last executing test programs: 27m24.379032651s ago: executing program 3 (id=2681): syz_open_dev$hidraw(&(0x7f0000000080), 0x0, 0x418000) syz_usb_connect$cdc_ncm(0x1, 0x6e, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000090000082502000000000000000109025c00020100f92a0904000001020900000524060001053408fa6e0d240f0100000000000d000a0006471a010000190581"], 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_connect$printer(0x1, 0x2d, &(0x7f0000000000)={{0x12, 0x1, 0x5f1, 0x0, 0x0, 0x0, 0x8, 0x525, 0xa4a8, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x1, 0x2c, 0x10, 0x9, "", [{{0x9, 0x4, 0x0, 0x7b, 0x1, 0x7, 0x1, 0x1, 0x40, "", {{{0x9, 0x5, 0x1, 0x2, 0x40, 0x61, 0x1, 0xd}}}}}]}}]}}, 0x0) 27m22.987655466s ago: executing program 3 (id=2688): syz_emit_ethernet(0x4a, &(0x7f0000000240)=ANY=[@ANYBLOB="aaaa"], 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x18, 0xf, &(0x7f0000000200)=ANY=[@ANYRESDEC, @ANYRES32, @ANYBLOB], 0x0, 0x7, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) r0 = syz_open_dev$loop(&(0x7f0000000000), 0x5, 0x183200) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.idle_time\x00', 0x275a, 0x0) bind$tipc(0xffffffffffffffff, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10) write$binfmt_misc(r1, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x300, 0x0, 0x0, 0xe, 0x1c, "fee8a2020000000000000000000000000000000500000000000000e3f7000000ecffffff00", "2809e8dbe108598948224ad44afac11d875397bdb22d0000b4a0d93481b232b11b819ef6167d3d458dd4992861ac00", "f4bd0000008019000000000000000000000000cd00", [0x0, 0x1000008]}}) 27m22.882278116s ago: executing program 3 (id=2691): r0 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r0, 0x0, 0x0) r1 = socket$kcm(0x10, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) keyctl$instantiate_iov(0x14, 0x0, &(0x7f0000001940)=[{0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x8, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = syz_open_dev$sndpcmp(&(0x7f0000000000), 0x1, 0xa0181) writev(r2, 0x0, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x8081) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0x1}], 0x1) sendmsg$RDMA_NLDEV_CMD_RES_MR_GET(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000280)={0x0, 0x20}, 0x1, 0x0, 0x0, 0x8000}, 0x4000000) sendmsg$kcm(r1, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000a80)=[{&(0x7f00000003c0)="2e00000010008188040f80ec59acbc0413a1f848110000004e140602000000000e000a000f00000002800000121f1e753475fdf08f585bda67439d77ba13c33667c653ebe90fbdd861284dbe8afa5e6dcbc08b050d16d55d30a0918f091e854c12ef7a36a763ef5a6baee15a2541f64bbb010000000000008052a6daaafa0c12a7dc3e83e9d941e914b9daed65960652e634c770a980", 0x96}, {&(0x7f0000000540)="be5b94c50ca49cb1b4a7458f86762fbf27c101d6aae58e56800fff97484fa6619d1f529460b5c3315f35bdf719722158f7f54c42ae9a0e258d913a8fb5101a25114ef298913998fb5451cc82ff159b90be19a3ac0017293e36dd77127c49c52568963276f3539e4dbff3d957339ce587a929f8ab2d122d1c0930f7beb5f7ac9d6202e045c347f1a9c937ed8cd58dea51aa463959f0b5981395b2b84afb0587204fef4a1b9dd65e001921f2aed3a3774d21f9c9355b88c93ff0a54a82ca", 0xbd}, {&(0x7f0000000640)="5a843a5e9f2c76f6137e37781e71355179cb4f7371f10335668f1193e39c767fa0a2d2a6240b0da9faa22c0bfb570f9ed199628d32dcff2934dd438492c3af0b900b8576b8da987abc19cfd4a49758e2b5449ce9036d929fc14fe8e7d66a4ac5679a39a30c957c72cbd7e6e63cec99cce5cfe36a2c02e2b9", 0x78}, {&(0x7f0000000880)="b7c56f6ad762de38cc71b30a7566f98e930453f64309f96000ff355d7056801cd0258e834705343a5be02ee9651ef4ed4db102a871c20ae0c3299efbe9744b4ff08cee41a332ff780b51d47e47e48778fccb72aaf3f415becaf9b4a4812b", 0x5e}, {0x0}], 0x5}, 0x8084) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r4, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r4, &(0x7f0000000200)={0xa, 0x20, 0x8, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r4, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r4, 0x11a, 0x1, &(0x7f0000000540)=@gcm_128={{0x303}, "12000000f7ffffe2", "8e083700daf38a6d69e9b5e9c2f133d7", "6a3a05b9"}, 0x28) shutdown(r4, 0x1) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='freezer.state\x00', 0x275a, 0x0) write$cgroup_int(r5, &(0x7f0000000080)=0x1, 0xfffffffffffffd5b) sendmsg$AUDIT_TTY_GET(r5, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x10, 0x3f8, 0x8, 0x70bd2b, 0x25dfdbfc, "", ["", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x88}, 0x4000001) sendfile(r4, r5, 0x0, 0xffffffff004) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000040)="2e00000010008108040f80ecdb4cb92e0a480e000f000000e8bd6efb250314000e000100240248ff050005001200", 0x2e}], 0x1}, 0x40880) socket$nl_netfilter(0x10, 0x3, 0xc) 27m22.513185473s ago: executing program 3 (id=2692): pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = fsopen(&(0x7f0000000080)='autofs\x00', 0x0) fsconfig$FSCONFIG_SET_FD(r1, 0x5, &(0x7f00000005c0)='fd', 0x0, r0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) fchdir(0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x89901) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r3 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) setpgid(r3, r3) setpgid(0x0, r3) lstat(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000400)) 27m22.410321618s ago: executing program 3 (id=2693): sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=@newsa={0x138, 0x18, 0x1, 0xfffffffe, 0x100, {{@in6=@ipv4={'\x00', '\xff\xff', @multicast2}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x71c, 0x4e23, 0x5, 0x0, 0x0, 0x0, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in=@dev={0xac, 0x14, 0x14, 0x25}, {0x0, 0x192, 0x9ba3, 0xffff, 0x82520, 0x5, 0xfffffffffffffffc}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0xfffffffa, 0xfffffffc}, 0x80, 0x3500, 0x2, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x41, 0x0) write$binfmt_aout(r2, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r2, 0x40045431, &(0x7f0000000100)={0x0, 0x40, 0x4, 0x7, 0x17, "95bf2e0003bf074000000000000063095c8200"}) r3 = syz_open_pts(r2, 0x0) ioctl$KVM_IOEVENTFD(0xffffffffffffffff, 0x4040ae79, &(0x7f0000000080)={0x800000000004, 0x6000, 0x1, 0xffffffffffffffff, 0x1}) r4 = dup3(r3, r2, 0x0) read$FUSE(r4, &(0x7f00000008c0)={0x2020}, 0x2020) ioctl$vim2m_VIDIOC_S_CTRL(r4, 0xc008561c, &(0x7f0000000200)={0x4, 0x6}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000ac0)={0x4c, 0x0, &(0x7f0000002100)=[@reply_sg={0x40486312, {0x41, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40}], 0x0, 0x0, 0x0}) 27m22.035621584s ago: executing program 3 (id=2695): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000002180)={0x1, &(0x7f00000003c0)=[{0x6, 0x40, 0xff}]}) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180), 0xffffffffffffff01, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000180), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000100)={0x6, 0x1f, 0x6}) sendmsg$ETHTOOL_MSG_COALESCE_SET(r0, 0x0, 0x4c004) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000000)={0x7fff, 0x8, 0x100}) r3 = syz_open_dev$dri(&(0x7f0000000180), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x8, 0x8169, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f00000001c0)={0x7, 0x1, 0x7}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x49, 0x7fff, 0x4}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000140)={0x6, 0x1000, 0x800}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f00000002c0)={0x8, 0xd7, 0x8}) close_range(r0, 0xffffffffffffffff, 0x0) 27m21.995755518s ago: executing program 32 (id=2695): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000002180)={0x1, &(0x7f00000003c0)=[{0x6, 0x40, 0xff}]}) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180), 0xffffffffffffff01, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000180), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000100)={0x6, 0x1f, 0x6}) sendmsg$ETHTOOL_MSG_COALESCE_SET(r0, 0x0, 0x4c004) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000000)={0x7fff, 0x8, 0x100}) r3 = syz_open_dev$dri(&(0x7f0000000180), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x8, 0x8169, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f00000001c0)={0x7, 0x1, 0x7}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x49, 0x7fff, 0x4}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000140)={0x6, 0x1000, 0x800}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f00000002c0)={0x8, 0xd7, 0x8}) close_range(r0, 0xffffffffffffffff, 0x0) 27m19.309827425s ago: executing program 1 (id=2710): r0 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r0, 0x0, 0x0) r1 = socket$kcm(0x10, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) keyctl$instantiate_iov(0x14, 0x0, &(0x7f0000001940)=[{0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x8, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = syz_open_dev$sndpcmp(&(0x7f0000000000), 0x1, 0xa0181) writev(r2, 0x0, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x8081) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0x1}], 0x1) sendmsg$RDMA_NLDEV_CMD_RES_MR_GET(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000280)={0x0, 0x20}, 0x1, 0x0, 0x0, 0x8000}, 0x4000000) sendmsg$kcm(r1, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000a80)=[{&(0x7f00000003c0)="2e00000010008188040f80ec59acbc0413a1f848110000004e140602000000000e000a000f00000002800000121f1e753475fdf08f585bda67439d77ba13c33667c653ebe90fbdd861284dbe8afa5e6dcbc08b050d16d55d30a0918f091e854c12ef7a36a763ef5a6baee15a2541f64bbb010000000000008052a6daaafa0c12a7dc3e83e9d941e914b9daed65960652e634c770a980", 0x96}, {&(0x7f0000000540)="be5b94c50ca49cb1b4a7458f86762fbf27c101d6aae58e56800fff97484fa6619d1f529460b5c3315f35bdf719722158f7f54c42ae9a0e258d913a8fb5101a25114ef298913998fb5451cc82ff159b90be19a3ac0017293e36dd77127c49c52568963276f3539e4dbff3d957339ce587a929f8ab2d122d1c0930f7beb5f7ac9d6202e045c347f1a9c937ed8cd58dea51aa463959f0b5981395b2b84afb0587204fef4a1b9dd65e001921f2aed3a3774d21f9c9355b88c93ff0a54a82ca", 0xbd}, {&(0x7f0000000640)="5a843a5e9f2c76f6137e37781e71355179cb4f7371f10335668f1193e39c767fa0a2d2a6240b0da9faa22c0bfb570f9ed199628d32dcff2934dd438492c3af0b900b8576b8da987abc19cfd4a49758e2b5449ce9036d929fc14fe8e7d66a4ac5679a39a30c957c72cbd7e6e63cec99cce5cfe36a2c02e2b9", 0x78}, {&(0x7f0000000880)="b7c56f6ad762de38cc71b30a7566f98e930453f64309f96000ff355d7056801cd0258e834705343a5be02ee9651ef4ed4db102a871c20ae0c3299efbe9744b4ff08cee41a332ff780b51d47e47e48778fccb72aaf3f415becaf9b4a4812b", 0x5e}, {0x0}], 0x5}, 0x8084) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r4, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r4, &(0x7f0000000200)={0xa, 0x20, 0x8, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r4, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r4, 0x11a, 0x1, &(0x7f0000000540)=@gcm_128={{0x303}, "12000000f7ffffe2", "8e083700daf38a6d69e9b5e9c2f133d7", "6a3a05b9"}, 0x28) shutdown(r4, 0x1) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='freezer.state\x00', 0x275a, 0x0) write$cgroup_int(r5, &(0x7f0000000080)=0x1, 0xfffffffffffffd5b) sendmsg$AUDIT_TTY_GET(r5, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x10, 0x3f8, 0x8, 0x70bd2b, 0x25dfdbfc, "", ["", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x88}, 0x4000001) sendfile(r4, r5, 0x0, 0xffffffff004) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000040)="2e00000010008108040f80ecdb4cb92e0a480e000f000000e8bd6efb250314000e000100240248ff050005001200", 0x2e}], 0x1}, 0x40880) socket$nl_netfilter(0x10, 0x3, 0xc) 27m19.002450126s ago: executing program 1 (id=2712): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$inet_udp(0x2, 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x6, 0x9, &(0x7f00000014c0)=ANY=[], 0x0, 0x2, 0x0, 0x0, 0x40f00, 0x2}, 0x94) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$kvm(0xffffffffffffff9c, 0x0, 0x68c81, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) socket$inet6_sctp(0xa, 0x5, 0x84) r2 = socket$inet6(0xa, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_ifreq(r3, 0x8991, 0x0) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) syz_emit_ethernet(0x86, &(0x7f0000000000)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}, @remote, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x78, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x64, 0x0, @wg=@response={0x2, 0x3, 0x1, "56805c734ee222c29de4125f81f6e030a5441a99f362cd24e0a1ac2291500733", "467f517bd818d5a4a8d26ae61b4cbf13", {"31ffc21d2e9bfb1eb3c03976ed837b6f", "876605ac29dcb96a8901e0711afb3db3"}}}}}}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000840)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x5, 0x0, 0x0, 0x60ff78ce1cb3c070}, 0x94) r4 = syz_open_dev$evdev(&(0x7f00000000c0), 0x0, 0x822b01) ioctl$EVIOCSMASK(r4, 0x40104593, &(0x7f00000001c0)={0x1, 0x0, 0x0}) r5 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000007300)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f0000006200)='syzkaller\x00', 0x7, 0x0, 0x0, 0x0, 0x4c, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r5, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) sendmmsg$inet(r0, &(0x7f0000002240)=[{{&(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10, 0x0, 0x0, &(0x7f0000000180)=[@ip_tos_u8={{0x18, 0x0, 0x1, 0xfc}}], 0x18}}], 0x1, 0x40014) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) 27m18.401750765s ago: executing program 0 (id=2714): syz_emit_ethernet(0x4a, &(0x7f0000000240)=ANY=[@ANYBLOB="aaaa"], 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x18, 0xf, &(0x7f0000000200)=ANY=[@ANYRESDEC, @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b70200000000000085000000510000"], 0x0, 0x7, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) r0 = syz_open_dev$loop(&(0x7f0000000000), 0x5, 0x183200) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.idle_time\x00', 0x275a, 0x0) bind$tipc(0xffffffffffffffff, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10) write$binfmt_misc(r1, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x300, 0x0, 0x0, 0xe, 0x1c, "fee8a2020000000000000000000000000000000500000000000000e3f7000000ecffffff00", "2809e8dbe108598948224ad44afac11d875397bdb22d0000b4a0d93481b232b11b819ef6167d3d458dd4992861ac00", "f4bd0000008019000000000000000000000000cd00", [0x0, 0x1000008]}}) 27m18.355330822s ago: executing program 0 (id=2715): socket$nl_generic(0x10, 0x3, 0x10) socket$inet_udp(0x2, 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x6, 0x9, &(0x7f00000014c0)=ANY=[], 0x0, 0x2, 0x0, 0x0, 0x40f00, 0x2}, 0x94) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$kvm(0xffffffffffffff9c, 0x0, 0x68c81, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) socket$inet6_sctp(0xa, 0x5, 0x84) r1 = socket$inet6(0xa, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_ifreq(r2, 0x8991, 0x0) bind$inet6(r1, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r1, &(0x7f0000005700)=[{{0x0, 0x0, &(0x7f0000003380)}, 0x4}], 0x1, 0x0, 0x0) syz_emit_ethernet(0x86, &(0x7f0000000000)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}, @remote, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x78, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x64, 0x0, @wg=@response={0x2, 0x3, 0x1, "56805c734ee222c29de4125f81f6e030a5441a99f362cd24e0a1ac2291500733", "467f517bd818d5a4a8d26ae61b4cbf13", {"31ffc21d2e9bfb1eb3c03976ed837b6f", "876605ac29dcb96a8901e0711afb3db3"}}}}}}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000840)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x5, 0x0, 0x0, 0x60ff78ce1cb3c070}, 0x94) r3 = syz_open_dev$evdev(&(0x7f00000000c0), 0x0, 0x822b01) ioctl$EVIOCSMASK(r3, 0x40104593, &(0x7f00000001c0)={0x1, 0x0, 0x0}) r4 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000007300)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f0000006200)='syzkaller\x00', 0x7, 0x0, 0x0, 0x0, 0x4c, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) bind$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r4, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) 27m17.563638105s ago: executing program 1 (id=2716): sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000001980)={0x0, 0x0, &(0x7f0000001940)={&(0x7f00000002c0)={0x190, 0x3f, 0x20, 0x0, 0x25dfdbfc, {0xd}, [@typed={0x8, 0x28, 0x0, 0x0, @fd}, @generic="8b8ea3bf9e3f7a473399f1d14470a92cefc6bed6c115bba488ddc12a0807b9084c90247ba085e441669e03c4099848ce1748ce7d9cccfc50f7e6943c11e5cd727c13aca127fa53bf5dd8e778c59890630b46302fcc4249c2a6487cbd3ac1570a45de66feaab43a517c87d8aa60fab7a582859f261c47d69850fbe4ac760c77c45071b45a6797b25d24cacb5d04464320ca5f6333f04b633e20252fdc9cd7344b0f80c20c53570d0d940c6cd08787bbb6c6773d296bb9fa404b9f96453b765ace89b4c761884466375cd52d534259c30ff203178198785546f170465940", @nested={0x6d, 0x132, 0x0, 0x1, [@nested={0x4, 0x85}, @generic="1b2d0b531dcc9127561a60775ee44133af23fe32c7d3dfeeca067e4bf55884df74b901ca27069e66066bb3fe017ad4c7e6e4a5e972b0000c5dd5bae26155d76564012ad881c6117682544a49354bc0164c414b8c291c1edef4a0565d2a", @nested={0x4, 0x38}, @generic="ffd9901a"]}, @nested={0x24, 0xd5, 0x0, 0x1, [@generic="52bbaa8153c2f76d09518c62aa432c823fcf027f9edd16184b0b895b0f5da008"]}]}, 0x190}, 0x1, 0x0, 0x0, 0xc800}, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x482, 0x0) ioctl$TCSETS(r0, 0x5402, &(0x7f0000000000)={0x7, 0xd, 0x0, 0xffdffffc, 0x6, "00001000"}) write$binfmt_aout(r0, &(0x7f0000000440)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x83, "00000000000000000000ffff00"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) read$FUSE(r2, &(0x7f0000003f80)={0x2020}, 0x2020) 27m17.403503881s ago: executing program 0 (id=2718): stat(0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) openat$ptp1(0xffffffffffffff9c, &(0x7f0000000100), 0x8080, 0x0) socket$packet(0x11, 0x2, 0x300) socket$packet(0x11, 0x2, 0x300) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$devlink(0x0, 0xffffffffffffffff) openat$rtc(0xffffff9c, &(0x7f0000000140), 0x101000, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$key(0xf, 0x3, 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x38}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[@ANYBLOB="020100090e"], 0x70}}, 0x0) syz_usbip_server_init(0x6) socket$inet6_sctp(0xa, 0x1, 0x84) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000080)='./binderfs/binder0\x00', 0x802, 0x0) open(&(0x7f00000001c0)='./file1\x00', 0x14927e, 0xb3) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x40400, 0x0) socket$inet_udp(0x2, 0x2, 0x0) listns(&(0x7f0000000000)={0x20, 0x0, 0x2}, 0x0, 0x0, 0x0) r0 = socket$netlink(0x10, 0x3, 0xc) sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYRES32, @ANYRES16=0x0, @ANYRES8=r0], 0x1c}, 0x1, 0x0, 0x0, 0x20000844}, 0x48885) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r1, &(0x7f0000000000), 0xd) 27m16.822648102s ago: executing program 0 (id=2719): pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = fsopen(&(0x7f0000000080)='autofs\x00', 0x0) fsconfig$FSCONFIG_SET_FD(r1, 0x5, &(0x7f00000005c0)='fd', 0x0, r0) r2 = fsmount(r1, 0x0, 0x2) fchdir(r2) mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x0) r3 = open_tree(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x89901) move_mount(r3, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r4 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) setpgid(r4, r4) setpgid(0x0, r4) lstat(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000400)) 27m16.652216987s ago: executing program 0 (id=2720): syz_emit_ethernet(0x4a, &(0x7f0000000240)=ANY=[@ANYBLOB="aaaa"], 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x18, 0xf, &(0x7f0000000200)=ANY=[@ANYRESDEC, @ANYBLOB="0000000000000000b702000014000000b7020000000000008500000051000000bf0900000000000055"], 0x0, 0x7, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) r0 = syz_open_dev$loop(&(0x7f0000000000), 0x5, 0x183200) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.idle_time\x00', 0x275a, 0x0) bind$tipc(0xffffffffffffffff, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10) write$binfmt_misc(r1, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x300, 0x0, 0x0, 0xe, 0x1c, "fee8a2020000000000000000000000000000000500000000000000e3f7000000ecffffff00", "2809e8dbe108598948224ad44afac11d875397bdb22d0000b4a0d93481b232b11b819ef6167d3d458dd4992861ac00", "f4bd0000008019000000000000000000000000cd00", [0x0, 0x1000008]}}) 27m16.609382588s ago: executing program 1 (id=2721): pipe(&(0x7f00000000c0)) r0 = fsopen(&(0x7f0000000080)='autofs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x2) fchdir(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x89901) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r3 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) setpgid(r3, r3) setpgid(0x0, r3) lstat(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000400)) 27m16.533337498s ago: executing program 1 (id=2722): sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000001980)={0x0, 0x0, &(0x7f0000001940)={&(0x7f00000002c0)={0x190, 0x3f, 0x20, 0x0, 0x25dfdbfc, {0xd}, [@typed={0x8, 0x28, 0x0, 0x0, @fd}, @generic="8b8ea3bf9e3f7a473399f1d14470a92cefc6bed6c115bba488ddc12a0807b9084c90247ba085e441669e03c4099848ce1748ce7d9cccfc50f7e6943c11e5cd727c13aca127fa53bf5dd8e778c59890630b46302fcc4249c2a6487cbd3ac1570a45de66feaab43a517c87d8aa60fab7a582859f261c47d69850fbe4ac760c77c45071b45a6797b25d24cacb5d04464320ca5f6333f04b633e20252fdc9cd7344b0f80c20c53570d0d940c6cd08787bbb6c6773d296bb9fa404b9f96453b765ace89b4c761884466375cd52d534259c30ff203178198785546f170465940", @nested={0x6d, 0x132, 0x0, 0x1, [@nested={0x4, 0x85}, @generic="1b2d0b531dcc9127561a60775ee44133af23fe32c7d3dfeeca067e4bf55884df74b901ca27069e66066bb3fe017ad4c7e6e4a5e972b0000c5dd5bae26155d76564012ad881c6117682544a49354bc0164c414b8c291c1edef4a0565d2a", @nested={0x4, 0x38}, @generic="ffd9901a"]}, @nested={0x24, 0xd5, 0x0, 0x1, [@generic="52bbaa8153c2f76d09518c62aa432c823fcf027f9edd16184b0b895b0f5da008"]}]}, 0x190}, 0x1, 0x0, 0x0, 0xc800}, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x482, 0x0) write$binfmt_aout(r0, &(0x7f0000000440)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x83, "00000000000000000000ffff00"}) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETS(r1, 0x5402, &(0x7f00000000c0)={0x5, 0x5, 0x28, 0xbaf6, 0x1a, "2455b59ed78225cfc98baa08da5b3e100a7766"}) r2 = dup3(r1, r0, 0x0) read$FUSE(r2, &(0x7f0000003f80)={0x2020}, 0x2020) 27m16.333802003s ago: executing program 0 (id=2723): syz_open_dev$sndpcmc(&(0x7f0000000080), 0x0, 0x80000) r0 = syz_open_dev$usbfs(0x0, 0x400000001fc, 0x301) ioctl$USBDEVFS_SUBMITURB(r0, 0x8038550a, &(0x7f0000000280)=@urb_type_control={0x2, {}, 0x2, 0x40, &(0x7f0000000300)={0x4b5a9da54893e123, 0x1, 0x2, 0x2}, 0x8, 0x203ffffd, 0x300, 0x0, 0x2, 0x20000, 0x0}) syz_emit_ethernet(0x66, &(0x7f0000000000)={@broadcast, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1e}, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x2, 0x0, 0x58, 0x0, 0x0, 0x0, 0x2f, 0x0, @remote, @broadcast}, {{0x0, 0x0, 0x1, 0x0, 0x2, 0x0, 0x0, 0x4, 0x86dd}, {0x0, 0x0, 0x0, 0x0, 0x11}}}}}}, 0x0) fsopen(0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="4c000000020601080000000000000000000000400500010006200000050005000a00000005000400000000000900020073797a310000000011000300686173683a69702c"], 0x4c}}, 0x0) sendmsg$IPSET_CMD_ADD(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)={0x4c, 0x9, 0x6, 0x201, 0x0, 0x0, {0x5, 0x0, 0xffff}, [@IPSET_ATTR_DATA={0x24, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0x18, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @local}}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0x2}]}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x4c}}, 0x4000080) 27m16.298293486s ago: executing program 33 (id=2723): syz_open_dev$sndpcmc(&(0x7f0000000080), 0x0, 0x80000) r0 = syz_open_dev$usbfs(0x0, 0x400000001fc, 0x301) ioctl$USBDEVFS_SUBMITURB(r0, 0x8038550a, &(0x7f0000000280)=@urb_type_control={0x2, {}, 0x2, 0x40, &(0x7f0000000300)={0x4b5a9da54893e123, 0x1, 0x2, 0x2}, 0x8, 0x203ffffd, 0x300, 0x0, 0x2, 0x20000, 0x0}) syz_emit_ethernet(0x66, &(0x7f0000000000)={@broadcast, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1e}, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x2, 0x0, 0x58, 0x0, 0x0, 0x0, 0x2f, 0x0, @remote, @broadcast}, {{0x0, 0x0, 0x1, 0x0, 0x2, 0x0, 0x0, 0x4, 0x86dd}, {0x0, 0x0, 0x0, 0x0, 0x11}}}}}}, 0x0) fsopen(0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="4c000000020601080000000000000000000000400500010006200000050005000a00000005000400000000000900020073797a310000000011000300686173683a69702c"], 0x4c}}, 0x0) sendmsg$IPSET_CMD_ADD(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)={0x4c, 0x9, 0x6, 0x201, 0x0, 0x0, {0x5, 0x0, 0xffff}, [@IPSET_ATTR_DATA={0x24, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0x18, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @local}}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0x2}]}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x4c}}, 0x4000080) 27m16.233662009s ago: executing program 1 (id=2724): syz_open_dev$sndpcmc(&(0x7f0000000080), 0x0, 0x80000) r0 = syz_open_dev$usbfs(0x0, 0x400000001fc, 0x301) ioctl$USBDEVFS_SUBMITURB(r0, 0x8038550a, &(0x7f0000000280)=@urb_type_control={0x2, {}, 0x2, 0x40, &(0x7f0000000300)={0x4b5a9da54893e123, 0x1, 0x2, 0x2}, 0x8, 0x203ffffd, 0x300, 0x0, 0x2, 0x20000, 0x0}) syz_emit_ethernet(0x66, &(0x7f0000000000)={@broadcast, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1e}, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x2, 0x0, 0x58, 0x0, 0x0, 0x0, 0x2f, 0x0, @remote, @broadcast}, {{0x0, 0x0, 0x1, 0x0, 0x2, 0x0, 0x0, 0x4, 0x86dd}, {0x0, 0x0, 0x0, 0x0, 0x11}}}}}}, 0x0) fsopen(0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="4c000000020601080000000000000000000000400500010006200000050005000a00000005000400000000000900020073797a310000000011000300686173683a69702c6d61726b"], 0x4c}}, 0x0) sendmsg$IPSET_CMD_ADD(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)={0x44, 0x9, 0x6, 0x201, 0x0, 0x0, {0x5, 0x0, 0xffff}, [@IPSET_ATTR_DATA={0x1c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0x18, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @local}}]}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x44}}, 0x4000080) 27m16.144765714s ago: executing program 34 (id=2724): syz_open_dev$sndpcmc(&(0x7f0000000080), 0x0, 0x80000) r0 = syz_open_dev$usbfs(0x0, 0x400000001fc, 0x301) ioctl$USBDEVFS_SUBMITURB(r0, 0x8038550a, &(0x7f0000000280)=@urb_type_control={0x2, {}, 0x2, 0x40, &(0x7f0000000300)={0x4b5a9da54893e123, 0x1, 0x2, 0x2}, 0x8, 0x203ffffd, 0x300, 0x0, 0x2, 0x20000, 0x0}) syz_emit_ethernet(0x66, &(0x7f0000000000)={@broadcast, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1e}, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x2, 0x0, 0x58, 0x0, 0x0, 0x0, 0x2f, 0x0, @remote, @broadcast}, {{0x0, 0x0, 0x1, 0x0, 0x2, 0x0, 0x0, 0x4, 0x86dd}, {0x0, 0x0, 0x0, 0x0, 0x11}}}}}}, 0x0) fsopen(0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="4c000000020601080000000000000000000000400500010006200000050005000a00000005000400000000000900020073797a310000000011000300686173683a69702c6d61726b"], 0x4c}}, 0x0) sendmsg$IPSET_CMD_ADD(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)={0x44, 0x9, 0x6, 0x201, 0x0, 0x0, {0x5, 0x0, 0xffff}, [@IPSET_ATTR_DATA={0x1c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0x18, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @local}}]}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x44}}, 0x4000080) 13.566575206s ago: executing program 6 (id=10229): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x1, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000031000000000000000000000034000100ffffffff9500000000000400"], &(0x7f0000000080)='GPL\x00', 0xf, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) r0 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000100)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r0, &(0x7f0000000240)='asymmetric\x00', &(0x7f0000000180)) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r0, &(0x7f00000000c0)='asymmetric\x00', 0x0) r1 = socket$netlink(0x10, 0x3, 0x10) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r2, 0x1, &(0x7f0000000040)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000300), 0x4) syz_genetlink_get_family_id$devlink(&(0x7f0000000080), r1) mq_notify(0xffffffffffffffff, &(0x7f0000000000)={0x110c230000, 0x3, 0x2, @thr={0x0, 0x0}}) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0) r4 = add_key$keyring(&(0x7f0000000440), &(0x7f0000000480)={'syz', 0x3}, 0x0, 0x0, r0) keyctl$KEYCTL_MOVE(0x1e, r0, r4, r0, 0x0) ioctl$AUTOFS_IOC_ASKUMOUNT(r3, 0x80049370, &(0x7f0000000580)) ioctl$PPPIOCNEWUNIT(r3, 0xc004743e, &(0x7f0000000600)=0xfffffffd) ioctl$PPPIOCSMAXCID(r3, 0x40047451, &(0x7f0000000200)=0x97) pwritev(r3, &(0x7f0000000040)=[{&(0x7f0000000240)='\x00!', 0x2}], 0x1, 0x8003, 0x8) r5 = syz_open_dev$audion(&(0x7f00000003c0), 0x8c, 0x200000) ioctl$USBDEVFS_DISCARDURB(r5, 0x550b, &(0x7f0000000400)=0xfff) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000040)={r0, 0x7b, 0xf7}, 0x0, &(0x7f00000001c0)="e7285393fd7da6f86c51e0a8f6f95361d1d5dd96d1b07e3ec371aa1c29943352c747228b982bd2650d1085c8497047008f640303fbe16b8414d669a0a1d3c9ffcae4fa699eab81a2f83cce7e0468761dcdac696933d5e48028bda426d0e8f9a01f232cbd27db2d9b5c7d72ecd47faeee8143eaebcd724bf4782881", &(0x7f00000002c0)=""/247) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000004c0)={0xffffffffffffffff}) connect$unix(r6, &(0x7f0000000500)=@abs={0x0, 0x0, 0x4e1f}, 0x6e) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r0, &(0x7f0000000080)='encrypted\x00', 0x0) socket$inet_tcp(0x2, 0x1, 0x0) socket$inet_sctp(0x2, 0x5, 0x84) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000340), 0xffffffffffffffff) 13.094957723s ago: executing program 6 (id=10233): syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000010ac054402000000002d7b0902240001000000000904000000030002"], 0x0) timer_create(0x0, 0x0, &(0x7f0000bbdffc)) r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x401) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2275, &(0x7f0000000100)=0x2c0000) r1 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x1) r3 = eventfd(0x5f0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xfc778000) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000002340)=ANY=[@ANYBLOB="c000000019000100000000000000000064010101000000000000000000000000fe8000000000000000000000000000aa00000005000000000a0000105c0000003d16126629739b11eefef355014ebc6b13d45e995d34f338f0d037b99805dafd60b6fb9626caad74", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="fcffffffffffffffa9000000000000000300000000000000000000000000000010f3ffffffffffffffffffffffffffff0000000000000000c774a71d00000000ff07000000000000ff090000000000000600000200000000000000040000000803000000000000000001000108001f0004000000"], 0xc0}, 0x1, 0x0, 0x0, 0x200400c5}, 0x24000810) setsockopt$inet_sctp_SCTP_RECVNXTINFO(0xffffffffffffffff, 0x84, 0x21, &(0x7f0000000180)=0x72dbb681, 0x4) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) ioctl$KVM_IOEVENTFD(r2, 0x40a0ae49, &(0x7f0000000080)={0x7ff, 0x0, 0x0, r3}) write$P9_RVERSION(0xffffffffffffffff, &(0x7f0000000380)=ANY=[@ANYRES32=r3], 0x13) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r2, 0x4020aed2, &(0x7f0000000000)={0x0, 0x308000, 0x8}) syz_open_dev$hidraw(&(0x7f0000000000), 0x0, 0x81) 11.13115011s ago: executing program 6 (id=10239): r0 = socket$nl_generic(0x10, 0x3, 0x10) socket$inet_udp(0x2, 0x2, 0x0) r1 = getpgid(0x0) r2 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) setsockopt$sock_int(r2, 0x1, 0x3e, &(0x7f00000000c0)=0x7, 0x4) bind$llc(r2, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x44, 0xf6}, 0x10) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) rename(&(0x7f00000002c0)='./file1\x00', &(0x7f0000000240)='./file1\x00') recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = syz_open_dev$tty1(0xc, 0x4, 0x1) r6 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2) r7 = memfd_create(&(0x7f0000000700)='y\x105\xfb\xf7u\x83%\x1f\xe09@:r\xc2\xb9x0\x90P\x03\x00\x00\x00\x00\x00\x00\x00\xfe,\x1c\xf1\xdd\xcf]\xac\xbc\t\xbb\xfc\xa4j\x9f\xceX\x8f5=\xaa\xd5\xe9n\xab s\xa5\x00\x8d\tV\t\x91\x18\x06O\xb0=D\xda\xb6F\x1a\xc82\x8b\xc0l\xd0\x89d\xe6\xb7\xd8\x97\xb8\xde\xa3\x89\xc2%/u\x17\xdaM\x8d\x01Lh\x1e^\x9ej\x1c\xc5\xf0\xf6\x92\x05\x9aH\x00\'\xd4\x94d_\v\xfc\xad\x0f\xa8\xc5\xad\x00\xc2\x12\xff\xff\xff\xff\xff\xff\x00\x00\x00\x00\nj\x8c\xef\x90\xc0Z\xfa\x1a\xb3\xf0wVq\xe9d\xf8N\x80\xd1g\xd8e\xc8\x16\xad1\x02\xab\xce3\xb2\xb0\xd1\x11\xf0\xc3Gj+kV$\x80\x8aJ$\x81\xc0\x16\xf5\x9cz\x10\x97\xdb\x12H\xee/\xe3sY\x02D;L~\xd0\xb44\x01*\xfb\xa4 \xb2b\x90H$\xb2\xad\xbf\x8aM\xb6\x81\x81^\x02\xa0\xa7t\xfbHb\xa5=\xdd+$\xc06J\xb4\xf0\xab\x85Xz\x9f\xb2D$\xbe\xd9\x7f-\r\x9aj9r\n_\x11\xd4\x19\xb0\xa0G\xb7\x94\xf7\xfd~\xe9\xb6G\xbfE\xbb\x15\x15\xa6\xca2\xd0\xd3\x8c\xf7nO\xf9\xa8\xfd\x8a\xd2\xb2\xab\xff\xe4\xb0;\xd9\xa8\f\x03R\xbd%\x9fF\xee\x05\x06.3(QF?\f\x05\xa4uY\xee\xab\x8a\xeb~\xed\xcb0\xb7\xe7\xe6?8g\x8aN\xda\x8f\x9d\xde\x1eNaS\x8fLk\xf1\x965N\x18\x8c\xb9=5\x991\xae\x89N\x13\xd1\xf7\xf0\x13\xb2\xaeS\xa1\x97\x18j\xea\x9f\xde\xb6\xd4\xdc\xe6*\x9c\xfdV\x82\x05', 0x2) ftruncate(r7, 0xffff) fcntl$addseals(r7, 0x409, 0x3) close(r0) ioctl$UDMABUF_CREATE(r6, 0x40187542, &(0x7f0000000000)={r7, 0x1, 0x0, 0x2000}) pselect6(0x40, &(0x7f0000000100)={0x0, 0x3, 0x0, 0x1, 0x800, 0xfffffffffffffffe}, 0x0, &(0x7f0000000240)={0x1f, 0x3, 0x0, 0x0, 0x0, 0xfffffffffffffffc}, &(0x7f0000000280)={0x0, 0x3938700}, 0x0) r8 = dup(r5) write$UHID_INPUT(r8, &(0x7f0000001040)={0xc, {"a2e3ad214fc752f91b3e090987f70e06d03be7ff7fc6e5539b3264078b089b0e083871090890e0878f0e1ac6e7049b334c959b669a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b31360d3b5d0936cd3b78130daa61d8e809ea882f5802b77f07227227b7ba67e0e78669a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000002335875271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1fe90a56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617601000000be70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d595a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9980000000b3309603f1d4ab966203861b5b15a841f2b575a8bd0d780231c9c99a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6c82fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c2021d653a5520000008213b704a5000000000000008ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710a80000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4e38a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2bed9e53803edf1a4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034e00000000ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c478b095b68441a34cb51682a8ae4d24ad92f243941ed274549b79a7962fb385a882e8020f068bb87af8b90fd8f08876da865d258734dd73583df292892448039ef799cf0630becdbe6c4579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93ae62fccfcbb2b75a2183c46eb65ca8124e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43e4fb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e01feffffffffffff83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369d75f2e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aa01b20f7694a00f16e2d0174035a2c22656dc00880acebdbe8ddbd75c2f998d8ac2dfad2ba3a50200000045a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe2907ac0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf463661c953fcad6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7cd419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaeecf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b281769177c6d594f88a4facfd4c735a20307c737afae5136651b1b9bd522d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a37684f4113c48859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463183b4b87c105000000302a808d7f5251440613d17ca51055f2f416a44fe180d2d50c312cca7cb14a20dc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb40100000006376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7ceec7dc808bf653639d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a602000000000000007007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4908b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf6529006c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6522fb5f6ffcdd56fed88935fcb75912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae233a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a5bd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08008897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b80c1c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c98ad90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe360500000000000000b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1062dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1df0d07b3d5bd3b01faffd0addbed2881a9700af561ac8c7e36bb2fc4c40e9c766c06817bb903729a7db6ff957697c9ede7885d94ffb0759be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c1484d2f9c55f4901203a9a8a2c3e51074b41bc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000600", 0x7c4}}, 0x1006) io_uring_setup(0x24ee, &(0x7f0000000340)={0x0, 0x2c28, 0x200, 0x0, 0x10000000, 0x0, r8}) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, 0x0) bpf$MAP_UPDATE_BATCH(0x1b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x3ff, 0xffffffffffffffff, 0x0, 0x100000000000000}, 0x38) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x3, 0x5, &(0x7f0000000500)=ANY=[@ANYBLOB="1800000002000000000000000608327aa13a60bdf9007a000800c2a92ac7fa5fc8086d5c4fd9008500f5020d8a9cc72e9fa652e038d25329f69beb21f8a22afd1c2549c17ac9c435f8fe3f1ef18a40e04bcf38d278295bfede7fde0ee9c2be4b9afc2b4b14a39e5c06000000ba2adb186c6195f90b87e17d56c77ac44163ca42ddecad7d48350117f36796b33db4a945464ec17d008cf72ad4b9397f427aa62e4d0db1f8b2b316908623"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000005c0)=ANY=[@ANYBLOB="340000000706010400000000f2000000000008100640040100010900020073797a3100000000000000d7bfbc007f83c642df00000000000000000000004fe39c4b67c991a2931d122ec461de477a7f05ad18fe1515894442b96bcae05fe815515c1e157063c40f5ef2648ff01119002f64416be7022e28ef89241429ed532e8511490ca3f8d7b2b8f91f704eac88c64ecd99e70600008aabe2b300ba05456f5b4e6f41b036034233919a43e747ad50c43e004e47c24d24f3f48e4a97480d17b56dff1401ca9f6cf29d368976883483485379f0"], 0x34}, 0x1, 0x0, 0x0, 0x20004055}, 0x48000) 10.289796372s ago: executing program 5 (id=10244): socket$nl_generic(0x10, 0x3, 0x10) mkdir(&(0x7f00000002c0)='./file0\x00', 0xe2) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x0, &(0x7f0000000c00)=ANY=[]) chdir(&(0x7f0000000080)='./file0\x00') open(&(0x7f00000000c0)='./file0\x00', 0x149442, 0x0) 10.169080659s ago: executing program 6 (id=10245): socket$nl_generic(0x10, 0x3, 0x10) mkdir(&(0x7f00000002c0)='./file0\x00', 0xe2) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x0, &(0x7f0000000c00)=ANY=[]) chdir(&(0x7f0000000080)='./file0\x00') open(&(0x7f00000000c0)='./file0\x00', 0x149442, 0x0) 10.168606918s ago: executing program 6 (id=10246): syz_usb_connect(0x0, 0x24, 0x0, 0x0) r0 = syz_open_dev$I2C(&(0x7f00000000c0), 0xc, 0x88000) ioctl$I2C_RDWR(r0, 0x707, &(0x7f0000000240)={&(0x7f0000000200)=[{0x3, 0x2800, 0x27, &(0x7f0000000100)="82078799431630c3306ff06f1afa24eaf6daf82c38ea0293dad2b9fbb237ebb62111933633d8d1"}], 0x1}) r1 = syz_open_dev$sg(&(0x7f0000001600), 0x0, 0x40042) write$binfmt_aout(r1, &(0x7f0000000480)=ANY=[@ANYBLOB="0000000000000000000000800080000014000091ff0f00004500f5ff06ff00010100fc5e15f4c3d3fbd80dad0007"], 0x125) r2 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000500)={0x114, 0x37, 0x1, 0x0, 0x0, "", [@nested={0x101, 0x0, 0x0, 0x1, [@typed={0xc, 0x1, 0x0, 0x0, @u64}, @typed={0x14, 0x3, 0x0, 0x0, @ipv6=@rand_addr=' \x01\x00'}, @generic="50bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a487f26fbe8101000000010000008b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767734f69ce475f55ac64337803f5eb4e5842f4d98fe3fa370d47eb640dc5061dc35817c8a66c29be82fd"]}]}, 0x114}], 0x1}, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000000)={'syztnl2\x00', 0x0, 0x10, 0x40, 0x200, 0x7f, {{0x5, 0x4, 0x1, 0x1, 0x14, 0x65, 0x0, 0x81, 0xae338c96d26691a1, 0x0, @multicast1, @remote}}}}) 9.49092046s ago: executing program 6 (id=10248): r0 = syz_open_dev$media(&(0x7f00000006c0), 0x4, 0x0) ioctl$MEDIA_IOC_REQUEST_ALLOC(r0, 0x80047c05, 0x0) pselect6(0x900, 0x0, 0x0, &(0x7f0000000240)={0x1f}, &(0x7f0000000280)={0x0, 0x3938700}, 0x0) r1 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000083667d1040206402d14e0102030109021b000100000000090400000190f19c00090584"], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) r2 = syz_open_dev$usbmon(&(0x7f0000000000), 0x6, 0x200) ioctl$MON_IOCX_MFETCH(r2, 0xc00c9207, &(0x7f0000000100)={0x0, 0x16, 0xb6}) syz_open_dev$usbfs(&(0x7f0000000240), 0x10, 0x80100) syz_usb_control_io$printer(r1, 0x0, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') r5 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r4, &(0x7f0000000040)) io_setup(0x3ff, &(0x7f0000000500)=0x0) io_submit(r6, 0xf000, &(0x7f0000000300)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x5, 0x0, r3, 0x0}, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r3, &(0x7f00000001c0)='m', 0xffffff4c}]) syz_usb_control_io(r1, 0x0, 0x0) r7 = openat$rtc(0xffffffffffffff9c, &(0x7f00000003c0), 0x80000, 0x0) ioctl$RTC_WKALM_SET(r7, 0x4028700f, &(0x7f0000000000)={0xff, 0x0, {0x4, 0x39, 0x16, 0x19, 0x4, 0xe80, 0x5, 0x400040, 0xffffffffffffffff}}) syz_usb_control_io$printer(r1, 0x0, 0x0) syz_usb_control_io$sierra_net(r1, 0x0, &(0x7f00000016c0)={0x1c, &(0x7f0000001140)=ANY=[], 0x0, 0x0}) r8 = syz_open_dev$I2C(&(0x7f0000000100), 0x2, 0x1) syz_usb_control_io$cdc_ncm(r1, &(0x7f00000000c0)={0xc, &(0x7f0000000040)={0x0, 0x9, 0x5, {0x5, 0x22, "8c76c2"}}, &(0x7f0000000080)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000400)={0x24, &(0x7f0000000140)={0x0, 0x7, 0x23, "457b2810d29a4828607b6c73bf5b3bffa0c5c968d1e5a0bd764756e48256e4c232baa8"}, &(0x7f0000000180)={0x0, 0xa, 0x1, 0x8f}, &(0x7f00000001c0)={0x0, 0x8, 0x1, 0x7}, &(0x7f0000000200)={0x20, 0x80, 0x1c, {0x9, 0xff, 0x8, 0x3, 0x0, 0x1, 0x3, 0x37, 0x3ff, 0x4, 0x4, 0x4}}, &(0x7f00000002c0)={0x20, 0x85, 0x4, 0x3}, &(0x7f0000000300)={0x20, 0x83, 0x2, 0x1}, &(0x7f0000000340)={0x20, 0x87, 0x2}, &(0x7f0000000380)={0x20, 0x89, 0x2}}) ioctl$I2C_RDWR(r8, 0x707, &(0x7f0000000740)={&(0x7f0000000800)=[{0x5, 0xa000, 0x2, &(0x7f0000000280)="da9d"}], 0x1}) 9.091446187s ago: executing program 5 (id=10249): r0 = socket(0x21, 0x80000, 0xc) r1 = socket(0x40000000015, 0x5, 0x0) bind$inet(r1, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x57) r2 = socket$nl_sock_diag(0x10, 0x3, 0x4) getsockopt$netlink(r2, 0x10e, 0x4, 0x0, &(0x7f0000000000)=0xfffffffffffffd55) getsockopt(r0, 0x200000000114, 0x2716, &(0x7f0000c35fff)=""/1, &(0x7f0000000000)=0xf002) r3 = syz_open_dev$evdev(&(0x7f0000000000), 0x0, 0x88440) ioctl$EVIOCGMASK(r3, 0x80104592, &(0x7f0000000300)={0x0, 0x9, &(0x7f0000000200)='\x00\x00\x00\x00\x00\x00\x00\x00\x00'}) ioctl$EVIOCGNAME(r3, 0x80404506, &(0x7f00000000c0)=""/32) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mkdir(&(0x7f0000000100)='./bus\x00', 0xe8) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000b80), 0x0, &(0x7f0000000a80)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@volatile}]}) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x81, 0x0) ioctl$SNAPSHOT_PLATFORM_SUPPORT(r4, 0x330f, 0x4) r5 = creat(&(0x7f0000000080)='./file0/file1\x00', 0x90) write$cgroup_type(r5, &(0x7f0000000000), 0xd4ba103) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) timer_settime(r6, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) timer_settime(r6, 0x0, &(0x7f0000000140)={{}, {0x77359400}}, &(0x7f0000000080)) r7 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r7, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r7, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r7, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r7, 0x6, 0xd, &(0x7f00000000c0)='cdg', 0x3) sendmmsg$inet(r7, 0x0, 0x0, 0x42054) sendto$inet(r7, &(0x7f0000000040)="17", 0xfffffe75, 0x10008085, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r7, 0x6, 0xd, &(0x7f0000000100)='hybla', 0x5) setsockopt$SO_TIMESTAMPING(r7, 0x1, 0x41, &(0x7f0000000100)=0x100, 0x4) 5.589478271s ago: executing program 5 (id=10257): r0 = socket$nl_generic(0x10, 0x3, 0x10) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x0, &(0x7f0000000c00)=ANY=[@ANYBLOB="56c78e3c733d76697274696f2c6e6f657874656e642c6163638173733d616e792c63616368653d667363616368652c76657273696f6e3d3970323030302e75"]) chdir(&(0x7f0000000080)='./file0\x00') r1 = open(&(0x7f00000000c0)='./file0\x00', 0x149442, 0x0) ftruncate(r1, 0x200002) r2 = open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(0xffffffffffffffff, &(0x7f00000002c0)=@pppol2tpin6={0x18, 0x1, {0x0, r3, 0x4, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x32) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mkdir(&(0x7f00000001c0)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) r4 = open(&(0x7f0000000040)='./file1\x00', 0x808400, 0x43) chdir(&(0x7f00000003c0)='./bus\x00') openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x185003, 0xbc) mkdirat(r4, &(0x7f0000000340)='./file0\x00', 0xf3) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./bus\x00', 0x4d) rename(&(0x7f0000000180)='./bus\x00', &(0x7f00000001c0)='./file0\x00') sendfile(0xffffffffffffffff, r2, 0x0, 0x80001d00c0d0) link(&(0x7f00000001c0)='./file1\x00', &(0x7f0000000000)='./file0\x00') mknodat$loop(0xffffffffffffff9c, 0x0, 0x6004, 0x1) sendmsg$nl_generic(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[], 0x38}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) 5.588836102s ago: executing program 2 (id=10258): r0 = socket(0x21, 0x80000, 0xc) r1 = socket(0x40000000015, 0x5, 0x0) bind$inet(r1, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x57) r2 = socket$nl_sock_diag(0x10, 0x3, 0x4) getsockopt$netlink(r2, 0x10e, 0x4, 0x0, &(0x7f0000000000)=0xfffffffffffffd55) getsockopt(r0, 0x200000000114, 0x2716, &(0x7f0000c35fff)=""/1, &(0x7f0000000000)=0xf002) r3 = syz_open_dev$evdev(&(0x7f0000000000), 0x0, 0x88440) ioctl$EVIOCGMASK(r3, 0x80104592, &(0x7f0000000300)={0x0, 0x9, &(0x7f0000000200)='\x00\x00\x00\x00\x00\x00\x00\x00\x00'}) ioctl$EVIOCGNAME(r3, 0x80404506, &(0x7f00000000c0)=""/32) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mkdir(&(0x7f0000000100)='./bus\x00', 0xe8) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000b80), 0x0, &(0x7f0000000a80)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x81, 0x0) ioctl$SNAPSHOT_PLATFORM_SUPPORT(r4, 0x330f, 0x4) r5 = creat(&(0x7f0000000080)='./file0/file1\x00', 0x90) write$cgroup_type(r5, &(0x7f0000000000), 0xd4ba103) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) timer_settime(r6, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) timer_settime(r6, 0x0, &(0x7f0000000140)={{}, {0x77359400}}, &(0x7f0000000080)) r7 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r7, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r7, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r7, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r7, 0x6, 0xd, &(0x7f00000000c0)='cdg', 0x3) sendmmsg$inet(r7, 0x0, 0x0, 0x42054) sendto$inet(r7, &(0x7f0000000040)="17", 0xfffffe75, 0x10008085, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r7, 0x6, 0xd, &(0x7f0000000100)='hybla', 0x5) setsockopt$SO_TIMESTAMPING(r7, 0x1, 0x41, &(0x7f0000000100)=0x100, 0x4) 5.434677744s ago: executing program 5 (id=10259): r0 = syz_open_dev$sndctrl(&(0x7f0000000040), 0xc, 0x80) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, 0x0) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000), 0x8502, 0x0) write$sndseq(r1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x0, @tick, {0x5}, {}, @addr}, {0x0, 0x0, 0x0, 0x0, @time, {}, {}, @result}, {0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @control}, {0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time}], 0x68) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, &(0x7f00000000c0)={0x1, 0x0, [{0x4b564d07, 0x0, 0x5}]}) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x20) ioctl$KVM_SET_MSRS(r4, 0xc008ae88, &(0x7f0000000040)={0x10000000000000cf, 0x0, [{}]}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) r5 = openat$vicodec0(0xffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$VIDIOC_G_EXT_CTRLS(r5, 0xc0185648, &(0x7f0000000100)={0x0, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000000c0)={0x98f90b, 0x9e69, '\x00', @p_u32=&(0x7f0000000440)=0x9}}) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x4010, 0xffffffffffffffff, 0xb320a000) r6 = open(&(0x7f0000000100)='./file0\x00', 0x1c082, 0x0) timer_delete(0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) fcntl$lock(r6, 0x410, &(0x7f00000000c0)={0x1, 0x1, 0x1, 0xfffe}) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) setxattr$system_posix_acl(&(0x7f0000002a00)='.\x00', &(0x7f0000002a40)='system.posix_acl_default\x00', 0x0, 0x0, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) r7 = socket$inet6(0xa, 0x0, 0x0) setsockopt$inet6_tcp_TCP_ULP(r7, 0x6, 0x1f, &(0x7f0000000000), 0x3) 5.225082172s ago: executing program 5 (id=10261): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nfc(&(0x7f0000000880), r1) r2 = syz_genetlink_get_family_id$devlink(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_TRAP_POLICER_GET(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYBLOB="c7bc16d78d19938f772307c94047e982452af6f64301fed5b17dc1ffef6af8078dbd3f91ee96ea121a1b0d3f973d2a0b6eb98a0241e68135d894accc099d4e7ae3e5ff6d4574cbaed100cfe07d83da21b0cb6a29168526d69073a711dab3f6ed8528941a81bf292eca97eafbf433dd66836594cf51a33f2a37ee4b06dda890fd33c158cc4e16b1571223bd0dd9b19d619bceb6ce67e00000", @ANYRES16=r2, @ANYBLOB="01002bbd7000fddbdf25450000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008008e001f000000"], 0x3c}, 0x1, 0x0, 0x0, 0x4844}, 0x24048010) socket$inet6_udp(0xa, 0x2, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0f00000004000000080000000c"], 0x50) socket$inet6_sctp(0xa, 0x5, 0x84) socket$can_raw(0x1d, 0x3, 0x1) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000000c0)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYBLOB="81b8000000000000140012800b000100697036677265000004"], 0x34}, 0x1, 0x0, 0x0, 0x24048007}, 0x4040844) socket$nl_route(0x10, 0x3, 0x0) socket$unix(0x1, 0x2, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)) socket(0x400000000010, 0x3, 0xf) socket$unix(0x1, 0x1, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3800000041000701fefffffffeffffff017c0000040042800c000180060006006558000014000280100014800c00", @ANYRES8=r3], 0x38}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) r4 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000300)={0xffffffffffffffff}, 0x2}}, 0x20) pselect6(0x40, &(0x7f0000000000)={0x9}, 0x0, 0x0, 0x0, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r4, &(0x7f00000001c0)={0x18, 0x110, 0xfa00, {r5, 0x7fffffff, 0x12, 0x0, 0x0, @ib={0x1b, 0x8, 0x6, {"78c36cbe7e38dade0099fe4e9d908e9b"}, 0xffff, 0x1ff, 0xfffffffeffffffff}, @in6={0xa, 0x4e22, 0x2, @local, 0x2}}}, 0x118) syz_genetlink_get_family_id$tipc2(&(0x7f0000000d80), 0xffffffffffffffff) 4.84934228s ago: executing program 4 (id=10263): pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r0, &(0x7f0000000380)=[{&(0x7f0000013580)="0dd2e7c8926dc6acd0ae6c178054e95986faff9544de5fc4c30adf404da41181a77466ac5075905ea5f50134fdd517a957fe2ee59b61f9fe8d7aabe595ea23de2723e437af0423a56686a4c2d957be1a0ab922fbbd3cb1d8c6ab0d58440a327c8eb05d445b4ac5f20abe449e4084f8b996268d0564f67980d3ed3479e0edfe5cec7b4f89bface391c9c4c58ad123b91c33173c72326d1df18804a9ea20f9ece48f784d8ca2318e3d2b316666b5dfb7295c4915989d5bcb120e8fedaa97b93a137c256ce4", 0xc4}, {&(0x7f0000013680)="c578381bf5113dad8319d9ea5294285ae9a90384ce23866477bef9de4399237d8b3522c9c194e71edaf3332a2f169682f9d8fa271683d4d441b710409e506333e0c3b64e52e8720734b6787f4a84f5bebb046649c6c697d978affd34a9f2774e6344d62f945e7a5bf2f5f7a31684c0503704881d2578a2a98ac3ef4e4a4b0dcdb70db735d5c1652eed3848b2dd4131bb0eb7cfadfaf5000000", 0x99}], 0x2, 0x0) write(0xffffffffffffffff, 0x0, 0x0) 4.597854916s ago: executing program 4 (id=10264): r0 = socket$nl_generic(0x10, 0x3, 0x10) socket$inet_udp(0x2, 0x2, 0x0) r1 = getpgid(0x0) r2 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) setsockopt$sock_int(r2, 0x1, 0x3e, &(0x7f00000000c0)=0x7, 0x4) bind$llc(r2, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x44, 0xf6}, 0x10) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) rename(&(0x7f00000002c0)='./file1\x00', &(0x7f0000000240)='./file1\x00') recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = syz_open_dev$tty1(0xc, 0x4, 0x1) r6 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2) r7 = memfd_create(&(0x7f0000000700)='y\x105\xfb\xf7u\x83%\x1f\xe09@:r\xc2\xb9x0\x90P\x03\x00\x00\x00\x00\x00\x00\x00\xfe,\x1c\xf1\xdd\xcf]\xac\xbc\t\xbb\xfc\xa4j\x9f\xceX\x8f5=\xaa\xd5\xe9n\xab s\xa5\x00\x8d\tV\t\x91\x18\x06O\xb0=D\xda\xb6F\x1a\xc82\x8b\xc0l\xd0\x89d\xe6\xb7\xd8\x97\xb8\xde\xa3\x89\xc2%/u\x17\xdaM\x8d\x01Lh\x1e^\x9ej\x1c\xc5\xf0\xf6\x92\x05\x9aH\x00\'\xd4\x94d_\v\xfc\xad\x0f\xa8\xc5\xad\x00\xc2\x12\xff\xff\xff\xff\xff\xff\x00\x00\x00\x00\nj\x8c\xef\x90\xc0Z\xfa\x1a\xb3\xf0wVq\xe9d\xf8N\x80\xd1g\xd8e\xc8\x16\xad1\x02\xab\xce3\xb2\xb0\xd1\x11\xf0\xc3Gj+kV$\x80\x8aJ$\x81\xc0\x16\xf5\x9cz\x10\x97\xdb\x12H\xee/\xe3sY\x02D;L~\xd0\xb44\x01*\xfb\xa4 \xb2b\x90H$\xb2\xad\xbf\x8aM\xb6\x81\x81^\x02\xa0\xa7t\xfbHb\xa5=\xdd+$\xc06J\xb4\xf0\xab\x85Xz\x9f\xb2D$\xbe\xd9\x7f-\r\x9aj9r\n_\x11\xd4\x19\xb0\xa0G\xb7\x94\xf7\xfd~\xe9\xb6G\xbfE\xbb\x15\x15\xa6\xca2\xd0\xd3\x8c\xf7nO\xf9\xa8\xfd\x8a\xd2\xb2\xab\xff\xe4\xb0;\xd9\xa8\f\x03R\xbd%\x9fF\xee\x05\x06.3(QF?\f\x05\xa4uY\xee\xab\x8a\xeb~\xed\xcb0\xb7\xe7\xe6?8g\x8aN\xda\x8f\x9d\xde\x1eNaS\x8fLk\xf1\x965N\x18\x8c\xb9=5\x991\xae\x89N\x13\xd1\xf7\xf0\x13\xb2\xaeS\xa1\x97\x18j\xea\x9f\xde\xb6\xd4\xdc\xe6*\x9c\xfdV\x82\x05', 0x2) ftruncate(r7, 0xffff) fcntl$addseals(r7, 0x409, 0x3) close(r0) ioctl$UDMABUF_CREATE(r6, 0x40187542, &(0x7f0000000000)={r7, 0x1, 0x0, 0x2000}) pselect6(0x40, &(0x7f0000000100)={0x0, 0x3, 0x0, 0x1, 0x800, 0xfffffffffffffffe}, 0x0, &(0x7f0000000240)={0x1f, 0x3, 0x0, 0x0, 0x0, 0xfffffffffffffffc}, &(0x7f0000000280)={0x0, 0x3938700}, 0x0) r8 = dup(r5) write$UHID_INPUT(r8, &(0x7f0000001040)={0xc, {"a2e3ad214fc752f91b3e090987f70e06d03be7ff7fc6e5539b3264078b089b0e083871090890e0878f0e1ac6e7049b334c959b669a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b31360d3b5d0936cd3b78130daa61d8e809ea882f5802b77f07227227b7ba67e0e78669a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000002335875271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1fe90a56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617601000000be70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d595a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9980000000b3309603f1d4ab966203861b5b15a841f2b575a8bd0d780231c9c99a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6c82fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c2021d653a5520000008213b704a5000000000000008ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710a80000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4e38a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2bed9e53803edf1a4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034e00000000ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c478b095b68441a34cb51682a8ae4d24ad92f243941ed274549b79a7962fb385a882e8020f068bb87af8b90fd8f08876da865d258734dd73583df292892448039ef799cf0630becdbe6c4579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93ae62fccfcbb2b75a2183c46eb65ca8124e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43e4fb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e01feffffffffffff83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369d75f2e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aa01b20f7694a00f16e2d0174035a2c22656dc00880acebdbe8ddbd75c2f998d8ac2dfad2ba3a50200000045a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe2907ac0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf463661c953fcad6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7cd419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaeecf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b281769177c6d594f88a4facfd4c735a20307c737afae5136651b1b9bd522d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a37684f4113c48859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463183b4b87c105000000302a808d7f5251440613d17ca51055f2f416a44fe180d2d50c312cca7cb14a20dc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb40100000006376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7ceec7dc808bf653639d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a602000000000000007007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4908b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf6529006c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6522fb5f6ffcdd56fed88935fcb75912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae233a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a5bd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08008897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b80c1c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c98ad90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe360500000000000000b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1062dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1df0d07b3d5bd3b01faffd0addbed2881a9700af561ac8c7e36bb2fc4c40e9c766c06817bb903729a7db6ff957697c9ede7885d94ffb0759be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c1484d2f9c55f4901203a9a8a2c3e51074b41bc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000600", 0x7c4}}, 0x1006) io_uring_setup(0x24ee, &(0x7f0000000340)={0x0, 0x2c28, 0x200, 0x0, 0x10000000, 0x0, r8}) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, 0x0) bpf$MAP_UPDATE_BATCH(0x1b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x3ff, 0xffffffffffffffff, 0x0, 0x100000000000000}, 0x38) bpf$PROG_LOAD(0x5, 0x0, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r9, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000005c0)=ANY=[@ANYBLOB="340000000706010400000000f2000000000008100640040100010900020073797a3100000000000000d7bfbc007f83c642df00000000000000000000004fe39c4b67c991a2931d122ec461de477a7f05ad18fe1515894442b96bcae05fe815515c1e157063c40f5ef2648ff01119002f64416be7022e28ef89241429ed532e8511490ca3f8d7b2b8f91f704eac88c64ecd99e70600008aabe2b300ba05456f5b4e6f41b036034233919a43e747ad50c43e004e47c24d24f3f48e4a97480d17b56dff1401ca9f6cf29d368976883483485379f0"], 0x34}, 0x1, 0x0, 0x0, 0x20004055}, 0x48000) 4.382993403s ago: executing program 2 (id=10265): r0 = syz_open_dev$sndctrl(&(0x7f0000000040), 0xc, 0x80) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, 0x0) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000), 0x8502, 0x0) write$sndseq(r1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x0, @tick, {0x5}, {}, @addr}, {0x0, 0x0, 0x0, 0x0, @time, {}, {}, @result}, {0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @control}, {0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time}], 0x68) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, &(0x7f00000000c0)={0x1, 0x0, [{0x4b564d07, 0x0, 0x5}]}) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x20) ioctl$KVM_SET_MSRS(r4, 0xc008ae88, &(0x7f0000000040)={0x10000000000000cf, 0x0, [{}]}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) r5 = openat$vicodec0(0xffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$VIDIOC_G_EXT_CTRLS(r5, 0xc0185648, &(0x7f0000000100)={0x0, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000000c0)={0x98f90b, 0x9e69, '\x00', @p_u32=&(0x7f0000000440)=0x9}}) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x4010, 0xffffffffffffffff, 0xb320a000) r6 = open(&(0x7f0000000100)='./file0\x00', 0x1c082, 0x0) timer_delete(0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) fcntl$lock(r6, 0x410, &(0x7f00000000c0)={0x1, 0x1, 0x1, 0xfffe}) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) setxattr$system_posix_acl(&(0x7f0000002a00)='.\x00', &(0x7f0000002a40)='system.posix_acl_default\x00', 0x0, 0x0, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) r7 = socket$inet6(0xa, 0x0, 0x0) setsockopt$inet6_tcp_TCP_ULP(r7, 0x6, 0x1f, &(0x7f0000000000), 0x3) 4.1813581s ago: executing program 2 (id=10266): r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) r2 = openat$tun(0xffffffffffffff9c, 0x0, 0xc8781, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) syz_open_dev$loop(&(0x7f0000000100), 0xf01c, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cpuset.memory_pressure\x00', 0x275a, 0x0) r3 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0xb04, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r3, r4, r5, r6, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) r9 = dup(r8) syz_ublk_setup_queues(r9, r7, &(0x7f0000000180)={0x0, 0x1, 0x0, 0x3, 0x255}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x400, 0x2100, 0x10000004, 0x0, r9}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x11e0, 0x1, 0xfffffffe, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf910, 0x0, 0x0, 0x1f0, 0x0, r9}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x587e, 0x8200, 0x2, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x0, 0x0, 0x0}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x6, 0x0, &(0x7f0000000000)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x94) r10 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r10, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) 3.950124773s ago: executing program 5 (id=10267): r0 = syz_open_dev$media(&(0x7f00000006c0), 0x4, 0x0) ioctl$MEDIA_IOC_REQUEST_ALLOC(r0, 0x80047c05, 0x0) pselect6(0x900, 0x0, 0x0, &(0x7f0000000240)={0x1f}, &(0x7f0000000280)={0x0, 0x3938700}, 0x0) r1 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000083667d1040206402d14e0102030109021b000100000000090400000190f19c00090584"], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) r2 = syz_open_dev$usbmon(&(0x7f0000000000), 0x6, 0x200) ioctl$MON_IOCX_MFETCH(r2, 0xc00c9207, &(0x7f0000000100)={0x0, 0x16, 0xb6}) syz_open_dev$usbfs(&(0x7f0000000240), 0x10, 0x80100) syz_usb_control_io$printer(r1, 0x0, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') r5 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r4, &(0x7f0000000040)) io_setup(0x3ff, &(0x7f0000000500)=0x0) io_submit(r6, 0xf000, &(0x7f0000000300)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x5, 0x0, r3, 0x0}, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r3, &(0x7f00000001c0)='m', 0xffffff4c}]) syz_usb_control_io(r1, 0x0, 0x0) r7 = openat$rtc(0xffffffffffffff9c, &(0x7f00000003c0), 0x80000, 0x0) ioctl$RTC_WKALM_SET(r7, 0x4028700f, &(0x7f0000000000)={0xff, 0x0, {0x4, 0x39, 0x16, 0x19, 0x4, 0xe80, 0x5, 0x400040, 0xffffffffffffffff}}) syz_usb_control_io$printer(r1, 0x0, 0x0) syz_usb_control_io$sierra_net(r1, 0x0, &(0x7f00000016c0)={0x1c, &(0x7f0000001140)=ANY=[], 0x0, 0x0}) r8 = syz_open_dev$I2C(&(0x7f0000000100), 0x2, 0x1) syz_usb_control_io$cdc_ncm(r1, &(0x7f00000000c0)={0xc, &(0x7f0000000040)={0x0, 0x9, 0x5, {0x5, 0x22, "8c76c2"}}, &(0x7f0000000080)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000400)={0x24, &(0x7f0000000140)={0x0, 0x7, 0x23, "457b2810d29a4828607b6c73bf5b3bffa0c5c968d1e5a0bd764756e48256e4c232baa8"}, &(0x7f0000000180)={0x0, 0xa, 0x1, 0x8f}, &(0x7f00000001c0)={0x0, 0x8, 0x1, 0x7}, &(0x7f0000000200)={0x20, 0x80, 0x1c, {0x9, 0xff, 0x8, 0x3, 0x0, 0x1, 0x3, 0x37, 0x3ff, 0x4, 0x4, 0x4}}, &(0x7f00000002c0)={0x20, 0x85, 0x4, 0x3}, &(0x7f0000000300)={0x20, 0x83, 0x2, 0x1}, &(0x7f0000000340)={0x20, 0x87, 0x2}, &(0x7f0000000380)={0x20, 0x89, 0x2}}) ioctl$I2C_RDWR(r8, 0x707, &(0x7f0000000740)={&(0x7f0000000800)=[{0x5, 0xa000, 0x2, &(0x7f0000000280)="da9d"}], 0x1}) 3.648940721s ago: executing program 4 (id=10268): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@base={0xf, 0x4, 0x8, 0xb, 0x0, 0xffffffffffffffff, 0x2}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x5}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x400}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x1e00, 0x68, '\x00', 0x0, @fallback=0x31, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000010c0)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000300)={r1, 0x2000000, 0x0, 0x0, &(0x7f0000000600), 0x0, 0x7ffd, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) 3.646417622s ago: executing program 4 (id=10269): r0 = syz_open_dev$vim2m(&(0x7f0000000040), 0x1000001, 0x2) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_CONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="050000000000000000002e00000008000300", @ANYRES32=r3, @ANYBLOB="0c0099008801000041000000040034004c1b95e95a5ebccb9ff7b9bdc7fd94abc78c8904e9e81cab8000c344dce802f1b6a122888433cc8334e7c426ff7c99ee4b3da612ca830000000000000000"], 0x2c}}, 0x0) ioctl$vim2m_VIDIOC_S_CTRL(r0, 0xc008561c, &(0x7f0000000000)={0x980912}) r4 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r4, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) syz_emit_ethernet(0xbe, &(0x7f00000006c0)=ANY=[@ANYBLOB="aaaaaaaaaa23aaaaaaaaaabb0800450000b000000000040400000000000000000000fffc4e20009c907801000000000000090000003b7461fd777b1c012bd14efb9f49fcdb8f080c26a04883ad5c8c82b8af584cbf2649a50f2dbc43efa8698d0a881c51852e4451b57d037ad3c045942824251d7d17b5191584bcd4fbe40a23424dbcfd56f1375461caaa2f19935e6996c7096ffeeb03000000000000649a3bfbc1d19cb307b3472ab8cdb042d2683fcbb2c5a57df67d074af6e8dafe0957fef5588823d21d45b66c50b7dc4b8005eea2504cabbbc603740de38fe625221f60a509d60bc917c2388df58000df8273fc4ff32c94615458cfd921155be3d3a0533fb8aff4d4cdf1b957c349b6c3e41e01586571d9ee1e08c82e6fe1c31d8f58be0e611dbe0fc06d8e5a5d39be5de563b48644ad69d37ee97e1eb001f1cc877ea6b2e4f3ca428d304fa45720681ec7ffc6f8910ad415baa65225cae10dcfc6bfa093619501"], 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x2, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x2b}, 0x94) r5 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x7}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r5, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) recvmmsg(r4, &(0x7f0000002680)=[{{0x0, 0x0, &(0x7f0000002580)=[{0x0}, {&(0x7f00000014c0)=""/4096, 0x94}], 0x2}, 0x200}], 0x1, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) r6 = syz_open_dev$vbi(&(0x7f0000000000), 0x3, 0x2) ioctl$VIDIOC_S_CTRL(r6, 0xc008561c, &(0x7f0000000080)={0xf0f040, 0x4}) syz_clone(0x100000, &(0x7f0000000000), 0x0, 0x0, 0x0, 0x0) r7 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) process_vm_writev(r7, &(0x7f0000000180)=[{&(0x7f0000000080)=""/215, 0xd7}], 0x1, &(0x7f0000002540)=[{&(0x7f00000021c0)=""/233, 0xe9}], 0x1, 0x0) 2.66139797s ago: executing program 2 (id=10270): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket(0x400000000010, 0x3, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000001c0), r2) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r4, 0x8933, &(0x7f0000000340)={'wpan0\x00', 0x0}) sendmsg$IEEE802154_LLSEC_ADD_DEV(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)={0x50, r3, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8, 0x2f, 0xfffffffd}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r5}, @IEEE802154_ATTR_PAN_ID={0x6}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5, 0x36, 0x1}]}, 0x50}, 0x4, 0x700000000000000}, 0x0) syz_genetlink_get_family_id$nl802154(&(0x7f00000003c0), 0xffffffffffffffff) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="18020000000000000000000000000000850000009b000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb70200"], &(0x7f0000000080)='GPL\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r6, 0x0, 0xe, 0x0, &(0x7f0000000000)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'wpan0\x00'}) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f00000008c0), 0xffffffffffffffff) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r7, 0x8933, &(0x7f00000001c0)={'wpan0\x00'}) msgctl$MSG_INFO(0x0, 0xc, 0x0) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x5, &(0x7f0000000000)=0x6, 0x4) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, 0x0) connect$inet(0xffffffffffffffff, &(0x7f0000000340)={0x2, 0x4e23, @multicast2}, 0x10) syz_open_dev$vbi(&(0x7f0000000000), 0x1, 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000140)={0x3, @pix={0x434c, 0x8, 0x584e4f53, 0x4, 0xc, 0xf, 0x0, 0x40000005, 0x1, 0x4, 0x2, 0x1}}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000480)=0x45) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r8 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r8, &(0x7f0000019680)=""/102384, 0x18ff0) 2.441948419s ago: executing program 4 (id=10271): r0 = socket$inet6_udp(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) connect$inet6(r0, &(0x7f0000000140)={0xa, 0x4e20, 0x6, @remote, 0xb}, 0x1c) socket$nl_route(0x10, 0x3, 0x0) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) ioctl$UI_ABS_SETUP(r1, 0x401c5504, &(0x7f0000000000)={0x0, {0x553, 0xd, 0x7, 0x8, 0x6, 0xcb8}}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x200, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0xe4b, 0x11e41e7a, 0x1, 0x1003, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x0, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$devlink(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_NEW(r2, &(0x7f0000002200)={0x0, 0x0, &(0x7f00000021c0)={&(0x7f0000002080)=ANY=[@ANYBLOB="f14d00", @ANYRES16=r3, @ANYBLOB="010000000000000000004c0000000e0001006e657464657673696d0000000f0002006e657464657673696d3000000f00b2007365636f6e646e616d650000"], 0x44}}, 0x0) r4 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x10000000000002) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sched_setaffinity(r4, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000840)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007100000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x94) 739.872591ms ago: executing program 4 (id=10272): sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=ANY=[@ANYBLOB="48000000120029481fe77c2b1111d801000000000000000000ac141400000000000000000000000000000000000000000014080d00200100000000000000000000000000000c0015000000000400000000"], 0x48}}, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000800)=@base={0x9, 0x4, 0x817, 0xb, 0x0, 0xffffffffffffffff, 0x6}, 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB, @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000003000000"], &(0x7f0000000440)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000380)={r2}, 0xc) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) connect$unix(r3, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000dc0)={0x38, 0x5, 0x8, 0x9, 0x0, 0x9, 0x0, 0xaa, 0xfa11, 0xffffffff}, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) close(0xffffffffffffffff) timer_create(0x0, &(0x7f00000002c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000b80)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r4, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) pipe2(&(0x7f0000000580)={0xffffffffffffffff}, 0x0) pipe2(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) tee(r5, r6, 0xfffffffffffffc01, 0x0) tee(r5, r6, 0x1fc, 0x0) r7 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKINFO_GET(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000100)={0x2c, r7, 0x1, 0x70bd26, 0x25dfdbfd, {}, [@HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0\x00'}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x800}, 0x10) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000100)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x190, 0x5230}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_AD_SELECT={0x5, 0x16, 0x1}]}}}]}, 0x3c}}, 0x0) sendmsg$nl_route(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000008000280012800a00010076786c616e00000018"], 0x50}}, 0x0) r9 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r9, &(0x7f00000000c0), 0x10) setsockopt$CAN_RAW_ERR_FILTER(r9, 0x65, 0x2, &(0x7f0000000000)=0xa, 0x4) ioctl$ifreq_SIOCGIFINDEX_vcan(r9, 0x8933, &(0x7f0000000040)={'vxcan0\x00'}) 560.74587ms ago: executing program 2 (id=10273): r0 = landlock_create_ruleset(&(0x7f0000000000)={0x40, 0x1, 0x3}, 0x18, 0x1) r1 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r2 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(0xffffffffffffffff, 0x4024587b, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) getuid() ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x67c, 0x6, 0xf3b8, 0xfffffffffffffffe, 0x1000, 0x400, 0x4002004c4, 0xfffffffffffffffb, 0x0, 0x97, 0xe, 0x0, 0x3, 0x4, 0x0, 0x8], 0xeeee8000, 0x402}) ioctl$KVM_RUN(r2, 0xae80, 0x0) io_setup(0x8, &(0x7f0000000040)=0x0) r4 = eventfd(0x6) r5 = eventfd2(0x4b6, 0x80000) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='net/unix\x00') read(r6, &(0x7f0000000640)=""/4096, 0x1000) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r0, 0x4024587b, &(0x7f0000001980)={{r2, &(0x7f0000001440)='\x00', 0x10000, &(0x7f0000001480)={@_ha_fsid={[0x4, 0xb]}, {0x1, 0x2, 0x80, 0x3}}, 0x2, &(0x7f00000014c0), &(0x7f0000001500)=0xff}, 0x6, &(0x7f00000018c0)=[{0x3, 0x0, &(0x7f0000001540)='/dev/kvm\x00', &(0x7f0000001580), 0x0, 0x22}, {0x3, 0x4, &(0x7f00000015c0)='\x00', &(0x7f0000001600)="7d92bea1071e556356b5a2e336b7fc0b7cfe67630e0d38a3ca7ea67299ccaeae54e5f0d700774fbae7382626b0", 0x2d, 0x10}, {0x3, 0x81, &(0x7f0000001640)='/dev/kvm\x00', &(0x7f0000001680)="93d2322bebaa5a8bf4f9429a", 0xc, 0x38}, {0x1, 0x4, &(0x7f00000016c0)='\x00', &(0x7f0000001700)="2c22da23b08da79d7438de06084feb14", 0x10, 0xa}, {0x3, 0x4, &(0x7f0000001740)='\x00', &(0x7f0000001780)="9072256af624a78c5a02adc23a37f031af09959ec65dac7928ebe8ec0e6a39367928cb25a4adab1d801376e13611d9a86c69e699b1beeb9b81cfd130715fbcce", 0x40, 0x2}, {0x2, 0xc0c, &(0x7f00000017c0)=':%(\x00', &(0x7f0000001800)="64d7a4f999bf6d1176e3b3ea698378892b82b5b845128f9da578bddca0180016f0f0b99154f4f74a07f34d26b8b7c43be4fd98a9f5d288b08c5b575c567fcbc66815e4316ec8b26a01a625aae52d973362182758a43fb306d17725dce9991bd40a077ba8dc89a284eb1d28a3f9c161cdc715e60a5b05738c39777b200ab2d6c42762c9fe332b9e0e3ff861d523fa50c5aa", 0x91, 0x8}]}) r8 = eventfd(0x6) io_submit(r3, 0x7, &(0x7f0000001b80)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x81, r0, &(0x7f0000000100)="00de2c58c4a824a451568139f8945708fbbf1fa16df2", 0x16, 0x1, 0x0, 0x3}, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x5, 0x9, r1, &(0x7f0000000180)="82060abe002aff48d4b52f69de259c2b8633df36163838318d6a13294747df30e5b7df48f15d9e", 0x27, 0x3, 0x0, 0x3, r4}, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x5, 0x10b, 0xffffffffffffffff, &(0x7f00000002c0)="b02c0df2e3122038716e0d418ad5f81d941d3f15ce924fb675d78e76589b9dbc7b0df5f1bc25556e6de05f6d3387b0bab24fc8a4f8815e21c6e8aae1952fe58835f99c172a946a68dc2499e7357f0d17a68e6c706b92766b1f12c87284087b05a20556", 0x63, 0x3}, &(0x7f0000001380)={0x0, 0x0, 0x0, 0x3, 0x2e23, 0xffffffffffffffff, &(0x7f0000000380)="6ad56797ea88afff0f685b2fd00795a28d3f389e1e4a593ebdac91e55990c87c4344a48cb2b8797fdcee78fb3e5fd4410f3aa1466f09ea9f0a7e43286c8000a40ee6e29d21e79b5c51deaf9cc64ca963f9340fa5d302e8168f437b910310030260169a55c21dd6707e5eeae3f3a7e93f9ed66f13b51bf35709f9eed4a8ef86388a50297275af9d876ce38f46fdcce2eb25163f27c861efea67e6080e9008bcb5c29dbc38687807e3eb786f6cce4ffdfe51b8a408ab06e82ea2d922bc77fa1945261b1ad3f1fd2939fba52216ef0575bb32e1fd7279e00a22f4294636bcaf24ddebd9aadb34e05119fbd48babda4310fa431a55d66088f36fa819183aaf96c7f2a7a2c8aeb2e732c182dc1e6ea09307a28ce72d925623344a1f3a3a52d708753ddbc91afd1751ab5cd36f0488f25d2ddf7d2270fd505bdc1ed13370b2f4d2b7dc3dcf5943b462f0229c9c142e51b6936c747871b7daea80d15bfae50f61d73f2e76c53862f5f1d92c6374e3056284c0652ae21ca513c248d6b95314194dd1cd866b24094f4acb532b89976302fef03765696f0808ba660d3c1d44360509c0ed7d97aa025b7315dafa13df791fd63456172e36921d0a7df3194b9c81d4c1ccbd2a6bab89931c42f15f9f558d85be12cb7b89def818b2b32b349dabd22f09d31896f3a3500bb403b502408847864c8a42749361b038528c7beed677e2809c96696569b1fab543930fa32a5a69e1dea81725136e8b73904717184ab8d6ba86ca28710a690bc77a8ca34261c6c8a7c3429beba9fbdce26f9b5a276175745a28022d6f01327c7d830b81696c845f7c58d85081756843b5580516c0169ffd5f0361ddfd41dc105b4089e99039b62ab516f779cd6dae6456ac4e2f97d8f5593d962a0004a9ce6ecf5d8d4224c5314e52792212dcc00c6b7958346a5daaccc0cf83fe95454c4b0d2af055c35f1acde0fc52b324e7b2a650d55e5b2b6a3e8f707c2fda37b62dc88b543be1ed72783580747cab0c5c00dbbf3eaf0f99fb598e2a3675454b55ccb3506dc74f3b97172cf1d0fbebbe3dac33cb186ca3ee1de94897d88e09400511509a19b05a70676745e4b0cf9a95bb1e0dbaa6bc2bc2b27d4c17e0dcf8ed3e412d417c70b98013bd6ccfc5bffc855a5308db84a784af976ca8fc8456e71f87c453d710c3c1b555fbec214f9e38fd71895708dc05767a2a8385be0f121fcaf8233e17f59d8bc7999d350e9ef20b0369e46e6f667f74d408ca740901be8c34559788ac7ba858ab0206dc7d4c9bc4097d261acbbf2a3aab135835e3432530ff4fab1a4f1fdb485606fabefa1286166a09bebd03e71471271f5900dc41d492e19aadea0945c737878fde2295d300f03f61984a6e9f1783b7a6c58c4fcd4549327780092a0909033a2292bc912826acabb4c5d4bc0bd4d48b58db4e32fb90e96955e8af8e3e2d479d01fc62676e0ce5206e3ba46ea496a473bb03e91aa57d8dc40066a7a1d7e8ad8a61080bd2d6f3a773771c3945f3309bee1dbe909bd898d79279fea3148f885d87ef20b32f490e995bb3e8758b299d3eb08bcdde6dbee5079d6722840c4b70151aa485ec669db72a45dd66aeb1a73db5a3125273ef95681b7c0ed2ef35e9f222b736cf921bcc435977dd50736b1c17027f0c787a37a54fc8330bb0a3984ecaaca41897b7b13b1b75b175b8efd0a825f1096da6f81dfe736313ace6ce184471fe0160d583b6f3384d5f4f491141b594f6ce5f84385f2bfd01f4e92f071acc2d5aa87cd814dec8f05825f283eb82833d7461e5ef538c1426bbf2f700d2ffac619834a626bc4b84aeb4d01bfc3985ec9a59b1dc916dde9748439b4e37c7f9a9858416ebf1835d965189e9c4db25e551e682a8e4f03241481c3ffc402a6da70d436b33064ab06097c457153faccabc8133777a7037b78cbe524e9e6d04838e3c830da618d1b18e3c587ac3bc75dd2bc87732c897f19ccd4295a568860ba82b2160bdc8617e2139ae91ee75cf16ae74dd6ea2ba23dfcb1672b463e13c3127842eddcc587bf899c9d5de4c39bd62b8809ec544d6279d56c6c45be56dd5b3cfe46d33ec8ba6a3b596100a77ccf81a553598b94507cbd5df84747f6da3f7d8f58dea0e3ff9d43c0284faef077f1b04fbc74407d86d00b2bb5703f9efa8d10dd30a5ecb947b5ca3ea65122a91c5b0b404b9131d88b78da703fd1f17904f7d06057f4c2421e890fe2640df8788a53399a566112c3c2bdc784051a3e083016ace062fef5421a53ba0815b68f4c7f3c215e6797be2cfc40f547cacf1802dadfeee3a09eac8d17976d39f2598a373bdd912722724e1f7c8a901eb570cca1c7b296417b413750294d1a3c373c0ea091c85c0519c5cbd4fdb87f11af9d286246774732a3dfd3af591dad70e14250b1016cab1bc50216d8e5825596557afdd7cb45c416f04f0b4e0e95b1404f37eefa0c3d48365772123d6fedd1a924bff2b86859fe8503e28ba707bd65df0acc8cef74bf36b4312a4ec8e4c714f74a8d3c223122fbe9c4a91f1abf105b864f77279ab6460c0dd7b304fd5022254c1e8d9763e3dab7fcd482b121ee98c115df6366d77df988f48bb1343f2816cc95d523ee07c72d53bb372936bd4b903f0560941fb0676855551896c63b507948e2d958124e6bef4941493db141675eacb9f015ba65149a9377427a3447aad0ae4b1366edc3fc2f4a00b1baca9f8e2b92d5e82a896b3e1564f49689b961ee68403e40b8f00e74947f3675edfc8f055253852b1be2a9c63133e30ac7074b466c99263cd6774a97e1b4d3ff9d42e13a629d6e8a2af2aa0382a396c377b227c78daf8e24789235827cf7caf86d8dfeb387dfe5441ddeea1569c4d5d2dacca75945ba27463612baf337c1bef72ef704509440b18498620fce074e83e3b0fd6c8d38f5c7e285258e6801830a54bae1ddb7ca5d7ebd2f25043365800b466017119eabe6c95d176a3106eb78e1c32c9533dc6bd6e4e584145609776d002f87a6cd8d46bbf475a0331a4d7845860af5501de12aa7ef340c012e99773f84e28b164cba31deec8bf18ebf5cf4fafb6c04bc42c0bab302491bef681725b9a071d48e9d4d45bfa7e02632c971eb05d7e39bcbd3b5987055e4c0057f3a95e2e6de341ae8cffaaa2e44332ebd79a524e471a7442ed2b3968b8fc71da3183908e7464dacbf7bda8152ef56ccca5ca9c41ed80ad7db74e1b9e6ca331923fdde720180b4427bb732998f827c7015515cac78b5a68a25b4f6b69b79a6f71427ae4396c11e07ec86a63aa62c82702d55821e3ed2eefefbf24e89350fc18f31bba037da7c76e851bb9963823ebfe79d6e21fa93fdc2171edf048af185e9f6dee04dafba0c01f589fae153216221a64579056131a94ea265dde8ccfb6bad3ae96049861d390ff2a0400666c67ccb6fe5095164141793ad04d58b57ae4ff2c90cb8d5e986aca043d4599d4098262713a6957ae0f0d9a881ca3d8c5b104bffe69a21c7301e6eb9c72c4cfe8b49be071e715e83d73c248f7572477ca4aa33fe9833481d1c776ea5eefeff70feb9f26d8b09d26249caa210dd3aeb1ea0798d68b20aefc1ae6a98916cc633b52ffaafca318dc87d14f7ff7d3347de1ab7b4ab65164656954fa73fcce1c0825e1cf371e0e19f05ec724324040f425f2414c4d12f3c73aff918e1b69516c689a1dcadad920701aea36b2047fa65abd99b7eb7900d99fd073307cd7eba696054892bc1379894fa06a1fc96e90316462e4b92e7c9d421745cc79944e2a6ab2f9ec3a0bf80912ba2eae353dad82addaa6a9d8523f591df935a895caa742ea53ba0cc44a4b5ba23cff831c7bca341d410403072261c4a8d2d1df28b108870761f10f970d0c07f1a2412674d4b13bed7b846f4edcf45bf35a7e89e18c9b73acc2fb41659309bc2bdf5384318887c1af8bfa9b28347c5d1d5a23f8c02bb9f20ae2a709ac6909fb02233e5e5a981f66465225ea41b14caa5397c13bb53e32c0a65f3327838fbf7ca229feb7b79c15e83ebb48428d99cba9f9409c80ec3c880d0b37b1cd076f41bade9992d7407f0fc9e709ba8338896d0c6c604e020b4fbe48a762cde731b01241012fb59a3abbd63f8d02e571b2495682ebccc985a38bdb4e0efacec58f1cf7a39f186f67b066c33e1a2ad7e2808b0810fc2e75322cdd041b07c9933de1fb3e3dd3f4dc5452d5a7c9b4d84302bcdca9ebc89140d97ebc3bea8cbdf01a351e447c29ff6227f34245f2ad643f7ede4ec7e0b687a7d9884865b066f17cebdbb5a9ab5944ef95cb2205d543fa1ab0bb4a92354df66db11d9b528cfff424cfa4ab97ee9886b2d208cdc6420eaeba6cbbb0290765a540b2604083bcd90a210e9fdc91bd92697fffae77872918cbd7fe7127cfa900d7abd07e2d8673d72db3582e2dc0a4599666c11d965d96e0bae99cd4a046cdda8c96acbdea0826954a440c83e286102548e71f518a47917d244378637b6763a567980a94adb8a45c9627c740e967659bdb2a91a9d6cc1b4234ec1012dc2eea6ada1700f5cbcf15aa82c5f4ac5b6428811719ace5315cab75c5634b285bfb17dca3670dd029c04e5fba20d6bfcf55323b69fb60a3ed4c6d4eeea1a949b1bb87936ecbdbbc426db0a5a7517a8ad757da9ae536dc1635ca138b0d9b553e1b0fc6a58fec85607365f029fd07defb07a535724c79892ce8d070cd04f82cf206703fc06a66da831055cda300bd5279c7b81aa9a6ccb487117c70385d7970ea9338851810f2618b49eb34ec130c3d927ae3fa88535cdc5806ef36ffd2c8dc8dab8bdeff7d8f26edd788687888c39505de9b48f019ebf044dd504f78bb3586bed08dd9a7e6839d5e844bedf1b04bc70722f80a8ca31e50a6a995f660a4d9b5610b9361a5385c16cd32e3d853f401f47f53960c83fdb158800494b61e6506fd7e1a67d189cf1a24fba37a040d43ad94fc3b9cfd47923da1c8a6684e50452bd21f165140fe05ef9fec7e3b5b671db430c641555b9f02d57b41808087db7c89d10693e854080f1762b91b51d2dd1f4b7d507c58e2ba81e33e5a073c1ac96d00c3baa4f36ec6b225f84568d25d2dbd1f2e4b3682993f2391591dc8020232e37e9ca041a76fa1517f54fdecc2e362b4495525933f92c908a6be83911e2e2e06c4c88725b030f0f5057977ab93ef2b23a16d88259a2364b14f97f4b419971633f57e462ee600ee30cc4c31c89a295a9ac9d5624f8e1f4227e63115e5ad63b9c8afbdeed7cbf8e138749d7d2d1d6d2414fd07e222b0ecf80bf979ad2ac9c4923c91d694c52171991aa96f43892b2901637289e0042b8c1a70ef6caf4235f72851bb1010649e4264df9cd24f804bc5e4780c6cbc877bec1b29969976b89a7d8f542dc60df42bbf35b703cb4711962b0aa071362d6bbb696b21bbfd9416c6c797406b73d84c943485218eb3681b559bd4e943c09310d72ed8c212c9e592d5214bcf6768e006be16080bfe4e9c8a79a7a9845e0873f81b4254d72d958ac7004ef0fd0987703459e421b68d0631e982472c36e5bfd02d5a227d697e3261481b60f323509373f9655a8dcb8bd2a74981bc97d3866f46ff498fa6bbe5535ead39d287d40ab3699ad5a6303588717b00199a77c6054238d2d1534c3e14cca46d631c3fecf18ab26e00af6a8732e7513593424c56d296b4300e118b850aed4d93d8a3e537e930596dddd3739d0d4ef0fb3026a87419c332086e2be6832f427be577ac69bd2e6e774fe82124783f63cb5991ed729148ad1aa301afbde71084d0", 0x1000, 0xb6700000, 0x0, 0x1, r5}, &(0x7f0000001400)={0x0, 0x0, 0x0, 0x5, 0x49, r2, &(0x7f00000013c0)="00002da935615e19dd8640cf1c1254243356649b5c4c24516c3ae7b0db99dd6e3b7a5a04c917146604f5e80d6d034bb42cfaa064c39b21d5a362c49a34a5", 0x3e, 0xb, 0x0, 0x0, r6}, &(0x7f0000001ac0)={0x0, 0x0, 0x0, 0x7, 0x4, r7, &(0x7f00000019c0)="65a5f31fddde9762cdbe0d01cfa3214f8eb7df6b80b293f8795f4ba5c3896269259f7311713339e8b9551e704da707a6c0f4d1f1093cd1360ad6c4105039ab4bd3fb108fa88ad5cedf3d4ca5d1c6c51ae8f909e1f685b4fe01f51ab834f5c442750ae10299a35c8f787bfc911427d6f1737527210e14f760044582496b2bf685bb702915d13aa37d3272c721402c794f3eff5fa67b2d10cd6721bc06557a7504dad335d9228cdb047bfbcc5f458b15aa454429a3ad43ff49844dd5454fdf54afbbb16d358532148c64997b7ca048578ade8774c21ea0f2b4a89af3eec5d867e31a4b1debea159fc52c5a345e1cf4e064", 0xf0, 0x616, 0x0, 0x1, r8}, &(0x7f0000001b40)={0x0, 0x0, 0x0, 0x2, 0x4, r1, &(0x7f0000001b00)="abf0783b89d4cd9f30d1ec92452503d38d00c2d6", 0x14, 0x9, 0x0, 0x3}]) 0s ago: executing program 2 (id=10274): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nfc(&(0x7f0000000880), r1) r2 = syz_genetlink_get_family_id$devlink(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_TRAP_POLICER_GET(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYBLOB="c7bc16d78d19938f772307c94047e982452af6f64301fed5b17dc1ffef6af8078dbd3f91ee96ea121a1b0d3f973d2a0b6eb98a0241e68135d894accc099d4e7ae3e5ff6d4574cbaed100cfe07d83da21b0cb6a29168526d69073a711dab3f6ed8528941a81bf292eca97eafbf433dd66836594cf51a33f2a37ee4b06dda890fd33c158cc4e16b1571223bd0dd9b19d619bceb6ce67e00000", @ANYRES16=r2, @ANYBLOB="01002bbd7000fddbdf25450000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008008e001f000000"], 0x3c}, 0x1, 0x0, 0x0, 0x4844}, 0x24048010) socket$inet6_udp(0xa, 0x2, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0f00000004000000080000000c"], 0x50) socket$inet6_sctp(0xa, 0x5, 0x84) socket$can_raw(0x1d, 0x3, 0x1) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000000c0)=ANY=[@ANYBLOB="340000001000f320c9f9", @ANYRES32=0x0, @ANYBLOB="81b8000000000000140012800b000100697036677265000004"], 0x34}, 0x1, 0x0, 0x0, 0x24048007}, 0x4040844) socket$nl_route(0x10, 0x3, 0x0) socket$unix(0x1, 0x2, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)) socket(0x400000000010, 0x3, 0xf) socket$unix(0x1, 0x1, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3800000041000701fefffffffeffffff017c0000040042800c000180060006006558000014000280100014800c00", @ANYRES8=r3], 0x38}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) r4 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000300)={0xffffffffffffffff}, 0x2}}, 0x20) pselect6(0x40, &(0x7f0000000000)={0x9}, 0x0, 0x0, 0x0, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r4, &(0x7f00000001c0)={0x18, 0x110, 0xfa00, {r5, 0x7fffffff, 0x12, 0x0, 0x0, @ib={0x1b, 0x8, 0x6, {"78c36cbe7e38dade0099fe4e9d908e9b"}, 0xffff, 0x1ff, 0xfffffffeffffffff}, @in6={0xa, 0x4e22, 0x2, @local, 0x2}}}, 0x118) syz_genetlink_get_family_id$tipc2(&(0x7f0000000d80), 0xffffffffffffffff) kernel console output (not intermixed with test programs): f_fill_super: No partition found (1) [ 2228.205570][T11748] cxusb: i2c wr: len=80 is too big! [ 2228.205570][T11748] [ 2228.213935][T11748] netlink: 'syz.4.9846': attribute type 3 has an invalid length. [ 2228.216477][T11748] netlink: 224 bytes leftover after parsing attributes in process `syz.4.9846'. [ 2228.224619][ T9] cxusb: set interface failed [ 2228.226618][ T9] dvb-usb: bulk message failed: -22 (1/0) [ 2228.245387][ T9] DVB: Unable to find symbol mt352_attach() [ 2228.247878][ T9] dvb-usb: bulk message failed: -22 (5/0) [ 2228.250248][ T9] zl10353_read_register: readreg error (reg=127, ret==-121) [ 2228.254101][ T9] dvb-usb: no frontend was attached by 'DigitalNow DVB-T Dual USB' [ 2228.295037][T11770] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 2228.297895][T11770] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 2228.300665][T11770] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 2228.312107][ T9] rc_core: IR keymap rc-dvico-mce not found [ 2228.314908][ T9] Registered IR keymap rc-empty [ 2228.318661][ T9] rc rc0: DigitalNow DVB-T Dual USB as /devices/platform/dummy_hcd.4/usb9/9-1/rc/rc0 [ 2228.325031][ T9] input: DigitalNow DVB-T Dual USB as /devices/platform/dummy_hcd.4/usb9/9-1/rc/rc0/input313 [ 2228.332365][ T9] dvb-usb: schedule remote query interval to 100 msecs. [ 2228.334871][ T9] dvb-usb: DigitalNow DVB-T Dual USB successfully initialized and connected. [ 2228.341074][ T9] usb 9-1: USB disconnect, device number 9 [ 2228.363616][T11777] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9855'. [ 2228.398960][ T9] dvb-usb: DigitalNow DVB-T Dual USB successfully deinitialized and disconnected. [ 2228.639765][ T42] audit: type=1804 audit(1783897988.996:498): pid=11781 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.9857" name="/newroot/337/file0/file0" dev="9p" ino=71827907 res=1 errno=0 [ 2228.647399][T11781] overlay: ./file0 is not a directory [ 2228.716058][ T55] em28xx 11-1:0.0: unknown em28xx chip ID (0) [ 2228.913631][T11789] random: crng reseeded on system resumption [ 2228.982157][T25207] usb 10-1: new high-speed USB device number 17 using dummy_hcd [ 2229.285618][T11755] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future [ 2229.772084][T25207] usb 10-1: device descriptor read/64, error -71 [ 2229.798932][ T42] audit: type=1804 audit(1783897990.156:499): pid=11795 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.4.9861" name="/newroot/460/file0/file0" dev="9p" ino=71827907 res=1 errno=0 [ 2229.803323][T11795] overlay: ./file0 is not a directory [ 2230.012172][T25207] usb 10-1: new high-speed USB device number 18 using dummy_hcd [ 2230.048441][T11797] netlink: 12 bytes leftover after parsing attributes in process `syz.4.9862'. [ 2230.152125][T25207] usb 10-1: device descriptor read/64, error -71 [ 2230.262487][T25207] usb usb10-port1: attempt power cycle [ 2230.362047][ T5624] Bluetooth: hci3: command 0x0406 tx timeout [ 2230.362101][ T5624] Bluetooth: hci1: command 0x0c1a tx timeout [ 2230.366193][ T55] em28xx 11-1:0.0: failed to get i2c transfer status from bridge register (error=-5) [ 2230.366214][ T55] em28xx 11-1:0.0: board has no eeprom [ 2230.394069][T11801] netlink: 32 bytes leftover after parsing attributes in process `syz.4.9863'. [ 2230.422038][ T55] em28xx 11-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 2230.422060][ T55] em28xx 11-1:0.0: dvb set to bulk mode. [ 2230.432787][T17559] em28xx 11-1:0.0: Binding DVB extension [ 2230.501532][T17559] em28xx 11-1:0.0: Registering input extension [ 2230.622223][T25207] usb 10-1: new high-speed USB device number 19 using dummy_hcd [ 2230.642703][T25207] usb 10-1: device descriptor read/8, error -71 [ 2230.667001][T11806] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9864'. [ 2230.738108][T17559] usb 11-1: USB disconnect, device number 18 [ 2230.743145][T17559] em28xx 11-1:0.0: Disconnecting em28xx [ 2230.750959][T17559] em28xx 11-1:0.0: Closing input extension [ 2230.785504][T17559] em28xx 11-1:0.0: Freeing device [ 2230.847409][T11810] random: crng reseeded on system resumption [ 2230.902881][T25207] usb 10-1: new high-speed USB device number 20 using dummy_hcd [ 2230.923027][T25207] usb 10-1: device descriptor read/8, error -71 [ 2231.042605][T25207] usb usb10-port1: unable to enumerate USB device [ 2231.114168][ T42] audit: type=1804 audit(1783897991.476:500): pid=11816 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.6.9868" name="/newroot/515/file0/file0" dev="9p" ino=71827907 res=1 errno=0 [ 2231.117314][T11816] overlay: ./file0 is not a directory [ 2231.466001][T11822] syzkaller0: entered promiscuous mode [ 2231.467972][T11822] syzkaller0: entered allmulticast mode [ 2231.469728][T11824] netlink: 12 bytes leftover after parsing attributes in process `syz.4.9871'. [ 2231.726961][T11831] netlink: 8 bytes leftover after parsing attributes in process `syz.4.9874'. [ 2232.063105][T11843] FAULT_INJECTION: forcing a failure. [ 2232.063105][T11843] name failslab, interval 1, probability 0, space 0, times 0 [ 2232.068278][T11843] CPU: 3 UID: 0 PID: 11843 Comm: syz.2.9877 Tainted: G L syzkaller #0 PREEMPT(full) [ 2232.068297][T11843] Tainted: [L]=SOFTLOCKUP [ 2232.068301][T11843] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 2232.068309][T11843] Call Trace: [ 2232.068313][T11843] [ 2232.068319][T11843] dump_stack_lvl+0x100/0x190 [ 2232.068342][T11843] should_fail_ex.cold+0x5/0xa [ 2232.068355][T11843] should_failslab+0xc2/0x120 [ 2232.068372][T11843] kmem_cache_alloc_node_noprof+0x94/0x6b0 [ 2232.068386][T11843] ? __alloc_skb+0x5b7/0x710 [ 2232.068399][T11843] ? __alloc_skb+0x140/0x710 [ 2232.068413][T11843] __alloc_skb+0x140/0x710 [ 2232.068423][T11843] ? __alloc_skb+0x5b7/0x710 [ 2232.068435][T11843] ? __pfx___alloc_skb+0x10/0x10 [ 2232.068450][T11843] alloc_skb_with_frags+0xdd/0x760 [ 2232.068465][T11843] ? __might_fault+0xc5/0x140 [ 2232.068476][T11843] ? __might_fault+0xc5/0x140 [ 2232.068489][T11843] sock_alloc_send_pskb+0x801/0x980 [ 2232.068501][T11843] ? _copy_from_iter+0x270/0x1690 [ 2232.068521][T11843] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 2232.068534][T11843] ? _parse_integer_limit+0x1ac/0x220 [ 2232.068546][T11843] ? iov_iter_advance+0xac/0x6d0 [ 2232.068563][T11843] tun_get_user+0x904/0x3c20 [ 2232.068582][T11843] ? __pfx_tun_get_user+0x10/0x10 [ 2232.068594][T11843] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 2232.068618][T11843] ? find_held_lock+0x2b/0x80 [ 2232.068631][T11843] ? tun_get+0x191/0x370 [ 2232.068648][T11843] ? tun_get+0x191/0x370 [ 2232.068668][T11843] tun_chr_write_iter+0xdc/0x200 [ 2232.068681][T11843] vfs_write+0x6ac/0x1050 [ 2232.068699][T11843] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 2232.068712][T11843] ? __pfx_vfs_write+0x10/0x10 [ 2232.068727][T11843] ? find_held_lock+0x2b/0x80 [ 2232.068748][T11843] ksys_write+0x12a/0x250 [ 2232.068765][T11843] ? __pfx_ksys_write+0x10/0x10 [ 2232.068781][T11843] ? ksys_write+0x1ac/0x250 [ 2232.068797][T11843] ? __pfx_ksys_write+0x10/0x10 [ 2232.068816][T11843] __do_fast_syscall_32+0xe7/0x970 [ 2232.068830][T11843] ? lockdep_hardirqs_on+0x78/0x100 [ 2232.068849][T11843] do_fast_syscall_32+0x32/0x70 [ 2232.068861][T11843] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 2232.068876][T11843] RIP: 0023:0xf6feefec [ 2232.068889][T11843] Code: Unable to access opcode bytes at 0xf6feefc2. [ 2232.068894][T11843] RSP: 002b:00000000f53dd50c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 2232.068906][T11843] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000080000000 [ 2232.068913][T11843] RDX: 000000000000fdef RSI: 0000000000000000 RDI: 0000000000000000 [ 2232.068919][T11843] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 2232.068926][T11843] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2232.068933][T11843] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 2232.068946][T11843] [ 2232.318448][T11848] FAULT_INJECTION: forcing a failure. [ 2232.318448][T11848] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2232.329883][T11848] CPU: 1 UID: 0 PID: 11848 Comm: syz.2.9878 Tainted: G L syzkaller #0 PREEMPT(full) [ 2232.329913][T11848] Tainted: [L]=SOFTLOCKUP [ 2232.329918][T11848] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 2232.329929][T11848] Call Trace: [ 2232.329936][T11848] [ 2232.329944][T11848] dump_stack_lvl+0x100/0x190 [ 2232.329971][T11848] should_fail_ex.cold+0x5/0xa [ 2232.329994][T11848] _copy_from_user+0x2e/0xd0 [ 2232.330020][T11848] do_devconfig_ioctl+0x11e/0x6d0 [ 2232.330044][T11848] ? comedi_unlocked_ioctl+0x180/0x3310 [ 2232.330069][T11848] ? __pfx_do_devconfig_ioctl+0x10/0x10 [ 2232.330100][T11848] ? tomoyo_path_number_perm+0x46d/0x580 [ 2232.330123][T11848] ? kasan_save_stack+0x3f/0x50 [ 2232.330150][T11848] ? kasan_save_stack+0x30/0x50 [ 2232.330170][T11848] ? kasan_save_track+0x14/0x30 [ 2232.330188][T11848] ? kasan_save_free_info+0x3b/0x70 [ 2232.330219][T11848] comedi_unlocked_ioctl+0x860/0x3310 [ 2232.330248][T11848] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 2232.330293][T11848] ? kasan_quarantine_put+0x104/0x240 [ 2232.330312][T11848] ? lockdep_hardirqs_on+0x78/0x100 [ 2232.330341][T11848] ? find_held_lock+0x2b/0x80 [ 2232.330362][T11848] ? tomoyo_path_number_perm+0x28f/0x580 [ 2232.330381][T11848] ? tomoyo_path_number_perm+0x28f/0x580 [ 2232.330406][T11848] ? tomoyo_path_number_perm+0x188/0x580 [ 2232.330434][T11848] comedi_compat_ioctl+0x438/0xe20 [ 2232.330460][T11848] ? __pfx_comedi_compat_ioctl+0x10/0x10 [ 2232.330486][T11848] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 2232.330515][T11848] ? do_vfs_ioctl+0x226/0x13e0 [ 2232.330540][T11848] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 2232.330570][T11848] ? find_held_lock+0x2b/0x80 [ 2232.330589][T11848] ? __fget_files+0x215/0x3d0 [ 2232.330613][T11848] ? hook_file_ioctl_common+0x140/0x440 [ 2232.330640][T11848] ? __fget_files+0x21f/0x3d0 [ 2232.330672][T11848] ? __pfx_comedi_compat_ioctl+0x10/0x10 [ 2232.330697][T11848] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 2232.330724][T11848] __do_fast_syscall_32+0xe7/0x970 [ 2232.330742][T11848] ? lockdep_hardirqs_on+0x78/0x100 [ 2232.330771][T11848] do_fast_syscall_32+0x32/0x70 [ 2232.330790][T11848] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 2232.330814][T11848] RIP: 0023:0xf6feefec [ 2232.330836][T11848] Code: Unable to access opcode bytes at 0xf6feefc2. [ 2232.330845][T11848] RSP: 002b:00000000f53dd50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 2232.330864][T11848] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000040946400 [ 2232.330876][T11848] RDX: 0000000080000340 RSI: 0000000000000000 RDI: 0000000000000000 [ 2232.330887][T11848] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 2232.330898][T11848] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 2232.330909][T11848] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 2232.330933][T11848] [ 2232.443752][T11803] Bluetooth: hci1: command 0x0c1a tx timeout [ 2232.997536][T11858] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9880'. [ 2233.000707][T11858] netlink: 12 bytes leftover after parsing attributes in process `syz.2.9880'. [ 2235.406899][T11876] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9884'. [ 2235.530924][T11884] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 2235.702220][ T55] usb 11-1: new high-speed USB device number 19 using dummy_hcd [ 2235.862451][ T55] usb 11-1: Using ep0 maxpacket: 8 [ 2235.874535][ T55] usb 11-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 2235.879347][ T55] usb 11-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 2235.883979][ T55] usb 11-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2235.940023][ T55] usb 11-1: config 0 descriptor?? [ 2236.177773][ T55] iowarrior 11-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 2236.339332][T11894] netlink: 8 bytes leftover after parsing attributes in process `syz.5.9889'. [ 2236.346343][T11894] netlink: 44 bytes leftover after parsing attributes in process `syz.5.9889'. [ 2236.399005][ T60] hid-generic 0000:0000:0000.003B: unknown main item tag 0x3 [ 2236.404082][ T60] hid-generic 0000:0000:0000.003B: unknown main item tag 0x3 [ 2236.406565][ T60] hid-generic 0000:0000:0000.003B: unknown main item tag 0x0 [ 2236.409070][ T60] hid-generic 0000:0000:0000.003B: unknown main item tag 0x0 [ 2236.411557][ T60] hid-generic 0000:0000:0000.003B: unknown main item tag 0x0 [ 2236.426339][T11874] bond0: (slave dummy0): Releasing backup interface [ 2236.430936][ T60] hid-generic 0000:0000:0000.003B: unknown main item tag 0x0 [ 2236.435041][T11874] dummy0: left promiscuous mode [ 2236.435128][ T60] hid-generic 0000:0000:0000.003B: unknown main item tag 0x0 [ 2236.439558][ T60] hid-generic 0000:0000:0000.003B: unknown main item tag 0x0 [ 2236.441894][ T60] hid-generic 0000:0000:0000.003B: unknown main item tag 0x0 [ 2236.444051][T11874] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 2236.456389][ T60] hid-generic 0000:0000:0000.003B: unknown main item tag 0x0 [ 2236.492625][ T60] hid-generic 0000:0000:0000.003B: hidraw1: HID v0.03 Device [syz1] on syz1 [ 2236.595016][T11902] random: crng reseeded on system resumption [ 2236.663876][T11897] fido_id[11897]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 2236.704069][ T60] usb 11-1: USB disconnect, device number 19 [ 2237.051541][T11907] lo speed is unknown, defaulting to 1000 [ 2237.700135][T11912] syz.6.9893: page allocation failure: order:0, mode:0x340cca(GFP_HIGHUSER_MOVABLE|__GFP_COMP|__GFP_THISNODE), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 2237.708392][T11912] CPU: 3 UID: 0 PID: 11912 Comm: syz.6.9893 Tainted: G L syzkaller #0 PREEMPT(full) [ 2237.708425][T11912] Tainted: [L]=SOFTLOCKUP [ 2237.708430][T11912] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 2237.708437][T11912] Call Trace: [ 2237.708442][T11912] [ 2237.708447][T11912] dump_stack_lvl+0x100/0x190 [ 2237.708466][T11912] warn_alloc.cold+0x94/0xa8 [ 2237.708484][T11912] ? __pfx_warn_alloc+0x10/0x10 [ 2237.708500][T11912] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 2237.708520][T11912] ? __pfx_get_page_from_freelist+0x10/0x10 [ 2237.708536][T11912] __alloc_frozen_pages_noprof+0x159f/0x2dc0 [ 2237.708551][T11912] ? __lock_acquire+0x49f/0x1a40 [ 2237.708573][T11912] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 2237.708589][T11912] ? find_held_lock+0x2b/0x80 [ 2237.708602][T11912] ? __free_frozen_pages+0x747/0x1090 [ 2237.708619][T11912] ? __free_frozen_pages+0x747/0x1090 [ 2237.708636][T11912] ? do_raw_spin_unlock+0x145/0x1e0 [ 2237.708648][T11912] ? _raw_spin_unlock+0x28/0x50 [ 2237.708666][T11912] ? __folio_put+0x2ee/0x5f0 [ 2237.708690][T11912] __folio_alloc_noprof+0x13/0x260 [ 2237.708701][T11912] alloc_migration_target+0x1d7/0x6d0 [ 2237.708720][T11912] migrate_pages_batch+0x5dc/0x45c0 [ 2237.708737][T11912] ? __pfx_alloc_migration_target+0x10/0x10 [ 2237.708756][T11912] ? migrate_pages_sync+0x12c/0x880 [ 2237.708772][T11912] ? migrate_pages_sync+0x588/0x880 [ 2237.708787][T11912] ? __pfx_migrate_pages_batch+0x10/0x10 [ 2237.708819][T11912] ? __pfx_migrate_pages_sync+0x10/0x10 [ 2237.708841][T11912] ? __lock_acquire+0x49f/0x1a40 [ 2237.708857][T11912] ? __css_rstat_updated+0x1ce/0x5a0 [ 2237.708875][T11912] migrate_pages+0x1950/0x2850 [ 2237.708892][T11912] ? __lock_acquire+0x49f/0x1a40 [ 2237.708909][T11912] ? __pfx_alloc_migration_target+0x10/0x10 [ 2237.708928][T11912] ? __pfx_migrate_pages+0x10/0x10 [ 2237.708947][T11912] ? __lock_acquire+0x49f/0x1a40 [ 2237.708966][T11912] ? mtree_load+0x32d/0xa90 [ 2237.708980][T11912] move_pages_and_store_status+0xf1/0x230 [ 2237.708999][T11912] ? __pfx_move_pages_and_store_status+0x10/0x10 [ 2237.709021][T11912] kernel_move_pages+0xc89/0x14a0 [ 2237.709042][T11912] ? __pfx_kernel_move_pages+0x10/0x10 [ 2237.709059][T11912] ? fput+0x79/0x100 [ 2237.709074][T11912] ? xfd_validate_state+0x129/0x190 [ 2237.709094][T11912] ? __pfx___ia32_sys_futex_time32+0x10/0x10 [ 2237.709112][T11912] __ia32_sys_move_pages+0xdd/0x1b0 [ 2237.709129][T11912] ? __do_fast_syscall_32+0x98/0x970 [ 2237.709141][T11912] ? lockdep_hardirqs_on+0x78/0x100 [ 2237.709158][T11912] __do_fast_syscall_32+0xe7/0x970 [ 2237.709172][T11912] do_fast_syscall_32+0x32/0x70 [ 2237.709184][T11912] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 2237.709199][T11912] RIP: 0023:0xf6fdefec [ 2237.709214][T11912] Code: Unable to access opcode bytes at 0xf6fdefc2. [ 2237.709219][T11912] RSP: 002b:00000000f538b50c EFLAGS: 00000292 ORIG_RAX: 000000000000013d [ 2237.709231][T11912] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000002064 [ 2237.709239][T11912] RDX: 0000000080000040 RSI: 0000000080001180 RDI: 0000000080000000 [ 2237.709246][T11912] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 2237.709252][T11912] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 2237.709259][T11912] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 2237.709273][T11912] [ 2237.711194][T11912] Mem-Info: [ 2237.814479][T11912] active_anon:781 inactive_anon:1842 isolated_anon:12 [ 2237.814479][T11912] active_file:1610 inactive_file:5802 isolated_file:0 [ 2237.814479][T11912] unevictable:3818 dirty:193 writeback:0 [ 2237.814479][T11912] slab_reclaimable:15372 slab_unreclaimable:85419 [ 2237.814479][T11912] mapped:26567 shmem:1780 pagetables:1576 [ 2237.814479][T11912] sec_pagetables:391 bounce:0 [ 2237.814479][T11912] kernel_misc_reclaimable:0 [ 2237.814479][T11912] free:29254 free_pcp:1066 free_cma:0 [ 2237.833622][T11912] Node 0 active_anon:0kB inactive_anon:96kB active_file:412kB inactive_file:1956kB unevictable:3536kB isolated(anon):0kB isolated(file):0kB mapped:476kB dirty:0kB writeback:0kB shmem:3536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:7424kB pagetables:1788kB sec_pagetables:1236kB all_unreclaimable? yes Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 2237.844485][T11912] Node 1 active_anon:3124kB inactive_anon:7272kB active_file:6028kB inactive_file:21252kB unevictable:10836kB isolated(anon):848kB isolated(file):0kB mapped:105792kB dirty:772kB writeback:0kB shmem:3584kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:8400kB pagetables:4516kB sec_pagetables:328kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 2237.856096][T11912] Node 0 DMA free:3660kB boost:2048kB min:2808kB low:2996kB high:3184kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2237.866061][T11912] lowmem_reserve[]: 0 280 280 280 280 [ 2237.867779][T11912] Node 0 DMA32 free:28668kB boost:28740kB min:41516kB low:44708kB high:47900kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:96kB active_file:412kB inactive_file:1956kB unevictable:3536kB writepending:0kB zspages:2852kB present:1032196kB managed:287116kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2237.877560][T11912] lowmem_reserve[]: 0 0 0 0 0 [ 2237.879735][T11912] Node 1 DMA32 free:83000kB boost:0kB min:47140kB low:58924kB high:70708kB reserved_highatomic:0KB free_highatomic:0KB active_anon:3124kB inactive_anon:7272kB active_file:6028kB inactive_file:21252kB unevictable:11036kB writepending:772kB zspages:8600kB present:1048432kB managed:948212kB mlocked:8200kB bounce:0kB free_pcp:4504kB local_pcp:344kB free_cma:0kB [ 2237.890889][T11912] lowmem_reserve[]: 0 0 0 0 0 [ 2237.892504][T11912] Node 0 DMA: 191*4kB (U) 40*8kB (U) 9*16kB (U) 18*32kB (U) 11*64kB (U) 3*128kB (U) 1*256kB (U) 1*512kB (U) 0*1024kB 0*2048kB 0*4096kB = 3660kB [ 2237.897299][T11912] Node 0 DMA32: 1004*4kB (UME) 300*8kB (UME) 38*16kB (UME) 155*32kB (UME) 55*64kB (UME) 17*128kB (UME) 7*256kB (UM) 2*512kB (UM) 4*1024kB (UM) 2*2048kB (M) 0*4096kB = 28688kB [ 2237.905816][T11912] Node 1 DMA32: 44*4kB (UE) 920*8kB (UME) 696*16kB (UME) 546*32kB (UME) 145*64kB (UME) 112*128kB (UME) 30*256kB (UM) 14*512kB (UM) 6*1024kB (UM) 1*2048kB (U) 0*4096kB = 82800kB [ 2237.911495][T11912] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 2237.914470][T11912] Node 0 hugepages_total=1 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 2237.917437][T11912] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 2237.920387][T11912] Node 1 hugepages_total=3 hugepages_free=3 hugepages_surp=0 hugepages_size=2048kB [ 2237.924787][T11912] 10986 total pagecache pages [ 2237.926349][T11912] 1755 pages in swap cache [ 2237.927842][T11912] Free swap = 29976kB [ 2237.929121][T11912] Total swap = 124996kB [ 2237.930422][T11912] 524155 pages RAM [ 2237.931612][T11912] 0 pages HighMem/MovableOnly [ 2237.933712][T11912] 211483 pages reserved [ 2237.935068][T11912] 0 pages cma reserved [ 2238.602259][ T55] usb 11-1: new low-speed USB device number 20 using dummy_hcd [ 2238.642111][T11938] netlink: 32 bytes leftover after parsing attributes in process `syz.2.9898'. [ 2238.765980][ T55] usb 11-1: config 0 has an invalid interface number: 1 but max is 0 [ 2238.769063][ T55] usb 11-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2238.769178][ T55] usb 11-1: config 0 has no interface number 0 [ 2238.769477][ T55] usb 11-1: config 0 interface 1 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 2238.769662][ T55] usb 11-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 2238.769734][ T55] usb 11-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2238.790902][ T55] usb 11-1: config 0 descriptor?? [ 2238.803745][T11929] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 2239.085640][T11929] netlink: 28 bytes leftover after parsing attributes in process `syz.6.9897'. [ 2239.089813][T11929] netlink: 28 bytes leftover after parsing attributes in process `syz.6.9897'. [ 2239.401847][ T55] usb 11-1: string descriptor 0 read error: -71 [ 2239.415816][ T55] iowarrior 11-1:0.1: no interrupt-in endpoint found [ 2239.438325][ T55] usb 11-1: USB disconnect, device number 20 [ 2239.704906][ T60] usb 7-1: new high-speed USB device number 33 using dummy_hcd [ 2239.937256][T11955] serio: Serial port ptm0 [ 2240.869999][ T60] usb 7-1: New USB device found, idVendor=0fe9, idProduct=db55, bcdDevice=69.fb [ 2240.870020][ T60] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=201 [ 2240.870033][ T60] usb 7-1: Product: syz [ 2240.870041][ T60] usb 7-1: Manufacturer: syz [ 2240.870050][ T60] usb 7-1: SerialNumber: syz [ 2240.877703][T11964] netlink: 4 bytes leftover after parsing attributes in process `syz.5.9906'. [ 2240.888789][ T60] usb 7-1: config 0 descriptor?? [ 2240.896004][ T60] dvb-usb: found a 'DigitalNow DVB-T Dual USB' in warm state. [ 2240.896037][ T60] dvb-usb: bulk message failed: -22 (2/0) [ 2240.921369][ T60] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 2240.922424][ T60] dvbdev: DVB: registering new adapter (DigitalNow DVB-T Dual USB) [ 2240.922482][ T60] usb 7-1: media controller created [ 2240.935713][ T60] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 2241.079821][T11974] random: crng reseeded on system resumption [ 2241.130016][T11947] netlink: 'syz.2.9903': attribute type 3 has an invalid length. [ 2241.135864][T11947] netlink: 224 bytes leftover after parsing attributes in process `syz.2.9903'. [ 2241.145664][ T60] cxusb: set interface failed [ 2241.147405][ T60] dvb-usb: bulk message failed: -22 (1/0) [ 2241.184549][ T60] DVB: Unable to find symbol mt352_attach() [ 2241.186556][ T60] dvb-usb: bulk message failed: -22 (5/0) [ 2241.188513][ T60] zl10353_read_register: readreg error (reg=127, ret==-121) [ 2241.192243][ T60] dvb-usb: no frontend was attached by 'DigitalNow DVB-T Dual USB' [ 2241.258827][T11979] netlink: 32 bytes leftover after parsing attributes in process `syz.5.9909'. [ 2241.262067][ T60] rc_core: IR keymap rc-dvico-mce not found [ 2241.262089][ T60] Registered IR keymap rc-empty [ 2241.262799][ T60] rc rc0: DigitalNow DVB-T Dual USB as /devices/platform/dummy_hcd.2/usb7/7-1/rc/rc0 [ 2241.263833][ T60] input: DigitalNow DVB-T Dual USB as /devices/platform/dummy_hcd.2/usb7/7-1/rc/rc0/input315 [ 2241.267716][ T60] dvb-usb: schedule remote query interval to 100 msecs. [ 2241.267732][ T60] dvb-usb: DigitalNow DVB-T Dual USB successfully initialized and connected. [ 2241.274577][ T60] usb 7-1: USB disconnect, device number 33 [ 2241.292107][ T9] usb 11-1: new high-speed USB device number 21 using dummy_hcd [ 2241.343999][ T60] dvb-usb: DigitalNow DVB-T Dual USB successfully deinitialized and disconnected. [ 2241.455680][ T9] usb 11-1: Using ep0 maxpacket: 32 [ 2241.458492][ T9] usb 11-1: unable to get BOS descriptor or descriptor too short [ 2241.459640][ T9] usb 11-1: config 14 has an invalid interface number: 57 but max is 1 [ 2241.472503][ T9] usb 11-1: config 14 has an invalid interface number: 228 but max is 1 [ 2241.472531][ T9] usb 11-1: config 14 has no interface number 0 [ 2241.472548][ T9] usb 11-1: config 14 has no interface number 1 [ 2241.472607][ T9] usb 11-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 2241.472629][ T9] usb 11-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0x1B, changing to 0xB [ 2241.472651][ T9] usb 11-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 2241.472673][ T9] usb 11-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 2241.472698][ T9] usb 11-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 2241.472725][ T9] usb 11-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 0, changing to 7 [ 2241.472749][ T9] usb 11-1: config 14 interface 228 altsetting 5 endpoint 0x9 has invalid wMaxPacketSize 0 [ 2241.472769][ T9] usb 11-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 2241.472794][ T9] usb 11-1: config 14 interface 57 has no altsetting 0 [ 2241.472810][ T9] usb 11-1: config 14 interface 228 has no altsetting 0 [ 2241.475813][ T9] usb 11-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 2241.475838][ T9] usb 11-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2241.475858][ T9] usb 11-1: Product: syz [ 2241.475873][ T9] usb 11-1: Manufacturer: syz [ 2241.475886][ T9] usb 11-1: SerialNumber: syz [ 2241.907219][ T9] legousbtower 11-1:14.57: interrupt endpoints not found [ 2242.732067][ T9682] usb 10-1: new high-speed USB device number 21 using dummy_hcd [ 2242.918546][ T9682] usb 10-1: New USB device found, idVendor=0fe9, idProduct=db55, bcdDevice=69.fb [ 2242.922677][ T9682] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=201 [ 2242.926216][ T9682] usb 10-1: Product: syz [ 2242.928080][ T9682] usb 10-1: Manufacturer: syz [ 2242.930112][ T9682] usb 10-1: SerialNumber: syz [ 2242.938830][ T9682] usb 10-1: config 0 descriptor?? [ 2242.944610][ T9682] dvb-usb: found a 'DigitalNow DVB-T Dual USB' in warm state. [ 2242.947831][ T9682] dvb-usb: bulk message failed: -22 (2/0) [ 2242.952817][ T9682] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 2242.957401][ T9682] dvbdev: DVB: registering new adapter (DigitalNow DVB-T Dual USB) [ 2242.972197][ T9682] usb 10-1: media controller created [ 2242.981186][ T9682] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 2243.148393][T12001] netlink: 'syz.5.9918': attribute type 3 has an invalid length. [ 2243.150883][T12001] netlink: 224 bytes leftover after parsing attributes in process `syz.5.9918'. [ 2243.227929][ T9682] cxusb: set interface failed [ 2243.229495][ T9682] dvb-usb: bulk message failed: -22 (1/0) [ 2243.293058][ T9682] DVB: Unable to find symbol mt352_attach() [ 2243.296263][ T9682] dvb-usb: bulk message failed: -22 (5/0) [ 2243.298095][ T9682] zl10353_read_register: readreg error (reg=127, ret==-121) [ 2243.301408][ T9682] dvb-usb: no frontend was attached by 'DigitalNow DVB-T Dual USB' [ 2243.372574][ T9682] rc_core: IR keymap rc-dvico-mce not found [ 2243.378868][ T9682] Registered IR keymap rc-empty [ 2243.384572][ T9682] rc rc0: DigitalNow DVB-T Dual USB as /devices/platform/dummy_hcd.5/usb10/10-1/rc/rc0 [ 2243.393141][ T9682] input: DigitalNow DVB-T Dual USB as /devices/platform/dummy_hcd.5/usb10/10-1/rc/rc0/input316 [ 2243.399156][ T9682] dvb-usb: schedule remote query interval to 100 msecs. [ 2243.402391][ T9682] dvb-usb: DigitalNow DVB-T Dual USB successfully initialized and connected. [ 2243.422263][ T9682] usb 10-1: USB disconnect, device number 21 [ 2243.460566][ T9682] dvb-usb: DigitalNow DVB-T Dual USB successfully deinitialized and disconnected. [ 2243.665005][T12016] random: crng reseeded on system resumption [ 2244.199467][T12027] 8021q: adding VLAN 0 to HW filter on device bond0 [ 2244.224083][T12027] bridge0: port 1(bridge_slave_0) entered disabled state [ 2244.229032][ T9] legousbtower 11-1:14.228: get version request failed: -71 [ 2244.230035][T12027] bridge0: port 2(bridge_slave_1) entered disabled state [ 2244.241255][ T9] legousbtower 11-1:14.228: probe with driver legousbtower failed with error -71 [ 2244.320941][T32321] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 2244.329840][T32321] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 2244.342950][T32321] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 2244.351650][T32321] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 2244.897225][ T9] usb 11-1: USB disconnect, device number 21 [ 2244.985702][T12040] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 2245.754253][T12045] overlay: ./file0 is not a directory [ 2246.832293][ T1356] usb 7-1: new high-speed USB device number 34 using dummy_hcd [ 2246.982022][ T1356] usb 7-1: Using ep0 maxpacket: 32 [ 2246.986425][ T1356] usb 7-1: unable to get BOS descriptor or descriptor too short [ 2246.990372][ T1356] usb 7-1: config 14 has an invalid interface number: 57 but max is 1 [ 2246.993254][ T1356] usb 7-1: config 14 has an invalid interface number: 228 but max is 1 [ 2246.995962][ T1356] usb 7-1: config 14 has no interface number 0 [ 2246.998106][ T1356] usb 7-1: config 14 has no interface number 1 [ 2247.000100][ T1356] usb 7-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 2247.005271][ T1356] usb 7-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0x1B, changing to 0xB [ 2247.009698][ T1356] usb 7-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 2247.014097][ T1356] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 2247.017787][ T1356] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 2247.021296][ T1356] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 0, changing to 7 [ 2247.025151][ T1356] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x9 has invalid wMaxPacketSize 0 [ 2247.028249][ T1356] usb 7-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 2247.032570][ T1356] usb 7-1: config 14 interface 57 has no altsetting 0 [ 2247.034882][ T1356] usb 7-1: config 14 interface 228 has no altsetting 0 [ 2247.039208][ T1356] usb 7-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 2247.042170][ T1356] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2247.044645][ T1356] usb 7-1: Product: syz [ 2247.046000][ T1356] usb 7-1: Manufacturer: syz [ 2247.047533][ T1356] usb 7-1: SerialNumber: syz [ 2247.222416][T14948] usb 11-1: new high-speed USB device number 22 using dummy_hcd [ 2247.303428][T12075] misc userio: The device must be registered before sending interrupts [ 2247.375532][T14948] usb 11-1: no configurations [ 2247.377101][T14948] usb 11-1: can't read configurations, error -22 [ 2247.522058][T14948] usb 11-1: new high-speed USB device number 23 using dummy_hcd [ 2247.620797][ T1356] legousbtower 7-1:14.57: interrupt endpoints not found [ 2247.672826][T14948] usb 11-1: no configurations [ 2247.674744][T14948] usb 11-1: can't read configurations, error -22 [ 2247.677746][T14948] usb usb11-port1: attempt power cycle [ 2248.013854][T14948] usb 11-1: new high-speed USB device number 24 using dummy_hcd [ 2248.035707][T14948] usb 11-1: no configurations [ 2248.037817][T14948] usb 11-1: can't read configurations, error -22 [ 2248.172198][T14948] usb 11-1: new high-speed USB device number 25 using dummy_hcd [ 2248.197157][T14948] usb 11-1: no configurations [ 2248.199254][T14948] usb 11-1: can't read configurations, error -22 [ 2248.204298][T14948] usb usb11-port1: unable to enumerate USB device [ 2248.213654][ T42] audit: type=1804 audit(1783898008.576:501): pid=12081 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.4.9943" name="/newroot/491/file0/file0" dev="9p" ino=71827907 res=1 errno=0 [ 2248.284642][T12080] overlay: ./file0 is not a directory [ 2249.058164][T12091] random: crng reseeded on system resumption [ 2249.698621][ T1356] legousbtower 7-1:14.228: get version request failed: -71 [ 2249.705191][ T1356] legousbtower 7-1:14.228: probe with driver legousbtower failed with error -71 [ 2249.727352][ T1356] usb 7-1: USB disconnect, device number 34 [ 2249.897457][T12105] random: crng reseeded on system resumption [ 2250.323795][T12114] netlink: 32 bytes leftover after parsing attributes in process `syz.5.9951'. [ 2250.545598][T12117] netlink: 8 bytes leftover after parsing attributes in process `syz.6.9952'. [ 2250.545640][T12117] netlink: 12 bytes leftover after parsing attributes in process `syz.6.9952'. [ 2251.779278][T12139] random: crng reseeded on system resumption [ 2251.888366][T12140] lo speed is unknown, defaulting to 1000 [ 2252.300931][ T9682] usb 10-1: new high-speed USB device number 22 using dummy_hcd [ 2252.484317][ T9682] usb 10-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2252.491998][ T9682] usb 10-1: config 0 has no interfaces? [ 2252.494778][ T9682] usb 10-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2252.502234][ T9682] usb 10-1: config 0 has no interfaces? [ 2252.507776][ T9682] usb 10-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2252.513719][ T9682] usb 10-1: config 0 has no interfaces? [ 2252.519354][ T9682] usb 10-1: New USB device found, idVendor=0fe9, idProduct=db55, bcdDevice=69.fb [ 2252.524685][ T9682] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=201 [ 2252.532022][ T9682] usb 10-1: Product: syz [ 2252.533563][ T9682] usb 10-1: Manufacturer: syz [ 2252.538264][ T9682] usb 10-1: SerialNumber: syz [ 2252.543177][ T9682] usb 10-1: config 0 descriptor?? [ 2252.785101][T12145] netlink: 'syz.5.9960': attribute type 3 has an invalid length. [ 2252.788196][T12145] netlink: 224 bytes leftover after parsing attributes in process `syz.5.9960'. [ 2252.795767][ T9682] usb 10-1: USB disconnect, device number 22 [ 2253.016214][T12161] netlink: 8 bytes leftover after parsing attributes in process `syz.6.9963'. [ 2253.019229][T12161] netlink: 12 bytes leftover after parsing attributes in process `syz.6.9963'. [ 2253.689435][T12176] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9968'. [ 2253.892085][ T60] usb 10-1: new high-speed USB device number 23 using dummy_hcd [ 2254.042494][ T60] usb 10-1: Using ep0 maxpacket: 16 [ 2254.044080][ T60] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 2254.045754][ T60] usb 10-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 2254.045770][ T60] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2254.045781][ T60] usb 10-1: Product: syz [ 2254.045789][ T60] usb 10-1: Manufacturer: syz [ 2254.045797][ T60] usb 10-1: SerialNumber: syz [ 2254.047305][ T60] usb 10-1: config 0 descriptor?? [ 2254.049228][ T60] em28xx 10-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 2254.049247][ T60] em28xx 10-1:0.0: DVB interface 0 found: bulk [ 2254.065489][T12188] netlink: 32 bytes leftover after parsing attributes in process `syz.2.9970'. [ 2254.671223][ T60] em28xx 10-1:0.0: unknown em28xx chip ID (0) [ 2254.718213][T12177] lo speed is unknown, defaulting to 1000 [ 2255.248636][T12169] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future [ 2256.379567][ T60] em28xx 10-1:0.0: failed to get i2c transfer status from bridge register (error=-5) [ 2256.382866][ T60] em28xx 10-1:0.0: board has no eeprom [ 2256.442138][ T60] em28xx 10-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 2256.456152][ T60] em28xx 10-1:0.0: dvb set to bulk mode. [ 2256.459638][ T34] em28xx 10-1:0.0: Binding DVB extension [ 2256.502176][ T34] em28xx 10-1:0.0: Registering input extension [ 2256.556973][T12200] lo speed is unknown, defaulting to 1000 [ 2256.665691][ T672] usb 10-1: USB disconnect, device number 23 [ 2256.675367][ T672] em28xx 10-1:0.0: Disconnecting em28xx [ 2256.689988][ T672] em28xx 10-1:0.0: Closing input extension [ 2256.754164][ T672] em28xx 10-1:0.0: Freeing device [ 2256.867516][T12210] netlink: 32 bytes leftover after parsing attributes in process `syz.2.9973'. [ 2257.337258][T12224] netlink: 8 bytes leftover after parsing attributes in process `syz.4.9978'. [ 2257.835425][T12234] netlink: 32 bytes leftover after parsing attributes in process `syz.5.9979'. [ 2257.863317][ T9682] usb 7-1: new high-speed USB device number 35 using dummy_hcd [ 2258.012038][ T9682] usb 7-1: Using ep0 maxpacket: 32 [ 2258.014280][ T9682] usb 7-1: unable to get BOS descriptor or descriptor too short [ 2258.017494][ T9682] usb 7-1: config 14 has an invalid interface number: 57 but max is 1 [ 2258.017510][ T9682] usb 7-1: config 14 has an invalid interface number: 228 but max is 1 [ 2258.017523][ T9682] usb 7-1: config 14 has no interface number 0 [ 2258.017534][ T9682] usb 7-1: config 14 has no interface number 1 [ 2258.017563][ T9682] usb 7-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 2258.017576][ T9682] usb 7-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0x1B, changing to 0xB [ 2258.017589][ T9682] usb 7-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 2258.017603][ T9682] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 2258.017617][ T9682] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 2258.017633][ T9682] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 0, changing to 7 [ 2258.017647][ T9682] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x9 has invalid wMaxPacketSize 0 [ 2258.017660][ T9682] usb 7-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 2258.017675][ T9682] usb 7-1: config 14 interface 57 has no altsetting 0 [ 2258.017686][ T9682] usb 7-1: config 14 interface 228 has no altsetting 0 [ 2258.019403][ T9682] usb 7-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 2258.125909][ T9682] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2258.134017][ T9682] usb 7-1: Product: syz [ 2258.137490][ T9682] usb 7-1: Manufacturer: syz [ 2258.142043][ T9682] usb 7-1: SerialNumber: syz [ 2258.563847][ T9682] legousbtower 7-1:14.57: interrupt endpoints not found [ 2259.107560][ T42] audit: type=1804 audit(1783898019.466:502): pid=12264 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.5.9986" name="/newroot/591/file0/file0" dev="9p" ino=71827907 res=1 errno=0 [ 2259.113497][T12268] overlay: ./file0 is not a directory [ 2259.276087][ T9682] legousbtower 7-1:14.228: get version request failed: -71 [ 2259.278456][ T9682] legousbtower 7-1:14.228: probe with driver legousbtower failed with error -71 [ 2259.294734][ T9682] usb 7-1: USB disconnect, device number 35 [ 2259.434480][T12272] netlink: 8 bytes leftover after parsing attributes in process `syz.4.9987'. [ 2259.712704][T12257] lo speed is unknown, defaulting to 1000 [ 2259.900649][T12278] netlink: 16 bytes leftover after parsing attributes in process `syz.2.9990'. [ 2259.912528][T12278] loop5: detected capacity change from 0 to 1 [ 2259.918438][T12278] ldm_validate_privheads(): Disk read failed. [ 2259.922339][T12278] Dev loop5: unable to read RDB block 1 [ 2259.924746][T12278] loop5: AHDI p2 p3 [ 2259.926584][T12278] loop5: partition table partially beyond EOD, truncated [ 2259.929617][T12278] loop5: p3 start 335544320 is beyond EOD, truncated [ 2260.049074][T12282] random: crng reseeded on system resumption [ 2260.288662][T12287] netlink: 32 bytes leftover after parsing attributes in process `syz.2.9991'. [ 2261.232257][ T9682] usb 7-1: new high-speed USB device number 36 using dummy_hcd [ 2261.386195][ T9682] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2261.402375][ T9682] usb 7-1: config 0 has no interfaces? [ 2261.408851][ T9682] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2261.420093][ T9682] usb 7-1: config 0 has no interfaces? [ 2261.426964][ T9682] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2261.436173][ T9682] usb 7-1: config 0 has no interfaces? [ 2261.447712][ T9682] usb 7-1: New USB device found, idVendor=0fe9, idProduct=db55, bcdDevice=69.fb [ 2261.459476][ T9682] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=201 [ 2261.474810][ T9682] usb 7-1: Product: syz [ 2261.482938][ T9682] usb 7-1: Manufacturer: syz [ 2261.485032][ T9682] usb 7-1: SerialNumber: syz [ 2261.497057][ T9682] usb 7-1: config 0 descriptor?? [ 2261.556525][T12306] netlink: 8 bytes leftover after parsing attributes in process `syz.6.9995'. [ 2261.716429][T12296] netlink: 'syz.2.9993': attribute type 3 has an invalid length. [ 2261.719276][T12296] netlink: 224 bytes leftover after parsing attributes in process `syz.2.9993'. [ 2261.729207][ T9682] usb 7-1: USB disconnect, device number 36 [ 2262.204916][ T42] audit: type=1804 audit(1783898022.566:503): pid=12314 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.4.9998" name="/newroot/509/file0/file0" dev="9p" ino=71827907 res=1 errno=0 [ 2262.250695][T12316] overlay: ./file0 is not a directory [ 2263.461597][T12334] netlink: 32 bytes leftover after parsing attributes in process `syz.4.10001'. [ 2264.167473][T12343] misc userio: The device must be registered before sending interrupts [ 2264.622481][T12345] netlink: 12 bytes leftover after parsing attributes in process `syz.4.10005'. [ 2264.878323][T12351] netlink: 8 bytes leftover after parsing attributes in process `syz.6.10006'. [ 2264.885618][ T42] audit: type=1804 audit(1783898025.246:504): pid=12349 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.4.10008" name="/newroot/513/file0/file0" dev="9p" ino=71827907 res=1 errno=0 [ 2264.954584][T12353] overlay: ./file0 is not a directory [ 2265.120327][T12333] lo speed is unknown, defaulting to 1000 [ 2265.604429][T12363] netlink: 'syz.6.10011': attribute type 3 has an invalid length. [ 2265.615597][T12363] netlink: 224 bytes leftover after parsing attributes in process `syz.6.10011'. [ 2265.912182][ T672] usb 9-1: new high-speed USB device number 10 using dummy_hcd [ 2266.062061][ T672] usb 9-1: Using ep0 maxpacket: 16 [ 2266.066225][ T672] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 2266.071659][ T672] usb 9-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 2266.075403][ T672] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2266.077989][ T672] usb 9-1: Product: syz [ 2266.080432][ T672] usb 9-1: Manufacturer: syz [ 2266.082143][ T672] usb 9-1: SerialNumber: syz [ 2266.086418][ T672] usb 9-1: config 0 descriptor?? [ 2266.097142][ T672] em28xx 9-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 2266.100331][ T672] em28xx 9-1:0.0: DVB interface 0 found: bulk [ 2266.706955][ T672] em28xx 9-1:0.0: unknown em28xx chip ID (0) [ 2266.960505][T12377] loop5: detected capacity change from 0 to 1 [ 2266.974546][T12377] Dev loop5: unable to read RDB block 1 [ 2266.976772][T12377] loop5: unable to read partition table [ 2266.985426][T12377] loop5: partition table beyond EOD, truncated [ 2266.987983][T12377] loop_reread_partitions: partition scan of loop5 (þè¢) failed (rc=-5) [ 2267.096511][T12383] pim6reg: entered allmulticast mode [ 2267.100553][T12383] pim6reg: left allmulticast mode [ 2267.105128][T12381] netlink: 8 bytes leftover after parsing attributes in process `syz.6.10014'. [ 2267.106318][T12379] netlink: 12 bytes leftover after parsing attributes in process `syz.2.10016'. [ 2267.274352][T12366] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future [ 2267.347255][ T42] audit: type=1804 audit(1783898027.706:505): pid=12390 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.6.10018" name="/newroot/548/file0/file0" dev="9p" ino=71827907 res=1 errno=0 [ 2267.387454][T12393] overlay: ./file0 is not a directory [ 2267.389747][T12392] netlink: 8 bytes leftover after parsing attributes in process `syz.2.10019'. [ 2267.772121][T17558] usb 10-1: new high-speed USB device number 24 using dummy_hcd [ 2267.808789][T12399] Cache volume key already in use (9p,syz,) [ 2267.870522][ T42] audit: type=1804 audit(1783898028.226:506): pid=12400 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.10022" name="/newroot/370/file0/file0" dev="9p" ino=71827907 res=1 errno=0 [ 2267.922128][T17558] usb 10-1: Using ep0 maxpacket: 16 [ 2267.930684][T17558] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 2267.941020][T17558] usb 10-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 2267.948542][T17558] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2267.955318][T17558] usb 10-1: Product: syz [ 2267.957139][T17558] usb 10-1: Manufacturer: syz [ 2267.965105][T17558] usb 10-1: SerialNumber: syz [ 2267.981205][T17558] usb 10-1: config 0 descriptor?? [ 2267.988957][T17558] em28xx 10-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 2268.000848][T17558] em28xx 10-1:0.0: DVB interface 0 found: bulk [ 2268.045825][T12399] overlay: ./file0 is not a directory [ 2268.529265][T12408] netlink: 32 bytes leftover after parsing attributes in process `syz.2.10023'. [ 2268.530225][ T672] em28xx 9-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 2268.530243][ T672] em28xx 9-1:0.0: board has no eeprom [ 2268.592056][ T672] em28xx 9-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 2268.592077][ T672] em28xx 9-1:0.0: dvb set to bulk mode. [ 2268.592490][T14948] em28xx 9-1:0.0: Binding DVB extension [ 2268.597428][T17558] em28xx 10-1:0.0: unknown em28xx chip ID (0) [ 2268.693992][T14948] em28xx 9-1:0.0: Registering input extension [ 2268.899345][ T1356] usb 9-1: USB disconnect, device number 10 [ 2268.908468][ T1356] em28xx 9-1:0.0: Disconnecting em28xx [ 2268.923163][ T1356] em28xx 9-1:0.0: Closing input extension [ 2268.953260][ T1356] em28xx 9-1:0.0: Freeing device [ 2269.793950][T12425] lo speed is unknown, defaulting to 1000 [ 2270.541391][T12434] netlink: 12 bytes leftover after parsing attributes in process `syz.4.10027'. [ 2270.722243][T14948] usb 7-1: new high-speed USB device number 37 using dummy_hcd [ 2270.874080][T14948] usb 7-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 2270.877122][T14948] usb 7-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 2270.880471][T14948] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 2270.884162][T14948] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 2270.891417][T14948] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 2270.905673][T14948] usb 7-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 2270.915375][T14948] usb 7-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 2270.924957][T14948] usb 7-1: Product: syz [ 2270.926944][T14948] usb 7-1: Manufacturer: syz [ 2270.943535][T14948] cdc_wdm 7-1:1.0: skipping garbage [ 2270.945989][T14948] cdc_wdm 7-1:1.0: skipping garbage [ 2270.950990][T14948] cdc_wdm 7-1:1.0: cdc-wdm0: USB WDM device [ 2270.953845][T14948] cdc_wdm 7-1:1.0: Unknown control protocol [ 2271.002304][T12427] em28xx 10-1:0.0: failed to get i2c transfer status from bridge register (error=-5) [ 2271.015374][T17558] em28xx 10-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 2271.020508][T17558] em28xx 10-1:0.0: board has no eeprom [ 2271.082203][T17558] em28xx 10-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 2271.087158][T17558] em28xx 10-1:0.0: dvb set to bulk mode. [ 2271.101412][T17559] em28xx 10-1:0.0: Binding DVB extension [ 2271.265135][T17559] em28xx 10-1:0.0: Registering input extension [ 2271.380840][ T60] usb 7-1: USB disconnect, device number 37 [ 2271.413242][T12446] netlink: 8 bytes leftover after parsing attributes in process `syz.4.10030'. [ 2271.430496][T12444] netlink: 8 bytes leftover after parsing attributes in process `syz.6.10029'. [ 2271.434147][T12444] netlink: 12 bytes leftover after parsing attributes in process `syz.6.10029'. [ 2271.545623][ T42] audit: type=1804 audit(1783898031.906:507): pid=12451 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.10031" name="/newroot/374/file0/file0" dev="9p" ino=71827907 res=1 errno=0 [ 2271.600082][T12452] overlay: ./file0 is not a directory [ 2272.210257][ T60] usb 10-1: USB disconnect, device number 24 [ 2272.219122][ T60] em28xx 10-1:0.0: Disconnecting em28xx [ 2272.222684][ T60] em28xx 10-1:0.0: Closing input extension [ 2272.233428][ T60] em28xx 10-1:0.0: Freeing device [ 2272.518129][T32239] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 2272.536728][T32239] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 2272.540881][T32239] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 2272.546611][T32239] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 2272.554457][T32239] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 2272.623281][T12461] misc userio: The device must be registered before sending interrupts [ 2272.910029][ T42] audit: type=1804 audit(1783898033.266:508): pid=12484 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.10036" name="/newroot/375/file0/file0" dev="9p" ino=71827907 res=1 errno=0 [ 2272.976141][T12485] overlay: ./file0 is not a directory [ 2272.984806][T12472] lo speed is unknown, defaulting to 1000 [ 2273.409861][T12472] bridge0: port 1(bridge_slave_0) entered blocking state [ 2273.414105][T12472] bridge0: port 1(bridge_slave_0) entered disabled state [ 2273.417350][T12472] bridge_slave_0: entered allmulticast mode [ 2273.422854][T12472] bridge_slave_0: entered promiscuous mode [ 2273.439915][T12472] bridge0: port 2(bridge_slave_1) entered blocking state [ 2273.451129][T12472] bridge0: port 2(bridge_slave_1) entered disabled state [ 2273.456263][T12472] bridge_slave_1: entered allmulticast mode [ 2273.460896][T12472] bridge_slave_1: entered promiscuous mode [ 2273.539400][T12472] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 2273.549062][T12472] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 2273.599820][T12472] team0: Port device team_slave_0 added [ 2273.614045][T12472] team0: Port device team_slave_1 added [ 2273.650399][T12497] netlink: 8 bytes leftover after parsing attributes in process `syz.6.10040'. [ 2273.671602][T12472] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 2273.674884][T12472] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2273.701176][T12472] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 2273.707350][T12472] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 2273.710150][T12472] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2273.719019][T12472] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 2273.800168][T12472] hsr_slave_0: entered promiscuous mode [ 2273.803104][T12472] hsr_slave_1: entered promiscuous mode [ 2274.413873][T12506] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 2274.564215][T12513] netlink: 32 bytes leftover after parsing attributes in process `syz.6.10041'. [ 2274.602053][T32239] Bluetooth: hci2: command tx timeout [ 2274.726675][T32321] vlan2: left promiscuous mode [ 2274.729501][T32321] bridge0: port 3(vlan2) entered disabled state [ 2274.754304][T32321] bridge_slave_1: left allmulticast mode [ 2274.756664][T32321] bridge_slave_1: left promiscuous mode [ 2274.761905][T32321] bridge0: port 2(bridge_slave_1) entered disabled state [ 2274.834493][T32321] bridge_slave_0: left allmulticast mode [ 2274.836995][T32321] bridge_slave_0: left promiscuous mode [ 2274.842616][T32321] bridge0: port 1(bridge_slave_0) entered disabled state [ 2274.856063][T12518] netlink: 8 bytes leftover after parsing attributes in process `syz.2.10043'. [ 2274.859164][T12518] netlink: 12 bytes leftover after parsing attributes in process `syz.2.10043'. [ 2275.361617][T32321] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 2275.369143][T32321] bond_slave_0: left promiscuous mode [ 2275.374627][T32321] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 2275.391572][T32321] bond_slave_1: left promiscuous mode [ 2275.395375][T32321] bond0 (unregistering): (slave dummy0): Releasing backup interface [ 2275.399706][T32321] dummy0: left promiscuous mode [ 2275.406928][T32321] bond0 (unregistering): Released all slaves [ 2275.412366][T32321] bond1 (unregistering): Released all slaves [ 2275.653697][T32321] IPVS: stopping backup sync thread 6893 ... [ 2275.800094][T12534] overlay: ./file0 is not a directory [ 2275.915168][ T5454] 8021q: adding VLAN 0 to HW filter on device eth14 [ 2276.002073][T17558] usb 7-1: new high-speed USB device number 38 using dummy_hcd [ 2276.152674][T17558] usb 7-1: Using ep0 maxpacket: 32 [ 2276.158591][T17558] usb 7-1: unable to get BOS descriptor or descriptor too short [ 2276.164465][T17558] usb 7-1: config 14 has an invalid interface number: 57 but max is 1 [ 2276.167234][T17558] usb 7-1: config 14 has an invalid interface number: 228 but max is 1 [ 2276.169873][T17558] usb 7-1: config 14 has no interface number 0 [ 2276.171900][T17558] usb 7-1: config 14 has no interface number 1 [ 2276.175172][T17558] usb 7-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 2276.178788][T17558] usb 7-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0x1B, changing to 0xB [ 2276.182988][T17558] usb 7-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 2276.186825][T17558] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 2276.190849][T17558] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 2276.195523][T17558] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 0, changing to 7 [ 2276.209599][ T42] audit: type=1804 audit(1783898036.566:509): pid=12529 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.4.10045" name="/newroot/524/file0/file0" dev="9p" ino=71827907 res=1 errno=0 [ 2276.216661][T17558] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x9 has invalid wMaxPacketSize 0 [ 2276.226063][T17558] usb 7-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 2276.235315][T17558] usb 7-1: config 14 interface 57 has no altsetting 0 [ 2276.243021][T17558] usb 7-1: config 14 interface 228 has no altsetting 0 [ 2276.257449][T17558] usb 7-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 2276.270783][T17558] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2276.274576][T17558] usb 7-1: Product: syz [ 2276.276669][T17558] usb 7-1: Manufacturer: syz [ 2276.278330][T17558] usb 7-1: SerialNumber: syz [ 2276.432681][ T42] audit: type=1800 audit(1783898036.786:510): pid=12525 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.10045" name="file0" dev="9p" ino=71827907 res=0 errno=0 [ 2276.482580][ T42] audit: type=1800 audit(1783898036.836:511): pid=12529 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.10045" name="file0" dev="9p" ino=71827907 res=0 errno=0 [ 2276.644586][T32321] hsr_slave_0: left promiscuous mode [ 2276.647550][T32321] hsr_slave_1: left promiscuous mode [ 2276.650168][T32321] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 2276.654274][T32321] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 2276.691922][T32239] Bluetooth: hci2: command tx timeout [ 2276.765238][T17558] legousbtower 7-1:14.57: interrupt endpoints not found [ 2276.845535][T32321] team0 (unregistering): Port device team_slave_1 removed [ 2276.853956][T32321] team0 (unregistering): Port device team_slave_0 removed [ 2277.241610][T12555] netlink: 8 bytes leftover after parsing attributes in process `syz.6.10048'. [ 2277.317969][T12550] netlink: 32 bytes leftover after parsing attributes in process `syz.4.10047'. [ 2277.338653][T17558] legousbtower 7-1:14.228: get version request failed: -71 [ 2277.338824][T17558] legousbtower 7-1:14.228: probe with driver legousbtower failed with error -71 [ 2277.399251][T17558] usb 7-1: USB disconnect, device number 38 [ 2277.668147][T12472] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 2277.717743][T12472] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 2277.785449][T12472] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 2277.796463][T12472] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 2277.803144][T12472] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 2277.821864][T12472] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 2277.826005][T12472] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 2277.832493][T12472] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 2277.910055][T12472] 8021q: adding VLAN 0 to HW filter on device bond0 [ 2277.928881][T12472] 8021q: adding VLAN 0 to HW filter on device team0 [ 2277.938065][ T168] bridge0: port 1(bridge_slave_0) entered blocking state [ 2277.941333][ T168] bridge0: port 1(bridge_slave_0) entered forwarding state [ 2277.950545][ T168] bridge0: port 2(bridge_slave_1) entered blocking state [ 2277.953759][ T168] bridge0: port 2(bridge_slave_1) entered forwarding state [ 2278.166010][T12576] netlink: 32 bytes leftover after parsing attributes in process `syz.6.10049'. [ 2278.592703][T12588] netlink: 32 bytes leftover after parsing attributes in process `syz.4.10051'. [ 2278.762324][T32239] Bluetooth: hci2: command tx timeout [ 2279.003980][T12472] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 2279.231928][ T42] audit: type=1804 audit(1783898039.586:512): pid=12607 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.10054" name="/newroot/381/file0/file0" dev="9p" ino=71827907 res=1 errno=0 [ 2279.236034][T12607] overlay: ./file0 is not a directory [ 2279.294800][T12472] veth0_vlan: entered promiscuous mode [ 2279.314693][T12472] veth1_vlan: entered promiscuous mode [ 2279.350678][T12472] veth0_macvtap: entered promiscuous mode [ 2279.358633][T12472] veth1_macvtap: entered promiscuous mode [ 2279.376008][T12472] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 2279.385897][T12472] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 2279.393372][T11306] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 2279.396379][T11306] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 2279.399698][T11306] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 2279.404111][T11306] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 2279.496730][ T4069] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2279.521673][ T4069] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2279.539656][T12614] netlink: 8 bytes leftover after parsing attributes in process `syz.6.10053'. [ 2279.545340][T12614] netlink: 12 bytes leftover after parsing attributes in process `syz.6.10053'. [ 2279.549070][T12613] netlink: 8 bytes leftover after parsing attributes in process `syz.2.10056'. [ 2279.552146][T14948] usb 9-1: new high-speed USB device number 11 using dummy_hcd [ 2279.570640][ T48] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2279.575316][ T48] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2279.709192][T14948] usb 9-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2279.727760][T14948] usb 9-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2279.742151][T14948] usb 9-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2279.749724][T14948] usb 9-1: New USB device found, idVendor=0fe9, idProduct=db55, bcdDevice=69.fb [ 2279.753893][T14948] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=201 [ 2279.757466][T14948] usb 9-1: Product: syz [ 2279.758899][T14948] usb 9-1: Manufacturer: syz [ 2279.760343][T14948] usb 9-1: SerialNumber: syz [ 2279.779652][T14948] usb 9-1: config 0 descriptor?? [ 2279.995153][T12609] netlink: 'syz.4.10055': attribute type 3 has an invalid length. [ 2279.997832][T12609] netlink: 224 bytes leftover after parsing attributes in process `syz.4.10055'. [ 2280.005245][ T672] usb 9-1: USB disconnect, device number 11 [ 2280.182452][ T9682] usb 7-1: new high-speed USB device number 39 using dummy_hcd [ 2280.342114][ T9682] usb 7-1: Using ep0 maxpacket: 32 [ 2280.346866][ T9682] usb 7-1: unable to get BOS descriptor or descriptor too short [ 2280.351120][ T9682] usb 7-1: config 14 has an invalid interface number: 57 but max is 1 [ 2280.356011][ T9682] usb 7-1: config 14 has an invalid interface number: 228 but max is 1 [ 2280.359434][ T9682] usb 7-1: config 14 has no interface number 0 [ 2280.361931][ T9682] usb 7-1: config 14 has no interface number 1 [ 2280.365878][ T9682] usb 7-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 2280.370231][T12625] random: crng reseeded on system resumption [ 2280.373771][ T9682] usb 7-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0x1B, changing to 0xB [ 2280.379106][ T9682] usb 7-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 2280.384423][ T9682] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 2280.389062][ T9682] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 2280.393937][ T9682] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 0, changing to 7 [ 2280.398274][ T9682] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x9 has invalid wMaxPacketSize 0 [ 2280.402994][ T9682] usb 7-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 2280.407796][ T9682] usb 7-1: config 14 interface 57 has no altsetting 0 [ 2280.410531][ T9682] usb 7-1: config 14 interface 228 has no altsetting 0 [ 2280.416453][ T9682] usb 7-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 2280.420097][ T9682] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2280.423977][ T9682] usb 7-1: Product: syz [ 2280.425737][ T9682] usb 7-1: Manufacturer: syz [ 2280.427676][ T9682] usb 7-1: SerialNumber: syz [ 2280.760253][T12628] overlayfs: failed to resolve './bus': -2 [ 2280.842084][T32239] Bluetooth: hci2: command tx timeout [ 2280.855506][ T9682] legousbtower 7-1:14.57: interrupt endpoints not found [ 2281.465753][ T9682] legousbtower 7-1:14.228: get version request failed: -71 [ 2281.477361][ T9682] legousbtower 7-1:14.228: probe with driver legousbtower failed with error -71 [ 2281.498524][ T9682] usb 7-1: USB disconnect, device number 39 [ 2281.811582][T12640] netlink: 12 bytes leftover after parsing attributes in process `syz.4.10061'. [ 2281.928884][T12642] loop5: detected capacity change from 0 to 1 [ 2281.931749][T12642] ldm_validate_privheads(): Disk read failed. [ 2281.934265][T12642] Dev loop5: unable to read RDB block 1 [ 2281.936189][T12642] loop5: AHDI p2 p3 [ 2281.937409][T12642] loop5: partition table partially beyond EOD, truncated [ 2281.939744][T12642] loop5: p3 start 335544320 is beyond EOD, truncated [ 2282.048894][T12644] netlink: 8 bytes leftover after parsing attributes in process `syz.5.10065'. [ 2282.128762][T12651] netlink: 'syz.6.10064': attribute type 3 has an invalid length. [ 2282.132244][T12651] netlink: 224 bytes leftover after parsing attributes in process `syz.6.10064'. [ 2282.292567][ T672] usb 7-1: new high-speed USB device number 40 using dummy_hcd [ 2282.352272][T14948] usb 9-1: new high-speed USB device number 12 using dummy_hcd [ 2282.442291][ T672] usb 7-1: Using ep0 maxpacket: 32 [ 2282.446127][ T672] usb 7-1: unable to get BOS descriptor or descriptor too short [ 2282.449545][ T672] usb 7-1: config 14 has an invalid interface number: 57 but max is 1 [ 2282.452375][ T672] usb 7-1: config 14 has an invalid interface number: 228 but max is 1 [ 2282.455029][ T672] usb 7-1: config 14 has no interface number 0 [ 2282.456949][ T672] usb 7-1: config 14 has no interface number 1 [ 2282.459031][ T672] usb 7-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 2282.463826][ T672] usb 7-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0x1B, changing to 0xB [ 2282.468591][ T672] usb 7-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 2282.473537][ T672] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 2282.477362][ T672] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 2282.481556][ T672] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 0, changing to 7 [ 2282.485901][ T672] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x9 has invalid wMaxPacketSize 0 [ 2282.490170][ T672] usb 7-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 2282.495990][ T672] usb 7-1: config 14 interface 57 has no altsetting 0 [ 2282.498877][ T672] usb 7-1: config 14 interface 228 has no altsetting 0 [ 2282.505616][T14948] usb 9-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2282.511327][T14948] usb 9-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2282.516136][ T672] usb 7-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 2282.520406][ T672] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2282.527016][T14948] usb 9-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2282.530044][ T672] usb 7-1: Product: syz [ 2282.531766][ T672] usb 7-1: Manufacturer: syz [ 2282.533803][ T672] usb 7-1: SerialNumber: syz [ 2282.537019][T14948] usb 9-1: New USB device found, idVendor=0fe9, idProduct=db55, bcdDevice=69.fb [ 2282.541088][T14948] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=201 [ 2282.545547][T14948] usb 9-1: Product: syz [ 2282.547999][T14948] usb 9-1: Manufacturer: syz [ 2282.550373][T14948] usb 9-1: SerialNumber: syz [ 2282.555805][T14948] usb 9-1: config 0 descriptor?? [ 2282.785597][T12649] netlink: 'syz.4.10067': attribute type 3 has an invalid length. [ 2282.788363][T12649] netlink: 224 bytes leftover after parsing attributes in process `syz.4.10067'. [ 2282.794930][ T9682] usb 9-1: USB disconnect, device number 12 [ 2282.830863][T12656] binder: 12655:12656 ioctl c0189371 80000440 returned -22 [ 2282.944684][ T1441] ieee802154 phy1 wpan1: encryption failed: -22 [ 2282.982102][ T672] legousbtower 7-1:14.57: interrupt endpoints not found [ 2284.042113][ T672] legousbtower 7-1:14.228: get version request failed: -71 [ 2284.326480][T12671] syzkaller0: entered promiscuous mode [ 2284.329130][T12671] syzkaller0: entered allmulticast mode [ 2284.390428][ T672] legousbtower 7-1:14.228: probe with driver legousbtower failed with error -71 [ 2284.407546][ T672] usb 7-1: USB disconnect, device number 40 [ 2284.982168][ T1356] usb 9-1: new high-speed USB device number 13 using dummy_hcd [ 2285.132123][ T1356] usb 9-1: Using ep0 maxpacket: 32 [ 2285.137221][ T1356] usb 9-1: unable to get BOS descriptor or descriptor too short [ 2285.141347][ T1356] usb 9-1: config 14 has an invalid interface number: 57 but max is 1 [ 2285.145785][ T1356] usb 9-1: config 14 has an invalid interface number: 228 but max is 1 [ 2285.148584][ T1356] usb 9-1: config 14 has no interface number 0 [ 2285.151001][ T1356] usb 9-1: config 14 has no interface number 1 [ 2285.154117][ T1356] usb 9-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 2285.158230][ T1356] usb 9-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0x1B, changing to 0xB [ 2285.163373][ T1356] usb 9-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 2285.167333][ T1356] usb 9-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 2285.170870][ T1356] usb 9-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 2285.174749][ T1356] usb 9-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 0, changing to 7 [ 2285.178218][ T1356] usb 9-1: config 14 interface 228 altsetting 5 endpoint 0x9 has invalid wMaxPacketSize 0 [ 2285.181296][ T1356] usb 9-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 2285.185770][ T1356] usb 9-1: config 14 interface 57 has no altsetting 0 [ 2285.187966][ T1356] usb 9-1: config 14 interface 228 has no altsetting 0 [ 2285.191716][ T1356] usb 9-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 2285.194778][ T1356] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2285.197343][ T1356] usb 9-1: Product: syz [ 2285.198658][ T1356] usb 9-1: Manufacturer: syz [ 2285.200165][ T1356] usb 9-1: SerialNumber: syz [ 2285.623170][ T1356] legousbtower 9-1:14.57: interrupt endpoints not found [ 2287.255219][T12706] netlink: 8 bytes leftover after parsing attributes in process `syz.2.10082'. [ 2287.548119][ T1356] legousbtower 9-1:14.228: get version request failed: -71 [ 2287.550938][ T1356] legousbtower 9-1:14.228: probe with driver legousbtower failed with error -71 [ 2287.560171][ T1356] usb 9-1: USB disconnect, device number 13 [ 2290.742066][ T9682] usb 10-1: new high-speed USB device number 25 using dummy_hcd [ 2290.894090][ T9682] usb 10-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2290.899104][ T9682] usb 10-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2290.902124][ T5961] usb 7-1: new high-speed USB device number 41 using dummy_hcd [ 2290.904481][ T9682] usb 10-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2290.912212][ T9682] usb 10-1: New USB device found, idVendor=0fe9, idProduct=db55, bcdDevice=69.fb [ 2290.916584][ T9682] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=201 [ 2290.920180][ T9682] usb 10-1: Product: syz [ 2290.923826][ T9682] usb 10-1: Manufacturer: syz [ 2290.926074][ T9682] usb 10-1: SerialNumber: syz [ 2290.931037][ T9682] usb 10-1: config 0 descriptor?? [ 2291.163646][T12721] netlink: 'syz.5.10089': attribute type 3 has an invalid length. [ 2291.166508][T12721] netlink: 224 bytes leftover after parsing attributes in process `syz.5.10089'. [ 2291.180208][T17559] usb 10-1: USB disconnect, device number 25 [ 2291.191484][ T5961] usb 7-1: New USB device found, idVendor=0fe9, idProduct=db55, bcdDevice=69.fb [ 2291.199722][ T5961] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=201 [ 2291.204888][ T5961] usb 7-1: Product: syz [ 2291.206331][ T5961] usb 7-1: Manufacturer: syz [ 2291.207849][ T5961] usb 7-1: SerialNumber: syz [ 2291.218353][ T5961] usb 7-1: config 0 descriptor?? [ 2291.223615][ T5961] dvb-usb: found a 'DigitalNow DVB-T Dual USB' in warm state. [ 2291.226608][ T5961] dvb-usb: bulk message failed: -22 (2/0) [ 2291.231855][ T5961] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 2291.235913][ T5961] dvbdev: DVB: registering new adapter (DigitalNow DVB-T Dual USB) [ 2291.238453][ T5961] usb 7-1: media controller created [ 2291.255995][ T5961] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 2291.456528][T12729] netlink: 'syz.2.10088': attribute type 3 has an invalid length. [ 2291.463624][T12729] netlink: 224 bytes leftover after parsing attributes in process `syz.2.10088'. [ 2291.475304][ T5961] cxusb: set interface failed [ 2291.476859][ T5961] dvb-usb: bulk message failed: -22 (1/0) [ 2291.636733][ T5961] DVB: Unable to find symbol mt352_attach() [ 2291.639762][ T5961] dvb-usb: bulk message failed: -22 (5/0) [ 2291.641781][ T5961] zl10353_read_register: readreg error (reg=127, ret==-121) [ 2291.645524][ T5961] dvb-usb: no frontend was attached by 'DigitalNow DVB-T Dual USB' [ 2291.742423][ T5961] rc_core: IR keymap rc-dvico-mce not found [ 2291.746552][ T5961] Registered IR keymap rc-empty [ 2291.751048][ T5961] rc rc0: DigitalNow DVB-T Dual USB as /devices/platform/dummy_hcd.2/usb7/7-1/rc/rc0 [ 2291.761921][ T5961] input: DigitalNow DVB-T Dual USB as /devices/platform/dummy_hcd.2/usb7/7-1/rc/rc0/input321 [ 2291.779058][ T5961] dvb-usb: schedule remote query interval to 100 msecs. [ 2291.788311][ T5961] dvb-usb: DigitalNow DVB-T Dual USB successfully initialized and connected. [ 2291.805976][ T5961] usb 7-1: USB disconnect, device number 41 [ 2291.857925][ T5961] dvb-usb: DigitalNow DVB-T Dual USB successfully deinitialized and disconnected. [ 2292.553633][T12754] netlink: 8 bytes leftover after parsing attributes in process `syz.2.10096'. [ 2292.620053][T12752] syzkaller0: entered promiscuous mode [ 2292.623360][T12752] syzkaller0: entered allmulticast mode [ 2293.354456][T12777] netlink: 12 bytes leftover after parsing attributes in process `syz.6.10103'. [ 2293.758404][ T672] usb 11-1: new high-speed USB device number 26 using dummy_hcd [ 2293.957674][ T672] usb 11-1: New USB device found, idVendor=0fe9, idProduct=db55, bcdDevice=69.fb [ 2293.960630][ T672] usb 11-1: New USB device strings: Mfr=1, Product=2, SerialNumber=201 [ 2293.963272][ T672] usb 11-1: Product: syz [ 2293.964668][ T672] usb 11-1: Manufacturer: syz [ 2293.966136][ T672] usb 11-1: SerialNumber: syz [ 2293.980709][ T672] usb 11-1: config 0 descriptor?? [ 2293.994357][ T672] dvb-usb: found a 'DigitalNow DVB-T Dual USB' in warm state. [ 2293.996756][ T672] dvb-usb: bulk message failed: -22 (2/0) [ 2294.000852][ T672] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 2294.015195][ T672] dvbdev: DVB: registering new adapter (DigitalNow DVB-T Dual USB) [ 2294.017778][ T672] usb 11-1: media controller created [ 2294.036048][ T672] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 2294.214466][T12779] netlink: 'syz.6.10104': attribute type 3 has an invalid length. [ 2294.217781][T12779] netlink: 224 bytes leftover after parsing attributes in process `syz.6.10104'. [ 2296.809408][T12775] tipc: Started in network mode [ 2296.811679][T12775] tipc: Node identity , cluster identity 4711 [ 2296.813783][T12775] tipc: Failed to obtain node identity [ 2296.815930][T12775] tipc: Enabling of bearer rejected, failed to enable media [ 2296.831082][ T672] cxusb: set interface failed [ 2296.832677][ T672] dvb-usb: bulk message failed: -22 (1/0) [ 2296.867247][ T672] DVB: Unable to find symbol mt352_attach() [ 2296.884976][T12789] netlink: 8 bytes leftover after parsing attributes in process `syz.2.10107'. [ 2296.932296][ T672] dvb-usb: bulk message failed: -22 (5/0) [ 2297.451432][T12804] netlink: 12 bytes leftover after parsing attributes in process `syz.5.10112'. [ 2297.517661][ T672] zl10353_read_register: readreg error (reg=127, ret==-121) [ 2297.880484][ T672] dvb-usb: no frontend was attached by 'DigitalNow DVB-T Dual USB' [ 2297.942180][ T672] rc_core: IR keymap rc-dvico-mce not found [ 2297.944467][ T672] Registered IR keymap rc-empty [ 2297.947393][ T672] rc rc0: DigitalNow DVB-T Dual USB as /devices/platform/dummy_hcd.6/usb11/11-1/rc/rc0 [ 2297.952763][ T672] input: DigitalNow DVB-T Dual USB as /devices/platform/dummy_hcd.6/usb11/11-1/rc/rc0/input322 [ 2297.958483][ T672] dvb-usb: schedule remote query interval to 100 msecs. [ 2297.961393][ T672] dvb-usb: DigitalNow DVB-T Dual USB successfully initialized and connected. [ 2297.966521][ T672] usb 11-1: USB disconnect, device number 26 [ 2298.098350][ T672] dvb-usb: DigitalNow DVB-T Dual USB successfully deinitialized and disconnected. [ 2298.490020][T12816] netlink: 8 bytes leftover after parsing attributes in process `syz.6.10114'. [ 2298.493708][T12816] netlink: 12 bytes leftover after parsing attributes in process `syz.6.10114'. [ 2299.630574][T12828] loop5: detected capacity change from 0 to 1 [ 2299.634712][T12828] ldm_validate_privheads(): Disk read failed. [ 2299.637486][T12828] Dev loop5: unable to read RDB block 1 [ 2299.639917][T12828] loop5: AHDI p2 p3 [ 2299.641661][T12828] loop5: partition table partially beyond EOD, truncated [ 2299.645072][T12828] loop5: p3 start 335544320 is beyond EOD, truncated [ 2299.718141][T12830] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 2299.812264][T17559] usb 10-1: new high-speed USB device number 26 using dummy_hcd [ 2299.994386][T17559] usb 10-1: New USB device found, idVendor=0fe9, idProduct=db55, bcdDevice=69.fb [ 2300.006080][T17559] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=201 [ 2300.012469][T17559] usb 10-1: Product: syz [ 2300.018687][T17559] usb 10-1: Manufacturer: syz [ 2300.020912][T17559] usb 10-1: SerialNumber: syz [ 2300.032472][T17559] usb 10-1: config 0 descriptor?? [ 2300.042065][T17559] dvb-usb: found a 'DigitalNow DVB-T Dual USB' in warm state. [ 2300.060283][T17559] dvb-usb: bulk message failed: -22 (2/0) [ 2300.073849][T17559] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 2300.078971][T17559] dvbdev: DVB: registering new adapter (DigitalNow DVB-T Dual USB) [ 2300.090961][T17559] usb 10-1: media controller created [ 2300.104066][T17559] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 2300.270534][T12826] netlink: 'syz.5.10117': attribute type 3 has an invalid length. [ 2300.281233][T12826] netlink: 224 bytes leftover after parsing attributes in process `syz.5.10117'. [ 2300.308247][T17559] cxusb: set interface failed [ 2300.313543][T17559] dvb-usb: bulk message failed: -22 (1/0) [ 2300.447280][T17559] DVB: Unable to find symbol mt352_attach() [ 2300.450303][T17559] dvb-usb: bulk message failed: -22 (5/0) [ 2300.453615][T17559] zl10353_read_register: readreg error (reg=127, ret==-121) [ 2300.457109][T17559] dvb-usb: no frontend was attached by 'DigitalNow DVB-T Dual USB' [ 2300.562718][T17559] rc_core: IR keymap rc-dvico-mce not found [ 2300.568200][T17559] Registered IR keymap rc-empty [ 2300.571769][T17559] rc rc0: DigitalNow DVB-T Dual USB as /devices/platform/dummy_hcd.5/usb10/10-1/rc/rc0 [ 2300.586838][T17559] input: DigitalNow DVB-T Dual USB as /devices/platform/dummy_hcd.5/usb10/10-1/rc/rc0/input323 [ 2300.608438][T17559] dvb-usb: schedule remote query interval to 100 msecs. [ 2300.618157][T17559] dvb-usb: DigitalNow DVB-T Dual USB successfully initialized and connected. [ 2300.642253][T17559] usb 10-1: USB disconnect, device number 26 [ 2300.998276][T12839] lo speed is unknown, defaulting to 1000 [ 2301.104143][T17559] dvb-usb: DigitalNow DVB-T Dual USB successfully deinitialized and disconnected. [ 2301.708660][T12854] overlay: ./file0 is not a directory [ 2301.822649][T12858] random: crng reseeded on system resumption [ 2302.367673][T12861] netlink: 12 bytes leftover after parsing attributes in process `syz.5.10125'. [ 2303.518747][T12878] netlink: 8 bytes leftover after parsing attributes in process `syz.4.10130'. [ 2303.539615][T12879] netlink: 8 bytes leftover after parsing attributes in process `syz.2.10129'. [ 2303.543664][T12879] netlink: 12 bytes leftover after parsing attributes in process `syz.2.10129'. [ 2304.005881][ T42] audit: type=1804 audit(1783898064.366:513): pid=12888 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.4.10132" name="/newroot/550/file0/file0" dev="9p" ino=71827907 res=1 errno=0 [ 2304.062737][T12884] overlay: ./file0 is not a directory [ 2304.080733][T12890] netlink: 8 bytes leftover after parsing attributes in process `syz.6.10133'. [ 2304.085265][T12890] netlink: 12 bytes leftover after parsing attributes in process `syz.6.10133'. [ 2304.163383][ T9] usb 10-1: new high-speed USB device number 27 using dummy_hcd [ 2304.332524][ T9] usb 10-1: Using ep0 maxpacket: 16 [ 2304.343108][ T9] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 2304.357819][ T9] usb 10-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 2304.361098][ T9] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2304.364608][ T9] usb 10-1: Product: syz [ 2304.366445][ T9] usb 10-1: Manufacturer: syz [ 2304.368509][ T9] usb 10-1: SerialNumber: syz [ 2304.392145][ T9] usb 10-1: config 0 descriptor?? [ 2304.419853][ T9] em28xx 10-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 2304.423723][ T9] em28xx 10-1:0.0: DVB interface 0 found: bulk [ 2304.684104][T12897] random: crng reseeded on system resumption [ 2305.016847][T12902] misc userio: The device must be registered before sending interrupts [ 2305.098660][T12904] pim6reg: entered allmulticast mode [ 2305.105796][T12904] pim6reg: left allmulticast mode [ 2305.472502][T12909] syzkaller0: entered promiscuous mode [ 2305.482104][T12909] syzkaller0: entered allmulticast mode [ 2305.856970][ T9] em28xx 10-1:0.0: unknown em28xx chip ID (0) [ 2306.713974][ T9] em28xx 10-1:0.0: read from i2c device at 0xa0 failed with unknown error (status=69) [ 2306.722663][ T9] em28xx 10-1:0.0: board has no eeprom [ 2307.634674][T12915] netlink: 40 bytes leftover after parsing attributes in process `syz.4.10139'. [ 2307.817078][T12882] em28xx 10-1:0.0: writing to i2c device at 0xa failed (error=-5) [ 2307.872492][ T9] em28xx 10-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 2307.876192][ T9] em28xx 10-1:0.0: dvb set to bulk mode. [ 2307.878483][T11294] em28xx 10-1:0.0: Binding DVB extension [ 2308.207629][T11294] em28xx 10-1:0.0: Registering input extension [ 2308.254552][ T9] usb 10-1: USB disconnect, device number 27 [ 2308.337224][ T9] em28xx 10-1:0.0: Disconnecting em28xx [ 2308.339354][ T9] em28xx 10-1:0.0: Closing input extension [ 2308.479025][T12923] random: crng reseeded on system resumption [ 2308.627659][ T9] em28xx 10-1:0.0: Freeing device [ 2309.026067][T12929] overlay: ./file0 is not a directory [ 2309.914358][T17559] usb 7-1: new high-speed USB device number 42 using dummy_hcd [ 2310.062071][T17559] usb 7-1: Using ep0 maxpacket: 16 [ 2310.065817][T17559] usb 7-1: too many configurations: 123, using maximum allowed: 8 [ 2310.070218][T17559] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2310.075739][T17559] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2310.080378][T17559] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2310.085296][T17559] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2310.089358][T17559] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2310.093646][T17559] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2310.097920][T17559] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2310.112067][T17559] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2310.117852][T17559] usb 7-1: New USB device found, idVendor=05ac, idProduct=0244, bcdDevice= 0.00 [ 2310.121803][T17559] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=45 [ 2310.125527][T17559] usb 7-1: SerialNumber: syz [ 2310.134879][T17559] usb 7-1: config 0 descriptor?? [ 2310.145550][T17559] usbhid 7-1:0.0: couldn't find an input interrupt endpoint [ 2310.472691][T12931] netlink: 12 bytes leftover after parsing attributes in process `syz.2.10143'. [ 2310.833370][ T9] usb 7-1: USB disconnect, device number 42 [ 2311.047453][T12913] lo speed is unknown, defaulting to 1000 [ 2311.653991][ T42] audit: type=1804 audit(1783898072.006:514): pid=12945 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.10146" name="/newroot/404/file0/file0" dev="9p" ino=71827907 res=1 errno=0 [ 2311.781180][T12942] overlay: ./file0 is not a directory [ 2311.896918][T12950] netlink: 8 bytes leftover after parsing attributes in process `syz.6.10145'. [ 2311.904097][T12950] netlink: 12 bytes leftover after parsing attributes in process `syz.6.10145'. [ 2312.263382][T12954] random: crng reseeded on system resumption [ 2312.757614][T12964] overlay: ./file0 is not a directory [ 2312.948619][T12967] netlink: 8 bytes leftover after parsing attributes in process `syz.5.10154'. [ 2313.292113][ T672] usb 7-1: new high-speed USB device number 43 using dummy_hcd [ 2313.418699][T12981] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 2313.480976][ T672] usb 7-1: New USB device found, idVendor=0fe9, idProduct=db55, bcdDevice=69.fb [ 2313.489885][ T672] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=201 [ 2313.499935][ T672] usb 7-1: Product: syz [ 2313.501840][ T672] usb 7-1: Manufacturer: syz [ 2313.506718][ T672] usb 7-1: SerialNumber: syz [ 2313.516072][ T672] usb 7-1: config 0 descriptor?? [ 2313.525887][ T672] dvb-usb: found a 'DigitalNow DVB-T Dual USB' in warm state. [ 2313.530632][ T672] dvb-usb: bulk message failed: -22 (2/0) [ 2313.536924][T12980] overlay: ./file0 is not a directory [ 2313.538421][ T672] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 2313.544374][ T672] dvbdev: DVB: registering new adapter (DigitalNow DVB-T Dual USB) [ 2313.548749][ T672] usb 7-1: media controller created [ 2313.565524][ T672] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 2313.572864][ T42] audit: type=1804 audit(1783898073.886:515): pid=12980 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.4.10156" name="/newroot/554/file0/file0" dev="9p" ino=71827907 res=1 errno=0 [ 2313.742063][T12970] netlink: 'syz.2.10153': attribute type 3 has an invalid length. [ 2313.745492][T12970] netlink: 224 bytes leftover after parsing attributes in process `syz.2.10153'. [ 2313.759210][ T672] cxusb: set interface failed [ 2313.764100][ T672] dvb-usb: bulk message failed: -22 (1/0) [ 2313.793306][ T672] DVB: Unable to find symbol mt352_attach() [ 2313.796198][ T672] dvb-usb: bulk message failed: -22 (5/0) [ 2313.798872][ T672] zl10353_read_register: readreg error (reg=127, ret==-121) [ 2313.803743][ T672] dvb-usb: no frontend was attached by 'DigitalNow DVB-T Dual USB' [ 2313.863841][ T672] rc_core: IR keymap rc-dvico-mce not found [ 2313.866596][ T672] Registered IR keymap rc-empty [ 2313.870235][ T672] rc rc0: DigitalNow DVB-T Dual USB as /devices/platform/dummy_hcd.2/usb7/7-1/rc/rc0 [ 2313.879354][ T672] input: DigitalNow DVB-T Dual USB as /devices/platform/dummy_hcd.2/usb7/7-1/rc/rc0/input325 [ 2313.887759][ T672] dvb-usb: schedule remote query interval to 100 msecs. [ 2313.890857][ T672] dvb-usb: DigitalNow DVB-T Dual USB successfully initialized and connected. [ 2313.898783][ T672] usb 7-1: USB disconnect, device number 43 [ 2313.934897][ T672] dvb-usb: DigitalNow DVB-T Dual USB successfully deinitialized and disconnected. [ 2314.043739][T12986] netlink: 8 bytes leftover after parsing attributes in process `syz.4.10158'. [ 2314.447464][T12992] netlink: 8 bytes leftover after parsing attributes in process `syz.4.10161'. [ 2314.460887][T12993] loop5: detected capacity change from 0 to 1 [ 2314.471764][T12993] Dev loop5: unable to read RDB block 1 [ 2314.479575][T12993] loop5: AHDI p1 p2 p3 [ 2314.483438][T12993] loop5: partition table partially beyond EOD, truncated [ 2314.487207][T12993] loop5: p1 start 1818582900 is beyond EOD, truncated [ 2314.489939][T12993] loop5: p3 start 335544320 is beyond EOD, truncated [ 2314.626187][T12996] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 2314.655846][T12999] netlink: 8 bytes leftover after parsing attributes in process `syz.5.10159'. [ 2314.658649][T12999] netlink: 12 bytes leftover after parsing attributes in process `syz.5.10159'. [ 2315.092163][ T5961] usb 11-1: new high-speed USB device number 27 using dummy_hcd [ 2315.262754][ T5961] usb 11-1: Using ep0 maxpacket: 16 [ 2315.268793][ T5961] usb 11-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 2315.281599][ T5961] usb 11-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 2315.294349][ T5961] usb 11-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2315.303540][ T5961] usb 11-1: Product: syz [ 2315.313398][ T5961] usb 11-1: Manufacturer: syz [ 2315.319235][ T5961] usb 11-1: SerialNumber: syz [ 2315.340254][ T5961] usb 11-1: config 0 descriptor?? [ 2315.360613][ T5961] em28xx 11-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 2315.370443][ T5961] em28xx 11-1:0.0: DVB interface 0 found: bulk [ 2316.285379][ T5961] em28xx 11-1:0.0: unknown em28xx chip ID (0) [ 2316.474247][T13018] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 2316.806970][T13002] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future [ 2317.392228][ T5961] em28xx 11-1:0.0: read from i2c device at 0xa0 failed with unknown error (status=69) [ 2317.395493][ T5961] em28xx 11-1:0.0: board has no eeprom [ 2317.527314][T13025] loop5: detected capacity change from 0 to 1 [ 2317.536099][T13025] Dev loop5: unable to read RDB block 1 [ 2317.538348][T13025] loop5: AHDI p1 p2 p3 [ 2317.540292][T13025] loop5: partition table partially beyond EOD, truncated [ 2317.544695][T13025] loop5: p1 start 1818582900 is beyond EOD, truncated [ 2317.548272][T13025] loop5: p3 start 335544320 is beyond EOD, truncated [ 2317.893968][T13030] netlink: 8 bytes leftover after parsing attributes in process `syz.2.10172'. [ 2318.383779][T13039] netlink: 8 bytes leftover after parsing attributes in process `syz.2.10173'. [ 2318.388235][T13039] netlink: 12 bytes leftover after parsing attributes in process `syz.2.10173'. [ 2318.452019][T13002] em28xx 11-1:0.0: writing to i2c device at 0xa failed (error=-5) [ 2318.502175][ T5961] em28xx 11-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 2318.512222][ T5961] em28xx 11-1:0.0: dvb set to bulk mode. [ 2318.543241][ T55] em28xx 11-1:0.0: Binding DVB extension [ 2318.841445][ T55] em28xx 11-1:0.0: Registering input extension [ 2319.486623][T13048] lo speed is unknown, defaulting to 1000 [ 2319.700463][ T672] usb 11-1: USB disconnect, device number 27 [ 2319.708716][ T672] em28xx 11-1:0.0: Disconnecting em28xx [ 2319.716531][ T672] em28xx 11-1:0.0: Closing input extension [ 2319.775795][ T672] em28xx 11-1:0.0: Freeing device [ 2321.749123][T13063] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 2322.217176][T13069] netlink: 8 bytes leftover after parsing attributes in process `syz.2.10181'. [ 2322.723555][T13075] netlink: 8 bytes leftover after parsing attributes in process `syz.5.10182'. [ 2322.734397][T13075] netlink: 12 bytes leftover after parsing attributes in process `syz.5.10182'. [ 2322.747385][T13083] random: crng reseeded on system resumption [ 2322.941524][T13086] netlink: 'syz.4.10187': attribute type 3 has an invalid length. [ 2322.952046][T13086] netlink: 224 bytes leftover after parsing attributes in process `syz.4.10187'. [ 2323.827291][T13098] netlink: 40 bytes leftover after parsing attributes in process `syz.4.10189'. [ 2323.835680][T13097] netlink: 8 bytes leftover after parsing attributes in process `syz.2.10191'. [ 2324.046530][T13101] 9pnet_virtio: no channels available for device syz [ 2324.071563][T13101] overlayfs: conflicting lowerdir path [ 2324.130999][T13102] lo speed is unknown, defaulting to 1000 [ 2324.269502][T13105] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 2325.286105][T13119] netlink: 8 bytes leftover after parsing attributes in process `syz.5.10198'. [ 2325.445181][T13124] netlink: 8 bytes leftover after parsing attributes in process `syz.2.10199'. [ 2325.449110][T13124] netlink: 12 bytes leftover after parsing attributes in process `syz.2.10199'. [ 2325.663550][T13126] netlink: 8 bytes leftover after parsing attributes in process `syz.5.10200'. [ 2326.409789][T13136] overlay: ./file0 is not a directory [ 2326.624538][T13140] random: crng reseeded on system resumption [ 2327.017089][T13142] netlink: 8 bytes leftover after parsing attributes in process `syz.5.10205'. [ 2327.025610][T13142] netlink: 32 bytes leftover after parsing attributes in process `syz.5.10205'. [ 2327.540156][T13149] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 2327.652426][ T5961] libceph: connect (1)[c::]:6789 error -101 [ 2327.654825][ T5961] libceph: mon0 (1)[c::]:6789 connect error [ 2327.938602][T13152] ceph: No mds server is up or the cluster is laggy [ 2327.947567][ T5961] libceph: connect (1)[c::]:6789 error -101 [ 2327.962275][ T5961] libceph: mon0 (1)[c::]:6789 connect error [ 2328.678417][T13170] overlayfs: conflicting lowerdir path [ 2328.792072][ T5961] usb 9-1: new high-speed USB device number 14 using dummy_hcd [ 2328.835920][T13172] netlink: 8 bytes leftover after parsing attributes in process `syz.6.10211'. [ 2328.952325][ T5961] usb 9-1: Using ep0 maxpacket: 32 [ 2328.955823][ T5961] usb 9-1: unable to get BOS descriptor or descriptor too short [ 2328.959575][ T5961] usb 9-1: config 14 has an invalid interface number: 57 but max is 1 [ 2328.964772][ T5961] usb 9-1: config 14 has an invalid interface number: 228 but max is 1 [ 2328.967726][ T5961] usb 9-1: config 14 has no interface number 0 [ 2328.969739][ T5961] usb 9-1: config 14 has no interface number 1 [ 2328.971733][ T5961] usb 9-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 2328.978388][ T5961] usb 9-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0x1B, changing to 0xB [ 2328.983468][ T5961] usb 9-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 2328.987161][ T5961] usb 9-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 2328.990767][ T5961] usb 9-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 2328.994759][ T5961] usb 9-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 0, changing to 7 [ 2328.998220][ T5961] usb 9-1: config 14 interface 228 altsetting 5 endpoint 0x9 has invalid wMaxPacketSize 0 [ 2329.001419][ T5961] usb 9-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 2329.005830][ T5961] usb 9-1: config 14 interface 57 has no altsetting 0 [ 2329.007987][ T5961] usb 9-1: config 14 interface 228 has no altsetting 0 [ 2329.012504][ T5961] usb 9-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 2329.016495][ T5961] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2329.019149][ T5961] usb 9-1: Product: syz [ 2329.020487][ T5961] usb 9-1: Manufacturer: syz [ 2329.022280][ T5961] usb 9-1: SerialNumber: syz [ 2329.036997][T13177] overlay: ./file0 is not a directory [ 2329.202327][ T672] usb 7-1: new high-speed USB device number 44 using dummy_hcd [ 2329.323823][T13186] netlink: 40 bytes leftover after parsing attributes in process `syz.5.10214'. [ 2329.358909][ T672] usb 7-1: New USB device found, idVendor=0fe9, idProduct=db55, bcdDevice=69.fb [ 2329.362651][ T672] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=201 [ 2329.365435][ T672] usb 7-1: Product: syz [ 2329.367063][ T672] usb 7-1: Manufacturer: syz [ 2329.368636][ T672] usb 7-1: SerialNumber: syz [ 2329.372603][ T672] usb 7-1: config 0 descriptor?? [ 2329.381913][ T672] dvb-usb: found a 'DigitalNow DVB-T Dual USB' in warm state. [ 2329.385928][ T672] dvb-usb: bulk message failed: -22 (2/0) [ 2329.391419][ T672] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 2329.399502][ T672] dvbdev: DVB: registering new adapter (DigitalNow DVB-T Dual USB) [ 2329.406010][ T672] usb 7-1: media controller created [ 2329.425295][ T672] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 2329.450274][ T5961] legousbtower 9-1:14.57: interrupt endpoints not found [ 2329.601445][T13175] netlink: 'syz.2.10210': attribute type 3 has an invalid length. [ 2329.608556][T13175] netlink: 224 bytes leftover after parsing attributes in process `syz.2.10210'. [ 2329.627867][ T672] cxusb: set interface failed [ 2329.630055][ T672] dvb-usb: bulk message failed: -22 (1/0) [ 2329.673826][T13187] lo speed is unknown, defaulting to 1000 [ 2329.682108][ T672] DVB: Unable to find symbol mt352_attach() [ 2329.685198][ T672] dvb-usb: bulk message failed: -22 (5/0) [ 2329.690280][ T672] zl10353_read_register: readreg error (reg=127, ret==-121) [ 2329.697538][ T672] dvb-usb: no frontend was attached by 'DigitalNow DVB-T Dual USB' [ 2329.772147][ T672] rc_core: IR keymap rc-dvico-mce not found [ 2329.776705][ T672] Registered IR keymap rc-empty [ 2329.782498][ T672] rc rc0: DigitalNow DVB-T Dual USB as /devices/platform/dummy_hcd.2/usb7/7-1/rc/rc0 [ 2329.793106][ T672] input: DigitalNow DVB-T Dual USB as /devices/platform/dummy_hcd.2/usb7/7-1/rc/rc0/input328 [ 2329.803030][ T672] dvb-usb: schedule remote query interval to 100 msecs. [ 2329.807311][ T672] dvb-usb: DigitalNow DVB-T Dual USB successfully initialized and connected. [ 2329.823756][ T672] usb 7-1: USB disconnect, device number 44 [ 2329.841335][ T672] dvb-usb: DigitalNow DVB-T Dual USB successfully deinitialized and disconnected. [ 2330.053991][ T5961] legousbtower 9-1:14.228: get version request failed: -71 [ 2330.063365][ T5961] legousbtower 9-1:14.228: probe with driver legousbtower failed with error -71 [ 2330.088444][ T5961] usb 9-1: USB disconnect, device number 14 [ 2330.194041][T25207] usb 11-1: new high-speed USB device number 28 using dummy_hcd [ 2330.352043][T25207] usb 11-1: Using ep0 maxpacket: 16 [ 2330.360736][T25207] usb 11-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 2330.369904][T25207] usb 11-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 2330.375181][T25207] usb 11-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2330.377727][T25207] usb 11-1: Product: syz [ 2330.379436][T25207] usb 11-1: Manufacturer: syz [ 2330.381111][T25207] usb 11-1: SerialNumber: syz [ 2330.392540][T25207] usb 11-1: config 0 descriptor?? [ 2330.398743][T25207] em28xx 11-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 2330.403497][T25207] em28xx 11-1:0.0: DVB interface 0 found: bulk [ 2331.021150][T25207] em28xx 11-1:0.0: unknown em28xx chip ID (0) [ 2331.438507][T13193] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future [ 2331.479487][T13221] overlayfs: missing 'lowerdir' [ 2331.500366][T13221] random: crng reseeded on system resumption [ 2332.476580][T13218] lo speed is unknown, defaulting to 1000 [ 2332.860741][T13231] netlink: 12 bytes leftover after parsing attributes in process `syz.2.10224'. [ 2332.926322][T25207] em28xx 11-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 2332.934040][T25207] em28xx 11-1:0.0: board has no eeprom [ 2333.002144][T25207] em28xx 11-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 2333.005303][T25207] em28xx 11-1:0.0: dvb set to bulk mode. [ 2333.007567][ T672] em28xx 11-1:0.0: Binding DVB extension [ 2333.160244][ T672] em28xx 11-1:0.0: Registering input extension [ 2333.334864][ T5961] usb 11-1: USB disconnect, device number 28 [ 2333.349532][ T5961] em28xx 11-1:0.0: Disconnecting em28xx [ 2333.355858][ T5961] em28xx 11-1:0.0: Closing input extension [ 2333.386821][ T5961] em28xx 11-1:0.0: Freeing device [ 2333.404037][T13244] netlink: 20 bytes leftover after parsing attributes in process `syz.4.10226'. [ 2334.050448][T13255] lo speed is unknown, defaulting to 1000 [ 2334.052046][T17559] usb 10-1: new high-speed USB device number 28 using dummy_hcd [ 2334.233223][T17559] usb 10-1: New USB device found, idVendor=0fe9, idProduct=db55, bcdDevice=69.fb [ 2334.242227][T17559] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=201 [ 2334.251887][T17559] usb 10-1: Product: syz [ 2334.253868][T17559] usb 10-1: Manufacturer: syz [ 2334.255866][T17559] usb 10-1: SerialNumber: syz [ 2334.260371][T17559] usb 10-1: config 0 descriptor?? [ 2334.267897][T17559] dvb-usb: found a 'DigitalNow DVB-T Dual USB' in warm state. [ 2334.270530][T17559] dvb-usb: bulk message failed: -22 (2/0) [ 2334.275925][T17559] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 2334.280274][T17559] dvbdev: DVB: registering new adapter (DigitalNow DVB-T Dual USB) [ 2334.286631][T17559] usb 10-1: media controller created [ 2334.311215][T17559] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 2334.481751][T13252] netlink: 'syz.5.10230': attribute type 3 has an invalid length. [ 2334.485389][T13252] netlink: 224 bytes leftover after parsing attributes in process `syz.5.10230'. [ 2334.587387][T17559] cxusb: set interface failed [ 2334.589450][T17559] dvb-usb: bulk message failed: -22 (1/0) [ 2334.661472][T17559] DVB: Unable to find symbol mt352_attach() [ 2334.663710][T17559] dvb-usb: bulk message failed: -22 (5/0) [ 2334.665818][T17559] zl10353_read_register: readreg error (reg=127, ret==-121) [ 2334.668137][T17559] dvb-usb: no frontend was attached by 'DigitalNow DVB-T Dual USB' [ 2334.742123][ T5961] usb 11-1: new high-speed USB device number 29 using dummy_hcd [ 2334.746221][T17559] rc_core: IR keymap rc-dvico-mce not found [ 2334.750256][T17559] Registered IR keymap rc-empty [ 2334.754081][T17559] rc rc0: DigitalNow DVB-T Dual USB as /devices/platform/dummy_hcd.5/usb10/10-1/rc/rc0 [ 2334.759774][T17559] input: DigitalNow DVB-T Dual USB as /devices/platform/dummy_hcd.5/usb10/10-1/rc/rc0/input330 [ 2334.788773][T17559] dvb-usb: schedule remote query interval to 100 msecs. [ 2334.791712][T17559] dvb-usb: DigitalNow DVB-T Dual USB successfully initialized and connected. [ 2334.797765][T17559] usb 10-1: USB disconnect, device number 28 [ 2334.836070][T17559] dvb-usb: DigitalNow DVB-T Dual USB successfully deinitialized and disconnected. [ 2334.902515][ T5961] usb 11-1: Using ep0 maxpacket: 16 [ 2334.904875][ T5961] usb 11-1: too many configurations: 123, using maximum allowed: 8 [ 2334.908532][ T5961] usb 11-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2334.912828][ T5961] usb 11-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2334.917434][ T5961] usb 11-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2334.923402][ T5961] usb 11-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2334.927835][ T5961] usb 11-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2334.932480][ T5961] usb 11-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2334.936464][ T5961] usb 11-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2334.940414][ T5961] usb 11-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2334.944942][ T5961] usb 11-1: New USB device found, idVendor=05ac, idProduct=0244, bcdDevice= 0.00 [ 2334.947817][ T5961] usb 11-1: New USB device strings: Mfr=0, Product=0, SerialNumber=45 [ 2334.950401][ T5961] usb 11-1: SerialNumber: syz [ 2334.955154][ T5961] usb 11-1: config 0 descriptor?? [ 2334.978690][ T5961] input: bcm5974 as /devices/platform/dummy_hcd.6/usb11/11-1/11-1:0.0/input/input331 [ 2335.186011][T13267] netlink: 12 bytes leftover after parsing attributes in process `syz.6.10233'. [ 2335.248498][T13272] netlink: 'syz.5.10234': attribute type 3 has an invalid length. [ 2335.252496][T13272] netlink: 224 bytes leftover after parsing attributes in process `syz.5.10234'. [ 2335.594145][ T5137] bcm5974 11-1:0.0: could not read from device [ 2335.615072][T13276] random: crng reseeded on system resumption [ 2335.618217][ T5961] usb 11-1: USB disconnect, device number 29 [ 2335.968798][T13274] FAULT_INJECTION: forcing a failure. [ 2335.968798][T13274] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2335.982044][T13274] CPU: 1 UID: 0 PID: 13274 Comm: syz.2.10235 Tainted: G L syzkaller #0 PREEMPT(full) [ 2335.982066][T13274] Tainted: [L]=SOFTLOCKUP [ 2335.982070][T13274] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 2335.982078][T13274] Call Trace: [ 2335.982083][T13274] [ 2335.982088][T13274] dump_stack_lvl+0x100/0x190 [ 2335.982111][T13274] should_fail_ex.cold+0x5/0xa [ 2335.982127][T13274] _copy_from_user+0x2e/0xd0 [ 2335.982148][T13274] memdup_user+0x6b/0xe0 [ 2335.982164][T13274] strndup_user+0x78/0xe0 [ 2335.982176][T13274] __ia32_sys_mount+0x136/0x310 [ 2335.982191][T13274] ? __pfx___ia32_sys_mount+0x10/0x10 [ 2335.982203][T13274] ? ksys_write+0x1ac/0x250 [ 2335.982220][T13274] ? __pfx_ksys_write+0x10/0x10 [ 2335.982240][T13274] __do_fast_syscall_32+0xe7/0x970 [ 2335.982254][T13274] ? lockdep_hardirqs_on+0x78/0x100 [ 2335.982273][T13274] do_fast_syscall_32+0x32/0x70 [ 2335.982289][T13274] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 2335.982305][T13274] RIP: 0023:0xf6feefec [ 2335.982315][T13274] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 2335.982327][T13274] RSP: 002b:00000000f53dd50c EFLAGS: 00000292 ORIG_RAX: 0000000000000015 [ 2335.982340][T13274] RAX: ffffffffffffffda RBX: 0000000080000000 RCX: 0000000080000280 [ 2335.982347][T13274] RDX: 00000000800002c0 RSI: 0000000000000000 RDI: 0000000080000180 [ 2335.982354][T13274] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 2335.982360][T13274] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2335.982367][T13274] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 2335.982380][T13274] [ 2336.015322][T13280] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 2336.078495][T13282] netlink: 'syz.2.10238': attribute type 3 has an invalid length. [ 2336.081565][T13282] netlink: 224 bytes leftover after parsing attributes in process `syz.2.10238'. [ 2336.704701][T13292] random: crng reseeded on system resumption [ 2337.223256][T13303] 9pnet_virtio: no channels available for device syz [ 2337.274141][T13305] netlink: 'syz.6.10246': attribute type 3 has an invalid length. [ 2337.277402][T13305] netlink: 224 bytes leftover after parsing attributes in process `syz.6.10246'. [ 2338.212069][T17559] usb 11-1: new high-speed USB device number 30 using dummy_hcd [ 2338.362315][T17559] usb 11-1: Using ep0 maxpacket: 16 [ 2338.366713][T17559] usb 11-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 2338.376713][T17559] usb 11-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 2338.380704][T17559] usb 11-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2338.384445][T17559] usb 11-1: Product: syz [ 2338.386316][T17559] usb 11-1: Manufacturer: syz [ 2338.388407][T17559] usb 11-1: SerialNumber: syz [ 2338.397671][T17559] usb 11-1: config 0 descriptor?? [ 2338.412492][T17559] em28xx 11-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 2338.416880][T17559] em28xx 11-1:0.0: DVB interface 0 found: bulk [ 2338.537825][T13315] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 2338.541793][T13315] overlayfs: option "volatile" is meaningless in a non-upper mount, ignoring it. [ 2338.546811][T13315] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 2338.552710][T13315] random: crng reseeded on system resumption [ 2338.978678][T13322] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 2339.043864][T17559] em28xx 11-1:0.0: unknown em28xx chip ID (0) [ 2339.622457][T13313] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future [ 2339.839496][T17559] em28xx 11-1:0.0: read from i2c device at 0xa0 failed with unknown error (status=69) [ 2339.848381][T17559] em28xx 11-1:0.0: board has no eeprom [ 2340.424130][T13336] netlink: 32 bytes leftover after parsing attributes in process `syz.2.10254'. [ 2340.482051][ T34] usb 9-1: new high-speed USB device number 15 using dummy_hcd [ 2340.642115][ T34] usb 9-1: Using ep0 maxpacket: 32 [ 2340.646726][ T34] usb 9-1: unable to get BOS descriptor or descriptor too short [ 2340.650793][ T34] usb 9-1: config 14 has an invalid interface number: 57 but max is 1 [ 2340.654020][ T34] usb 9-1: config 14 has an invalid interface number: 228 but max is 1 [ 2340.656992][ T34] usb 9-1: config 14 has no interface number 0 [ 2340.659063][ T34] usb 9-1: config 14 has no interface number 1 [ 2340.661104][ T34] usb 9-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 2340.665135][ T34] usb 9-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0x1B, changing to 0xB [ 2340.669515][ T34] usb 9-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 2340.674269][ T34] usb 9-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 2340.678902][ T34] usb 9-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 2340.683607][ T34] usb 9-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 0, changing to 7 [ 2340.688079][ T34] usb 9-1: config 14 interface 228 altsetting 5 endpoint 0x9 has invalid wMaxPacketSize 0 [ 2340.692851][ T34] usb 9-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 2340.698198][ T34] usb 9-1: config 14 interface 57 has no altsetting 0 [ 2340.700954][ T34] usb 9-1: config 14 interface 228 has no altsetting 0 [ 2340.706719][ T34] usb 9-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 2340.709759][ T34] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2340.712481][ T34] usb 9-1: Product: syz [ 2340.713884][ T34] usb 9-1: Manufacturer: syz [ 2340.715435][ T34] usb 9-1: SerialNumber: syz [ 2340.939298][T13313] em28xx 11-1:0.0: writing to i2c device at 0xa failed (error=-5) [ 2340.992075][T17559] em28xx 11-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 2340.995637][T17559] em28xx 11-1:0.0: dvb set to bulk mode. [ 2341.005263][T17559] em28xx 11-1:0.0: Binding DVB extension [ 2341.122211][T17559] em28xx 11-1:0.0: Registering input extension [ 2341.133885][T13340] em28xx 11-1:0.0: writing to i2c device at 0x6 failed (error=-5) [ 2341.137320][ T34] legousbtower 9-1:14.57: interrupt endpoints not found [ 2341.200543][T13340] netlink: 'syz.2.10256': attribute type 3 has an invalid length. [ 2341.203514][T13340] netlink: 224 bytes leftover after parsing attributes in process `syz.2.10256'. [ 2341.747228][ T34] legousbtower 9-1:14.228: get version request failed: -71 [ 2341.749647][ T34] legousbtower 9-1:14.228: probe with driver legousbtower failed with error -71 [ 2341.758420][ T34] usb 9-1: USB disconnect, device number 15 [ 2341.865043][T13344] random: crng reseeded on system resumption [ 2341.925615][T13346] overlay: ./file0 is not a directory [ 2342.079108][ T34] usb 11-1: USB disconnect, device number 30 [ 2342.090310][ T34] em28xx 11-1:0.0: Disconnecting em28xx [ 2342.099476][ T34] em28xx 11-1:0.0: Closing input extension [ 2342.138851][ T34] em28xx 11-1:0.0: Freeing device [ 2342.254327][T13354] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 2342.413858][T11803] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 2342.430836][T11803] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 2342.435726][T11803] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 2342.441830][T11803] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 2342.460671][T11803] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 2342.831161][T13161] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2342.864107][T13358] lo speed is unknown, defaulting to 1000 [ 2343.086534][T13377] netlink: 32 bytes leftover after parsing attributes in process `syz.4.10264'. [ 2343.172165][T13161] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2343.670110][T13161] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2343.802407][T14948] usb 10-1: new high-speed USB device number 29 using dummy_hcd [ 2343.972267][T14948] usb 10-1: Using ep0 maxpacket: 16 [ 2343.979775][T14948] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 2343.989959][T14948] usb 10-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 2343.994135][T14948] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2344.001560][T14948] usb 10-1: Product: syz [ 2344.006655][T14948] usb 10-1: Manufacturer: syz [ 2344.015532][T14948] usb 10-1: SerialNumber: syz [ 2344.035501][T14948] usb 10-1: config 0 descriptor?? [ 2344.045543][T14948] em28xx 10-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 2344.060374][T14948] em28xx 10-1:0.0: DVB interface 0 found: bulk [ 2344.142002][T13358] bridge0: port 1(bridge_slave_0) entered blocking state [ 2344.152276][T13358] bridge0: port 1(bridge_slave_0) entered disabled state [ 2344.154813][T13358] bridge_slave_0: entered allmulticast mode [ 2344.160910][T13358] bridge_slave_0: entered promiscuous mode [ 2344.185897][T13358] bridge0: port 2(bridge_slave_1) entered blocking state [ 2344.202228][T13358] bridge0: port 2(bridge_slave_1) entered disabled state [ 2344.205280][T13358] bridge_slave_1: entered allmulticast mode [ 2344.209334][T13358] bridge_slave_1: entered promiscuous mode [ 2344.230993][T13358] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 2344.378419][ T1441] ieee802154 phy1 wpan1: encryption failed: -22 [ 2344.522229][T11803] Bluetooth: hci0: command tx timeout [ 2344.639229][T13161] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2344.655158][T14948] em28xx 10-1:0.0: unknown em28xx chip ID (0) [ 2344.655866][T13358] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 2344.700441][T13358] team0: Port device team_slave_0 added [ 2344.706106][T13358] team0: Port device team_slave_1 added [ 2344.731901][T13358] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 2344.739582][T13358] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2344.752560][T13358] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 2344.765036][T13358] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 2344.773425][T13358] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2344.790211][T13358] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 2344.903251][T13358] hsr_slave_0: entered promiscuous mode [ 2344.905514][T13358] hsr_slave_1: entered promiscuous mode [ 2344.907649][T13358] debugfs: 'hsr0' already exists in 'hsr' [ 2344.909751][T13358] Cannot create hsr debugfs directory [ 2345.273928][T13391] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future [ 2345.337739][T13161] vlan2: left allmulticast mode [ 2345.339340][T13161] bridge_slave_0: left allmulticast mode [ 2345.342551][T13161] vlan2: left promiscuous mode [ 2345.344481][T13161] bridge_slave_0: left promiscuous mode [ 2345.346505][T13161] bridge0: port 3(vlan2) entered disabled state [ 2345.787823][T14948] em28xx 10-1:0.0: read from i2c device at 0xa0 failed with unknown error (status=69) [ 2345.797102][T14948] em28xx 10-1:0.0: board has no eeprom [ 2346.268849][T13161] tipc: Disabling bearer [ 2346.332254][T13161] bond0 (unregistering): Released all slaves [ 2346.352523][T13161] bond1 (unregistering): Released all slaves [ 2346.374882][T13161] bond2 (unregistering): (slave veth5): Releasing active interface [ 2346.381162][T13161] bond2 (unregistering): Released all slaves [ 2346.441022][ T5454] 8021q: adding VLAN 0 to HW filter on device eth14 [ 2346.522385][T13161] tipc: Left network mode [ 2346.605982][T11803] Bluetooth: hci0: command tx timeout [ 2346.854891][T13391] em28xx 10-1:0.0: writing to i2c device at 0xa failed (error=-5) [ 2346.912569][T14948] em28xx 10-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 2346.929985][T14948] em28xx 10-1:0.0: dvb set to bulk mode. [ 2346.940901][T25207] em28xx 10-1:0.0: Binding DVB extension [ 2347.039196][T25207] kworker/2:4: page allocation failure: order:4, mode:0x40dc0(GFP_KERNEL|__GFP_ZERO|__GFP_COMP), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 2347.052281][T25207] CPU: 2 UID: 0 PID: 25207 Comm: kworker/2:4 Tainted: G L syzkaller #0 PREEMPT(full) [ 2347.052313][T25207] Tainted: [L]=SOFTLOCKUP [ 2347.052321][T25207] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 2347.052334][T25207] Workqueue: events request_module_async [ 2347.052426][T25207] Call Trace: [ 2347.052435][T25207] [ 2347.052444][T25207] dump_stack_lvl+0x100/0x190 [ 2347.052471][T25207] warn_alloc.cold+0x94/0xa8 [ 2347.052492][T25207] ? __pfx_warn_alloc+0x10/0x10 [ 2347.052512][T25207] ? find_held_lock+0x2b/0x80 [ 2347.052537][T25207] ? psi_memstall_leave+0x19c/0x360 [ 2347.052569][T25207] ? psi_memstall_leave+0x1eb/0x360 [ 2347.052592][T25207] ? lockdep_hardirqs_on+0x78/0x100 [ 2347.052630][T25207] __alloc_frozen_pages_noprof+0x159f/0x2dc0 [ 2347.052665][T25207] ? stack_trace_save+0x8e/0xc0 [ 2347.052690][T25207] ? __pfx_stack_trace_save+0x10/0x10 [ 2347.052713][T25207] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 2347.052733][T25207] ? stack_depot_save_flags+0x27/0x9d0 [ 2347.052765][T25207] ? stack_depot_save_flags+0x27/0x9d0 [ 2347.052794][T25207] ? kasan_save_stack+0x3f/0x50 [ 2347.052815][T25207] ? kasan_save_stack+0x30/0x50 [ 2347.052833][T25207] ? kasan_save_track+0x14/0x30 [ 2347.052854][T25207] ? __kasan_kmalloc+0xaa/0xb0 [ 2347.052875][T25207] ? usb_alloc_urb+0x66/0xa0 [ 2347.052939][T25207] ? em28xx_alloc_urbs+0x5fa/0xf60 [ 2347.052964][T25207] ? em28xx_dvb_init.cold+0x1f2/0x7391 [ 2347.052984][T25207] ? request_module_async+0x61/0x80 [ 2347.053011][T25207] ? process_one_work+0xa23/0x1940 [ 2347.053037][T25207] ? worker_thread+0x5ef/0xe50 [ 2347.053069][T25207] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 2347.053100][T25207] ? policy_nodemask+0xed/0x4f0 [ 2347.053127][T25207] alloc_pages_mpol+0x1fb/0x540 [ 2347.053154][T25207] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 2347.053190][T25207] ___kmalloc_large_node+0xe5/0x120 [ 2347.053216][T25207] __kmalloc_large_node_noprof+0x1c/0x70 [ 2347.053244][T25207] __kmalloc_noprof+0x5a1/0x820 [ 2347.053265][T25207] ? usb_alloc_urb+0x66/0xa0 [ 2347.053308][T25207] ? em28xx_alloc_urbs+0x655/0xf60 [ 2347.053338][T25207] em28xx_alloc_urbs+0x655/0xf60 [ 2347.053376][T25207] ? __pfx_em28xx_dvb_init+0x10/0x10 [ 2347.053402][T25207] em28xx_dvb_init.cold+0x1f2/0x7391 [ 2347.053426][T25207] ? lock_acquire+0x1b9/0x370 [ 2347.053453][T25207] ? __pfx_em28xx_dvb_init+0x10/0x10 [ 2347.053478][T25207] ? rcu_is_watching+0x12/0xc0 [ 2347.053502][T25207] ? trace_contention_end+0x126/0x160 [ 2347.053541][T25207] ? __mutex_lock+0x26d/0x1bd0 [ 2347.053563][T25207] ? em28xx_init_extension+0x2f/0x200 [ 2347.053590][T25207] ? register_lock_class+0x40/0x560 [ 2347.053616][T25207] ? do_raw_spin_lock+0x128/0x260 [ 2347.053636][T25207] ? em28xx_audio_init+0x132/0x1a0 [ 2347.053658][T25207] ? __pfx___mutex_lock+0x10/0x10 [ 2347.053677][T25207] ? __lock_acquire+0x49f/0x1a40 [ 2347.053703][T25207] ? em28xx_v4l2_init+0x89/0xb0 [ 2347.053725][T25207] ? do_raw_spin_unlock+0x145/0x1e0 [ 2347.053746][T25207] ? __pfx_em28xx_audio_init+0x10/0x10 [ 2347.053776][T25207] ? __pfx_em28xx_dvb_init+0x10/0x10 [ 2347.053799][T25207] em28xx_init_extension+0x13a/0x200 [ 2347.053833][T25207] request_module_async+0x61/0x80 [ 2347.053860][T25207] process_one_work+0xa23/0x1940 [ 2347.053919][T25207] ? __pfx_process_one_work+0x10/0x10 [ 2347.053958][T25207] ? __pfx_request_module_async+0x10/0x10 [ 2347.053989][T25207] worker_thread+0x5ef/0xe50 [ 2347.054024][T25207] ? kthread+0x13a/0x450 [ 2347.054045][T25207] ? __pfx_worker_thread+0x10/0x10 [ 2347.054068][T25207] kthread+0x370/0x450 [ 2347.054091][T25207] ? __pfx_kthread+0x10/0x10 [ 2347.054116][T25207] ret_from_fork+0x72b/0xd50 [ 2347.054143][T25207] ? __pfx_ret_from_fork+0x10/0x10 [ 2347.054163][T25207] ? __switch_to+0x800/0x10f0 [ 2347.054198][T25207] ? __pfx_kthread+0x10/0x10 [ 2347.054224][T25207] ret_from_fork_asm+0x1a/0x30 [ 2347.054261][T25207] [ 2347.056652][T25207] Mem-Info: [ 2347.197161][T25207] active_anon:3977 inactive_anon:2860 isolated_anon:0 [ 2347.197161][T25207] active_file:2408 inactive_file:7301 isolated_file:0 [ 2347.197161][T25207] unevictable:1768 dirty:26 writeback:0 [ 2347.197161][T25207] slab_reclaimable:15473 slab_unreclaimable:86139 [ 2347.197161][T25207] mapped:28795 shmem:6547 pagetables:1603 [ 2347.197161][T25207] sec_pagetables:399 bounce:0 [ 2347.197161][T25207] kernel_misc_reclaimable:0 [ 2347.197161][T25207] free:25496 free_pcp:493 free_cma:0 [ 2347.231565][T25207] Node 0 active_anon:24kB inactive_anon:20kB active_file:0kB inactive_file:12kB unevictable:3536kB isolated(anon):0kB isolated(file):0kB mapped:40kB dirty:0kB writeback:0kB shmem:3536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:7456kB pagetables:1788kB sec_pagetables:1248kB all_unreclaimable? yes Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 2347.244343][T25207] Node 1 active_anon:21384kB inactive_anon:5320kB active_file:9632kB inactive_file:29592kB unevictable:3536kB isolated(anon):0kB isolated(file):0kB mapped:113440kB dirty:104kB writeback:0kB shmem:22452kB shmem_thp:2048kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:8496kB pagetables:4624kB sec_pagetables:348kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 2347.255775][T25207] Node 0 DMA free:3676kB boost:2048kB min:2808kB low:2996kB high:3184kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2347.274201][T25207] lowmem_reserve[]: 0 280 280 280 280 [ 2347.276558][T25207] Node 0 DMA32 free:26180kB boost:28740kB min:41516kB low:44708kB high:47900kB reserved_highatomic:2048KB free_highatomic:80KB active_anon:24kB inactive_anon:20kB active_file:0kB inactive_file:12kB unevictable:3536kB writepending:0kB zspages:2060kB present:1032196kB managed:287116kB mlocked:0kB bounce:0kB free_pcp:340kB local_pcp:0kB free_cma:0kB [ 2347.298921][T25207] lowmem_reserve[]: 0 0 0 0 0 [ 2347.302330][T25207] Node 1 DMA32 free:72044kB boost:24576kB min:71716kB low:83500kB high:95284kB reserved_highatomic:0KB free_highatomic:0KB active_anon:21784kB inactive_anon:5320kB active_file:9632kB inactive_file:28992kB unevictable:3536kB writepending:104kB zspages:4636kB present:1048432kB managed:948212kB mlocked:0kB bounce:0kB free_pcp:2476kB local_pcp:844kB free_cma:0kB [ 2347.348538][T25207] lowmem_reserve[]: 0 0 0 0 0 [ 2347.352447][T25207] Node 0 DMA: 191*4kB (U) 40*8kB (U) 10*16kB (U) 18*32kB (U) 11*64kB (U) 3*128kB (U) 1*256kB (U) 1*512kB (U) 0*1024kB 0*2048kB 0*4096kB = 3676kB [ 2347.358318][T25207] Node 0 DMA32: 954*4kB (UME) 314*8kB (UMEH) 65*16kB (UME) 71*32kB (UMEH) 37*64kB (UME) 17*128kB (UME) 7*256kB (UM) 2*512kB (UM) 3*1024kB (UM) 3*2048kB (M) 0*4096kB = 26216kB [ 2347.369780][T25207] Node 1 DMA32: 576*4kB (UE) 478*8kB (UME) 259*16kB (UME) 423*32kB (UME) 148*64kB (UME) 102*128kB (UM) 33*256kB (UM) 31*512kB (U) 0*1024kB 0*2048kB 0*4096kB = 70656kB [ 2347.384028][T25207] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 2347.391238][T25207] Node 0 hugepages_total=1 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 2347.398021][T25207] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 2347.403821][T13161] hsr_slave_0: left promiscuous mode [ 2347.409720][T25207] Node 1 hugepages_total=3 hugepages_free=3 hugepages_surp=0 hugepages_size=2048kB [ 2347.415788][T25207] 18315 total pagecache pages [ 2347.417317][T25207] 1365 pages in swap cache [ 2347.417542][T13161] hsr_slave_1: left promiscuous mode [ 2347.418654][T25207] Free swap = 74576kB [ 2347.418661][T25207] Total swap = 124996kB [ 2347.424057][T25207] 524155 pages RAM [ 2347.425286][T25207] 0 pages HighMem/MovableOnly [ 2347.427317][T25207] 211483 pages reserved [ 2347.428620][T25207] 0 pages cma reserved [ 2347.432656][T25207] ------------[ cut here ]------------ [ 2347.434346][T25207] !PageLargeKmalloc(page) [ 2347.434356][T25207] WARNING: mm/slub.c:6630 at free_large_kmalloc+0xbf/0x100, CPU#2: kworker/2:4/25207 [ 2347.457376][T25207] Modules linked in: [ 2347.459557][T25207] CPU: 2 UID: 0 PID: 25207 Comm: kworker/2:4 Tainted: G L syzkaller #0 PREEMPT(full) [ 2347.463224][T25207] Tainted: [L]=SOFTLOCKUP [ 2347.464997][T25207] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 2347.468632][T25207] Workqueue: events request_module_async [ 2347.470762][T25207] RIP: 0010:free_large_kmalloc+0xbf/0x100 [ 2347.473036][T25207] Code: 28 90 0f 0b 90 80 3d 82 f0 9d 0e 00 0f 84 87 0b b8 fe 48 8b 74 24 28 48 89 ef e8 9c 3b 0c 00 b8 00 f0 ff ff 45 31 ed eb 9d 90 <0f> 0b 90 48 83 c4 08 48 89 df 48 c7 c6 52 17 19 8e 5b 5d 41 5c 41 [ 2347.478935][T25207] RSP: 0018:ffffc90020a07818 EFLAGS: 00010293 [ 2347.480819][T25207] RAX: 00000000000000f0 RBX: ffffea0001859400 RCX: 000000000000002e [ 2347.483408][T25207] RDX: 0000000000000000 RSI: ffff888061650000 RDI: ffffea0001859400 [ 2347.485879][T25207] RBP: ffff888061650000 R08: 0000000000000005 R09: 0000000000000000 [ 2347.488339][T25207] R10: ffffffffffffffff R11: dffffc0000000000 R12: ffff888051c35e98 [ 2347.490988][T25207] R13: ffff888053466b00 R14: dffffc0000000000 R15: ffffed100a386bd5 [ 2347.493416][T25207] FS: 0000000000000000(0000) GS:ffff888096df2000(0000) knlGS:0000000000000000 [ 2347.496081][T25207] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 2347.498005][T25207] CR2: 00000000f7351a60 CR3: 0000000024621000 CR4: 0000000000352ef0 [ 2347.500401][T25207] Call Trace: [ 2347.501406][T25207] [ 2347.502402][T25207] usb_free_urb.part.0+0xf8/0x110 [ 2347.504421][T25207] usb_free_urb+0x1f/0x30 [ 2347.506142][T25207] em28xx_uninit_usb_xfer+0xf3/0x360 [ 2347.508076][T25207] em28xx_alloc_urbs+0xb43/0xf60 [ 2347.510243][T25207] ? __pfx_em28xx_dvb_init+0x10/0x10 [ 2347.512610][T25207] em28xx_dvb_init.cold+0x1f2/0x7391 [ 2347.514989][T25207] ? lock_acquire+0x1b9/0x370 [ 2347.516854][T25207] ? __pfx_em28xx_dvb_init+0x10/0x10 [ 2347.518920][T25207] ? rcu_is_watching+0x12/0xc0 [ 2347.520775][T25207] ? trace_contention_end+0x126/0x160 [ 2347.523230][T25207] ? __mutex_lock+0x26d/0x1bd0 [ 2347.525157][T25207] ? em28xx_init_extension+0x2f/0x200 [ 2347.527307][T25207] ? register_lock_class+0x40/0x560 [ 2347.529283][T25207] ? do_raw_spin_lock+0x128/0x260 [ 2347.531231][T25207] ? em28xx_audio_init+0x132/0x1a0 [ 2347.533279][T25207] ? __pfx___mutex_lock+0x10/0x10 [ 2347.535324][T25207] ? __lock_acquire+0x49f/0x1a40 [ 2347.537316][T25207] ? em28xx_v4l2_init+0x89/0xb0 [ 2347.539223][T25207] ? do_raw_spin_unlock+0x145/0x1e0 [ 2347.541736][T25207] ? __pfx_em28xx_audio_init+0x10/0x10 [ 2347.544047][T25207] ? __pfx_em28xx_dvb_init+0x10/0x10 [ 2347.546142][T25207] em28xx_init_extension+0x13a/0x200 [ 2347.548168][T25207] request_module_async+0x61/0x80 [ 2347.550140][T25207] process_one_work+0xa23/0x1940 [ 2347.552222][T25207] ? __pfx_process_one_work+0x10/0x10 [ 2347.554374][T25207] ? __pfx_request_module_async+0x10/0x10 [ 2347.556545][T25207] worker_thread+0x5ef/0xe50 [ 2347.558451][T25207] ? kthread+0x13a/0x450 [ 2347.560090][T25207] ? __pfx_worker_thread+0x10/0x10 [ 2347.562156][T25207] kthread+0x370/0x450 [ 2347.563781][T25207] ? __pfx_kthread+0x10/0x10 [ 2347.565602][T25207] ret_from_fork+0x72b/0xd50 [ 2347.567392][T25207] ? __pfx_ret_from_fork+0x10/0x10 [ 2347.569374][T25207] ? __switch_to+0x800/0x10f0 [ 2347.571241][T25207] ? __pfx_kthread+0x10/0x10 [ 2347.573151][T25207] ret_from_fork_asm+0x1a/0x30 [ 2347.575124][T25207] [ 2347.576370][T25207] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 2347.579206][T25207] CPU: 2 UID: 0 PID: 25207 Comm: kworker/2:4 Tainted: G L syzkaller #0 PREEMPT(full) [ 2347.583337][T25207] Tainted: [L]=SOFTLOCKUP [ 2347.585039][T25207] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 2347.588879][T25207] Workqueue: events request_module_async [ 2347.591091][T25207] Call Trace: [ 2347.592382][T25207] [ 2347.593531][T25207] dump_stack_lvl+0x100/0x190 [ 2347.595422][T25207] vpanic+0x552/0x970 [ 2347.596979][T25207] ? __pfx_vpanic+0x10/0x10 [ 2347.598766][T25207] panic+0xd1/0xe0 [ 2347.600283][T25207] ? __pfx_panic+0x10/0x10 [ 2347.602073][T25207] ? check_panic_on_warn+0x1f/0x90 [ 2347.604170][T25207] check_panic_on_warn.cold+0x19/0x34 [ 2347.606316][T25207] ? free_large_kmalloc+0xbf/0x100 [ 2347.608363][T25207] __warn.cold+0x191/0x318 [ 2347.610176][T25207] __report_bug+0x30f/0x440 [ 2347.611981][T25207] ? free_large_kmalloc+0xbf/0x100 [ 2347.614026][T25207] ? __pfx___report_bug+0x10/0x10 [ 2347.616017][T25207] ? lock_acquire+0x1b9/0x370 [ 2347.617934][T25207] ? find_held_lock+0x2b/0x80 [ 2347.619833][T25207] ? __free_one_page+0x109/0x10d0 [ 2347.621855][T25207] ? __free_one_page+0x109/0x10d0 [ 2347.623885][T25207] ? free_large_kmalloc+0xbf/0x100 [ 2347.626022][T25207] report_bug+0xb2/0x220 [ 2347.627747][T25207] ? free_large_kmalloc+0xbf/0x100 [ 2347.629803][T25207] handle_bug+0x16a/0x2a0 [ 2347.631632][T25207] exc_invalid_op+0x17/0x50 [ 2347.633467][T25207] asm_exc_invalid_op+0x1a/0x20 [ 2347.635454][T25207] RIP: 0010:free_large_kmalloc+0xbf/0x100 [ 2347.637731][T25207] Code: 28 90 0f 0b 90 80 3d 82 f0 9d 0e 00 0f 84 87 0b b8 fe 48 8b 74 24 28 48 89 ef e8 9c 3b 0c 00 b8 00 f0 ff ff 45 31 ed eb 9d 90 <0f> 0b 90 48 83 c4 08 48 89 df 48 c7 c6 52 17 19 8e 5b 5d 41 5c 41 [ 2347.645305][T25207] RSP: 0018:ffffc90020a07818 EFLAGS: 00010293 [ 2347.647714][T25207] RAX: 00000000000000f0 RBX: ffffea0001859400 RCX: 000000000000002e [ 2347.650833][T25207] RDX: 0000000000000000 RSI: ffff888061650000 RDI: ffffea0001859400 [ 2347.653780][T25207] RBP: ffff888061650000 R08: 0000000000000005 R09: 0000000000000000 [ 2347.656968][T25207] R10: ffffffffffffffff R11: dffffc0000000000 R12: ffff888051c35e98 [ 2347.660073][T25207] R13: ffff888053466b00 R14: dffffc0000000000 R15: ffffed100a386bd5 [ 2347.663097][T25207] usb_free_urb.part.0+0xf8/0x110 [ 2347.665096][T25207] usb_free_urb+0x1f/0x30 [ 2347.666788][T25207] em28xx_uninit_usb_xfer+0xf3/0x360 [ 2347.668779][T25207] em28xx_alloc_urbs+0xb43/0xf60 [ 2347.670751][T25207] ? __pfx_em28xx_dvb_init+0x10/0x10 [ 2347.672792][T25207] em28xx_dvb_init.cold+0x1f2/0x7391 [ 2347.674876][T25207] ? lock_acquire+0x1b9/0x370 [ 2347.676780][T25207] ? __pfx_em28xx_dvb_init+0x10/0x10 [ 2347.678894][T25207] ? rcu_is_watching+0x12/0xc0 [ 2347.680805][T25207] ? trace_contention_end+0x126/0x160 [ 2347.682949][T25207] ? __mutex_lock+0x26d/0x1bd0 [ 2347.684863][T25207] ? em28xx_init_extension+0x2f/0x200 [ 2347.687020][T25207] ? register_lock_class+0x40/0x560 [ 2347.689096][T25207] ? do_raw_spin_lock+0x128/0x260 [ 2347.691044][T25207] ? em28xx_audio_init+0x132/0x1a0 [ 2347.693024][T25207] ? __pfx___mutex_lock+0x10/0x10 [ 2347.695034][T25207] ? __lock_acquire+0x49f/0x1a40 [ 2347.696994][T25207] ? em28xx_v4l2_init+0x89/0xb0 [ 2347.698907][T25207] ? do_raw_spin_unlock+0x145/0x1e0 [ 2347.700948][T25207] ? __pfx_em28xx_audio_init+0x10/0x10 [ 2347.703047][T25207] ? __pfx_em28xx_dvb_init+0x10/0x10 [ 2347.705060][T25207] em28xx_init_extension+0x13a/0x200 [ 2347.707105][T25207] request_module_async+0x61/0x80 [ 2347.709030][T25207] process_one_work+0xa23/0x1940 [ 2347.710965][T25207] ? __pfx_process_one_work+0x10/0x10 [ 2347.713007][T25207] ? __pfx_request_module_async+0x10/0x10 [ 2347.715234][T25207] worker_thread+0x5ef/0xe50 [ 2347.717094][T25207] ? kthread+0x13a/0x450 [ 2347.718728][T25207] ? __pfx_worker_thread+0x10/0x10 [ 2347.720673][T25207] kthread+0x370/0x450 [ 2347.722261][T25207] ? __pfx_kthread+0x10/0x10 [ 2347.724040][T25207] ret_from_fork+0x72b/0xd50 [ 2347.725819][T25207] ? __pfx_ret_from_fork+0x10/0x10 [ 2347.727804][T25207] ? __switch_to+0x800/0x10f0 [ 2347.729667][T25207] ? __pfx_kthread+0x10/0x10 [ 2347.731466][T25207] ret_from_fork_asm+0x1a/0x30 [ 2347.733256][T25207] [ 2347.735145][T25207] Kernel Offset: disabled [ 2347.736801][T25207] Rebooting in 86400 seconds..