057'. [ 427.178431][ T24] m920x_read = error: -19 [ 427.183186][ T24] dvb-usb: error while querying for an remote control event. [ 427.415681][ T5914] input: syz as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:256C:006D.003A/input/input33 [ 427.431544][ T5914] uclogic 0003:256C:006D.003A: input,hidraw1: USB HID v0.00 Keypad [syz] on usb-dummy_hcd.1-1/input0 [ 427.534081][ T24] m920x_read = error: -19 [ 427.566450][ T24] dvb-usb: error while querying for an remote control event. [ 427.697568][ T24] m920x_read = error: -19 [ 427.702219][ T24] dvb-usb: error while querying for an remote control event. [ 427.837568][ T24] m920x_read = error: -19 [ 427.843130][ T24] dvb-usb: error while querying for an remote control event. [ 427.957555][ T24] m920x_read = error: -19 [ 427.961984][ T24] dvb-usb: error while querying for an remote control event. [ 428.032772][T10454] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1060'. [ 428.077646][ T24] m920x_read = error: -19 [ 428.082060][ T24] dvb-usb: error while querying for an remote control event. [ 428.238820][T10451] tipc: Started in network mode [ 428.243733][T10451] tipc: Node identity ac1414aa, cluster identity 4711 [ 428.251349][ T24] m920x_read = error: -19 [ 428.257880][T10451] tipc: Enabled bearer , priority 10 [ 428.269301][T10451] tipc: Enabled bearer , priority 0 [ 428.296592][ T24] dvb-usb: error while querying for an remote control event. [ 428.472307][ T24] m920x_read = error: -19 [ 428.478951][ T24] dvb-usb: error while querying for an remote control event. [ 428.488524][ T5916] usb 4-1: USB disconnect, device number 41 [ 428.607673][ T24] m920x_read = error: -19 [ 428.612216][ T24] dvb-usb: error while querying for an remote control event. [ 428.737555][ T5916] m920x_read = error: -19 [ 428.742072][ T5916] dvb-usb: error while querying for an remote control event. [ 428.760693][ T5907] usb 2-1: USB disconnect, device number 48 [ 428.774641][T10465] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1062'. [ 428.787186][T10465] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1062'. [ 429.007728][ T5916] m920x_read = error: -19 [ 429.013595][ T5916] dvb-usb: error while querying for an remote control event. [ 429.193114][T10476] x_tables: duplicate underflow at hook 1 [ 429.217886][ T30] audit: type=1326 audit(1773599349.716:1887): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10472 comm="syz.1.1064" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf706ef6c code=0x7ffc0000 [ 429.218690][ T5916] m920x_read = error: -19 [ 429.269740][ T29] tipc: Node number set to 2886997162 [ 429.311310][ T5916] dvb-usb: error while querying for an remote control event. [ 429.317639][ T30] audit: type=1326 audit(1773599349.716:1888): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10472 comm="syz.1.1064" exe="/root/syz-executor" sig=0 arch=40000003 syscall=437 compat=1 ip=0xf706ef6c code=0x7ffc0000 [ 429.519836][ T29] m920x_read = error: -19 [ 429.525212][ T29] dvb-usb: error while querying for an remote control event. [ 429.542010][ T30] audit: type=1326 audit(1773599349.716:1889): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10472 comm="syz.1.1064" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf706ef6c code=0x7ffc0000 [ 429.620513][T10481] GUP no longer grows the stack in syz.2.1065 (10481): 80009000-80018000 (80006000) [ 429.631250][T10481] CPU: 1 UID: 0 PID: 10481 Comm: syz.2.1065 Not tainted syzkaller #0 PREEMPT(full) [ 429.631275][T10481] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 429.631287][T10481] Call Trace: [ 429.631294][T10481] [ 429.631303][T10481] dump_stack_lvl+0xe8/0x150 [ 429.631332][T10481] __get_user_pages+0x2453/0x29d0 [ 429.631383][T10481] __gup_longterm_locked+0x3db/0x1630 [ 429.631409][T10481] ? try_get_folio+0x623/0x650 [ 429.631433][T10481] gup_fast_fallback+0x1d82/0x22e0 [ 429.631471][T10481] ? __pfx_gup_fast_fallback+0x10/0x10 [ 429.631491][T10481] ? is_valid_gup_args+0x11f/0x200 [ 429.631510][T10481] ? pin_user_pages_fast+0x4d/0xb0 [ 429.631528][T10481] io_pin_pages+0xba/0x1b0 [ 429.631641][T10481] io_sqe_buffer_register+0x268/0x1c90 [ 429.631709][T10481] ? kasan_quarantine_put+0xbb/0x1f0 [ 429.631731][T10481] ? __pfx_io_sqe_buffer_register+0x10/0x10 [ 429.631761][T10481] __io_register_rsrc_update+0x4a8/0x10c0 [ 429.631791][T10481] ? __pfx___io_register_rsrc_update+0x10/0x10 [ 429.631823][T10481] io_register_rsrc_update+0x1b1/0x1c0 [ 429.631841][T10481] ? __pfx_io_register_rsrc_update+0x10/0x10 [ 429.631859][T10481] ? __fget_files+0x2a/0x420 [ 429.631878][T10481] ? io_is_uring_fops+0xd/0x50 [ 429.631892][T10481] __se_sys_io_uring_register+0xfe2/0x19a0 [ 429.631914][T10481] ? __pfx___se_sys_io_uring_register+0x10/0x10 [ 429.631933][T10481] ? rcu_is_watching+0x15/0xb0 [ 429.631959][T10481] __do_fast_syscall_32+0x20d/0x640 [ 429.631974][T10481] ? lockdep_hardirqs_on+0x7a/0x110 [ 429.631987][T10481] ? do_fast_syscall_32+0x33/0x70 [ 429.632000][T10481] ? irqentry_exit+0x10e/0x620 [ 429.632012][T10481] ? trace_irq_disable+0x3b/0x150 [ 429.632031][T10481] do_fast_syscall_32+0x33/0x70 [ 429.632045][T10481] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 429.632061][T10481] RIP: 0023:0xf7f53f6c [ 429.632076][T10481] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 429.632089][T10481] RSP: 002b:00000000f4f7e50c EFLAGS: 00000206 ORIG_RAX: 00000000000001ab [ 429.632105][T10481] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 0000000000000010 [ 429.632114][T10481] RDX: 0000000080000600 RSI: 0000000000000020 RDI: 0000000000000000 [ 429.632122][T10481] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 429.632131][T10481] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 429.632139][T10481] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 429.632159][T10481] [ 429.959470][ T29] m920x_read = error: -19 [ 429.963856][ T29] dvb-usb: error while querying for an remote control event. [ 430.078428][ T5916] m920x_read = error: -19 [ 430.082828][ T5916] dvb-usb: error while querying for an remote control event. [ 430.141972][ T30] audit: type=1326 audit(1773599349.716:1890): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10472 comm="syz.1.1064" exe="/root/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf706ef6c code=0x7ffc0000 [ 430.285857][ T30] audit: type=1326 audit(1773599349.716:1891): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10472 comm="syz.1.1064" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf706ef6c code=0x7ffc0000 [ 430.418619][ T5916] m920x_read = error: -19 [ 430.426695][ T5916] dvb-usb: error while querying for an remote control event. [ 430.536942][ T30] audit: type=1326 audit(1773599349.716:1892): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10472 comm="syz.1.1064" exe="/root/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf706ef6c code=0x7ffc0000 [ 430.567707][ T29] usb 1-1: new high-speed USB device number 57 using dummy_hcd [ 430.570645][ T30] audit: type=1326 audit(1773599349.716:1893): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10472 comm="syz.1.1064" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf706ef6c code=0x7ffc0000 [ 430.577723][ T5916] m920x_read = error: -19 [ 430.661819][ T30] audit: type=1326 audit(1773599349.716:1894): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10472 comm="syz.1.1064" exe="/root/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf706ef6c code=0x7ffc0000 [ 430.684937][ T5916] dvb-usb: error while querying for an remote control event. [ 430.701200][ T30] audit: type=1326 audit(1773599349.716:1895): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10472 comm="syz.1.1064" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf706ef6c code=0x7ffc0000 [ 430.777544][ T29] usb 1-1: New USB device found, idVendor=0547, idProduct=0201, bcdDevice=11.64 [ 430.786653][ T29] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 430.795154][ T5916] m920x_read = error: -19 [ 430.799663][ T5916] dvb-usb: error while querying for an remote control event. [ 430.818497][T10493] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1069'. [ 430.827833][T10493] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1069'. [ 430.923544][ T5916] m920x_read = error: -19 [ 430.936352][ T5916] dvb-usb: error while querying for an remote control event. [ 430.965785][ T29] usb 1-1: Product: syz [ 431.020112][ T29] usb 1-1: Manufacturer: syz [ 431.030834][ T29] usb 1-1: SerialNumber: syz [ 431.048071][ T29] usb 1-1: config 0 descriptor?? [ 431.061435][ T29] dvb-usb: found a 'Nebula Electronics uDigiTV DVB-T USB2.0)' in warm state. [ 431.070360][ T24] m920x_read = error: -19 [ 431.074719][ T24] dvb-usb: error while querying for an remote control event. [ 431.104668][ T29] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 431.182218][ T29] dvbdev: DVB: registering new adapter (Nebula Electronics uDigiTV DVB-T USB2.0)) [ 431.192410][ T24] m920x_read = error: -19 [ 431.197552][ T24] dvb-usb: error while querying for an remote control event. [ 431.273083][ T29] usb 1-1: media controller created [ 431.359247][ T24] m920x_read = error: -19 [ 431.377484][ T24] dvb-usb: error while querying for an remote control event. [ 431.388896][ T29] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 431.499455][ T29] DVB: Unable to find symbol mt352_attach() [ 431.519361][ T5916] m920x_read = error: -19 [ 431.570549][ T5916] dvb-usb: error while querying for an remote control event. [ 431.698495][ T5916] m920x_read = error: -19 [ 431.703622][ T5916] dvb-usb: error while querying for an remote control event. [ 431.747660][ T29] DVB: Unable to find symbol nxt6000_attach() [ 431.753781][ T29] dvb-usb: no frontend was attached by 'Nebula Electronics uDigiTV DVB-T USB2.0)' [ 431.870273][ T29] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.0/usb1/1-1/input/input34 [ 431.882168][ T5916] m920x_read = error: -19 [ 431.886921][ T5916] dvb-usb: error while querying for an remote control event. [ 431.919406][ T29] dvb-usb: schedule remote query interval to 1000 msecs. [ 431.928164][ T24] usb 4-1: new high-speed USB device number 42 using dummy_hcd [ 431.964060][ T29] dvb-usb: Nebula Electronics uDigiTV DVB-T USB2.0) successfully initialized and connected. [ 431.992442][ T29] dvb-usb: bulk message failed: -22 (7/0) [ 432.018271][ T29] dvb-usb: bulk message failed: -22 (7/0) [ 432.027713][ T5827] m920x_read = error: -19 [ 432.032098][ T5827] dvb-usb: error while querying for an remote control event. [ 432.044380][ T29] usb 1-1: USB disconnect, device number 57 [ 432.119070][ T24] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 432.130146][ T24] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 432.140403][ T24] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 432.157871][ T5916] m920x_read = error: -19 [ 432.163207][ T5916] dvb-usb: error while querying for an remote control event. [ 432.182809][ T24] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 432.207015][ T24] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 432.227542][ T24] usb 4-1: config 0 descriptor?? [ 432.320654][ T29] dvb-usb: Nebula Electronics uDigiTV DVB-T USB2.0 successfully deinitialized and disconnected. [ 432.354399][ T5916] m920x_read = error: -19 [ 432.363741][ T5916] dvb-usb: error while querying for an remote control event. [ 432.487833][ T5916] m920x_read = error: -19 [ 432.521449][T10518] netlink: 56 bytes leftover after parsing attributes in process `syz.0.1074'. [ 432.530729][T10518] netlink: 56 bytes leftover after parsing attributes in process `syz.0.1074'. [ 432.541475][ T5916] dvb-usb: error while querying for an remote control event. [ 432.670261][ T29] m920x_read = error: -19 [ 432.674611][ T29] dvb-usb: error while querying for an remote control event. [ 432.682260][ T24] plantronics 0003:047F:FFFF.003B: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 432.698643][ T5831] usb 2-1: new high-speed USB device number 49 using dummy_hcd [ 432.797558][ T24] m920x_read = error: -19 [ 432.802469][ T24] dvb-usb: error while querying for an remote control event. [ 432.887538][ T10] usb 3-1: new high-speed USB device number 34 using dummy_hcd [ 432.896717][ T5831] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 432.916072][ T5831] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 432.997755][ T24] m920x_read = error: -19 [ 433.014584][ T24] dvb-usb: error while querying for an remote control event. [ 433.029490][ T5831] usb 2-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 433.040005][ T5831] usb 2-1: New USB device strings: Mfr=2, Product=0, SerialNumber=0 [ 433.049237][ T5831] usb 2-1: Manufacturer: syz [ 433.056029][ T5831] usb 2-1: config 0 descriptor?? [ 433.077534][ T10] usb 3-1: device descriptor read/64, error -71 [ 433.143179][ T30] kauditd_printk_skb: 31 callbacks suppressed [ 433.143196][ T30] audit: type=1326 audit(1773599353.676:1927): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10523 comm="syz.5.1078" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f97f6c code=0x7ffc0000 [ 433.173291][T10527] x_tables: duplicate underflow at hook 1 [ 433.192905][T10527] pim6reg: entered allmulticast mode [ 433.198841][ T30] audit: type=1326 audit(1773599353.676:1928): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10523 comm="syz.5.1078" exe="/root/syz-executor" sig=0 arch=40000003 syscall=437 compat=1 ip=0xf7f97f6c code=0x7ffc0000 [ 433.221977][ T30] audit: type=1326 audit(1773599353.676:1929): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10523 comm="syz.5.1078" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f97f6c code=0x7ffc0000 [ 433.248517][ T24] m920x_read = error: -19 [ 433.264973][ T24] dvb-usb: error while querying for an remote control event. [ 433.267350][ T30] audit: type=1326 audit(1773599353.676:1930): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10523 comm="syz.5.1078" exe="/root/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf7f97f6c code=0x7ffc0000 [ 433.317562][ T10] usb 3-1: new high-speed USB device number 35 using dummy_hcd [ 433.363772][ T30] audit: type=1326 audit(1773599353.676:1931): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10523 comm="syz.5.1078" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f97f6c code=0x7ffc0000 [ 433.378507][ T24] m920x_read = error: -19 [ 433.426113][ T30] audit: type=1326 audit(1773599353.676:1932): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10523 comm="syz.5.1078" exe="/root/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf7f97f6c code=0x7ffc0000 [ 433.427546][ T24] dvb-usb: error while querying for an remote control event. [ 433.512529][ T10] usb 3-1: device descriptor read/64, error -71 [ 433.556792][ T30] audit: type=1326 audit(1773599353.676:1933): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10523 comm="syz.5.1078" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f97f6c code=0x7ffc0000 [ 433.628804][ T24] m920x_read = error: -19 [ 433.632642][ T10] usb usb3-port1: attempt power cycle [ 433.633306][ T24] dvb-usb: error while querying for an remote control event. [ 433.652074][ T30] audit: type=1326 audit(1773599353.676:1934): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10523 comm="syz.5.1078" exe="/root/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf7f97f6c code=0x7ffc0000 [ 433.847191][ T24] m920x_read = error: -19 [ 433.851738][ T24] dvb-usb: error while querying for an remote control event. [ 433.867589][ T30] audit: type=1326 audit(1773599353.676:1935): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10523 comm="syz.5.1078" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f97f6c code=0x7ffc0000 [ 433.890464][ T30] audit: type=1326 audit(1773599353.676:1936): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10523 comm="syz.5.1078" exe="/root/syz-executor" sig=0 arch=40000003 syscall=145 compat=1 ip=0xf7f97f6c code=0x7ffc0000 [ 434.007881][ T24] m920x_read = error: -19 [ 434.014985][ T24] dvb-usb: error while querying for an remote control event. [ 434.132413][ T10] usb 3-1: new high-speed USB device number 36 using dummy_hcd [ 434.134384][ T5831] input: syz as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:256C:006D.003C/input/input35 [ 434.151469][ T5916] m920x_read = error: -19 [ 434.155838][ T5916] dvb-usb: error while querying for an remote control event. [ 434.185536][ T10] usb 3-1: device descriptor read/8, error -71 [ 434.281668][ T5831] input: syz as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:256C:006D.003C/input/input36 [ 434.292420][ T5916] m920x_read = error: -19 [ 434.296787][ T5916] dvb-usb: error while querying for an remote control event. [ 434.429710][ T10] usb 3-1: new high-speed USB device number 37 using dummy_hcd [ 434.437733][ T5916] m920x_read = error: -19 [ 434.563858][T10540] netlink: 20 bytes leftover after parsing attributes in process `syz.5.1080'. [ 434.587561][ T5916] dvb-usb: error while querying for an remote control event. [ 434.686251][ T10] usb 3-1: device descriptor read/8, error -71 [ 434.858687][ T29] m920x_read = error: -19 [ 434.863075][ T29] dvb-usb: error while querying for an remote control event. [ 434.877743][ T5907] usb 4-1: USB disconnect, device number 42 [ 434.887931][ T10] usb usb3-port1: unable to enumerate USB device [ 434.903861][ T5831] uclogic 0003:256C:006D.003C: input,hidraw1: USB HID v0.00 Keypad [syz] on usb-dummy_hcd.1-1/input0 [ 434.998087][ T5916] m920x_read = error: -19 [ 435.027028][ T5916] dvb-usb: error while querying for an remote control event. [ 435.167732][ T5916] m920x_read = error: -19 [ 435.175032][ T5916] dvb-usb: error while querying for an remote control event. [ 435.187610][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 435.328120][ T29] m920x_read = error: -19 [ 435.332567][ T29] dvb-usb: error while querying for an remote control event. [ 435.417580][ T5916] usb 2-1: reset high-speed USB device number 49 using dummy_hcd [ 435.447559][ T5831] m920x_read = error: -19 [ 435.451969][ T5831] dvb-usb: error while querying for an remote control event. [ 435.577553][ T5831] m920x_read = error: -19 [ 435.581964][ T5831] dvb-usb: error while querying for an remote control event. [ 435.717969][ T5831] m920x_read = error: -19 [ 435.733506][ T5831] dvb-usb: error while querying for an remote control event. [ 435.907110][ T5827] m920x_read = error: -19 [ 435.942202][ T5827] dvb-usb: error while querying for an remote control event. [ 436.067641][ T5827] m920x_read = error: -19 [ 436.072051][ T5827] dvb-usb: error while querying for an remote control event. [ 436.197649][ T5827] m920x_read = error: -19 [ 436.202313][ T5827] dvb-usb: error while querying for an remote control event. [ 436.317778][ T5831] m920x_read = error: -19 [ 436.322157][ T5831] dvb-usb: error while querying for an remote control event. [ 436.569568][ T5831] m920x_read = error: -19 [ 436.586021][ T5831] dvb-usb: error while querying for an remote control event. [ 436.727578][ T5831] m920x_read = error: -19 [ 436.731984][ T5831] dvb-usb: error while querying for an remote control event. [ 436.827574][ T5914] usb 3-1: new high-speed USB device number 38 using dummy_hcd [ 436.875790][ T5831] m920x_read = error: -19 [ 436.885850][ T5831] dvb-usb: error while querying for an remote control event. [ 436.933682][T10576] x_tables: duplicate underflow at hook 1 [ 437.018120][ T5831] m920x_read = error: -19 [ 437.022477][ T5831] dvb-usb: error while querying for an remote control event. [ 437.041805][ T5914] usb 3-1: Using ep0 maxpacket: 16 [ 437.049931][ T5914] usb 3-1: config index 0 descriptor too short (expected 526, got 367) [ 437.063557][ T5914] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 437.095856][ T5914] usb 3-1: New USB device found, idVendor=0424, idProduct=cf19, bcdDevice=a4.96 [ 437.110370][ T5914] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 437.167563][ T5914] usb 3-1: Product: syz [ 437.177735][ T5914] usb 3-1: Manufacturer: syz [ 437.182478][ T5914] usb 3-1: SerialNumber: syz [ 437.204732][ T5914] usb 3-1: config 0 descriptor?? [ 437.217603][ T5831] m920x_read = error: -19 [ 437.227548][ T5916] usb 2-1: device descriptor read/64, error -71 [ 437.252076][ T5831] dvb-usb: error while querying for an remote control event. [ 437.377853][ T5831] m920x_read = error: -19 [ 437.382635][ T5831] dvb-usb: error while querying for an remote control event. [ 437.479059][ T5916] usb 2-1: reset high-speed USB device number 49 using dummy_hcd [ 437.507622][ T5831] m920x_read = error: -19 [ 437.521161][ T5831] dvb-usb: error while querying for an remote control event. [ 437.927804][ T5831] m920x_read = error: -19 [ 437.932374][ T5831] dvb-usb: error while querying for an remote control event. [ 437.948176][ T5916] usb 2-1: device firmware changed [ 437.958167][ T29] usb 2-1: USB disconnect, device number 49 [ 437.967519][ T5914] usb 4-1: new high-speed USB device number 43 using dummy_hcd [ 438.051211][ T5916] m920x_read = error: -19 [ 438.055666][ T5916] dvb-usb: error while querying for an remote control event. [ 438.139983][ T5914] usb 4-1: Using ep0 maxpacket: 16 [ 438.164049][ T5914] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 438.176763][ T5914] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 438.177996][ T5916] m920x_read = error: -19 [ 438.220387][ T5916] dvb-usb: error while querying for an remote control event. [ 438.222372][ T5914] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 438.248137][ T5914] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 438.256399][ T5914] usb 4-1: Product: syz [ 438.262133][ T5914] usb 4-1: Manufacturer: syz [ 438.267549][ T5914] usb 4-1: SerialNumber: syz [ 438.327533][ T29] usb 2-1: new high-speed USB device number 50 using dummy_hcd [ 438.347713][ T5916] m920x_read = error: -19 [ 438.352078][ T5916] dvb-usb: error while querying for an remote control event. [ 438.477881][ T5916] m920x_read = error: -19 [ 438.484189][ T5916] dvb-usb: error while querying for an remote control event. [ 438.484675][T10584] PKCS7: Unknown OID: [5] (bad) [ 438.507715][T10584] PKCS7: Only support pkcs7_signedData type [ 438.516495][ T29] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 438.547174][ T29] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 438.560365][ T5914] usb 4-1: 0:2 : does not exist [ 438.567105][ T29] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 438.583613][ T29] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 438.593856][ T29] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 438.604708][ T5914] usb 4-1: 5:0: failed to get current value for ch 0 (-22) [ 438.639826][ T5916] m920x_read = error: -19 [ 438.644442][ T5916] dvb-usb: error while querying for an remote control event. [ 438.658587][ T29] usb 2-1: config 0 descriptor?? [ 438.690159][ T5914] usb 4-1: USB disconnect, device number 43 [ 438.770441][ T5916] m920x_read = error: -19 [ 438.775005][ T5916] dvb-usb: error while querying for an remote control event. [ 438.796485][T10590] bond0: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 438.833096][T10590] bond0: (slave lo): Error: Device can not be enslaved while up [ 438.898200][ T5916] m920x_read = error: -19 [ 438.903014][ T5916] dvb-usb: error while querying for an remote control event. [ 439.063858][ T5916] m920x_read = error: -19 [ 439.069194][ T5916] dvb-usb: error while querying for an remote control event. [ 439.097885][ T29] plantronics 0003:047F:FFFF.003D: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0 [ 439.187776][ T29] m920x_read = error: -19 [ 439.200622][ T29] dvb-usb: error while querying for an remote control event. [ 439.337589][ T29] m920x_read = error: -19 [ 439.392576][ T29] dvb-usb: error while querying for an remote control event. [ 439.400714][ T5916] usb 3-1: USB disconnect, device number 38 [ 439.598637][ T5827] m920x_read = error: -19 [ 439.603431][ T5827] dvb-usb: error while querying for an remote control event. [ 439.836126][ T5827] m920x_read = error: -19 [ 439.840594][ T5827] dvb-usb: error while querying for an remote control event. [ 439.957578][ T5827] m920x_read = error: -19 [ 439.962208][ T5827] dvb-usb: error while querying for an remote control event. [ 440.082461][ T5827] m920x_read = error: -19 [ 440.086906][ T5827] dvb-usb: error while querying for an remote control event. [ 440.257253][ T5827] m920x_read = error: -19 [ 440.283208][ T5827] dvb-usb: error while querying for an remote control event. [ 440.330222][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.336765][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.407642][ T5916] m920x_read = error: -19 [ 440.412072][ T5916] dvb-usb: error while querying for an remote control event. [ 440.640622][ T29] m920x_read = error: -19 [ 440.647840][ T29] dvb-usb: error while querying for an remote control event. [ 440.767825][ T29] m920x_read = error: -19 [ 440.772396][ T29] dvb-usb: error while querying for an remote control event. [ 440.921927][ T29] m920x_read = error: -19 [ 440.926317][ T29] dvb-usb: error while querying for an remote control event. [ 441.026591][T10638] x_tables: duplicate underflow at hook 1 [ 441.032891][ T30] kauditd_printk_skb: 93 callbacks suppressed [ 441.032904][ T30] audit: type=1326 audit(1773599361.536:2030): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10631 comm="syz.2.1105" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f53f6c code=0x7ffc0000 [ 441.104361][ T10] usb 1-1: new high-speed USB device number 58 using dummy_hcd [ 441.203695][ T29] m920x_read = error: -19 [ 441.208874][ T29] dvb-usb: error while querying for an remote control event. [ 441.209280][ T5914] usb 2-1: USB disconnect, device number 50 [ 441.377587][ T10] usb 1-1: Using ep0 maxpacket: 16 [ 441.389587][ T30] audit: type=1326 audit(1773599361.536:2031): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10631 comm="syz.2.1105" exe="/root/syz-executor" sig=0 arch=40000003 syscall=437 compat=1 ip=0xf7f53f6c code=0x7ffc0000 [ 441.416627][ T10] usb 1-1: unable to get BOS descriptor or descriptor too short [ 441.434590][ T10] usb 1-1: config 13 has an invalid interface number: 50 but max is 0 [ 441.471126][ T10] usb 1-1: config 13 has no interface number 0 [ 441.486875][ T10] usb 1-1: config 13 interface 50 altsetting 167 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 441.509563][ T30] audit: type=1326 audit(1773599361.536:2032): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10631 comm="syz.2.1105" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f53f6c code=0x7ffc0000 [ 441.552170][ T29] m920x_read = error: -19 [ 441.554397][ T10] usb 1-1: config 13 interface 50 has no altsetting 0 [ 441.565141][ T29] dvb-usb: error while querying for an remote control event. [ 441.565801][ T30] audit: type=1326 audit(1773599361.536:2033): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10631 comm="syz.2.1105" exe="/root/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf7f53f6c code=0x7ffc0000 [ 441.619311][ T10] usb 1-1: New USB device found, idVendor=1aca, idProduct=b28e, bcdDevice=92.32 [ 441.629047][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 441.706788][ T10] usb 1-1: Product: syz [ 441.731568][ T29] m920x_read = error: -19 [ 441.731796][ T10] usb 1-1: Manufacturer: syz [ 441.792233][ T10] usb 1-1: SerialNumber: syz [ 441.792321][ T29] dvb-usb: error while querying for an remote control event. [ 441.856697][ T30] audit: type=1326 audit(1773599361.536:2034): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10631 comm="syz.2.1105" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f53f6c code=0x7ffc0000 [ 441.920067][ T30] audit: type=1326 audit(1773599361.536:2035): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10631 comm="syz.2.1105" exe="/root/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf7f53f6c code=0x7ffc0000 [ 441.947839][ T29] m920x_read = error: -19 [ 441.952987][ T29] dvb-usb: error while querying for an remote control event. [ 442.073611][ T30] audit: type=1326 audit(1773599361.536:2036): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10631 comm="syz.2.1105" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f53f6c code=0x7ffc0000 [ 442.248760][ T29] m920x_read = error: -19 [ 442.302571][ T29] dvb-usb: error while querying for an remote control event. [ 442.367594][ T30] audit: type=1326 audit(1773599361.536:2037): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10631 comm="syz.2.1105" exe="/root/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf7f53f6c code=0x7ffc0000 [ 442.466301][ T30] audit: type=1326 audit(1773599361.536:2038): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10631 comm="syz.2.1105" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f53f6c code=0x7ffc0000 [ 442.549233][ T30] audit: type=1326 audit(1773599361.546:2039): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10631 comm="syz.2.1105" exe="/root/syz-executor" sig=0 arch=40000003 syscall=145 compat=1 ip=0xf7f53f6c code=0x7ffc0000 [ 442.577691][ T29] m920x_read = error: -19 [ 442.587593][ T29] dvb-usb: error while querying for an remote control event. [ 442.717571][ T5827] m920x_read = error: -19 [ 442.722007][ T5827] dvb-usb: error while querying for an remote control event. [ 442.747508][ T29] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 442.848168][ T5827] m920x_read = error: -19 [ 442.852790][ T5827] dvb-usb: error while querying for an remote control event. [ 442.912488][ T29] usb 6-1: New USB device found, idVendor=1a86, idProduct=7522, bcdDevice=35.36 [ 442.921989][ T29] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 442.950411][ T29] usb 6-1: Product: syz [ 442.957512][ T29] usb 6-1: Manufacturer: syz [ 442.962267][ T29] usb 6-1: SerialNumber: syz [ 442.977553][ T5827] m920x_read = error: -19 [ 442.982045][ T5827] dvb-usb: error while querying for an remote control event. [ 442.990513][ T29] usb 6-1: config 0 descriptor?? [ 443.003433][ T29] ch341 6-1:0.0: ch341-uart converter detected [ 443.077568][ T5914] usb 3-1: new high-speed USB device number 39 using dummy_hcd [ 443.117891][ T5827] m920x_read = error: -19 [ 443.122310][ T5827] dvb-usb: error while querying for an remote control event. [ 443.259495][ T5914] usb 3-1: Using ep0 maxpacket: 16 [ 443.264947][ T5916] m920x_read = error: -19 [ 443.269949][ T5827] IPVS: starting estimator thread 0... [ 443.275761][ T5916] dvb-usb: error while querying for an remote control event. [ 443.291346][ T5914] usb 3-1: config index 0 descriptor too short (expected 51443, got 18) [ 443.303222][ T5914] usb 3-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 443.314489][ T5914] usb 3-1: New USB device strings: Mfr=14, Product=2, SerialNumber=3 [ 443.329588][ T5914] usb 3-1: Product: syz [ 443.338894][ T5914] usb 3-1: Manufacturer: syz [ 443.349784][ T5914] usb 3-1: SerialNumber: syz [ 443.365121][ T5914] r8152-cfgselector 3-1: Unknown version 0x0000 [ 443.371808][T10669] IPVS: using max 57 ests per chain, 136800 per kthread [ 443.381132][ T5914] r8152-cfgselector 3-1: config 0 descriptor?? [ 443.389256][ T5916] m920x_read = error: -19 [ 443.393666][ T5916] dvb-usb: error while querying for an remote control event. [ 443.507985][ T5916] m920x_read = error: -19 [ 443.510923][ T10] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 443.512448][ T5916] dvb-usb: error while querying for an remote control event. [ 443.538651][ T10] usb 1-1: MIDIStreaming interface descriptor not found [ 443.636902][T10672] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 443.657584][ T5916] m920x_read = error: -19 [ 443.670911][T10661] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1113'. [ 443.674161][ T5916] dvb-usb: error while querying for an remote control event. [ 443.735731][T10672] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 443.784465][ T10] usb 1-1: USB disconnect, device number 58 [ 443.798202][ T5914] r8152-cfgselector 3-1: Needed 2 retries to read version [ 443.805402][ T5914] r8152-cfgselector 3-1: Unknown version 0x0000 [ 443.817925][ T5916] m920x_read = error: -19 [ 443.823932][T10655] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 443.836057][ T5914] r8152-cfgselector 3-1: bad CDC descriptors [ 443.837814][ T5916] dvb-usb: error while querying for an remote control event. [ 443.844753][T10676] QAT: failed to copy from user cfg_data. [ 443.858321][T10655] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 443.883815][T10672] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 443.908703][T10672] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 443.967740][ T5916] m920x_read = error: -19 [ 443.972145][ T5916] dvb-usb: error while querying for an remote control event. [ 444.087669][ T5916] m920x_read = error: -19 [ 444.092104][ T5916] dvb-usb: error while querying for an remote control event. [ 444.227574][ T5916] m920x_read = error: -19 [ 444.232042][ T5916] dvb-usb: error while querying for an remote control event. [ 444.262815][T10685] netlink: 56 bytes leftover after parsing attributes in process `syz.0.1119'. [ 444.272970][T10685] netlink: 56 bytes leftover after parsing attributes in process `syz.0.1119'. [ 444.368187][ T5916] m920x_read = error: -19 [ 444.373993][ T5916] dvb-usb: error while querying for an remote control event. [ 444.488233][ T5916] m920x_read = error: -19 [ 444.492847][ T5916] dvb-usb: error while querying for an remote control event. [ 444.600941][T10693] x_tables: duplicate underflow at hook 1 [ 444.617679][ T5916] m920x_read = error: -19 [ 444.622072][ T5916] dvb-usb: error while querying for an remote control event. [ 444.676388][ T29] ch341-uart ttyUSB0: failed to read break control: -71 [ 444.685491][ T29] ch341-uart ttyUSB0: probe with driver ch341-uart failed with error -71 [ 444.759314][ T5916] m920x_read = error: -19 [ 444.768169][ T5916] dvb-usb: error while querying for an remote control event. [ 444.790833][ T29] usb 6-1: USB disconnect, device number 8 [ 444.805177][ T29] ch341 6-1:0.0: device disconnected [ 444.909497][ T5916] m920x_read = error: -19 [ 444.914386][ T5916] dvb-usb: error while querying for an remote control event. [ 445.028025][ T5916] m920x_read = error: -19 [ 445.159765][ T5916] dvb-usb: error while querying for an remote control event. [ 445.307590][ T5916] m920x_read = error: -19 [ 445.311972][ T5916] dvb-usb: error while querying for an remote control event. [ 445.488915][ T5916] m920x_read = error: -19 [ 445.509019][ T5916] dvb-usb: error while querying for an remote control event. [ 445.647704][ T5916] m920x_read = error: -19 [ 446.008612][ T5916] dvb-usb: error while querying for an remote control event. [ 446.139902][ T5916] m920x_read = error: -19 [ 446.144263][ T5916] dvb-usb: error while querying for an remote control event. [ 446.289573][ T29] m920x_read = error: -19 [ 446.294050][ T29] dvb-usb: error while querying for an remote control event. [ 446.407555][ T29] m920x_read = error: -19 [ 446.412193][ T29] dvb-usb: error while querying for an remote control event. [ 446.548320][ T29] m920x_read = error: -19 [ 446.553062][ T29] dvb-usb: error while querying for an remote control event. [ 446.570047][T10728] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 446.607938][T10728] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 446.750937][ T29] m920x_read = error: -19 [ 446.755315][ T29] dvb-usb: error while querying for an remote control event. [ 446.887817][ T5916] m920x_read = error: -19 [ 446.892371][ T5916] dvb-usb: error while querying for an remote control event. [ 446.899898][ T5831] usb 4-1: new high-speed USB device number 44 using dummy_hcd [ 447.028123][ T29] m920x_read = error: -19 [ 447.032581][ T29] dvb-usb: error while querying for an remote control event. [ 447.067492][ T5831] usb 4-1: Using ep0 maxpacket: 32 [ 447.080656][ T10] usb 2-1: new high-speed USB device number 51 using dummy_hcd [ 447.097726][ T5916] usb 6-1: new high-speed USB device number 9 using dummy_hcd [ 447.108952][ T5831] usb 4-1: config 0 interface 0 altsetting 9 endpoint 0x81 has invalid maxpacket 9865, setting to 1024 [ 447.125935][ T5831] usb 4-1: config 0 interface 0 altsetting 9 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 447.140811][ T5831] usb 4-1: config 0 interface 0 has no altsetting 0 [ 447.147728][ T5831] usb 4-1: New USB device found, idVendor=05ac, idProduct=0269, bcdDevice= 0.00 [ 447.157062][ T5831] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 447.165618][ T29] m920x_read = error: -19 [ 447.172176][ T29] dvb-usb: error while querying for an remote control event. [ 447.185698][ T5831] usb 4-1: config 0 descriptor?? [ 447.194253][T10727] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 447.229680][ T5916] usb 6-1: device descriptor read/64, error -71 [ 447.287574][ T29] m920x_read = error: -19 [ 447.295246][ T29] dvb-usb: error while querying for an remote control event. [ 447.297514][ T10] usb 2-1: Using ep0 maxpacket: 32 [ 447.467724][ T29] m920x_read = error: -19 [ 447.468832][ T10] usb 2-1: config 0 interface 0 altsetting 9 endpoint 0x81 has invalid maxpacket 9865, setting to 1024 [ 447.472480][ T29] dvb-usb: error while querying for an remote control event. [ 447.483475][ T10] usb 2-1: config 0 interface 0 altsetting 9 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 447.503701][ T10] usb 2-1: config 0 interface 0 has no altsetting 0 [ 447.510544][ T10] usb 2-1: New USB device found, idVendor=05ac, idProduct=0269, bcdDevice= 0.00 [ 447.519711][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 447.527509][ T5916] usb 6-1: new high-speed USB device number 10 using dummy_hcd [ 447.531128][ T10] usb 2-1: config 0 descriptor?? [ 447.548246][T10735] raw-gadget.3 gadget.1: fail, usb_ep_enable returned -22 [ 447.677580][ T29] m920x_read = error: -19 [ 447.682008][ T29] dvb-usb: error while querying for an remote control event. [ 447.697534][ T5916] usb 6-1: device descriptor read/64, error -71 [ 447.729061][T10727] create_pit_timer: 6 callbacks suppressed [ 447.729079][T10727] kvm: requested 79619 ns i8254 timer period limited to 200000 ns [ 447.746939][T10727] kvm: requested 72914 ns i8254 timer period limited to 200000 ns [ 447.757170][T10727] kvm: requested 81295 ns i8254 timer period limited to 200000 ns [ 447.774127][T10727] kvm: requested 180190 ns i8254 timer period limited to 200000 ns [ 447.800062][ T24] m920x_read = error: -19 [ 447.804450][ T24] dvb-usb: error while querying for an remote control event. [ 447.814150][ T5831] hid (null): global environment stack underflow [ 447.821449][T10727] kvm: requested 26819 ns i8254 timer period limited to 200000 ns [ 447.832425][ T5916] usb usb6-port1: attempt power cycle [ 447.838373][ T5831] hid (null): invalid report_count -274726912 [ 447.846534][ T5831] hid (null): invalid report_size 7169389 [ 447.861849][T10727] kvm: requested 27657 ns i8254 timer period limited to 200000 ns [ 447.874123][ T5831] hid_parser_main: 14 callbacks suppressed [ 447.874142][ T5831] magicmouse 0003:05AC:0269.003E: unknown main item tag 0x0 [ 447.888132][T10727] kvm: requested 838 ns i8254 timer period limited to 200000 ns [ 447.903649][T10727] kvm: requested 3352 ns i8254 timer period limited to 200000 ns [ 447.912089][ T5831] magicmouse 0003:05AC:0269.003E: unknown main item tag 0x0 [ 447.920691][ T5831] magicmouse 0003:05AC:0269.003E: unknown main item tag 0x0 [ 447.928072][ T5831] magicmouse 0003:05AC:0269.003E: unknown main item tag 0x0 [ 447.935418][ T5831] magicmouse 0003:05AC:0269.003E: unknown main item tag 0x0 [ 447.946676][T10727] kvm: requested 14247 ns i8254 timer period limited to 200000 ns [ 447.955604][ T24] m920x_read = error: -19 [ 447.960025][ T24] dvb-usb: error while querying for an remote control event. [ 447.972263][ T5831] magicmouse 0003:05AC:0269.003E: unknown main item tag 0x0 [ 447.979765][T10727] kvm: requested 80457 ns i8254 timer period limited to 200000 ns [ 447.980093][ T5831] magicmouse 0003:05AC:0269.003E: unknown main item tag 0x0 [ 448.000784][ T5831] magicmouse 0003:05AC:0269.003E: unknown main item tag 0x0 [ 448.027718][ T5831] magicmouse 0003:05AC:0269.003E: unknown main item tag 0x0 [ 448.044351][ T5831] magicmouse 0003:05AC:0269.003E: unknown main item tag 0x5 [ 448.055994][ T5831] magicmouse 0003:05AC:0269.003E: global environment stack underflow [ 448.082018][ T24] m920x_read = error: -19 [ 448.090859][ T24] dvb-usb: error while querying for an remote control event. [ 448.108617][ T5831] magicmouse 0003:05AC:0269.003E: item 0 0 1 11 parsing failed [ 448.123070][ T5831] magicmouse 0003:05AC:0269.003E: magicmouse hid parse failed [ 448.142025][ T5831] magicmouse 0003:05AC:0269.003E: probe with driver magicmouse failed with error -22 [ 448.147020][ T10] hid (null): global environment stack underflow [ 448.182103][ T10] hid (null): invalid report_count -274726912 [ 448.187789][ T5916] usb 6-1: new high-speed USB device number 11 using dummy_hcd [ 448.199399][T10747] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 448.210368][T10747] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 448.217615][ T5831] m920x_read = error: -19 [ 448.223304][ T5831] dvb-usb: error while querying for an remote control event. [ 448.230825][ T5827] usb 1-1: new high-speed USB device number 59 using dummy_hcd [ 448.240952][ T5916] usb 6-1: device descriptor read/8, error -71 [ 448.252966][ T5914] usb 4-1: USB disconnect, device number 44 [ 448.284088][ T10] hid (null): invalid report_size 7169389 [ 448.290297][ T10] hid (null): invalid report_count 37632 [ 448.296118][ T10] hid (null): invalid report_count -2113371648 [ 448.310604][ T10] magicmouse 0003:05AC:0269.003F: global environment stack underflow [ 448.320171][ T10] magicmouse 0003:05AC:0269.003F: item 0 0 1 11 parsing failed [ 448.329759][ T10] magicmouse 0003:05AC:0269.003F: magicmouse hid parse failed [ 448.339662][ T10] magicmouse 0003:05AC:0269.003F: probe with driver magicmouse failed with error -22 [ 448.359596][ T5831] m920x_read = error: -19 [ 448.363971][ T5831] dvb-usb: error while querying for an remote control event. [ 448.487489][ T5827] usb 1-1: Using ep0 maxpacket: 16 [ 448.499054][ T5827] usb 1-1: config index 0 descriptor too short (expected 51443, got 18) [ 448.507604][ T5916] usb 6-1: new high-speed USB device number 12 using dummy_hcd [ 448.518147][ T5827] usb 1-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 448.548273][ T5827] usb 1-1: New USB device strings: Mfr=14, Product=2, SerialNumber=3 [ 448.557358][ T5916] usb 6-1: device descriptor read/8, error -71 [ 448.593706][ T5827] usb 1-1: Product: syz [ 448.598270][ T5831] m920x_read = error: -19 [ 448.605973][ T5831] dvb-usb: error while querying for an remote control event. [ 448.615396][ T5827] usb 1-1: Manufacturer: syz [ 448.624068][ T5827] usb 1-1: SerialNumber: syz [ 448.645120][ T5827] r8152-cfgselector 1-1: Unknown version 0x0000 [ 448.652159][ T5827] r8152-cfgselector 1-1: config 0 descriptor?? [ 448.697800][ T5916] usb usb6-port1: unable to enumerate USB device [ 448.739749][ T5916] m920x_read = error: -19 [ 448.745035][ T5916] dvb-usb: error while querying for an remote control event. [ 448.840986][ T5914] usb 2-1: USB disconnect, device number 51 [ 448.867742][ T5916] m920x_read = error: -19 [ 448.872229][ T5916] dvb-usb: error while querying for an remote control event. [ 448.907892][T10743] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1134'. [ 449.007672][ T5916] m920x_read = error: -19 [ 449.016527][ T5916] dvb-usb: error while querying for an remote control event. [ 449.157374][ T5831] m920x_read = error: -19 [ 449.165019][ T5831] dvb-usb: error while querying for an remote control event. [ 449.228176][ T5827] r8152-cfgselector 1-1: Needed 2 retries to read version [ 449.236337][ T5827] r8152-cfgselector 1-1: Unknown version 0x0000 [ 449.245553][ T5827] r8152-cfgselector 1-1: bad CDC descriptors [ 449.277801][ T5827] m920x_read = error: -19 [ 449.282250][ T5827] dvb-usb: error while querying for an remote control event. [ 449.358939][ T5831] usb 4-1: new high-speed USB device number 45 using dummy_hcd [ 449.408986][ T5827] m920x_read = error: -19 [ 449.417482][ T5827] dvb-usb: error while querying for an remote control event. [ 449.483395][ T5827] r8152-cfgselector 1-1: USB disconnect, device number 59 [ 449.537559][ T5916] m920x_read = error: -19 [ 449.542011][ T5916] dvb-usb: error while querying for an remote control event. [ 449.549725][ T5831] usb 4-1: Using ep0 maxpacket: 8 [ 449.560369][ T5831] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 449.572611][ T5831] usb 4-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 449.609836][ T5831] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 449.631744][ T5831] usb 4-1: config 0 descriptor?? [ 449.677578][ T5916] m920x_read = error: -19 [ 449.682275][ T5916] dvb-usb: error while querying for an remote control event. [ 449.738891][ T5914] usb 2-1: new high-speed USB device number 52 using dummy_hcd [ 449.818271][ T5827] m920x_read = error: -19 [ 449.822706][ T5827] dvb-usb: error while querying for an remote control event. [ 449.946052][T10764] netlink: 56 bytes leftover after parsing attributes in process `syz.5.1138'. [ 449.955291][T10764] netlink: 56 bytes leftover after parsing attributes in process `syz.5.1138'. [ 449.965006][ T5827] m920x_read = error: -19 [ 449.969759][ T5827] dvb-usb: error while querying for an remote control event. [ 449.996546][ T5914] usb 2-1: unable to get BOS descriptor or descriptor too short [ 450.009679][ T5914] usb 2-1: config 1 interface 0 has no altsetting 0 [ 450.021239][ T5831] iowarrior 4-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 450.027207][ T5914] usb 2-1: string descriptor 0 read error: -22 [ 450.047629][ T5914] usb 2-1: New USB device found, idVendor=1e7d, idProduct=2ced, bcdDevice= 0.40 [ 450.114449][ T5831] m920x_read = error: -19 [ 450.119506][ T5831] dvb-usb: error while querying for an remote control event. [ 450.127512][ T5914] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 450.227928][ T5827] m920x_read = error: -19 [ 450.237576][ T5827] dvb-usb: error while querying for an remote control event. [ 450.360108][ T5827] m920x_read = error: -19 [ 450.364563][ T5827] dvb-usb: error while querying for an remote control event. [ 450.486849][ T30] kauditd_printk_skb: 78 callbacks suppressed [ 450.486866][ T30] audit: type=1326 audit(1773599371.016:2118): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10769 comm="syz.0.1140" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fb7f6c code=0x7ffc0000 [ 450.520244][ T5827] m920x_read = error: -19 [ 450.524707][ T5827] dvb-usb: error while querying for an remote control event. [ 450.532965][ T30] audit: type=1326 audit(1773599371.016:2119): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10769 comm="syz.0.1140" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fb7f6c code=0x7ffc0000 [ 450.568703][T10770] x_tables: duplicate underflow at hook 1 [ 450.651742][ T5831] m920x_read = error: -19 [ 450.658412][ T5831] dvb-usb: error while querying for an remote control event. [ 450.668603][ T30] audit: type=1326 audit(1773599371.096:2120): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10769 comm="syz.0.1140" exe="/root/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf7fb7f6c code=0x7ffc0000 [ 450.712378][ T30] audit: type=1326 audit(1773599371.096:2121): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10769 comm="syz.0.1140" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fb7f6c code=0x7ffc0000 [ 450.769546][ T5914] usbhid 2-1:1.0: can't add hid device: -32 [ 450.777552][ T5827] m920x_read = error: -19 [ 450.792261][ T5827] dvb-usb: error while querying for an remote control event. [ 450.802523][ T5914] usbhid 2-1:1.0: probe with driver usbhid failed with error -32 [ 450.832764][ T5914] usb 2-1: USB disconnect, device number 52 [ 450.947710][ T5827] m920x_read = error: -19 [ 450.952172][ T5827] dvb-usb: error while querying for an remote control event. [ 451.033367][ T30] audit: type=1326 audit(1773599371.096:2122): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10769 comm="syz.0.1140" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fb7f6c code=0x7ffc0000 [ 451.068356][ T5827] m920x_read = error: -19 [ 451.079941][ T5827] dvb-usb: error while querying for an remote control event. [ 451.158041][ T10] usb 1-1: new high-speed USB device number 60 using dummy_hcd [ 451.197599][ T5831] m920x_read = error: -19 [ 451.201966][ T5831] dvb-usb: error while querying for an remote control event. [ 451.317574][ T10] usb 1-1: device descriptor read/64, error -71 [ 451.317786][ T5831] m920x_read = error: -19 [ 451.328585][ T5831] dvb-usb: error while querying for an remote control event. [ 451.352958][T10780] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(3) [ 451.359507][T10780] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 451.368162][T10780] vhci_hcd vhci_hcd.0: Device attached [ 451.378701][T10780] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 451.390114][T10780] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 451.457677][ T5831] m920x_read = error: -19 [ 451.462051][ T5831] dvb-usb: error while querying for an remote control event. [ 451.567523][ T10] usb 1-1: new high-speed USB device number 61 using dummy_hcd [ 451.590915][ T5831] m920x_read = error: -19 [ 451.608104][ T5914] usb 37-1: new low-speed USB device number 2 using vhci_hcd [ 451.616174][ T5831] dvb-usb: error while querying for an remote control event. [ 451.719019][T10783] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 451.727500][ T10] usb 1-1: device descriptor read/64, error -71 [ 451.732965][ T5831] m920x_read = error: -19 [ 451.738254][ T5831] dvb-usb: error while querying for an remote control event. [ 451.747853][T10783] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 451.759416][T10781] vhci_hcd: cannot find a urb of seqnum 536872705 max seqnum 1 [ 451.769360][ T149] vhci_hcd vhci_hcd.2: stop threads [ 451.774918][ T149] vhci_hcd vhci_hcd.2: release socket [ 451.781010][ T149] vhci_hcd vhci_hcd.2: disconnect device [ 451.847968][ T10] usb usb1-port1: attempt power cycle [ 451.868121][ T5831] m920x_read = error: -19 [ 451.872498][ T5831] dvb-usb: error while querying for an remote control event. [ 451.987589][ T5831] m920x_read = error: -19 [ 451.992326][ T5831] dvb-usb: error while querying for an remote control event. [ 452.107595][ T5831] m920x_read = error: -19 [ 452.112001][ T5831] dvb-usb: error while querying for an remote control event. [ 452.187797][ T10] usb 1-1: new high-speed USB device number 62 using dummy_hcd [ 452.208615][ T10] usb 1-1: device descriptor read/8, error -71 [ 452.228527][ T5827] m920x_read = error: -19 [ 452.232974][ T5827] dvb-usb: error while querying for an remote control event. [ 452.347589][ T5827] m920x_read = error: -19 [ 452.352842][ T5827] dvb-usb: error while querying for an remote control event. [ 452.421641][ T5827] usb 4-1: USB disconnect, device number 45 [ 452.427505][ T5900] usb 6-1: new high-speed USB device number 13 using dummy_hcd [ 452.459657][ T10] usb 1-1: new high-speed USB device number 63 using dummy_hcd [ 452.467837][ T29] m920x_read = error: -19 [ 452.485522][ T29] dvb-usb: error while querying for an remote control event. [ 452.501577][ T10] usb 1-1: device descriptor read/8, error -71 [ 452.617580][T10793] IPVS: sync thread started: state = BACKUP, mcast_ifn = bond0, syncid = 8, id = 0 [ 452.626957][ T29] m920x_read = error: -19 [ 452.631370][ T29] dvb-usb: error while querying for an remote control event. [ 452.660485][ T10] usb usb1-port1: unable to enumerate USB device [ 452.697803][ T5900] usb 6-1: Using ep0 maxpacket: 32 [ 452.707078][ T5900] usb 6-1: config 0 interface 0 altsetting 9 endpoint 0x81 has invalid maxpacket 9865, setting to 1024 [ 452.719118][ T5900] usb 6-1: config 0 interface 0 altsetting 9 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 452.737602][ T5900] usb 6-1: config 0 interface 0 has no altsetting 0 [ 452.744483][ T5900] usb 6-1: New USB device found, idVendor=05ac, idProduct=0269, bcdDevice= 0.00 [ 452.748123][ T5827] m920x_read = error: -19 [ 452.754153][ T5900] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 452.781287][ T5827] dvb-usb: error while querying for an remote control event. [ 452.793132][ T5900] usb 6-1: config 0 descriptor?? [ 452.812361][T10787] raw-gadget.5 gadget.5: fail, usb_ep_enable returned -22 [ 452.857556][T10788] usb 2-1: new high-speed USB device number 53 using dummy_hcd [ 452.917863][ T5827] m920x_read = error: -19 [ 452.926604][ T5827] dvb-usb: error while querying for an remote control event. [ 453.024514][T10788] usb 2-1: New USB device found, idVendor=2c42, idProduct=1602, bcdDevice=da.64 [ 453.037767][T10788] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 453.047308][T10788] usb 2-1: Product: syz [ 453.052765][T10788] usb 2-1: Manufacturer: syz [ 453.070551][ T5827] m920x_read = error: -19 [ 453.077923][ T5827] dvb-usb: error while querying for an remote control event. [ 453.088624][T10788] usb 2-1: SerialNumber: syz [ 453.105001][T10788] usb 2-1: config 0 descriptor?? [ 453.131684][T10788] hub 2-1:0.0: bad descriptor, ignoring hub [ 453.146041][T10788] hub 2-1:0.0: probe with driver hub failed with error -5 [ 453.157283][T10788] f81232 2-1:0.0: f81534a converter detected [ 453.187625][ T5827] m920x_read = error: -19 [ 453.192009][ T5827] dvb-usb: error while querying for an remote control event. [ 453.273684][T10787] create_pit_timer: 40 callbacks suppressed [ 453.273702][T10787] kvm: requested 79619 ns i8254 timer period limited to 200000 ns [ 453.292279][T10787] kvm: requested 72914 ns i8254 timer period limited to 200000 ns [ 453.300555][T10787] kvm: requested 81295 ns i8254 timer period limited to 200000 ns [ 453.308539][ T5827] m920x_read = error: -19 [ 453.312893][ T5827] dvb-usb: error while querying for an remote control event. [ 453.320612][T10787] kvm: requested 180190 ns i8254 timer period limited to 200000 ns [ 453.330705][T10787] kvm: requested 81295 ns i8254 timer period limited to 200000 ns [ 453.337168][ T5900] hid (null): global environment stack underflow [ 453.348109][ T5900] hid (null): invalid report_count -274726912 [ 453.349462][T10787] kvm: requested 120685 ns i8254 timer period limited to 200000 ns [ 453.357204][ T5900] hid (null): invalid report_size 7169389 [ 453.374329][T10788] usb 2-1: f81534a converter now attached to ttyUSB0 [ 453.386646][T10787] kvm: requested 60342 ns i8254 timer period limited to 200000 ns [ 453.387624][ T5900] hid_parser_main: 32 callbacks suppressed [ 453.387642][ T5900] magicmouse 0003:05AC:0269.0040: unknown main item tag 0x0 [ 453.414358][ T5900] magicmouse 0003:05AC:0269.0040: unknown main item tag 0x0 [ 453.422596][ T5900] magicmouse 0003:05AC:0269.0040: unknown main item tag 0x0 [ 453.424748][T10787] kvm: requested 117333 ns i8254 timer period limited to 200000 ns [ 453.429981][ T5900] magicmouse 0003:05AC:0269.0040: unknown main item tag 0x0 [ 453.430011][ T5900] magicmouse 0003:05AC:0269.0040: unknown main item tag 0x0 [ 453.430034][ T5900] magicmouse 0003:05AC:0269.0040: unknown main item tag 0x0 [ 453.430139][ T5900] magicmouse 0003:05AC:0269.0040: unknown main item tag 0x0 [ 453.438353][ T5827] m920x_read = error: -19 [ 453.446394][ T5900] magicmouse 0003:05AC:0269.0040: unknown main item tag 0x0 [ 453.476074][ T5827] dvb-usb: error while querying for an remote control event. [ 453.485898][ T5900] magicmouse 0003:05AC:0269.0040: unknown main item tag 0x0 [ 453.494483][ T5900] magicmouse 0003:05AC:0269.0040: unknown main item tag 0x5 [ 453.515521][T10787] kvm: requested 13409 ns i8254 timer period limited to 200000 ns [ 453.523517][ T5900] magicmouse 0003:05AC:0269.0040: global environment stack underflow [ 453.532660][T10787] kvm: requested 838 ns i8254 timer period limited to 200000 ns [ 453.540135][ T5900] magicmouse 0003:05AC:0269.0040: item 0 0 1 11 parsing failed [ 453.549758][ T5900] magicmouse 0003:05AC:0269.0040: magicmouse hid parse failed [ 453.559769][ T5900] magicmouse 0003:05AC:0269.0040: probe with driver magicmouse failed with error -22 [ 453.628133][ T5827] m920x_read = error: -19 [ 453.632657][ T5827] dvb-usb: error while querying for an remote control event. [ 453.747653][ T5827] m920x_read = error: -19 [ 453.757135][ T5827] dvb-usb: error while querying for an remote control event. [ 453.812765][ T5827] usb 6-1: USB disconnect, device number 13 [ 453.869285][ T5831] m920x_read = error: -19 [ 453.873756][ T5831] dvb-usb: error while querying for an remote control event. [ 453.987581][ T5831] m920x_read = error: -19 [ 453.991980][ T5831] dvb-usb: error while querying for an remote control event. [ 454.115471][T10814] x_tables: duplicate underflow at hook 1 [ 454.122603][ T30] audit: type=1326 audit(1773599374.546:2123): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10808 comm="syz.3.1151" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fc5f6c code=0x7ffc0000 [ 454.193608][ T30] audit: type=1326 audit(1773599374.546:2124): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10808 comm="syz.3.1151" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fc5f6c code=0x7ffc0000 [ 454.237789][ T30] audit: type=1326 audit(1773599374.546:2125): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10808 comm="syz.3.1151" exe="/root/syz-executor" sig=0 arch=40000003 syscall=437 compat=1 ip=0xf7fc5f6c code=0x7ffc0000 [ 454.267553][ T30] audit: type=1326 audit(1773599374.546:2126): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10808 comm="syz.3.1151" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fc5f6c code=0x7ffc0000 [ 454.294894][ T30] audit: type=1326 audit(1773599374.546:2127): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10808 comm="syz.3.1151" exe="/root/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf7fc5f6c code=0x7ffc0000 [ 454.298314][ T5831] m920x_read = error: -19 [ 454.423766][ T5831] dvb-usb: error while querying for an remote control event. [ 454.816989][ T5831] m920x_read = error: -19 [ 454.836021][ T5831] dvb-usb: error while querying for an remote control event. [ 454.861319][T10821] netlink: 56 bytes leftover after parsing attributes in process `syz.0.1153'. [ 454.873774][T10821] netlink: 56 bytes leftover after parsing attributes in process `syz.0.1153'. [ 454.947688][ T5831] m920x_read = error: -19 [ 454.952073][ T5831] dvb-usb: error while querying for an remote control event. [ 455.077791][ T5831] m920x_read = error: -19 [ 455.082268][ T5831] dvb-usb: error while querying for an remote control event. [ 455.207566][ T5831] m920x_read = error: -19 [ 455.212166][ T5831] dvb-usb: error while querying for an remote control event. [ 455.360094][ T5831] m920x_read = error: -19 [ 455.366562][ T5831] dvb-usb: error while querying for an remote control event. [ 455.458863][T10830] netlink: 'syz.1.1158': attribute type 1 has an invalid length. [ 455.467245][T10830] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1158'. [ 455.483387][ T5831] m920x_read = error: -19 [ 455.487894][ T5831] dvb-usb: error while querying for an remote control event. [ 455.488095][ T5900] usb 2-1: USB disconnect, device number 53 [ 455.522394][ T5900] f81534a ttyUSB0: f81534a converter now disconnected from ttyUSB0 [ 455.546403][ T5900] f81232 2-1:0.0: device disconnected [ 455.546631][T10834] xt_ecn: cannot match TCP bits for non-tcp packets [ 455.586594][T10834] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1159'. [ 455.597607][ T5831] m920x_read = error: -19 [ 455.601975][ T5831] dvb-usb: error while querying for an remote control event. [ 455.674152][T10839] netlink: 156 bytes leftover after parsing attributes in process `syz.0.1159'. [ 455.809802][ T5831] m920x_read = error: -19 [ 455.815857][ T5831] dvb-usb: error while querying for an remote control event. [ 455.867547][ T5900] usb 4-1: new high-speed USB device number 46 using dummy_hcd [ 455.947852][ T29] usb 6-1: new full-speed USB device number 14 using dummy_hcd [ 455.977958][ T5827] m920x_read = error: -19 [ 455.988137][T10847] vivid-001: disconnect [ 455.997103][ T5827] dvb-usb: error while querying for an remote control event. [ 456.018462][ T5900] usb 4-1: device descriptor read/64, error -71 [ 456.139231][ T29] usb 6-1: New USB device found, idVendor=174f, idProduct=6a31, bcdDevice=26.3f [ 456.149758][ T29] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 456.158941][ T5831] m920x_read = error: -19 [ 456.164919][ T5831] dvb-usb: error while querying for an remote control event. [ 456.203921][ T29] usb 6-1: Product: syz [ 456.204987][T10847] : entered promiscuous mode [ 456.214545][ T29] usb 6-1: Manufacturer: syz [ 456.243292][ T29] usb 6-1: SerialNumber: syz [ 456.264573][ T29] usb 6-1: config 0 descriptor?? [ 456.283030][ T5900] usb 4-1: new high-speed USB device number 47 using dummy_hcd [ 456.287032][ T29] gspca_main: stk1135-2.14.0 probing 174f:6a31 [ 456.327004][ T5827] m920x_read = error: -19 [ 456.352633][ T5827] dvb-usb: error while querying for an remote control event. [ 456.647885][ T5900] usb 4-1: device descriptor read/64, error -71 [ 456.697561][ T5914] vhci_hcd vhci_hcd.2: vhci_device speed not set [ 456.745093][ T5916] m920x_read = error: -19 [ 456.750616][ T5916] dvb-usb: error while querying for an remote control event. [ 456.767828][ T5900] usb usb4-port1: attempt power cycle [ 456.776465][T10850] netlink: 56 bytes leftover after parsing attributes in process `syz.1.1164'. [ 456.809573][T10846] vivid-001: reconnect [ 456.873994][ T5916] m920x_read = error: -19 [ 456.880382][ T5916] dvb-usb: error while querying for an remote control event. [ 456.895687][T10856] vti0: entered promiscuous mode [ 456.914560][T10856] vti0: entered allmulticast mode [ 456.955086][T10856] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 456.987809][T10856] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 456.997593][ T5916] m920x_read = error: -19 [ 457.004916][ T5916] dvb-usb: error while querying for an remote control event. [ 457.107637][ T5900] usb 4-1: new high-speed USB device number 48 using dummy_hcd [ 457.117647][ T5827] m920x_read = error: -19 [ 457.122026][ T5827] dvb-usb: error while querying for an remote control event. [ 457.133134][ T5900] usb 4-1: device descriptor read/8, error -71 [ 457.217605][T10788] usb 2-1: new high-speed USB device number 54 using dummy_hcd [ 457.247538][ T5916] usb 1-1: new high-speed USB device number 64 using dummy_hcd [ 457.256246][ T5827] m920x_read = error: -19 [ 457.261040][ T5827] dvb-usb: error while querying for an remote control event. [ 457.367536][T10788] usb 2-1: Using ep0 maxpacket: 16 [ 457.375147][T10788] usb 2-1: unable to get BOS descriptor or descriptor too short [ 457.383783][ T5900] usb 4-1: new high-speed USB device number 49 using dummy_hcd [ 457.387723][ T5827] m920x_read = error: -19 [ 457.396278][ T5827] dvb-usb: error while querying for an remote control event. [ 457.396758][T10788] usb 2-1: config 13 has an invalid interface number: 50 but max is 0 [ 457.413074][T10788] usb 2-1: config 13 has no interface number 0 [ 457.413205][ T5900] usb 4-1: device descriptor read/8, error -71 [ 457.426120][T10788] usb 2-1: config 13 interface 50 altsetting 167 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 457.440644][T10788] usb 2-1: config 13 interface 50 has no altsetting 0 [ 457.447732][ T5916] usb 1-1: Using ep0 maxpacket: 32 [ 457.449614][T10788] usb 2-1: New USB device found, idVendor=1aca, idProduct=b28e, bcdDevice=92.32 [ 457.455131][ T5916] usb 1-1: config 0 interface 0 altsetting 9 endpoint 0x81 has invalid maxpacket 9865, setting to 1024 [ 457.462382][T10788] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 457.483403][T10788] usb 2-1: Product: syz [ 457.484048][ T5916] usb 1-1: config 0 interface 0 altsetting 9 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 457.487695][T10788] usb 2-1: Manufacturer: syz [ 457.505547][T10788] usb 2-1: SerialNumber: syz [ 457.505549][ T5916] usb 1-1: config 0 interface 0 has no altsetting 0 [ 457.505585][ T5916] usb 1-1: New USB device found, idVendor=05ac, idProduct=0269, bcdDevice= 0.00 [ 457.530482][ T5827] m920x_read = error: -19 [ 457.534864][ T5827] dvb-usb: error while querying for an remote control event. [ 457.542631][ T5916] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 457.548030][ T5900] usb usb4-port1: unable to enumerate USB device [ 457.558560][ T5916] usb 1-1: config 0 descriptor?? [ 457.571995][T10860] raw-gadget.5 gadget.0: fail, usb_ep_enable returned -22 [ 457.647580][ T5827] m920x_read = error: -19 [ 457.652064][ T5827] dvb-usb: error while querying for an remote control event. [ 457.767588][ T5827] m920x_read = error: -19 [ 457.772136][ T5827] dvb-usb: error while querying for an remote control event. [ 457.889748][ T5827] m920x_read = error: -19 [ 457.894246][ T5827] dvb-usb: error while querying for an remote control event. [ 457.999268][T10823] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1155'. [ 458.011763][ T5827] m920x_read = error: -19 [ 458.016264][ T5827] dvb-usb: error while querying for an remote control event. [ 458.056314][ T29] gspca_stk1135: reg_w 0x200 err -71 [ 458.064070][ T29] gspca_stk1135: serial bus timeout: status=0x00 [ 458.077504][ T29] gspca_stk1135: Sensor write failed [ 458.084625][ T29] gspca_stk1135: serial bus timeout: status=0x00 [ 458.094323][ T5916] hid (null): global environment stack underflow [ 458.100947][ T29] gspca_stk1135: Sensor write failed [ 458.106784][ T5916] hid (null): invalid report_count -274726912 [ 458.113961][ T29] gspca_stk1135: serial bus timeout: status=0x00 [ 458.121824][ T5916] hid (null): report_id 5888 is invalid [ 458.127589][ T29] gspca_stk1135: Sensor read failed [ 458.133108][ T5916] hid (null): invalid report_count 33536 [ 458.138830][ T29] gspca_stk1135: serial bus timeout: status=0x00 [ 458.145403][ T5916] hid (null): report_id 37376 is invalid [ 458.151545][ T5827] m920x_read = error: -19 [ 458.156111][ T5827] dvb-usb: error while querying for an remote control event. [ 458.163569][ T29] gspca_stk1135: Sensor read failed [ 458.168974][ T5916] hid (null): report_id 33280 is invalid [ 458.174629][ T29] gspca_stk1135: Detected sensor type unknown (0x0) [ 458.181452][ T5916] hid (null): report_id 1792 is invalid [ 458.187108][ T29] gspca_stk1135: serial bus timeout: status=0x00 [ 458.193653][ T5916] hid (null): invalid report_count 37632 [ 458.200616][ T29] gspca_stk1135: Sensor read failed [ 458.205915][ T5916] hid (null): invalid report_count -2113371648 [ 458.212155][ T29] gspca_stk1135: serial bus timeout: status=0x00 [ 458.220466][ T29] gspca_stk1135: Sensor read failed [ 458.227399][ T5916] magicmouse 0003:05AC:0269.0041: global environment stack underflow [ 458.239037][ T29] gspca_stk1135: serial bus timeout: status=0x00 [ 458.245732][ T5916] magicmouse 0003:05AC:0269.0041: item 0 0 1 11 parsing failed [ 458.253396][ T29] gspca_stk1135: Sensor write failed [ 458.259499][ T5916] magicmouse 0003:05AC:0269.0041: magicmouse hid parse failed [ 458.267030][ T29] gspca_stk1135: serial bus timeout: status=0x00 [ 458.273781][ T29] gspca_stk1135: Sensor write failed [ 458.279235][ T5827] m920x_read = error: -19 [ 458.283701][ T5916] magicmouse 0003:05AC:0269.0041: probe with driver magicmouse failed with error -22 [ 458.298139][ T5827] dvb-usb: error while querying for an remote control event. [ 458.308087][ T29] stk1135 6-1:0.0: probe with driver stk1135 failed with error -71 [ 458.351038][ T29] usb 6-1: USB disconnect, device number 14 [ 458.427847][ T5916] m920x_read = error: -19 [ 458.432516][ T5916] dvb-usb: error while querying for an remote control event. [ 458.440430][ T5900] usb 1-1: USB disconnect, device number 64 [ 458.557918][ T5916] m920x_read = error: -19 [ 458.562384][ T5916] dvb-usb: error while querying for an remote control event. [ 458.677610][ T5916] m920x_read = error: -19 [ 458.684485][ T5916] dvb-usb: error while querying for an remote control event. [ 458.921175][ T5916] m920x_read = error: -19 [ 458.925550][ T5916] dvb-usb: error while querying for an remote control event. [ 458.933996][T10874] x_tables: duplicate underflow at hook 1 [ 458.967530][ T30] kauditd_printk_skb: 36 callbacks suppressed [ 458.967545][ T30] audit: type=1326 audit(1773599379.406:2164): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10870 comm="syz.5.1168" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f97f6c code=0x7ffc0000 [ 459.057583][ T29] m920x_read = error: -19 [ 459.061943][ T29] dvb-usb: error while querying for an remote control event. [ 459.093159][T10788] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 459.101240][T10788] usb 2-1: MIDIStreaming interface descriptor not found [ 459.114067][T10876] IPVS: sync thread started: state = BACKUP, mcast_ifn = bond0, syncid = 8, id = 0 [ 459.124094][ T30] audit: type=1326 audit(1773599379.406:2165): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10870 comm="syz.5.1168" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f97f6c code=0x7ffc0000 [ 459.201316][ T30] audit: type=1326 audit(1773599379.436:2166): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10870 comm="syz.5.1168" exe="/root/syz-executor" sig=0 arch=40000003 syscall=437 compat=1 ip=0xf7f97f6c code=0x7ffc0000 [ 459.247730][ T29] m920x_read = error: -19 [ 459.253103][ T29] dvb-usb: error while querying for an remote control event. [ 459.320981][T10788] usb 2-1: USB disconnect, device number 54 [ 459.352656][ T30] audit: type=1326 audit(1773599379.436:2167): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10870 comm="syz.5.1168" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f97f6c code=0x7ffc0000 [ 459.394457][ T29] m920x_read = error: -19 [ 459.400703][ T29] dvb-usb: error while querying for an remote control event. [ 459.486613][ T30] audit: type=1326 audit(1773599379.436:2168): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10870 comm="syz.5.1168" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f97f6c code=0x7ffc0000 [ 459.537800][ T5916] usb 4-1: new high-speed USB device number 50 using dummy_hcd [ 459.559527][ T30] audit: type=1326 audit(1773599379.436:2169): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10870 comm="syz.5.1168" exe="/root/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf7f97f6c code=0x7ffc0000 [ 459.733490][ T29] m920x_read = error: -19 [ 459.766266][ T29] dvb-usb: error while querying for an remote control event. [ 459.823051][T10888] netlink: 56 bytes leftover after parsing attributes in process `syz.1.1170'. [ 459.832321][T10888] netlink: 56 bytes leftover after parsing attributes in process `syz.1.1170'. [ 459.897628][ T29] m920x_read = error: -19 [ 459.902009][ T29] dvb-usb: error while querying for an remote control event. [ 459.904604][ T30] audit: type=1326 audit(1773599379.436:2170): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10870 comm="syz.5.1168" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f97f6c code=0x7ffc0000 [ 459.987952][ T30] audit: type=1326 audit(1773599379.436:2171): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10870 comm="syz.5.1168" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f97f6c code=0x7ffc0000 [ 460.072695][ T5916] usb 4-1: New USB device found, idVendor=2c42, idProduct=1602, bcdDevice=da.64 [ 460.092786][ T5916] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 460.158572][ T5916] usb 4-1: Product: syz [ 460.188853][ T5831] m920x_read = error: -19 [ 460.196636][ T5831] dvb-usb: error while querying for an remote control event. [ 460.209662][ T5916] usb 4-1: Manufacturer: syz [ 460.226202][ T5916] usb 4-1: SerialNumber: syz [ 460.380697][ T5831] m920x_read = error: -19 [ 460.385105][ T5831] dvb-usb: error while querying for an remote control event. [ 460.500877][ T5916] usb 4-1: config 0 descriptor?? [ 460.535948][ T30] audit: type=1326 audit(1773599379.446:2172): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10870 comm="syz.5.1168" exe="/root/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf7f97f6c code=0x7ffc0000 [ 460.608690][ T29] m920x_read = error: -19 [ 460.613120][ T29] dvb-usb: error while querying for an remote control event. [ 460.637253][ T5916] hub 4-1:0.0: bad descriptor, ignoring hub [ 460.702319][ T5916] hub 4-1:0.0: probe with driver hub failed with error -5 [ 460.731512][ T5916] f81232 4-1:0.0: f81534a converter detected [ 460.765695][ T30] audit: type=1326 audit(1773599379.446:2173): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10870 comm="syz.5.1168" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f97f6c code=0x7ffc0000 [ 460.828347][ T5831] m920x_read = error: -19 [ 460.832748][ T5831] dvb-usb: error while querying for an remote control event. [ 460.858961][ T5916] usb 4-1: f81534a converter now attached to ttyUSB0 [ 460.949016][ T5916] m920x_read = error: -19 [ 460.957538][ T5916] dvb-usb: error while querying for an remote control event. [ 461.147720][ T5916] m920x_read = error: -19 [ 461.172949][ T5916] dvb-usb: error while querying for an remote control event. [ 461.426645][ T5916] m920x_read = error: -19 [ 461.439957][ T5916] dvb-usb: error while querying for an remote control event. [ 461.547508][T10788] usb 6-1: new high-speed USB device number 15 using dummy_hcd [ 461.588422][ T5831] m920x_read = error: -19 [ 461.599626][ T5831] dvb-usb: error while querying for an remote control event. [ 461.731094][ T5831] m920x_read = error: -19 [ 461.740007][ T5831] dvb-usb: error while querying for an remote control event. [ 461.762392][ T10] usb 1-1: new high-speed USB device number 65 using dummy_hcd [ 461.780328][T10788] usb 6-1: Using ep0 maxpacket: 8 [ 461.867573][ T5916] m920x_read = error: -19 [ 461.872182][ T5916] dvb-usb: error while querying for an remote control event. [ 461.895332][T10788] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 461.944351][T10788] usb 6-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 461.956533][ T10] usb 1-1: Using ep0 maxpacket: 32 [ 461.970987][T10788] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 461.980713][ T10] usb 1-1: config 0 has an invalid interface number: 89 but max is 0 [ 461.989983][ T10] usb 1-1: config 0 has no interface number 0 [ 461.997854][ T5916] m920x_read = error: -19 [ 462.002271][ T5916] dvb-usb: error while querying for an remote control event. [ 462.109537][T10788] usb 6-1: config 0 descriptor?? [ 462.117567][ T10] usb 1-1: config 0 interface 89 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 462.130608][ T10] usb 1-1: config 0 interface 89 has no altsetting 0 [ 462.139433][ T10] usb 1-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4a [ 462.149314][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 462.157371][ T10] usb 1-1: Product: syz [ 462.162237][ T5916] m920x_read = error: -19 [ 462.169479][ T5916] dvb-usb: error while querying for an remote control event. [ 462.176958][ T10] usb 1-1: Manufacturer: syz [ 462.182037][ T10] usb 1-1: SerialNumber: syz [ 462.209273][ T10] usb 1-1: config 0 descriptor?? [ 462.246435][ T10] em28xx 1-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 462.285358][ T10] em28xx 1-1:0.89: Video interface 89 found: [ 462.392945][ T5916] m920x_read = error: -19 [ 462.426725][ T5916] dvb-usb: error while querying for an remote control event. [ 462.540749][ T5916] m920x_read = error: -19 [ 462.545147][ T5916] dvb-usb: error while querying for an remote control event. [ 462.676851][T10788] iowarrior 6-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 462.696346][ T5916] m920x_read = error: -19 [ 462.701782][ T5916] dvb-usb: error while querying for an remote control event. [ 462.828316][ T5916] m920x_read = error: -19 [ 462.832703][ T5916] dvb-usb: error while querying for an remote control event. [ 462.881734][ T10] em28xx 1-1:0.89: unknown em28xx chip ID (0) [ 462.908063][ T5900] usb 4-1: USB disconnect, device number 50 [ 462.940448][ T5900] f81534a ttyUSB0: f81534a converter now disconnected from ttyUSB0 [ 462.988724][ T5900] f81232 4-1:0.0: device disconnected [ 463.008363][ T5916] m920x_read = error: -19 [ 463.012757][ T5916] dvb-usb: error while querying for an remote control event. [ 463.128147][ T5916] m920x_read = error: -19 [ 463.132792][ T5916] dvb-usb: error while querying for an remote control event. [ 463.257729][ T5916] m920x_read = error: -19 [ 463.262173][ T5916] dvb-usb: error while querying for an remote control event. [ 463.277652][ T5900] usb 4-1: new high-speed USB device number 51 using dummy_hcd [ 463.377585][ T5916] m920x_read = error: -19 [ 463.381976][ T5916] dvb-usb: error while querying for an remote control event. [ 463.429487][ T5900] usb 4-1: Using ep0 maxpacket: 32 [ 463.437618][ T5900] usb 4-1: config 0 interface 0 altsetting 9 endpoint 0x81 has invalid maxpacket 9865, setting to 1024 [ 463.449593][ T5900] usb 4-1: config 0 interface 0 altsetting 9 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 463.467156][ T5900] usb 4-1: config 0 interface 0 has no altsetting 0 [ 463.483647][ T5900] usb 4-1: New USB device found, idVendor=05ac, idProduct=0269, bcdDevice= 0.00 [ 463.499757][ T5916] m920x_read = error: -19 [ 463.500787][ T5900] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 463.512699][ T5916] dvb-usb: error while querying for an remote control event. [ 463.524900][ T5900] usb 4-1: config 0 descriptor?? [ 463.556565][T10926] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 463.648462][ T5916] m920x_read = error: -19 [ 463.652843][ T5916] dvb-usb: error while querying for an remote control event. [ 463.789135][ T5916] m920x_read = error: -19 [ 463.796106][ T5916] dvb-usb: error while querying for an remote control event. [ 463.908124][ T10] em28xx 1-1:0.89: AC97 command still being executed: not handled properly! [ 463.920601][ T29] m920x_read = error: -19 [ 463.925157][ T29] dvb-usb: error while querying for an remote control event. [ 464.013354][T10926] create_pit_timer: 38 callbacks suppressed [ 464.013371][T10926] kvm: requested 79619 ns i8254 timer period limited to 200000 ns [ 464.095435][T10926] kvm: requested 72914 ns i8254 timer period limited to 200000 ns [ 464.110575][ T29] m920x_read = error: -19 [ 464.118441][ T29] dvb-usb: error while querying for an remote control event. [ 464.138930][T10941] netlink: 56 bytes leftover after parsing attributes in process `syz.2.1184'. [ 464.148493][T10941] netlink: 56 bytes leftover after parsing attributes in process `syz.2.1184'. [ 464.186040][T10913] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 464.195798][ T5900] hid (null): global environment stack underflow [ 464.206121][T10926] kvm: requested 81295 ns i8254 timer period limited to 200000 ns [ 464.236124][ T5900] hid (null): invalid report_count -274726912 [ 464.295077][ T29] m920x_read = error: -19 [ 464.299633][ T29] dvb-usb: error while querying for an remote control event. [ 464.360615][T10913] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 464.369799][T10926] kvm: requested 3352 ns i8254 timer period limited to 200000 ns [ 464.380351][ T5900] hid (null): invalid report_size 7169389 [ 464.396661][T10926] kvm: requested 43580 ns i8254 timer period limited to 200000 ns [ 464.406997][ T5900] hid_parser_main: 32 callbacks suppressed [ 464.407013][ T5900] magicmouse 0003:05AC:0269.0042: unknown main item tag 0x0 [ 464.434214][ T29] m920x_read = error: -19 [ 464.447573][ T5900] magicmouse 0003:05AC:0269.0042: unknown main item tag 0x0 [ 464.457392][ T29] dvb-usb: error while querying for an remote control event. [ 464.468395][T10926] kvm: requested 3352 ns i8254 timer period limited to 200000 ns [ 464.502456][T10926] kvm: requested 56990 ns i8254 timer period limited to 200000 ns [ 464.520005][ T5900] magicmouse 0003:05AC:0269.0042: unknown main item tag 0x0 [ 464.528261][T10926] kvm: requested 94704 ns i8254 timer period limited to 200000 ns [ 464.550054][ T5900] magicmouse 0003:05AC:0269.0042: unknown main item tag 0x0 [ 464.571522][T10926] kvm: requested 60342 ns i8254 timer period limited to 200000 ns [ 464.619924][ T29] m920x_read = error: -19 [ 464.624765][ T29] dvb-usb: error while querying for an remote control event. [ 464.656903][ T5900] magicmouse 0003:05AC:0269.0042: unknown main item tag 0x0 [ 464.672764][T10926] kvm: requested 108114 ns i8254 timer period limited to 200000 ns [ 464.708316][ T5900] magicmouse 0003:05AC:0269.0042: unknown main item tag 0x0 [ 464.752725][ T5916] m920x_read = error: -19 [ 464.757383][ T5916] dvb-usb: error while querying for an remote control event. [ 464.833807][ T5900] magicmouse 0003:05AC:0269.0042: unknown main item tag 0x0 [ 464.850555][ T5900] magicmouse 0003:05AC:0269.0042: unknown main item tag 0x0 [ 464.867922][ T5900] magicmouse 0003:05AC:0269.0042: unknown main item tag 0x0 [ 464.915225][ T5900] magicmouse 0003:05AC:0269.0042: unknown main item tag 0x5 [ 464.954217][ T10] em28xx 1-1:0.89: reading from i2c device at 0xa0 failed (error=-5) [ 464.962827][ T5900] magicmouse 0003:05AC:0269.0042: global environment stack underflow [ 464.982807][ T10] em28xx 1-1:0.89: board has no eeprom [ 464.997511][ T5900] magicmouse 0003:05AC:0269.0042: item 0 0 1 11 parsing failed [ 465.017836][ T5916] m920x_read = error: -19 [ 465.022219][ T5916] dvb-usb: error while querying for an remote control event. [ 465.076003][ C1] vcan0: j1939_tp_rxtimer: 0xffff8880311e2000: rx timeout, send abort [ 465.077569][ T10] em28xx 1-1:0.89: Identified as Terratec Grabby (card=67) [ 465.086333][ C1] vcan0: j1939_xtp_rx_abort_one: 0xffff8880311e2000: 0x2ff00: (3) A timeout occurred and this is the connection abort to close the session. [ 465.093874][ T5900] magicmouse 0003:05AC:0269.0042: magicmouse hid parse failed [ 465.128931][ T10] em28xx 1-1:0.89: analog set to bulk mode. [ 465.135006][T10788] em28xx 1-1:0.89: Registering V4L2 extension [ 465.167579][ T5916] m920x_read = error: -19 [ 465.172037][ T5900] magicmouse 0003:05AC:0269.0042: probe with driver magicmouse failed with error -22 [ 465.185007][ T5916] dvb-usb: error while querying for an remote control event. [ 465.266702][T10788] em28xx 1-1:0.89: reading from i2c device at 0x4a failed (error=-5) [ 465.317811][ T5916] m920x_read = error: -19 [ 465.322404][ T5916] dvb-usb: error while querying for an remote control event. [ 465.323874][T10788] em28xx 1-1:0.89: reading from i2c device at 0x48 failed (error=-5) [ 465.391789][ T29] usb 6-1: USB disconnect, device number 15 [ 465.404062][T10788] em28xx 1-1:0.89: reading from i2c device at 0x42 failed (error=-5) [ 465.452465][T10951] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 465.461877][T10951] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 465.730484][T10788] em28xx 1-1:0.89: reading from i2c device at 0x40 failed (error=-5) [ 465.730934][ T5827] m920x_read = error: -19 [ 465.756568][ T5827] dvb-usb: error while querying for an remote control event. [ 465.765023][T10051] usb 1-1: USB disconnect, device number 65 [ 465.774635][ T5831] usb 4-1: USB disconnect, device number 51 [ 465.782504][T10051] em28xx 1-1:0.89: Disconnecting em28xx [ 465.794345][T10788] em28xx 1-1:0.89: Config register raw data: 0xffffffed [ 465.823955][T10788] em28xx 1-1:0.89: AC97 chip type couldn't be determined [ 465.846192][T10954] netlink: 64 bytes leftover after parsing attributes in process `syz.5.1186'. [ 465.855625][T10788] em28xx 1-1:0.89: No AC97 audio processor [ 465.883304][T10788] usb 1-1: Decoder not found [ 465.895372][T10788] em28xx 1-1:0.89: failed to create media graph [ 465.920920][ T797] m920x_read = error: -19 [ 465.925346][ T797] dvb-usb: error while querying for an remote control event. [ 465.974877][T10788] em28xx 1-1:0.89: V4L2 device video103 deregistered [ 466.021637][T10955] ================================================================== [ 466.029789][T10955] BUG: KASAN: slab-use-after-free in v4l2_fh_open+0xac/0x420 [ 466.036872][T10959] netlink: 'syz.5.1188': attribute type 1 has an invalid length. [ 466.037319][T10955] Read of size 8 at addr ffff88802b3b0748 by task v4l_id/10955 [ 466.047468][T10959] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1188'. [ 466.052548][T10955] [ 466.063705][T10955] CPU: 0 UID: 0 PID: 10955 Comm: v4l_id Not tainted syzkaller #0 PREEMPT(full) [ 466.063794][T10955] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 466.063805][T10955] Call Trace: [ 466.063812][T10955] [ 466.063820][T10955] dump_stack_lvl+0xe8/0x150 [ 466.063849][T10955] print_report+0xba/0x230 [ 466.063878][T10955] ? v4l2_fh_open+0xac/0x420 [ 466.063897][T10955] kasan_report+0x117/0x150 [ 466.063919][T10955] ? v4l2_fh_open+0xac/0x420 [ 466.063941][T10955] v4l2_fh_open+0xac/0x420 [ 466.063960][T10955] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 466.063982][T10955] em28xx_v4l2_open+0x157/0x9a0 [ 466.064051][T10955] ? do_raw_spin_lock+0x12b/0x2f0 [ 466.064093][T10955] v4l2_open+0x1bf/0x3a0 [ 466.064148][T10955] chrdev_open+0x4cd/0x5e0 [ 466.064181][T10955] ? __pfx_chrdev_open+0x10/0x10 [ 466.064201][T10955] ? fsnotify_open_perm_and_set_mode+0x135/0x6d0 [ 466.064220][T10955] ? __pfx_chrdev_open+0x10/0x10 [ 466.064251][T10955] do_dentry_open+0x785/0x14e0 [ 466.064276][T10955] vfs_open+0x3b/0x340 [ 466.064296][T10955] ? path_openat+0x2df0/0x3860 [ 466.064313][T10955] path_openat+0x2e08/0x3860 [ 466.064336][T10955] ? __pfx_stack_trace_save+0x10/0x10 [ 466.064354][T10955] ? stack_depot_save_flags+0x33/0x810 [ 466.064383][T10955] ? __pfx_path_openat+0x10/0x10 [ 466.064398][T10955] ? __x64_sys_openat+0x138/0x170 [ 466.064419][T10955] ? do_syscall_64+0x14d/0xf80 [ 466.064435][T10955] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 466.064456][T10955] ? __lock_acquire+0x6b5/0x2cf0 [ 466.064478][T10955] do_file_open+0x23e/0x4a0 [ 466.064497][T10955] ? __pfx_do_file_open+0x10/0x10 [ 466.064528][T10955] ? _raw_spin_unlock+0x28/0x50 [ 466.064550][T10955] ? alloc_fd+0x64b/0x6c0 [ 466.064575][T10955] do_sys_openat2+0x113/0x200 [ 466.064597][T10955] ? __pfx_do_sys_openat2+0x10/0x10 [ 466.064618][T10955] ? exc_page_fault+0x6a/0xc0 [ 466.064636][T10955] ? do_user_addr_fault+0xc6f/0x1340 [ 466.064663][T10955] __x64_sys_openat+0x138/0x170 [ 466.064686][T10955] do_syscall_64+0x14d/0xf80 [ 466.064702][T10955] ? trace_irq_disable+0x3b/0x150 [ 466.064725][T10955] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 466.064740][T10955] ? clear_bhb_loop+0x40/0x90 [ 466.064757][T10955] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 466.064773][T10955] RIP: 0033:0x7f5b276a7407 [ 466.064789][T10955] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 466.064804][T10955] RSP: 002b:00007ffc809c6830 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 466.064823][T10955] RAX: ffffffffffffffda RBX: 00007f5b27e41880 RCX: 00007f5b276a7407 [ 466.064835][T10955] RDX: 0000000000000000 RSI: 00007ffc809c6f1c RDI: ffffffffffffff9c [ 466.064847][T10955] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 [ 466.064857][T10955] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 466.064867][T10955] R13: 00007ffc809c6a80 R14: 00007f5b27fa8000 R15: 000055f18e75b4d8 [ 466.064886][T10955] [ 466.064893][T10955] [ 466.087515][ T5831] m920x_read = error: -19 [ 466.090189][T10955] Allocated by task 10788: [ 466.368031][T10955] kasan_save_track+0x3e/0x80 [ 466.372705][T10955] __kasan_kmalloc+0x93/0xb0 [ 466.377285][T10955] __kmalloc_cache_noprof+0x31c/0x660 [ 466.382645][T10955] em28xx_v4l2_init+0x10b/0x2e70 [ 466.387672][T10955] em28xx_init_extension+0x120/0x1c0 [ 466.392968][T10955] process_scheduled_works+0xb6e/0x18c0 [ 466.398502][T10955] worker_thread+0xa53/0xfc0 [ 466.403132][T10955] kthread+0x388/0x470 [ 466.407190][T10955] ret_from_fork+0x51e/0xb90 [ 466.411803][T10955] ret_from_fork_asm+0x1a/0x30 [ 466.416552][T10955] [ 466.418857][T10955] Freed by task 10788: [ 466.422925][T10955] kasan_save_track+0x3e/0x80 [ 466.427602][T10955] kasan_save_free_info+0x46/0x50 [ 466.432616][T10955] __kasan_slab_free+0x5c/0x80 [ 466.437364][T10955] kfree+0x1c1/0x630 [ 466.441241][T10955] em28xx_v4l2_init+0x1683/0x2e70 [ 466.446251][T10955] em28xx_init_extension+0x120/0x1c0 [ 466.451523][T10955] process_scheduled_works+0xb6e/0x18c0 [ 466.457060][T10955] worker_thread+0xa53/0xfc0 [ 466.461678][T10955] kthread+0x388/0x470 [ 466.465823][T10955] ret_from_fork+0x51e/0xb90 [ 466.470419][T10955] ret_from_fork_asm+0x1a/0x30 [ 466.475172][T10955] [ 466.477483][T10955] The buggy address belongs to the object at ffff88802b3b0000 [ 466.477483][T10955] which belongs to the cache kmalloc-8k of size 8192 [ 466.491528][T10955] The buggy address is located 1864 bytes inside of [ 466.491528][T10955] freed 8192-byte region [ffff88802b3b0000, ffff88802b3b2000) [ 466.505502][T10955] [ 466.507844][T10955] The buggy address belongs to the physical page: [ 466.514341][T10955] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2b3b0 [ 466.523115][T10955] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 466.531600][T10955] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 466.539144][T10955] page_type: f5(slab) [ 466.543120][T10955] raw: 00fff00000000040 ffff88813fea6280 dead000000000100 dead000000000122 [ 466.551686][T10955] raw: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 466.560259][T10955] head: 00fff00000000040 ffff88813fea6280 dead000000000100 dead000000000122 [ 466.568913][T10955] head: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 466.577568][T10955] head: 00fff00000000003 ffffea0000acec01 00000000ffffffff 00000000ffffffff [ 466.586239][T10955] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 466.594992][T10955] page dumped because: kasan: bad access detected [ 466.601427][T10955] page_owner tracks the page as allocated [ 466.607136][T10955] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5212, tgid 5212 (udevd), ts 37647342728, free_ts 37634973097 [ 466.627091][T10955] post_alloc_hook+0x231/0x280 [ 466.631846][T10955] get_page_from_freelist+0x24dc/0x2580 [ 466.637383][T10955] __alloc_frozen_pages_noprof+0x18d/0x380 [ 466.643201][T10955] allocate_slab+0x77/0x660 [ 466.647706][T10955] refill_objects+0x331/0x3c0 [ 466.652391][T10955] __pcs_replace_empty_main+0x2e6/0x730 [ 466.657942][T10955] __kmalloc_cache_noprof+0x392/0x660 [ 466.663311][T10955] tomoyo_init_log+0x112e/0x1fb0 [ 466.668326][T10955] tomoyo_supervisor+0x353/0x1570 [ 466.673333][T10955] tomoyo_env_perm+0x151/0x1f0 [ 466.678132][T10955] tomoyo_find_next_domain+0x15cb/0x1aa0 [ 466.683764][T10955] tomoyo_bprm_check_security+0x11b/0x180 [ 466.689815][T10955] security_bprm_check+0x85/0x240 [ 466.694903][T10955] bprm_execve+0x896/0x1460 [ 466.699477][T10955] do_execveat_common+0x50d/0x690 [ 466.704504][T10955] __x64_sys_execve+0x97/0xc0 [ 466.709160][T10955] page last free pid 5201 tgid 5201 stack trace: [ 466.715645][T10955] __free_frozen_pages+0xc2b/0xdb0 [ 466.720751][T10955] __slab_free+0x263/0x2b0 [ 466.725158][T10955] qlist_free_all+0x97/0x100 [ 466.730216][T10955] kasan_quarantine_reduce+0x148/0x160 [ 466.735656][T10955] __kasan_slab_alloc+0x22/0x80 [ 466.740758][T10955] kmem_cache_alloc_noprof+0x2bc/0x650 [ 466.746214][T10955] anon_vma_clone+0x412/0xa00 [ 466.750892][T10955] anon_vma_fork+0x16a/0x570 [ 466.755466][T10955] dup_mmap+0x991/0x1d90 [ 466.759688][T10955] copy_mm+0x13b/0x4b0 [ 466.763765][T10955] copy_process+0x18b6/0x3cf0 [ 466.768419][T10955] kernel_clone+0x248/0x8e0 [ 466.772932][T10955] __x64_sys_clone+0x1b6/0x230 [ 466.777682][T10955] do_syscall_64+0x14d/0xf80 [ 466.782253][T10955] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 466.788216][T10955] [ 466.790533][T10955] Memory state around the buggy address: [ 466.796235][T10955] ffff88802b3b0600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 466.804285][T10955] ffff88802b3b0680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 466.812338][T10955] >ffff88802b3b0700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 466.820407][T10955] ^ [ 466.826839][T10955] ffff88802b3b0780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 466.834887][T10955] ffff88802b3b0800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 466.842937][T10955] ================================================================== [ 466.852169][T10788] em28xx 1-1:0.89: Registering snapshot button... [ 466.867326][T10788] input: em28xx snapshot button as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.89/input/input37 [ 466.940985][ T5831] dvb-usb: error while querying for an remote control event. [ 466.966119][T10788] em28xx 1-1:0.89: Remote control support is not available for this card. [ 466.975651][T10051] em28xx 1-1:0.89: Closing input extension [ 467.006839][T10957] x_tables: duplicate underflow at hook 1 [ 467.032752][ T30] kauditd_printk_skb: 36 callbacks suppressed [ 467.032763][ T30] audit: type=1326 audit(1773599387.536:2210): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10956 comm="syz.1.1187" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf706ef6c code=0x7ffc0000 [ 467.087619][ T30] audit: type=1326 audit(1773599387.536:2211): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10956 comm="syz.1.1187" exe="/root/syz-executor" sig=0 arch=40000003 syscall=437 compat=1 ip=0xf706ef6c code=0x7ffc0000 [ 467.089638][ T5831] m920x_read = error: -19 [ 467.112144][T10955] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 467.112169][T10955] CPU: 0 UID: 0 PID: 10955 Comm: v4l_id Not tainted syzkaller #0 PREEMPT(full) [ 467.112189][T10955] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 467.112200][T10955] Call Trace: [ 467.112208][T10955] [ 467.112217][T10955] vpanic+0x56c/0xa60 [ 467.112243][T10955] ? __pfx_vpanic+0x10/0x10 [ 467.112266][T10955] panic+0xc5/0xd0 [ 467.112285][T10955] ? __pfx_panic+0x10/0x10 [ 467.112305][T10955] ? preempt_schedule_thunk+0x16/0x30 [ 467.112323][T10955] ? preempt_schedule_thunk+0x16/0x30 [ 467.112341][T10955] ? v4l2_fh_open+0xac/0x420 [ 467.112360][T10955] check_panic_on_warn+0x89/0xb0 [ 467.112378][T10955] ? v4l2_fh_open+0xac/0x420 [ 467.112396][T10955] end_report+0x73/0x180 [ 467.112415][T10955] ? v4l2_fh_open+0xac/0x420 [ 467.112432][T10955] kasan_report+0x128/0x150 [ 467.112451][T10955] ? v4l2_fh_open+0xac/0x420 [ 467.112471][T10955] v4l2_fh_open+0xac/0x420 [ 467.112498][T10955] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 467.112519][T10955] em28xx_v4l2_open+0x157/0x9a0 [ 467.112535][T10955] ? do_raw_spin_lock+0x12b/0x2f0 [ 467.112561][T10955] v4l2_open+0x1bf/0x3a0 [ 467.112581][T10955] chrdev_open+0x4cd/0x5e0 [ 467.112602][T10955] ? __pfx_chrdev_open+0x10/0x10 [ 467.112620][T10955] ? fsnotify_open_perm_and_set_mode+0x135/0x6d0 [ 467.112640][T10955] ? __pfx_chrdev_open+0x10/0x10 [ 467.112656][T10955] do_dentry_open+0x785/0x14e0 [ 467.112682][T10955] vfs_open+0x3b/0x340 [ 467.112702][T10955] ? path_openat+0x2df0/0x3860 [ 467.112719][T10955] path_openat+0x2e08/0x3860 [ 467.112741][T10955] ? __pfx_stack_trace_save+0x10/0x10 [ 467.112759][T10955] ? stack_depot_save_flags+0x33/0x810 [ 467.112784][T10955] ? __pfx_path_openat+0x10/0x10 [ 467.112799][T10955] ? __x64_sys_openat+0x138/0x170 [ 467.112818][T10955] ? do_syscall_64+0x14d/0xf80 [ 467.112834][T10955] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 467.112853][T10955] ? __lock_acquire+0x6b5/0x2cf0 [ 467.112875][T10955] do_file_open+0x23e/0x4a0 [ 467.112894][T10955] ? __pfx_do_file_open+0x10/0x10 [ 467.112918][T10955] ? _raw_spin_unlock+0x28/0x50 [ 467.112939][T10955] ? alloc_fd+0x64b/0x6c0 [ 467.112962][T10955] do_sys_openat2+0x113/0x200 [ 467.112984][T10955] ? __pfx_do_sys_openat2+0x10/0x10 [ 467.113006][T10955] ? exc_page_fault+0x6a/0xc0 [ 467.113023][T10955] ? do_user_addr_fault+0xc6f/0x1340 [ 467.113044][T10955] __x64_sys_openat+0x138/0x170 [ 467.113066][T10955] do_syscall_64+0x14d/0xf80 [ 467.113082][T10955] ? trace_irq_disable+0x3b/0x150 [ 467.113104][T10955] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 467.113119][T10955] ? clear_bhb_loop+0x40/0x90 [ 467.113136][T10955] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 467.113152][T10955] RIP: 0033:0x7f5b276a7407 [ 467.113168][T10955] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 467.113182][T10955] RSP: 002b:00007ffc809c6830 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 467.113201][T10955] RAX: ffffffffffffffda RBX: 00007f5b27e41880 RCX: 00007f5b276a7407 [ 467.113213][T10955] RDX: 0000000000000000 RSI: 00007ffc809c6f1c RDI: ffffffffffffff9c [ 467.113224][T10955] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 [ 467.113235][T10955] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 467.113245][T10955] R13: 00007ffc809c6a80 R14: 00007f5b27fa8000 R15: 000055f18e75b4d8 [ 467.113263][T10955] [ 467.115241][T10955] Kernel Offset: disabled