last executing test programs: 3m45.621974654s ago: executing program 1 (id=2581): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) openat$dsp(0xffffffffffffff9c, 0x0, 0x10c40, 0x0) shutdown(r0, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r0, 0x84, 0x6e, &(0x7f00000002c0)=[@in6={0xa, 0x4e23, 0x3, @private2, 0xa}], 0x3f) 3m45.383498942s ago: executing program 1 (id=2582): mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file0\x00', 0x1e0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000340)=0x6) ioctl$vim2m_VIDIOC_S_CTRL(0xffffffffffffffff, 0xc008561c, 0x0) r3 = socket$rds(0x15, 0x5, 0x0) bind$rds(r3, 0x0, 0x0) r4 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r4, &(0x7f0000000340)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r4, 0x10e, 0x4, &(0x7f0000000140)=0x6, 0x4) setsockopt$sock_int(r4, 0x1, 0x8, &(0x7f0000000200), 0x4) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000006c0)={0x94, 0x0, 0x1, 0x401, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @local}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8}]}, 0x94}}, 0x0) sendmsg$IPCTNL_MSG_CT_DELETE(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)={0x14, 0x2, 0x1, 0x5, 0x0, 0x0, {0x2, 0x0, 0x8}}, 0x14}, 0x1, 0x0, 0x0, 0x20044804}, 0x40040) 3m44.527160243s ago: executing program 1 (id=2590): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0xd800, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a20000000000a050000000000000000000100fffc0900010073797a300000000040000000030a01200000000000000000010000000900030073797a300000000014000480080002400000000008000140000000010900010073797a300000000050000000060a010400000000000000000100000028000480240001800b000100736f636b6574001b140002800800024000000001080001400000000208000b40000000000900010073797a300000000014000000110001"], 0xd8}, 0x1, 0x0, 0x0, 0x8000}, 0x4000804) 3m44.376762164s ago: executing program 1 (id=2593): syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000000c0)=[@textreal={0x8, &(0x7f0000000000)="8ee8c9b8ee088ed8660f3801b2d6352ed9ff660f3882040f01cf0fc72d2626652e0f01ca0fc7386635002000000f22e0", 0x30}], 0x1, 0x3a, 0x0, 0x0) r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009210008000122010009058103"], 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000240)={0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="00000c000000070001"], 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000180)={0x84, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB=' '], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000001200)={0x84, 0x0, 0x0, 0x0, &(0x7f0000000040)={0x20, 0x0, 0x4, {0x1}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000002a00)={0x84, 0x0, 0x0, 0x0, &(0x7f0000002700)={0x20, 0x0, 0x4, {0x1, 0x3}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x6, 0x8, &(0x7f0000002680)="19fed23575863b48") syz_usb_control_io(r0, &(0x7f00000007c0)={0x2c, &(0x7f00000004c0)={0x40, 0x8, 0xff, {0xff, 0xb, "53cdc3ebdc46ace2af1e8ec31c693948340c833191a894c94809cdf488b2fa7ed39b1330992f5eed55a74df60ccceaf15d61096ccee4e6080ae7cb80321c696d550bea3f548ed771ed3fee433eabe82f54bc20acbb2591a8a06ee01c6f6c4ae409ad92b83d72b99b9b8bc99750be6bfa46ae9036e09fc383672d6afc6587e5115af758bd959d8e24df6a17cb970ebe1196fe4d08dd54053a7b7f6890e3c0a5f82dc632e9b066580b7a5b69b7b9209f1cfcc2f451a353e18343432522107a557b50e27d496f5123eddde674b08aae8e10926cd8cf4e08ee720b3b97b4b723177bdde25944d394770261c226c0581a227820ec8d81a3cc1649a4b93dfa93"}}, &(0x7f0000000600)={0x0, 0x3, 0x54, @string={0x54, 0x3, "8023a6a967ffc7176c5927c1ec952315a6192f39dd1a3eadeadcdcb4f2c49f48189a49647a8a8f300ebd026c40418619b1bb9eac6d1c6423951527f3958cf9429251c0addac8463f8e8dca235c7d42d6451f"}}, &(0x7f0000000680)={0x0, 0xf, 0xe8, {0x5, 0xf, 0xe8, 0x6, [@ss_cap={0xa, 0x10, 0x3, 0x0, 0x2, 0x7, 0x3, 0x9}, @ptm_cap={0x3}, @generic={0xc6, 0x10, 0xa, "e3e024a082ce44031181cc3bdebe5bcd49806993fcaeec030af3957d10ef677fea983fb0d1510bb1e3b01a26996712568a13921510d79e03e0843070edf0b59f3283fef571ab64f656194c3cd502ed2e3a0fb1e4b3ecc7f29c086d1223aba4a75f4f1736c4d7a9c60a7219ef3089134d1b593ff641249904e72684472f2a74e176dd42fced95db79cb0e82bcd0d88914f4c029a592330b1b565f2725bb90c8363918510d44fa6470fddbe10885e3d7174a241f22968abac496e69a77e18ab414a68b8f"}, @ptm_cap={0x3}, @ptm_cap={0x3}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x5cbabe4f2fdc90d2, 0x0, 0xa, 0x10}]}}, &(0x7f0000000440)={0x20, 0x29, 0xf, {0xf, 0x29, 0x7, 0x4, 0x4, 0xa, "e61fa66a", "2a97ba51"}}, &(0x7f0000000780)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x3, 0x10, 0x8, 0x1, 0xc, 0x200, 0x7ce}}}, &(0x7f0000000c80)={0x84, &(0x7f0000002740)={0x20, 0x18, 0x9c, "2a8782ee7c393b05a0d0c7e2bff9bbf6f8f4ae857c21830c8e16e8ae5faa503bbd4d95462f175f3d04a9821c74c57095677aad4a3bd1d84d94602aa8c13ac887c966e2cdd396bb5c08c022cc858f4ec99bc2d0d901ca9132ae596ef79682805cd146f9b50d35f8768e02d46023ba0d5737e64bb50d88866b39dd70940cb4b6131f8c0198f389740269b3b0568ed1492285bcd3dab9a236a17940df4b"}, &(0x7f00000008c0)={0x0, 0xa, 0x1, 0x1}, &(0x7f0000000900)={0x0, 0x8, 0x1, 0xc5}, &(0x7f0000000940)={0x20, 0x0, 0x4, {0x2, 0x3}}, &(0x7f0000000980)={0x20, 0x0, 0x4, {0x400, 0x40}}, &(0x7f00000009c0)={0x40, 0x7, 0x2, 0x7fff}, &(0x7f0000000a00)={0x40, 0x9, 0x1, 0x4}, &(0x7f0000000a40)={0x40, 0xb, 0x2, "e096"}, &(0x7f0000000a80)={0x40, 0xf, 0x2, 0x9}, &(0x7f0000000ac0)={0x40, 0x13, 0x6, @local}, &(0x7f0000000b00)={0x40, 0x17, 0x6, @local}, &(0x7f0000000b40)={0x40, 0x19, 0x2, "9f20"}, &(0x7f0000000b80)={0x40, 0x1a, 0x2, 0x6}, &(0x7f0000000bc0)={0x40, 0x1c, 0x1, 0xff}, &(0x7f00000026c0)={0x40, 0x1e, 0x1, 0x6}, &(0x7f0000000c40)={0x40, 0x21, 0x1, 0x3}}) r1 = socket$inet(0x2, 0x3, 0x4) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000040)='ip6_vti0\x00', 0x10) sendmmsg$inet(r1, &(0x7f0000000280)=[{{&(0x7f00000000c0)={0x2, 0x4e01, @local}, 0x10, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='4\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00D \r', @ANYRES64=r1], 0x38}}], 0x1, 0x46000) mkdir(&(0x7f00000020c0)='./file0\x00', 0x0) openat$sndseq(0xffffffffffffff9c, 0x0, 0x22803) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f00000001c0)='proc\x00', 0x810c03, 0x0) chroot(&(0x7f0000000100)='./file0\x00') r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_NR_MMU_PAGES(r3, 0xae44, 0x80) pipe(&(0x7f00000002c0)={0xffffffffffffffff}) r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x20081, 0x0) write$vga_arbiter(r5, &(0x7f0000001580)=ANY=[@ANYBLOB='target PCI:0:0:0.', @ANYRESHEX], 0x13) r6 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000340), 0xffffffffffffffff) r7 = syz_open_procfs(0x0, &(0x7f0000000040)='net/ip_vs_stats_percpu\x00') read$FUSE(r7, &(0x7f0000000640)={0x2020}, 0x2020) sendmsg$SEG6_CMD_DUMPHMAC(r4, &(0x7f0000000480)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000380)={&(0x7f0000000400)={0x3c, r6, 0xb02, 0x70bd29, 0x25dfdbfb, {}, [@SEG6_ATTR_DSTLEN={0x8, 0x2, 0x40000000}, @SEG6_ATTR_SECRET={0x10, 0x4, [0x1, 0x6, 0x2]}, @SEG6_ATTR_SECRETLEN={0x5, 0x5, 0x4}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x1}]}, 0x3c}, 0x1, 0x0, 0x0, 0x2406c804}, 0x4001) mount$bind(&(0x7f0000000040)='.\x00', &(0x7f00000003c0)='./file0\x00', 0x0, 0x2a05004, 0x0) mount$9p_tcp(0x0, 0x0, 0x0, 0x80, 0x0) pivot_root(&(0x7f0000000280)='./file0\x00', &(0x7f0000000180)='./file0/../file0\x00') 3m41.776841783s ago: executing program 1 (id=2619): r0 = socket(0x15, 0x5, 0x0) getsockopt(r0, 0x200000000114, 0x2721, 0x0, &(0x7f0000000000)) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r0) sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f0000000300)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000140)={0x140, r1, 0x200, 0x70bd2d, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_HT_CAPABILITY_MASK={0x1e, 0x94, {0x80, 0x2, 0x2, 0x0, {0x8c, 0x8, 0x0, 0x8, 0x0, 0x0, 0x1, 0x3, 0x1}, 0x6, 0x3, 0x2}}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0xe}, @fils_params=[@NL80211_ATTR_FILS_ERP_REALM={0xd8, 0xfa, "d8380b2875307dc0e25095f9ee09aa3d808b45be612908a552baf8f2488e6762f57caf5e3757d170290a3f759443b31168f4f1763c79a6ad1719f4dd23b9219a178ed951744127c9c2f3a4dc0d20dc3967c274aafd355aa1702cb95862772d6b9c7bed495f429fa21b92fe9f259f4b82dc159c7ed472b22ec65ad2a9c66e08d561d7a524d61c4948d6bb60fe991f124681841645808ec0eb73f59166b7d6d2d1c9dfd747fe7a6c69103489e12054dd5f423ae7d5f4bbf0532c4ec0218482f4c515ce1695de277e15ffe426f2d7da80265993dbf2"}, @NL80211_ATTR_FILS_ERP_USERNAME={0x5, 0xf9, 'B'}], @NL80211_ATTR_VHT_CAPABILITY_MASK={0x10, 0xb0, {0x200000, {0x4, 0x8, 0x527, 0x8}}}, @NL80211_ATTR_PBSS={0x4}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0x8}, @NL80211_ATTR_BG_SCAN_PERIOD={0x6, 0x98, 0x5}]}, 0x140}}, 0x8000) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SIOCX25GDTEFACILITIES(r0, 0x89ea, &(0x7f0000000380)) setsockopt$SO_J1939_ERRQUEUE(r0, 0x6b, 0x4, &(0x7f0000000340)=0x1, 0x4) r3 = openat$null(0xffffffffffffff9c, &(0x7f00000000c0), 0x1, 0x0) sendfile(r3, r2, 0x0, 0x80009) syz_init_net_socket$ax25(0x3, 0x3, 0xcf) 3m41.453717532s ago: executing program 1 (id=2624): sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000740)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000b40)=ANY=[@ANYBLOB="14000000000000002900000000000014000000000000002900000034000000fdffffff00000000180000000000000029000000040000000400000000000000d80000000000000029000000360000005e17000000000000000100000100010800000000000000000728000000030800ff0f66090000000000000700000000000000010000000000000001000000000000000864c8a110995d43"], 0x188}}], 0x1, 0x810) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg(r0, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x0, 0x0, 0x10}, 0x40000) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb0", 0x49}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11", 0xce}], 0x3, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 3m41.220698596s ago: executing program 32 (id=2624): sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000740)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000b40)=ANY=[@ANYBLOB="14000000000000002900000000000014000000000000002900000034000000fdffffff00000000180000000000000029000000040000000400000000000000d80000000000000029000000360000005e17000000000000000100000100010800000000000000000728000000030800ff0f66090000000000000700000000000000010000000000000001000000000000000864c8a110995d43"], 0x188}}], 0x1, 0x810) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg(r0, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x0, 0x0, 0x10}, 0x40000) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb0", 0x49}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11", 0xce}], 0x3, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 1m37.44864541s ago: executing program 4 (id=3840): openat$kvm(0xffffff9c, 0x0, 0x800, 0x0) syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000024917720042322023f770102030109021200010000100009"], 0x0) r0 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2003) ioctl$I2C_RDWR(r0, 0x707, &(0x7f00000001c0)={&(0x7f00000002c0)=[{0x1, 0x8010, 0x0, 0x0}], 0x1}) 1m36.13171405s ago: executing program 4 (id=3847): r0 = semget$private(0x0, 0x2, 0x0) semget(0x1, 0x5, 0x0) r1 = openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) pwritev(r1, &(0x7f0000001580)=[{&(0x7f0000000140)="368aabc5889d2352eddb42586e7fb247f644da5e135319cef23741019a2990005923acfe3f3c331c3f95d263b5ca225053459e2c3130f892fdb399ca1df1709e65ec7e571df8e7115811c23b3ac433b47ef9ac8bdd41122bc8694dc006419bfc1731d4306de296966d67ae94f75ea6d640b31bb0a66b9b49b708d54a1957e380983342ff5c62a1efc238ac1291fc37cd8fc4f3441684dbf45f0d1f4db25c189519c22cd54d", 0xa5}, {&(0x7f0000000200)="878b808a79f57124fb869940898364ab1570587ac82c042be5228d3e3100a5ed792b6efff632189f51567f3c4583ebe34054dfb27b652f6f7e5879fd30253c009b26292b4e76f7944c509f317ce89ab59af2829adb4741b932f8c9525b69031923443724d366e0ea7f16ec47b950d1adb5bde7", 0x73}, {&(0x7f0000000280)="ac390c71dba8c339807404ee413d4a9d304cf9ea4c6e8d9e765d9b63a3bf5b0455cee6640d49ce67ff47936c64bfe36ccecda5fd7438120bde93e3b1b89c17", 0x3f}, {&(0x7f00000002c0)="8c2360bc09ebbb862ea8fb1abf10ce5d2b4453adea0ecb7e70e95ef87bd806ea154b8f4619a928aaefcf6c5328666801bff9ac7ab4831c74fed070435bb2be0068a82767287cd9688d7b8d6d08ada5418346e6e6e20a815bb705dcef08af23f7ae95eec759da0fb69ee07496185b47f9217ec97efeffc220388eceeba55303375247edb9db92c6fefbe0b6bb3c1324b5376815fbd1fbbc55c099b577a2ad0785850ceb6306a8e21149a72b172a548d802fb58c5c70fba1ed90a3e6aee93fc54d06be9b72c261cd932169c69455ebc9ab1ba82498cb3f8089c07cf29368620759f6397bde3a102e121d26731e09ade9e4790a16781b036267a4c84521f4b112045851c2fdd6365ecb6f250a271cc96b50bb6781741022baaebe70aa954350112881d84292e91d2a0b13424d14c39d295a30b478c177113b265d889989449804cdee3e51c9729b947585c10caa088e663dfa143304a83ba8a2d2da3b93afa4aabd72577753c879a0efc2669ad34eae8663abc9469532f524c7be742a8eedfbdcdf2c637e26e0a0ef8459e5a05fe7dd2192fc468c033eb687260c1a2d681755a83e77633e6298626e44e040232f6c14d2030b1e4d75e76b54f881a222f4432f8073a2bdf3bd5c16e91b19fea2dde102df17a385fae0f5ad450ee7011c42f9845b480494a555bd07401cafeaa8410a5ff754aa956bf8c6d5c6c905a0c04f664a671cdc435d72e11f1d86acdbec1987d49b911b44997c4ea7e31489567a9a66c80277c1960f45ae9097be9c00aef433749c0b12ce47cf31607bc56eb702a919196c0fbf3dfe47287759cf92c2477cf51366aacb627664d5512f78273e5e23cd6205f2615ad13cf064c1d74acdf5fba47d02d501c605616194f710d9215f15ac55989caf3a105f3f5b9f13962ac852f456fd9bd9d9dd32a9fc15ed54c928fb11a6dd893b23adb580181f14a299883616bd972c855d4a206d1abe2549bd302bde8f0c8099fae6a74ff722f3d8f6383a508b28a1f16c3bf2bd1e3621a9e7e94830e43a315f913ed673bcac41ee9ebc59551d3992b019907750795d00b565614bee11e57c6196f972a1a9e60f7030b8eba3f4ca97d169a0ce6d820dad29928ad6584d22a14fb6b65bde1b3b057d50ebd0852f741d20e62eda842e19573b8f9417563acd92448eac82e0607399ece2d60c5703fde61ad6b51a4a8adefd97d8e33c2e0717befb8d5f4d9a331d9e9d31657aed38b3c059e2cfe15faa137f48f463394bb5a584ae4358ef7f8b9f0b53273622b3d5b0c95027fb87707b82fd9b2fb30debf924ebda2aa34fcd3e729aae6174318a78e3d79e6e2856f028baf2efde2d37dac07a0a84fcb112990d09818ce4907ed965f3b74adf90189c73bee067038426362c6a55046f921b92ada390064a46d12551773678eb947d8dfae3b85c1c07d4affe5cb1f6ee7c28dabebd3d40d894ce60c015f09aae0be0ddf5a168b29325fc1a24676d54c427fde4579d26abcc6f6bd83764c6274a97ac09242a23069a92e454e17779b2c63cece2c44bc942e4d09e764e8f7828af877357a6297939ad313d56be1fda297748973967108ad984f16b10c99932039409adf57e47a6f518cbcb43efb0755769277d72f769af80f6e996ade8c0b752f6138a4ffa510ec355d04f3c20e56f064f6e23feca4b14bfe3aca92051a3ef4d518e78a0fdb699d90d8441938f6b44326fab18bbb10005bfe4d9d1b4dd967bd0895e13a6911ee2a3ebfa3dd47201a2f25b3ecf743c86550b3056797d33c8442ee1a23c18a89af7592f46587703dbb25926a01595ac0f8551e5521e91462ae10f400fe94298e407fb7004725e6c41aeeb80565ad7ffe87a5eeacd758742c559d990b7e51c1b79470e94159f501269c35765210b69b56519c1c3f4e7028e732893423d8d663fc4002ea42fbfaf5bcaf10e2121281c3db69aa9f298d5312156f043c945b61947143a1d635b4ab8336be9e9baf0e8c93083c5f6e1e851fbb80dd05c8643acac8b4fa43f140d40d17b7b0546fe78f3eac3933df0996127523906ff46bc69b9aeddc8e3eda31fdab138109f7dac9e29acbe9c53cb3e87717a4750c52702510bc2ce3148fa231d25875a6145be2878dd9e469c7109d90ead12843b52c9ede3af4bf6392285bf3d4172a21fa26fd231707a8a424959ce61d1d15bda7921817c903e4f9eff647e1c2ddf0c50aeddc053a8f74c1971eb8befded851238c8d7b99f2ce96e0507de21103a1f298cac86bab4a92bfab809255653af1c748e1aeece3ae064c6dc236c998a3e65e3f6a160f6b174b237d05d9c2728f80c44c659f1902ff1ebea5692dceefb2f9988eabb56bc62a0db76ec0078ccf33811df992348166f90cf3538a6089c53d327331bf9798722570f75591880fb2848e60f3a3b4cd71cf9a143ccdea21d6b8e6711430778e53a320be68a167de0e30a44a6b1333875a93a7f464926c970acb612bbda82e4f80c3022c7eb13ee3b9cb0e4712b33cd1b3c8d8ef545fc7da294acef7f442a13811e279960bf90631695e9315916cf3fd4ad26d30241c56dd0ff5603c9f0de9cc9a37423e555ee33e50d10a758720383cd3fa39162fbd5de6c9c350daf415e8cc4b0e2e55ebeb80d45b8e376a36c7ac6ba8c4f22cb705afd9aedd3dcc7aa2074f01785b16d2bfa789e729ea10404eab26f9aeb0302b7875dd35d0fbc27337e6f573dafe06380353fb4476f5bff1683b6c50e34587ff7c541c2c2046ebe051f8558dd0af710d154e5470c8cba69bc502d425d86435f88435b8cf62e0585101c5d6f58e0d51aee6c082f708da3d6258f9bd456deb35f98505c328c6630f3355ce246f23c42bba5b7355e806836efc192e71fc2c4f51d0bdc64c238b46894d58b2b5c59d8c6c2d44f929017b84d5f73aff0bf1bfbf4279f89d250c1a96a4b40f199227f7900984f05bde4f8a3cb102c7103bd75d0673864f810163d72c6cbb4649b01a7240d68839966b94db478c2cbe03cb7b9705687770abbe16cd30560ca599dedb224e357610d311aa7f3818469b2484df3fc8fa15363ec3b6c6363abf1d0ffecef1facaa1170464bb0d221f4f01b380e84170df57b6e665ffe5688d89bad4e7b7e2a2f00791d2ba561de78fcd8f3ddb03941c1c3443dee6f857270b11b2d46eec71fce23ad147a8474f272cbef11ac8d5134cb3badcb5af34f0a069e817c3c0e7532559f50011d5f6aae35da267d7351d7c1717b61ae439921b79b42e93b2a0976d24a5e359cd78d1b2ec392d0125248460b1c8391866d0e1e8ed98056fc952af127e28e4e1d7ab56b16401b8e8967326ceebf59bf18765a9b1b5f95a301790feda898425c5323bcd721f3e1ff717fc79f26295364f13bfb662d33ccecef615adf52d11627da2141ca9e3c2c300a3e4b048537351cdeee3060bbcd8262f68bebc217e1d59f9748e95c13cbd5bf75ae3f808072987fefdcd280ce8163537cdff8e17965ccad88a41f336509f5536257caba90f59f5b76a809894ea6231d4de3e545faaeedcdbccc610e267675abcd8ce1c9ca2285ab0af7c7843129a64a4e78ea2d41a85b60ed7f92629b092d1248413a32cda24d64a1c3ef53d96c4ae9abd6405cdee242c046e55015dc214793167d879fca21c2918119cdbb10b3d3bf3d81bb392b160aefa9a5ed8bc2550f1ff2c0ec09a4777ade9a40072bac19856860c0696eafaa5500e46706c2c20b11388a213bd4e2c5a41eb1256c613fc6c96d2acdd9a055e8fd93079153b3a37cb77cedae7d56d38a709ffa3af2eb24e97d1dc92cadb4151d863acab3e6d42bdbe9f366a3f1bc295046cdbfad866c12df703a5a8745539df8f621d6a91a9709814d538034996947f0ecd7696a10f238d5c44ee14009efade856ac9c81500d0ac30fd5659be7e1c59bf241a9f838c461c268569baa7bf1666443f5e156b8a9b63619c1825d0d013b3723c9d73d6df8eb73a4da50c3bf5461de1b6a805735cddcc6354ec76c1f821e922680bea67ac2869d3c74e9f544975deddee70c059ec02dec92f55bbad2fff456c3c63a9cf4f79250e68b4c01362e5f33d78bfbf9baa561763002dbb2a82ad02b0c03547d88ce5e14e44c5293980e2f30fb30e64e308b24d2a6ebcf6313d4cce98a740005afd29d33c3a402189f953951c88e1abf96093b406806850b899c736edc9eb1255ef233c17efb7c6691aa446baca9f16c74a85ff4def1ba22167b7ce15df75dd20f47dac67e3cb4db13fc4a5e28c708ab34bf2e6505ce8d3c549f26e2f5358acce20bda8d260661415e0fc3ab2b899a93445c903781edf4cb3afc740ee433d2c3d7872b298986918b3e766707e4ac7de670d2f2e0c707321b7e504a0129821299d07463ffe38332aca20a210c6fd34d1fa491490c38f9f1dbbf0ec9d388d9ded399dfe9d426e17e45e824985fc7b135dcff9ff0cf732edc7643f3c09ca8795fdb4d8411bc6febd92c0f770d22eb42f8b49364efa5b80ac9da23523fe1d28c5aa3f9413f0881d46d7a9c4eeac7c92429ed917227ac43c664fe12341cb43052de11db4212c0b8c8c6fe7a2946d87fb0f5b7e820fd54f9f91ca84b846ff87a6dcf6dddb46f296209cf83c27c547a845588a195b2c482336bdb3221e776bafe1301fb966998ab82cefb2ae069bcad2dcff961a10dd7c4808cba630d77500a78db3710ff673c1071dc654a2ed8f56a20cadcfd5ad118787d19bb3ae4867753df4e168ee8b9a8b72fb8474c0b2c38a0adc60362a6db3763d5491f2a8e77a6235e19cb85e40663b152d4a46ddd25730dd97a20977d5005f395b93e7b47235bbc299eeea3c5eb1395a9c3e29bcaa5c1dbf738d085992a5a46fb2747e8ae2e1923a3a9e9637719f22c1a91f00e7181400ed8de91f964272dd20ded9f406a9095be9e03c12ed523c30e278fc7ab1c6177e4402c5c88c73cc852c3847b7f295a4442dbd43e8e863635e1a15c9ca4a66ab55b2950ac0ff902971605316ce3689f55eefe946b388432e6883645746ad76b493f4908c29804d1b9f0a217da74c763d8894bdee54863d4df46bffcf34c0d41e2fca46a47bbb95f6c1b123bfe8bb5abba43518e9cec4525a786a531f4cf272ed4902ad7f95b3e171eae85bce49bdb320f3dd63882f56e81686d7a469a7d2a4212d1ace8ad1fe2744de59f479fef6a41245731bc3df81ea8799f7a37346cf1be2b3068a7856f76b8cbdaacdbef60ec14a6fb6e09d2a10a0d1a3dda3dd3e9f2df2a7906f0b99df4c0163b260c7dbf1d3b64d8d8a7b23bd95dfb54b38c23776502f05d6fd3d0c0bed5e3363cf4060baeed0e206d90079a1cd8e9283eaca08ae6267d3f95d488c1f365dbedec6b36c006e65c97d78404a541281b18ea72ac092243572f131881fcaaabdf3a5e9b4386aef42f8992172aadea279262c9790644ae0e3c584a4196dd796139d94fdc953ec06d3a5d5a73c825602888de14d1bfc1081a164ea8ea30329f09b7daf2807426b69de9c2b32cd38fb4d6c2a17d80d7d50597ef2d0ddfaa23f33645e8ea24a997e47a5c8bbce3f9ac771e84bfc1f481ceb85fab55121eb998d92720f6a9356218f369020a8e8f366e191f7ffb92f427fa8d24c554b1717c798c4170ff86e958525198f27882c286ad945871790fda7a4ad480493e43094f3f8bef41910de2076aaab0cf29ec5e77a6abc27b8d0a1f8fd0a170c905593e25a0b4672fe45f76855ea90f5a20d98f380febf591f68fec79b84156e52576797d78cc7f0a190689b316a9b801f532d43757106dba06ca164", 0x1000}, {&(0x7f00000012c0)="6d86fb5ee9fe1daa27a65f734e82f9ef241182c88c01d13af52db35ec714b9985c863be0673c127f74e8e0f81b518505df904d30412b4758591ee2066fb5b820fdd22db85c4d8616ec774b947f5af38de112b0bf3280e08d28d05e5ed60a6e9c76700f5f49fb30be32996ebc080476a72a30cd3befafebe70bdc638ae049947c8092", 0x82}, {&(0x7f0000001380)="a748537be05a88790032c9c52ab8d4466dafae4aeeb36115672a4746aaf513fe26911d24e00c0afb9e48c08e78afa81015dd8057ecbc8425ef918c5f137c161bdee5f77ad1868e9806be5586c271f2bef2fadde94fa122360882dc3785111931d3cc00220b7f2fd9b96f3b62fbddd28a546c6c7d3bda53a012819aa156", 0x7d}, {&(0x7f0000001400)="4f63d03a3e6fac011e54cf64745ffbd78accac3caa902a7cfde560c21e6eca54ac382ff9d4f466cac8821f61dafe7c2abc4f93310290", 0x36}, {&(0x7f0000001440)="d1c2d54f0bd6044cfe07963ed9a4fb1996f39f633aefff3d180edbf8ca3ad75366b6c92c0917f32abdcd28b1c31141424c174ce2a0feb84b14e78ab81885170b15be713f199f8665ba056acc4cb27219acc49b6079f4b47d93b86805c959b0bc9607b27686a1140dd990fdfa94aecf0f017835adc5987a69", 0x78}, {&(0x7f00000014c0)="26e7244375df999a419da7508fc28013a5b42622ac08fb707dfd6fddf63401c80d41d90aaad2d988ba56b611ede2be36a85c211204c0b23a830a185317b20827d3870173ce472b71c5821260858e19faca4abe8e8c", 0x55}], 0x9, 0x3, 0x2) semctl$GETZCNT(r0, 0x2, 0xf, &(0x7f0000001640)=""/249) ioctl$FS_IOC_GET_ENCRYPTION_POLICY_EX(0xffffffffffffffff, 0xc0096616, &(0x7f0000001740)={0x2, [0x0, 0x0]}) semget$private(0x0, 0x7, 0x200) semctl$IPC_RMID(0x0, 0x0, 0x0) 1m36.064969892s ago: executing program 4 (id=3849): socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000000)={'wlan0\x00'}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) close(0x3) bind$alg(r2, &(0x7f0000000540)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, 0x0, 0x0) accept4(r2, 0x0, 0x0, 0x0) sendto$inet(r1, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x0) recvfrom$inet(r1, &(0x7f0000000000)=""/8, 0xfffffffffffffd0b, 0x400123eb, 0x0, 0x1154103478d401ea) 1m35.955540599s ago: executing program 4 (id=3851): mkdir(&(0x7f00000020c0)='./file0\x00', 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x21c0, 0x103) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file2\x00', 0x0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) openat$sndseq(0xffffffffffffff9c, 0x0, 0x22803) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f00000001c0)='proc\x00', 0x810c03, 0x0) chroot(&(0x7f0000000100)='./file0\x00') ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000580)={0x0, 0x0}) r2 = socket$inet6(0xa, 0x80000, 0x0) futex(&(0x7f0000000180)=0x2, 0x0, 0x1, &(0x7f0000000080), 0x0, 0x2) sendmmsg$inet6(r2, &(0x7f0000000a00)=[{{&(0x7f0000000000)={0xa, 0x4e24, 0x3ff, @ipv4={'\x00', '\xff\xff', @local}, 0x6}, 0x1c, 0x0, 0x0, &(0x7f0000000300)=ANY=[@ANYRESDEC=r0, @ANYRESHEX=r1], 0x28}}, {{&(0x7f00000002c0)={0xa, 0x4e22, 0x6925, @remote, 0x7}, 0x1c, &(0x7f00000006c0)=[{&(0x7f0000000480)="aa6a207f4966d41f416d6df3", 0xc}, {&(0x7f00000004c0)="289c0dbc536655d4d1b11af3df1fc9885f0ddc550729e1fb6c10812221eb552ddee3f112250ea898213961984878317156939bf1de26ad02e3b9fad215e59f3559663494dad32a1d3c7f9df035d3d1fada030e369d762de70a1c7d9c0fa21e5f84e78044f909d5ab91551f6c3c452c50c16eb37aa480b10e4820d82f4ebb19f163a3286bc73493d237263555a5bf7731b5afb6439d", 0x95}, {&(0x7f0000000600)="a99bc0db8b0a4e17c5872d39bd14003c67e67d0764c7bdb020ad55047f321ba6d9e2d5f76a0d877cb88c4d2341a1ea61021a530cf263821b60870d90e190467b4326c7b2c1958c7d75e7c86836dfc51f33c14abf6cd99492384aa4e5ce111888342770968202f598f116c8f4cf82fe28ad682cdf1ebe7f24a9b1d066f20b328aa84684f33f22edd9bceecb9b9dc1c1e6108b82fb0bf1ddd1072208a0776b579a6e02c8b8ebf6897c748622977c409543a0ec2adf7b8ad0820ff673a46c", 0xbd}], 0x3, &(0x7f0000000780)=[@rthdrdstopts={{0xf8, 0x29, 0x37, {0x37, 0x1b, '\x00', [@hao={0xc9, 0x10, @local}, @ra={0x5, 0x2, 0xa}, @pad1, @jumbo={0xc2, 0x4, 0x84a5}, @generic={0x8, 0xbc, "57c2e96530b05230dfe38772ce74a892dd0ebb7300ff6f402e6be64d30dce84cdbcfa6feb60530d869dfdbd98d64157bafb51867a4c6af0b7d597091823c05b6c961a3e3ca01bee9ca83c56814315c4756264814efa0cc5401c8dfd4687795190c94c591d85b5b87b639966242ab229ab7cf9d851e05d1f3c3b9ea30f33a4c749272664b99ef9eb8e888357efc1b8b33b1f4ebf06a432a4f456c69f43f75cdf60965f6ab0c1033cb884f38787b963f1a8da79229d488abe86d79e985"}]}}}, @rthdr_2292={{0x98, 0x29, 0x39, {0x5e, 0x10, 0x2, 0x2, 0x0, [@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @private2={0xfc, 0x2, '\x00', 0x1}, @private1={0xfc, 0x1, '\x00', 0x1}, @empty, @loopback, @mcast2, @mcast2, @mcast1]}}}, @pktinfo={{0x24, 0x29, 0x32, {@remote}}}, @rthdr_2292={{0x38, 0x29, 0x39, {0x62, 0x4, 0x1, 0x7, 0x0, [@rand_addr=' \x01\x00', @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02']}}}, @dstopts={{0x60, 0x29, 0x37, {0x2, 0x8, '\x00', [@calipso={0x7, 0x30, {0x2, 0xa, 0x6, 0xfffa, [0x4, 0x6, 0x4, 0x2, 0x3]}}, @ra={0x5, 0x2, 0x7}, @enc_lim={0x4, 0x1, 0x31}, @ra={0x5, 0x2, 0x8}, @jumbo={0xc2, 0x4, 0x5}]}}}, @tclass={{0x14, 0x29, 0x43, 0x7}}], 0x268}}], 0x2, 0x90) syz_open_procfs(r1, &(0x7f0000000440)='io\x00') pivot_root(&(0x7f0000000080)='./file0/../file0\x00', &(0x7f0000000200)='./file0\x00') mount$bind(&(0x7f0000000040)='.\x00', &(0x7f00000003c0)='./file0\x00', 0x0, 0x2a05004, 0x0) mount$9p_tcp(0x0, 0x0, 0x0, 0x80, 0x0) r3 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r3, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder1\x00', 0x2, 0x0) r5 = openat$binfmt(0xffffffffffffff9c, 0x0, 0x42, 0x1ff) close(r5) execveat$binfmt(0xffffffffffffff9c, 0x0, 0x0, 0x0, 0x0) r6 = openat$binfmt(0xffffffffffffff9c, 0x0, 0x2, 0x0) close(r6) execveat$binfmt(0xffffffffffffff9c, 0x0, 0x0, 0x0, 0x0) execveat$binfmt(0xffffffffffffff9c, 0x0, &(0x7f0000000400)={[&(0x7f0000000000)='\x00', &(0x7f00000003c0)='#-}*[&-^!#-\x00']}, 0x0, 0x1000) r7 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$IOCTL_VMCI_GET_CONTEXT_ID(r7, 0x7b3, &(0x7f0000000040)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000380)=[@transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x39, 0x0, 0x0}) 1m35.876985849s ago: executing program 4 (id=3852): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000780)=ANY=[@ANYBLOB="48010000100001000000000000000000e00000020000000000000000000000000a010101000000000000000000000000000000004e2100"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ffffdfff0000000000000000000000000000000033000000fe8000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffffffffffff000000000000000000000000000004000000010000000000000000000a000000000000000000000048000100736861323536000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000048460000000000000000000000000008001d00000000000800220003"], 0x148}}, 0x0) (async) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x442, 0x1ff) close(r1) (async) rseq(&(0x7f0000000040)={0x0, 0x0, 0x0, 0x3}, 0x20, 0x0, 0x0) r2 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000540)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_control_io$printer(r2, 0x0, 0x0) r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$EVIOCGMASK(r3, 0x5b01, 0x0) execveat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x0, 0x0, 0x0) r4 = socket$nl_rdma(0x10, 0x3, 0x14) (async) r5 = socket$inet6_icmp(0xa, 0x2, 0x3a) bind$inet6(r5, 0x0, 0x0) (async) r6 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000040), 0x31001) ioctl$SNDRV_TIMER_IOCTL_SELECT(r6, 0x40345410, &(0x7f0000000300)={{0x0, 0x2, 0x3}}) (async) r7 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000600), 0x183c81) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r7, 0xc08c5332, &(0x7f00000003c0)={0x9c9, 0x0, 0x0, 'queue1\x00', 0x200000}) (async) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r7, 0x40605346, &(0x7f0000000280)={0x0, 0x0, {0x3}}) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r6, 0x40505412, &(0x7f00000000c0)={0x6, 0xffff81a4, 0x40, 0x0, 0xf}) (async) sendmsg$RDMA_NLDEV_CMD_PORT_GET(r4, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="300000000514000304000000fddbdf250800010002000000080003000000000008000100020000000800430004000000222f90e213b73d62c1"], 0x30}, 0x1, 0x0, 0x0, 0x404408d}, 0x20000000) 1m35.595765226s ago: executing program 4 (id=3853): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0xfa, 0x0, 0xe4}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='bbr', 0x3) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600)=0xdfa, 0x4) sendmmsg$inet(r0, &(0x7f0000004240)=[{{0x0, 0x0, &(0x7f0000001440)=[{&(0x7f00000011c0)="a2587becf7e1e085649ac6104204d09ecb05a13f146abe945049f4aed9c9a8f72403f43f534b88eb66ed092b4a78e4344ec26b04c7fb5f4fb5e9a591f786f632", 0x40}], 0x1}}, {{0x0, 0x0, &(0x7f00000019c0)=[{&(0x7f0000001780)="d1ef1bb59f70ec9b719b1589c8f3d0678afd96", 0x13}, {&(0x7f00000017c0)="dad5b14f2f8f950502cf2880", 0xc}, {&(0x7f0000001800)="e9d7b200bf6ecf325e1a9c0dccd8c357998ad687717f392aab546e2ad010fb16c3120d5c20a62654dfa7da737faea449d323a40f6b39ce3ccea07331a90678979abfde57efde701f4c14b7897b8ef0530b2eecee7536d3c0186c646980b6c78eaf6f4d9d55d211f1d5a38fe9f95f95e72127a07b02bd5f5b3bcb265680ae107e6cf387fb56fca7ecd4e7257f1dc5a9ac14a40036a3f8675e691f6f6e9067617ffa6045157cf5b7562f68838b5e13843d24469663f76355633256edfdebaeee1320c3303b3d6a06113505045fb3ec9be769234a276ebec1707dae5cde125d22383405763a724ee1cfe93b3d4542c820725eddbe4be04ea031d732", 0xfa}, {&(0x7f0000001900)="8d70e326292a261d6ca941faf3ba88cde8f3f0ca51f1f4f3513ef8a82be6d9e2bad67c0a7a216788451d6641dcdedf7b1cc6d649900d5cd0d53094cfa788f6", 0x3f}], 0x4}}, {{0x0, 0x0, &(0x7f0000001d00)=[{&(0x7f0000001ac0)="6c5b0b3e474f01bac640e7eb9064ec8e2ccac8b36c7d9ab464dc0bd7221bbae89e38ef0efc78f3e2f90e6236ad1ad1fb3dbd3e4fd8f2de84e526dfafb354837ff3958d97c8366471850ce9c14b83bb6e9a7c282a1d3e03cdfb675b61e1dbacc6ebcd08e105d4df684f2cd13262d10ffb8b0794f39b3e490416530423da29406a6a4b5a356dc898052883f1e54fd041e5a82247a4bbb784ce30ce321a2805b28d30", 0xa1}, {&(0x7f0000001b80)="66a7d24b8451d3e0201a73aaabe1e3fe371dfbf029efdbc2de3742c687d72207cab9988bc15b9e27135be8e1d84bbeb01ccf943eb163a18b6a02c752c829c5f24ccd2c02f1c208e64deb4d916ff1727fe172", 0x52}, {&(0x7f0000001c00)="811e3e8966b4199496dc8329eca81fa24aedba0078949553b10b0df3cc25de83324cb3fb6672cbb763e260abad0adca5ab04cf5988b6c9a912e96ba01b3508998595bfad50323f42fa943adb8d0324801ae6efa1e3", 0x55}], 0x3}}, {{0x0, 0x0, &(0x7f0000004180)=[{&(0x7f0000002f00)="5f97b46d7adb8b68ff35da0f147fef1c6c6c60db5c1fb54496a27c9eeb14cf97ceed1ac5e9d95d093d6400f4996e3c5f73fa7edad49015f697bdc1a17f731cd7b4e404954a2fbc069f73e9fa86cab27babb16a9004571326e20d84cb662973ba616c4ba4126e45ad1a7230b6c86c600a3dd01872c0f5823fadc0eb8b73f3d98c63881cd2131d63411f51e40a122182507d2d4be44f5fdec44f415e3448ebda832a6831bbd48324e11fe96400d92fae40f4a9ed9f376c56e6c6c703fe76dac9c3b4aed05a81b2b2adadc3e2ba8fd5cfc361420e61014782eeb5a921fd042bdc9cbfff5dac3df5711d5710e1d0a11d6e637dddd79ccd700dbc4924e22f8a50f0f43b6082b706c748e6d552178aa8d5959d8a3a175bf1d2b61b363fbad94b53505fb7ac302a0dec14a19141120d958b484f6e5e6f087267680eecfc91d11295a6bbd062cb7c99299681481a9ee65f157852aa46b21936e52611dbd9a8019b7566ec79b5fe8db94259c20842af9384aaf33dfafd15bb97d051743f467399caa4ee74394664c3de94449b4597bb90787c75a468f320be5e8faa11d13b589231eca2f9f4072cd44f0a1cbc874233a71901f5e027fc301caeadbe77f76206257f006e483b6b78b9319b57399a0f736f01df368726ee362c6224aaef36cff42bf221a2e03fb153bcdc240b594b22a043adc163f9004ed1ef0f152f0d960a58a18d709236df500abd672436b916c67c7e6fe7508530fe05b040c7cbeb2645f43259f3a142583a3051ea146281b901f732ba819f84050007c5f07e3848ddb7de602171525c7df8427475137a845796f12214b69dc7fb8cd458e9f2fac518b9dc84da1a13d8e95eb32cf4c14d2647b6e8bd808a91d258da905bac6e87ef6485e19ba85442c12b15c2fe95f5da8fd93f3b0c080703626eb7213954f38bdb5806393b0394532a886d896bed1b964984ba35de5de4674eab5e97312b6331fec90b0e9ad08cbb564d73a0428a", 0x2c5}, {&(0x7f0000003f00)="1f4af8fed7be58fd8686039093816fed8bf780c28e9a3e381dc0823276cb353324cbbad17108c2ad8e4946bc715057581728500e074e757687d75fe12890941341bf811dbc105949cabdb27ed4ae27fe50777d312307fc0c04ab7f7d4f968803d5bc4b5cc680b3a19aaefaa9732507680a8a20e345a4b33dfa18ee960931a539ac0c2b4b612bb28ec51ff4eb27b2622fad3d3dcb03f588ffb8ccf60cb2a2911435c978591f348959cf65d98788", 0xad}, {&(0x7f0000004000)="e4a979bc13e5ab701983256e", 0xc}, {&(0x7f0000004080)="e3f6b565db913652c092094a86c4b5a91acd35f6ddc50b99965b4d30bd2f08fae8a65f51c43b04efe10753719f42e035c70becaf563fdba9d11ae1ea7b1455506195fc159029c2c154efe0d3c9c43212720fd37317f13a7d07338ff66b6e554923856d6fba076ff9c5bde30d552863729ab6ae67d9531250b7d00ec881d7fd18770f5f2f52521017188b8c70552f1d1df1704112e79ff83070dfa4ca8398d327e61a4532f17ff9b57e05f8e88d5dd3361ddab994e782364e195840", 0xbb}, {&(0x7f0000004140)="439533884cc70bf474149df1e64c390eea64c9f8dd7bf2a498db9902c5102ac290381bd6", 0x24}], 0x5}}], 0x4, 0x40000) 1m35.314303109s ago: executing program 33 (id=3853): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0xfa, 0x0, 0xe4}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='bbr', 0x3) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600)=0xdfa, 0x4) sendmmsg$inet(r0, &(0x7f0000004240)=[{{0x0, 0x0, &(0x7f0000001440)=[{&(0x7f00000011c0)="a2587becf7e1e085649ac6104204d09ecb05a13f146abe945049f4aed9c9a8f72403f43f534b88eb66ed092b4a78e4344ec26b04c7fb5f4fb5e9a591f786f632", 0x40}], 0x1}}, {{0x0, 0x0, &(0x7f00000019c0)=[{&(0x7f0000001780)="d1ef1bb59f70ec9b719b1589c8f3d0678afd96", 0x13}, {&(0x7f00000017c0)="dad5b14f2f8f950502cf2880", 0xc}, {&(0x7f0000001800)="e9d7b200bf6ecf325e1a9c0dccd8c357998ad687717f392aab546e2ad010fb16c3120d5c20a62654dfa7da737faea449d323a40f6b39ce3ccea07331a90678979abfde57efde701f4c14b7897b8ef0530b2eecee7536d3c0186c646980b6c78eaf6f4d9d55d211f1d5a38fe9f95f95e72127a07b02bd5f5b3bcb265680ae107e6cf387fb56fca7ecd4e7257f1dc5a9ac14a40036a3f8675e691f6f6e9067617ffa6045157cf5b7562f68838b5e13843d24469663f76355633256edfdebaeee1320c3303b3d6a06113505045fb3ec9be769234a276ebec1707dae5cde125d22383405763a724ee1cfe93b3d4542c820725eddbe4be04ea031d732", 0xfa}, {&(0x7f0000001900)="8d70e326292a261d6ca941faf3ba88cde8f3f0ca51f1f4f3513ef8a82be6d9e2bad67c0a7a216788451d6641dcdedf7b1cc6d649900d5cd0d53094cfa788f6", 0x3f}], 0x4}}, {{0x0, 0x0, &(0x7f0000001d00)=[{&(0x7f0000001ac0)="6c5b0b3e474f01bac640e7eb9064ec8e2ccac8b36c7d9ab464dc0bd7221bbae89e38ef0efc78f3e2f90e6236ad1ad1fb3dbd3e4fd8f2de84e526dfafb354837ff3958d97c8366471850ce9c14b83bb6e9a7c282a1d3e03cdfb675b61e1dbacc6ebcd08e105d4df684f2cd13262d10ffb8b0794f39b3e490416530423da29406a6a4b5a356dc898052883f1e54fd041e5a82247a4bbb784ce30ce321a2805b28d30", 0xa1}, {&(0x7f0000001b80)="66a7d24b8451d3e0201a73aaabe1e3fe371dfbf029efdbc2de3742c687d72207cab9988bc15b9e27135be8e1d84bbeb01ccf943eb163a18b6a02c752c829c5f24ccd2c02f1c208e64deb4d916ff1727fe172", 0x52}, {&(0x7f0000001c00)="811e3e8966b4199496dc8329eca81fa24aedba0078949553b10b0df3cc25de83324cb3fb6672cbb763e260abad0adca5ab04cf5988b6c9a912e96ba01b3508998595bfad50323f42fa943adb8d0324801ae6efa1e3", 0x55}], 0x3}}, {{0x0, 0x0, &(0x7f0000004180)=[{&(0x7f0000002f00)="5f97b46d7adb8b68ff35da0f147fef1c6c6c60db5c1fb54496a27c9eeb14cf97ceed1ac5e9d95d093d6400f4996e3c5f73fa7edad49015f697bdc1a17f731cd7b4e404954a2fbc069f73e9fa86cab27babb16a9004571326e20d84cb662973ba616c4ba4126e45ad1a7230b6c86c600a3dd01872c0f5823fadc0eb8b73f3d98c63881cd2131d63411f51e40a122182507d2d4be44f5fdec44f415e3448ebda832a6831bbd48324e11fe96400d92fae40f4a9ed9f376c56e6c6c703fe76dac9c3b4aed05a81b2b2adadc3e2ba8fd5cfc361420e61014782eeb5a921fd042bdc9cbfff5dac3df5711d5710e1d0a11d6e637dddd79ccd700dbc4924e22f8a50f0f43b6082b706c748e6d552178aa8d5959d8a3a175bf1d2b61b363fbad94b53505fb7ac302a0dec14a19141120d958b484f6e5e6f087267680eecfc91d11295a6bbd062cb7c99299681481a9ee65f157852aa46b21936e52611dbd9a8019b7566ec79b5fe8db94259c20842af9384aaf33dfafd15bb97d051743f467399caa4ee74394664c3de94449b4597bb90787c75a468f320be5e8faa11d13b589231eca2f9f4072cd44f0a1cbc874233a71901f5e027fc301caeadbe77f76206257f006e483b6b78b9319b57399a0f736f01df368726ee362c6224aaef36cff42bf221a2e03fb153bcdc240b594b22a043adc163f9004ed1ef0f152f0d960a58a18d709236df500abd672436b916c67c7e6fe7508530fe05b040c7cbeb2645f43259f3a142583a3051ea146281b901f732ba819f84050007c5f07e3848ddb7de602171525c7df8427475137a845796f12214b69dc7fb8cd458e9f2fac518b9dc84da1a13d8e95eb32cf4c14d2647b6e8bd808a91d258da905bac6e87ef6485e19ba85442c12b15c2fe95f5da8fd93f3b0c080703626eb7213954f38bdb5806393b0394532a886d896bed1b964984ba35de5de4674eab5e97312b6331fec90b0e9ad08cbb564d73a0428a", 0x2c5}, {&(0x7f0000003f00)="1f4af8fed7be58fd8686039093816fed8bf780c28e9a3e381dc0823276cb353324cbbad17108c2ad8e4946bc715057581728500e074e757687d75fe12890941341bf811dbc105949cabdb27ed4ae27fe50777d312307fc0c04ab7f7d4f968803d5bc4b5cc680b3a19aaefaa9732507680a8a20e345a4b33dfa18ee960931a539ac0c2b4b612bb28ec51ff4eb27b2622fad3d3dcb03f588ffb8ccf60cb2a2911435c978591f348959cf65d98788", 0xad}, {&(0x7f0000004000)="e4a979bc13e5ab701983256e", 0xc}, {&(0x7f0000004080)="e3f6b565db913652c092094a86c4b5a91acd35f6ddc50b99965b4d30bd2f08fae8a65f51c43b04efe10753719f42e035c70becaf563fdba9d11ae1ea7b1455506195fc159029c2c154efe0d3c9c43212720fd37317f13a7d07338ff66b6e554923856d6fba076ff9c5bde30d552863729ab6ae67d9531250b7d00ec881d7fd18770f5f2f52521017188b8c70552f1d1df1704112e79ff83070dfa4ca8398d327e61a4532f17ff9b57e05f8e88d5dd3361ddab994e782364e195840", 0xbb}, {&(0x7f0000004140)="439533884cc70bf474149df1e64c390eea64c9f8dd7bf2a498db9902c5102ac290381bd6", 0x24}], 0x5}}], 0x4, 0x40000) 1m16.732243065s ago: executing program 2 (id=3995): mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./file1\x00', 0x100) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f0000000000)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000380)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) chdir(&(0x7f0000000140)='./bus\x00') r0 = open(&(0x7f0000000580)='./bus\x00', 0x84242, 0x1df2a23c5997fa5f) write$FUSE_CREATE_OPEN(r0, &(0x7f0000000180)={0xa0, 0xffffffffffffffda, 0x0, {{0x4, 0x6040000, 0x5, 0x7, 0x3, 0xfffffffd, {0x400000080001, 0xfd, 0x20ff, 0x8, 0xe, 0xd615, 0x9, 0x3, 0xfffffffc, 0x6000, 0x0, 0x0, 0x0, 0x5, 0x7}}, {0x0, 0x13}}}, 0xa0) 1m16.549534943s ago: executing program 2 (id=3997): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000040)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="1709000000000000000001000000050007000000000008000900fffffffe060002000000000008000a000100000008001800ac1414aa08001900"], 0x58}}, 0x0) r2 = syz_usbip_server_init(0x1) syz_usb_connect(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120100006325a640402000207265970000010902"], 0x0) write$usbip_server(r2, &(0x7f00000000c0)=ANY=[@ANYBLOB="0000000300000001"], 0x35) 1m15.16355916s ago: executing program 2 (id=4008): r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x400, 0x0) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f00000000c0)={'dt2801\x00', [0x4fa7, 0x102, 0x2, 0x10000421, 0x1, 0xcc7, 0x7ffffffe, 0xa, 0x5, 0x3ff, 0x0, 0x300, 0x81, 0x6, 0x9, 0x1, 0x40400, 0x8, 0x4, 0x8001fe, 0x80000089, 0xa, 0x1400000, 0x20001e56, 0xffffeadb, 0x0, 0x3f, 0x8, 0x4, 0x7ffffff, 0x800000]}) ioctl$XFS_IOC_PATH_TO_FSHANDLE(r0, 0xc0385868, 0x0) r1 = syz_usb_connect$uac2(0x3, 0x8f, &(0x7f0000000400)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x20, 0xdba, 0x1000, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x7d, 0x3, 0x1, 0x6, 0x10, 0x2, {0x8, 0xb, 0x1, 0x0, 0x1, 0xc}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0xff80, 0x7, 0x1d, 0x4}, [@output_terminal={0xc, 0x24, 0x3, 0x2, 0x304, 0x5, 0x4, 0x0, 0x1ff, 0x1c}, @source_unit={0x8, 0x24, 0xa, 0x4, 0x2, 0x95, 0x5, 0x1}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x10, 0xc, 0x2, 0x9, {0x8, 0x25, 0x1, 0x80, 0x30, 0xad, 0x100}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x20, 0x2, 0xfa, 0xbc, {0x8, 0x25, 0x1, 0x2, 0xfa4024f26d164786, 0x81, 0x9}}}}}}}}]}}, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, 0x0) syz_usb_control_io$uac2(r1, &(0x7f0000000640)={0x14, 0x0, &(0x7f0000000600)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x446}}}, 0x0) syz_usb_control_io$uac2(r1, &(0x7f0000000c40)={0x14, 0x0, &(0x7f0000000c00)={0x0, 0x3, 0x23, @string={0x23, 0x3, "95c2212b0e74415c1e713e41211a3c41e8f49481e045c38fab449953d942da9b38"}}}, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0xa, 0x8000000000002}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000180)={{0x1, 0x1, 0x18, r0, {0x7}}, './file0\x00'}) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x1) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r5 = dup3(r4, r2, 0x0) r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r6, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r6, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001040)={0x4c, 0x0, &(0x7f0000000ec0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000740)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x400}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000900)={0x4c, 0x0, &(0x7f00000007c0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f00000002c0)={0x30, 0x30, 0x30}}, 0x400}], 0x0, 0x0, 0x0}) syz_emit_vhci(&(0x7f0000000240)=ANY=[@ANYBLOB="041c0500c9000066bd4027451f9da30e3e00"], 0x8) 1m13.519928194s ago: executing program 2 (id=4018): r0 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) sendmsg$NL80211_CMD_NEW_MPATH(r0, &(0x7f0000000940)={&(0x7f0000000840), 0xc, &(0x7f0000000440)={&(0x7f00000000c0)=ANY=[], 0x14}, 0x1, 0x0, 0x0, 0x4040889}, 0x4000) mkdir(&(0x7f00000020c0)='./file0\x00', 0x0) r1 = inotify_init1(0x800) ioctl$INOTIFY_IOC_SETNEXTWD(r1, 0x541b, 0x5) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f00000001c0)='proc\x00', 0x810c03, 0x0) chroot(&(0x7f0000000100)='./file0\x00') mount$bind(&(0x7f0000000040)='.\x00', &(0x7f00000003c0)='./file0\x00', 0x0, 0x2a05004, 0x0) pivot_root(&(0x7f0000000280)='./file0\x00', &(0x7f0000000180)='./file0/../file0\x00') ioctl$sock_SIOCINQ(r0, 0x541b, &(0x7f0000000040)) 1m13.468613744s ago: executing program 2 (id=4019): sched_setattr(0x0, &(0x7f0000000040)={0x95, 0x0, 0x21, 0x3, 0xfffffffe, 0x236, 0x800000000009, 0x8, 0xd861, 0x3}, 0x0) r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_SYS_SET(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="18000000071401000000000000000000050060"], 0x18}}, 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x15d) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f00000001c0)='proc\x00', 0x810c03, 0x0) chroot(&(0x7f0000000100)='./file0\x00') mount$bind(&(0x7f0000000040)='.\x00', &(0x7f00000003c0)='./file0\x00', 0x0, 0x2a05004, 0x0) chroot(&(0x7f0000000000)='./file0/../file0\x00') r1 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f00000000c0), 0x80000, 0x0) r2 = open$dir(&(0x7f0000000240)='./file0/../file0\x00', 0x10000, 0x20) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETRULE(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000680)=ANY=[@ANYBLOB="48000000070a050000000000000000000a0040010900010073797a31000000000900020073797a32"], 0x48}, 0x1, 0x0, 0x0, 0x20040850}, 0x4004014) file_getattr(r1, &(0x7f0000000300)='./file0/../file0\x00', &(0x7f0000000340), 0x18, 0x1000) renameat2(r1, &(0x7f0000000200)='./file0/../file0\x00', r2, &(0x7f00000002c0)='./file0/file0\x00', 0x3) pivot_root(&(0x7f0000000280)='./file0\x00', &(0x7f0000000180)='./file0/../file0\x00') 1m13.231666496s ago: executing program 2 (id=4020): r0 = semget$private(0x0, 0x2, 0x0) semget(0x1, 0x5, 0x0) r1 = openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) pwritev(r1, &(0x7f0000001580)=[{&(0x7f0000000140)="368aabc5889d2352eddb42586e7fb247f644da5e135319cef23741019a2990005923acfe3f3c331c3f95d263b5ca225053459e2c3130f892fdb399ca1df1709e65ec7e571df8e7115811c23b3ac433b47ef9ac8bdd41122bc8694dc006419bfc1731d4306de296966d67ae94f75ea6d640b31bb0a66b9b49b708d54a1957e380983342ff5c62a1efc238ac1291fc37cd8fc4f3441684dbf45f0d1f4db25c189519c22cd54d", 0xa5}, {&(0x7f0000000200)="878b808a79f57124fb869940898364ab1570587ac82c042be5228d3e3100a5ed792b6efff632189f51567f3c4583ebe34054dfb27b652f6f7e5879fd30253c009b26292b4e76f7944c509f317ce89ab59af2829adb4741b932f8c9525b69031923443724d366e0ea7f16ec47b950d1adb5bde7", 0x73}, {&(0x7f0000000280)="ac390c71dba8c339807404ee413d4a9d304cf9ea4c6e8d9e765d9b63a3bf5b0455cee6640d49ce67ff47936c64bfe36ccecda5fd7438120bde93e3b1b89c17", 0x3f}, {0x0}, {0x0}, {0x0}, {&(0x7f0000001400)="4f63d03a3e6fac011e54cf64745ffbd78accac3caa902a7cfde560c21e6eca54ac382ff9d4f466cac8821f61dafe7c2abc4f933102900ab8ae", 0x39}, {&(0x7f0000001440)="d1c2d54f0bd6044cfe07963ed9a4fb1996f39f633aefff3d180edbf8ca3ad75366b6c92c0917f32abdcd28b1c31141424c174ce2a0feb84b14e78ab81885170b15be713f199f8665ba056acc4cb27219acc49b6079f4b47d93b86805c959b0bc9607b27686a1140dd990fdfa94aecf0f017835adc5987a69", 0x78}, {&(0x7f00000014c0)="26e7244375df999a419da7508fc28013a5b42622ac08fb707dfd6fddf63401c80d41d90aaad2d988ba56b611ede2be36a85c211204c0b23a830a185317b20827d3870173ce472b71c5821260858e19faca4abe8e8c", 0x55}], 0x9, 0x3, 0x2) semctl$GETZCNT(r0, 0x2, 0xf, &(0x7f0000001640)=""/249) ioctl$FS_IOC_GET_ENCRYPTION_POLICY_EX(0xffffffffffffffff, 0xc0096616, &(0x7f0000001740)={0x2, [0x0, 0x0]}) semget$private(0x0, 0x7, 0x200) semctl$IPC_RMID(0x0, 0x0, 0x0) 1m12.969271466s ago: executing program 34 (id=4020): r0 = semget$private(0x0, 0x2, 0x0) semget(0x1, 0x5, 0x0) r1 = openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) pwritev(r1, &(0x7f0000001580)=[{&(0x7f0000000140)="368aabc5889d2352eddb42586e7fb247f644da5e135319cef23741019a2990005923acfe3f3c331c3f95d263b5ca225053459e2c3130f892fdb399ca1df1709e65ec7e571df8e7115811c23b3ac433b47ef9ac8bdd41122bc8694dc006419bfc1731d4306de296966d67ae94f75ea6d640b31bb0a66b9b49b708d54a1957e380983342ff5c62a1efc238ac1291fc37cd8fc4f3441684dbf45f0d1f4db25c189519c22cd54d", 0xa5}, {&(0x7f0000000200)="878b808a79f57124fb869940898364ab1570587ac82c042be5228d3e3100a5ed792b6efff632189f51567f3c4583ebe34054dfb27b652f6f7e5879fd30253c009b26292b4e76f7944c509f317ce89ab59af2829adb4741b932f8c9525b69031923443724d366e0ea7f16ec47b950d1adb5bde7", 0x73}, {&(0x7f0000000280)="ac390c71dba8c339807404ee413d4a9d304cf9ea4c6e8d9e765d9b63a3bf5b0455cee6640d49ce67ff47936c64bfe36ccecda5fd7438120bde93e3b1b89c17", 0x3f}, {0x0}, {0x0}, {0x0}, {&(0x7f0000001400)="4f63d03a3e6fac011e54cf64745ffbd78accac3caa902a7cfde560c21e6eca54ac382ff9d4f466cac8821f61dafe7c2abc4f933102900ab8ae", 0x39}, {&(0x7f0000001440)="d1c2d54f0bd6044cfe07963ed9a4fb1996f39f633aefff3d180edbf8ca3ad75366b6c92c0917f32abdcd28b1c31141424c174ce2a0feb84b14e78ab81885170b15be713f199f8665ba056acc4cb27219acc49b6079f4b47d93b86805c959b0bc9607b27686a1140dd990fdfa94aecf0f017835adc5987a69", 0x78}, {&(0x7f00000014c0)="26e7244375df999a419da7508fc28013a5b42622ac08fb707dfd6fddf63401c80d41d90aaad2d988ba56b611ede2be36a85c211204c0b23a830a185317b20827d3870173ce472b71c5821260858e19faca4abe8e8c", 0x55}], 0x9, 0x3, 0x2) semctl$GETZCNT(r0, 0x2, 0xf, &(0x7f0000001640)=""/249) ioctl$FS_IOC_GET_ENCRYPTION_POLICY_EX(0xffffffffffffffff, 0xc0096616, &(0x7f0000001740)={0x2, [0x0, 0x0]}) semget$private(0x0, 0x7, 0x200) semctl$IPC_RMID(0x0, 0x0, 0x0) 6.880791132s ago: executing program 6 (id=4581): sysfs$3(0x3) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) r0 = open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) sendfile(r1, r0, 0x0, 0x80001d00c0d0) socketpair(0x23, 0x5, 0x800, &(0x7f0000000000)) 6.74746781s ago: executing program 6 (id=4582): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000201b4510fc0428155d6d010203010902", @ANYRES16=r0, @ANYRES32=r0], 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000100), r1) sendmsg$TIPC_CMD_SHOW_STATS(r1, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x1c, r2, 0x6, 0x70bd25, 0xf, {}, ["", "", "", "", "", "", "", "", ""]}, 0x1c}}, 0x1) syz_usb_connect$midi(0x0, 0x110, &(0x7f0000000200)={{0x12, 0x1, 0x250, 0x0, 0x0, 0x0, 0x8, 0xe41, 0x3061, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xfe, 0x1, 0x1, 0x9, 0x20, 0x7f, "", {{{0x9, 0x4, 0x0, 0x0, 0x7, 0x1, 0x3, 0x20, 0x8, [@midi_in_jack={0x6, 0x24, 0x2, 0x2, 0x6, 0xcc}, @midi_out_jack={0x13, 0x24, 0x3, 0x3, 0xa8, 0x6, [{0xf, 0xfe}, {0x2, 0x5}, {0xb, 0x1}, {0x5, 0x18}, {0x5, 0x4}, {0xd, 0x81}], 0x8}, @ms_header={0x7, 0x24, 0x1, 0x8000, 0x7}, @midi_in_jack={0x6, 0x24, 0x2, 0x0, 0x75, 0x42}, @ms_header={0x7, 0x24, 0x1, 0x8, 0x7}, @midi_out_jack={0xb, 0x24, 0x3, 0x3, 0x1, 0x2, [{0x81}, {0x2, 0x44}], 0x4}, @midi_out_jack={0x1b, 0x24, 0x3, 0x1, 0x3, 0xa, [{0x80, 0x8}, {0x9}, {0x4, 0x7}, {0x6, 0x9}, {0x4, 0x3}, {0x8, 0x5}, {0x53, 0x31}, {0x2}, {0x8, 0x6}, {0x6, 0xac}], 0xf6}, @ms_header={0x7, 0x24, 0x1, 0x8, 0x7}], [{{0x9, 0x5, 0x1f, 0x1, 0x400, 0x4, 0x6, 0x7, {0x8, 0x25, 0x1, 0x4, "0298e2a9"}}}, {{0x9, 0x5, 0x1, 0x3, 0x3ff, 0x81, 0xb7, 0x40, {0x6, 0x25, 0x1, 0x2, "5404"}}}, {{0x9, 0x5, 0x80, 0x4, 0x10, 0x6, 0x9, 0x5, {0xf, 0x25, 0x1, 0xb, "cff796d3d8abb4b1d3ceeb"}}}, {{0x9, 0x5, 0x80, 0x10, 0x400, 0x8, 0x4, 0x4, {0xe, 0x25, 0x1, 0xa, "90b647e3160d49e52ac6"}}}, {{0x9, 0x5, 0x0, 0x10, 0x200, 0x9, 0xff, 0xfe, {0xb, 0x25, 0x1, 0x7, "35993f2bceb3e5"}}}, {{0x9, 0x5, 0x1, 0x0, 0x20, 0xd3, 0x63, 0x1, {0xa, 0x25, 0x1, 0x6, "5f2531d79d15"}}}, {{0x9, 0x5, 0x8, 0xc, 0x200, 0x6, 0x3, 0x3e, {0x13, 0x25, 0x1, 0xf, "59177d591d2aa892ca4cfc233549cf"}}}]}}}}}]}}, &(0x7f0000000440)={0xa, &(0x7f0000000340)={0xa, 0x6, 0x200, 0x4, 0x2, 0x5, 0x0, 0x5}, 0x16c, &(0x7f0000000580)={0x5, 0xf, 0x16c, 0x5, [@ext_cap={0x7, 0x10, 0x2, 0x2, 0x4, 0x4, 0x2}, @generic={0x5e, 0x10, 0x3, "1c81ab7877481ce7623bc27bf70d2b9116a85a05bed63492a85782d960ed200e2164f163b8ab2920905390257ac02cb56ca0c073c034565d64dffc1ffcba326834e63d592eecd4e496ba1ac2ad32cda95500591f22227f5ea06abc"}, @generic={0x11, 0x10, 0x8, "d3f2b674b6222d069c3680de8a3b"}, @generic={0xe6, 0x10, 0x1, "1bba762b9cc78fbbc14e3c340a9dde8b0f6b191d75b6b2a6e37c2e6f9c21e7c7714ec0def2efb9e3bed78f5c463e585527e55f0807bb45724c7237e4044f499811dbcebacee567ec22c841ba88a60fd75d8a9cfc061d651ff5922cbc63c9f269570bda3898fb3b39ca267b67714f90a5597b5d25bf0e3e2b033c787c9bab904cb04ceb6b13d2c0b453a2d22d3b1a3f6c5a1416cf0cf9a50e3bfdcef2fb66652d48172315707fd3a9049c08b4500b1776daea66b6be93e12185595c96728647a1b459ba07556086fc4e589e3522e22339389b44ad891190c9e809853a623d002cff47ca"}, @wireless={0xb, 0x10, 0x1, 0xc, 0x0, 0xf, 0xc6, 0x3, 0x2}]}, 0x2, [{0x5, &(0x7f0000000380)=@string={0x5, 0x3, "ba27eb"}}, {0x4, &(0x7f0000000400)=@lang_id={0x4, 0x3, 0x40f}}]}) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f00000004c0), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_FLUSH(r1, &(0x7f0000000880)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000840)={&(0x7f0000000700)={0x124, r4, 0x400, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NODE={0xb0, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x6}, @TIPC_NLA_NODE_KEY={0x43, 0x4, {'gcm(aes)\x00', 0x1b, "94205f7d1554b85d9301dedc4e343abe58480363270daf01a34712"}}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x5}, @TIPC_NLA_NODE_KEY={0x3d, 0x4, {'gcm(aes)\x00', 0x15, "d788eba1fcfcf0160d591e807c208764583196ebad"}}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x2}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x7f}]}, @TIPC_NLA_SOCK={0x60, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x7fff}, @TIPC_NLA_SOCK_CON={0x44, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0xeca3}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x5}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x2}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0xecc9}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x415f055a}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x10000}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x18000}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x7}]}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x8d7}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x9e06}]}]}, 0x124}, 0x1, 0x0, 0x0, 0x10}, 0x4) r5 = socket$inet(0xa, 0x801, 0x84) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r7 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) writev(r6, &(0x7f0000000480)=[{&(0x7f0000000080)="2e9b5b0007e03dd65193dfb6c575963f86dd", 0x12}, {&(0x7f00000004c0)="b70000000180", 0x6}, {&(0x7f0000000200)="06000000750d08c4daf10a7742e39e31ceefb1fcd2e5bc3fc84150da0d1787cc10d211447da94cb715e462877318612235a604082c42a4b9c311", 0x3a}], 0x3) connect$inet(r5, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r5, 0x8) r8 = accept4(r5, 0x0, 0x0, 0x800) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r8, 0x84, 0x73, &(0x7f0000000180)={0x0, 0x4, 0x20, 0x7, 0x63b6}, &(0x7f00000001c0)=0x18) sendmsg$ETHTOOL_MSG_WOL_GET(r1, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000003c0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010027bd7000fbdbdf25090000001c0001801400020067656e65766531000000000000000000"], 0x2c}, 0x1, 0x0, 0x0, 0x20000000}, 0x4008000) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, 0x0) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, 0x0) r9 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000008c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_DESTROY$ioas(r0, 0x3b80, &(0x7f0000000900)={0x8, r10}) ioctl$HCIINQUIRY(r9, 0x800448f0, &(0x7f0000000000)={0x3, 0xed, "5301ad", 0x2, 0x7f}) 5.169439425s ago: executing program 0 (id=4589): r0 = syz_usb_connect(0x0, 0x24, &(0x7f00000001c0)=ANY=[@ANYBLOB="12010000b5403340861a227536350102030109021200010000000009"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000740)={0x84, &(0x7f0000000200)=ANY=[@ANYBLOB="400f02000000602f61cb0759f3cc3ebcf7d81d66069baf4f5e0dc4f9423e5fb3babeb2102dac6888f19d7f5fecf41a88be137c669e08ce6eadf4783a673e8bed6676bfdd8f7e6291c4cc03c20aec82459b8797d1ae88a3f8fc1dfbb3eea2dad008e270761ebec1713c4a3ba08da9993d176d1ab1dc04bfbb201de246e7f8371d866d9d97f723bba9c3b8bf52c990ce43edd4309b843cb5c6267287076689daf926e51ca921064bcebde00700655bba674c713af29cfe0f3e0e8be3b484d7ffbc30a76ff9aaba61eb82f6bc4d477fcd8a3eeba4bc4015dd0944fb4532eeefa628287e96a4d2357c15"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, &(0x7f0000000100)={0x14, &(0x7f0000000300)={0x0, 0xf, 0x8e, {0x8e, 0x8, "374d146309a0e68a6a4c42d9d93f53053d2565f975fee21d3bb162837cdbad4c8660b92d99b7a1f93c774a591f178164b37772575efa2042ee401801d4ae4b44e5c67e5788e576b4d7372eb0e947b8afc3a401d0542d4b2937d6f78e931b5a059974e189da8196ad028b62c3fc537e7d05ed8ab929dfe48d2477eb9838c4617c1783e6b7199252d3c0243bf1"}}, &(0x7f0000000080)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000440)={0x1c, &(0x7f0000000140)={0x20, 0xf, 0x17, "a175d731b8026874d24e23c40e320bb37c78daae50c5ed"}, &(0x7f00000003c0)={0x0, 0xa, 0x1, 0xf}, &(0x7f0000000400)={0x0, 0x8, 0x1, 0x5}}) 3.295890585s ago: executing program 6 (id=4599): open(&(0x7f0000000100)='./bus\x00', 0x143142, 0xa2) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(0xffffffffffffffff, 0x40045532, &(0x7f0000000100)) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0xf88e470f, 0xed}]}) r0 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0xc45, 0x9, 0xfffffffffffffffd, 0x0, 0x10003, 0x3, 0x4002004c2, 0x7ff, 0x9, 0x6, 0x400, 0x80, 0x88, 0x0, 0x3, 0x8d], 0x100000, 0x2c08c6}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 3.149263422s ago: executing program 6 (id=4602): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00'}) socket$nl_generic(0x10, 0x3, 0x10) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(0xffffffffffffffff, 0xc0189378, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0, {0xffffffffffffffff}}, './file0\x00'}) sendmsg$IPSET_CMD_HEADER(r1, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x28, 0xc, 0x6, 0x703, 0x0, 0x0, {0x8, 0x0, 0x4}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x28}, 0x1, 0x0, 0x0, 0x8080}, 0x4840) syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff) socket$nl_netfilter(0x10, 0x3, 0xc) setsockopt$packet_int(r1, 0x107, 0x14, &(0x7f00000001c0)=0x2, 0x4) shmctl$SHM_LOCK(0x0, 0xb) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_INFO(r1, 0xc08c5334, &(0x7f00000004c0)={0x6, 0x2, 0x0, 'queue1\x00', 0x6}) r2 = syz_usb_connect(0x3, 0x24, &(0x7f0000000280)=ANY=[@ANYBLOB="12010000d3750820c80a2103be6f000000010902120001000000000904"], 0x0) syz_usb_control_io$cdc_ecm(r2, 0x0, &(0x7f0000000540)={0x1c, &(0x7f0000000440)=ANY=[], 0x0, 0x0}) syz_usb_control_io$uac1(r2, 0x0, 0x0) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_control_io$lan78xx(r2, 0x0, 0x0) syz_usb_control_io(r2, 0x0, &(0x7f0000000b00)={0x84, &(0x7f0000000680)={0x0, 0x17}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)={0x40, 0x13, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}, &(0x7f0000000980)={0x40, 0x17, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x3a}}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r2, 0x0, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r3, 0x1, 0x3c, &(0x7f0000000040)=0x1, 0xfff0) r4 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r4, 0x0, &(0x7f00000000c0)=0x0) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r6) sendmsg$NFC_CMD_DEV_UP(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x1c, r7, 0x1, 0x123, 0x234, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r5}]}, 0x1c}}, 0x0) write$nci(r4, &(0x7f00000009c0)=@NCI_OP_CORE_INIT_RSP_V2={0x0, 0x0, 0x2, 0x1, 0xc, {0x1, 0x1, 0xff, 0x2, 0x2, 0x62, 0x7, 0x7}}, 0x11) setsockopt$inet_tcp_TCP_REPAIR(r3, 0x6, 0x13, &(0x7f00000000c0)=0x1, 0x4) connect$inet(r3, &(0x7f00000006c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x2}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000140)=0x1, 0x4) sendmmsg$inet(r3, &(0x7f0000000d00)=[{{0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000740)="b3", 0x1}], 0x1, &(0x7f0000000640)=ANY=[], 0xf0}}], 0x1, 0x24004c41) syz_usb_control_io$cdc_ncm(r2, 0x0, 0x0) 2.230003893s ago: executing program 3 (id=4608): r0 = socket(0x2, 0x2, 0x1) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup.net/cgroup.procs\x00', 0x40002, 0x128) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4e23, 0xfffffffd, @local, 0x2}, 0x1c) r2 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) ioctl$SCSI_IOCTL_GET_PCI(r2, 0x5393, &(0x7f0000000000)) sendmsg$NL802154_CMD_SET_LBT_MODE(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000740)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB="04501fbc1fe8f878a612a7e85100"], 0x14}}, 0x0) syz_genetlink_get_family_id$nfc(&(0x7f0000000cc0), 0xffffffffffffffff) r3 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f00000012c0), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_VERSION(0xffffffffffffffff, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000080)={0x2c, r3, 0xf03, 0x0, 0x9000000, {}, [@NLBL_MGMT_A_DOMAIN={0x15, 0x1, '\x00\x00\x00\t\x00\x00\x00\xc1\x04\x00\x00\x00\x00\x00\x00\x00\x00'}]}, 0x2c}}, 0x0) sendfile(r0, r1, 0x0, 0x1) 2.158645376s ago: executing program 3 (id=4609): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x0) ioctl$NBD_SET_FLAGS(r1, 0x401070c9, 0x0) ioctl$KVM_CHECK_EXTENSION(r0, 0xae03, 0x3d) r2 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r2, 0x0, &(0x7f0000000500)=0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r4) sendmsg$NFC_CMD_DEV_UP(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="0a7810efe0980ec9e998e359060000", @ANYRES16=r5, @ANYBLOB="010023010000340200000200000008000100", @ANYRES32=r3, @ANYBLOB], 0x1c}}, 0x0) read$nci(r2, &(0x7f0000000200)=""/100, 0x64) write$nci(r2, &(0x7f0000000280)=@NCI_OP_RF_DISCOVER_RSP={0x1, 0x1, 0x2, 0x3, 0xf3, 0x1}, 0x4) read$nci(r2, &(0x7f00000002c0)=""/100, 0x64) write$nci(r2, &(0x7f0000000340)=@NCI_OP_CORE_INIT_RSP, 0x14) read$nci(r2, &(0x7f0000000380)=""/100, 0x64) write$nci(r2, &(0x7f0000000400)=@NCI_OP_RF_DISCOVER_MAP_RSP, 0x4) sendmsg$NFC_CMD_START_POLL(r4, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000004c0)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010023010000340200000600000008000100", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x24}}, 0x0) read$nci(r2, &(0x7f0000000900)=""/100, 0x64) write$nci(r2, &(0x7f0000000580)=@NCI_OP_CORE_SET_CONFIG_RSP, 0x5) read$nci(r2, &(0x7f00000005c0)=""/100, 0x64) write$nci(r2, &(0x7f0000000640)=@NCI_OP_CORE_SET_CONFIG_RSP, 0x5) read$nci(r2, &(0x7f0000000680)=""/100, 0x64) write$nci(r2, &(0x7f0000000700)=@NCI_OP_RF_DISCOVER_RSP, 0x4) write$nci(r2, &(0x7f0000000740)=@NCI_OP_RF_DISCOVER_NTF={0x1, 0x0, 0x3, 0x3, 0x0, @b={0xfd, 0x1, 0x1, 0x1, {0x1, "e7"}}}, 0xa) sendmsg$NFC_CMD_ACTIVATE_TARGET(r4, &(0x7f0000000780)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000800)={0x2c, r5, 0x1, 0x123, 0x234, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r3}, @NFC_ATTR_TARGET_INDEX={0x8}, @NFC_ATTR_PROTOCOLS={0x8, 0x3, 0x1}]}, 0x2c}}, 0x0) read$nci(r2, &(0x7f0000000840)=""/100, 0x64) write$nci(r2, &(0x7f00000008c0)=@NCI_OP_CORE_CONN_CREATE_RSP={0x0, 0x0, 0x2, 0x4, 0x0, {0x0, 0x0, 0x0, 0x1}}, 0x7) fcntl$getownex(r0, 0x10, &(0x7f0000000640)={0x0, 0x0}) r7 = getpgrp(r6) prlimit64(r7, 0x8, &(0x7f0000000600)={0x8, 0xfffffffffffffffc}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) 2.157714402s ago: executing program 5 (id=4610): open(&(0x7f0000000100)='./bus\x00', 0x143142, 0xa2) syz_io_uring_setup(0x231, &(0x7f0000000140)={0x0, 0x5b4a, 0x1000, 0x200}, 0x0, 0x0) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000240)) r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) write$dsp(r0, &(0x7f0000000200)='m', 0x1) r1 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x801) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r1, 0x40045532, &(0x7f0000000100)) syz_open_dev$sndpcmp(&(0x7f0000001200), 0x0, 0xa2c65) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x1, 0x4, 0xe8}, 0x0, &(0x7f00000002c0)={0x3ff, 0x30e3, 0x0, 0x3, 0x5, 0x8000000000, 0x80000001, 0xfffffffffffffffc}, 0x0, 0x0) 2.086819642s ago: executing program 0 (id=4611): r0 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0xc45, 0x9, 0xfffffffffffffffd, 0x0, 0x10003, 0x3, 0x4002004c2, 0x7ff, 0x9, 0x6, 0x400, 0x80, 0x88, 0x0, 0x3, 0x8d], 0x100000, 0x2c08c6}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 2.007421792s ago: executing program 5 (id=4612): read$FUSE(0xffffffffffffffff, &(0x7f00000003c0)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) r1 = syz_open_procfs(r0, &(0x7f0000000200)='net/xfrm_stat\x00') preadv(r1, &(0x7f00000001c0)=[{&(0x7f0000000000)=""/155, 0x9b}], 0x1, 0x3, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x101100, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) getsockname$packet(r1, &(0x7f00000000c0)={0x11, 0x0, 0x0}, &(0x7f0000000100)=0x14) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f0000000180)={r4, 0x1, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x2c}}, 0x10) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r5, &(0x7f0000000000)={0x500, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB="020300000e000000000000000000000005000600000000000a00000000000000000000000000000000000000000000000000000000400000020001000000000a00000afcff00000005000500000000000a"], 0x70}}, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x1) ioctl$F2FS_IOC_COMPRESS_FILE(r1, 0xf518, 0x0) r7 = syz_usb_connect(0x3, 0x62, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000fb5d7d086d04c308166b0102030109025000010000000009041f0000ff0100000a24010400050201020724070500000508240805040004960d2406010103020001000600060924030505030605810924030601030405050724040501", @ANYRESHEX=0x0], 0x0) syz_usb_control_io$uac1(r7, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000000)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x2409}}}, 0x0) syz_usb_control_io$hid(r7, &(0x7f0000000140)={0x24, 0x0, &(0x7f0000000180)={0x0, 0x3, 0x2e, @string={0x2e, 0x3, "54e81a0cbcd0320a3de84905ad97bdb74a5be318b53cb910b0cf19394ed2f88f2aca9ac4d1ae7c190c5390b1"}}, 0x0, 0x0}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000080)={0x2, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000016000/0x18000)=nil, &(0x7f0000000300)=[@text32={0x20, 0x0}], 0x1, 0x4e, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 1.90772411s ago: executing program 0 (id=4613): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0xfa, 0x0, 0xe4}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='bbr', 0x3) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600)=0xdfa, 0x4) sendmmsg$inet(r0, &(0x7f0000004240)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000001440)=[{&(0x7f00000011c0)="a2587becf7e1e085649ac6104204d09ecb05a13f146abe945049f4aed9c9a8f72403f43f534b88eb66ed092b4a78e4344ec26b04c7fb5f4fb5e9a591f786f632305fc2aa", 0x44}], 0x1, &(0x7f0000001580)}}, {{0x0, 0x0, &(0x7f00000019c0)=[{&(0x7f0000001780)="d1ef1bb59f70ec9b719b1589c8f3d0678afd", 0x12}, {&(0x7f00000017c0)="dad5b14f2f8f950502cf2880", 0xc}, {&(0x7f0000001800)="e9d7b200bf6ecf325e1a9c0dccd8c357998ad687717f392aab546e2ad010fb16c3120d5c20a62654dfa7da737faea449d323a40f6b39ce3ccea07331a90678979abfde57efde701f4c14b7897b8ef0530b2eecee7536d3c0186c646980b6c78eaf6f4d9d55d211f1d5a38fe9f95f95e72127a07b02bd5f5b3bcb265680ae107e6cf387fb56fca7ecd4e7257f1dc5a9ac14a40036a3f8675e691f6f6e9067617ffa6045157cf5b7562f68838b5e13843d24469663f76355633256edfdebaeee1320c3303b3d6a06113505045fb3ec9be769234a276ebec1707dae5cde125d22383405763a724ee1cfe93b3d4542c820725eddbe4be04ea031d732", 0xfa}, {&(0x7f0000001900)="8d70e326292a261d6ca941faf3", 0xd}], 0x4, &(0x7f0000001a40)}}, {{0x0, 0x0, &(0x7f0000001d00)=[{&(0x7f0000001ac0)="6c5b0b3e474f01bac640e7eb9064ec8e2ccac8b36c7d9ab464dc0bd7221bbae89e38ef0efc78f3e2f90e6236ad1ad1fb3dbd3e4fd8f2de84e526dfafb354837ff3958d97c8366471850ce9c14b83bb6e9a7c282a1d3e03cdfb675b61e1dbacc6ebcd08e105d4df684f2cd13262d10ffb8b0794f39b3e490416530423da29406a6a4b5a356dc898052883f1e54fd041e5a82247a4bbb784ce30ce321a2805b28d30", 0xa1}, {&(0x7f0000001b80)="66a7d24b8451d3e0201a73aaabe1e3fe371dfbf029efdbc2de3742c687d72207cab9988bc15b9e27135be8e1d84bbeb01ccf943eb163a18b6a02c752c829c5f24ccd2c02f1c208e64deb4d916ff1727fe172", 0x52}, {&(0x7f0000001c00)="811e3e8966b4199496dc8329eca81fa24aedba0078949553b10b0df3cc25de83324cb3fb6672cbb763e260abad0adca5ab04cf5988b6c9a912e96ba01b3508998595bfad50323f42fa943adb8d0324801ae6efa1e3", 0x55}], 0x3}}, {{0x0, 0x0, &(0x7f0000004180)=[{&(0x7f0000002f00)="5f97b46d7adb8b68ff35da0f147fef1c6c6c60db5c1fb54496a27c9eeb14cf97ceed1ac5e9d95d093d6400f4996e3c5f73fa7edad49015f697bdc1a17f731cd7b4e404954a2fbc069f73e9fa86cab27babb16a9004571326e20d84cb662973ba616c4ba4126e45ad1a7230b6c86c600a3dd01872c0f5823fadc0eb8b73f3d98c63881cd2131d63411f51e40a122182507d2d4be44f5fdec44f415e3448ebda832a6831bbd48324e11fe96400d92fae40f4a9ed9f376c56e6c6c703fe76dac9c3b4aed05a81b2b2adadc3e2ba8fd5cfc361420e61014782eeb5a921fd042bdc9cbfff5dac3df5711d5710e1d0a11d6e637dddd79ccd700dbc4924e22f8a50f0f43b6082b706c748e6d552178aa8d5959d8a3a175bf1d2b61b363fbad94b53505fb7ac302a0dec14a19141120d958b484f6e5e6f087267680eecfc91d11295a6bbd062cb7c99299681481a9ee65f157852aa46b21936e52611dbd9a8019b7566ec79b5fe8db94259c20842af9384aaf33dfafd15bb97d051743f467399caa4ee74394664c3de94449b4597bb90787c75a468f320be5e8faa11d13b589231eca2f9f4072cd44f0a1cbc874233a71901f5e027fc301caeadbe77f76206257f006e483b6b78b9319b57399a0f736f01df368726ee362c6224aaef36cff42bf221a2e03fb153bcdc240b594b22a043adc163f9004ed1ef0f152f0d960a58a18d709236df500abd672436b916c67c7e6fe7508530fe05b040c7cbeb2645f43259f3a142583a3051ea146281b901f732ba819f84050007c5f07e3848ddb7de602171525c7df8427475137a845796f12214b69dc7fb8cd458e9f2fac518b9dc84da1a13d8e95eb32cf4c14d2647b6e8bd808a91d258da905bac6e87ef6485e19ba85442c12b15c2fe95f5da8fd93f3b0c080703626eb7213954f38bdb5806393b0394532a886d896bed1b964984ba35de5de4674eab5e97312b6331fec90b0e9ad08cbb564d73a0428a", 0x2c5}, {&(0x7f0000003f00)="1f4af8fed7be58fd8686039093816fed8bf780c28e9a3e381dc0823276cb353324cbbad17108c2ad8e4946bc715057581728500e074e757687d75fe12890941341bf811dbc105949cabdb27ed4ae27fe50777d312307fc0c04ab7f7d4f968803d5bc4b5cc680b3a19aaefaa9732507680a8a20e345a4b33dfa18ee960931a539ac0c2b4b612bb28ec51ff4eb27b2622fad3d3dcb03f588ffb8ccf60cb2a2911435c978591f348959cf65d98788", 0xad}, {&(0x7f0000004000)="e4a979bc13e5ab701983256e", 0xc}, {&(0x7f0000004080)="e3f6b565db913652c092094a86c4b5a91acd35f6ddc50b99965b4d30bd2f08fae8a65f51c43b04efe10753719f42e035c70becaf563fdba9d11ae1ea7b1455506195fc159029c2c154efe0d3c9c43212720fd37317f13a7d07338ff66b6e554923856d6fba076ff9c5bde30d552863729ab6ae67d9531250b7d00ec881d7fd18770f5f2f52521017188b8c7055", 0x8d}], 0x4}}], 0x6, 0x40000) 1.844576609s ago: executing program 0 (id=4615): sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000480)={0x0, 0xe8}, 0x1, 0x0, 0x0, 0x40010}, 0x4008000) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) sendmsg$DEVLINK_CMD_SB_OCC_MAX_CLEAR(r0, &(0x7f0000000440)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000400)={&(0x7f0000000880)={0xf8, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [{@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x2}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0xb, 0x7}}, {@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x3a8}}, {@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x4}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0xb, 0x3ff}}]}, 0xf8}, 0x1, 0x0, 0x0, 0x1}, 0x4008000) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x321}, {&(0x7f0000000280)=""/85, 0x21}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000580)=""/106, 0x659}, {&(0x7f0000000980)=""/73, 0xd}, {&(0x7f0000000200)=""/77, 0x69}, {&(0x7f00000007c0)=""/141, 0x5c}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}, 0x5}], 0x4000000000003b4, 0x2000, &(0x7f0000003700)={0x77359400}) 1.748244154s ago: executing program 0 (id=4616): r0 = syz_usb_connect(0x5, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000062a10b40450c1010fce60102030109021b00010000000009043200019740a40009058203ff"], 0x0) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x10d4, &(0x7f0000003380)=ANY=[]) 1.438638174s ago: executing program 5 (id=4617): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000001400), 0x2, 0x0) r1 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000413f5f201d0650c16fce0102030109021b00010000100009043300011870f500090582020002"], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="100000002d000b02d2", 0x9}], 0x1}, 0x0) syz_usb_ep_write$ath9k_ep1(r1, 0x82, 0xa8, &(0x7f0000000040)=ANY=[@ANYBLOB="6b0ee0b3d41b1b"]) write$RDMA_USER_CM_CMD_LISTEN(r0, &(0x7f0000000100)={0x7, 0x8, 0xfa00, {0xffffffffffffffff, 0x10000}}, 0x10) 1.187028936s ago: executing program 3 (id=4618): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000ec0)={'wpan0\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000000), r1) sendmsg$NL802154_CMD_NEW_SEC_LEVEL(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01002ebd7000fddbdf252000000008000300", @ANYRES32=r2], 0x58}, 0x1, 0x0, 0x0, 0x4000004}, 0x20004000) 967.155669ms ago: executing program 3 (id=4619): sendmsg$kcm(0xffffffffffffffff, &(0x7f00000006c0)={&(0x7f0000000100)=@pptp={0x18, 0x2, {0x3, @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x80, 0x0}, 0x80) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000058000000160a01000000000000000000010000000900010073797a30000000000900020073797a32000000002c0003800800014000000000180003801400010076657468315f00005f626f6e64000000080002400000000064000000160a0101000b000000000000010000000900020073797a32000000000900010073797a3000000000300003802c00038014"], 0x104}, 0x1, 0x0, 0x0, 0x10004000}, 0x20004080) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x40000000, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)={0x2, 0x18, 0xfd, 0x0, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @empty}}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @private1}}]}, 0x60}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = syz_open_procfs(0x0, &(0x7f00000001c0)='maps\x00') ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0xc0686611, &(0x7f0000000180)={0x68, 0x0, 0x17, 0x2000, &(0x7f0000ffd000/0x2000)=nil}) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a44000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40000000010800034000000014480000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a31000000001c0003801800008008000340000000020c0004400000000000000c7f14000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSETELEM(r4, &(0x7f0000000100)={0x0, 0x20, &(0x7f0000000200)={&(0x7f0000002f40)=ANY=[@ANYBLOB="40000000210a010900000000000000000a0000010900020073797a31000000000900010073797a31"], 0x40}, 0x1, 0x0, 0x0, 0x24000801}, 0x8000) r5 = syz_open_dev$ttys(0xc, 0x2, 0x1) ioctl$TIOCSLCKTRMIOS(r5, 0x5457, 0x0) r6 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW2(r6, 0x402c542c, &(0x7f0000000340)={0xff7ff2d4, 0x0, 0x7, 0xffffffff, 0x0, "4d6b5ccb000000f600", 0x0, 0x1}) r7 = syz_open_dev$vim2m(&(0x7f00000007c0), 0x2, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r7, 0xc0d05605, &(0x7f0000000900)={0x1, @pix={0x6, 0x8, 0x3631564e, 0x4, 0x5, 0x7, 0x6, 0x9, 0x1, 0x0, 0x2, 0x6}}) 938.341684ms ago: executing program 3 (id=4620): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0xfa, 0x0, 0xe4}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='bbr', 0x3) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600)=0xdfa, 0x4) sendmmsg$inet(r0, &(0x7f0000004240)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000001440)=[{&(0x7f00000011c0)="a2587becf7e1e085649ac6104204d09ecb05a13f146abe945049f4aed9c9a8f72403f43f534b88eb66ed092b4a78e4344ec26b04c7fb5f4fb5e9a591f786f632305fc2aa", 0x44}], 0x1, &(0x7f0000001580)}}, {{0x0, 0x0, &(0x7f00000019c0)=[{&(0x7f0000001780)="d1ef1bb59f70ec9b719b1589c8f3d0678afd96", 0x13}, {&(0x7f00000017c0)="dad5b14f2f8f950502cf2880", 0xc}, {&(0x7f0000001800)="e9d7b200bf6ecf325e1a9c0dccd8c357998ad687717f392aab546e2ad010fb16c3120d5c20a62654dfa7da737faea449d323a40f6b39ce3ccea07331a90678979abfde57efde701f4c14b7897b8ef0530b2eecee7536d3c0186c646980b6c78eaf6f4d9d55d211f1d5a38fe9f95f95e72127a07b02bd5f5b3bcb265680ae107e6cf387fb56fca7ecd4e7257f1dc5a9ac14a40036a3f8675e691f6f6e9067617ffa6045157cf5b7562f68838b5e13843d24469663f76355633256edfdebaeee1320c3303b3d6a06113505045fb3ec9be769234a276ebec1707dae5cde125d22383405763a724ee1cfe93b3d4542c820725eddbe4be04ea031d732", 0xfa}, {0x0}], 0x4, &(0x7f0000001a40)}}, {{0x0, 0x0, &(0x7f0000001d00)=[{&(0x7f0000001ac0)="6c5b0b3e474f01bac640e7eb9064ec8e2ccac8b36c7d9ab464dc0bd7221bbae89e38ef0efc78f3e2f90e6236ad1ad1fb3dbd3e4fd8f2de84e526dfafb354837ff3958d97c8366471850ce9c14b83bb6e9a7c282a1d3e03cdfb675b61e1dbacc6ebcd08e105d4df684f2cd13262d10ffb8b0794f39b3e490416530423da29406a6a4b5a356dc898052883f1e54fd041e5a82247a4bbb784ce30ce321a2805b28d30", 0xa1}, {&(0x7f0000001b80)="66a7d24b8451d3e0201a73aaabe1e3fe371dfbf029efdbc2de3742c687d72207cab9988bc15b9e27135be8e1d84bbeb01ccf943eb163a18b6a02c752c829c5f24ccd2c02f1c208e64deb4d916ff1727fe172", 0x52}, {&(0x7f0000001c00)="811e3e8966b4199496dc8329eca81fa24aedba0078949553b10b0df3cc25de83324cb3fb6672cbb763e260abad0adca5ab04cf5988b6c9a912e96ba01b3508998595bfad50323f42fa943adb8d0324801ae6efa1e3", 0x55}], 0x3}}, {{0x0, 0x0, &(0x7f0000004180)=[{&(0x7f0000002f00)="5f97b46d7adb8b68ff35da0f147fef1c6c6c60db5c1fb54496a27c9eeb14cf97ceed1ac5e9d95d093d6400f4996e3c5f73fa7edad49015f697bdc1a17f731cd7b4e404954a2fbc069f73e9fa86cab27babb16a9004571326e20d84cb662973ba616c4ba4126e45ad1a7230b6c86c600a3dd01872c0f5823fadc0eb8b73f3d98c63881cd2131d63411f51e40a122182507d2d4be44f5fdec44f415e3448ebda832a6831bbd48324e11fe96400d92fae40f4a9ed9f376c56e6c6c703fe76dac9c3b4aed05a81b2b2adadc3e2ba8fd5cfc361420e61014782eeb5a921fd042bdc9cbfff5dac3df5711d5710e1d0a11d6e637dddd79ccd700dbc4924e22f8a50f0f43b6082b706c748e6d552178aa8d5959d8a3a175bf1d2b61b363fbad94b53505fb7ac302a0dec14a19141120d958b484f6e5e6f087267680eecfc91d11295a6bbd062cb7c99299681481a9ee65f157852aa46b21936e52611dbd9a8019b7566ec79b5fe8db94259c20842af9384aaf33dfafd15bb97d051743f467399caa4ee74394664c3de94449b4597bb90787c75a468f320be5e8faa11d13b589231eca2f9f4072cd44f0a1cbc874233a71901f5e027fc301caeadbe77f76206257f006e483b6b78b9319b57399a0f736f01df368726ee362c6224aaef36cff42bf221a2e03fb153bcdc240b594b22a043adc163f9004ed1ef0f152f0d960a58a18d709236df500abd672436b916c67c7e6fe7508530fe05b040c7cbeb2645f43259f3a142583a3051ea146281b901f732ba819f84050007c5f07e3848ddb7de602171525c7df8427475137a845796f12214b69dc7fb8cd458e9f2fac518b9dc84da1a13d8e95eb32cf4c14d2647b6e8bd808a91d258da905bac6e87ef6485e19ba85442c12b15c2fe95f5da8fd93f3b0c080703626eb7213954f38bdb5806393b0394532a886d896bed1b964984ba35de5de4674eab5e97312b6331fec90b0e9ad08cbb564d73a0428a", 0x2c5}, {&(0x7f0000003f00)="1f4af8fed7be58fd8686039093816fed8bf780c28e9a3e381dc0823276cb353324cbbad17108c2ad8e4946bc715057581728500e074e757687d75fe12890941341bf811dbc105949cabdb27ed4ae27fe50777d31", 0x54}, {&(0x7f0000004000)="e4a979bc13e5ab701983256e", 0xc}, {&(0x7f0000004080)="e3f6b565db913652c092094a86c4b5a91acd35f6ddc50b99965b4d30bd2f08fae8a65f51c43b04efe10753719f42e035c70becaf563fdba9d11ae1ea7b1455506195fc159029c2c154efe0d3c9c43212720fd37317f13a7d07338ff66b6e554923856d6fba076ff9c5bde30d552863729ab6ae67d9531250b7d00ec881d7fd18770f5f2f52521017188b8c7055", 0x8d}], 0x4}}], 0x6, 0x40000) 860.278528ms ago: executing program 3 (id=4621): r0 = syz_usb_connect(0x0, 0x24, &(0x7f00000001c0)=ANY=[@ANYBLOB="12010000b5403340861a22753635010203010902120001000000000904"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, &(0x7f0000000100)={0x14, &(0x7f0000000300)={0x0, 0xf, 0x8e, {0x8e, 0x8, "374d146309a0e68a6a4c42d9d93f53053d2565f975fee21d3bb162837cdbad4c8660b92d99b7a1f93c774a591f178164b37772575efa2042ee401801d4ae4b44e5c67e5788e576b4d7372eb0e947b8afc3a401d0542d4b2937d6f78e931b5a059974e189da8196ad028b62c3fc537e7d05ed8ab929dfe48d2477eb9838c4617c1783e6b7199252d3c0243bf1"}}, &(0x7f0000000080)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000440)={0x1c, &(0x7f0000000140)={0x20, 0xf, 0x17, "a175d731b8026874d24e23c40e320bb37c78daae50c5ed"}, &(0x7f00000003c0)={0x0, 0xa, 0x1, 0xf}, &(0x7f0000000400)={0x0, 0x8, 0x1, 0x5}}) 714.073826ms ago: executing program 5 (id=4622): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000080)={0x2, &(0x7f0000000000)=[{0x5c}, {0x6, 0x0, 0x0, 0x7ffffe39}]}) r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$RDMA_NLDEV_CMD_STAT_GET(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x18, 0x1411, 0x200, 0x70bd29, 0x25dfdbff, "", [@RDMA_NLDEV_ATTR_STAT_MODE={0x8, 0x4a, 0x1}]}, 0x18}}, 0x4004010) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=@updpolicy={0x1fc, 0x19, 0x1, 0x2, 0x0, {{@in6=@private2, @in6=@empty, 0x0, 0x3, 0x0, 0x0, 0x2, 0x0, 0x0, 0xc}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}}, [@tmpl={0x144, 0x5, [{{@in6=@empty, 0x0, 0x32}, 0x0, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x1}, {{@in6=@private2, 0x0, 0x32}, 0x0, @in6=@ipv4={'\x00', '\xff\xff', @remote}, 0x0, 0x0, 0x3}, {{@in6=@loopback, 0x0, 0x3c}, 0x2, @in6=@empty, 0x0, 0x1, 0x3, 0x40}, {{@in6=@dev={0xfe, 0x80, '\x00', 0x11}, 0x0, 0x32}, 0x2, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3}, {{@in=@loopback, 0x0, 0x2b}, 0x2, @in=@dev, 0x3500, 0x0, 0x0, 0x0, 0x3eb}]}]}, 0x1fc}}, 0x0) r2 = syz_usb_connect(0x0, 0x24, &(0x7f0000000680)=ANY=[@ANYBLOB="12010000cf8bed20d90f21004029000000010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r2, 0x0, &(0x7f0000000580)={0x44, &(0x7f0000000380)=ANY=[@ANYBLOB="201101"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) ioctl$I2C_RDWR(r3, 0x707, &(0x7f0000000200)={&(0x7f0000000040)=[{0x8a, 0x1000, 0x0, 0x0}, {0xfffa, 0x8000, 0xfe, &(0x7f00000003c0)="c43c787530650700e69d21349fa666a2a46c6fffc58f7a1b313e82a5f425217484f544baf0eb50a4acd4ab67b0738e41963a779a1c3b453871194e254bd74fe73f830bb3dfcb5f21e0b2c552eb4f2deb488c5624f10e1f59b9cf54b95e26d565a3c9a964d27ea841d0a53933bb0a3a289dc1b906208baa08ef4b3801270cc8ff78c00873dc05b40011165bc8d1cebb6c858c2bda4e2a7259e876a9e4e9a51707dc6b6b6c0b7f122dd5942e19a52a47daf9c460ae7b6fe0dd0d5b3c8b3e6aa1f98d88b30357a0b2635a5d4543161ec627633a0c41788498ecc5e83feca605cf5594bb1b0824a39f198cc11ff2f4c300fee0ccd002aca9e4eaacde3f24207b"}], 0x2}) syz_usb_control_io(r2, 0x0, 0x0) 331.564524ms ago: executing program 6 (id=4623): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0xfa, 0x0, 0xe4}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='bbr', 0x3) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600)=0xdfa, 0x4) sendmmsg$inet(r0, &(0x7f0000004240)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000001440)=[{&(0x7f00000011c0)="a2587becf7e1e085649ac6104204d09ecb05a13f146abe945049f4aed9c9a8f72403f43f534b88eb66ed092b4a78e4344ec26b04c7fb5f4fb5e9a591f786f632305fc2aa", 0x44}], 0x1, &(0x7f0000001580)}}, {{0x0, 0x0, &(0x7f00000019c0)=[{&(0x7f0000001780)="d1ef1bb59f70ec9b719b1589c8f3d0678afd", 0x12}, {&(0x7f00000017c0)="dad5b14f2f8f950502cf2880", 0xc}, {&(0x7f0000001800)="e9d7b200bf6ecf325e1a9c0dccd8c357998ad687717f392aab546e2ad010fb16c3120d5c20a62654dfa7da737faea449d323a40f6b39ce3ccea07331a90678979abfde57efde701f4c14b7897b8ef0530b2eecee7536d3c0186c646980b6c78eaf6f4d9d55d211f1d5a38fe9f95f95e72127a07b02bd5f5b3bcb265680ae107e6cf387fb56fca7ecd4e7257f1dc5a9ac14a40036a3f8675e691f6f6e9067617ffa6045157cf5b7562f68838b5e13843d24469663f76355633256edfdebaeee1320c3303b3d6a06113505045fb3ec9be769234a276ebec1707dae5cde125d22383405763a724ee1cfe93b3d4542c820725eddbe4be04ea031d732", 0xfa}, {&(0x7f0000001900)="8d70e326292a261d6ca941faf3", 0xd}], 0x4, &(0x7f0000001a40)}}, {{0x0, 0x0, &(0x7f0000001d00)=[{&(0x7f0000001ac0)="6c5b0b3e474f01bac640e7eb9064ec8e2ccac8b36c7d9ab464dc0bd7221bbae89e38ef0efc78f3e2f90e6236ad1ad1fb3dbd3e4fd8f2de84e526dfafb354837ff3958d97c8366471850ce9c14b83bb6e9a7c282a1d3e03cdfb675b61e1dbacc6ebcd08e105d4df684f2cd13262d10ffb8b0794f39b3e490416530423da29406a6a4b5a356dc898052883f1e54fd041e5a82247a4bbb784ce30ce321a2805b28d30", 0xa1}, {&(0x7f0000001b80)="66a7d24b8451d3e0201a73aaabe1e3fe371dfbf029efdbc2de3742c687d72207cab9988bc15b9e27135be8e1d84bbeb01ccf943eb163a18b6a02c752c829c5f24ccd2c02f1c208e64deb4d916ff1727fe172", 0x52}, {&(0x7f0000001c00)="811e3e8966b4199496dc8329eca81fa24aedba0078949553b10b0df3cc25de83324cb3fb6672cbb763e260abad0adca5ab04cf5988b6c9a912e96ba01b3508998595bfad50323f42fa943adb8d0324801ae6efa1e3", 0x55}], 0x3}}, {{0x0, 0x0, &(0x7f0000004180)=[{&(0x7f0000002f00)="5f97b46d7adb8b68ff35da0f147fef1c6c6c60db5c1fb54496a27c9eeb14cf97ceed1ac5e9d95d093d6400f4996e3c5f73fa7edad49015f697bdc1a17f731cd7b4e404954a2fbc069f73e9fa86cab27babb16a9004571326e20d84cb662973ba616c4ba4126e45ad1a7230b6c86c600a3dd01872c0f5823fadc0eb8b73f3d98c63881cd2131d63411f51e40a122182507d2d4be44f5fdec44f415e3448ebda832a6831bbd48324e11fe96400d92fae40f4a9ed9f376c56e6c6c703fe76dac9c3b4aed05a81b2b2adadc3e2ba8fd5cfc361420e61014782eeb5a921fd042bdc9cbfff5dac3df5711d5710e1d0a11d6e637dddd79ccd700dbc4924e22f8a50f0f43b6082b706c748e6d552178aa8d5959d8a3a175bf1d2b61b363fbad94b53505fb7ac302a0dec14a19141120d958b484f6e5e6f087267680eecfc91d11295a6bbd062cb7c99299681481a9ee65f157852aa46b21936e52611dbd9a8019b7566ec79b5fe8db94259c20842af9384aaf33dfafd15bb97d051743f467399caa4ee74394664c3de94449b4597bb90787c75a468f320be5e8faa11d13b589231eca2f9f4072cd44f0a1cbc874233a71901f5e027fc301caeadbe77f76206257f006e483b6b78b9319b57399a0f736f01df368726ee362c6224aaef36cff42bf221a2e03fb153bcdc240b594b22a043adc163f9004ed1ef0f152f0d960a58a18d709236df500abd672436b916c67c7e6fe7508530fe05b040c7cbeb2645f43259f3a142583a3051ea146281b901f732ba819f84050007c5f07e3848ddb7de602171525c7df8427475137a845796f12214b69dc7fb8cd458e9f2fac518b9dc84da1a13d8e95eb32cf4c14d2647b6e8bd808a91d258da905bac6e87ef6485e19ba85442c12b15c2fe95f5da8fd93f3b0c080703626eb7213954f38bdb5806393b0394532a886d896bed1b964984ba35de5de4674eab5e97312b6331fec90b0e9ad08cbb564d73a0428a", 0x2c5}, {&(0x7f0000003f00)="1f4af8fed7be58fd8686039093816fed8bf780c28e9a3e381dc0823276cb353324cbbad17108c2ad8e4946bc715057581728500e074e757687d75fe12890941341bf811dbc105949cabdb27ed4ae27fe50777d312307fc0c04ab7f7d4f968803d5bc4b5cc680b3a19aaefaa9732507680a8a20e345a4b33dfa18ee960931a539ac0c2b4b612bb28ec51ff4eb27b2622fad3d3dcb03f588ffb8ccf60cb2a2911435c978591f348959cf65d98788", 0xad}, {&(0x7f0000004000)="e4a979bc13e5ab701983256e", 0xc}, {&(0x7f0000004080)="e3f6b565db913652c092094a86c4b5a91acd35f6ddc50b99965b4d30bd2f08fae8a65f51c43b04efe10753719f42e035c70becaf563fdba9d11ae1ea7b1455506195fc159029c2c154efe0d3c9c43212720fd37317f13a7d07338ff66b6e554923856d6fba076ff9c5bde30d552863729ab6ae67d9531250b7d00ec881d7fd18770f5f2f52521017188b8c7055", 0x8d}], 0x4}}], 0x6, 0x40000) 258.566796ms ago: executing program 0 (id=4624): r0 = userfaultfd(0x1) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000140)) ioctl$UFFDIO_WRITEPROTECT(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000800000/0x800000)=nil, 0x800000}, 0x2}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$UFFDIO_CONTINUE(r1, 0xc020aa08, &(0x7f00000000c0)={{&(0x7f0000800000/0x800000)=nil, 0x800000}}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_CONTINUE(r1, 0xc020aa07, &(0x7f0000000000)={{&(0x7f0000ffa000/0x3000)=nil, 0x3000}}) 209.204662ms ago: executing program 6 (id=4625): r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12014101f2c59620d016b8108ede0102030109022400010000100009040002020083ec0009050602000202000a09058202"], 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f00000005c0)={0x84, &(0x7f0000000340)=ANY=[@ANYBLOB='@\t\f'], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000440)={0x44, &(0x7f00000001c0)={0x20, 0xc, 0x28, "e249c1e68886c33f55468695fda6351adc5976abd0c381b051faaca44fad15a897f2514a9efd21c6"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000d80)={0x1c, &(0x7f0000000840)=ANY=[@ANYBLOB="400528"], 0x0, 0x0}) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r2, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x41}}, 0x10) r3 = socket$tipc(0x1e, 0x5, 0x0) r4 = creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) write$binfmt_elf64(r4, &(0x7f00000004c0)=ANY=[@ANYBLOB="7f454c4603000702810000000000000002003e00f9ffffffd80100000000000040000000000000008b00000000000000330d00000500380004"], 0x120) lsetxattr$security_capability(&(0x7f0000002580)='./file0\x00', &(0x7f00000025c0), 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r4, 0xc018937b, &(0x7f0000000300)={{0x1, 0x1, 0x18, r2, {0xffffffffffffffff, 0xee01}}, './file0\x00'}) mount$overlay(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x410, &(0x7f0000000400)={[{@volatile}, {@default_permissions}], [{@appraise}, {@smackfsfloor={'smackfsfloor', 0x3d, '{'}}, {@flag='silent'}, {@func={'func', 0x3d, 'MMAP_CHECK'}}, {@dont_hash}, {@hash}, {@obj_type={'obj_type', 0x3d, 'security.capability\x00'}}, {@appraise}, {@euid_gt={'euid>', r5}}]}) close(r4) execve(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r6 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt(r6, 0x84, 0x7f, &(0x7f0000000040)="020000000980ffff", 0x8) sendmsg$tipc(r3, &(0x7f0000000240)={&(0x7f0000000080)=@name={0x1e, 0x2, 0x0, {{0x41}}}, 0x10, 0x0}, 0x48011) recvmmsg(r3, &(0x7f00000014c0)=[{{0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000180)=""/189, 0xbd}], 0x1}, 0x6}], 0x1, 0x40012000, 0x0) r7 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000001c0)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_KEY(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB='|\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="3f9d00000000000000001700000008000300", @ANYRES32=r8, @ANYBLOB="60003080050002000000000014000400403a050c5bae9c544ef2b6d713459a7a1c0001800500020000000000080004000500000008000100020000"], 0x7c}, 0x1, 0x0, 0x0, 0x4004}, 0x0) 99.879318ms ago: executing program 5 (id=4626): socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r1, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @loopback}}}, 0x108) r2 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r2, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108) syz_clone3(&(0x7f0000000400)={0x180060000, &(0x7f0000000040), &(0x7f0000000080)=0x0, &(0x7f00000000c0), {0x10}, &(0x7f0000000100)=""/92, 0x5c, &(0x7f0000000340)=""/161, &(0x7f0000000180)=[0x0], 0x1}, 0x58) syz_open_procfs(r3, &(0x7f00000001c0)='net/sockstat6\x00') r4 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r4, 0x29, 0x2a, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @remote, 0x1000}}}, 0x108) close_range(r0, 0xffffffffffffffff, 0x0) 0s ago: executing program 5 (id=4627): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@weak_binder={0x77622a85, 0x100a, 0x8000000000}, @flat=@weak_binder={0x77622a85, 0x1100, 0x3}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000240)='./binderfs/binder1\x00', 0x800, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x10000000000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000004a40)={0x44, 0x0, &(0x7f00000049c0)=[@transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x78, 0x0, &(0x7f0000000600)="878b7cdfd4455cf49da7ba6f280ae012ce80389a2aefe4fd04084554d7015aba5330d1b817d6c08af29938b8a9bc2b83462ddadaad3a3a5c0181a0203e49b12c99ac8757fc317fe672938a06f89c133d615cf8c6e94b3ac320fa50046f5c18ac35b49243870e4e6b90c76177feda5469369b2b5a4739cc0b"}) kernel console output (not intermixed with test programs): evice descriptor read/8, error -71 [ 457.152453][T15478] usb usb4-port1: unable to enumerate USB device [ 457.184654][ T5890] usb 1-1: USB disconnect, device number 94 [ 457.573999][ T5890] usb 3-1: new high-speed USB device number 86 using dummy_hcd [ 457.741790][ T5890] usb 3-1: Using ep0 maxpacket: 8 [ 457.749821][ T5890] usb 3-1: config index 0 descriptor too short (expected 301, got 45) [ 457.758273][ T5890] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 457.768478][ T5890] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 457.778678][ T5890] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 457.789321][ T5890] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 457.803863][ T5890] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 457.813163][ T5890] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 458.031766][ T5890] usb 3-1: usb_control_msg returned -32 [ 458.051766][ T5890] usbtmc 3-1:16.0: can't read capabilities [ 458.584453][ T5911] usb 1-1: new high-speed USB device number 95 using dummy_hcd [ 458.658603][T15644] netlink: 'syz.3.3954': attribute type 25 has an invalid length. [ 458.666693][T15644] netlink: 'syz.3.3954': attribute type 3 has an invalid length. [ 458.680032][T15645] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 458.691932][T15644] netlink: 132 bytes leftover after parsing attributes in process `syz.3.3954'. [ 458.701718][T15645] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 458.782424][ T5911] usb 1-1: Using ep0 maxpacket: 32 [ 458.803213][ T5911] usb 1-1: New USB device found, idVendor=0fd9, idProduct=0021, bcdDevice=29.40 [ 458.824827][ T5911] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 458.851737][ T5911] usb 1-1: config 0 descriptor?? [ 459.068330][ T5911] dvb-usb: found a 'Elgato EyeTV DTT' in warm state. [ 459.079535][ T5911] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 459.083774][ T5890] usb 4-1: new high-speed USB device number 98 using dummy_hcd [ 459.091132][ T5911] dvbdev: DVB: registering new adapter (Elgato EyeTV DTT) [ 459.103771][ T5911] usb 1-1: media controller created [ 459.123762][ T5911] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 459.183352][ T5911] DVB: Unable to find symbol dib7000p_attach() [ 459.189546][ T5911] dvb-usb: no frontend was attached by 'Elgato EyeTV DTT' [ 459.261719][ T5911] rc_core: IR keymap rc-dib0700-rc5 not found [ 459.269511][ T5911] Registered IR keymap rc-empty [ 459.276164][ T5890] usb 4-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 459.285696][ T5890] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 459.295034][ T5890] usb 4-1: Product: syz [ 459.299300][ T5890] usb 4-1: Manufacturer: syz [ 459.304452][ T5890] usb 4-1: SerialNumber: syz [ 459.325642][ T5911] dvb-usb: could not initialize remote control. [ 459.333169][ T5911] dvb-usb: Elgato EyeTV DTT successfully initialized and connected. [ 459.621216][ T5911] usb 1-1: USB disconnect, device number 95 [ 459.636930][T15649] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 459.666272][T15649] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 459.697808][ T5890] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPROTO [ 459.725083][ T5890] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): lan78xx_setup_irq_domain() failed : -71 [ 459.744134][ T5890] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 459.757851][ T5911] dvb-usb: Elgato EyeTV DTT successfully deinitialized and disconnected. [ 459.768892][ T5890] lan78xx 4-1:1.0: probe with driver lan78xx failed with error -71 [ 459.777718][T15663] netlink: 'syz.5.3960': attribute type 11 has an invalid length. [ 459.800433][ T5890] usb 4-1: USB disconnect, device number 98 [ 460.222482][ T5912] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 460.381765][ T5912] usb 6-1: Using ep0 maxpacket: 32 [ 460.389749][ T5912] usb 6-1: New USB device found, idVendor=0fd9, idProduct=0021, bcdDevice=29.40 [ 460.401098][ T5912] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 460.427664][ T5912] usb 6-1: config 0 descriptor?? [ 460.665955][ T5912] dvb-usb: found a 'Elgato EyeTV DTT' in warm state. [ 460.695171][ T5912] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 460.730004][ T5912] dvbdev: DVB: registering new adapter (Elgato EyeTV DTT) [ 460.737639][ T5912] usb 6-1: media controller created [ 460.761340][ T5912] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 460.839038][ T5912] DVB: Unable to find symbol dib7000p_attach() [ 460.846467][ T5912] dvb-usb: no frontend was attached by 'Elgato EyeTV DTT' [ 460.867080][T15667] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 460.898000][T15667] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 460.944946][ T5912] rc_core: IR keymap rc-dib0700-rc5 not found [ 460.951191][ T5912] Registered IR keymap rc-empty [ 460.956313][T15478] usb 4-1: new high-speed USB device number 99 using dummy_hcd [ 460.964253][ T5912] dvb-usb: could not initialize remote control. [ 460.971461][ T5912] dvb-usb: Elgato EyeTV DTT successfully initialized and connected. [ 461.131797][T15478] usb 4-1: Using ep0 maxpacket: 16 [ 461.139489][T15478] usb 4-1: unable to get BOS descriptor or descriptor too short [ 461.151405][T15478] usb 4-1: New USB device found, idVendor=1235, idProduct=8201, bcdDevice= 0.40 [ 461.165068][T15478] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 461.173455][T15478] usb 4-1: Product: syz [ 461.178157][T15478] usb 4-1: Manufacturer: syz [ 461.183042][T15478] usb 4-1: SerialNumber: syz [ 461.247062][ T5898] usb 6-1: USB disconnect, device number 3 [ 461.290611][ T5898] dvb-usb: Elgato EyeTV DTT successfully deinitialized and disconnected. [ 461.431459][T15478] usb 4-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 461.439162][T15478] usb 4-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 461.485292][T15478] usb 4-1: USB disconnect, device number 99 [ 461.529675][T11252] udevd[11252]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 462.471790][ T5912] usb 4-1: new high-speed USB device number 100 using dummy_hcd [ 462.512660][ T5891] usb 1-1: new high-speed USB device number 96 using dummy_hcd [ 462.631745][ T5912] usb 4-1: Using ep0 maxpacket: 32 [ 462.644323][ T5912] usb 4-1: New USB device found, idVendor=0fd9, idProduct=0021, bcdDevice=29.40 [ 462.666852][ T5912] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 462.673016][ T5891] usb 1-1: New USB device found, idVendor=2c42, idProduct=1709, bcdDevice=ca.b7 [ 462.685395][ T5891] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 462.694452][ T5912] usb 4-1: config 0 descriptor?? [ 462.701509][ T5891] usb 1-1: Product: syz [ 462.707140][ T5891] usb 1-1: Manufacturer: syz [ 462.712408][ T5891] usb 1-1: SerialNumber: syz [ 462.733000][ T5891] usb 1-1: config 0 descriptor?? [ 462.911139][ T5912] dvb-usb: found a 'Elgato EyeTV DTT' in warm state. [ 462.936566][ T5912] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 462.951195][ T5891] usb 1-1: f81604_read: reg: 105 failed: -EPIPE [ 462.960118][ T5912] dvbdev: DVB: registering new adapter (Elgato EyeTV DTT) [ 462.963803][ T5891] f81604 1-1:0.0: Setting termination of CH#0 failed: -EPIPE [ 462.976538][ T5891] f81604 1-1:0.0: probe with driver f81604 failed with error -32 [ 462.986867][ T5912] usb 4-1: media controller created [ 463.066158][ T5912] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 463.090452][ T5848] usb 1-1: USB disconnect, device number 96 [ 463.113868][T15723] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 463.180457][T15723] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 463.273623][ T5912] DVB: Unable to find symbol dib7000p_attach() [ 463.279855][ T5912] dvb-usb: no frontend was attached by 'Elgato EyeTV DTT' [ 463.359774][ T5912] rc_core: IR keymap rc-dib0700-rc5 not found [ 463.370865][ T5912] Registered IR keymap rc-empty [ 463.378257][ T5912] dvb-usb: could not initialize remote control. [ 463.389614][ T5912] dvb-usb: Elgato EyeTV DTT successfully initialized and connected. [ 463.483760][ T5891] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 463.647020][ T5891] usb 6-1: New USB device found, idVendor=200c, idProduct=1018, bcdDevice= 0.40 [ 463.656290][ T5891] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 463.670878][ T5891] usb 6-1: Product: syz [ 463.675861][ T5891] usb 6-1: Manufacturer: syz [ 463.680556][ T5891] usb 6-1: SerialNumber: syz [ 463.713080][T15631] usbtmc 3-1:16.0: usb_control_msg returned -110 [ 463.779533][ T5898] usb 3-1: USB disconnect, device number 86 [ 463.920520][T15767] tipc: Started in network mode [ 463.940991][T15767] tipc: Node identity ca446bfde903, cluster identity 4711 [ 463.962854][T15767] tipc: Enabled bearer , priority 0 [ 463.978565][T15767] syzkaller0: mtu greater than device maximum [ 463.993377][T15766] tipc: Disabling bearer [ 464.179717][ T5891] usb 6-1: unit 4 not found! [ 464.278471][ T30] audit: type=1800 audit(1773790772.517:7): pid=15782 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.3995" name="bus" dev="overlay" ino=2463 res=0 errno=0 [ 464.318302][ T5891] usb 6-1: USB disconnect, device number 4 [ 464.417243][T15788] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3997'. [ 464.433547][T15788] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(4) [ 464.440091][T15788] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 464.448412][T15788] vhci_hcd vhci_hcd.0: Device attached [ 464.691840][ T5890] usb 37-1: new low-speed USB device number 4 using vhci_hcd [ 464.703354][ T5848] usb 3-1: new high-speed USB device number 87 using dummy_hcd [ 464.851756][ T5891] usb 1-1: new high-speed USB device number 97 using dummy_hcd [ 464.874250][ T5848] usb 3-1: config 0 has no interfaces? [ 464.880943][ T5848] usb 3-1: New USB device found, idVendor=2040, idProduct=2000, bcdDevice=65.72 [ 464.892279][ T5848] usb 3-1: New USB device strings: Mfr=151, Product=0, SerialNumber=0 [ 464.901371][ T5848] usb 3-1: Manufacturer: syz [ 464.908671][ T5848] usb 3-1: config 0 descriptor?? [ 464.981760][ T5891] usb 1-1: device descriptor read/64, error -71 [ 465.117594][T15789] vhci_hcd: cannot find a urb of seqnum 1 max seqnum 3 [ 465.120062][ T5848] usb 3-1: USB disconnect, device number 87 [ 465.132440][ T87] vhci_hcd vhci_hcd.2: stop threads [ 465.137820][ T87] vhci_hcd vhci_hcd.2: release socket [ 465.143695][ T87] vhci_hcd vhci_hcd.2: disconnect device [ 465.221805][ T5891] usb 1-1: new high-speed USB device number 98 using dummy_hcd [ 465.247785][ T5912] usb 4-1: USB disconnect, device number 100 [ 465.310667][ T5912] dvb-usb: Elgato EyeTV DTT successfully deinitialized and disconnected. [ 465.351842][ T5891] usb 1-1: device descriptor read/64, error -71 [ 465.473197][ T5891] usb usb1-port1: attempt power cycle [ 465.831778][ T5891] usb 1-1: new high-speed USB device number 99 using dummy_hcd [ 465.883319][ T5891] usb 1-1: device descriptor read/8, error -71 [ 465.903710][T15838] overlayfs: failed to resolve './file1': -2 [ 466.011881][ T5947] usb 3-1: new high-speed USB device number 88 using dummy_hcd [ 466.093447][ T5912] usb 4-1: new high-speed USB device number 101 using dummy_hcd [ 466.132981][ T5891] usb 1-1: new high-speed USB device number 100 using dummy_hcd [ 466.146071][T15853] fuse: fd is not a fuse device [ 466.160697][ T5891] usb 1-1: device descriptor read/8, error -71 [ 466.171754][ T5947] usb 3-1: Using ep0 maxpacket: 32 [ 466.179889][ T5947] usb 3-1: unable to get BOS descriptor or descriptor too short [ 466.192534][ T5947] usb 3-1: New USB device found, idVendor=0dba, idProduct=1000, bcdDevice= 0.40 [ 466.203197][ T5947] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 466.212166][ T5947] usb 3-1: Product: syz [ 466.216565][ T5947] usb 3-1: Manufacturer: syz [ 466.221218][ T5947] usb 3-1: SerialNumber: syz [ 466.271857][ T5912] usb 4-1: Using ep0 maxpacket: 32 [ 466.277468][ T5891] usb usb1-port1: unable to enumerate USB device [ 466.281461][ T5912] usb 4-1: New USB device found, idVendor=0fd9, idProduct=0021, bcdDevice=29.40 [ 466.297747][ T5912] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 466.310269][ T5912] usb 4-1: config 0 descriptor?? [ 466.521117][ T5912] dvb-usb: found a 'Elgato EyeTV DTT' in warm state. [ 466.531252][ T5912] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 466.542510][ T5912] dvbdev: DVB: registering new adapter (Elgato EyeTV DTT) [ 466.549724][ T5912] usb 4-1: media controller created [ 466.568718][ T5912] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 466.619681][ T5912] DVB: Unable to find symbol dib7000p_attach() [ 466.626340][ T5912] dvb-usb: no frontend was attached by 'Elgato EyeTV DTT' [ 466.635876][ T5947] usb 3-1: unit 0 not found! [ 466.701737][ T5912] rc_core: IR keymap rc-dib0700-rc5 not found [ 466.707942][ T5912] Registered IR keymap rc-empty [ 466.715676][ T5912] dvb-usb: could not initialize remote control. [ 466.722795][ T5912] dvb-usb: Elgato EyeTV DTT successfully initialized and connected. [ 466.731048][T15835] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 466.740160][T15835] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 466.839648][T15833] binder_alloc: 15832: pid 15832 spamming oneway? 1 buffers allocated for a total size of 4096 [ 466.860588][ T5947] snd-usb-audio 3-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 466.873749][ T5947] usb 3-1: unit 0 not found! [ 466.882677][ T5947] snd-usb-audio 3-1:1.1: probe with driver snd-usb-audio failed with error -22 [ 466.896497][ T5947] usb 3-1: unit 0 not found! [ 466.944746][ T5947] snd-usb-audio 3-1:1.2: probe with driver snd-usb-audio failed with error -22 [ 466.959369][ T5947] usb 3-1: USB disconnect, device number 88 [ 466.990892][T10933] udevd[10933]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.2/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 467.748543][ T87] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 467.856548][ T87] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 468.026767][T15875] netlink: 96 bytes leftover after parsing attributes in process `syz.0.4023'. [ 468.066381][ T87] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 468.162040][ T5847] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 468.184911][ T5847] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 468.193839][ T5847] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 468.207458][ T5847] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 468.216948][ T5847] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 468.251188][ T87] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 468.593255][ T87] bridge_slave_1: left allmulticast mode [ 468.606862][ T87] bridge_slave_1: left promiscuous mode [ 468.620302][ T87] bridge0: port 2(bridge_slave_1) entered disabled state [ 468.649015][ T87] bridge_slave_0: left allmulticast mode [ 468.661767][ T87] bridge_slave_0: left promiscuous mode [ 468.676392][ T87] bridge0: port 1(bridge_slave_0) entered disabled state [ 468.899658][ T5911] usb 4-1: USB disconnect, device number 101 [ 469.056376][ T5911] dvb-usb: Elgato EyeTV DTT successfully deinitialized and disconnected. [ 469.087883][ T87] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 469.157605][ T87] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 469.185045][ T87] bond0 (unregistering): Released all slaves [ 469.330529][ T87] tipc: Left network mode [ 469.613232][ T5911] usb 1-1: new high-speed USB device number 101 using dummy_hcd [ 469.710861][T15880] chnl_net:caif_netlink_parms(): no params data found [ 469.791778][ T5890] vhci_hcd vhci_hcd.2: vhci_device speed not set [ 469.816833][ T5911] usb 1-1: New USB device found, idVendor=1a86, idProduct=7522, bcdDevice=35.36 [ 469.847603][ T5911] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 469.878676][ T5911] usb 1-1: Product: syz [ 469.893299][ T5911] usb 1-1: Manufacturer: syz [ 469.907233][ T5911] usb 1-1: SerialNumber: syz [ 469.957371][ T5911] usb 1-1: config 0 descriptor?? [ 469.999399][ T5911] ch341 1-1:0.0: ch341-uart converter detected [ 470.097325][ T87] hsr_slave_0: left promiscuous mode [ 470.122056][ T87] hsr_slave_1: left promiscuous mode [ 470.174050][ T87] veth1_macvtap: left promiscuous mode [ 470.227020][ T87] veth0_macvtap: left promiscuous mode [ 470.246246][ T87] veth1_vlan: left promiscuous mode [ 470.261973][ T87] veth0_vlan: left promiscuous mode [ 470.271902][ T5847] Bluetooth: hci1: command tx timeout [ 470.334106][T15924] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4038'. [ 470.636667][ T5911] usb 1-1: failed to send control message: -71 [ 470.664172][ T5911] ch341-uart ttyUSB0: probe with driver ch341-uart failed with error -71 [ 470.692079][T15933] 9p: Bad value for 'rfdno' [ 470.712068][ T5911] usb 1-1: USB disconnect, device number 101 [ 470.761226][ T5911] ch341 1-1:0.0: device disconnected [ 470.961592][ T87] team0 (unregistering): Port device team_slave_1 removed [ 470.987422][ T87] team0 (unregistering): Port device team_slave_0 removed [ 471.061764][ T5848] usb 4-1: new high-speed USB device number 102 using dummy_hcd [ 471.225814][T15880] bridge0: port 1(bridge_slave_0) entered blocking state [ 471.234866][T15880] bridge0: port 1(bridge_slave_0) entered disabled state [ 471.242143][ T5848] usb 4-1: Using ep0 maxpacket: 32 [ 471.250412][ T5848] usb 4-1: New USB device found, idVendor=0fd9, idProduct=0021, bcdDevice=29.40 [ 471.260049][T15880] bridge_slave_0: entered allmulticast mode [ 471.269105][ T5848] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 471.277934][T15880] bridge_slave_0: entered promiscuous mode [ 471.298913][T15880] bridge0: port 2(bridge_slave_1) entered blocking state [ 471.311741][ T5848] usb 4-1: config 0 descriptor?? [ 471.334891][T15880] bridge0: port 2(bridge_slave_1) entered disabled state [ 471.372779][T15880] bridge_slave_1: entered allmulticast mode [ 471.395351][T15880] bridge_slave_1: entered promiscuous mode [ 471.489494][T15880] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 471.534090][T15880] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 471.535466][ T5848] dvb-usb: found a 'Elgato EyeTV DTT' in warm state. [ 471.552959][T15949] Invalid source name [ 471.578519][ T5848] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 471.610043][ T5848] dvbdev: DVB: registering new adapter (Elgato EyeTV DTT) [ 471.632172][ T5848] usb 4-1: media controller created [ 471.675153][ T5848] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 471.689426][T15880] team0: Port device team_slave_0 added [ 471.713738][T15880] team0: Port device team_slave_1 added [ 471.751327][T15936] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 471.779897][T15936] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 471.819277][T15880] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 471.831055][T15880] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 471.878376][T15880] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 471.880805][ T5848] DVB: Unable to find symbol dib7000p_attach() [ 471.896571][ T5848] dvb-usb: no frontend was attached by 'Elgato EyeTV DTT' [ 471.909750][T15880] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 471.928647][T15880] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 471.989250][T15880] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 472.054607][ T5848] rc_core: IR keymap rc-dib0700-rc5 not found [ 472.066248][ T5848] Registered IR keymap rc-empty [ 472.087584][ T5848] dvb-usb: could not initialize remote control. [ 472.096001][ T5848] dvb-usb: Elgato EyeTV DTT successfully initialized and connected. [ 472.104230][T15880] hsr_slave_0: entered promiscuous mode [ 472.122656][T15880] hsr_slave_1: entered promiscuous mode [ 472.136780][T15880] debugfs: 'hsr0' already exists in 'hsr' [ 472.142890][T15880] Cannot create hsr debugfs directory [ 472.352672][ T5847] Bluetooth: hci1: command tx timeout [ 472.485632][T15976] syz.0.4051: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 472.504024][T15976] CPU: 1 UID: 0 PID: 15976 Comm: syz.0.4051 Tainted: G L syzkaller #0 PREEMPT(full) [ 472.504050][T15976] Tainted: [L]=SOFTLOCKUP [ 472.504056][T15976] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 472.504067][T15976] Call Trace: [ 472.504074][T15976] [ 472.504081][T15976] dump_stack_lvl+0xe8/0x150 [ 472.504110][T15976] warn_alloc+0x249/0x340 [ 472.504129][T15976] ? stack_trace_save+0xa9/0x100 [ 472.504153][T15976] ? __pfx_warn_alloc+0x10/0x10 [ 472.504175][T15976] ? kasan_save_track+0x4f/0x80 [ 472.504198][T15976] ? kasan_save_track+0x3e/0x80 [ 472.504221][T15976] ? __kasan_kmalloc+0x93/0xb0 [ 472.504235][T15976] ? __kmalloc_cache_noprof+0x31c/0x660 [ 472.504258][T15976] ? xskq_create+0x56/0x170 [ 472.504282][T15976] ? xsk_setsockopt+0x54c/0x990 [ 472.504303][T15976] ? do_sock_setsockopt+0x17c/0x1b0 [ 472.504319][T15976] ? __x64_sys_setsockopt+0x13d/0x1b0 [ 472.504335][T15976] ? do_syscall_64+0x14d/0xf80 [ 472.504355][T15976] __vmalloc_node_range_noprof+0x132/0x1750 [ 472.504407][T15976] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 472.504439][T15976] ? __kasan_kmalloc+0x93/0xb0 [ 472.504460][T15976] vmalloc_user_noprof+0xad/0xe0 [ 472.504487][T15976] ? xskq_create+0xbf/0x170 [ 472.504512][T15976] xskq_create+0xbf/0x170 [ 472.504538][T15976] xsk_init_queue+0x8a/0xe0 [ 472.504565][T15976] xsk_setsockopt+0x54c/0x990 [ 472.504590][T15976] ? __pfx_xsk_setsockopt+0x10/0x10 [ 472.504613][T15976] ? __pfx_aa_sk_perm+0x10/0x10 [ 472.504640][T15976] ? aa_sock_opt_perm+0xff/0x1a0 [ 472.504744][T15976] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 472.504771][T15976] ? __pfx_xsk_setsockopt+0x10/0x10 [ 472.504796][T15976] do_sock_setsockopt+0x17c/0x1b0 [ 472.504818][T15976] __x64_sys_setsockopt+0x13d/0x1b0 [ 472.504841][T15976] do_syscall_64+0x14d/0xf80 [ 472.504858][T15976] ? trace_irq_disable+0x3b/0x150 [ 472.504878][T15976] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 472.504896][T15976] ? clear_bhb_loop+0x40/0x90 [ 472.504918][T15976] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 472.504935][T15976] RIP: 0033:0x7fb8bcb9c799 [ 472.504953][T15976] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 472.504969][T15976] RSP: 002b:00007fb8bd990028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 472.504987][T15976] RAX: ffffffffffffffda RBX: 00007fb8bce16090 RCX: 00007fb8bcb9c799 [ 472.505000][T15976] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000004 [ 472.505011][T15976] RBP: 00007fb8bcc32c99 R08: 0000000000000004 R09: 0000000000000000 [ 472.505022][T15976] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 472.505033][T15976] R13: 00007fb8bce16128 R14: 00007fb8bce16090 R15: 00007fffc736e778 [ 472.505060][T15976] [ 472.505074][T15976] Mem-Info: [ 472.789053][T15976] active_anon:22048 inactive_anon:0 isolated_anon:0 [ 472.789053][T15976] active_file:8740 inactive_file:50379 isolated_file:0 [ 472.789053][T15976] unevictable:769 dirty:59 writeback:0 [ 472.789053][T15976] slab_reclaimable:11171 slab_unreclaimable:92573 [ 472.789053][T15976] mapped:26902 shmem:16844 pagetables:1569 [ 472.789053][T15976] sec_pagetables:0 bounce:0 [ 472.789053][T15976] kernel_misc_reclaimable:0 [ 472.789053][T15976] free:1304325 free_pcp:10451 free_cma:0 [ 472.867493][T15976] Node 0 active_anon:87892kB inactive_anon:0kB active_file:34960kB inactive_file:201304kB unevictable:1540kB isolated(anon):0kB isolated(file):0kB mapped:107508kB dirty:232kB writeback:0kB shmem:65840kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:11940kB pagetables:6136kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 472.917760][T15976] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:212kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:4kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:32kB pagetables:140kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 472.951090][T15976] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 472.983147][T15976] lowmem_reserve[]: 0 2480 2482 2482 2482 [ 472.988983][T15976] Node 0 DMA32 free:1255964kB boost:0kB min:34080kB low:42600kB high:51120kB reserved_highatomic:0KB free_highatomic:0KB active_anon:87892kB inactive_anon:0kB active_file:34960kB inactive_file:201304kB unevictable:1540kB writepending:232kB zspages:0kB present:3129332kB managed:2540140kB mlocked:0kB bounce:0kB free_pcp:41708kB local_pcp:21440kB free_cma:0kB [ 473.029993][T15976] lowmem_reserve[]: 0 0 1 1 1 [ 473.034966][T15976] Node 0 Normal free:8kB boost:0kB min:16kB low:20kB high:24kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:1436kB mlocked:0kB bounce:0kB free_pcp:4kB local_pcp:0kB free_cma:0kB [ 473.072113][T15880] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 473.088197][T15880] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 473.102896][T15976] lowmem_reserve[]: 0 0 0 0 0 [ 473.108748][T15976] Node 1 Normal free:3946040kB boost:0kB min:55800kB low:69748kB high:83696kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:212kB unevictable:1536kB writepending:4kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:248kB local_pcp:0kB free_cma:0kB [ 473.128353][T15880] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 473.151294][T15976] lowmem_reserve[]: 0 0 0 0 0 [ 473.156728][T15976] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 473.169786][T15976] Node 0 DMA32: 4875*4kB (UM) 2918*8kB (UME) 1493*16kB (UM) 540*32kB (UM) 327*64kB (UME) 466*128kB (UM) 429*256kB (UME) 259*512kB (UM) 93*1024kB (UM) 44*2048kB (UME) 162*4096kB (UM) = 1255916kB [ 473.200962][T15976] Node 0 Normal: 0*4kB 1*8kB (U) 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 8kB [ 473.214679][T15976] Node 1 Normal: 2*4kB (UM) 2*8kB (UM) 2*16kB (UM) 4*32kB (UM) 10*64kB (UM) 4*128kB (UM) 3*256kB (UM) 3*512kB (UM) 2*1024kB (UM) 2*2048kB (U) 961*4096kB (M) = 3946040kB [ 473.234689][T15880] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 473.243231][T15976] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 473.256878][T15976] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 473.267896][T15976] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 473.278170][T15976] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 473.287946][T15976] 75959 total pagecache pages [ 473.293162][T15976] 0 pages in swap cache [ 473.314008][T15976] Free swap = 124996kB [ 473.323504][T15976] Total swap = 124996kB [ 473.332534][T15976] 2097051 pages RAM [ 473.343399][T15976] 0 pages HighMem/MovableOnly [ 473.354051][T15976] 430042 pages reserved [ 473.365457][T15976] 0 pages cma reserved [ 473.490114][T15880] 8021q: adding VLAN 0 to HW filter on device bond0 [ 473.548712][T15880] 8021q: adding VLAN 0 to HW filter on device team0 [ 473.574724][ T63] bridge0: port 1(bridge_slave_0) entered blocking state [ 473.582037][ T63] bridge0: port 1(bridge_slave_0) entered forwarding state [ 473.613624][ T63] bridge0: port 2(bridge_slave_1) entered blocking state [ 473.620874][ T63] bridge0: port 2(bridge_slave_1) entered forwarding state [ 473.886202][ T5912] usb 4-1: USB disconnect, device number 102 [ 474.006939][ T5912] dvb-usb: Elgato EyeTV DTT successfully deinitialized and disconnected. [ 474.164824][T15880] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 474.342062][ T5912] usb 4-1: new high-speed USB device number 103 using dummy_hcd [ 474.432099][ T5847] Bluetooth: hci1: command tx timeout [ 474.500190][T15880] veth0_vlan: entered promiscuous mode [ 474.507018][ T5912] usb 4-1: Using ep0 maxpacket: 8 [ 474.517818][ T5912] usb 4-1: config index 0 descriptor too short (expected 301, got 45) [ 474.536944][T15880] veth1_vlan: entered promiscuous mode [ 474.542764][ T5912] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 474.557822][ T5912] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 474.579468][ T5912] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 474.596424][ T5912] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 474.609864][ T5912] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 474.618995][ T5912] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 474.672554][T15880] veth0_macvtap: entered promiscuous mode [ 474.719688][T15880] veth1_macvtap: entered promiscuous mode [ 474.803889][T15880] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 474.850454][ T5912] usb 4-1: usb_control_msg returned -32 [ 474.865695][T15880] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 474.873274][ T5912] usbtmc 4-1:16.0: can't read capabilities [ 474.903686][ T49] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 474.924640][ T87] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 474.956713][ T87] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 475.003419][ T87] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 475.248900][ T6613] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 475.262276][ T6613] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 475.323103][ T49] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 475.341248][ T49] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 475.577265][T16066] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 475.610823][T16066] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 475.901794][T15478] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 475.952315][ T5956] usb 1-1: new high-speed USB device number 102 using dummy_hcd [ 476.063502][T15478] usb 7-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 476.073937][T15478] usb 7-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 476.085201][T15478] usb 7-1: config 27 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 476.098707][T15478] usb 7-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 476.108061][T15478] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 476.129093][T15478] usb 7-1: Quirk or no altset; falling back to MIDI 1.0 [ 476.138949][ T5956] usb 1-1: Using ep0 maxpacket: 32 [ 476.145132][T15478] usb 7-1: invalid MIDI out EP 0 [ 476.153343][ T5956] usb 1-1: New USB device found, idVendor=0fd9, idProduct=0021, bcdDevice=29.40 [ 476.168822][ T5956] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 476.207085][ T5956] usb 1-1: config 0 descriptor?? [ 476.294678][T15478] snd-usb-audio 7-1:27.0: probe with driver snd-usb-audio failed with error -22 [ 476.371376][ T5891] usb 7-1: USB disconnect, device number 2 [ 476.436857][ T5956] dvb-usb: found a 'Elgato EyeTV DTT' in warm state. [ 476.459285][ T5956] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 476.481493][ T5956] dvbdev: DVB: registering new adapter (Elgato EyeTV DTT) [ 476.490696][ T5956] usb 1-1: media controller created [ 476.512509][ T5847] Bluetooth: hci1: command tx timeout [ 476.529835][ T5956] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 476.593161][ T5956] DVB: Unable to find symbol dib7000p_attach() [ 476.599384][ T5956] dvb-usb: no frontend was attached by 'Elgato EyeTV DTT' [ 476.701909][ T5956] rc_core: IR keymap rc-dib0700-rc5 not found [ 476.708109][ T5956] Registered IR keymap rc-empty [ 476.714001][ T5956] dvb-usb: could not initialize remote control. [ 476.720360][ T5956] dvb-usb: Elgato EyeTV DTT successfully initialized and connected. [ 476.988635][ T29] usb 1-1: USB disconnect, device number 102 [ 477.043074][T15478] usb 4-1: USB disconnect, device number 103 [ 477.076655][ T29] dvb-usb: Elgato EyeTV DTT successfully deinitialized and disconnected. [ 477.110831][T16095] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4072'. [ 477.238471][ T5847] Bluetooth: hci3: Received unexpected HCI Event 0x00 [ 477.425869][T16108] netlink: 'syz.5.4078': attribute type 1 has an invalid length. [ 477.547454][T16113] netlink: 'syz.5.4080': attribute type 1 has an invalid length. [ 477.559925][T16113] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 477.591836][T15478] usb 4-1: new high-speed USB device number 104 using dummy_hcd [ 477.645084][T16121] sctp: [Deprecated]: syz.5.4082 (pid 16121) Use of int in maxseg socket option. [ 477.645084][T16121] Use struct sctp_assoc_value instead [ 477.771220][T15478] usb 4-1: Using ep0 maxpacket: 8 [ 477.789511][T15478] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 477.816165][T15478] usb 4-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 477.842799][T15478] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 477.866597][T15478] usb 4-1: config 0 descriptor?? [ 477.882268][ T29] usb 1-1: new full-speed USB device number 103 using dummy_hcd [ 477.900027][T16131] fuse: fd is not a fuse device [ 478.079774][ T29] usb 1-1: unable to get BOS descriptor or descriptor too short [ 478.100228][ T29] usb 1-1: not running at top speed; connect to a high speed hub [ 478.114429][T15478] iowarrior 4-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 478.126808][ T29] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x88 has an invalid bInterval 0, changing to 10 [ 478.139312][ T29] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 478.152676][ T29] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0xC has invalid maxpacket 65535, setting to 64 [ 478.165005][ T29] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0xF has invalid wMaxPacketSize 0 [ 478.174796][ T29] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x75, changing to 0x5 [ 478.186346][ T29] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 478.200874][ T29] usb 1-1: New USB device found, idVendor=0763, idProduct=1002, bcdDevice=5f.84 [ 478.210041][ T29] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 478.218909][ T29] usb 1-1: Product: syz [ 478.224205][ T29] usb 1-1: Manufacturer: syz [ 478.228859][ T29] usb 1-1: SerialNumber: syz [ 478.236107][ T29] usb 1-1: config 0 descriptor?? [ 478.243122][T16116] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 478.252984][ T29] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 478.315883][ T29] snd-usb-audio 1-1:0.0: probe with driver snd-usb-audio failed with error -12 [ 478.321922][ T5898] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 478.372057][T10937] udevd[10937]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 478.481784][ T5898] usb 7-1: Using ep0 maxpacket: 32 [ 478.489354][ T5898] usb 7-1: New USB device found, idVendor=0fd9, idProduct=0021, bcdDevice=29.40 [ 478.498834][ T5898] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 478.515386][ T5898] usb 7-1: config 0 descriptor?? [ 478.526625][T16100] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4074'. [ 478.554853][ T5891] usb 4-1: USB disconnect, device number 104 [ 478.714779][T16150] fuse: fd is not a fuse device [ 478.742199][ T5898] dvb-usb: found a 'Elgato EyeTV DTT' in warm state. [ 478.755412][ T5898] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 478.770060][ T5898] dvbdev: DVB: registering new adapter (Elgato EyeTV DTT) [ 478.777750][ T5898] usb 7-1: media controller created [ 478.795248][ T5898] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 478.848626][ T5898] DVB: Unable to find symbol dib7000p_attach() [ 478.854905][ T5898] dvb-usb: no frontend was attached by 'Elgato EyeTV DTT' [ 478.921754][ T5898] rc_core: IR keymap rc-dib0700-rc5 not found [ 478.929124][ T5898] Registered IR keymap rc-empty [ 478.934575][ T5898] dvb-usb: could not initialize remote control. [ 478.940860][ T5898] dvb-usb: Elgato EyeTV DTT successfully initialized and connected. [ 478.958408][ T5898] usb 7-1: USB disconnect, device number 3 [ 478.996212][ T5898] dvb-usb: Elgato EyeTV DTT successfully deinitialized and disconnected. [ 479.474585][ T5848] usb 4-1: new high-speed USB device number 105 using dummy_hcd [ 479.634593][ T5848] usb 4-1: New USB device found, idVendor=0813, idProduct=0001, bcdDevice=3a.08 [ 479.643850][ T5848] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 479.654864][ T5848] usb 4-1: config 0 descriptor?? [ 479.664531][ T5848] gspca_main: cpia1-2.14.0 probing 0813:0001 [ 479.676392][T16171] netlink: 12 bytes leftover after parsing attributes in process `syz.6.4098'. [ 479.685691][T16171] netlink: 20 bytes leftover after parsing attributes in process `syz.6.4098'. [ 479.870209][ T5848] gspca_cpia1: usb_control_msg 05, error -71 [ 479.877795][ T5848] gspca_cpia1: usb_control_msg 01, error -71 [ 479.885993][ T5848] cpia1 4-1:0.0: only firmware version 1 is supported (got: 0) [ 479.896147][ T5848] usb 4-1: USB disconnect, device number 105 [ 479.988596][T16173] binder: 16172:16173 ioctl c0306201 200000001a80 returned -14 [ 480.093452][T16178] FAULT_INJECTION: forcing a failure. [ 480.093452][T16178] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 480.106762][T16178] CPU: 0 UID: 0 PID: 16178 Comm: syz.6.4100 Tainted: G L syzkaller #0 PREEMPT(full) [ 480.106793][T16178] Tainted: [L]=SOFTLOCKUP [ 480.106801][T16178] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 480.106813][T16178] Call Trace: [ 480.106821][T16178] [ 480.106830][T16178] dump_stack_lvl+0xe8/0x150 [ 480.106865][T16178] should_fail_ex+0x412/0x560 [ 480.106893][T16178] _copy_from_iter+0x1d3/0x1670 [ 480.106920][T16178] ? rcu_is_watching+0x15/0xb0 [ 480.106946][T16178] ? __pfx__copy_from_iter+0x10/0x10 [ 480.106976][T16178] ? netlink_sendmsg+0x650/0xb40 [ 480.106994][T16178] ? skb_put+0x11b/0x210 [ 480.107017][T16178] netlink_sendmsg+0x6c0/0xb40 [ 480.107045][T16178] ? __pfx_netlink_sendmsg+0x10/0x10 [ 480.107067][T16178] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 480.107107][T16178] ? __pfx_netlink_sendmsg+0x10/0x10 [ 480.107124][T16178] sock_sendmsg_nosec+0x112/0x150 [ 480.107154][T16178] ____sys_sendmsg+0x589/0x8c0 [ 480.107185][T16178] ? __pfx_____sys_sendmsg+0x10/0x10 [ 480.107216][T16178] ? import_iovec+0x73/0xa0 [ 480.107249][T16178] ___sys_sendmsg+0x2a5/0x360 [ 480.107278][T16178] ? __pfx____sys_sendmsg+0x10/0x10 [ 480.107350][T16178] ? __fget_files+0x2a/0x420 [ 480.107377][T16178] ? __fget_files+0x3a0/0x420 [ 480.107414][T16178] __x64_sys_sendmsg+0x1bd/0x2a0 [ 480.107441][T16178] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 480.107478][T16178] ? __pfx_ksys_write+0x10/0x10 [ 480.107501][T16178] do_syscall_64+0x14d/0xf80 [ 480.107516][T16178] ? trace_irq_disable+0x3b/0x150 [ 480.107533][T16178] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 480.107548][T16178] ? clear_bhb_loop+0x40/0x90 [ 480.107567][T16178] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 480.107582][T16178] RIP: 0033:0x7f9ec519c799 [ 480.107609][T16178] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 480.107621][T16178] RSP: 002b:00007f9ec33d5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 480.107637][T16178] RAX: ffffffffffffffda RBX: 00007f9ec5416090 RCX: 00007f9ec519c799 [ 480.107647][T16178] RDX: 000000000000c114 RSI: 00002000000002c0 RDI: 0000000000000003 [ 480.107657][T16178] RBP: 00007f9ec33d5090 R08: 0000000000000000 R09: 0000000000000000 [ 480.107672][T16178] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 480.107680][T16178] R13: 00007f9ec5416128 R14: 00007f9ec5416090 R15: 00007ffef0a30e98 [ 480.107720][T16178] [ 480.612754][T16116] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 480.653970][ T5848] usb 1-1: USB disconnect, device number 103 [ 480.789023][ T5847] Bluetooth: hci1: failed to read key size for handle 201 [ 480.833280][T16184] netlink: 'syz.3.4104': attribute type 10 has an invalid length. [ 480.855832][T16184] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 481.213734][ T5911] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 481.372108][ T5911] usb 7-1: Using ep0 maxpacket: 32 [ 481.377410][ T5848] usb 4-1: new high-speed USB device number 106 using dummy_hcd [ 481.389345][ T5911] usb 7-1: New USB device found, idVendor=0fd9, idProduct=0021, bcdDevice=29.40 [ 481.401705][ T5911] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 481.419196][ T5911] usb 7-1: config 0 descriptor?? [ 481.521770][ T5891] usb 1-1: new high-speed USB device number 104 using dummy_hcd [ 481.564881][ T5848] usb 4-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 481.575996][ T5848] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 481.588277][ T5848] usb 4-1: config 27 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 481.602842][ T5848] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 481.610200][T16221] tipc: Started in network mode [ 481.612025][ T5848] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 481.618100][T16221] tipc: Node identity aaaaaaaaaa41, cluster identity 4711 [ 481.649988][T16221] tipc: Enabled bearer , priority 10 [ 481.657218][ T5848] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 481.667052][ T5911] dvb-usb: found a 'Elgato EyeTV DTT' in warm state. [ 481.675189][ T5848] usb 4-1: invalid MIDI out EP 0 [ 481.685639][ T5891] usb 1-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 481.696860][ T5911] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 481.712517][ T5891] usb 1-1: New USB device found, idVendor=041e, idProduct=4007, bcdDevice=5d.18 [ 481.723560][ T5911] dvbdev: DVB: registering new adapter (Elgato EyeTV DTT) [ 481.734342][ T5911] usb 7-1: media controller created [ 481.745264][ T5891] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 481.806224][ T5911] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 481.832091][ T5891] gspca_main: stv0680-2.14.0 probing 041e:4007 [ 481.845701][T16224] libceph: resolve '.00' (ret=-3): failed [ 481.984571][ T5848] snd-usb-audio 4-1:27.0: probe with driver snd-usb-audio failed with error -22 [ 482.003084][ T5848] usb 4-1: USB disconnect, device number 106 [ 482.040876][ T5911] DVB: Unable to find symbol dib7000p_attach() [ 482.052616][ T5911] dvb-usb: no frontend was attached by 'Elgato EyeTV DTT' [ 482.173033][ T5911] rc_core: IR keymap rc-dib0700-rc5 not found [ 482.179315][ T5911] Registered IR keymap rc-empty [ 482.185277][ T5911] dvb-usb: could not initialize remote control. [ 482.191593][ T5911] dvb-usb: Elgato EyeTV DTT successfully initialized and connected. [ 482.207462][ T5911] usb 7-1: USB disconnect, device number 4 [ 482.247405][ T5911] dvb-usb: Elgato EyeTV DTT successfully deinitialized and disconnected. [ 482.709594][T16242] netlink: 'syz.5.4122': attribute type 2 has an invalid length. [ 482.718861][T16242] netlink: 132 bytes leftover after parsing attributes in process `syz.5.4122'. [ 482.763416][ T5890] tipc: Node number set to 15444650 [ 482.917449][ T5891] gspca_stv0680: usb_control_msg error 0, request = 0x88, error = -32 [ 482.955674][ T5891] stv0680 1-1:4.0: STV(e): camera ping failed!! [ 482.968525][ T5891] stv0680 1-1:4.0: last error: 0, command = 0x0 [ 483.026560][T16257] tmpfs: Bad value for 'mpol' [ 483.314103][ T5891] usb 4-1: new high-speed USB device number 107 using dummy_hcd [ 483.477940][ T5891] usb 4-1: config 1 has an invalid interface number: 7 but max is 0 [ 483.486897][ T5891] usb 4-1: config 1 has no interface number 0 [ 483.493460][ T5891] usb 4-1: config 1 interface 7 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 483.504115][ T5891] usb 4-1: config 1 interface 7 altsetting 0 bulk endpoint 0x7 has invalid maxpacket 8 [ 483.514693][ T5891] usb 4-1: config 1 interface 7 altsetting 0 has a duplicate endpoint with address 0x1, skipping [ 483.527494][ T5891] usb 4-1: New USB device found, idVendor=1199, idProduct=68a3, bcdDevice= 0.00 [ 483.537377][ T5891] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 483.545769][ T5891] usb 4-1: Product: syz [ 483.550235][ T5891] usb 4-1: Manufacturer: syz [ 483.555586][ T5891] usb 4-1: SerialNumber: syz [ 483.563439][T16261] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 483.570721][T16261] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 483.579887][ T5891] usb 4-1: Expected 3 endpoints, found: 2 [ 483.784625][T16261] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 483.794291][T16261] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 484.182119][ T5898] usb 7-1: new high-speed USB device number 5 using dummy_hcd [ 484.296800][ T5848] usb 1-1: USB disconnect, device number 104 [ 484.331717][ T5898] usb 7-1: Using ep0 maxpacket: 32 [ 484.345982][ T5898] usb 7-1: New USB device found, idVendor=0fd9, idProduct=0021, bcdDevice=29.40 [ 484.371068][ T5898] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 484.395127][ T5898] usb 7-1: config 0 descriptor?? [ 484.552168][T16283] netlink: 'syz.5.4140': attribute type 9 has an invalid length. [ 484.561476][T16283] netlink: 'syz.5.4140': attribute type 11 has an invalid length. [ 484.571071][T16283] netlink: 'syz.5.4140': attribute type 12 has an invalid length. [ 484.579081][T16283] netlink: 210020 bytes leftover after parsing attributes in process `syz.5.4140'. [ 484.589474][T16283] netlink: 4 bytes leftover after parsing attributes in process `syz.5.4140'. [ 484.631982][ T5898] dvb-usb: found a 'Elgato EyeTV DTT' in warm state. [ 484.656533][ T5898] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 484.681444][ T5898] dvbdev: DVB: registering new adapter (Elgato EyeTV DTT) [ 484.690134][ T5898] usb 7-1: media controller created [ 484.724703][ T5898] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 484.840367][ T5898] DVB: Unable to find symbol dib7000p_attach() [ 484.846968][ T5898] dvb-usb: no frontend was attached by 'Elgato EyeTV DTT' [ 484.922199][ T5898] rc_core: IR keymap rc-dib0700-rc5 not found [ 484.930618][ T5898] Registered IR keymap rc-empty [ 484.940457][ T5898] dvb-usb: could not initialize remote control. [ 484.950536][ T5898] dvb-usb: Elgato EyeTV DTT successfully initialized and connected. [ 484.973943][ T5898] usb 7-1: USB disconnect, device number 5 [ 485.010139][ T5898] dvb-usb: Elgato EyeTV DTT successfully deinitialized and disconnected. [ 485.359788][T16297] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4144'. [ 485.766684][T16312] netlink: 'syz.5.4151': attribute type 32 has an invalid length. [ 485.841999][ T5898] usb 7-1: new full-speed USB device number 6 using dummy_hcd [ 486.013859][ T5898] usb 7-1: config 0 has an invalid interface number: 172 but max is 0 [ 486.031897][ T5898] usb 7-1: config 0 has no interface number 0 [ 486.043173][ T5898] usb 7-1: config 0 interface 172 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 486.076713][ T5898] usb 7-1: New USB device found, idVendor=06f8, idProduct=301b, bcdDevice=bb.39 [ 486.103055][ T10] usb 4-1: USB disconnect, device number 107 [ 486.109109][ T5898] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 486.122068][ T5898] usb 7-1: Product: syz [ 486.127883][ T5898] usb 7-1: Manufacturer: syz [ 486.139321][ T5898] usb 7-1: SerialNumber: syz [ 486.154351][ T5898] usb 7-1: config 0 descriptor?? [ 486.173100][ T5898] gspca_main: gspca_pac7302-2.14.0 probing 06f8:301b [ 486.551792][ T10] usb 4-1: new high-speed USB device number 108 using dummy_hcd [ 486.722020][ T10] usb 4-1: Using ep0 maxpacket: 16 [ 486.737544][ T10] usb 4-1: config 0 has an invalid interface number: 3 but max is 0 [ 486.756908][ T10] usb 4-1: config 0 has no interface number 0 [ 486.769984][ T10] usb 4-1: New USB device found, idVendor=061d, idProduct=c020, bcdDevice=9c.15 [ 486.779919][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 486.788417][ T10] usb 4-1: Product: syz [ 486.793103][ T10] usb 4-1: Manufacturer: syz [ 486.797778][ T10] usb 4-1: SerialNumber: syz [ 486.814133][ T10] usb 4-1: config 0 descriptor?? [ 486.827751][ T10] ssu100 4-1:0.3: Quatech SSU-100 USB to Serial Driver converter detected [ 486.983838][ T5898] input: gspca_pac7302 as /devices/platform/dummy_hcd.6/usb7/7-1/input/input54 [ 487.001824][ T29] usb 1-1: new high-speed USB device number 105 using dummy_hcd [ 487.161704][ T29] usb 1-1: Using ep0 maxpacket: 32 [ 487.169093][ T29] usb 1-1: New USB device found, idVendor=0fd9, idProduct=0021, bcdDevice=29.40 [ 487.178324][ T29] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 487.190130][ T29] usb 1-1: config 0 descriptor?? [ 487.309668][ T5898] usb 7-1: USB disconnect, device number 6 [ 487.411883][ T29] dvb-usb: found a 'Elgato EyeTV DTT' in warm state. [ 487.430458][ T10] ssu100 4-1:0.3: probe with driver ssu100 failed with error -71 [ 487.450454][ T29] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 487.463955][ T29] dvbdev: DVB: registering new adapter (Elgato EyeTV DTT) [ 487.471321][ T29] usb 1-1: media controller created [ 487.486460][ T10] usb 4-1: USB disconnect, device number 108 [ 487.507888][ T29] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 487.664982][ T29] DVB: Unable to find symbol dib7000p_attach() [ 487.684260][ T29] dvb-usb: no frontend was attached by 'Elgato EyeTV DTT' [ 487.761724][ T29] rc_core: IR keymap rc-dib0700-rc5 not found [ 487.767858][ T29] Registered IR keymap rc-empty [ 487.773215][ T29] dvb-usb: could not initialize remote control. [ 487.779512][ T29] dvb-usb: Elgato EyeTV DTT successfully initialized and connected. [ 488.029814][ T5891] usb 1-1: USB disconnect, device number 105 [ 488.124182][ T10] usb 7-1: new high-speed USB device number 7 using dummy_hcd [ 488.139011][ T5891] dvb-usb: Elgato EyeTV DTT successfully deinitialized and disconnected. [ 488.196026][T16374] IPv6: NLM_F_CREATE should be specified when creating new route [ 488.283568][T16379] binder: 16372:16379 ioctl c00c620f 0 returned -14 [ 488.305847][ T10] usb 7-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 488.318947][ T10] usb 7-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 488.334998][ T10] usb 7-1: config 27 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 488.348278][ T10] usb 7-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 488.362029][ T10] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 488.406483][ T10] usb 7-1: Quirk or no altset; falling back to MIDI 1.0 [ 488.431212][ T10] usb 7-1: invalid MIDI out EP 0 [ 488.684403][ T10] snd-usb-audio 7-1:27.0: probe with driver snd-usb-audio failed with error -22 [ 488.713607][ T10] usb 7-1: USB disconnect, device number 7 [ 489.701877][ T10] usb 7-1: new high-speed USB device number 8 using dummy_hcd [ 489.772022][T16449] new mount options do not match the existing superblock, will be ignored [ 489.872236][ T10] usb 7-1: Using ep0 maxpacket: 32 [ 489.883938][ T10] usb 7-1: New USB device found, idVendor=0fd9, idProduct=0021, bcdDevice=29.40 [ 489.900512][ T10] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 489.913943][ T10] usb 7-1: config 0 descriptor?? [ 490.021728][ T5911] usb 1-1: new high-speed USB device number 106 using dummy_hcd [ 490.102114][ T29] usb 4-1: new high-speed USB device number 109 using dummy_hcd [ 490.128549][ T10] dvb-usb: found a 'Elgato EyeTV DTT' in warm state. [ 490.140144][ T10] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 490.163673][ T10] dvbdev: DVB: registering new adapter (Elgato EyeTV DTT) [ 490.170881][ T10] usb 7-1: media controller created [ 490.195274][ T10] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 490.215163][ T5911] usb 1-1: unable to get BOS descriptor or descriptor too short [ 490.234560][ T5911] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 490.247104][ T5911] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 9 [ 490.258566][ T5911] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x88 has invalid maxpacket 73 [ 490.271279][ T5911] usb 1-1: New USB device found, idVendor=04e6, idProduct=5591, bcdDevice=94.39 [ 490.281316][ T5911] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 490.291527][ T5911] usb 1-1: Product: syz [ 490.296525][ T29] usb 4-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 490.308921][ T29] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 490.321904][ T5911] usb 1-1: Manufacturer: syz [ 490.333191][ T5911] usb 1-1: SerialNumber: syz [ 490.338848][ T10] DVB: Unable to find symbol dib7000p_attach() [ 490.339428][ T29] usb 4-1: config 27 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 490.350157][ T10] dvb-usb: no frontend was attached by 'Elgato EyeTV DTT' [ 490.375708][ T5911] usb 1-1: config 0 descriptor?? [ 490.393109][T16449] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 490.412859][ T29] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 490.422269][T16449] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 490.430753][ T29] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 490.446196][ C1] usb 1-1: NFC: Urb failure (status -71) [ 490.454797][ C1] usb 1-1: NFC: Urb failure (status -71) [ 490.462470][ T10] rc_core: IR keymap rc-dib0700-rc5 not found [ 490.462899][ T5911] usb 1-1: NFC: Unable to get FW version [ 490.474948][ T10] Registered IR keymap rc-empty [ 490.485723][ T10] dvb-usb: could not initialize remote control. [ 490.490282][ T29] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 490.497394][ T10] dvb-usb: Elgato EyeTV DTT successfully initialized and connected. [ 490.509469][ T5911] pn533_usb 1-1:0.0: probe with driver pn533_usb failed with error -71 [ 490.530716][ T29] usb 4-1: invalid MIDI out EP 0 [ 490.646352][ T29] snd-usb-audio 4-1:27.0: probe with driver snd-usb-audio failed with error -22 [ 490.648234][ T10] usb 1-1: USB disconnect, device number 106 [ 490.689537][ T5898] usb 4-1: USB disconnect, device number 109 [ 490.741845][ T5891] usb 7-1: USB disconnect, device number 8 [ 490.775209][ T5891] dvb-usb: Elgato EyeTV DTT successfully deinitialized and disconnected. [ 491.451748][ T29] usb 1-1: new full-speed USB device number 107 using dummy_hcd [ 491.493048][T16484] FAULT_INJECTION: forcing a failure. [ 491.493048][T16484] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 491.507375][T16484] CPU: 1 UID: 0 PID: 16484 Comm: syz.3.4197 Tainted: G L syzkaller #0 PREEMPT(full) [ 491.507409][T16484] Tainted: [L]=SOFTLOCKUP [ 491.507417][T16484] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 491.507430][T16484] Call Trace: [ 491.507439][T16484] [ 491.507447][T16484] dump_stack_lvl+0xe8/0x150 [ 491.507482][T16484] should_fail_ex+0x412/0x560 [ 491.507511][T16484] _copy_from_iter+0x1d3/0x1670 [ 491.507539][T16484] ? rcu_is_watching+0x15/0xb0 [ 491.507577][T16484] ? __pfx__copy_from_iter+0x10/0x10 [ 491.507615][T16484] ? netlink_sendmsg+0x650/0xb40 [ 491.507641][T16484] ? skb_put+0x11b/0x210 [ 491.507666][T16484] netlink_sendmsg+0x6c0/0xb40 [ 491.507695][T16484] ? __pfx_netlink_sendmsg+0x10/0x10 [ 491.507717][T16484] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 491.507759][T16484] ? __pfx_netlink_sendmsg+0x10/0x10 [ 491.507778][T16484] sock_sendmsg_nosec+0x112/0x150 [ 491.507809][T16484] ____sys_sendmsg+0x589/0x8c0 [ 491.507840][T16484] ? __pfx_____sys_sendmsg+0x10/0x10 [ 491.507872][T16484] ? import_iovec+0x73/0xa0 [ 491.507904][T16484] ___sys_sendmsg+0x2a5/0x360 [ 491.507933][T16484] ? __pfx____sys_sendmsg+0x10/0x10 [ 491.507989][T16484] ? __fget_files+0x2a/0x420 [ 491.508015][T16484] ? __fget_files+0x3a0/0x420 [ 491.508051][T16484] __x64_sys_sendmsg+0x1bd/0x2a0 [ 491.508076][T16484] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 491.508108][T16484] ? __pfx_ksys_write+0x10/0x10 [ 491.508139][T16484] do_syscall_64+0x14d/0xf80 [ 491.508159][T16484] ? trace_irq_disable+0x3b/0x150 [ 491.508184][T16484] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 491.508206][T16484] ? clear_bhb_loop+0x40/0x90 [ 491.508231][T16484] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 491.508252][T16484] RIP: 0033:0x7f431539c799 [ 491.508272][T16484] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 491.508300][T16484] RSP: 002b:00007f431622b028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 491.508322][T16484] RAX: ffffffffffffffda RBX: 00007f4315615fa0 RCX: 00007f431539c799 [ 491.508337][T16484] RDX: 0000000000000000 RSI: 0000200000000280 RDI: 0000000000000003 [ 491.508350][T16484] RBP: 00007f431622b090 R08: 0000000000000000 R09: 0000000000000000 [ 491.508362][T16484] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 491.508374][T16484] R13: 00007f4315616038 R14: 00007f4315615fa0 R15: 00007ffc8f230758 [ 491.508406][T16484] [ 491.539395][T16486] syzkaller1: entered promiscuous mode [ 491.676547][ T29] usb 1-1: config index 0 descriptor too short (expected 23569, got 27) [ 491.733416][T16486] syzkaller1: entered allmulticast mode [ 491.766301][ T29] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 491.810493][ T29] usb 1-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 491.819789][ T29] usb 1-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 491.827998][ T29] usb 1-1: Manufacturer: syz [ 491.861952][ T29] usb 1-1: config 0 descriptor?? [ 491.877653][ T29] igorplugusb 1-1:0.0: incorrect number of endpoints [ 491.922565][ T5847] Bluetooth: Unexpected continuation frame (len 12) [ 492.073818][ T29] usb 1-1: USB disconnect, device number 107 [ 492.251910][ T10] usb 7-1: new high-speed USB device number 9 using dummy_hcd [ 492.402473][ T10] usb 7-1: Using ep0 maxpacket: 8 [ 492.409501][ T10] usb 7-1: config 127 has an invalid interface number: 171 but max is 1 [ 492.418046][ T10] usb 7-1: config 127 has an invalid descriptor of length 0, skipping remainder of the config [ 492.428512][ T10] usb 7-1: config 127 has 1 interface, different from the descriptor's value: 2 [ 492.438739][ T10] usb 7-1: config 127 has no interface number 0 [ 492.445713][ T10] usb 7-1: config 127 interface 171 has no altsetting 0 [ 492.455137][ T10] usb 7-1: New USB device found, idVendor=04e2, idProduct=1414, bcdDevice=c5.b9 [ 492.464411][ T5898] usb 4-1: new high-speed USB device number 110 using dummy_hcd [ 492.472201][ T10] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 492.480341][ T10] usb 7-1: Product: syz [ 492.484864][ T10] usb 7-1: Manufacturer: syz [ 492.489922][ T10] usb 7-1: SerialNumber: syz [ 492.634984][ T5898] usb 4-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 492.664213][ T5898] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 492.686698][ T5898] usb 4-1: config 27 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 492.701126][ T5898] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 492.710706][ T5898] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 492.726862][ T10] usb 7-1: USB disconnect, device number 9 [ 492.769809][ T5898] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 492.794273][ T5898] usb 4-1: invalid MIDI out EP 0 [ 493.025167][ T5898] snd-usb-audio 4-1:27.0: probe with driver snd-usb-audio failed with error -22 [ 493.060970][ T5898] usb 4-1: USB disconnect, device number 110 [ 493.124325][T16524] netlink: 20 bytes leftover after parsing attributes in process `syz.5.4215'. [ 493.374496][ T29] usb 1-1: new full-speed USB device number 108 using dummy_hcd [ 493.531881][ T29] usb 1-1: device descriptor read/64, error -71 [ 493.755979][T16535] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 493.769141][T16539] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4219'. [ 493.778848][ T29] usb 1-1: new full-speed USB device number 109 using dummy_hcd [ 493.826076][T16543] x_tables: duplicate underflow at hook 1 [ 493.865136][T16543] netlink: 32 bytes leftover after parsing attributes in process `syz.3.4221'. [ 493.914514][ T29] usb 1-1: device descriptor read/64, error -71 [ 494.023396][ T29] usb usb1-port1: attempt power cycle [ 494.188568][T16554] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4225'. [ 494.361787][ T29] usb 1-1: new full-speed USB device number 110 using dummy_hcd [ 494.392770][ T29] usb 1-1: device descriptor read/8, error -71 [ 494.392770][ T5898] usb 7-1: new high-speed USB device number 10 using dummy_hcd [ 494.541719][ T5898] usb 7-1: Using ep0 maxpacket: 32 [ 494.549087][ T5898] usb 7-1: unable to get BOS descriptor or descriptor too short [ 494.557883][ T5898] usb 7-1: config 78 has an invalid interface number: 117 but max is 0 [ 494.566664][ T5898] usb 7-1: config 78 has no interface number 0 [ 494.572972][ T5898] usb 7-1: config 78 interface 117 has no altsetting 0 [ 494.582352][ T5898] usb 7-1: New USB device found, idVendor=1385, idProduct=4251, bcdDevice=ca.f8 [ 494.591423][ T5898] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 494.600508][ T5898] usb 7-1: Product: syz [ 494.605699][ T5898] usb 7-1: Manufacturer: syz [ 494.610329][ T5898] usb 7-1: SerialNumber: syz [ 494.631720][ T10] usb 4-1: new high-speed USB device number 111 using dummy_hcd [ 494.642348][ T29] usb 1-1: new full-speed USB device number 111 using dummy_hcd [ 494.662760][ T29] usb 1-1: device descriptor read/8, error -71 [ 494.772939][ T29] usb usb1-port1: unable to enumerate USB device [ 494.791796][ T10] usb 4-1: Using ep0 maxpacket: 32 [ 494.798777][ T10] usb 4-1: New USB device found, idVendor=0fd9, idProduct=0021, bcdDevice=29.40 [ 494.808722][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 494.821420][ T10] usb 4-1: config 0 descriptor?? [ 494.847564][T16552] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 494.862792][T16552] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 494.878279][ T5898] usb 7-1: Could not find all expected endpoints [ 494.901496][ T5898] usb 7-1: USB disconnect, device number 10 [ 495.023827][ T5847] Bluetooth: hci0: ACL packet for unknown connection handle 201 [ 495.046359][ T10] dvb-usb: found a 'Elgato EyeTV DTT' in warm state. [ 495.058549][ T10] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 495.079901][ T10] dvbdev: DVB: registering new adapter (Elgato EyeTV DTT) [ 495.087346][ T10] usb 4-1: media controller created [ 495.109019][ T10] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 495.161021][ T10] DVB: Unable to find symbol dib7000p_attach() [ 495.168081][ T10] dvb-usb: no frontend was attached by 'Elgato EyeTV DTT' [ 495.261824][ T10] rc_core: IR keymap rc-dib0700-rc5 not found [ 495.269966][ T10] Registered IR keymap rc-empty [ 495.276647][ T10] dvb-usb: could not initialize remote control. [ 495.283386][ T10] dvb-usb: Elgato EyeTV DTT successfully initialized and connected. [ 495.563127][ T5898] usb 4-1: USB disconnect, device number 111 [ 495.626306][ T5898] dvb-usb: Elgato EyeTV DTT successfully deinitialized and disconnected. [ 495.876810][T16589] binder: 16587:16589 ioctl 4018f514 0 returned -22 [ 496.329545][ T5847] Bluetooth: hci0: ACL packet for unknown connection handle 201 [ 496.572839][ T5911] usb 4-1: new high-speed USB device number 112 using dummy_hcd [ 496.732873][ T5911] usb 4-1: Using ep0 maxpacket: 8 [ 496.747220][ T5911] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 496.765740][ T5911] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 496.778587][ T5911] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 496.791587][ T5911] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 496.811237][ T5911] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 496.829523][ T5911] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 497.021926][ T29] usb 7-1: new high-speed USB device number 11 using dummy_hcd [ 497.061200][ T5911] usb 4-1: GET_CAPABILITIES returned 0 [ 497.067952][ T5911] usbtmc 4-1:16.0: can't read capabilities [ 497.171721][ T29] usb 7-1: Using ep0 maxpacket: 32 [ 497.180208][ T29] usb 7-1: New USB device found, idVendor=0fd9, idProduct=0021, bcdDevice=29.40 [ 497.189959][ T29] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 497.207743][ T29] usb 7-1: config 0 descriptor?? [ 497.282304][ T5911] usb 4-1: USB disconnect, device number 112 [ 497.426284][ T29] dvb-usb: found a 'Elgato EyeTV DTT' in warm state. [ 497.444212][ T29] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 497.464904][ T29] dvbdev: DVB: registering new adapter (Elgato EyeTV DTT) [ 497.482421][ T29] usb 7-1: media controller created [ 497.517797][ T29] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 497.556809][T16618] netlink: 212368 bytes leftover after parsing attributes in process `syz.5.4249'. [ 497.639779][ T29] DVB: Unable to find symbol dib7000p_attach() [ 497.651825][ T29] dvb-usb: no frontend was attached by 'Elgato EyeTV DTT' [ 497.680795][ T5847] Bluetooth: hci0: ACL packet for unknown connection handle 201 [ 497.764909][T16629] netlink: 20 bytes leftover after parsing attributes in process `syz.5.4252'. [ 497.775187][ T29] rc_core: IR keymap rc-dib0700-rc5 not found [ 497.781332][ T29] Registered IR keymap rc-empty [ 497.790991][ T29] dvb-usb: could not initialize remote control. [ 497.797924][ T29] dvb-usb: Elgato EyeTV DTT successfully initialized and connected. [ 497.847165][T16632] netlink: 20 bytes leftover after parsing attributes in process `syz.5.4252'. [ 497.862466][T16632] netlink: 64 bytes leftover after parsing attributes in process `syz.5.4252'. [ 497.894585][T16634] netlink: 104 bytes leftover after parsing attributes in process `syz.3.4254'. [ 498.036410][ T5911] usb 7-1: USB disconnect, device number 11 [ 498.061951][ T29] usb 1-1: new high-speed USB device number 112 using dummy_hcd [ 498.078311][ T5911] dvb-usb: Elgato EyeTV DTT successfully deinitialized and disconnected. [ 498.221771][ T29] usb 1-1: Using ep0 maxpacket: 16 [ 498.228591][ T29] usb 1-1: config 0 has no interfaces? [ 498.236449][ T29] usb 1-1: New USB device found, idVendor=04fc, idProduct=1528, bcdDevice=6d.5d [ 498.245784][ T29] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 498.253954][ T29] usb 1-1: Product: syz [ 498.258791][ T29] usb 1-1: Manufacturer: syz [ 498.263522][ T29] usb 1-1: SerialNumber: syz [ 498.271282][ T29] usb 1-1: config 0 descriptor?? [ 498.636475][T16642] x_tables: duplicate underflow at hook 1 [ 498.686661][T16644] netlink: 2384 bytes leftover after parsing attributes in process `syz.3.4258'. [ 498.699418][T16644] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 498.818845][T16656] netlink: 32 bytes leftover after parsing attributes in process `syz.6.4255'. [ 498.834939][ T5847] Bluetooth: hci0: ACL packet for unknown connection handle 201 [ 498.851327][ T5847] Bluetooth: hci0: ACL packet for unknown connection handle 201 [ 499.222327][T16661] netlink: 'syz.5.4262': attribute type 21 has an invalid length. [ 499.230523][T16661] netlink: 100 bytes leftover after parsing attributes in process `syz.5.4262'. [ 499.322870][ T5898] usb 7-1: new high-speed USB device number 12 using dummy_hcd [ 499.491833][ T5898] usb 7-1: Using ep0 maxpacket: 32 [ 499.503693][ T5898] usb 7-1: New USB device found, idVendor=0fd9, idProduct=0021, bcdDevice=29.40 [ 499.514432][ T5898] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 499.530205][ T5898] usb 7-1: config 0 descriptor?? [ 499.748697][ T5898] dvb-usb: found a 'Elgato EyeTV DTT' in warm state. [ 499.765648][ T5898] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 499.801101][ T5898] dvbdev: DVB: registering new adapter (Elgato EyeTV DTT) [ 499.827538][ T5898] usb 7-1: media controller created [ 499.879845][ T5898] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 499.988402][ T5898] DVB: Unable to find symbol dib7000p_attach() [ 499.997331][ T5898] dvb-usb: no frontend was attached by 'Elgato EyeTV DTT' [ 500.092148][ T5898] rc_core: IR keymap rc-dib0700-rc5 not found [ 500.101349][ T5898] Registered IR keymap rc-empty [ 500.110648][ T5898] dvb-usb: could not initialize remote control. [ 500.119278][ T5898] dvb-usb: Elgato EyeTV DTT successfully initialized and connected. [ 500.251266][T16671] autofs4:pid:16671:validate_dev_ioctl: invalid path supplied for cmd(0xc018937e) [ 500.360265][ T5898] usb 7-1: USB disconnect, device number 12 [ 500.417678][ T5898] dvb-usb: Elgato EyeTV DTT successfully deinitialized and disconnected. [ 500.480720][T16678] syzkaller0: entered promiscuous mode [ 500.486600][T16678] syzkaller0: entered allmulticast mode [ 500.591724][ T5847] Bluetooth: hci3: command 0x0406 tx timeout [ 500.611534][T16638] Bluetooth: hci3: Opcode 0x0401 failed: -110 [ 501.230519][ T5947] usb 1-1: USB disconnect, device number 112 [ 501.245928][ T1315] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.735733][ T5848] usb 1-1: new full-speed USB device number 113 using dummy_hcd [ 501.904263][ T5848] usb 1-1: unable to get BOS descriptor or descriptor too short [ 501.923269][ T5848] usb 1-1: not running at top speed; connect to a high speed hub [ 501.942294][ T5848] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 501.952905][ T5848] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 501.969874][ T5848] usb 1-1: string descriptor 0 read error: -22 [ 501.977481][ T5848] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 501.990331][ T5848] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 502.028003][ T5848] usb 1-1: 0:2 : does not exist [ 502.251763][ T5898] usb 4-1: new high-speed USB device number 113 using dummy_hcd [ 502.353927][T16716] team_slave_0: entered promiscuous mode [ 502.362573][T16716] team_slave_1: entered promiscuous mode [ 502.370292][T16716] netlink: 'syz.5.4282': attribute type 10 has an invalid length. [ 502.384514][T16716] team_slave_0: left promiscuous mode [ 502.391007][T16716] team_slave_1: left promiscuous mode [ 502.421769][ T5898] usb 4-1: Using ep0 maxpacket: 32 [ 502.430715][T16716] team0 (unregistering): Port device team_slave_0 removed [ 502.431125][ T5898] usb 4-1: config 0 has an invalid interface number: 89 but max is 0 [ 502.453488][ T5898] usb 4-1: config 0 has no interface number 0 [ 502.459887][ T5898] usb 4-1: config 0 interface 89 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 502.470032][ T5898] usb 4-1: config 0 interface 89 has no altsetting 0 [ 502.481289][ T5898] usb 4-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4a [ 502.491876][ T5898] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 502.499990][ T5898] usb 4-1: Product: syz [ 502.504796][ T5898] usb 4-1: Manufacturer: syz [ 502.509510][ T5898] usb 4-1: SerialNumber: syz [ 502.526336][ T5898] usb 4-1: config 0 descriptor?? [ 502.533965][T16716] team0 (unregistering): Port device team_slave_1 removed [ 502.546100][ T5898] em28xx 4-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 502.557924][ T5898] em28xx 4-1:0.89: Video interface 89 found: [ 502.647037][ T5848] usb 1-1: 5:0: cannot get min/max values for control 2 (id 5) [ 502.670935][ T5848] usb 1-1: 5:0: cannot get min/max values for control 3 (id 5) [ 502.707184][ T5848] usb 1-1: 5:0: failed to get current value for ch 1 (-22) [ 502.759290][ T5848] usb 1-1: 5:0: cannot get min/max values for control 3 (id 5) [ 502.820456][ T5848] usb 1-1: USB disconnect, device number 113 [ 503.135936][ T5898] em28xx 4-1:0.89: unknown em28xx chip ID (0) [ 503.468059][T16740] binder: 16739:16740 ioctl 4018620d 0 returned -22 [ 503.651832][ T5947] usb 7-1: new high-speed USB device number 13 using dummy_hcd [ 503.761781][ T10] usb 1-1: new high-speed USB device number 114 using dummy_hcd [ 503.801829][ T5947] usb 7-1: Using ep0 maxpacket: 32 [ 503.809097][ T5947] usb 7-1: New USB device found, idVendor=0fd9, idProduct=0021, bcdDevice=29.40 [ 503.819302][ T5947] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 503.832193][ T5947] usb 7-1: config 0 descriptor?? [ 503.911713][ T10] usb 1-1: Using ep0 maxpacket: 8 [ 503.919663][ T10] usb 1-1: config index 0 descriptor too short (expected 301, got 45) [ 503.928030][ T10] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 503.937935][ T10] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 503.947863][ T10] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 503.958595][ T10] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 503.971846][ T10] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 503.980996][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 504.041102][ T5947] dvb-usb: found a 'Elgato EyeTV DTT' in warm state. [ 504.052299][ T5947] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 504.062991][ T5947] dvbdev: DVB: registering new adapter (Elgato EyeTV DTT) [ 504.070221][ T5947] usb 7-1: media controller created [ 504.090421][ T5947] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 504.147978][ T5947] DVB: Unable to find symbol dib7000p_attach() [ 504.154370][ T5947] dvb-usb: no frontend was attached by 'Elgato EyeTV DTT' [ 504.182287][ T5898] em28xx 4-1:0.89: reading from i2c device at 0xa0 failed (error=-5) [ 504.190485][ T5898] em28xx 4-1:0.89: board has no eeprom [ 504.208656][ T10] usb 1-1: usb_control_msg returned -32 [ 504.215709][ T10] usbtmc 1-1:16.0: can't read capabilities [ 504.261930][ T5898] em28xx 4-1:0.89: Identified as Terratec Grabby (card=67) [ 504.269245][ T5947] rc_core: IR keymap rc-dib0700-rc5 not found [ 504.276381][ T5898] em28xx 4-1:0.89: analog set to bulk mode. [ 504.282397][ T5947] Registered IR keymap rc-empty [ 504.287884][ T5947] dvb-usb: could not initialize remote control. [ 504.295363][ T5891] em28xx 4-1:0.89: Registering V4L2 extension [ 504.305771][ T5947] dvb-usb: Elgato EyeTV DTT successfully initialized and connected. [ 504.315901][ T5898] usb 4-1: USB disconnect, device number 113 [ 504.330951][ T5898] em28xx 4-1:0.89: Disconnecting em28xx [ 504.369826][ T5891] em28xx 4-1:0.89: Config register raw data: 0xffffffed [ 504.378229][ T5891] em28xx 4-1:0.89: AC97 chip type couldn't be determined [ 504.385457][ T5891] em28xx 4-1:0.89: No AC97 audio processor [ 504.393517][ T5891] usb 4-1: Decoder not found [ 504.398238][ T5891] em28xx 4-1:0.89: failed to create media graph [ 504.405319][ T5891] em28xx 4-1:0.89: V4L2 device video103 deregistered [ 504.413456][ T5891] em28xx 4-1:0.89: Registering snapshot button... [ 504.421031][ T5891] input: em28xx snapshot button as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.89/input/input61 [ 504.440006][ T5891] em28xx 4-1:0.89: Remote control support is not available for this card. [ 504.449408][ T5898] em28xx 4-1:0.89: Closing input extension [ 504.455396][ T5898] em28xx 4-1:0.89: Deregistering snapshot button [ 504.470547][ T5898] em28xx 4-1:0.89: Freeing device [ 504.587621][ T5911] usb 7-1: USB disconnect, device number 13 [ 504.617398][ T5911] dvb-usb: Elgato EyeTV DTT successfully deinitialized and disconnected. [ 504.973393][T16758] usbtmc 1-1:16.0: usb_control_msg returned -32 [ 505.178051][ T5891] usb 1-1: USB disconnect, device number 114 [ 505.427916][T16782] syzkaller0: entered promiscuous mode [ 505.434425][T16782] syzkaller0: entered allmulticast mode [ 505.897045][T16801] netlink: 'syz.0.4310': attribute type 4 has an invalid length. [ 505.905951][T16801] netlink: 3657 bytes leftover after parsing attributes in process `syz.0.4310'. [ 506.003012][ T5898] usb 4-1: new high-speed USB device number 114 using dummy_hcd [ 506.161722][ T5898] usb 4-1: Using ep0 maxpacket: 32 [ 506.169585][ T5898] usb 4-1: New USB device found, idVendor=0fd9, idProduct=0021, bcdDevice=29.40 [ 506.178867][ T5898] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 506.190965][ T5898] usb 4-1: config 0 descriptor?? [ 506.400424][ T5898] dvb-usb: found a 'Elgato EyeTV DTT' in warm state. [ 506.411767][ T5898] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 506.424149][ T5898] dvbdev: DVB: registering new adapter (Elgato EyeTV DTT) [ 506.431347][ T5898] usb 4-1: media controller created [ 506.455573][ T5898] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 506.554434][ T5898] DVB: Unable to find symbol dib7000p_attach() [ 506.564960][ T5898] dvb-usb: no frontend was attached by 'Elgato EyeTV DTT' [ 506.642722][ T5898] rc_core: IR keymap rc-dib0700-rc5 not found [ 506.648883][ T5898] Registered IR keymap rc-empty [ 506.658681][ T5898] dvb-usb: could not initialize remote control. [ 506.666890][ T5898] dvb-usb: Elgato EyeTV DTT successfully initialized and connected. [ 506.761482][T16812] netlink: 36 bytes leftover after parsing attributes in process `syz.5.4314'. [ 506.773448][T16812] openvswitch: netlink: Flow key attr not present in new flow. [ 506.860898][T16816] loop6: detected capacity change from 0 to 2640 [ 506.868712][T16816] buffer_io_error: 11 callbacks suppressed [ 506.868729][T16816] Buffer I/O error on dev loop6, logical block 0, async page read [ 506.872730][ T5898] usb 7-1: new full-speed USB device number 14 using dummy_hcd [ 506.877915][T16816] Buffer I/O error on dev loop6, logical block 0, async page read [ 506.902237][T16816] Buffer I/O error on dev loop6, logical block 0, async page read [ 506.910135][T16816] Buffer I/O error on dev loop6, logical block 0, async page read [ 506.918979][T16816] Buffer I/O error on dev loop6, logical block 0, async page read [ 506.927062][T16816] Buffer I/O error on dev loop6, logical block 0, async page read [ 506.935141][T16816] Buffer I/O error on dev loop6, logical block 0, async page read [ 506.943102][T16816] Buffer I/O error on dev loop6, logical block 0, async page read [ 506.951090][T16816] ldm_validate_partition_table(): Disk read failed. [ 506.962773][T16816] Buffer I/O error on dev loop6, logical block 0, async page read [ 506.970765][T16816] Buffer I/O error on dev loop6, logical block 0, async page read [ 506.976234][ T5891] usb 4-1: USB disconnect, device number 114 [ 506.979971][T16816] Dev loop6: unable to read RDB block 0 [ 506.991389][T16816] loop6: unable to read partition table [ 506.999473][T16816] loop_reread_partitions: partition scan of loop6 (3Ÿ ¾‚³˜) failed (rc=-5) [ 507.021786][ T5898] usb 7-1: device descriptor read/64, error -71 [ 507.058302][ T5891] dvb-usb: Elgato EyeTV DTT successfully deinitialized and disconnected. [ 507.170012][T16824] (syz.0.4319,16824,0):dlmfs_mkdir:421 ERROR: invalid domain name for directory. [ 507.261973][ T5898] usb 7-1: new full-speed USB device number 15 using dummy_hcd [ 507.286751][T16829] binder_alloc: 16828: binder_alloc_buf, no vma [ 507.392860][ T5898] usb 7-1: device descriptor read/64, error -71 [ 507.521997][ T5898] usb usb7-port1: attempt power cycle [ 507.531067][T16839] x_tables: duplicate underflow at hook 1 [ 507.831733][ T5911] usb 4-1: new low-speed USB device number 115 using dummy_hcd [ 507.881798][ T5898] usb 7-1: new full-speed USB device number 16 using dummy_hcd [ 507.915553][T16850] fuse: Unknown parameter 'roo†mode' [ 507.933741][ T5898] usb 7-1: device descriptor read/8, error -71 [ 507.985547][ T5911] usb 4-1: config 0 has an invalid interface number: 244 but max is 0 [ 508.010329][ T5911] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 508.031731][ T5911] usb 4-1: config 0 has no interface number 0 [ 508.047691][ T5911] usb 4-1: New USB device found, idVendor=1163, idProduct=0200, bcdDevice=e1.32 [ 508.056825][ T5911] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 508.069321][ T5911] usb 4-1: config 0 descriptor?? [ 508.171745][ T5898] usb 7-1: new full-speed USB device number 17 using dummy_hcd [ 508.212853][ T5898] usb 7-1: device descriptor read/8, error -71 [ 508.284120][T16841] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 508.303204][T16841] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 508.313984][ T5911] usb 4-1: string descriptor 0 read error: -71 [ 508.337775][ T5911] cypress_m8 4-1:0.244: DeLorme Earthmate USB converter detected [ 508.342800][ T5898] usb usb7-port1: unable to enumerate USB device [ 508.355376][ T5911] earthmate ttyUSB0: required endpoint is missing [ 508.386496][ T5911] usb 4-1: USB disconnect, device number 115 [ 508.401247][ T5911] cypress_m8 4-1:0.244: device disconnected [ 509.251766][ T10] usb 1-1: new high-speed USB device number 115 using dummy_hcd [ 509.401736][ T10] usb 1-1: Using ep0 maxpacket: 32 [ 509.409208][ T10] usb 1-1: New USB device found, idVendor=0fd9, idProduct=0021, bcdDevice=29.40 [ 509.419298][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 509.433818][ T10] usb 1-1: config 0 descriptor?? [ 509.653319][ T10] dvb-usb: found a 'Elgato EyeTV DTT' in warm state. [ 509.686331][ T10] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 509.728223][ T10] dvbdev: DVB: registering new adapter (Elgato EyeTV DTT) [ 509.746589][ T10] usb 1-1: media controller created [ 509.765037][ T10] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 509.894830][ T10] DVB: Unable to find symbol dib7000p_attach() [ 509.922640][ T10] dvb-usb: no frontend was attached by 'Elgato EyeTV DTT' [ 510.074945][T16906] binder_alloc: 16905: binder_alloc_buf, no vma [ 510.102150][ T10] rc_core: IR keymap rc-dib0700-rc5 not found [ 510.118822][ T10] Registered IR keymap rc-empty [ 510.133506][ T10] dvb-usb: could not initialize remote control. [ 510.149182][ T10] dvb-usb: Elgato EyeTV DTT successfully initialized and connected. [ 510.363815][ T5891] usb 1-1: USB disconnect, device number 115 [ 510.430467][ T5891] dvb-usb: Elgato EyeTV DTT successfully deinitialized and disconnected. [ 510.541907][ T5956] usb 4-1: new high-speed USB device number 116 using dummy_hcd [ 510.691708][ T5956] usb 4-1: Using ep0 maxpacket: 8 [ 510.691731][ T10] usb 7-1: new high-speed USB device number 18 using dummy_hcd [ 510.706294][ T5956] usb 4-1: New USB device found, idVendor=0c45, idProduct=613e, bcdDevice=c4.6d [ 510.715524][ T5956] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 510.724277][ T5956] usb 4-1: Product: syz [ 510.728580][ T5956] usb 4-1: Manufacturer: syz [ 510.733230][ T5956] usb 4-1: SerialNumber: syz [ 510.741227][ T5956] usb 4-1: config 0 descriptor?? [ 510.753548][ T5956] gspca_main: sonixj-2.14.0 probing 0c45:613e [ 510.856804][ T10] usb 7-1: config 0 has no interfaces? [ 510.863415][ T10] usb 7-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 510.881761][ T10] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 510.905837][ T10] usb 7-1: config 0 descriptor?? [ 511.124917][ T5911] usb 7-1: USB disconnect, device number 18 [ 511.182554][ T10] usb 1-1: new high-speed USB device number 116 using dummy_hcd [ 511.346910][ T10] usb 1-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 511.357391][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 511.365921][ T10] usb 1-1: Product: syz [ 511.370192][ T10] usb 1-1: Manufacturer: syz [ 511.375925][ T10] usb 1-1: SerialNumber: syz [ 511.384538][ T10] usb 1-1: config 0 descriptor?? [ 511.767712][ T5956] gspca_sonixj: reg_w1 err -71 [ 511.820867][T16922] syz.0.4344 (16922) used obsolete PPPIOCDETACH ioctl [ 511.829925][ T5956] sonixj 4-1:0.0: probe with driver sonixj failed with error -71 [ 511.869921][ T5956] usb 4-1: USB disconnect, device number 116 [ 512.104601][ T10] usb 1-1: Firmware version (0.0) predates our first public release. [ 512.119838][ T10] usb 1-1: Please update to version 0.2 or newer [ 512.165235][ T10] usb 1-1: USB disconnect, device number 116 [ 512.242710][ T5956] usb 7-1: new high-speed USB device number 19 using dummy_hcd [ 512.393437][ T5956] usb 7-1: Using ep0 maxpacket: 16 [ 512.402564][ T5956] usb 7-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 512.412034][ T5956] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 512.425717][ T5956] usb 7-1: Product: syz [ 512.429908][ T5956] usb 7-1: Manufacturer: syz [ 512.435073][ T5956] usb 7-1: SerialNumber: syz [ 513.028186][T16976] netlink: 'syz.5.4360': attribute type 8 has an invalid length. [ 513.241987][ T5911] usb 4-1: new high-speed USB device number 117 using dummy_hcd [ 513.392617][ T5911] usb 4-1: device descriptor read/64, error -71 [ 513.414964][T16993] netlink: 32 bytes leftover after parsing attributes in process `syz.5.4365'. [ 513.644012][ T5911] usb 4-1: new high-speed USB device number 118 using dummy_hcd [ 513.791834][ T5911] usb 4-1: device descriptor read/64, error -71 [ 513.903621][ T5911] usb usb4-port1: attempt power cycle [ 514.095697][ T5956] usb 7-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 514.121324][ T5956] usb 7-1: 2:1 : no UAC_FORMAT_TYPE desc [ 514.176480][T17019] x_tables: duplicate underflow at hook 1 [ 514.178934][ T5956] usb 7-1: USB disconnect, device number 19 [ 514.252037][ T5911] usb 4-1: new high-speed USB device number 119 using dummy_hcd [ 514.292555][ T5911] usb 4-1: device descriptor read/8, error -71 [ 514.314500][T17022] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4370'. [ 514.325790][T17024] netlink: 16 bytes leftover after parsing attributes in process `syz.0.4371'. [ 514.400018][T17026] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4372'. [ 514.414392][T17026] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4372'. [ 514.418991][T17028] binder: BINDER_SET_CONTEXT_MGR already set [ 514.430678][T17028] binder: 17027:17028 ioctl 4018620d 200000004a80 returned -16 [ 514.542279][ T5911] usb 4-1: new high-speed USB device number 120 using dummy_hcd [ 514.572322][ T5911] usb 4-1: device descriptor read/8, error -71 [ 514.624715][T17038] x_tables: duplicate underflow at hook 1 [ 514.692946][ T5911] usb usb4-port1: unable to enumerate USB device [ 514.812727][T17047] netlink: 'syz.0.4382': attribute type 1 has an invalid length. [ 514.827839][T17049] overlayfs: failed to clone upperpath [ 515.051019][T17063] x_tables: duplicate underflow at hook 1 [ 515.557713][ T5847] Bluetooth: hci1: link tx timeout [ 515.565465][ T5847] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 515.695449][ T30] audit: type=1800 audit(1773790823.937:8): pid=17084 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.4397" name="nullb0" dev="tmpfs" ino=1102 res=0 errno=0 [ 515.731762][ T5911] usb 1-1: new high-speed USB device number 117 using dummy_hcd [ 515.771734][ T5956] usb 7-1: new high-speed USB device number 20 using dummy_hcd [ 515.820282][T17088] x_tables: duplicate underflow at hook 1 [ 515.868639][ T5855] Bluetooth: hci1: link tx timeout [ 515.877525][ T5855] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 515.892123][ T5911] usb 1-1: Using ep0 maxpacket: 8 [ 515.901747][ T5911] usb 1-1: config index 0 descriptor too short (expected 301, got 45) [ 515.910119][ T5911] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 515.920278][ T5911] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 515.930379][ T5911] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 515.941493][ T5911] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 515.955670][ T5911] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 515.965937][ T5911] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 515.966233][ T5956] usb 7-1: config 0 has too many interfaces: 253, using maximum allowed: 32 [ 516.001884][ T5956] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 253 [ 516.026330][ T5956] usb 7-1: New USB device found, idVendor=055f, idProduct=c630, bcdDevice=b6.ac [ 516.035658][ T5956] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 516.046285][ T5956] usb 7-1: Product: syz [ 516.050561][ T5956] usb 7-1: Manufacturer: syz [ 516.055254][ T5956] usb 7-1: SerialNumber: syz [ 516.067979][ T5956] usb 7-1: config 0 descriptor?? [ 516.081560][ T5956] gspca_main: sunplus-2.14.0 probing 055f:c630 [ 516.213451][ T5911] usb 1-1: usb_control_msg returned -32 [ 516.219117][ T5911] usbtmc 1-1:16.0: can't read capabilities [ 516.347984][ T10] usb 7-1: USB disconnect, device number 20 [ 516.392147][ T5911] usb 4-1: new high-speed USB device number 121 using dummy_hcd [ 516.420185][ T5855] Bluetooth: hci1: link tx timeout [ 516.427221][ T5855] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 516.455991][T17104] binder: BINDER_SET_CONTEXT_MGR already set [ 516.462200][T17104] binder: 17103:17104 ioctl 4018620d 200000004a80 returned -16 [ 516.526399][T17106] netlink: 8 bytes leftover after parsing attributes in process `syz.6.4404'. [ 516.586355][ T5911] usb 4-1: New USB device found, idVendor=055f, idProduct=c420, bcdDevice=6a.33 [ 516.597405][ T5911] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 516.633100][ T5911] usb 4-1: config 0 descriptor?? [ 516.653419][ T5911] gspca_main: sunplus-2.14.0 probing 055f:c420 [ 516.857895][T17115] x_tables: duplicate underflow at hook 1 [ 517.269278][ T5911] gspca_sunplus: reg_w_riv err -71 [ 517.277173][ T5911] sunplus 4-1:0.0: probe with driver sunplus failed with error -71 [ 517.288369][ T5911] usb 4-1: USB disconnect, device number 121 [ 517.313900][ T5949] usb 7-1: new full-speed USB device number 21 using dummy_hcd [ 517.451805][ T5949] usb 7-1: device descriptor read/64, error -71 [ 517.631783][ T5855] Bluetooth: hci1: command 0x0406 tx timeout [ 517.701766][ T5949] usb 7-1: new full-speed USB device number 22 using dummy_hcd [ 517.842914][ T5949] usb 7-1: device descriptor read/64, error -71 [ 517.953479][ T5949] usb usb7-port1: attempt power cycle [ 518.054389][T17138] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4418'. [ 518.303695][T17142] x_tables: duplicate underflow at hook 1 [ 518.315669][ T5949] usb 7-1: new full-speed USB device number 23 using dummy_hcd [ 518.341816][ T5911] usb 4-1: new high-speed USB device number 122 using dummy_hcd [ 518.347925][ T5949] usb 7-1: device descriptor read/8, error -71 [ 518.501737][ T5911] usb 4-1: Using ep0 maxpacket: 32 [ 518.510775][ T5911] usb 4-1: unable to get BOS descriptor or descriptor too short [ 518.525742][ T5911] usb 4-1: New USB device found, idVendor=1430, idProduct=474b, bcdDevice= 0.40 [ 518.536187][ T5911] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 518.546888][ T5911] usb 4-1: Product: syz [ 518.551150][ T5911] usb 4-1: Manufacturer: syz [ 518.563435][ T5911] usb 4-1: SerialNumber: syz [ 518.611735][ T5949] usb 7-1: new full-speed USB device number 24 using dummy_hcd [ 518.632297][ T5949] usb 7-1: device descriptor read/8, error -71 [ 518.762187][ T5949] usb usb7-port1: unable to enumerate USB device [ 518.790177][ T5911] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 518.800128][ T5911] usb 4-1: MIDIStreaming interface descriptor not found [ 518.875074][ T5911] usb 4-1: USB disconnect, device number 122 [ 518.925869][T10937] udevd[10937]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 519.338087][T17161] x_tables: duplicate underflow at hook 1 [ 519.504211][T17167] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4432'. [ 519.850643][T17177] netlink: 60 bytes leftover after parsing attributes in process `syz.5.4437'. [ 519.864976][T17177] netlink: 60 bytes leftover after parsing attributes in process `syz.5.4437'. [ 519.925149][T17179] x_tables: duplicate underflow at hook 1 [ 520.464647][T17197] x_tables: duplicate underflow at hook 1 [ 520.881463][T17215] netlink: 48 bytes leftover after parsing attributes in process `syz.6.4453'. [ 521.191706][ T5956] usb 4-1: new high-speed USB device number 123 using dummy_hcd [ 521.341787][ T5956] usb 4-1: Using ep0 maxpacket: 8 [ 521.363583][ T10] usb 7-1: new high-speed USB device number 25 using dummy_hcd [ 521.381330][ T5956] usb 4-1: unable to get BOS descriptor or descriptor too short [ 521.392104][ T5956] usb 4-1: too many configurations: 239, using maximum allowed: 8 [ 521.415686][ T5956] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 521.450530][ T5956] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 521.466204][ T5956] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 521.485766][ T5956] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 521.498380][ T5956] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 521.524076][ T5956] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 521.547128][ T10] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 521.573449][ T10] usb 7-1: config 0 has no interfaces? [ 521.576057][ T5956] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 521.579531][ T10] usb 7-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 521.599204][ T10] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 521.614068][ T10] usb 7-1: config 0 descriptor?? [ 521.632306][ T5956] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 521.653218][ T5956] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 521.674738][ T5956] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 521.694780][ T5956] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 521.724474][ T5956] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 521.747545][ T5956] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 521.772701][ T5956] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 521.793660][ T5956] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 521.825207][ T5956] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 521.846327][ T5956] usb 4-1: New USB device found, idVendor=0e41, idProduct=4241, bcdDevice=ac.24 [ 521.858894][ T10] usb 7-1: USB disconnect, device number 25 [ 521.866052][ T5956] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=246 [ 521.875142][ T5956] usb 4-1: Product: syz [ 521.879924][ T5956] usb 4-1: Manufacturer: syz [ 521.884772][ T5956] usb 4-1: SerialNumber: syz [ 521.951539][T17250] netlink: 20 bytes leftover after parsing attributes in process `syz.5.4463'. [ 521.969964][T17250] netlink: 84 bytes leftover after parsing attributes in process `syz.5.4463'. [ 522.135386][T17221] comedi comedi4: bad chanlist[0]=0x04000020 chan=32 range length=1 [ 522.240218][ T5956] usb 4-1: USB disconnect, device number 123 [ 522.436641][T17130] usbtmc 1-1:16.0: usb_control_msg returned -110 [ 522.503502][ T5956] usb 1-1: USB disconnect, device number 117 [ 522.940019][T17297] netlink: 4 bytes leftover after parsing attributes in process `syz.5.4475'. [ 523.082059][ T5891] usb 7-1: new full-speed USB device number 26 using dummy_hcd [ 523.173630][ T10] usb 1-1: new high-speed USB device number 118 using dummy_hcd [ 523.226279][ T5847] Bluetooth: hci0: ACL packet for unknown connection handle 201 [ 523.247039][ T5891] usb 7-1: not running at top speed; connect to a high speed hub [ 523.261449][ T5891] usb 7-1: New USB device found, idVendor=15ca, idProduct=1806, bcdDevice= 0.40 [ 523.275639][ T5891] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 523.281987][ T5956] usb 4-1: new high-speed USB device number 124 using dummy_hcd [ 523.289639][ T5891] usb 7-1: Product: syz [ 523.296185][ T5891] usb 7-1: Manufacturer: syz [ 523.300881][ T5891] usb 7-1: SerialNumber: syz [ 523.343553][ T10] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 523.354996][ T10] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 523.366765][ T10] usb 1-1: New USB device found, idVendor=1a86, idProduct=7522, bcdDevice=35.36 [ 523.376477][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 523.386090][ T10] usb 1-1: Product: syz [ 523.390322][ T10] usb 1-1: Manufacturer: syz [ 523.396216][ T10] usb 1-1: SerialNumber: syz [ 523.403866][ T10] usb 1-1: config 0 descriptor?? [ 523.454199][ T5956] usb 4-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 523.465676][ T5956] usb 4-1: config 27 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 523.479533][ T5956] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 523.488709][ T5956] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 523.510468][ T5956] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 523.527118][T17288] netlink: 'syz.6.4472': attribute type 10 has an invalid length. [ 523.565951][T17288] team0: Port device netdevsim0 added [ 523.609226][ T5956] snd-usb-audio 4-1:27.0: probe with driver snd-usb-audio failed with error -2 [ 523.713711][ T10] usb 4-1: USB disconnect, device number 124 [ 523.969142][T17323] netlink: 4 bytes leftover after parsing attributes in process `syz.5.4485'. [ 524.030169][T17326] netlink: 'syz.5.4486': attribute type 1 has an invalid length. [ 524.099679][ T5891] usb 7-1: Quirk or no altset; falling back to MIDI 1.0 [ 524.108797][ T5891] usb 7-1: MIDIStreaming interface descriptor not found [ 524.191503][ T5891] usb 7-1: USB disconnect, device number 26 [ 524.291446][T10937] udevd[10937]: error opening ATTR{/sys/devices/platform/dummy_hcd.6/usb7/7-1/7-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 524.591841][ T10] usb 4-1: new full-speed USB device number 125 using dummy_hcd [ 524.704682][T17343] netlink: 4 bytes leftover after parsing attributes in process `syz.5.4494'. [ 524.745073][ T10] usb 4-1: unable to get BOS descriptor or descriptor too short [ 524.753954][ T10] usb 4-1: not running at top speed; connect to a high speed hub [ 524.762440][ T10] usb 4-1: too many configurations: 64, using maximum allowed: 8 [ 524.777448][ T10] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 524.785823][ T10] usb 4-1: can't read configurations, error -61 [ 524.797973][T17345] netlink: 4 bytes leftover after parsing attributes in process `syz.5.4495'. [ 524.921775][ T10] usb 4-1: new full-speed USB device number 126 using dummy_hcd [ 525.076931][ T10] usb 4-1: unable to get BOS descriptor or descriptor too short [ 525.085598][ T10] usb 4-1: not running at top speed; connect to a high speed hub [ 525.093479][ T10] usb 4-1: too many configurations: 64, using maximum allowed: 8 [ 525.104191][ T10] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 525.112538][ T10] usb 4-1: can't read configurations, error -61 [ 525.119191][ T10] usb usb4-port1: attempt power cycle [ 525.308607][T17349] [U]  [ 525.463287][ T10] usb 4-1: new full-speed USB device number 127 using dummy_hcd [ 525.505171][ T10] usb 4-1: unable to get BOS descriptor or descriptor too short [ 525.516523][ T10] usb 4-1: not running at top speed; connect to a high speed hub [ 525.526060][ T10] usb 4-1: too many configurations: 64, using maximum allowed: 8 [ 525.536491][ T10] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 525.546492][ T10] usb 4-1: can't read configurations, error -61 [ 525.566645][T17361] netlink: 'syz.5.4502': attribute type 4 has an invalid length. [ 525.611728][ T5949] usb 7-1: new high-speed USB device number 27 using dummy_hcd [ 525.681883][ T10] usb 4-1: new full-speed USB device number 2 using dummy_hcd [ 525.704513][ T10] usb 4-1: unable to get BOS descriptor or descriptor too short [ 525.726579][ T10] usb 4-1: not running at top speed; connect to a high speed hub [ 525.734694][ T10] usb 4-1: too many configurations: 64, using maximum allowed: 8 [ 525.747000][ T10] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 525.755243][ T10] usb 4-1: can't read configurations, error -61 [ 525.762245][ T10] usb usb4-port1: unable to enumerate USB device [ 525.773445][ T5949] usb 7-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 525.784752][ T5949] usb 7-1: config 27 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 525.799271][ T5949] usb 7-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 525.821696][ T5949] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 525.856720][ T5949] usb 7-1: Quirk or no altset; falling back to MIDI 1.0 [ 525.957518][ T5956] usb 1-1: USB disconnect, device number 118 [ 525.977809][ T5949] snd-usb-audio 7-1:27.0: probe with driver snd-usb-audio failed with error -2 [ 526.047951][ T5949] usb 7-1: USB disconnect, device number 27 [ 526.309897][T17388] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 526.318962][T17388] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 526.341508][T17389] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 526.365691][T17388] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 526.376620][T17388] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 526.541866][T15478] usb 1-1: new high-speed USB device number 119 using dummy_hcd [ 526.784345][T17409] PF_CAN: dropped non conform CAN FD skbuff: dev type 65534, len 64993 [ 526.966625][T17413] FAULT_INJECTION: forcing a failure. [ 526.966625][T17413] name failslab, interval 1, probability 0, space 0, times 0 [ 526.980173][T17413] CPU: 1 UID: 0 PID: 17413 Comm: syz.6.4521 Tainted: G L syzkaller #0 PREEMPT(full) [ 526.980203][T17413] Tainted: [L]=SOFTLOCKUP [ 526.980210][T17413] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 526.980221][T17413] Call Trace: [ 526.980229][T17413] [ 526.980237][T17413] dump_stack_lvl+0xe8/0x150 [ 526.980268][T17413] should_fail_ex+0x412/0x560 [ 526.980293][T17413] should_failslab+0xa8/0x100 [ 526.980315][T17413] __kmalloc_noprof+0xe8/0x760 [ 526.980343][T17413] ? genl_family_rcv_msg_attrs_parse+0xd0/0x2f0 [ 526.980373][T17413] ? snprintf+0xe8/0x140 [ 526.980445][T17413] genl_family_rcv_msg_attrs_parse+0xd0/0x2f0 [ 526.980467][T17413] genl_family_rcv_msg_doit+0xd9/0x330 [ 526.980488][T17413] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 526.980510][T17413] ? apparmor_capable+0x126/0x170 [ 526.980526][T17413] ? bpf_lsm_capable+0x9/0x20 [ 526.980541][T17413] ? security_capable+0x7e/0x2c0 [ 526.980598][T17413] genl_rcv_msg+0x61c/0x7a0 [ 526.980618][T17413] ? __pfx_genl_rcv_msg+0x10/0x10 [ 526.980633][T17413] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 526.980646][T17413] ? __pfx_nl80211_set_tx_bitrate_mask+0x10/0x10 [ 526.980664][T17413] ? __pfx_nl80211_post_doit+0x10/0x10 [ 526.980677][T17413] ? __lock_acquire+0x6b5/0x2cf0 [ 526.980705][T17413] netlink_rcv_skb+0x232/0x4b0 [ 526.980726][T17413] ? __pfx_genl_rcv_msg+0x10/0x10 [ 526.980743][T17413] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 526.980816][T17413] ? down_read+0x270/0x2e0 [ 526.980839][T17413] ? genl_rcv+0xd/0x40 [ 526.980856][T17413] genl_rcv+0x28/0x40 [ 526.980871][T17413] netlink_unicast+0x80f/0x9b0 [ 526.980897][T17413] ? __pfx_netlink_unicast+0x10/0x10 [ 526.980923][T17413] ? netlink_sendmsg+0x650/0xb40 [ 526.980935][T17413] ? skb_put+0x11b/0x210 [ 526.980952][T17413] netlink_sendmsg+0x813/0xb40 [ 526.980972][T17413] ? __pfx_netlink_sendmsg+0x10/0x10 [ 526.980987][T17413] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 526.981027][T17413] ? __pfx_netlink_sendmsg+0x10/0x10 [ 526.981039][T17413] sock_sendmsg_nosec+0x112/0x150 [ 526.981059][T17413] ____sys_sendmsg+0x589/0x8c0 [ 526.981080][T17413] ? __pfx_____sys_sendmsg+0x10/0x10 [ 526.981101][T17413] ? import_iovec+0x73/0xa0 [ 526.981121][T17413] ___sys_sendmsg+0x2a5/0x360 [ 526.981140][T17413] ? __pfx____sys_sendmsg+0x10/0x10 [ 526.981177][T17413] ? __fget_files+0x2a/0x420 [ 526.981195][T17413] ? __fget_files+0x3a0/0x420 [ 526.981219][T17413] __x64_sys_sendmsg+0x1bd/0x2a0 [ 526.981236][T17413] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 526.981257][T17413] ? __pfx_ksys_write+0x10/0x10 [ 526.981278][T17413] do_syscall_64+0x14d/0xf80 [ 526.981291][T17413] ? trace_irq_disable+0x3b/0x150 [ 526.981307][T17413] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 526.981321][T17413] ? clear_bhb_loop+0x40/0x90 [ 526.981338][T17413] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 526.981351][T17413] RIP: 0033:0x7f9ec519c799 [ 526.981365][T17413] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 526.981377][T17413] RSP: 002b:00007f9ec33f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 526.981392][T17413] RAX: ffffffffffffffda RBX: 00007f9ec5415fa0 RCX: 00007f9ec519c799 [ 526.981402][T17413] RDX: 0000000000000000 RSI: 0000200000000280 RDI: 0000000000000003 [ 526.981410][T17413] RBP: 00007f9ec33f6090 R08: 0000000000000000 R09: 0000000000000000 [ 526.981420][T17413] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 526.981428][T17413] R13: 00007f9ec5416038 R14: 00007f9ec5415fa0 R15: 00007ffef0a30e98 [ 526.981449][T17413] [ 527.741489][T17435] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 527.751959][ T5891] usb 7-1: new high-speed USB device number 28 using dummy_hcd [ 527.841980][T15478] usb 1-1: device descriptor read/64, error -71 [ 527.903516][ T5891] usb 7-1: config 0 has no interfaces? [ 527.909271][ T5891] usb 7-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 527.918874][ T5891] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 527.930255][ T5891] usb 7-1: config 0 descriptor?? [ 528.091726][T15478] usb 1-1: new high-speed USB device number 120 using dummy_hcd [ 528.143028][ T5911] usb 7-1: USB disconnect, device number 28 [ 528.263793][T15478] usb 1-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 528.277105][T15478] usb 1-1: config 27 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 528.292286][T15478] usb 1-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 528.301480][T15478] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 528.344606][T15478] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 528.459696][T15478] snd-usb-audio 1-1:27.0: probe with driver snd-usb-audio failed with error -2 [ 528.530601][T15478] usb 1-1: USB disconnect, device number 120 [ 528.622536][ T5911] usb 7-1: new high-speed USB device number 29 using dummy_hcd [ 528.805978][ T5911] usb 7-1: unable to get BOS descriptor or descriptor too short [ 528.815592][ T5911] usb 7-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 37, changing to 7 [ 528.826987][ T5911] usb 7-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 116, changing to 7 [ 528.843658][ T5911] usb 7-1: New USB device found, idVendor=0582, idProduct=0582, bcdDevice= 0.40 [ 528.853230][ T5911] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 528.861289][ T5911] usb 7-1: Product: syz [ 528.866468][ T5911] usb 7-1: Manufacturer: syz [ 528.871135][ T5911] usb 7-1: SerialNumber: syz [ 529.297728][T17472] netlink: 'syz.5.4546': attribute type 3 has an invalid length. [ 529.451716][ T5949] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 529.611699][ T5949] usb 4-1: Using ep0 maxpacket: 32 [ 529.620368][ T5949] usb 4-1: config 0 has an invalid interface number: 67 but max is 0 [ 529.628866][ T5949] usb 4-1: config 0 has no interface number 0 [ 529.643970][ T5949] usb 4-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 529.653104][ T5949] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 529.661115][ T5949] usb 4-1: Product: syz [ 529.665495][ T5949] usb 4-1: Manufacturer: syz [ 529.670429][ T5949] usb 4-1: SerialNumber: syz [ 529.678398][ T5949] usb 4-1: config 0 descriptor?? [ 529.737637][ T5911] usb 7-1: 2:0: failed to get current value for ch 0 (-71) [ 529.760458][ T5911] usb 7-1: 2:0: cannot get min/max values for control 2 (id 2) [ 529.769345][ T5911] usb 7-1: Warning! Unlikely small volume range (=1), linear volume or custom curve? [ 529.779451][ T5911] usb 7-1: [2] FU [Generic Out Playback Volume] ch = 1, val = 0/1/1 [ 529.821982][ T5848] usb 1-1: new high-speed USB device number 121 using dummy_hcd [ 529.856250][ T5911] usb 7-1: USB disconnect, device number 29 [ 529.997641][ T5848] usb 1-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 530.019809][ T5848] usb 1-1: config 27 interface 0 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 530.044750][ T5848] usb 1-1: config 27 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 530.072134][ T5848] usb 1-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 530.097099][ T5848] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 530.114830][T17470] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 530.140192][ T5848] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 530.156162][T17470] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 530.173076][ T5949] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 530.201872][ T5949] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 530.250140][ T5848] snd-usb-audio 1-1:27.0: probe with driver snd-usb-audio failed with error -2 [ 530.347029][ T5848] usb 1-1: USB disconnect, device number 121 [ 530.423195][T17488] netlink: 'syz.6.4554': attribute type 10 has an invalid length. [ 530.600219][T17492] netlink: 'syz.6.4555': attribute type 3 has an invalid length. [ 530.609536][T17492] netlink: 16 bytes leftover after parsing attributes in process `syz.6.4555'. [ 530.634109][ T5949] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000108: -71 [ 530.647908][ T5949] smsc95xx 4-1:0.67: probe with driver smsc95xx failed with error -71 [ 530.673745][ T5949] usb 4-1: USB disconnect, device number 3 [ 531.184238][ T5911] usb 1-1: new high-speed USB device number 122 using dummy_hcd [ 531.219082][ T10] usb 7-1: new high-speed USB device number 30 using dummy_hcd [ 531.331771][ T5911] usb 1-1: device descriptor read/64, error -71 [ 531.383671][ T10] usb 7-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 531.395920][ T10] usb 7-1: New USB device found, idVendor=1a86, idProduct=7522, bcdDevice=35.36 [ 531.405122][ T10] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 531.413346][ T10] usb 7-1: Product: syz [ 531.417567][ T10] usb 7-1: Manufacturer: syz [ 531.422415][ T10] usb 7-1: SerialNumber: syz [ 531.429558][ T10] usb 7-1: config 0 descriptor?? [ 531.511966][ T5848] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 531.601725][ T5911] usb 1-1: new high-speed USB device number 123 using dummy_hcd [ 531.674116][ T5848] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 531.682226][ T5848] usb 4-1: config 0 has no interface number 0 [ 531.690399][ T5848] usb 4-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 531.699516][ T5848] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 531.707706][ T5848] usb 4-1: Product: syz [ 531.712166][ T5848] usb 4-1: Manufacturer: syz [ 531.716903][ T5848] usb 4-1: SerialNumber: syz [ 531.724312][ T5848] usb 4-1: config 0 descriptor?? [ 531.741886][ T5911] usb 1-1: device descriptor read/64, error -71 [ 531.852679][ T5911] usb usb1-port1: attempt power cycle [ 531.934380][ T5848] usb 4-1: dvb_usb_v2: found a 'E3C EC168 reference design' in warm state [ 531.949020][ T5848] usb 4-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 531.964104][ T5848] dvbdev: DVB: registering new adapter (E3C EC168 reference design) [ 531.976600][ T5848] usb 4-1: media controller created [ 531.997758][ T5848] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 532.191737][ T5911] usb 1-1: new high-speed USB device number 124 using dummy_hcd [ 532.212479][ T5911] usb 1-1: device descriptor read/8, error -71 [ 532.451725][ T5911] usb 1-1: new high-speed USB device number 125 using dummy_hcd [ 532.472305][ T5911] usb 1-1: device descriptor read/8, error -71 [ 532.583636][ T5911] usb usb1-port1: unable to enumerate USB device [ 532.897593][T17527] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4571'. [ 532.910488][T17527] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4571'. [ 533.030040][T17531] netlink: 32 bytes leftover after parsing attributes in process `syz.5.4573'. [ 533.077592][ T5848] i2c i2c-1: ec100: i2c rd failed=-110 reg=33 [ 533.998779][ T5848] usb 7-1: USB disconnect, device number 30 [ 534.287742][ T5949] usb 4-1: USB disconnect, device number 4 [ 534.337112][T17552] binder: 17551:17552 ioctl c0306201 200000000640 returned -22 [ 534.351872][ T10] usb 1-1: new high-speed USB device number 126 using dummy_hcd [ 534.432028][ T5848] usb 7-1: new high-speed USB device number 31 using dummy_hcd [ 534.513021][ T10] usb 1-1: Using ep0 maxpacket: 8 [ 534.523997][ T10] usb 1-1: unable to get BOS descriptor or descriptor too short [ 534.533389][ T10] usb 1-1: too many configurations: 239, using maximum allowed: 8 [ 534.543584][ T10] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 534.556452][ T10] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 534.567759][ T10] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 534.580196][ T10] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 534.583724][ T5848] usb 7-1: Using ep0 maxpacket: 16 [ 534.598559][ T5848] usb 7-1: config 0 has 0 interfaces, different from the descriptor's value: 3 [ 534.605210][ T10] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 534.617692][ T5848] usb 7-1: New USB device found, idVendor=04fc, idProduct=1528, bcdDevice=6d.5d [ 534.617721][ T5848] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 534.617742][ T5848] usb 7-1: Product: syz [ 534.617758][ T5848] usb 7-1: Manufacturer: syz [ 534.617773][ T5848] usb 7-1: SerialNumber: syz [ 534.654594][ T5848] usb 7-1: config 0 descriptor?? [ 534.703632][ T10] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 534.715198][ T10] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 534.728162][ T10] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 534.741039][ T10] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 534.751532][ T10] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 534.765193][ T10] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 534.778249][ T10] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 534.789546][ T10] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 534.799997][ T10] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 534.810267][ T10] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 534.823265][ T10] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 534.835105][ T10] usb 1-1: New USB device found, idVendor=0e41, idProduct=4241, bcdDevice=ac.24 [ 534.846338][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=246 [ 534.855591][ T10] usb 1-1: Product: syz [ 534.859887][ T10] usb 1-1: Manufacturer: syz [ 534.866224][ T10] usb 1-1: SerialNumber: syz [ 534.895641][T17550] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 534.907557][T17550] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 534.954152][T17550] netlink: 24 bytes leftover after parsing attributes in process `syz.6.4582'. [ 535.086892][T17545] comedi comedi4: bad chanlist[0]=0x04000020 chan=32 range length=1 [ 535.168730][ T10] usb 1-1: USB disconnect, device number 126 [ 535.752308][ T10] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 535.893207][ T10] usb 4-1: device descriptor read/64, error -71 [ 535.981736][ T5848] usb 1-1: new high-speed USB device number 127 using dummy_hcd [ 536.142980][ T10] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 536.148383][ T5848] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 536.162169][ T5848] usb 1-1: New USB device found, idVendor=1a86, idProduct=7522, bcdDevice=35.36 [ 536.172377][ T5848] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 536.180414][ T5848] usb 1-1: Product: syz [ 536.184841][ T5848] usb 1-1: Manufacturer: syz [ 536.189475][ T5848] usb 1-1: SerialNumber: syz [ 536.197782][ T5848] usb 1-1: config 0 descriptor?? [ 536.272595][ T10] usb 4-1: device descriptor read/64, error -71 [ 536.382493][ T10] usb usb4-port1: attempt power cycle [ 536.721729][ T10] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 536.742582][ T10] usb 4-1: device descriptor read/8, error -71 [ 536.981713][ T10] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 536.991708][ T5847] Bluetooth: hci3: command 0x0406 tx timeout [ 536.992485][T17550] Bluetooth: hci3: Opcode 0x0401 failed: -110 [ 537.005636][ T10] usb 4-1: device descriptor read/8, error -71 [ 537.065368][ T5891] usb 7-1: USB disconnect, device number 31 [ 537.121929][ T10] usb usb4-port1: unable to enumerate USB device [ 537.566104][T17598] overlayfs: failed to clone upperpath [ 537.575852][T17598] overlayfs: failed to clone upperpath [ 538.031828][T15478] usb 7-1: new high-speed USB device number 32 using dummy_hcd [ 538.181688][T15478] usb 7-1: Using ep0 maxpacket: 32 [ 538.189432][T15478] usb 7-1: New USB device found, idVendor=0ac8, idProduct=0321, bcdDevice=6f.be [ 538.199557][T15478] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 538.213796][T15478] usb 7-1: config 0 descriptor?? [ 538.228375][T15478] gspca_main: vc032x-2.14.0 probing 0ac8:0321 [ 538.792735][ T5911] usb 1-1: USB disconnect, device number 127 [ 538.949564][T17637] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4609'. [ 539.361917][ T5891] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 539.513704][ T5891] usb 1-1: config 0 has an invalid interface number: 50 but max is 0 [ 539.522110][ T5891] usb 1-1: config 0 has no interface number 0 [ 539.528273][ T5891] usb 1-1: config 0 interface 50 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 539.543194][ T5891] usb 1-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=e6.fc [ 539.552392][ T5847] Bluetooth: hci0: command 0x0406 tx timeout [ 539.579086][ T5891] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 539.587215][ T5891] usb 1-1: Product: syz [ 539.592986][ T5891] usb 1-1: Manufacturer: syz [ 539.597639][ T5891] usb 1-1: SerialNumber: syz [ 539.606170][ T5891] usb 1-1: config 0 descriptor?? [ 539.627846][ T5891] yurex 1-1:0.50: USB YUREX device now attached to Yurex #0 [ 539.806918][T17658] netlink: 60 bytes leftover after parsing attributes in process `syz.3.4618'. [ 539.824906][ C0] yurex 1-1:0.50: yurex_interrupt - overflow with length 8, actual length is 8 [ 539.896574][T17660] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4619'. [ 539.912042][T17660] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4619'. [ 540.011184][T15478] gspca_vc032x: reg_w err -71 [ 540.020229][T15478] gspca_vc032x: I2c Bus Busy Wait 00 [ 540.035592][ T5891] usb 1-1: USB disconnect, device number 2 [ 540.042036][T15478] gspca_vc032x: I2c Bus Busy Wait 00 [ 540.047623][T15478] gspca_vc032x: I2c Bus Busy Wait 00 [ 540.056804][T15478] gspca_vc032x: I2c Bus Busy Wait 00 [ 540.066728][T15478] gspca_vc032x: I2c Bus Busy Wait 00 [ 540.072602][T15478] gspca_vc032x: I2c Bus Busy Wait 00 [ 540.078292][T15478] gspca_vc032x: I2c Bus Busy Wait 00 [ 540.094041][T15478] gspca_vc032x: I2c Bus Busy Wait 00 [ 540.099437][T15478] gspca_vc032x: I2c Bus Busy Wait 00 [ 540.106165][ T5891] yurex 1-1:0.50: USB YUREX #0 now disconnected [ 540.112772][T15478] gspca_vc032x: I2c Bus Busy Wait 00 [ 540.118275][T15478] gspca_vc032x: I2c Bus Busy Wait 00 [ 540.141694][T15478] gspca_vc032x: I2c Bus Busy Wait 00 [ 540.158820][T15478] gspca_vc032x: I2c Bus Busy Wait 00 [ 540.165850][T15478] gspca_vc032x: I2c Bus Busy Wait 00 [ 540.171239][T15478] gspca_vc032x: I2c Bus Busy Wait 00 [ 540.181112][T15478] gspca_vc032x: I2c Bus Busy Wait 00 [ 540.188581][T15478] gspca_vc032x: I2c Bus Busy Wait 00 [ 540.195490][T15478] gspca_vc032x: I2c Bus Busy Wait 00 [ 540.200878][T15478] gspca_vc032x: Unknown sensor... [ 540.206537][T15478] vc032x 7-1:0.0: probe with driver vc032x failed with error -22 [ 540.217846][T15478] usb 7-1: USB disconnect, device number 32 [ 540.381731][ T5956] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 540.536278][ T5956] usb 4-1: New USB device found, idVendor=1a86, idProduct=7522, bcdDevice=35.36 [ 540.546726][ T5956] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 540.555776][ T5956] usb 4-1: Product: syz [ 540.560122][ T5956] usb 4-1: Manufacturer: syz [ 540.568984][ T5956] usb 4-1: SerialNumber: syz [ 540.588011][ T5956] usb 4-1: config 0 descriptor?? [ 540.607725][ T5956] ch341 4-1:0.0: ch341-uart converter detected [ 540.814663][ T5956] usb 4-1: failed to receive control message: -32 [ 540.831855][ T5956] ch341-uart ttyUSB0: probe with driver ch341-uart failed with error -32 [ 540.930390][T17678] [ 540.932766][T17678] ====================================================== [ 540.939866][T17678] WARNING: possible circular locking dependency detected [ 540.946956][T17678] syzkaller #0 Tainted: G L [ 540.952958][T17678] ------------------------------------------------------ [ 540.960046][T17678] syz.0.4624/17678 is trying to acquire lock: [ 540.966124][T17678] ffff88802c49f3b8 (&mm->mmap_lock){++++}-{4:4}, at: __might_fault+0xaf/0x130 [ 540.975071][T17678] [ 540.975071][T17678] but task is already holding lock: [ 540.982469][T17678] ffff88807b3a6b30 (&ctx->map_changing_lock){.+.+}-{4:4}, at: mfill_get_vma+0x162/0x660 [ 540.992251][T17678] [ 540.992251][T17678] which lock already depends on the new lock. [ 540.992251][T17678] [ 541.002668][T17678] [ 541.002668][T17678] the existing dependency chain (in reverse order) is: [ 541.011688][T17678] [ 541.011688][T17678] -> #1 (&ctx->map_changing_lock){.+.+}-{4:4}: [ 541.020108][T17678] down_read+0x47/0x2e0 [ 541.024821][T17678] mwriteprotect_range+0x1af/0x530 [ 541.030477][T17678] userfaultfd_ioctl+0x3aa1/0x4c70 [ 541.036137][T17678] __se_sys_ioctl+0xfc/0x170 [ 541.041351][T17678] do_syscall_64+0x14d/0xf80 [ 541.046492][T17678] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 541.052908][T17678] [ 541.052908][T17678] -> #0 (&mm->mmap_lock){++++}-{4:4}: [ 541.060483][T17678] __lock_acquire+0x15a5/0x2cf0 [ 541.065880][T17678] lock_acquire+0xf0/0x2e0 [ 541.070827][T17678] __might_fault+0xcb/0x130 [ 541.075871][T17678] userfaultfd_ioctl+0x2372/0x4c70 [ 541.081512][T17678] __se_sys_ioctl+0xfc/0x170 [ 541.086622][T17678] do_syscall_64+0x14d/0xf80 [ 541.091741][T17678] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 541.098170][T17678] [ 541.098170][T17678] other info that might help us debug this: [ 541.098170][T17678] [ 541.108411][T17678] Possible unsafe locking scenario: [ 541.108411][T17678] [ 541.115867][T17678] CPU0 CPU1 [ 541.121293][T17678] ---- ---- [ 541.126674][T17678] rlock(&ctx->map_changing_lock); [ 541.131890][T17678] lock(&mm->mmap_lock); [ 541.138765][T17678] lock(&ctx->map_changing_lock); [ 541.146427][T17678] rlock(&mm->mmap_lock); [ 541.150859][T17678] [ 541.150859][T17678] *** DEADLOCK *** [ 541.150859][T17678] [ 541.159062][T17678] 2 locks held by syz.0.4624/17678: [ 541.164265][T17678] #0: ffff88802a1dca88 (vm_lock){++++}-{0:0}, at: lock_vma_under_rcu+0x1d1/0x500 [ 541.173555][T17678] #1: ffff88807b3a6b30 (&ctx->map_changing_lock){.+.+}-{4:4}, at: mfill_get_vma+0x162/0x660 [ 541.183746][T17678] [ 541.183746][T17678] stack backtrace: [ 541.189651][T17678] CPU: 0 UID: 0 PID: 17678 Comm: syz.0.4624 Tainted: G L syzkaller #0 PREEMPT(full) [ 541.189676][T17678] Tainted: [L]=SOFTLOCKUP [ 541.189682][T17678] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 541.189693][T17678] Call Trace: [ 541.189701][T17678] [ 541.189708][T17678] dump_stack_lvl+0xe8/0x150 [ 541.189736][T17678] print_circular_bug+0x2e1/0x300 [ 541.189757][T17678] check_noncircular+0x12e/0x150 [ 541.189778][T17678] __lock_acquire+0x15a5/0x2cf0 [ 541.189805][T17678] ? __kernel_text_address+0xd/0x30 [ 541.189827][T17678] ? unwind_get_return_address+0x4d/0x90 [ 541.189850][T17678] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 541.189876][T17678] lock_acquire+0xf0/0x2e0 [ 541.189899][T17678] ? __might_fault+0xaf/0x130 [ 541.189925][T17678] ? __might_fault+0xaf/0x130 [ 541.189947][T17678] __might_fault+0xcb/0x130 [ 541.189969][T17678] ? __might_fault+0xaf/0x130 [ 541.189992][T17678] userfaultfd_ioctl+0x2372/0x4c70 [ 541.190015][T17678] ? __kasan_slab_free+0x5c/0x80 [ 541.190029][T17678] ? kfree+0x1c5/0x650 [ 541.190055][T17678] ? __pfx_userfaultfd_ioctl+0x10/0x10 [ 541.190088][T17678] ? kasan_quarantine_put+0xbb/0x1f0 [ 541.190115][T17678] ? tomoyo_path_number_perm+0x219/0x630 [ 541.190136][T17678] ? tomoyo_path_number_perm+0x219/0x630 [ 541.190157][T17678] ? do_vfs_ioctl+0x1166/0x1530 [ 541.190175][T17678] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 541.190203][T17678] ? __fget_files+0x2a/0x420 [ 541.190225][T17678] ? __fget_files+0x2a/0x420 [ 541.190246][T17678] ? __fget_files+0x3a0/0x420 [ 541.190266][T17678] ? __fget_files+0x2a/0x420 [ 541.190289][T17678] ? bpf_lsm_file_ioctl+0x9/0x20 [ 541.190305][T17678] ? __pfx_userfaultfd_ioctl+0x10/0x10 [ 541.190327][T17678] __se_sys_ioctl+0xfc/0x170 [ 541.190345][T17678] do_syscall_64+0x14d/0xf80 [ 541.190361][T17678] ? trace_irq_disable+0x3b/0x150 [ 541.190381][T17678] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 541.190398][T17678] ? clear_bhb_loop+0x40/0x90 [ 541.190416][T17678] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 541.190433][T17678] RIP: 0033:0x7fb8bcb9c799 [ 541.190450][T17678] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 541.190465][T17678] RSP: 002b:00007fb8bd990028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 541.190482][T17678] RAX: ffffffffffffffda RBX: 00007fb8bce16090 RCX: 00007fb8bcb9c799 [ 541.190496][T17678] RDX: 0000200000000000 RSI: 00000000c020aa07 RDI: 0000000000000004 [ 541.190507][T17678] RBP: 00007fb8bcc32c99 R08: 0000000000000000 R09: 0000000000000000 [ 541.190529][T17678] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 541.190539][T17678] R13: 00007fb8bce16128 R14: 00007fb8bce16090 R15: 00007fffc736e778 [ 541.190558][T17678] [ 541.191355][ T5956] usb 7-1: new high-speed USB device number 33 using dummy_hcd [ 541.621678][ T5956] usb 7-1: Using ep0 maxpacket: 32 [ 541.628395][ T5956] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 541.638471][ T5956] usb 7-1: config 0 interface 0 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 0 [ 541.648289][ T5956] usb 7-1: config 0 interface 0 has no altsetting 0 [ 541.656752][ T5956] usb 7-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 541.665870][ T5956] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 541.673956][ T5956] usb 7-1: Product: syz [ 541.678191][ T5956] usb 7-1: Manufacturer: syz [ 541.682872][ T5956] usb 7-1: SerialNumber: syz [ 541.689776][ T5956] usb 7-1: config 0 descriptor?? [ 542.100337][ T5956] gs_usb 7-1:0.0: Configuring for 1 interfaces [ 542.710423][T17673] overlay: Unknown parameter 'appraise' [ 542.725502][T17673] Invalid argument reading file caps for ./file0 [ 542.736195][T17673] netlink: 36 bytes leftover after parsing attributes in process `syz.6.4625'. [ 542.747878][ T5956] usb 7-1: USB disconnect, device number 33 [ 543.159060][ T5891] usb 4-1: USB disconnect, device number 9 [ 543.166279][ T5891] ch341 4-1:0.0: device disconnected