last executing test programs: 14m12.644704003s ago: executing program 1 (id=990): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=@newqdisc={0x34, 0x24, 0xd0f, 0x70bd29, 0x0, {0x60, 0x0, 0x0, 0x0, {}, {0xffe0, 0xa}, {0x1, 0x10}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x55}, 0x4000) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="280000001800090000000000000000001c140000fe000001000000000c0013"], 0x28}}, 0x0) syz_emit_ethernet(0x56, &(0x7f00000002c0)={@local, @link_local={0x3}, @void, {@ipv4={0x800, @tcp={{0xd, 0x4, 0x0, 0x0, 0x48, 0x65, 0x0, 0x0, 0x6, 0x0, @dev={0xac, 0x14, 0x14, 0x18}, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0xf, 0x8, [@multicast2, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @timestamp={0x44, 0xc, 0x5, 0x0, 0x0, [0x61, 0x7]}, @timestamp={0x44, 0x4}]}}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}, 0x0) syz_usb_connect(0x1, 0x2d, &(0x7f0000000340)=ANY=[@ANYBLOB="120100001ddf8208c007121522300000000109021b0001000000010904010001faf40d00090582239f"], 0x0) munmap(&(0x7f0000001000/0x4000)=nil, 0x4000) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000044082, 0x0) writev(r1, &(0x7f0000000800)=[{&(0x7f0000000e80)="b8336ce8a5202841ae02ea3c08e8d50d35aee99b56c23b4da5da17913bb9b3e311ffb048eeb74520d71218c9b35be0ca98753b71dd6bcc73b4aa146399e269ab8397c4a82d2182af4b0e12b349383464ece5b56af496e9af3f4411a2ab7013629fc3f6975f077c12256c6d4ae9f226aaffe5a578261681e0be270ea401e518c723c6872d887fcd4b2ddd04b6935f651f7d8b2749cc7f61742f5981dfe83dbb47f0f16e3e01f5587edce11308964d3dbd4dbffea0ceef934f52714378529c21ca7c8d3241be2405aa62e43fdaecc48df2a2ffd24a5f81243bb7962fc375c02bc889c5a47c94f0ef4cb0f15691565fcd2890bc2ab2cc19b637d619ef1aaa04dd4352a2df8535150ef7fc98cadcec179a1e9456790f285c10c871d69fecf3a96fffc9ad629cd7a57ece6a9fa7578c6623fd0562d1c787ac3ee48f56f177928edfc4222c1a0eac7a767b30264c3bef2a4b6446e2ce162be0bd6ccadc89b264aafae2d7e72c5992fb3993af42c4719c21979b3e75f94fd60356b8ba230350b06c088386e9e6f07f37903e53d165cea4fe7cccbd364b250646632dca799fc3e74ac99c585bc8746e15b5e9ccb3ba55d31c8ebbc42f383fcd06876f765834a2fb41578469e0cd0a7c04249adb3dec4ad648f05697cc3c66ac451e733a0b1c6833704945b6385a0d7cb85a6b8a2e16d70dfb3e0bce384ae27d8a7f21b7b2c68d428abc9d", 0x200}], 0x1) syz_open_dev$char_usb(0xc, 0xb4, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x2980eceb09db83dd}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x7c, 0x2, 0x6, 0x3, 0x0, 0x0, {0x3, 0x0, 0x5}, [@IPSET_ATTR_REVISION={0x5, 0x4, 0x3}, @IPSET_ATTR_DATA={0x34, 0x7, 0x0, 0x1, [@IPSET_ATTR_PORT_TO={0x6, 0x5, 0x1, 0x0, 0x4e21}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4e22}, @IPSET_ATTR_IP={0x18, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4e21}]}, @IPSET_ATTR_TYPENAME={0xc, 0x3, 'hash:ip\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x1}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4001040}, 0x20000080) r2 = syz_open_dev$video4linux(&(0x7f0000000500), 0x5, 0x2d22c1) ioctl$VIDIOC_UNSUBSCRIBE_EVENT(r2, 0x4020565b, &(0x7f0000000540)={0x2, 0x4}) setrlimit(0x9, &(0x7f00000004c0)={0x200, 0x40}) r3 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000000), 0x4) preadv(r3, &(0x7f00000001c0)=[{0x0}, {&(0x7f0000001b80)=""/4092, 0xffc}, {&(0x7f0000000040)=""/160, 0xa0}, {&(0x7f0000000100)=""/50, 0x32}, {&(0x7f0000000140)=""/112, 0x70}, {&(0x7f0000000380)=""/233, 0xe9}], 0x6, 0x80000001, 0xd54) 14m11.357350238s ago: executing program 1 (id=995): socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 32) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) (rerun: 32) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) (async) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) ioctl$VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, 0x0) (async, rerun: 32) munmap(&(0x7f0000002000/0x2000)=nil, 0x2000) (async, rerun: 32) r2 = syz_open_procfs$pagemap(0x0, &(0x7f0000000240)) ioctl$PAGEMAP_SCAN(r2, 0xc0606610, 0x0) r3 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) (async, rerun: 32) r5 = socket(0x400000000010, 0x3, 0x0) (rerun: 32) r6 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000140)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000001300)=@newtfilter={0x90, 0x2c, 0xd27, 0x30bd29, 0x21dfdbfc, {0x0, 0x0, 0x0, r7, {0x0, 0xf}, {}, {0xb}}, [@filter_kind_options=@f_u32={{0x8}, {0x64, 0x2, [@TCA_U32_SEL={0x54, 0x5, {0xe, 0x9, 0x5, 0x5, 0x7de, 0x74, 0xe, 0xdc, [{0x80000001, 0x2, 0x9, 0x1ff}, {0x38, 0x1, 0x4}, {0x9, 0xf12, 0x7f, 0xa}, {0x3, 0x1, 0x3, 0x3e}]}}, @TCA_U32_CLASSID={0x8, 0x1, {0x1, 0xffe0}}, @TCA_U32_POLICE={0x4}]}}]}, 0x90}, 0x1, 0x0, 0x0, 0x24000014}, 0x200c4004) (async) ioctl$VIDIOC_CREATE_BUFS(r3, 0xc100565c, &(0x7f0000000040)={0x0, 0xfff, 0x4, {0x9, @pix_mp={0x12, 0x5be7, 0xb5315258, 0x6, 0xb, [{0x80000004, 0x7}, {0x7ff, 0x5}, {0x10000001, 0x9}, {0x63d, 0x7fd}, {0x1, 0xb}, {0x7, 0x489aa92e}, {0x5}, {0xff, 0x7}], 0x1, 0xc, 0x2, 0x0, 0x3}}, 0xfffffffd}) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xb, 0x31, 0xffffffffffffffff, 0x0) r8 = syz_usb_connect(0x0, 0x2d, &(0x7f00000005c0)=ANY=[@ANYBLOB="12010000413f5f201d0650c16fce0102030109021b00010000100009043300011870fd0009058202"], 0x0) syz_usb_control_io$hid(r8, 0x0, 0x0) (async) r9 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x123f41, 0x0) write$binfmt_aout(r9, &(0x7f0000000280)=ANY=[], 0xff2e) (async, rerun: 32) ioctl$TCFLSH(r9, 0x540b, 0x1) (rerun: 32) syz_usb_ep_write$ath9k_ep1(r8, 0x82, 0xa8, &(0x7f0000000400)=ANY=[]) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) (async) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r10, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) (async) sendmsg$NFT_BATCH(r10, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a6c000000060a0b04000000000000000002000000400004803c0001800b00010065787468647200002c000280080004400000000408000740d400000508000640000000010500020000000000086c06dc14000340000000040900010073797a30000000000900020073797a320000000014000000110001000000000000000000"], 0x94}}, 0x0) 14m10.607782614s ago: executing program 1 (id=1000): r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x4, 0x11, r0, 0x100000000) r1 = socket$packet(0x11, 0x2, 0x300) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r2, 0x107, 0xf, &(0x7f0000000100)=0x9, 0x4) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'geneve0\x00', 0x0}) sendto$packet(r2, &(0x7f0000000180)="0b031407e0ff640f0200475400f6a13bb1000e00080008004803", 0x10000, 0x0, &(0x7f0000000140)={0x11, 0x0, r3}, 0x14) (fail_nth: 4) 14m10.370495748s ago: executing program 1 (id=1001): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x40000000015, 0x5, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x4000040, &(0x7f0000000000)={0xa, 0x4e20, 0x8, @ipv4={'\x00', '\xff\xff', @empty}, 0x20000092}, 0x71) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$VIDIOC_G_SELECTION(0xffffffffffffffff, 0xc040565e, &(0x7f0000000300)={0xe, 0x0, 0x0, {0x1, 0x6, 0x1, 0x80000000}}) r3 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00', 0x0}) r5 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r5, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0], 0x0, 0x0, 0x0) writev(0xffffffffffffffff, &(0x7f00000009c0)=[{&(0x7f0000000400)="1e8fcce8f00c20c3713b0c220663c3b66bb174e7d57d1fe72dbb0d27d9cbe1ec30047462375528c2c005a0ccd366c1ab0b8e5e0d788c178dbbdea330a90fa9e7c51a1aaf175a9d59559f29c09ff5e337e791be17c1ef703647852fe9e1b3ab3e6cd1c3b84b92c9822e232e0052c33bec0c49ee12b56b36e6c5be956e7791334289cd58966289930fe24f617b", 0x8c}, {&(0x7f0000000640)="146d7d1fe23f2a3821", 0x9}], 0x2) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x0) ioctl$KDSETLED(0xffffffffffffffff, 0x4b32, 0x9) r6 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r6, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, 0x0, 0x41) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x100000, 0x0) r7 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r7, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) sendmsg$nl_route(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)=ANY=[@ANYBLOB="3c000000110005002dbd70000003000007000000", @ANYRES32=r4, @ANYBLOB="01000000000000001c001a801800048014000680"], 0x3c}, 0x1, 0x0, 0x0, 0x1}, 0x0) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r2) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000001c0)={'wlan0\x00', 0x0}) openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x84042, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff0000/0xd000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000fec000/0x14000)=nil, &(0x7f0000fe9000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r10 = io_uring_setup(0x1c79, &(0x7f00000004c0)={0x0, 0xc8a1, 0xc000, 0x8, 0xc2}) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x8000000, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x2f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) io_uring_enter(r10, 0x2219, 0x7721, 0x16, 0x0, 0x0) sendmsg$NL80211_CMD_NEW_KEY(r2, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000200)={&(0x7f0000000380)={0x5c, r8, 0x8, 0x70bd29, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r9}, @val={0xc, 0x99, {0xffffff38, 0x67}}}}, [@NL80211_ATTR_KEY_DEFAULT_TYPES={0x24, 0x6e, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}]}, @NL80211_ATTR_KEY_TYPE={0x8, 0x37, 0x2}, @NL80211_ATTR_KEY_IDX={0x5, 0x8, 0x2}]}, 0x5c}, 0x1, 0x0, 0x0, 0xc1}, 0x2000c010) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'wlan1\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000040)={'batadv0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000b40)=ANY=[@ANYBLOB="4400000010000104000002000000000000000000", @ANYRES32=0x0, @ANYBLOB="9380000068820000140012800c0001006d616376746170000400028008000500", @ANYRES32=r11, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r12, @ANYBLOB], 0x44}, 0x1, 0x0, 0x0, 0x240008c4}, 0x4054) 14m9.480004986s ago: executing program 1 (id=1004): socket$nl_xfrm(0x10, 0x3, 0x6) socket$netlink(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x20140, 0x0) socket(0x400000000010, 0x3, 0x0) socket$unix(0x1, 0x5, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket(0x400000000010, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) socket$unix(0x1, 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$alg(0x26, 0x5, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000003c0)) syz_io_uring_setup(0x462, &(0x7f0000000280)={0x0, 0x40000020, 0x10, 0x2, 0x34f}, &(0x7f00000000c0)=0x0, &(0x7f0000000000)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_SENDMSG={0x9, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x54, 0x1}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r2 = dup(r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r2, 0x2000) mmap(&(0x7f0000003000/0x3000)=nil, 0x3000, 0x0, 0x2172, 0xffffffffffffffff, 0x0) r3 = syz_io_uring_setup(0xbdc, &(0x7f0000000280)={0x0, 0xec25, 0x4000, 0x3, 0x2b7}, &(0x7f00000006c0)=0x0, &(0x7f0000000400)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, &(0x7f0000000600)=[{&(0x7f0000001800)=""/216, 0xfffffe62}], 0x1}) io_uring_enter(r3, 0x47ba, 0x0, 0x28, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r0, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(aes)\x00'}, 0x58) accept$alg(r6, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) 14m9.112807552s ago: executing program 1 (id=1005): bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000780)=ANY=[@ANYBLOB="b700000081200000bfa30000000000000703000002feffff720af0fff8ffffff91a4f0ff000000006b030000000000001d400500000000004704000001ed000072030200000000001d44000000000000730a00fe000000007303000000000000b5000000000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f1ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c107571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f6f096753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c2571f983e9673560000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d1abf3cb17b40ac9b10968f38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e1661261173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b393cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd84990453f006694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a09313b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abae1cf01ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028ad0c74e2a9478fa3be18a1a2b65079cc1c7bc46dd12305a1ae9dd19e8d525206c0a728cfd42193abe8130bc01a2d61f3b39c64307f9c82b2807c9ff4a269841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ad1012fd7a8139166fd5e59c84f4ab279b1b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336d205c5913ef67a41b9e320146ee9f566a28"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xfffffffffffffd00}, 0x48) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x90, 0x0, 0x1, 0x401, 0x0, 0x0, {0x2}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x8, 0x2, @multicast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_FILTER={0x34, 0x19, 0x0, 0x1, [@CTA_FILTER_ORIG_FLAGS={0x8, 0x1, 0x40}, @CTA_FILTER_REPLY_FLAGS={0x8, 0x2, 0x402}, @CTA_FILTER_ORIG_FLAGS={0x8, 0x1, 0x200}, @CTA_FILTER_REPLY_FLAGS={0x8, 0x2, 0x812}, @CTA_FILTER_REPLY_FLAGS={0x8}, @CTA_FILTER_REPLY_FLAGS={0x8, 0x2, 0xadf0cffe3960a7a0}]}, @CTA_TIMEOUT={0x8}, @CTA_SYNPROXY={0x1c, 0x18, 0x0, 0x1, [@CTA_SYNPROXY_ITS={0x8}, @CTA_SYNPROXY_ISN={0x8}, @CTA_SYNPROXY_TSOFF={0x8}]}]}, 0x90}}, 0x0) 14m8.695795156s ago: executing program 32 (id=1005): bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000780)=ANY=[@ANYBLOB="b700000081200000bfa30000000000000703000002feffff720af0fff8ffffff91a4f0ff000000006b030000000000001d400500000000004704000001ed000072030200000000001d44000000000000730a00fe000000007303000000000000b5000000000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f1ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c107571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f6f096753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c2571f983e9673560000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d1abf3cb17b40ac9b10968f38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e1661261173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b393cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd84990453f006694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a09313b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abae1cf01ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028ad0c74e2a9478fa3be18a1a2b65079cc1c7bc46dd12305a1ae9dd19e8d525206c0a728cfd42193abe8130bc01a2d61f3b39c64307f9c82b2807c9ff4a269841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ad1012fd7a8139166fd5e59c84f4ab279b1b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336d205c5913ef67a41b9e320146ee9f566a28"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xfffffffffffffd00}, 0x48) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x90, 0x0, 0x1, 0x401, 0x0, 0x0, {0x2}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x8, 0x2, @multicast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_FILTER={0x34, 0x19, 0x0, 0x1, [@CTA_FILTER_ORIG_FLAGS={0x8, 0x1, 0x40}, @CTA_FILTER_REPLY_FLAGS={0x8, 0x2, 0x402}, @CTA_FILTER_ORIG_FLAGS={0x8, 0x1, 0x200}, @CTA_FILTER_REPLY_FLAGS={0x8, 0x2, 0x812}, @CTA_FILTER_REPLY_FLAGS={0x8}, @CTA_FILTER_REPLY_FLAGS={0x8, 0x2, 0xadf0cffe3960a7a0}]}, @CTA_TIMEOUT={0x8}, @CTA_SYNPROXY={0x1c, 0x18, 0x0, 0x1, [@CTA_SYNPROXY_ITS={0x8}, @CTA_SYNPROXY_ISN={0x8}, @CTA_SYNPROXY_TSOFF={0x8}]}]}, 0x90}}, 0x0) 13m49.224473939s ago: executing program 3 (id=1088): r0 = syz_open_procfs(0x0, &(0x7f0000000000)='ns\x00') r1 = socket$isdn(0x22, 0x3, 0x3) r2 = socket$packet(0x11, 0x3, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f0000000040)={'batadv0\x00', 0x0}) syz_emit_ethernet(0x2a, &(0x7f0000000100)=ANY=[@ANYBLOB="bbbbbbbbbbbb8a0a63cdec590806000108"], 0x0) sendto$packet(r2, &(0x7f0000000100)="f257a8ea7bc273dfaeab96850806", 0x2a, 0x0, &(0x7f0000000200)={0x11, 0x0, r3, 0x1, 0x0, 0x6, @link_local}, 0x14) r4 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_freeze_timeout', 0x82802, 0xf) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000600)='blkio.bfq.avg_queue_size\x00', 0x275a, 0x0) ioctl$VIDIOC_G_EXT_CTRLS(r0, 0xc0205647, &(0x7f0000000180)={0x9c0000, 0x8, 0x0, r4, 0x0, &(0x7f0000000140)={0x9c0001, 0x5, '\x00', @value=0x8}}) fcntl$lock(r5, 0x40f, &(0x7f0000000000)) sendto$isdn(r1, &(0x7f0000000040)={0x9, 0x2e, "87fb272ed2b793c969bc8c2b314c0dbf2919d00be563665b192e6c027294e9b47f305076ed8ba46a42ef7778f75b313c070fce50973230c9130c4ab8ae33992b44c811ed5411f2e4fcf696c480234565edc13543d6acf4ccbf33dc6db1fc38b27d452d1b84cb693801a20228ca410c83a12177aa362cbf8471987585a6c4590f49a3ba2bdf68bf743ad4f5a88933e33f084eebd02c"}, 0x9d, 0x34000090, 0x0, 0x0) name_to_handle_at(r0, &(0x7f0000000300)='./mnt\x00', &(0x7f0000000100)=ANY=[@ANYBLOB="280000004f00000084d600000000000000009dd17ded0000000000000100000000000000000000000000000001000000"], &(0x7f0000001500), 0x200) 13m49.033566885s ago: executing program 3 (id=1091): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000003005740ed0b0011c3ec000000010902120001000000000904"], 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000100)={0x2c, &(0x7f0000000440)=ANY=[@ANYBLOB="00000100000004"], 0x0, 0x0, 0x0, 0x0}) r1 = socket$netlink(0x10, 0x3, 0x10) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000300), 0x4) sendmsg$nl_netfilter(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)={0x14, 0x0, 0x1, 0x3, 0x70bd2a, 0x25dfdbfe, {0x1, 0x0, 0x7}}, 0x14}, 0x1, 0x0, 0x0, 0x80}, 0x20040040) syz_genetlink_get_family_id$devlink(&(0x7f0000000080), r1) mq_notify(0xffffffffffffffff, &(0x7f0000000000)={0x110c230000, 0x3, 0x2, @thr={0x0, 0x0}}) syz_usb_control_io(r0, 0x0, &(0x7f00000008c0)={0x84, &(0x7f00000002c0)={0x40, 0x93cbdfa27418ee13, 0xe, "f9ba220c4c93375f37405c9a93c9"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000003005740ed0b0011c3ec000000010902120001000000000904"], 0x0) (async) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000100)={0x2c, &(0x7f0000000440)=ANY=[@ANYBLOB="00000100000004"], 0x0, 0x0, 0x0, 0x0}) (async) socket$netlink(0x10, 0x3, 0x10) (async) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000300), 0x4) (async) sendmsg$nl_netfilter(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)={0x14, 0x0, 0x1, 0x3, 0x70bd2a, 0x25dfdbfe, {0x1, 0x0, 0x7}}, 0x14}, 0x1, 0x0, 0x0, 0x80}, 0x20040040) (async) syz_genetlink_get_family_id$devlink(&(0x7f0000000080), r1) (async) mq_notify(0xffffffffffffffff, &(0x7f0000000000)={0x110c230000, 0x3, 0x2, @thr={0x0, 0x0}}) (async) syz_usb_control_io(r0, 0x0, &(0x7f00000008c0)={0x84, &(0x7f00000002c0)={0x40, 0x93cbdfa27418ee13, 0xe, "f9ba220c4c93375f37405c9a93c9"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) 13m47.497472438s ago: executing program 3 (id=1094): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='&\x00\x00\x00\x00'], 0x50) ioctl$SIOCSIFHWADDR(r0, 0x8946, &(0x7f0000000040)={'veth0_vlan\x00', @random='\x00\x00\x00\x00\x00 '}) r1 = socket$qrtr(0x2a, 0x2, 0x0) connect$qrtr(r1, &(0x7f0000000000)={0x2a, 0x0, 0x2}, 0xc) bind$qrtr(r1, &(0x7f00000000c0)={0x2a, 0x1}, 0xc) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) r3 = syz_kvm_add_vcpu$x86(0x0, &(0x7f00000005c0)={0x0, &(0x7f0000000100)=[@cpuid={0x64, 0x18, {0x89, 0x200}}, @nested_amd_inject_event={0x180, 0x38, {0x1, 0x3b, 0x7, 0xf72, 0x2}}, @rdmsr={0x66, 0x18, {0x120c}}, @cpuid={0x64, 0x18, {0x6, 0xf14}}, @rdmsr={0x66, 0x18, {0x327}}, @nested_amd_vmcb_write_mask={0x17c, 0x38, {0x3, @save_area=0x5a5, 0x10001, 0x7, 0xcb}}, @nested_vmresume={0x130, 0x18, 0x1}, @nested_create_vm={0x12d, 0x18, 0x3}, @wr_crn={0x67, 0x20, {0x4, 0x4}}, @nested_load_syzos={0x136, 0x1a9, {0x1, 0x8, [@nested_amd_stgi={0x17e, 0x10}, @nested_amd_invlpga={0x17d, 0x20, {0x0, 0xf404}}, @nested_amd_invlpga={0x17d, 0x20, {0x801c000, 0x2e44}}, @code={0xa, 0x6f, {"b9800000c00f3235002000000f30c4e17d2b2026642699440f20c0350a000000440f22c048b802000000000000000f23d00f21f8352000000a0f23f826f20f7dd336420f78ad00280000470f01c4c4237d3959d72266430fc7b05c8c8844"}}, @nested_amd_vmcb_write_mask={0x17c, 0x38, {0x0, @save_area=0x467, 0xcc9, 0x8001, 0x7fffffffffffffff}}, @code={0xa, 0x62, {"c483897d3c4d0000000000430f01cb45f4c4a1ff70f1390f01c5460fc7a800000000410f30c744240000000000c744240279330000c7442406000000000f011c24c4c290f399f81c0000b9ee0b00000f32"}}, @wr_drn={0x68, 0x20, {0x2, 0x8}}, @nested_amd_clgi={0x17f, 0x10}]}}, @wr_crn={0x67, 0x20, {0x0, 0xffffffffffffffff}}, @set_irq_handler={0xc8, 0x20, {0x91, 0x2}}, @rdmsr={0x66, 0x18, {0x1ae}}, @nested_vmlaunch={0x12f, 0x18, 0x3}, @nested_amd_vmload={0x182, 0x18, 0x1}, @wr_drn={0x68, 0x20, {0x2, 0x6}}, @nested_amd_stgi={0x17e, 0x10}, @nested_load_code={0x12e, 0x80, {0x0, "66b8d1000f00d03e6567f3470f1efa66baf80cb894a9bc87ef66bafc0cb8e5180000efb8010000000f01d966ba2100ed66baf80cb85849068bef66bafc0c66ed0f1f00b961080000b882999c5abacc9947630f30b9800000c00f3235001000000f30c4e1fc537906"}}, @wr_drn={0x68, 0x20, {0x7, 0x800}}, @cpuid={0x64, 0x18, {0x4, 0xcc0}}, @rdmsr={0x66, 0x18, {0x2d9}}, @rdmsr={0x66, 0x18, {0x881}}, @enable_nested={0x12c, 0x18}, @nested_amd_invlpga={0x17d, 0x20, {0x41000, 0xb6ac}}, @nested_vmresume={0x130, 0x18}], 0x4b9}) ioctl$KVM_GET_STATS_FD_cpu(r3, 0xaece) setsockopt$inet_tcp_int(r2, 0x6, 0x6, &(0x7f0000000040)=0x24, 0x4) r4 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_GET_ASSOC_NUMBER(r4, 0x84, 0x1c, &(0x7f0000000080), &(0x7f00000000c0)=0x4) setsockopt$inet_int(r2, 0x0, 0xf, &(0x7f0000000000)=0x1001, 0x4) 13m47.292912417s ago: executing program 3 (id=1095): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000000180)={0x20, 0xff, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff, 0x2, 0x0, 0x93}, 0xe) r1 = syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0x3cfa, 0x0, 0x3, 0x8069}, &(0x7f0000000200)=0x0, &(0x7f0000000280)=0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) r5 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r5, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0], 0x0, 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000280)='./file0\x00', 0x0, 0x100000, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[]) r6 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r6, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x84000, 0x0) r7 = syz_open_procfs(0x0, &(0x7f00000000c0)='mountinfo\x00') sendfile(r7, r7, &(0x7f0000000000)=0x2eb4, 0x2000007ff) r8 = socket$kcm(0x10, 0x400000002, 0x0) write$cgroup_subtree(r8, &(0x7f00000003c0)=ANY=[@ANYBLOB="0007000042009103"], 0xfe33) recvmsg(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000004700)=""/4097, 0x1001}, {&(0x7f0000003700)=""/4064, 0xfe0}, {&(0x7f0000002500)=""/4137, 0x1029}, {&(0x7f0000000200)=""/110, 0x6e}, {&(0x7f00000005c0)=""/156, 0x9c}, {&(0x7f00000000c0)=""/171, 0xab}], 0x6}, 0x10100) ioctl$TCSETAW(0xffffffffffffffff, 0x5407, &(0x7f0000000100)={0x2, 0xff, 0x5, 0xf, 0x1a, "5011cb1a1e9f306c"}) r9 = openat$vimc1(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) ioctl$VIDIOC_DQBUF(r9, 0xc0585611, &(0x7f0000000540)=@multiplanar_mmap={0x5, 0xa, 0x4, 0x0, 0xfff, {}, {0x4, 0x0, 0x10, 0x4e, 0x81, 0xf, "b255d28a"}, 0x0, 0x1, {&(0x7f0000000340)=[{0x5, 0x9, {0x81}, 0x401}, {0xffff, 0x80000000, {0x4}, 0xec}]}, 0x5}) r10 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000040), 0x2a8300) ioctl$SNDRV_TIMER_IOCTL_SELECT(r10, 0x40345410, &(0x7f00000000c0)={{0xffffffffffffffff, 0x0, 0x5, 0x0, 0x2}}) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd=r0, 0x0, 0x0, 0x0, {0x2}, 0x1}) io_uring_enter(r1, 0x20047f6, 0xa511, 0xa, 0x0, 0x0) ioctl$int_in(r0, 0x5452, &(0x7f0000000280)=0xffffffffffffffff) sendto$inet6(r0, &(0x7f0000000300)="8b", 0x34000, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @private1}, 0x1c) shutdown(r0, 0x1) 13m46.30076485s ago: executing program 3 (id=1099): r0 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000580)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0xbc3d, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) write$RDMA_USER_CM_CMD_RESOLVE_IP(0xffffffffffffffff, 0x0, 0x0) r4 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000200), 0x100, 0x0) mount$fuse(0x0, 0x0, 0x0, 0x1802020, &(0x7f0000000340)=ANY=[]) getsockopt$netlink(0xffffffffffffffff, 0x10e, 0x7, &(0x7f0000000440)=""/76, 0x0) unshare(0xe060400) unshare(0x2c060000) ioctl$IOCTL_STATUS_ACCEL_DEV(r4, 0x40046103, 0x0) r5 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) r6 = fcntl$dupfd(r5, 0x0, r5) write$uinput_user_dev(r6, &(0x7f0000000180)={'syz1\x00', {0x10, 0x0, 0xfffb}, 0x9, [0xb86, 0x7, 0x4, 0x7, 0x7ff, 0x3, 0x5, 0x100000, 0x5, 0x4, 0x8, 0x3, 0x9, 0x1f, 0xc795, 0x8, 0x7fff, 0x10001, 0x4, 0x4, 0x1, 0x6, 0xa, 0x6, 0x1, 0x5, 0x0, 0xfb82, 0x3, 0x0, 0x0, 0x4, 0xd, 0x2, 0x2, 0x1, 0x0, 0xfffffffc, 0x400, 0x5, 0x9, 0x5, 0x2, 0x6, 0x0, 0x8, 0x7, 0x4, 0x1, 0xe8, 0x5, 0x7, 0x4, 0x2, 0x2f03132e, 0x0, 0x3, 0x9, 0x3, 0x0, 0x0, 0x0, 0xdf, 0x287f], [0x101, 0x31, 0x6, 0x7, 0x23e, 0x80000001, 0x40a1, 0xe, 0x3, 0x8, 0x9, 0x7f, 0x75, 0x8, 0x7fff, 0x2, 0x7f, 0x5, 0x73, 0x8, 0xffffffff, 0x1, 0x7ff, 0x4, 0x4d, 0x1, 0x0, 0x9, 0x0, 0x2, 0x8, 0xf, 0xd, 0x2, 0x2a, 0x8, 0x7, 0x3, 0x1, 0x8, 0x2, 0xfffffff0, 0x6, 0x8, 0x7cd, 0x8, 0x7, 0x3, 0xc6, 0x7, 0x9, 0x7, 0x10000, 0x6, 0x5, 0x0, 0x3, 0x4, 0x8, 0x0, 0x2, 0x0, 0x6], [0x0, 0x2, 0x1, 0x3, 0x9, 0x8001, 0x3, 0x3ea7, 0x6, 0xfffffff8, 0x9, 0x1, 0x700, 0xfffffffd, 0xfffffffa, 0xd, 0x7ff, 0x6, 0x80000, 0x7fffffff, 0x9, 0x48, 0x9, 0x6, 0x1, 0x9, 0x3, 0x709, 0x9, 0x9, 0x2, 0x7, 0xff, 0x7fffffff, 0x5, 0x6, 0x43cd, 0x5, 0xd, 0x8000, 0x4, 0x40, 0x7, 0x5, 0x8, 0x10001, 0x4, 0xffff89a3, 0x1000, 0x19, 0x9, 0xa59, 0x3ff, 0x1, 0x3, 0xfffffff5, 0x9, 0x2, 0x10000, 0x1d, 0x3, 0x4, 0x1, 0x1], [0x7, 0x8, 0x213, 0x789c, 0x40, 0x6, 0x1000, 0x8000, 0x2, 0x3, 0x2, 0x5, 0x7fffffff, 0xd, 0x6, 0x7, 0x8, 0xd, 0x7fffffff, 0x0, 0xffff, 0x0, 0x6, 0x7, 0x0, 0xda43, 0x2, 0x5, 0x14ac3b3b, 0x2, 0xb, 0x0, 0x2, 0x1, 0x1, 0x1000, 0x81, 0xff, 0xb6, 0x3, 0xffff, 0x10, 0xa114, 0x3, 0x6, 0x800, 0x4, 0x40, 0xfffffffb, 0x4, 0x0, 0xfffffff7, 0x7, 0x800, 0x0, 0x4, 0x5, 0x3, 0x2, 0x6, 0xe, 0x9a6, 0x5, 0xffffffff]}, 0x45c) ioctl$SG_GET_REQUEST_TABLE(r6, 0x2275, &(0x7f00000018c0)) (fail_nth: 1) r7 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) mount$fuse(0x0, 0x0, &(0x7f0000002100), 0x240017, &(0x7f0000000780)={{'fd', 0x3d, r7}, 0x2c, {'rootmode', 0x3d, 0xc000}}) read$FUSE(r7, &(0x7f0000004280)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r7, &(0x7f0000001dc0)={0x50, 0x0, r8, {0x7, 0x2b, 0x0, 0x28000440, 0x6, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}}, 0x50) syz_fuse_handle_req(r7, &(0x7f0000008e80)="0e24ac7705237246fc1db898fda0c7f95d375ea7f4bc7a07517a51095880f2219d9e4329f6c4e734f2bb34564a1c2e298d7eb8844d8af7b30e1a71750a2511e44b368fc6e9ae65e40e64e4b5fd3d0f87009b5727519df1ddbcbb38ef00871f00ed2543b7f2990a44482bf3d7478c3c2799dd8120fc3258cfeccf648fe15128c54d1d4272bfd44950915afd3aa0abb5b04d4dbec287df0816c3e43c2503cac6e95041aa205c5958f51a9c4c8214ae2108401b08ae7ff8440988c93424422f06c628077d767432521fefa0f8d0f387e685e4af54bdd7f931c3eace52ca7a6ba2d0fd701e5d77393e6268f52e68d97087f87edd2ae49180028bf08ab7e02c3ef12aec2f286d1bf40fd3a5f337b0f0b63d701c60bae36a5e1644bc90f34165049ac5c4fc8a0ada90e345df1420a58c92cfcc6973d3fa532b8b4088592e0f2c36f7e756139b272fc99104a93c5cf2599c683b60910af98a55b17bf646ddddb13e73d0bfdcfb3e3d261d84f83270832708f6e5b3fd2bb98e135b914e21681b409d717afa8f65dc9d3ab6a78b9b026b6aa1f1ee5872426b4bd4fd652072f86dfb96ef79649396a0f19239b0ce6ba9a8ff49f8f4820579a3169fe54b6f060a69236d57a1a13f033054fb22dbfb3f72861acc7ed51ebed60a8a03c3e16030e7a114d0690c268713d8206b34a005fb89d5123103d36ab57594fc731e8a6353ab3be3af22faa6f85b54ba78b90aba30e17dad90c31a20cc5f39c8ff50097bb310535efd6ecbc49dfc2d547bee78d5c5ebfe0d4bd3c093413e12cfefbfdb5f38c437ce831b209f3337979f6e0c46d8bf272a3ac6076c7940f905536167d2285d2a7d0e75f1765f0c080f1dfd9bae98afdfda7e7837d1081d83effab72e6eff493cc9031a299383f726227d75474e4c8378b2376fc7fef8b213b26794edc4c2fc110d917b863d25e7382b19b1b90cc90428f6aa0b1df015bcbbe83de36ff56c065ba92f1f49e61ac6bc6b3c20e42e7763dd52f66095f07e235f0062accb0eab60ce54d84391cbf2613096ded353543b5d6a884cc981b759e4499ab72881f88542208c9fd81b541514d6d2ed54683926b0d6bfe904b76215aea6db4cff8242d3ee5524acb456ec219e42d46c1b1e3fa9748404db4583537b195ad326853ed9472790656ab01bd031b19fb64b0e5227d18ea09ea7557c9afdc918c918a1fafdd18f9f54682bf0f49ba2ae14f963340dc6600e1b344ce50ed61af0726e3441583f8cf045df193dfbce93285d7fddfc0d831fefc85cd3e7920757f27a4e09b5cfa77b93a5e82f571d1293d9437cf89997011eee6ba9f9b7e6ce2fe1c381cb2db053a6e2d9351edbddcc10faf80f5b686727dd8982b12604fde3467f4a7e98b13250df7e1eef67da8f7fe3fffd3a185457aaaecb38f5ca31ea3e35cc7c6adc3873c734cb661e3c43e64bf0843b2cf1d950642eeb20d698cc9e598eb7ec71d3a0d83f311afa2d40a659a219defad76fdb7e8146756ff02a8a74abf8a8ccd72ffd7f70911698d54552aada8ef27b3f5b2644d4d0fda2976d838686a7469b296a98b67b7cc9834dc94f2292581dd242d1abb42db30d4de42c4611c0fbdc77134a6cb0c0d7b36d18a217aaabd34744ed5cac171e2a8bfe90b2dad03d0ca5f74d3eb95c454757be4c77f386c63fee91e95a508d8fcea5cd6bef9bd05e0b992da4e4cbc2f52c9cfde09b6f17f3d73fffc01d7ac55f328061516cf0e4fa50fff5b03dca67b163a68d9ddbb988f50a68fdbfc6e6feb6c892b58eb766d3429396669228dd1653bcbb5cb47c0857d27660e62d23e90178ef2b75713c2c58a207d8c21e9ce64556bfd71b40207ee76416f9f40c5601173b1d84105ac331247c021941a6a27e86de4f9a4db382f67dd6dc8e86a02a8438ddda1a636256fcac8e2328aaa3c054ab86f55c9d7bb2c2999a5c7933f092a3bf66523cb388052c65d138346ad1c5137fa383d7b9023b1868af02cf48923289162544db8fb29cf592c306a76ec92b35f33fae90f5aeac830b82dcc3f0069f668aebe6e5fe13c811f150de080632e357221d2f220ef95ce436730d1f9390d9f192220347d04ac5a94631e349ad330276b9524f775f7a8f68be7823ad7ed3ac4b4d87a12c0261846ec1dfe785b60675968e79496d7ae4e5d478661bd7125f2cc0de35422764556b63d687b339e2b25ad43ca85bc861944d19f9689dffe71d87030d23e0428942441d622de361778cbe8952f7b93c74783552b0087bff535afaf92935aa889018e46d34b2a258f863d89e4b6da841389fa63d489d135e559b7d11b8d97215323548501c275248eb07916ae3f0814c6af32f5ece7eb0330bdaac4394c518f3c8e48cafc36057cfa7788fb2f9a73bddb1d40546cf21b681e6c9ef6f0ac43c512762323209b2c878ed5a9f55e207b56a33c863eaa34a6eb14ad8de9885d52a7c073a406ea4324f8433ddfd89b269d6716072627054197928370ae01a94e3dd4d07125560a5cb1d1bfbbd8c099194de5f787a550a3400ce796e115702255d1f17d96a7fb63384ff497cf72beeb50bd24008ffc58256aec6b2faff2c20336e29bc1acd853214496893af25e8efb571c96edf64fbcd136c95e1213e73bc3f1a896fca2bde0894449ee2927c38114de5f1063d0c203c3fab1389861c4cda173a991eb275ccffe04f75d67df181c26777b18e5552b42fb4332046554109a9a6007592a62d2553dbd098f1daae593322e45f66a64bdb09869feede70d1fcc88fd4c19f4008d1b1d5f34a6025a71d9bf6ff20daccda25cbcc662cfc687ffe5ebc344468f338f4c9bbdc7ed9820feb5e3b09ace47f4253a81da7029816656613aef7456524fc68f4345bc0e7f26240d4594374d2fcb39560e2828e0e219b2417f5787add73418b465b1308d5ac5169791f55802d11354eb62940a492d955e8bd11b952a28acea90cb43af774e6fc75e57383e68937aa3643aa37f7e7665c703576579dcccf63d2bdadfbf14be796d4023689880453b0ff576fb01bb141be3c17478f0d555ca96ff7c3f3e4f53be1f088827203fab2008ec6687e4f5df305f58fe647b93ad09a70165c989498d313ca5ba05f3ce90adc80d55b56d0ec4cd5a78268cc6def7e8bb810bc29f8e742487048363815fa3fe645194ee8529ffba2b8d6756915530f142b42f31eae1703faeae14f3d81ae5c2297c3476b0f89b32f53802453fc74c80bf217097577a910a51860bbead4f73a29423816eadca7b1e2d24a9895949b352fe59f13abfa7b69c0f0061eaae2ada6d72b2f90c9c553ad8be9ee4e4ad2876851a3f3e979c4d770d7df9a27e72ab215ec3efd252d622e7ec6160ac951d1ee9b8c0adc0fc853f2a4f36602c955b61646246e07bd7b745f5d3e99f95f55a1616ed36633db6efa97a96dacf12219cf1555222cc6a589a6def5680124f7ac2f1ec83832a30fd011ff02dbf4ab01afb5989fcc678383f179b5d647cf0a762acf0714e9e4151afa39626884e6f56859d3aafc9fc7f7bbcfb27e038e238783cf56c86f0be52568c4bed0917d651f4d26f76ba6c343e075146504590da391e1c4d028dc81767294df5de9370d62756584baa3bfa31578b6f754e77b0d6ea7357d8915ff0bda182b604b014ecf7dc94ab97061765bfab2053fa863fb671fad3b6312d6e59ba0e70b0ea2476399e925f8fa2e51c9bbfac19aeb11db3dd6ea8d916c4d4eae7de17259e6155591be9b704d3e24cda131eded5e9dd6758dc90a5c7a43332957d26ac91bc65120b1c6b7b84fdf83b397bd8990747f01d3ed912abeab74bb5ae3ff2ee0009cfe8cdb6b4e75a7de3566c8ff7bdddb06b7775cf3116b029e7c85fb7189147e753d614caa490594ff2e22b7144153c635ac7b20a49c2d8575af2f546b968bea9fc4ee5ff417a6fa86ca09c8fed14ea4b721b2d5870d4b670761c70516daa07809ac3817246844f01eadda045c57d1c864cbaabedf90cb42d374392e77b3d1a1afdf962feb55a4e04a77c8fb452429007e0046a406a5f2325f0c7f75a19deed1b456ac5de6486eebbc126ff97c5ee8531a975676b61a0d79f56ff75cbcd20337119422815537a57766648777f1b5f75d358dc63764083406e2d95afd87d00099581940367ed029065df0d9008301fb92e019feac9bb406032167eb053ab07309385771aacc2c52a5d526d14721fd530e63cb7c53f27518c679ccd0f3d2db8aa52ef95c6ac3f5dac0b9b5c3a96a794690f3d49aa0e5a4a95b36609cf61d471cc2c0cd55e8cd96be47558b055280313b15907eba5761180f5229a59341faa1e11eb5b6a48ec9320efb1d9f00936d9a5d91f2bf837fe72edf6ec025c1c4e87171cc02c7342fa5d4f825157d70d8f66f6fa0542de2255373d8743612e7d4e16b8ceebf4e92c40926f21929cab343b981120236b8b0b900772a33bbe4eef06feff3c7b104cf63d92c7f9233982f9b713489fb8bf80f2feffd6c22007b63925209e158a837dc95b42d52ed764350b5f83ad54041bc15a7552c0b8c1933d674a16b0c0934277d9895c1ad01327231a7fffc4b5e1a1495489559bebff324d54f2894563a23b85d3bef62c356eb476e01e0c039287ca38626751f701ef4e20d951433940ce1138660589ff389dee9f85a7faebb9cc494bbe7138b413303af6e05806032d8131d5a25a5d7c0ed87906d92bdd87ce7d62c13989f3435ad77a29b721d8219d2cf530c2ec9edc3de9ce2dcd5053c38a6797de8d8cbd3596ed545d2dc6f825a0e65428dd73df96d5f3e40dbe5a62f0f440f712419d1558ef97bf1d0ca1d59fa1caf6ed0d422456848e196e94b4741b757935bc3aef3a46f53066dc7a74f42d539da2228fb8593ddb79ac977a8b67c0a6058efdbe23ba75fb2faf5b9f152e60b8a96ee19fbf0c417c89f882c53d389bf27a18b9e34b2a33aa27029cfed7a03335cf33d95ea803ad125237a9cc70520f18bc7e9f0c1432368a5304544f5d1e1599242bcd905f69f25cd0fcde391960fc57426e0bf22155ea315f0caee330bf3b7f4f4363f87146531175ad4f69002d46e95a48f714c9bbd9e39b95783406d477dabe03397d68e7af5ee623b4c05eb64120ca76af4f1d37348f93f39d8fa1d22fef874ce65b66f8a1aaff9db97520dab97eb8d1f99efef4d4c9704d181d687874ec4fbb400ed4ce050ac997c843e647bebeddc33eeb70201b3286ea25ad1bdb80dba1fc78a6883ecca84d17645be16bee32967bd487c6f5e0714ca819d5913436ac9aeeab4e5092ec1897dad39737365e8414246a81a731bf7d3ad8d789b42c651702b70ee786032356e3b9fc4402104ffbe55026c84e8ec5dd2a1860cefd0e7789ac2a47fa5ee9610dee980fa3c2fa7219b4e57642f31012b3e00e64285fda219fa9ca37955e3c25fd5872172ed2f5651d208897ed4e1d224243b2f241f24580e924e02cb60af5e14898028596400a770f94e67590df5fe99e9d170d061397f71f4202eca4c91c7fc27e2379358a8d9bfc28c2fb67842b0bd1e5e68e017b34084aa08e7453fc6b03bd42772643eae036f25f10e4da022818dc84f35eea2c07e4dbb41e861b8a4c6df4f0b4b785f0df55f863707a0563cdd5b9fcaa352b54071cd486cf4948575ddbe4654a566438922987a3bd304853a98283c7a4d7757cc6e8298b0121aca5fdb64d86996d8c0ddfa1ee4ccef1ee21dcf853bdb02471383f73ddae17dfef217c6a3f79b182fc36bdb47d1899e87bb4c4e490ad4a2724d223b31b889685355f349ca8bc62d39150ebccaba863bd72bf91d65cffe560eecf162b2440f9d74fe0fb3f8479fd8f6293f16e4d67b3ec30e83180444cec51d2b455a3ab2b6286d4fac1acba8b7b5026671fef497d5e050e0aa34dcecf2d06a9e4b60cdb3f9cbb7cadd73c817f255f8e2eb22d6283a7934e0fd64eaf52caab2d1862baf505889e4db1a1870f0049b3ada06d38af52535da352bedbf1e88e34595820cedd4559cbe0fe0578c557a62f56060d75c5a6806e384d3c274c218d57beecbd8e7832f3cc050668b44c1b8ff8cdcd2b85b5ecb9eca1dcc1204d27bc3689578eab43dac5658a1cfe75456b221c15ed26720a49829f96d501fda6d7839724207d6a5f6bb3d8390e90dd7c6b80e15e6b20b7c74ff3282c770eb1c77583fc97bdb5f2df62a74b3385e2e8ba06fc39730f1f02107477c215deb6c8599cdacc7c710b7b1a77afbe3b2a593f6eec5c8014dd366f5890a1a579e51d858cc8ef93aff098af9903b4e3633a3090a630e64be99f49d32d63d779f989d0198044717741d3bfab4242a05dae33f11ed6b1d850fb379f725fdb7b296d9d9b3024160d4fd735a77c8ab23f0816bfc2715a2561c3cee6e41cf79030c1500c09e75ebbd5a7aa8a0e4826542ad46a9350e969b357c142af13afdd8927cdce3d1f35493f6a7a14c5a20739d462d566fe3ab620f1ef323768bd871eb454dad947f2a871efa05d601cf9fb08d992caf6f4b0f652e13df7dfc658f50e0c9bfc3bf28114a51142f65e25435a32c8719fde2a3d5c4850e31ffa675fa44f9e54957d108e46a67a3b7d71b272ecb0385466e39238f6421b2fd6f33a258883a4501b63001ee9e0f9137162488051f7ff15e6f4be81ca31ffac70f48bcd3457fcb137a2f5108d908ba1d51b0fca7e14273b176af4b954837dc3d40b4341fd03063ee145dfc4456bb303bb0540db3aadb26240242f4a55cb9f6623b6e724e0f9d8b73d02c9fd9140873c0bb884e3cf4c844bad6f27388b56840b63d65ca760dbddf778e430e1f03c246e74e9b56a08a56617658f7fc42e3582f3181a720e51598d22062815ca3caebf36389a58278acc788035d8deb0b800180ef6537d92bfa18947cb18232bfd27e048fcd49d44c137f1d8a10294a6dd20251a00c379bb0936fcb5137c9f5a7a7404976c778912a37f1503deb27b85d3b1d886415a98348d3632c7eb4bf58fdfddd5b24407709474e4478c991a03ed8b456d9a71ec82f05791eb17425e0360493fb5ec343eba7e9c970f47f4cd85edda849cc524d42a11eaf29be950e621cd12e16e3a304516ce5c74a2b47a1baf1f3321b84318883bb023cb5f67dc3541a4d72ebb3316244f96cde4aebc1a77336a93d226c315ab02581123140e45373f40c8cfc7fb5d478607f9b38c2b95bcd55fb8a2047569ac7927b9e4208f75032abfe83442d2ca5db1ee8903888548b5fa9724520083052f8e652f1b0d39d031d2c61f63e5cfb98061b5b913dc6da26e690c85b07fa19b9bf83d124a5fcf96de21d9f00c9aaf2ec66580e4dd99c21c01b7557b7c6336cec525003157d3efdd16a52407b35225f65e44933d56c90dbeeffcfbe2b10bdd921a507592817043c88bab1882ac8863f8a73fed3310138ae56c9b5fb8aa22d5d6ab9e5ece2afb94c5054bdc8444b00a46d74716c21346f2dce31f180f3e01453d7a7aaf4200c4be278a2a88fbec4529a551189da822d1365c8ac70bd6c6cb3c3791e183eeba95e65f1f87c10b2f740bee2575807c486e3b7939f093d44693ac069089830afff26d7165712abb7ba5bf8aaa87a3d57c5670b3a45d707b87aa7689b18292d851cac59802b38bd7ab8e1c3b8a134db1a366aaa8f77a6e2c937f49961637d291970b4541e3405948ba2ef49b40f600e28861c54f06a2400f82ffb2b9a0d4c6da720f9fea31dbe3f42aa29bd126fcbfccb9d809c8bbd76d241fc2588963f10434b69e9415d20bea13c30a08b22f5f21bd945a11466d228848b7b68927725239142fc536f784b705d3bd318f5d5fce31ddd32eca57309b1f9e5cdb0164df0bc45d04db323ed272fef5e4e0554cbe0eef83999d6dd82b67a5de6986b7063851602f833a23946ffb004b9cb30f6af2108e2aee029aa3e4fd525597f4a8d0184750731821bf21aaf703753270d3f12d5ed5f7bdb47c891074a44c63bebe47c66aab7f24e422b5f549249f26cab0aac9484087871de53cdb6d575e0e7ea3c73de23460c5b1bbe1e838433de48ecc812c1e21861dc290f22733090b5d3f88910478bff51307e6d869b68a745255ca007b9f5dda63074845d4d8f03604ada7cb5f8c1bcad9f3a84bab71e6c109ef7bd8eb29ba18011430f28eee91aa83749594aa5c717c0d53e0ff68372284e356e55f9cf33716ade1e148beda327236f4005472600f99a1c2fbe10c5492d2e082d15fa962492b16029a222bce55a001b2726fad239160f3ed55e98343fa5266cd7f5e36158480430e2f802fbfa3aa6e7299ab0940eea91682c79fffb171a705a23b70173f0973ca0b0ea230b306418677be4e6bcca0e6cc7bdbf6a3a96090819d541f505402ce505b40bd7d012ffb6a62f2528c5d370b2d6d6cf4b49c6886d20a5cc94cbe5e7cdf012af5d27c0c89c190956d1aaf1911888b33f67341fe74a10cba3328b84e3c4b83bb8b25da32122ed8df7b831e77bf9528af4b0960a0abb420e931eead4dcf31849cafc6099e8a3053758200bdbb411346662442e8274bc9780fd69abb4ef9ddd292f791b846a5849610862453cdb9263ddc232492de5d24c2c52751223cb961bb9ba7c86988b2a5490c3540ada6ffb9ba287c3e15d228aa0a6491ceced135cb1533b31c0b8ca218ffe4e1a07f29b4557a05b447358350ebfdcff9793b2eb1d7e0ea082b1f4fde8207071a8beb8c1e5efc49e1153fb8fb21ebc46c4d5b404a743a54076e4987da1748a39c70c083960873ffa0b88d4cccae69cdf4630a78250db81141e216e2007b7aea7500ad3176ae8e22c5fce5f14f0aa581bbe520a6d6c5f504547b178e62236f54809dd43763107e49b0d44a7968dcdf73a8c3c395fecd8a557ab850bebf1a67e82714131e0380fd6684e8094783190ce491a03243d903b4488d574be3847b4219145f5aa05201b4bafcbe2c2c98fb4e968c15822e20c06e83b0fc24d8d30acc9e24b36cfd06ad1a073719bf3a92922111e76efac5a813faaca76acfb065ad4faf1efe403aee89bc149bfa4e907008fe5f81d4e795c7a646c2b48e79b7ba54ec42425978c4d084c3c1f66ccdf230515366b08cd506a210e92e75bf7adfbaada44b619feecc4427ca23e74b68abfe9796a6e9a1f540d6a438042f506c27bb4f4814c73541b38eb7d548010363cdf7b2b6faf1a41a10fb71bd206388f32777c6b8e3fd7f6cd76342a1fba80deba8100f878eb4e4a09287ce513bb6b1f445e3cbdf220ff5faceb36c3a7f1a1710e780b9772124e5728fed14bbe348f0f4831913ae69ff40c953cc6447babbcf55b08491357531dc9d86fbe5cd4fd0d6e03e5b71daca299a8d31c3596fb98d21acc09d03e3fe7cc1f13c3e8b49b9dd40b8397ae617b322951a4bd8fe8a1eff9f920b79ddad1639da4d4a18c12ca3b65430e41506198483d5a2a0bc058269e7575cd6dc8d1a03937486223694c07b8a5fe570a7795d98b75e23d4c05c39655c8b81a389b512461a20711487695b8d4ff2d81ab4fe8c884768cbb99640a9ec5b54d3cd13a90f318e0264038b7f91dd73205342400eb9d186ed30286ff7cb9e459341ee59638b253148cfa74bada6b959f185b5cf68a313ff757836aafbbdf1f4440ec0f44d99c3950a6e2fdc6b7d8c6120f921630b93ec31c216e93e6b3781d02ef2339dbea56125ffe79019b1689c25d35db7d3f3e5c613060400977a2f7e142b50591b2ae5738dfd208c0f4daeda71edd05beaf4fc0b128fd004bd2bf1cea1d6883b4287cab96354e8f34f9d3707763b731686cbe6c175848a9f4bdd7c2961d270d9ef63ac95aa0603d3612a8933660c303fd1a91b3eb700718cdf40a34795399a7812c89b44f7b223dbe8bb08e0c01c4bf740c95431445a6b6fae337df7778e834813b34e0e6d3f0e935fdd136e6ac50c8e11fffb518b06c734985f31884a411293a3a3757a6e5be3d2495916314dc072fc9c0dbefcb5100513df15c18e04b2ad744d660f9cb5f4c64eead30fdd52507bba003c625108e6cdfcd7a1b38e8fd4fef0d419f695904be3026aeb9bab1ad3566a0a46a2a2d092c75ae2cbad109a117b7db76b729aaab3a89bcef8a5e63008613414fa5ce56988bbe3e839ccb8e192c56115522620e0851fbd19790f3acf9669915ef0f1ca0a2ca8a5578747f2d6cbec07a7bc4128ae131b7685191d5cf05210cc4bca2dc6303747c72cc0e4165512cccd43c5a79800b84ca018190a70984d73056e2a8bbdea91fdfcda72d9f8705227c5c4fdef9e0b81948420cae7344ba872a85e2d47c1e40fefcaa8d246fac5c7abe90b2bf39ec601390dd0a8cacbe82fc1ba0cf13c3cd89220a42e82ce62ccdf63fcb1be53c91d36349c7d3aa30170dccd5262d9ee570581ae5c9f84cf5b32261d8f531f6df0636cea496c698f36aee3274f0f9dfb7d72c074530a2679d13e5cc1bfcd957be3eba04a12f8897507122fc74ad66a7f621012ea43878cfa9a2a3ed95581aebdf1ffd7a8985f65c63de9eab4286cb94e57e3076e4e2850faef69b1d9f75ff45227b9e1bcc256c0236dc63483cffb8d72543eb213b2e0a487217850ab3bf7213dabb360c35714dbab5604357ea7b23fc0ba27d0bd09dc09e7ac471088c58d28e3ef12c3054d8a017a5023f378ae81bbbf55228620e061ace44906cc82520bfac2e1d7f7e340f53215bcf6f6078d82266abaaf479e084e73f0600572a7d482a84633eefc6e196f27638e8f08c6a4c615ef98238895d2cffb221a800424e115b0e84b960424fe39a2f33a203eb42f7f5e70e8f73aa172a8adf1d977b176cae2750859c96692bdac1067b7a1b1496dbd7c8220f3f0b42938ba0779c9bfa414a0e6073556d651d526875a4cfa95e8e981f40fc6d8bdd4704a12f44612e8eb8842535edea3d609d929b3fc05c2b02bd44e02a732ba814caf9e03e0bd7f41a24b3b6e282d07d74de2ab968ac739e994c0265416a7347f44bb80d1948cf8c9a69409e850b13f379dd672eb34a732b0b1d7b67ef2ee1bcb686cc4d1f4512c1ffb105ad2e46d783e0ca5f97ef9e4ab2798ce1c29b0f3292fbf1001d9487adfc3b34b4329be6b72ebf7a62158e488bd7888060f1e562045ecf9388c492fe3e0a6ce9b92b5a3eb230e5d82cc5b75cecdd0809db8f1cc17bf5b72ed46fa3038722b6369d9f9497b83cc2ea1d0ebea0ac1306a83249705ae0b1c0145af67388d2153dbcb8856971216ee8f3d0cc6f532f159e5e28c6308154bf8efe46333b30740e9d94993393a27eb263dc0d19f182913ffa3953a52847fe979b9e682d304944529131b02ed468c88b5aac0483ff22ad56f9630b4f6134f266ee446068edd079411571f7e77acf2035d483043b8ad85b6277dca9e590ca801dc1896acdfc88dcf3cf83fca85afefe6addd27131f8be0fd5a80a0723556639fff59d56453ec76d3ebad3f5cb04e7b758b13e3d64c2ff5c3b018f52040063e053ee2fd78e35b2a834a069953e759455047521ad6615ab87e6381f0363a4554b86dd14f5ab43eb6b3fff64d94af0949a9e5c63d8c8e883886e61bd36f5ca11dfe2c025290cd49f369f8a3f9023d5daa7410fba96927fd0b5d2c75e00", 0x2000, &(0x7f0000000d00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x90, 0xfffffffffffffffe, 0x5, {0x8, 0x4, 0x1, 0xc, 0x8, 0x9, {0x0, 0x3, 0x10000000000006, 0x9, 0x2, 0x1000000000000003, 0x8, 0xaf, 0x200006, 0x8000, 0x2, r9, r10, 0x2, 0x10000001}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) statx(r6, &(0x7f00000000c0)='./file0\x00', 0x4000, 0x40, &(0x7f0000000600)) fchown(r3, r9, 0x0) gettid() syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x4e02) ioctl$VIDIOC_QUERY_EXT_CTRL(r0, 0xc0e85667, &(0x7f0000000100)={0xf99ead171fc0ec3e, 0x100, "2712db36f3c964c0cdd68849d8e85f0130b1fb723f0eb00fc8a12fd500025269", 0x0, 0xfffffffffffffffb, 0x4a10875b, 0x0, 0x0, 0xf, 0x7fff, 0x5, [0x0, 0x9, 0x7, 0x9ae]}) 13m45.709478185s ago: executing program 3 (id=1102): socket$nl_generic(0x10, 0x3, 0x10) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = syz_usb_connect(0x5, 0x24, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010003de001f66088f051066055a1dea0d0d490490c8493048010203010902120001049570810904008100ffffff021f140600086282512ffc278ed9c93a8635771002fa1383d4a83f63dad4bdb2f7507ff2b2a6ee0a26ef57d8975d6c489f6ade356565f2345ecc5fad6d5844953c48fe2d875832478735364dfdd0ee7e4e6f4539abecefc02a4b3819c324f26921ba782576469f0345713e3903e260b9d88fd6c2015b5554bf9daabcfdd215280310e9"], &(0x7f0000001700)={0xffffffa0, 0x0, 0x0, 0x0, 0x23}) r4 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2003) ioctl$I2C_RDWR(r4, 0x707, &(0x7f0000000a40)={&(0x7f0000000380)=[{0x3, 0x6000, 0x1, &(0x7f00000003c0)='t'}, {0x1, 0x2a00, 0x0, 0x0}], 0x2}) syz_usb_control_io$cdc_ecm(r3, 0x0, &(0x7f0000000200)={0x1c, &(0x7f0000000000)=ANY=[], 0x0, 0x0}) ioctl$SNDCTL_TMR_STOP(0xffffffffffffffff, 0x5403) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = syz_io_uring_setup(0x499, &(0x7f0000000400)={0x0, 0x4407, 0x0, 0x1, 0x28b}, &(0x7f00000001c0)=0x0, &(0x7f0000000000)=0x0) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x16, 0x0, 0x0, &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) r8 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r8, 0x6, 0x0, 0x0, 0x0) r9 = fsmount(r8, 0x0, 0x6) fchdir(r9) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xf3) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./file1/file3\x00', 0x84) renameat2(0xffffffffffffff9c, &(0x7f0000000080)='./file1/file3\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./file0/file3\x00', 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) r10 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x100, 0x0) ioctl$KVM_CREATE_VM(r10, 0xae01, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x18) syz_io_uring_submit(r6, r7, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd_index=0x4, 0x0, 0x0}) io_uring_enter(r5, 0x5fc8, 0xfffff800, 0x4, 0x0, 0x0) 13m45.075971602s ago: executing program 33 (id=1102): socket$nl_generic(0x10, 0x3, 0x10) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = syz_usb_connect(0x5, 0x24, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010003de001f66088f051066055a1dea0d0d490490c8493048010203010902120001049570810904008100ffffff021f140600086282512ffc278ed9c93a8635771002fa1383d4a83f63dad4bdb2f7507ff2b2a6ee0a26ef57d8975d6c489f6ade356565f2345ecc5fad6d5844953c48fe2d875832478735364dfdd0ee7e4e6f4539abecefc02a4b3819c324f26921ba782576469f0345713e3903e260b9d88fd6c2015b5554bf9daabcfdd215280310e9"], &(0x7f0000001700)={0xffffffa0, 0x0, 0x0, 0x0, 0x23}) r4 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2003) ioctl$I2C_RDWR(r4, 0x707, &(0x7f0000000a40)={&(0x7f0000000380)=[{0x3, 0x6000, 0x1, &(0x7f00000003c0)='t'}, {0x1, 0x2a00, 0x0, 0x0}], 0x2}) syz_usb_control_io$cdc_ecm(r3, 0x0, &(0x7f0000000200)={0x1c, &(0x7f0000000000)=ANY=[], 0x0, 0x0}) ioctl$SNDCTL_TMR_STOP(0xffffffffffffffff, 0x5403) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = syz_io_uring_setup(0x499, &(0x7f0000000400)={0x0, 0x4407, 0x0, 0x1, 0x28b}, &(0x7f00000001c0)=0x0, &(0x7f0000000000)=0x0) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x16, 0x0, 0x0, &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) r8 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r8, 0x6, 0x0, 0x0, 0x0) r9 = fsmount(r8, 0x0, 0x6) fchdir(r9) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xf3) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./file1/file3\x00', 0x84) renameat2(0xffffffffffffff9c, &(0x7f0000000080)='./file1/file3\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./file0/file3\x00', 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) r10 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x100, 0x0) ioctl$KVM_CREATE_VM(r10, 0xae01, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x18) syz_io_uring_submit(r6, r7, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd_index=0x4, 0x0, 0x0}) io_uring_enter(r5, 0x5fc8, 0xfffff800, 0x4, 0x0, 0x0) 12m15.322770235s ago: executing program 0 (id=1453): r0 = syz_usb_connect(0x3, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b00000009040000022a3e740009058bff7f0000100109050b362f"], 0x0) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000100)=ANY=[@ANYRESDEC=r0], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, &(0x7f0000000740)={0x24, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="002208000000a20100c3"], 0x0}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000500)=ANY=[@ANYBLOB="a00000000001010400000000000000000a0000003c0001802c00018014000300fe8000000000000000000000000000aa14000400ff0100000000000000000000000000010c0002800500010000000000440002802c00018014000300fe8000000000000000000000000000aa14000400fe8800000000000000000000000000010c000280050001000000000006000340000100000800074000000000040006804a7810"], 0xa0}}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000380)={0xb4, 0x0, 0x1, 0x401, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @empty}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x44, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @local}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}]}, @CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0x400}, @CTA_NAT_SRC={0x18, 0x6, 0x0, 0x1, [@CTA_NAT_V6_MINIP={0x14, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}]}]}, 0xb4}}, 0x0) r3 = syz_open_dev$hiddev(&(0x7f0000000000), 0x0, 0x880) ioctl$HIDIOCGUCODE(r3, 0xc018480d, &(0x7f0000000240)={0xffffffff, 0x0, 0x2, 0x6, 0x7, 0x2}) syz_open_dev$midi(&(0x7f0000000040), 0x3, 0x88c02) r4 = syz_io_uring_setup(0xbdc, &(0x7f0000000640)={0x0, 0xec25, 0x400, 0x1, 0x40000333}, &(0x7f00000006c0)=0x0, &(0x7f00000001c0)=0x0) r7 = syz_open_dev$loop(&(0x7f0000000280), 0xffff, 0x14f600) sendmsg$IPSET_CMD_FLUSH(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB='\x00'/20], 0x14}}, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) ioctl$LOOP_CONFIGURE(r7, 0xc0c0128e, &(0x7f0000000140)={0xffffffffffffffff, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x8, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00000000170000000400", "f4bd000000801900", [0x100000000, 0x8]}}) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x114, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) close(0x3) syz_io_uring_submit(r5, r6, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, &(0x7f00000005c0)=[{&(0x7f0000001800)=""/216, 0xd8}, {0x0}], 0x2, 0x6, 0x1}) io_uring_enter(r4, 0x847ba, 0x0, 0xe, 0x0, 0x0) r8 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x1, 0x10, &(0x7f00000004c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x400, 0x0, 0x0, 0x0, 0x2}, {{0x18, 0x1, 0x1, 0x0, r8}}, {}, [@call={0x85, 0x0, 0x0, 0x9}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000000)='GPL\x00', 0x8, 0x0, 0x0, 0x41100, 0x20, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 12m12.199822971s ago: executing program 0 (id=1475): socket$kcm(0x10, 0x2, 0x4) socket$nl_generic(0x10, 0x3, 0x10) socket$packet(0x11, 0xa, 0x300) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000002800)=[{{0x0, 0x0, &(0x7f0000000140)=[{0x0}, {&(0x7f0000000100)="91641a", 0x3}], 0x2}}, {{&(0x7f00000004c0)={0x2, 0x4e21, @rand_addr=0x64010100}, 0x10, 0x0}}], 0x2, 0x0) r2 = userfaultfd(0x80001) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000100)) ioctl$UFFDIO_CONTINUE(r2, 0xc020aa08, &(0x7f0000000400)={{&(0x7f000044b000/0x1000)=nil, 0x1000}}) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r3 = socket$inet6(0xa, 0x3, 0x3c) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000002100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000040900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff27414000000110001"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) connect$inet6(r3, &(0x7f0000000000)={0xa, 0x5000, 0x80000001, @remote, 0x7}, 0x1c) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f00000002c0)={{}, 0x0, 0x0}, 0x20) r5 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f00000000c0)={&(0x7f0000000600)=ANY=[@ANYBLOB="240000006800010000000000000000000200000000000000080006000100000004000b"], 0x24}}, 0x4004094) r6 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r6, 0x10e, 0xc, &(0x7f0000000040)={0x81}, 0x10) sendmsg$nl_route(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="240000001a00010000000000000000000a000000000000000000000008001f"], 0x24}, 0x1, 0x0, 0x0, 0x4048890}, 0x0) writev(r3, &(0x7f00000000c0)=[{&(0x7f0000000100)=',', 0xffdf}], 0x1) syz_emit_ethernet(0x7e, &(0x7f0000000880)={@broadcast, @multicast, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "6b88ef", 0x48, 0x3a, 0x0, @private1, @local, {[], @pkt_toobig={0x2, 0x0, 0x0, 0x0, {0x0, 0x6, "bdd7c3", 0x0, 0x33, 0x0, @loopback, @local, [@dstopts={0x29, 0x1, '\x00', [@calipso={0x7, 0x8, {0x2, 0x0, 0xb, 0x4}}]}]}}}}}}}, 0x0) 12m11.132509761s ago: executing program 0 (id=1479): unshare(0x6a040000) socket$packet(0x11, 0x3, 0x300) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x940d, 0x0, 0x9, 0x0, 0xfffffdffffffffff, 0xfa11, 0xffffffff}, 0x0) syz_emit_ethernet(0xc2, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(0xffffffffffffffff, 0x40505330, &(0x7f0000000180)={0x800100, 0xffffffff, 0x22, 0xe1d9, 0x1101, 0xff}) r2 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000080)={0x84, @private=0xa010100, 0x15, 0x3, 'sh\x00', 0x28, 0x0, 0x70}, 0x2c) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000740)=ANY=[@ANYBLOB="4001001ed629202ab043001a000100feffffff00010000e000000200000000000000fc0100000000000000000000000000010001071c4e2300050a", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ff020000000000000000000000000001000004d46c000000fc02000000000000000000000000000100000000000000009201000000000010a39b000000000000ffff0000000000001c250800000000000500000000000000fcffffffffffffff0000000000000000ffffffffffffffff00000000000000001f00000000000000fefffffffffffffffefffffffc030000000000008000000005350000020001002000000000000000480003006465666c6174650000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000b007f000000"], 0x140}}, 0x844) r4 = socket$kcm(0xa, 0x2, 0x0) r5 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$IP_VS_SO_SET_ADDDEST(r5, 0x0, 0x487, &(0x7f0000000000)={{0x84, @private=0xa010102, 0x4e24, 0x3, 'lc\x00', 0x5, 0x8, 0x77}, {@remote, 0x4e20, 0x10000, 0x0, 0x9}}, 0x44) sendmsg$sock(r4, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e23, 0x0, @ipv4={'\x00', '\xff\xff', @private=0xa010101}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) 12m8.477183633s ago: executing program 0 (id=1484): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001900)={0x34, 0x40, 0x107, 0xfffffffe, 0x0, {0x1, 0x7c}, [@nested={0x4, 0x142}, @nested={0x18, 0x1, 0x0, 0x1, [@typed={0x10, 0x4, 0x0, 0x0, @str='\xca\xb1\x89: \xb8\xd2\xa95!\x80\n'}, @nested={0x4, 0x1c}]}, @nested={0x4, 0x2}]}, 0x34}, 0x1, 0x0, 0x0, 0x48815}, 0xc000) mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x9801) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$fuseblk(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x24000, 0x0) open_tree(r1, &(0x7f0000000640)='\x00', 0x89901) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/pids.max\x00', 0x2, 0x0) write$cgroup_subtree(r3, &(0x7f0000000000)=ANY=[@ANYBLOB='-0'], 0x6) r4 = open(&(0x7f00000001c0)='./cgroup\x00', 0x0, 0x157) syz_clone3(&(0x7f0000000340)={0x3a0000080, 0x0, 0x0, 0x0, {0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, {r4}}, 0x58) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001900)={0x34, 0x40, 0x107, 0xfffffffe, 0x0, {0x1, 0x7c}, [@nested={0x4, 0x142}, @nested={0x18, 0x1, 0x0, 0x1, [@typed={0x10, 0x4, 0x0, 0x0, @str='\xca\xb1\x89: \xb8\xd2\xa95!\x80\n'}, @nested={0x4, 0x1c}]}, @nested={0x4, 0x2}]}, 0x34}, 0x1, 0x0, 0x0, 0x48815}, 0xc000) (async) mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) (async) open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) (async) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) (async) open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x9801) (async) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) (async) mount$fuseblk(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x24000, 0x0) (async) open_tree(r1, &(0x7f0000000640)='\x00', 0x89901) (async) openat(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/pids.max\x00', 0x2, 0x0) (async) write$cgroup_subtree(r3, &(0x7f0000000000)=ANY=[@ANYBLOB='-0'], 0x6) (async) open(&(0x7f00000001c0)='./cgroup\x00', 0x0, 0x157) (async) syz_clone3(&(0x7f0000000340)={0x3a0000080, 0x0, 0x0, 0x0, {0xb}, 0x0, 0x0, 0x0, 0x0, 0x0, {r4}}, 0x58) (async) 12m8.051857566s ago: executing program 0 (id=1487): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet6_mtu(r0, 0x29, 0x17, 0x0, &(0x7f00000001c0)) (async) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x3ff}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) (async) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) (async) r2 = socket$inet_udp(0x2, 0x2, 0x0) (async) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000004c0)={'bond0\x00'}) (async) sendmsg$nl_route(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000340)=ANY=[@ANYRESHEX=r3, @ANYBLOB="b1d6cdaa7390c13038255409f72e26dfb6bb5490cdb9b808bb75e1d6a21e65194691162edb253ef2d59d5c6683b426f354092b7b872a0fb9a0cfa97afb300ef947956156acaf4c0f08fb7935244bfe54975cab6348e13b4e5303ff694ee8", @ANYRES8, @ANYRESOCT=r2, @ANYRESDEC=r0], 0x44}, 0x1, 0x0, 0x0, 0x4800}, 0x40000000) (async) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) (async) mmap$KVM_VCPU(&(0x7f0000ffb000/0x2000)=nil, 0x930, 0x1000002, 0x4018831, 0xffffffffffffffff, 0x0) (async) r4 = userfaultfd(0x1) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f00000000c0)) (async) fsmount(0xffffffffffffffff, 0x0, 0x88) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_clone(0x40000, 0x0, 0x0, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) (async) unshare(0x20000400) (async) socket$nl_sock_diag(0x10, 0x3, 0x4) sendmmsg$unix(r6, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_emit_ethernet(0xae, &(0x7f0000000000)=ANY=[@ANYBLOB="ffffffffffffaaaaaaaaaabb86dd6000021000783afffe8000000000000000000000000000bbff020000000000000000000000000001860090780000000000000000000000e4180100fffff271c08223af91f34006598080a8030037004023493b87aafaffffffffffffff23732472eefa45ad96579269748e254c1e9f8d8b3f0ab0c430d3be27df3e34066d42ca0a5c15b37adac15084dbaf736b41e5af18020001005ff9297d00001392000100"], 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) openat$rdma_cm(0xffffff9c, 0x0, 0x2, 0x0) r7 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) unshare(0x2030000) (async) ioctl$IOMMU_IOAS_ALLOC(r7, 0x3b81, &(0x7f00000000c0)={0x9}) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) 12m4.730154026s ago: executing program 0 (id=1494): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0) ioctl$VIDIOC_S_FMT(r2, 0xc0d05640, &(0x7f00000004c0)={0x1, @pix={0x800, 0x0, 0x52424752, 0x0, 0x0, 0x0, 0x5, 0xfeedcafe, 0x3, 0x8, 0x2, 0x7}}) r3 = socket(0x10, 0x2, 0x0) write(r3, &(0x7f0000000200)="240000001e005f80004000000000000003000000", 0x14) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x14, 0x0, 0xa, 0x101, 0x0, 0x0, {0x1, 0x0, 0x3}}, @NFT_MSG_NEWCHAIN={0x60, 0x3, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0xffff}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}, @NFTA_CHAIN_HOOK={0x34, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8}, @NFTA_HOOK_DEV={0x14, 0x3, 'vcan0\x00'}, @NFTA_HOOK_DEV={0x14, 0x3, 'veth1_macvtap\x00'}]}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x9c}}, 0x0) pwritev(r0, &(0x7f0000000480)=[{&(0x7f0000000380)='Q', 0x1}], 0x1, 0xc, 0x5) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r5 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000001c0)=[@text16={0x10, 0x0}], 0x1, 0x70, 0x0, 0xffffffffffffff7e) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000200)="f7790066baa00066b86b4266ef66ba420066b8e20066ef0f29902cbb0000c4e2b1ba8c88d9000000666666440f38826b410f7842280f07b8010000000f01d9c4033921820f47a753fd", 0x49}], 0x1, 0x43, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f0000000040)={[0x80000000004, 0x2, 0x80, 0x25, 0x20000004, 0x7f, 0x44233, 0x0, 0x81, 0x9c1, 0x8001, 0x1005, 0xc, 0x4db6, 0x0, 0xfffffdfffffffffd], 0xf000, 0x80300}) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x1, 0x0, 0x0, 0x4ee59ce4, 0xfffffffffffffffd, 0xfffffffc}, 0x0) ioprio_set$pid(0x3, 0x0, 0x0) r6 = openat$procfs(0xffffffffffffff9c, &(0x7f0000002200)='/proc/diskstats\x00', 0x0, 0x0) preadv2(r6, &(0x7f0000000000)=[{&(0x7f0000002240)=""/253, 0xfd}], 0x1, 0x1b39, 0x6d, 0x10) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) 12m3.913295848s ago: executing program 34 (id=1494): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0) ioctl$VIDIOC_S_FMT(r2, 0xc0d05640, &(0x7f00000004c0)={0x1, @pix={0x800, 0x0, 0x52424752, 0x0, 0x0, 0x0, 0x5, 0xfeedcafe, 0x3, 0x8, 0x2, 0x7}}) r3 = socket(0x10, 0x2, 0x0) write(r3, &(0x7f0000000200)="240000001e005f80004000000000000003000000", 0x14) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x14, 0x0, 0xa, 0x101, 0x0, 0x0, {0x1, 0x0, 0x3}}, @NFT_MSG_NEWCHAIN={0x60, 0x3, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0xffff}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}, @NFTA_CHAIN_HOOK={0x34, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8}, @NFTA_HOOK_DEV={0x14, 0x3, 'vcan0\x00'}, @NFTA_HOOK_DEV={0x14, 0x3, 'veth1_macvtap\x00'}]}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x9c}}, 0x0) pwritev(r0, &(0x7f0000000480)=[{&(0x7f0000000380)='Q', 0x1}], 0x1, 0xc, 0x5) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r5 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000001c0)=[@text16={0x10, 0x0}], 0x1, 0x70, 0x0, 0xffffffffffffff7e) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000200)="f7790066baa00066b86b4266ef66ba420066b8e20066ef0f29902cbb0000c4e2b1ba8c88d9000000666666440f38826b410f7842280f07b8010000000f01d9c4033921820f47a753fd", 0x49}], 0x1, 0x43, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f0000000040)={[0x80000000004, 0x2, 0x80, 0x25, 0x20000004, 0x7f, 0x44233, 0x0, 0x81, 0x9c1, 0x8001, 0x1005, 0xc, 0x4db6, 0x0, 0xfffffdfffffffffd], 0xf000, 0x80300}) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x1, 0x0, 0x0, 0x4ee59ce4, 0xfffffffffffffffd, 0xfffffffc}, 0x0) ioprio_set$pid(0x3, 0x0, 0x0) r6 = openat$procfs(0xffffffffffffff9c, &(0x7f0000002200)='/proc/diskstats\x00', 0x0, 0x0) preadv2(r6, &(0x7f0000000000)=[{&(0x7f0000002240)=""/253, 0xfd}], 0x1, 0x1b39, 0x6d, 0x10) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) 1m58.669379949s ago: executing program 7 (id=3482): r0 = socket(0x400000000010, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x14}}, 0x0) getsockname$packet(r4, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700000086d7c0d6c878f064eb", @ANYRES32=r5, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}, 0x1, 0x0, 0x0, 0x4c840}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000900)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}, 0x1, 0xfffc, 0x0, 0x4}, 0x4000810) sendmsg$nl_route_sched(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=@delchain={0x54, 0x64, 0xf31, 0xfffffffb, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0xfff3}, {0xfff3, 0xffff}, {0x0, 0x1b}}, [@filter_kind_options=@f_flower={{0xb}, {0x24, 0x2, [@TCA_FLOWER_KEY_ENC_OPTS={0x20, 0x54, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_GENEVE={0x1c, 0x1, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_GENEVE_DATA={0x5, 0x3, 0x4}, @TCA_FLOWER_KEY_ENC_OPT_GENEVE_CLASS={0x6}, @TCA_FLOWER_KEY_ENC_OPT_GENEVE_TYPE={0x5, 0x2, 0x8}]}]}]}}]}, 0x54}, 0x1, 0x0, 0x0, 0x10}, 0x0) r6 = socket(0x400000000010, 0x3, 0x0) r7 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xffffffff, {0x0, 0x0, 0x0, r8, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xc, 0xf}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_RSC={0x10, 0x1, {0x0, 0xfffffffe, 0x4}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x8801}, 0x20008850) r9 = socket$unix(0x1, 0x1, 0x0) r10 = socket$kcm(0x11, 0x3, 0x0) r11 = socket(0x400000000010, 0x3, 0x0) r12 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r11, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000c00)=@newtfilter={0x488, 0x2c, 0xd3f, 0x870bd24, 0x25dfdbfc, {0x0, 0x0, 0x0, r13, {0xfff3, 0xffe0}, {}, {0x7, 0x2}}, [@filter_kind_options=@f_bpf={{0x8}, {0x45c, 0x2, [@TCA_BPF_OPS={{0x6, 0x4, 0x1}, {0xc, 0x5, [{0x6, 0xd, 0x9, 0x4}]}}, @TCA_BPF_POLICE={0x444, 0x2, [@TCA_POLICE_RATE={0x404, 0x2, [0x3, 0x8, 0x1, 0x7, 0xd988, 0x3, 0x3, 0xa08b, 0x1, 0x3ff, 0x5, 0x5, 0x6, 0x4, 0x3, 0x92c, 0x7, 0xffffffb2, 0xeaac, 0x2, 0xe13, 0x4, 0x10000, 0xded, 0x8, 0x10000000, 0x7, 0x10001, 0xc6d, 0x88000001, 0x8, 0x7, 0x7, 0x7, 0x5, 0x7, 0x800, 0x9, 0x100, 0x8, 0x9, 0x8, 0x3, 0x5, 0x6, 0xffffff9a, 0x3, 0xd, 0x7, 0x5, 0x13f6, 0x81, 0x53, 0x17, 0x4, 0x1000001, 0x6, 0x4, 0x8, 0x800, 0x86e1, 0x8, 0xfffffff9, 0x5, 0x1, 0x3, 0x5, 0x5, 0x80000000, 0xf3, 0xd, 0x8, 0xfffffff9, 0x800, 0x2726a3ed, 0x6, 0x200004, 0x2, 0x6, 0x8, 0x2, 0x7ff, 0x100, 0x1ff, 0x7, 0x3, 0x8, 0x8, 0x5, 0x2, 0x5, 0x0, 0x4, 0x3, 0x16, 0xff, 0x1, 0xc, 0x9, 0xb, 0x5, 0x8000, 0x5, 0x6, 0x8, 0xfa, 0x3, 0x0, 0x10, 0x1ff, 0x3, 0x4, 0x60000000, 0x8, 0x2, 0x5, 0x3, 0x2, 0x401, 0xa955, 0x5000, 0x1, 0xe6, 0x2, 0x3, 0x6e4, 0x1, 0x5, 0xe, 0xb, 0x6, 0x4, 0x80000001, 0x3, 0x99b, 0x9c4, 0x7f, 0x3, 0x70, 0xff800, 0x1, 0x7, 0x5, 0xff, 0x7, 0x6, 0xfff, 0x800, 0xa3, 0x10000, 0xff, 0x80000000, 0xc, 0x7, 0x8, 0xff, 0x0, 0x80, 0x8, 0x6, 0xe2f3, 0x4, 0x7f, 0x9, 0x1, 0xffff, 0x3, 0x9, 0x9, 0x8, 0x7, 0xfffffc00, 0x0, 0x40, 0x400, 0x64c, 0x8, 0x7, 0x8, 0x6, 0x0, 0x6, 0x5, 0x7ff, 0xc7, 0x7, 0xf30, 0x800, 0x0, 0xee3, 0x2005, 0x4, 0x8, 0x8, 0x1000, 0x8, 0x7, 0xa37f, 0x8, 0x9, 0x3, 0x1, 0xff, 0x8, 0x10000, 0xb, 0xcf9, 0x8, 0xfc, 0x40, 0x3, 0x1731, 0x3b, 0xff, 0x6, 0x6ad880, 0x266d, 0x4007, 0xc28, 0x2, 0x400, 0x7d75, 0x52, 0xd3, 0x8, 0x2, 0x4, 0xfffffff8, 0x200, 0x6, 0x6, 0x8, 0xe, 0xe459, 0x7ff, 0xc7, 0x81, 0x40, 0x0, 0x9, 0x3feb, 0x800, 0x100, 0x100, 0x7, 0xfffffb98, 0xfffffffb, 0x4, 0x20001, 0x3, 0x8, 0x1, 0x15b9, 0x7, 0x100, 0xffffffff]}, @TCA_POLICE_TBF={0x3c, 0x1, {0x5, 0xffffffffffffffff, 0x1, 0x7, 0xb, {0x7, 0x2, 0x1, 0x80, 0x6572, 0x6}, {0x2, 0x0, 0x400, 0x8, 0x8}, 0x3, 0x0, 0x7fffffff}}]}]}}]}, 0x488}, 0x1, 0x0, 0x0, 0x8848}, 0x20004804) r14 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r14) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r14, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r10, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x7, r15, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)='\'', 0x1}], 0x1}, 0x4) r16 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r16, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafd, {0x0, 0x0, 0x0, r17, {0xc, 0xc}, {0x0, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x20000801}, 0x4041080) 1m57.820881358s ago: executing program 7 (id=3485): socket$nl_route(0x10, 0x3, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000003c0)={'team_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x7, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) write$cgroup_freezer_state(0xffffffffffffffff, &(0x7f00000001c0)='FREEZING\x00', 0x9) r5 = dup(r4) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r5, 0x84, 0x64, &(0x7f00000001c0), 0x0) sendmsg$inet6(r4, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0x8, @loopback, 0x4}, 0x1c, &(0x7f0000000380)=[{&(0x7f00000000c0)="88", 0x1}], 0x1}, 0x4048043) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000000)='syz_tun\x00', 0x10) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x111, 0x5}}, 0x20) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r5, 0x84, 0x9, &(0x7f0000000200)={0x0, @in={{0x2, 0x4e21, @empty}}, 0x5, 0x3, 0xf06, 0x1, 0x94, 0xfffffffd, 0x5}, 0x9c) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000400)={0x0, 0x18, 0xfa00, {0x3, 0x0, 0x106, 0xb}}, 0x20) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r5, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in6={{0xa, 0x4e60, 0xfffffff2, @empty}}, 0x0, 0x9, 0xffff1896, 0x106, 0x25, 0x7fff}, 0x9c) write$P9_RREAD(r5, &(0x7f0000002080)=ANY=[], 0xec1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(0xffffffffffffffff, &(0x7f0000000540)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r7, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sysfs(0xffffffffffffff9c, 0x0, 0x1, 0x0) io_setup(0x61, &(0x7f0000000100)) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x7f7603, 0x0) openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2) r8 = memfd_create(&(0x7f0000000440)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea\x7f\x8cZ7`_4t\xcda\x9b\x11\x11\x0e\xa1\xcf\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xdbu&d\xec\xfc?I\t\x88\x12~yt\x14\xeb\xb0\xb6\xb0\xc3w\xc9\x0f\xb2D\xf1+\fiU\xf1\xb3\x9b~\n\xb7\xbd\xe6M\t\x8e\xb0\xbeb#6\xf3\xc6\xda\rc|\xbc\xcd!8aj0\xb9aV\xf4\xe8&jT\xd2]\xfdt@*\xd6\x1f\'\x1f\xce\x851\x98\xab\x81_\x93\xbf\x10_\xf9B\x15\x9a\xdb\x97\xfe>\xdeyM\xc6>\xc9\x95<\x85\x88%\x8c\xc7\x9bt\xfe\xa6|-[&F\x1d\xdc\x13r\x96\xa4\xf6\xc8yD)\nuLW\x93_F\x86\x1d\xaa\xb65\x86%I\xba\xca', 0x2) ftruncate(r8, 0x1000006) fcntl$addseals(r8, 0x409, 0x7) 1m56.631141985s ago: executing program 7 (id=3487): socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000001c0)=@abs={0x0, 0x0, 0x4e23}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x0, 0x0, 0x200000, 0x0, 0xb49, 0x6, 0xc, 0x0, 0x1}, 0x0) syz_open_dev$dri(0x0, 0x1, 0x0) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) read$dsp(r2, 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = openat$ppp(0xffffffffffffff9c, 0x0, 0xc0802, 0x0) pwritev(r4, 0x0, 0x0, 0xe, 0x200004) prctl$PR_MCE_KILL(0x29, 0x1, 0x2) r5 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps\x00') lseek(r5, 0x1000000, 0x0) sendmsg$nl_generic(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x8000}, 0x0) r6 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000580)="1400000016004163d25a80648c2594f91724fc60", 0x14}], 0x1}, 0x0) 1m53.966879673s ago: executing program 7 (id=3497): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0xce, &(0x7f0000006680)) r0 = openat$pidfd(0xffffffffffffff9c, &(0x7f0000000140), 0x111000, 0x0) pidfd_send_signal(r0, 0x0, &(0x7f0000000640)={0x0, 0x0, 0xfffffff8}, 0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x6a855000) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x181002, 0x0) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000000)=0x0) sched_setscheduler(r2, 0x1, &(0x7f0000000080)=0x8) ioctl$TCSETAF(r1, 0x5408, &(0x7f0000000200)={0x49db, 0x7, 0x7, 0x8000, 0x0, "0a00a1640a3e7607"}) write$binfmt_aout(r1, &(0x7f00000000c0)=ANY=[], 0xff2e) ioctl$TCSETS(r1, 0x40045431, &(0x7f00000001c0)={0x0, 0xffffef7b, 0x0, 0xb2, 0x10, "1b09000040000000000000e678000000001000"}) syz_open_pts(r1, 0x40000) r3 = syz_open_pts(r1, 0x20800) read(r3, &(0x7f0000000240)=""/253, 0xfd) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) memfd_create(&(0x7f0000000140)='-B\xd5NI\xc5j\x9appp\xf0\n\x84\xae\n\x00\v\x18\x004\xa6Ey\xdb\xd1\xa7\xb1\x03\x00\x00\x00\xe3LS\xf1:)\x00\xca\xd7Uw\x00\xbc\xfa2\xb3\xbb\x8d\xac\xac\xbe\xe1}knh\x9c\xea\xc9\x01c\x10d\xee\xa9\x1a\xcaR\xcf\xbcsi\xdf\xb9\xb9\x12\x8b\x04\xa3\xbd\xf2C\x93\xb8\x9a\x06\x97k\xde\xc5\xe96\xddU)\xc98M\xd0\xfb\xcc\x82n=\x7f=\xcdJx\xaa\xcf~\xb90a\xa9\xb2\x04(\xcc\xce\x8b\x19\xea\xef\x17d\xc7d\xc5\xfa\b<\xe3?ip\x9dX4U\xd70\xfdM1\x17\xe1G\x81\xd1\x84\v{\x16\xcc7\xd8fP\x12\x0e\xe07)[;\xa4\xc1\x05S\xf9~\x8e7\xa8sKkR\x16\aA\x9a\xf4\x1a\x01\xe5vm\x18&\x8f.\x87\a\xde\xd7M\xda\xa1\xa2b\x0f)\xd0\xf1\x02;\x01\xd5\x94gD\x87\xd3E\xcf!\xf8K\xa4\xee\xb7rS\x8e\xbc`;\xb8\x8er\xe1\xb2\x8b\xb9wN\x87\xad\xd1W\xa7\xe7\xff_&\bv\xb46\xf6\x89\t\x1d\x8b@\xd63\x1d\x80\\\xef\xd0g`\xc6\xaem\n', 0x2) 1m52.394941282s ago: executing program 7 (id=3502): r0 = syz_usb_connect$printer(0x2, 0x2d, &(0x7f00000000c0)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0x525, 0xa4a8, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x1, 0xff, 0x80, 0xc, [{{0x9, 0x4, 0x0, 0xfd, 0x1, 0x7, 0x1, 0x1, 0x0, "", {{{0x9, 0x5, 0x1, 0x2, 0x20, 0x4, 0x20, 0xb}}}}}]}}]}}, 0x0) syz_usb_control_io$printer(r0, &(0x7f0000001100)={0x14, 0x0, &(0x7f0000000300)={0x0, 0x3, 0x2, @string={0x2}}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x80000000) write$char_usb(r1, &(0x7f0000006800)="10", 0x1) write$char_usb(r1, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r2, 0x10e, 0x1, &(0x7f0000000200)=0x1b, 0x4) syz_usb_connect$sierra_net(0x3, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x1199, 0x68a3, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x0, 0x80, 0xfa, {{0x9, 0x4, 0x7, 0x0, 0x3, 0xff, 0x0, 0x0, 0x0, "", {{0x9, 0x5, 0x8, 0x2, 0x3ff, 0x4, 0x7, 0xb}, {0x9, 0x5, 0xc, 0x2, 0x200, 0x2, 0xb, 0x6e}, {0x9, 0x5, 0x3, 0x3, 0x40, 0x6, 0x3, 0x1}}}}}}]}}, 0x0) syz_usb_disconnect(r0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x458, 0x87, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0xfe, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x5}}}}]}}]}}, 0x0) ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, 0x0) ioctl$EVIOCGNAME(0xffffffffffffffff, 0x80404506, 0x0) 1m49.044222774s ago: executing program 7 (id=3511): r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000018c0), 0xe0c81) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f00000002c0)={0x4000000, 0xb0, 0x0, 'queue1\x00'}) write$sndseq(r0, &(0x7f0000000000)=[{0x1e, 0x0, 0x0, 0x0, @tick, {0x4}, {}, @raw32}], 0xffffff2d) fsopen(0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x400, 0x0) ioctl$TUNSETOFFLOAD(r1, 0x400454c9, 0xba98575a95aeb70d) ioctl$TUNSETTXFILTER(r1, 0x400454d1, &(0x7f0000000680)=ANY=[@ANYBLOB="9386c68bf668cebe445a2bc56cf0446a9d265e5040692865f03553dfb361d42a1149d5151358853976ea5edf2d012458cc1ec548e06012efaf08a2bc17e32b865f3879e341d64c6460f3632dbb7285884e413cebb88d973f321ecdd1dc4b4ae2c5ddfbed509d8d8bbd522ba24303fd49edfe1cb299509bb6e54e4e23107ef762f2261c5fcea730b65c7ae58e9286ff2582a894680e88036d0a519898c7a7c5453bcf58d498ded2c44e629ca3d03bf7344100d79e4400419e04bf97825a158bf1ab80e54c1ab629d4"]) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000100)={0x0, 0x5, 0x7, {0x763039aa, 0x115}, 0x10, 0x5}) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) mmap(&(0x7f0000261000/0xc00000)=nil, 0xc00000, 0x3000003, 0x31, 0xffffffffffffffff, 0x0) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x14) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2000002, 0x4ca31, 0xffffffffffffffff, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000100)={'wlan0\x00'}) r3 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r3, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x8, 0x8001, 0x0, 0x2, 0x7, 0xfffffe0001000001, 0xfa11, 0xffffffff}, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x1, 0x4, &(0x7f0000000480)=ANY=[], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x28, '\x00', 0x0, @fallback=0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$DRM_IOCTL_MODE_GETPLANE(0xffffffffffffffff, 0xc02064b6, 0x0) r6 = syz_open_dev$dri(0x0, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r6, 0xc02064b2, 0x0) syz_usb_connect(0x5, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="120100000c9768405e0483020b9901e4020109021b000100000000090400fb0160291d00090536", @ANYRES16=r1], 0x0) unshare(0x6020480) 1m33.958498151s ago: executing program 35 (id=3511): r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000018c0), 0xe0c81) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f00000002c0)={0x4000000, 0xb0, 0x0, 'queue1\x00'}) write$sndseq(r0, &(0x7f0000000000)=[{0x1e, 0x0, 0x0, 0x0, @tick, {0x4}, {}, @raw32}], 0xffffff2d) fsopen(0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x400, 0x0) ioctl$TUNSETOFFLOAD(r1, 0x400454c9, 0xba98575a95aeb70d) ioctl$TUNSETTXFILTER(r1, 0x400454d1, &(0x7f0000000680)=ANY=[@ANYBLOB="9386c68bf668cebe445a2bc56cf0446a9d265e5040692865f03553dfb361d42a1149d5151358853976ea5edf2d012458cc1ec548e06012efaf08a2bc17e32b865f3879e341d64c6460f3632dbb7285884e413cebb88d973f321ecdd1dc4b4ae2c5ddfbed509d8d8bbd522ba24303fd49edfe1cb299509bb6e54e4e23107ef762f2261c5fcea730b65c7ae58e9286ff2582a894680e88036d0a519898c7a7c5453bcf58d498ded2c44e629ca3d03bf7344100d79e4400419e04bf97825a158bf1ab80e54c1ab629d4"]) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000100)={0x0, 0x5, 0x7, {0x763039aa, 0x115}, 0x10, 0x5}) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) mmap(&(0x7f0000261000/0xc00000)=nil, 0xc00000, 0x3000003, 0x31, 0xffffffffffffffff, 0x0) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x14) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2000002, 0x4ca31, 0xffffffffffffffff, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000100)={'wlan0\x00'}) r3 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r3, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x8, 0x8001, 0x0, 0x2, 0x7, 0xfffffe0001000001, 0xfa11, 0xffffffff}, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x1, 0x4, &(0x7f0000000480)=ANY=[], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x28, '\x00', 0x0, @fallback=0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$DRM_IOCTL_MODE_GETPLANE(0xffffffffffffffff, 0xc02064b6, 0x0) r6 = syz_open_dev$dri(0x0, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r6, 0xc02064b2, 0x0) syz_usb_connect(0x5, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="120100000c9768405e0483020b9901e4020109021b000100000000090400fb0160291d00090536", @ANYRES16=r1], 0x0) unshare(0x6020480) 13.522637161s ago: executing program 4 (id=3925): r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_usb_connect(0x5, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000b9a48f10b1134200c9070102030109022400010100"], 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x38, 0x0, 0x1, 0x8001, 0x0, 0xb49, 0x200000000002, 0x9, 0x8, 0x5}, 0x0) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) socket$inet6_tcp(0xa, 0x1, 0x0) r4 = userfaultfd(0x80801) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x3000002, 0x5d031, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f0000000100)={0xaa, 0x54}) ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x4}) ioctl$UFFDIO_COPY(r4, 0xc028aa03, &(0x7f0000000240)={&(0x7f0000800000/0x800000)=nil, &(0x7f0000199000/0x800000)=nil, 0x800000, 0x2}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendto$inet6(r3, &(0x7f0000000140)='\x00', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x6, @loopback={0xfec0ffffffffffff, 0x1c9ae7fffe9a6f34}}, 0x1c) r5 = socket$inet(0x2, 0x3, 0x4) setsockopt$inet_opts(r5, 0x0, 0x4, 0x0, 0x0) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f00000000c0)='xfrm0\x00', 0x10) connect$inet(r5, &(0x7f0000000080)={0x2, 0x4e20, @private=0xa010100}, 0x10) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r7, 0x8933, &(0x7f0000000c80)={'batadv_slave_1\x00', 0x0}) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000d40)={&(0x7f0000000000)=@ipv4_newaddr={0x28, 0x14, 0x509, 0x70bd27, 0x25dfdbfd, {0x2, 0x1f, 0x80, 0xcb, r8}, [@IFA_TARGET_NETNSID={0x8, 0xa, 0x1}, @IFA_LOCAL={0x8, 0x2, @multicast2}]}, 0x28}, 0x1, 0x0, 0x0, 0x4044014}, 0x4000000) sendmmsg$inet(r5, &(0x7f0000001f80)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f0000000280)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r8, @remote, @local}}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @broadcast, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @remote, @remote}}}, @ip_retopts={{0x38, 0x0, 0x7, {[@rr={0x7, 0x17, 0xa2, [@multicast1, @loopback, @remote, @private=0xa010101, @remote]}, @generic={0x83, 0xd, "7e448877fa0a0b48ce09d1"}, @end]}}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r8, @dev={0xac, 0x14, 0x14, 0x3e}, @dev={0xac, 0x14, 0x14, 0x21}}}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @multicast2, @multicast1}}}], 0xd8}}, {{0x0, 0x0, &(0x7f0000000840)=[{0x0}], 0x1}}, {{0x0, 0x0, &(0x7f0000000d80), 0x0, &(0x7f0000000e00)=[@ip_tos_int={{0x14, 0x0, 0x1, 0x4}}, @ip_retopts={{0x14, 0x0, 0x7, {[@timestamp_addr={0x44, 0x4, 0x2b, 0x1, 0x1}]}}}, @ip_ttl={{0x14, 0x0, 0x2, 0x59d9}}, @ip_retopts={{0x10}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}}}}], 0x78}}], 0x4, 0x40) setsockopt$inet_sctp6_SCTP_EVENTS(r3, 0x84, 0xb, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x88, 0x1, 0x0, 0x3}, 0xe) shutdown(r3, 0x1) setsockopt$SO_TIMESTAMPING(r3, 0x1, 0x25, &(0x7f0000000000)=0x405e, 0x4) recvmmsg(r3, &(0x7f0000000840)=[{{0x0, 0x41, 0x0}}], 0x414, 0x406, 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000002280)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}}, 0x0, 0x0, 0x0) 10.02458229s ago: executing program 4 (id=3940): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r2, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000003340)=@newtfilter={0x80, 0x2c, 0xd27, 0x70bd25, 0x0, {0x0, 0x0, 0x0, r2, {0xfffa, 0x4}, {}, {0x8, 0x4}}, [@filter_kind_options=@f_bpf={{0x8}, {0x54, 0x2, [@TCA_BPF_FLAGS={0x8}, @TCA_BPF_POLICE={0x40, 0x2, [@TCA_POLICE_TBF={0x30, 0x1, {0x8, 0x0, 0x2, 0x9, 0xfffff800, {0x8f, 0x0, 0x10, 0x5, 0x200}, {0x10, 0x2, 0x200, 0x1, 0x7, 0x7}, 0x9, 0x7fff, 0x8a}}]}, @TCA_BPF_FD={0x8}]}}]}, 0x80}, 0x1, 0x0, 0x0, 0x50}, 0x0) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/keys\x00', 0x0, 0x0) read$FUSE(r3, &(0x7f0000001580)={0x2020}, 0x2020) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000240)={[0x8000000000000000, 0xffffffffffffffff, 0x100000000, 0x6, 0x139f, 0x8, 0x8, 0x0, 0x1, 0xf, 0x7fffffffffffffff, 0x7, 0x4, 0x3, 0x3, 0xb8]}) 8.899650214s ago: executing program 8 (id=3943): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000240)={0x1, &(0x7f0000000200)=[{0x6, 0xff, 0x7, 0x8}]}) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, &(0x7f0000000180)={0x4000}, 0x10) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r3 = syz_io_uring_setup(0x49a, &(0x7f0000000140)={0x0, 0x79b2, 0x3180, 0x1, 0x283}, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000000)=0xffb, 0x0, 0x4) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(0xffffffffffffffff, 0x84, 0x6c, 0x0, 0x0) syz_io_uring_submit(r4, r5, &(0x7f00000001c0)=@IORING_OP_WRITE={0x17, 0x48, 0x4007, @fd_index=0x3, 0x22, 0x0, 0x0, 0x6, 0x1}) io_uring_enter(r3, 0x627, 0x4c1, 0x63, 0x0, 0x0) 7.334433582s ago: executing program 8 (id=3947): r0 = socket$inet(0xa, 0x801, 0x84) connect$inet(r0, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000280), 0x404000, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000300)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r1, 0x3b85, &(0x7f0000000340)={0x28, 0x0, r2, 0x0, &(0x7f0000ffc000/0x1000)=nil, 0x1000}) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000000c0)=ANY=[@ANYRES64=r0], 0x3c}, 0x1, 0x0, 0x0, 0x44050}, 0x14) listen(r0, 0x8) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x3d, &(0x7f0000000040)={0x1, &(0x7f0000000080)=[{0x6, 0x2, 0x0, 0x7ffffdbd}]}) r4 = add_key$keyring(&(0x7f0000000540), &(0x7f0000000180)={'syz', 0x2}, 0x0, 0x0, 0xffffffffffffffff) r5 = add_key$user(&(0x7f0000000080), &(0x7f0000000100)={'syz', 0x1}, &(0x7f0000000580)="c28fec3e6003", 0x6, r4) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f0000000200)='asymmetric\x00', &(0x7f0000000140)=@keyring={'key_or_keyring:', r5}) r6 = accept4(r0, 0x0, 0x0, 0x0) sendto$inet(r6, &(0x7f00000002c0)="cc", 0x1, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r0, 0x84, 0x66, &(0x7f0000000040)={0x0, 0x7}, &(0x7f0000000080)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r6, 0x84, 0x22, &(0x7f0000000000)={0x101, 0x0, 0x6, 0x691, r7}, 0x10) sendto$inet6(r6, &(0x7f0000000200)='x', 0x1, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r6, 0x84, 0x7b, &(0x7f0000000140)={0x0, 0x1}, 0x8) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r6, 0x84, 0x7c, &(0x7f0000001400)={0x0, 0x5, 0x7a}, 0x8) add_key$user(&(0x7f00000001c0), &(0x7f0000000240)={'syz', 0x1}, &(0x7f00000003c0)="f7894d34d4afbdb7a51d458acf097bacf33df81786691607907027f763d030d5fd1753fbcdcfca20073b6552c8a8807f98afa088b2bda28e4581b9a822bbec40109739c228029fc5f721b1ceeaa5e6cb719ab758e6186c3e3a9a041620514bde7302b7933bbaf90108c03513127d2352f0cc8b4bd67e157aa07edffdf3f003a5ce2379834883bc5f80574b339a62eb8ed60ce48e36cb77a406f5c16b4e9f25fe47", 0xa1, r4) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r6, 0x84, 0x7c, &(0x7f0000000180)={0x0, 0x6, 0x7a}, 0x8) 7.14967028s ago: executing program 8 (id=3949): socket$kcm(0x11, 0x3, 0x0) r0 = socket$unix(0x1, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) r3 = syz_usb_connect(0x2, 0x24, &(0x7f00000007c0)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) syz_usb_control_io(r3, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r3, 0x0, &(0x7f0000000000)={0x1c, &(0x7f0000000240)=ANY=[], 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r3, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r3, 0x0, &(0x7f00000003c0)={0x44, &(0x7f0000000500)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r3, 0x0, 0x0) syz_usb_control_io(r3, 0x0, 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) syz_usb_control_io(r3, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r3, 0x0, 0x0) syz_usb_control_io$uac1(r3, 0x0, 0x0) syz_usb_control_io(r3, 0x0, 0x0) syz_usb_control_io$uac1(r3, 0x0, &(0x7f0000000040)={0x44, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r3, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r3, 0x0, 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) syz_usb_control_io$printer(r3, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r3, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r3, 0x0, &(0x7f00000001c0)={0x1c, &(0x7f00000000c0)=ANY=[], 0x0, 0x0}) syz_usb_control_io(r3, 0x0, &(0x7f0000000680)={0x84, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r3, 0x0, 0x0) close(r0) socket$netlink(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) 6.69009791s ago: executing program 6 (id=3953): mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x3000003, 0x4031, 0xffffffffffffffff, 0x0) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) fsetxattr$trusted_overlay_opaque(r2, &(0x7f0000000180), &(0x7f0000000200), 0x2, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000340)="f7790066baa00066b86b4266ef66ba420066b8e20066ef0f29902cbb0000c4e2b1ba8c88d9000000666666440f38826b410f7842280f07b8010000000f01d9c4033921820f47a753fd", 0x49}], 0x1, 0x43, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000040)={[0x4, 0x2, 0x7c, 0x25, 0x20000004, 0x7f, 0x44233, 0x200000000000000, 0xffff, 0x9c1, 0x8001, 0x1005, 0xc, 0x4db1, 0x0, 0xfffffdfffffffffd], 0x0, 0xa0340}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0) r4 = syz_open_dev$vim2m(&(0x7f0000000100), 0x3, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r4, 0xc0145608, &(0x7f00000000c0)={0x1, 0x2, 0x1}) ioctl$vim2m_VIDIOC_QBUF(r4, 0xc058560f, &(0x7f00000002c0)=@multiplanar_mmap={0x0, 0x2, 0x4, 0x40, 0x6, {}, {0x7, 0x8, 0x0, 0x0, 0x5, 0x8, '|^b!'}, 0x0, 0x1, {0x0}, 0x2}) ioctl$vim2m_VIDIOC_QBUF(r4, 0xc058560f, &(0x7f0000000340)=@mmap={0x0, 0x2, 0x4, 0xffffff7f, 0x101, {}, {0x0, 0xc, 0x0, 0x0, 0x0, 0x0, "186856f3"}, 0x0, 0x1, {}, 0x0, 0x0, 0xffffffffffffffff}) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000c, 0x204031, r5, 0xffffd000) 6.124793851s ago: executing program 4 (id=3955): r0 = socket(0x1e, 0x4, 0x0) r1 = syz_io_uring_setup(0x497, &(0x7f00000000c0)={0x0, 0xf6b1, 0x3180, 0x8000, 0x40024e}, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r4, 0x29, 0x40, &(0x7f0000000980)=@filter={'filter\x00', 0x4, 0x4, 0x340, 0xffffffff, 0x0, 0xd0, 0xd0, 0xfeffffff, 0xffffffff, 0x270, 0x270, 0x270, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x2f2, 0xa8, 0xd0}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x5}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0x270}}, {{@ipv6={@private0, @loopback, [0xff, 0x0, 0xff000000], [0x0, 0xff, 0xff000000, 0xffffff00], 'team0\x00', 'batadv_slave_0\x00', {0xff}, {}, 0xff, 0xe7, 0x4, 0x44}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0x9, 0x8, 0x1}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3a0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000000)=0xffb, 0x0, 0x4) socket$nl_generic(0x10, 0x3, 0x10) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_open_dev$sndmidi(&(0x7f0000000240), 0x2, 0x141101) ioctl$VFAT_IOCTL_READDIR_BOTH(0xffffffffffffffff, 0x890c, 0x0) setsockopt$MRT_FLUSH(0xffffffffffffffff, 0x0, 0xd1, 0x0, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DESTROY(r5, &(0x7f0000000240)={0x0, 0x3c, &(0x7f0000000200)={&(0x7f0000000080)={0x1c, 0x3, 0x6, 0x201, 0x0, 0x0, {0x7, 0x0, 0xa}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x40814) io_uring_enter(0xffffffffffffffff, 0x234f, 0xb1e6, 0x1, 0x0, 0x0) syz_io_uring_submit(r2, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x40, 0x4007, @fd_index=0x3, 0xffffffffffffffff, &(0x7f0000000580)=""/207, 0xcf, 0x16, 0x1}) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=@ipv4_newrule={0x24, 0x20, 0x1, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, [@FRA_GENERIC_POLICY=@FRA_IP_PROTO={0x5, 0x19}]}, 0x24}}, 0x0) io_uring_enter(r1, 0xd44, 0x44c1, 0x7, 0x0, 0x0) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000040)=@req={0x3fc, 0x0, 0x0, 0x5}, 0x10) 6.032207846s ago: executing program 2 (id=3956): syz_usb_connect$hid(0x3, 0x36, 0x0, 0x0) r0 = socket$inet_mptcp(0x2, 0x1, 0x106) syz_usb_connect$uac1(0x4, 0x11d, &(0x7f0000000080)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0x8, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x10b, 0x3, 0x1, 0x2, 0x70, 0x6, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x6, 0x17}, [@input_terminal={0xc, 0x24, 0x2, 0x3, 0x206, 0x6, 0x5, 0x4d, 0xc, 0x5}, @feature_unit={0xf, 0x24, 0x6, 0x1, 0x3, 0x4, [0x1, 0x4, 0xa, 0x1], 0x3}, @feature_unit={0xf, 0x24, 0x6, 0x3, 0x4, 0x4, [0x4, 0x8, 0x4, 0x2], 0xf9}, @processing_unit={0x8, 0x24, 0x7, 0x1, 0x4, 0xfc, "d6"}, @feature_unit={0x9, 0x24, 0x6, 0x2, 0x2, 0x1, [0xa], 0x8}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_continuous={0xe, 0x24, 0x2, 0x1, 0x1, 0x2, 0x40, 0x5, "7caa5d", "7f9ee8"}, @format_type_i_discrete={0xd, 0x24, 0x2, 0x1, 0x7, 0x2, 0x2, 0x5, "e2b19ef1c0"}, @format_type_ii_discrete={0x11, 0x24, 0x2, 0x2, 0x1, 0x5, 0x0, "69bbaafe916d52b4"}, @as_header={0x7, 0x24, 0x1, 0x8, 0x5, 0x1001}, @format_type_i_continuous={0xc, 0x24, 0x2, 0x1, 0x0, 0x4, 0x4a, 0x0, "e7e3", "ecbd"}, @format_type_i_continuous={0xa, 0x24, 0x2, 0x1, 0x40, 0x4, 0x80, 0x80, "880e"}]}, {{0x9, 0x5, 0x1, 0x9, 0x200, 0x9, 0x81, 0xe, {0x7, 0x25, 0x1, 0x80, 0x7, 0x6fb8}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@as_header={0x7, 0x24, 0x1, 0x4, 0x10}, @format_type_i_continuous={0xb, 0x24, 0x2, 0x1, 0x4, 0x2, 0x5, 0x3, "", "a2cde3"}, @as_header={0x7, 0x24, 0x1, 0x2, 0x8, 0x1}, @format_type_i_discrete={0xf, 0x24, 0x2, 0x1, 0xa, 0x2, 0x0, 0x9, "ce21829ba87aef"}]}, {{0x9, 0x5, 0x82, 0x9, 0x20, 0x4, 0x5, 0x24, {0x7, 0x25, 0x1, 0x3, 0x9}}}}}}}]}}, &(0x7f00000006c0)={0xa, &(0x7f00000002c0)={0xa, 0x6, 0x770, 0x8, 0x6, 0x9, 0x20, 0x9}, 0x10d, &(0x7f0000000300)={0x5, 0xf, 0x10d, 0x6, [@generic={0xd5, 0x10, 0x1, "a9ef8d6cdaac1b81d830796026aca7b6d2dc8c0eb21c81767cf3814cedc507481c57d8900adde564cec06f9c2fe47e45c381e19d65b6b7bf992f25421f68fbd4a01a62f1a371c939c242087384ccee691f551b83fac88cf5552763813e79fbddea423e1844480ed3b9e2298e79e14ce4c49721f3de03709fdb343470a776b023c1226ee078c2ca285b70fbaef45a200bc4df7158d665d775cda0b56d42ebb19ae76368f93ce820df95576aefaf775aaf4d3e628f850aca05e8778eb1a7d77f80d6cece644aa33d2e4846ac13005f030b3fae"}, @wireless={0xb, 0x10, 0x1, 0x8, 0x40, 0x7f, 0x3, 0x40, 0x7}, @ext_cap={0x7, 0x10, 0x2, 0x0, 0xe, 0x8, 0x6}, @ss_container_id={0x14, 0x10, 0x4, 0x4, "5f01674e67e1255639ec20b0e4a1492d"}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x0, 0xe, 0x9c, 0x3}, @ptm_cap={0x3}]}, 0x5, [{0x83, &(0x7f0000000440)=@string={0x83, 0x3, "b7638ab6fc2b7fcd0e95668a0f3583d7cd9d3d81a372ee777cc66b9fbe812e9e6db6eac9f272af9db0afb6a07406aa0dda4a4464e7c43fb73de62cdecbc11000be840f35057a60dac847e914cfbce7d3f67c7e0f67813003cef1bc67ec3147719d1c5d0c1affae8af7bf52f2055d68969feb63c1d45350f616db3eef49c62e9436"}}, {0x45, &(0x7f0000000500)=@string={0x45, 0x3, "7b4ad06a152d91fa9d0d9a777823af4128154f47359d1003c650d7e8e450c0730602041c16144231bffacd6a76751f98cb7a227dbc367055a8209794f58b2b56108fb2"}}, {0xb6, &(0x7f0000000580)=@string={0xb6, 0x3, "1ed798535f211f41656f13ad58853cddd4a29321386c467732b58f116746c3a6bd1aee18888e6b2bd58cecf3374ada7ed2c1517fbb66ba83e8be4f8fb5137724bab097e7ddebdda9d336a0ea21753d2cb7fa53c01f8a6f697a3693d49efbaa9b67936d2e2587f8d6f1f461329053062bbd6aa6097086844fbf135757491e813d8b4ac3018c82bad269c9fa1e636c0f9849dd281edfff4ee07c0dee1030d5ab343f1b2b7f45ec86fc4b934e8ee045d108cd0872d4"}}, {0x4, &(0x7f0000000640)=@lang_id={0x4, 0x3, 0x440a}}, {0x4, &(0x7f0000000680)=@lang_id={0x4, 0x3, 0x41e}}]}) setsockopt$inet_tcp_int(r0, 0x6, 0x5, &(0x7f0000000040)=0x24, 0x5) setsockopt$inet_int(r0, 0x0, 0x13, &(0x7f0000000000)=0x800, 0x4) syz_emit_ethernet(0xbe, &(0x7f00000001c0)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff0800450000b00000000000119078ac141400ac1414aa00000000009c90780100000000000000f4cb985d86dd6266b5efb88a2c2ceda081bac8b2f9a49d564054f1c9218f47b3cf8743eb4d9e776f94a6a58d36e006ac614f6f7bce9217cbfea31675d4a860cf6003977b1e4dbb16dc31cc76522bf19d5043edd2a8cc8c41345f8feb1a7a8e23043b8a465b1ed5bf8bc91307c7193f7edd1efe4742dc481e6f57f901948177bcc5dea4029ba4683a6bdcd7a1c9eb92b88a3505711767e410d6d3144f8d2dae2d33af9a78a64b98027354d587d0b913400f0b2002dd2df65232dd04"], 0x0) 5.760366616s ago: executing program 6 (id=3957): r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000280)={{0x12, 0x1, 0x141, 0x27, 0xc0, 0xde, 0x20, 0x86a, 0x3, 0xf03f, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0x2, 0x2, 0x2, 0xf3, 0xbf, 0xf5, 0x0, [], [{{0x9, 0x5, 0x6, 0x2, 0x200, 0x2, 0x0, 0xa}}, {{0x9, 0x5, 0x82, 0x2, 0x200, 0x0, 0x1, 0x10}}]}}]}}]}}, 0x0) r1 = socket$inet6(0xa, 0x5, 0x0) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f0000fee000)=0x3fa, 0x4) bind$inet6(r1, &(0x7f0000000140)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) r2 = socket$inet6(0xa, 0x5, 0x0) setsockopt$sock_int(r2, 0x1, 0x4000000000000002, &(0x7f0000fee000)=0x3fa, 0x4) bind$inet6(r2, &(0x7f0000000140)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) connect$inet6(r2, &(0x7f0000000240)={0xa, 0x4e22, 0x0, @private1}, 0x7f) connect$inet6(r1, &(0x7f0000000240)={0xa, 0x4e22, 0x0, @private1, 0xd}, 0x1c) syz_usb_control_io$uac1(r0, &(0x7f0000000200)={0x14, 0x0, &(0x7f0000000380)={0x0, 0x3, 0x16, @string={0x16, 0x3, "6d0a412b2cde821824674afe5f8c7e017e901c88"}}}, 0x0) 5.61666215s ago: executing program 4 (id=3958): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x202, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xc0241, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r3, 0x107, 0xa, 0x0, 0x0) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) mknod(&(0x7f0000000040)='./file0\x00', 0x8001420, 0xffffffff) r4 = syz_open_dev$sndctrl(&(0x7f00000000c0), 0x4000000000000001, 0x103000) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000002340), 0x40800) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r5, 0xc058534f, &(0x7f0000002380)={{0x0, 0x1}, 0x1, 0x0, 0x2, {0x4}, 0x3, 0x800}) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r4, 0xc4c85512, &(0x7f0000000480)={{0x40003, 0x3, 0x24000000, 0x3ff, '\x00', 0x6}, 0x1, [0x9, 0x11, 0xfffffffffffffff9, 0x5, 0xf, 0xa, 0x800000, 0xff, 0xffffffffffffffff, 0x9, 0x1, 0x8, 0xfffffffffffffff7, 0x80000004, 0x3ff, 0x1, 0x36, 0x3, 0xc0010, 0x9, 0x1, 0x3ff, 0x7ff, 0x5, 0x80, 0x0, 0x4, 0x6, 0x7bc10d5c, 0x9, 0x1, 0x71, 0xa, 0x2, 0x1ff, 0x7fffffff, 0x9, 0x4, 0x45, 0x10, 0xfffffffffffffff7, 0x16, 0x9db6, 0x7f, 0x6, 0x2, 0x5, 0x7, 0x0, 0x8, 0x3, 0x303, 0xa2, 0x8000, 0x7, 0x400, 0x9, 0x1fd, 0x3, 0x2, 0xc9a8, 0xffffffff, 0x3, 0x8, 0xffff, 0x0, 0x10000, 0xffffffffffffffff, 0x5, 0x3, 0x5, 0x9, 0xec, 0x7d, 0xffffffffffffffff, 0x100000000, 0x9f1a, 0xffffffffffffffff, 0xffffffff, 0x8, 0x0, 0x9, 0x3, 0x9, 0x1, 0x4, 0x3, 0xa, 0xf4, 0x4, 0x2, 0x2, 0x2, 0xe, 0xe70, 0xfffffffffffffff7, 0xb, 0x7, 0x6, 0x9, 0x5, 0x63b, 0x8, 0x4, 0x400, 0x9a06, 0x7, 0xffffffff00000000, 0x3, 0xb5, 0x400200080000001, 0x5, 0xd30, 0x1, 0x4, 0x256, 0x6ff, 0x40, 0x7, 0x1ff, 0x6, 0x9, 0x0, 0x1b485fe1, 0x7, 0x7, 0xfffffffffffffff7, 0x9]}) bind$inet(0xffffffffffffffff, &(0x7f0000000100)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, &(0x7f0000000000)=0x5, 0xffffffffffffff17) socket$nl_xfrm(0x10, 0x3, 0x6) r6 = openat$audio(0xffffffffffffff9c, &(0x7f00000005c0), 0x40000000008d82, 0x0) r7 = syz_io_uring_setup(0x578a, &(0x7f00000002c0)={0x0, 0x30be, 0x400, 0x2, 0x104}, &(0x7f00000001c0)=0x0, &(0x7f0000000240)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r8, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r8, r9, &(0x7f0000000200)=@IORING_OP_WRITEV={0x2, 0x40, 0x4000, @fd=r6, 0x7fffffffffffdfff, &(0x7f0000000340)=[{&(0x7f0000001900)="acbe16e97c4e9463bf7dfdaac4cd231eeb09dfeb84dffd558e3c844ba6a25b2b22536a", 0x23}], 0x1, 0x0, 0x1}) io_uring_enter(r7, 0x847ba, 0x0, 0xe, 0x0, 0x0) connect$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @broadcast}, 0x10) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000004d00)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x30000}}], 0x300, 0xf1c) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x1, 0x0) syz_open_dev$vim2m(&(0x7f0000000180), 0x0, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) 5.303283926s ago: executing program 2 (id=3959): r0 = socket$packet(0x11, 0x3, 0x300) (async) r1 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_S_INPUT(r1, 0xc0045627, &(0x7f0000000100)=0x3) (async) ioctl$VIDIOC_ENUM_DV_TIMINGS(r1, 0xc0945662, &(0x7f0000000040)={0x0, 0x0, '\x00', {0x0, @reserved}}) syz_usb_connect(0x1, 0x2d, &(0x7f0000000340)=ANY=[@ANYBLOB="120100001ddf8208c007121522300000000109021b0001000000010904010001faf40d00090582239f"], 0x0) (async) socket$nl_netfilter(0x10, 0x3, 0xc) syz_open_dev$char_usb(0xc, 0xb4, 0x0) (async) sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0x4000800) (async) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) (async) readv(0xffffffffffffffff, 0x0, 0x0) (async) r2 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r2, 0xaf01, 0x0) (async) ioctl$VHOST_SET_VRING_ADDR(r2, 0x4028af11, &(0x7f0000000200)={0x0, 0x1, 0x0, &(0x7f00000001c0)=""/29, 0x0, 0x8000000}) ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f0000000680)) (async) r3 = socket$inet6(0xa, 0x3, 0x7) sendmmsg$inet6(r3, &(0x7f0000004580)=[{{&(0x7f0000000080)={0xa, 0x0, 0x0, @mcast2}, 0x1c, 0x0, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB='$\x00\x00\x00\x00\x00\x00\x00)\x00\x00\x002'], 0x28}}], 0x1, 0x0) (async) r4 = syz_open_procfs(0x0, &(0x7f0000000040)='statm\x00') (async) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x181, 0x0) (async) sendmsg$SOCK_DIAG_BY_FAMILY(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)={0x24, 0x14, 0x51b, 0x70bd28, 0x25dfdbff, {0x11}, [@INET_DIAG_REQ_BYTECODE={0xd, 0x1, "95d875db896271d922"}]}, 0x24}, 0x1, 0x0, 0x0, 0x2400a051}, 0x44000) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x2) ioctl$KVM_SET_CPUID2(r7, 0x4008ae90, &(0x7f0000000000)={0x2f}) (async) dup3(r0, r4, 0x0) (async) unshare(0x22020600) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r8, 0x10e, 0x2, 0x0, 0x20) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f00000000c0)={0x0, r4}) 3.920211352s ago: executing program 2 (id=3961): r0 = socket(0xa, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x4000000000000, 0x40, &(0x7f0000000540)=@raw={'raw\x00', 0xc08, 0x3, 0x458, 0x310, 0x5002004a, 0xb, 0x0, 0xea13, 0x3c0, 0x3c8, 0x3c8, 0x3c0, 0x3c8, 0x3, 0x0, {[{{@ip={@multicast2, @private=0xa010101, 0xff, 0xffffffff, 'bridge0\x00', 'veth0_macvtap\x00', {}, {0xff}, 0x5c, 0x3, 0x2}, 0x0, 0x2c8, 0x310, 0x0, {}, [@common=@unspec=@bpf1={{0x230}, @bytecode={0x0, 0x2, 0x0, [{}, {0x16}, {0x4}, {}, {}, {0x0, 0x0, 0x5e}, {}, {}, {}, {0x0, 0xa}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0xfffffffd}, {0x6}, {0x0, 0x0, 0x4}, {}, {0x4, 0x65}, {}, {}, {0x2, 0x1}, {0x0, 0x0, 0x0, 0x7f}, {0x0, 0x4}, {}, {0x0, 0x0, 0xfd}, {}, {0xfffc}, {}, {}, {0x0, 0x0, 0x2}, {}, {}, {}, {}, {}, {}, {0x0, 0x7}, {0x7fff}, {}, {}, {0x4}, {}, {0x0, 0x0, 0x50}, {}, {0x0, 0x1}, {}, {}, {}, {}, {}, {}, {}, {}, {0x80, 0x0, 0x0, 0x8}, {}, {}, {0x0, 0x0, 0x0, 0xd53}, {}, {}, {0x0, 0x0, 0xfd}]}}, @common=@inet=@ecn={{0x28}, {0x10, 0x20, 0x1, 0x5b}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0xffffffff, 'pptp\x00', {0x100000}}}}, {{@uncond, 0x0, 0x70, 0xb0}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz0\x00', 0x7, 0x99}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x4b8) r1 = syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040bd2835090000330000010902240001000020080904140002030002000921fdff000122450009058103"], 0x0) r2 = epoll_create1(0x80000) r3 = epoll_create1(0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x1, 0x0, 0x0, 0x3) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) close(r2) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fc00100}]}) getpid() epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000c85000)={0x8000200d}) syz_emit_ethernet(0x2b, &(0x7f0000000000)={@multicast, @local, @void, {@ipv4={0x800, @igmp={{0x5, 0x4, 0x0, 0x4, 0x1d, 0x66, 0x0, 0x7, 0x2, 0x0, @private=0xa010102, @local}, {0x11, 0x1, 0x0, @empty=0x1000000, '\x00'}}}}}, 0x0) epoll_ctl$EPOLL_CTL_MOD(r3, 0x3, r2, &(0x7f0000000180)={0x40002000}) syz_usb_control_io(r1, 0x0, 0x0) ioctl$KVM_GET_DEVICE_ATTR_vm(r2, 0x4018aee2, &(0x7f00000000c0)=@attr_arm64={0x0, 0x0, 0x0, &(0x7f0000000080)={0x5, 0x4}}) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000700)=@ipv6_newaddrlabel={0x70, 0x48, 0x1, 0x70bd2a, 0x25dfdbfe, {0xa, 0x0, 0x0, 0x0, 0x0, 0x5}, [@IFAL_ADDRESS={0x14, 0x1, @empty}, @IFAL_ADDRESS={0x14, 0x1, @mcast2}, @IFAL_LABEL={0x8, 0x2, 0xc}, @IFAL_LABEL={0x8, 0x2, 0x2}, @IFAL_LABEL={0xffffffffffffffae, 0x2, 0x1}, @IFAL_ADDRESS={0x14, 0x1, @private1={0xfc, 0x1, '\x00', 0x1}}]}, 0x70}, 0x1, 0x0, 0x0, 0x4008804}, 0x20040040) r5 = syz_usb_connect(0x2, 0x752, &(0x7f0000000380)={{0x12, 0x1, 0x201, 0x59, 0x37, 0xa9, 0x20, 0x403, 0xf857, 0x173d, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x740, 0x3, 0x8, 0x1, 0x0, 0xff, [{{0x9, 0x4, 0x4d, 0x9, 0x4, 0xf4, 0x39, 0x1a, 0x4, [@uac_control={{0xa, 0x24, 0x1, 0x55c, 0x4}, [@feature_unit={0xd, 0x24, 0x6, 0x2, 0x4, 0x3, [0x5, 0x2, 0x1], 0x1}, @processing_unit={0xb, 0x24, 0x7, 0x5, 0x3, 0x2, "8a10cc87"}, @selector_unit={0x5, 0x24, 0x5, 0x4}, @extension_unit={0x9, 0x24, 0x8, 0x2, 0xd, 0x4, "c87e"}]}], [{{0x9, 0x5, 0x4, 0x10, 0x20, 0x9, 0x10, 0xfc, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0x5, 0x8000}]}}, {{0x9, 0x5, 0x0, 0x2, 0x40, 0x0, 0xd, 0x5, [@uac_iso={0x7, 0x25, 0x1, 0x1, 0xb, 0x7fff}]}}, {{0x9, 0x5, 0x2, 0xc, 0x40, 0x8, 0x3, 0x6, [@generic={0x86, 0x6, "fc78ebca6f248337cdc52c2352bda45a8313e02450a76c99dd5ab6c61875b1f34cc7eb6b1e2205cbb8806c2cb8c47b87c040546c81aac1563d4809d5f8237524328d2ae1e4275bfbe14b67c357b32aea63d9dafb247f67355e09d5f2ecd85cefbb2d98ece9a63b5a75394fd351ba10059de7b8f9922934591f53640e03b23c2a53221a16"}]}}, {{0x9, 0x5, 0xb, 0xd, 0x400, 0x36, 0x79, 0x4, [@uac_iso={0x7, 0x25, 0x1, 0x83, 0xff, 0x6}, @uac_iso={0x7, 0x25, 0x1, 0x1, 0x7f, 0x6068}]}}]}}, {{0x9, 0x4, 0x4f, 0x8, 0x9, 0x43, 0x2a, 0x19, 0x2, [@hid_hid={0x9, 0x21, 0xfff4, 0x10, 0x1, {0x22, 0x694}}, @uac_control={{0xa, 0x24, 0x1, 0x5, 0x9}, [@extension_unit={0x9, 0x24, 0x8, 0x2, 0x11, 0xc, "74b0"}, @processing_unit={0xb, 0x24, 0x7, 0x3, 0x7, 0x7, "d41e4302"}]}], [{{0x9, 0x5, 0xf, 0x3, 0x3ff, 0x57, 0x3, 0x9, [@generic={0x1e, 0x22, "033523de9d35d670211cb89cedadc31c20088071e72368b75e8fd68d"}, @uac_iso={0x7, 0x25, 0x1, 0x83, 0x3, 0x4}]}}, {{0x9, 0x5, 0xa, 0x10, 0x0, 0x6, 0x5, 0xff, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0x7, 0x80}]}}, {{0x9, 0x5, 0x6, 0x0, 0x200, 0x6, 0x1, 0x1, [@generic={0x38, 0x23, "dc325e65838243e16fb29f04edf9317e95710b222d05f6ceded60f584f589cbb259dd256471e13ae3f6168f78a9bfabd44f36ea101eb"}]}}, {{0x9, 0x5, 0xd, 0x0, 0x400, 0x7, 0x80, 0x5, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0x3, 0xc14}, @generic={0x4f, 0x23, "73ed84eda0210e6c5b97755e455b11436e46a41c7eb76eec22442521960ecb4b4c8692a03973438388a6aaeb1615482f44a26f4e7bd37eb4635fb768e7f3ec8f09293370dffb0245f8a1268492"}]}}, {{0x9, 0x5, 0xd, 0x10, 0x3ff, 0xc8, 0x5, 0x8, [@generic={0xb5, 0xa, "0520c9d71bc209978c25b05aa932bc8245e867ea2ae67775a10bbb318b8f7b68348cfede41993a4c5a5c67e5130afef5d204ef1f3908a94bcfd651654cc07138deab44dcd125af74de59cf5fb8ac90cc99e659b47c7c73f4f9b8c02f4abffec64ffd27f00bc55da21921e97c22196cb757d7eb38f52f77c1f0f363bd20777db47bd50dccefbe00703ac5bda1d8d198b6fde6aa08c91773a8b2d5c17e0a537ecbff144fd0c19d8a39a4b3cb4a3b04ac2acfc2f8"}]}}, {{0x9, 0x5, 0x3, 0x1b, 0x3ff, 0x3, 0x4, 0x3, [@generic={0xcd, 0x23, "52b953d9e72f3ea3da76a1a9d0f0bbb685e0db7ab05cc085dda64033eb442bc08d298bf184b79eee0a349a56fa286f7b1fb57d9a53f74963593a63725aa0c0c0500df9a6e33648acf9104125048536e72d3116b9dcccda2c398a0ef24048a5c169feb0b843fb04a9e2c8d5e3768147e5eb09d70785cbffdfd6253c1addbb2b3086568e48a08388d388810f139e35ec48f65a22346d8fcec9731670d01a70a073e02336dc131e79272699626c927441da18a9cb02f1e6d0f6a4ded393fefb162a4b7036b7a24c4e1920df16"}]}}, {{0x9, 0x5, 0xc, 0x16, 0x8, 0x4, 0x5, 0x1, [@uac_iso={0x7, 0x25, 0x1, 0x1, 0x8, 0x6}]}}, {{0x9, 0x5, 0x8, 0x1, 0x8, 0x8, 0x6, 0x6, [@uac_iso={0x7, 0x25, 0x1, 0x1, 0x5, 0x7}, @uac_iso={0x7, 0x25, 0x1, 0x2, 0x3, 0x2}]}}, {{0x9, 0x5, 0x3, 0x10, 0x8, 0xd7, 0x2, 0x50, [@uac_iso={0x7, 0x25, 0x1, 0x80, 0xe1}]}}]}}, {{0x9, 0x4, 0x1f, 0xe, 0x2, 0xd9, 0xa4, 0x30, 0x9, [@hid_hid={0x9, 0x21, 0x4, 0x23, 0x1, {0x22, 0x47d}}], [{{0x9, 0x5, 0x0, 0xc, 0x200, 0x40, 0xb, 0x9, [@generic={0xaa, 0x23, "dfd22a2f0678cdf657941dc0fbaaa7ff4064dc99e2fc22073611cdd8d1c335ca3b3a4cced48ed4cd49b8ddc6b17c7b03b1b24e90c08904e9b0c3b55e52032a9efe69b05471a9f80fc3ab0913587f977d3fdf824e4eaa07dbbfef9b8e8e6c4a3c5ab2c9dcdda702cb23d3c1fec71168cdf58123d73316695a6c02ed17589e5291e80b0167e8975073f132aa4edf7b686876a5c8227e095de2cd0ef841a1c72f1dc4527a15afc115de"}, @generic={0xbe, 0x31, "13d1931535efae73d695a221e71780d0c81dc8d46323219fa7691c8bffe357b594ed6b7e8099da09e78d6bd444f2f4e06ccfd8fb450f2a0a176bc67311eba9e47e27b8848a1c8a533e98b8e03ade701abe2426c9f154871e7bf5be15a7bf17d1a1b5b6a0b14e5db8002f9ba28bfb8a7d257d7eba550e2ca85dc45a6e5c5a96be4b4b4eea04c1d7cb276bec4a558045ee192283680061fce50ce6a0c97dcc2a513761d542c8b28410b98eaefafa28753b5b1272804965d4524cf5a73e"}]}}, {{0x9, 0x5, 0xd, 0x2, 0x0, 0x1, 0x7, 0x1, [@generic={0xe4, 0x7, "54c4eaa9867fc3b5f090e5085cd85523deaff46bf9f55dd98a07aff222f8b0c193e6dc39755f5e1f4210451c009c001430cf66a30546bc9a890b1b619e6509614d02391e4e59fe069fef08b163b8aa0c81556456eb83bbb072a80d14f5889be8e53eabbafb73f08cd18509102df67523b188dacec36cec7c7812447bae230eda2c004eafa7421d2a02d1644a833d027e521f69e7250ce0fe9b816d8a817c4433122cf5e4c623cd230e189ec8ed9ffd6b47c87d51cb4f348d29ce59ca2bd9ef8f37b55b22a2cb322db5de41eadf925a366ba50a236191dcbb96a9dba5d64ea9a5a128"}, @generic={0xf1, 0x10, "0a641ace780110a7c0a6693e050d9a3f45430fee46c890105556ec62865fd3398732c4b96d2eaff3c2535adbf06caeff5391126f30d4ba5befd3ed474408e166c79f8eb0861c0bd0408f03513d05210d3319deff63127cfdc4e7c6dc79d303e4781e4eb6bda8b4deea441fb542955713e03a5cb1982574e9cc0a1e0d02c50d55751c0c362a63170202fd351122b2a2afb53cef2bb264772c9cab62d8a2dc2aece9da1ecf0a265afcc96b787ba5404ca279cd670f3de5d508b35753a48d79d8a469fbf656c13627f398c4bcc269dc4e1930098e60b0e8152c47a40950da50177d0cf1830c14cdff51737f486bbc86b5"}]}}]}}]}}]}}, &(0x7f0000000c00)={0xa, &(0x7f0000000100)={0xa, 0x6, 0x300, 0x7, 0x9, 0x2, 0x8, 0x2}, 0x19, &(0x7f0000000140)={0x5, 0xf, 0x19, 0x1, [@ss_container_id={0x14, 0x10, 0x4, 0x49, "e75cb8466ed28d363959002a24289ca4"}]}, 0x6, [{0xdd, &(0x7f00000001c0)=@string={0xdd, 0x3, "3f0d69584af6b701456d91aadd34b2bd47cc8b62a277edb1bf8216af01ad405bae291470b51f9b96ad9dabc9aa72f3d238793b116c9e8871c4e36b32253c1c3d12b1d577d56854c5007ce78cccbd479814bdf7be49f43c775d943164c2e7cbb6d9f03fe233ddd0a1f21f722be7464d883f27315728941a17c5768245305453dc86111bbf3b3a5f9edb0e54ff21e6b85e83923ea674d3ae9438ad4e3a6257295e0004836271effa0a11f6cc52635bf8bb1491e740ce4e011bc26696bf581a1edd74ab738c39b7246cccba00deab86d92a8785acecd125031457ec16"}}, {0x4, &(0x7f00000002c0)=@lang_id={0x4, 0x3, 0xc0a}}, {0x4, &(0x7f0000000300)=@lang_id={0x4, 0x3, 0x412}}, {0x7b, &(0x7f0000000b00)=@string={0x7b, 0x3, "953d30938a1fe97c7c69a2cc420b8218c59ea225002dc3a2df63248cb504573a4ccc648f2fe9b20b810197efae9aeafd16e798cc8bbfcd9b0a631e57f0c490b1ee47f14f4af4f1a5800a7687f933fd7e0331a4b78ca6a8ea042ff1e24cb450193278cd2ead438690d2c43b420c4584c8f2935dd6489ada038e"}}, {0x4, &(0x7f0000000b80)=@lang_id={0x4, 0x3, 0x424}}, {0x4, &(0x7f0000000bc0)=@lang_id={0x4, 0x3, 0x447}}]}) syz_usb_control_io$printer(r5, &(0x7f0000000e80)={0x14, &(0x7f0000000c80)={0x20, 0x26, 0xc4, {0xc4, 0x10, "8e1f3690a807457eabddd362559702c595aef556a977d1e3a55a5ff0e918941989b268fb8f0e9b5de3b3d2f63f4c36178b1eb8413d97b97a9768a7e261d1e785ecb2914895ec0f77115933d9821481d08048bbd4df69eac0d6c0c96429ad526b171fa4099ee3ba280f3579f8e9a12fb39f9fede9cdefe9ea37fe9237ec1fd54b1a3a4811e02622fe8ef82f7089f5d7a509098ee22ace35b6e2affe9411e0b75755b7936669fd6f12ab338b751755f821aa8fbbff25aa814fdb5c1a5936499f7744c3"}}, &(0x7f0000000d80)={0x0, 0x3, 0xd4, @string={0xd4, 0x3, "1a7ff15741d8eb5a0d3b169bd08789c681af9def61fca550a4a2d3fd7c7b7c3b43c2df499b00b251afd3caadb8db7b8f723329359ce803329d167a0e3d83bf849d1d393a3116744ea26064960bf8fdcc45fa926aa01f9c2f17838d6c3f4be6ef2e77d7be21d7b4cf6e09c8959cd85fb08d7c56dfba3d8dd5763ebc76e1d658af7ff019add737b4ae6e960771cc83f48bea86655955c03b730562bfef30a78dfe226d24fa2bbc520b53709b8216f899edcb1edb88dc54e25d434586dfbb37cf0bac51cdbdea510afc4af78dc781c90493eeb9"}}}, &(0x7f00000010c0)={0x34, &(0x7f0000000ec0)={0x0, 0xf, 0x70, "e28da2f9c07bddee97261349292e7b88bdca3b8c9f20b247e98340940b3769c776c45b5e74e0f8d96fa0a50865bf640fbc091ed72ca40d3d7b8af6ee221dd11e79741b9a9a05499471dc64706f08df99d32c07529038e2f1029ca3c5702ec2510288a631a739cd8dbabf43bf65136c74"}, &(0x7f0000000f40)={0x0, 0xa, 0x1, 0xf6}, &(0x7f0000000f80)={0x0, 0x8, 0x1, 0x2}, &(0x7f0000000fc0)={0x20, 0x0, 0x4f, {0x4d, "d98a7f5a5c347c7278b25d91fbc9cf25b7c9112a3117d85e85ab0c8474949ef62ef96eccef1aa12914730fa1adf4af927c87fcf206e9c6633c8ecd981ad3c87336c859c7aeecc30108b3581599"}}, &(0x7f0000001040)={0x20, 0x1, 0x1, 0x6}, &(0x7f0000001080)={0x20, 0x0, 0x1, 0x80}}) syz_usb_control_io(r1, &(0x7f0000000340)={0x18, &(0x7f0000000040)=ANY=[@ANYBLOB='@#E'], 0x0, 0x0, 0x0, 0x0}, 0x0) 3.285914758s ago: executing program 4 (id=3965): r0 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101301) ioctl$USBDEVFS_RELEASEINTERFACE(r0, 0x80045510, &(0x7f0000000000)=0x5) 3.093207122s ago: executing program 4 (id=3966): r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0xa1, 0x12, 0x17, 0x10, 0xb95, 0x172a, 0xf7f4, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0xfb, 0x0, 0x2, 0x6c, 0x5d, 0x65, 0x0, [], [{{0x9, 0x5, 0x4, 0x2, 0x10, 0x0, 0xfa}}, {{0x9, 0x5, 0x82, 0x2, 0x40}}]}}]}}]}}, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) r1 = socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = gettid() sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[@ANYBLOB="3c00000063126805007e30687cdf9e52f3dd62b437d7a38b981ed4d4d125acaddeaace80e86e188f47ba62d58741a6314c23835aea342eaa6c5d5eb40a510c35c97fce46fb30bb98857432ca683d356aa5f22808ae673f3aa83d57c8089ca25ae4f940cb5753b1502c", @ANYRES32=0x0, @ANYBLOB="942a000004000600140012800900010076657468000000000400028008001300", @ANYRES32=r5, @ANYBLOB], 0x3c}, 0x1, 0x0, 0x0, 0x4000000}, 0x24008080) keyctl$KEYCTL_WATCH_KEY(0x20, 0x0, 0xffffffffffffffff, 0x71) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0x8, 0x4, 0x4, 0x10002, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0xffffffff, 0x0, 0x0, @void, @value, @void, @value=0x180}, 0x50) r6 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000600)=ANY=[@ANYBLOB="541b0001abb4442d9b000017000000006370cff27f033acf68a2a8a1b30cfe9d1eadc67c15bbebfb5906558371635d3ccc84e2856db630f27d6d3d08950a64e2d06e97f218ef5802a4c85f5d5a853916fa45285b52ac55f032e2c87f79a72bd38b68c4a47d2f7dad203314a7ca2157cbc68318d0b5b04992e8b0a620ed5a6a3709edf7a72ce055890aee46e9eb1e222ebe949ef372545d2547c7ff", @ANYRES16=r6, @ANYBLOB="1709000000000000000001000000050007000000000008000900fcffffff08000a000000000014001f00000000000000000000000000000000001400200000000000000000000000ffffe0000001"], 0x54}, 0x1, 0x0, 0x0, 0x100008c5}, 0x20000810) r7 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r7, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x110b, 0x8000000000002}) r8 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x800, 0x0) ioctl$BINDER_WRITE_READ(r8, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r9 = dup3(r8, r7, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a, 0x4}) socket$nl_route(0x10, 0x3, 0x0) ioctl$BINDER_WRITE_READ(r9, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000580)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000440)={@flat=@weak_binder={0x77622a85, 0x1000, 0x2}, @flat=@binder={0x73622a85, 0xa, 0x3}, @flat=@binder={0x73622a85, 0x1000}}, &(0x7f0000000240)={0x0, 0x18, 0x30}}, 0x1000}], 0x0, 0x0, 0x0}) r10 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000100)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) read$FUSE(r10, &(0x7f00000034c0)={0x2020}, 0xcac) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) 2.87293522s ago: executing program 8 (id=3967): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='dctcp', 0x5) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) sendto$inet6(r0, &(0x7f0000000300)="a6", 0x1, 0x24000045, &(0x7f00000001c0)={0xa, 0x2, 0xffff, @loopback, 0x9}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='bbr', 0x3) shutdown(r0, 0x1) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_int(r1, 0x0, 0x32, &(0x7f0000000f00)=0x1000000, 0x4) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000140)={'veth0_macvtap\x00', 0x0}) sendmmsg$inet(r1, &(0x7f0000000000)=[{{&(0x7f00000000c0)={0x2, 0x4e24, @broadcast}, 0x10, 0x0, 0x0, &(0x7f0000000280)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r2, @private=0xa010100, @empty}}}], 0x20}}], 0x1, 0x4004004) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xc, 0xf}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8001}, 0x20008850) sendmsg$nl_route_sched(r4, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000940)=@newtfilter={0x34, 0x2c, 0xd27, 0x70bd28, 0xfffff000, {0x0, 0x0, 0x0, r6, {0xf000, 0xffff}, {}, {0x7, 0xa}}, [@filter_kind_options=@f_route={{0xa}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x80}, 0x20000800) sendmsg$nl_route_sched(r3, &(0x7f00000002c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)=@gettclass={0x24, 0x2a, 0x4, 0x6, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {0x6, 0xfff3}, {0x7, 0x5}, {0x10, 0x3}}, [""]}, 0x24}, 0x1, 0x0, 0x0, 0x840}, 0x4000010) 2.653910824s ago: executing program 6 (id=3968): syz_emit_ethernet(0x3b6, &(0x7f00000003c0)={@multicast, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "122d92", 0x380, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x0, 0x0, 0xf5, 0x0, 0x0, [{0x0, 0xa, "a78ce54006598080a8030037004023493b87aafaffffffffffffff23732472eefa45ad96579269748e254c1e4a8a8b3f0ab0c430d3be27df3e34066d42ca0a5c15b37adac15084dbaf736b41e5af1802"}, {0x0, 0x20000000000000f2, "000000000000000026000400"}, {0x18, 0x18, "fe906d26efe39393fe08f73eabc5977b1190a3a6ad8338f1511cdd10c35d8f6de79fc7fd175f75649fa368a32c829af02d7f44d92324a7051e460a13ddde25a5b85b9d930914625d8a049b4cf0d129806a610ad8477a2499a9a0527f75b655a6653d0363a979acf93f88eea07d68423e90280409de1657275f716a2bf2915d1783e8eb477b0d1170f0ecbdef4c23e1b76e9ab3d2fbe4b34438d2a77577edd0ebed9682b851b380ae0cab282af9d7ebe668177704c5fd4698c934de4731f3f61effc978"}, {0x0, 0x1d, "06aa85616177c41bc943afcb84619755403946b0730a18d5c38cf7dcad830f2dc8674b87ba8b58f81ece27975cc39e595e9af90b4fe92a38d25551c2d9ebfc5dfc5a2a501b7e483de3f808895c5f4a1a2367bc591dd8b094822ff0dea07c9a1f643c822a18b79f7c5eba31fb68b2d734a6671e27182aee96f24a4a5cf390dab23b500b0c0272479611e4f7f4299ec4d926d443367b105185e6ecd9602ba95392343e9bbd047ef6bc1ba42399907ccd0a562db212baa39eb8164e240069f656d3a05fecf894222a141123f5ac010000000000000090aa235a670670ffc5dc49dfb58d00000000000000"}, {0x18, 0xb, "17dcea46805d4809c20547406b18901b0aeff04c0300f3c75dc2d227a83b89483b1084743475671545e65eb2e9ac946a3f0e2bc4619f91394c02bcfbbb7d71138537d68e2d2c6393a9f3becd1a9f51a948b5b303f4f003"}, {0x21, 0x7, "000000ffffff0000000000020000000000000000000000ffff008879e66485201a0015ca83740000000000000000000000000000004000"}, {0x1, 0x14, "5e14f0e7e72d42cfb3f27fafb60845f90b6dfc2e37bc87c6905bbc94d33e1ea71a28105f543e868a8a53b360a9d33e2b1e26eb1d18065daa7628cf9ef083611c9f6ae2e1eb3d8bf9c6ab2642c4808288e62afbf03269f1f98aea6ab3beb5fdc5fdaabc2c676d8800871a6aa54155dea2d995cb22c9924e0ad38c6967052cc7786d779b8353aac33a57d79b05613a12328f61129017fa632dbf04542188b196e213408c"}, {0x3, 0x5, "d5170000dce9674a36da018dff16e70b8b14c4b7a94fe18e88605aa6be1a02a326a6bce65f81ed"}]}}}}}}, 0x0) 2.561157084s ago: executing program 8 (id=3969): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000200)=@abs={0x1, 0x0, 0x4e20}, 0x6e) (async) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) (async) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) (async) r3 = syz_io_uring_setup(0x497, &(0x7f0000002180)={0x0, 0x787f, 0x100, 0x4, 0x1b0}, &(0x7f00000000c0)=0x0, &(0x7f0000000280)=0x0) io_uring_register$IORING_REGISTER_PBUF_RING(r3, 0x16, &(0x7f0000000040)={&(0x7f0000001000)={[{0x0, 0x1f, 0x3}]}, 0x1, 0x1}, 0x1) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f00000002c0)=@IORING_OP_RECV=@use_registered_buffer={0x1b, 0x20, 0x2, r2, 0x0, 0x0, 0x0, 0x200, 0x1, {0x1}}) io_uring_enter(r3, 0x3516, 0x0, 0x0, 0x0, 0x0) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r6, 0x29, 0x2, &(0x7f0000000000)=0x7, 0x4) r7 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x105042, 0x0) sendmsg$can_bcm(r7, &(0x7f0000000800)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000100)={0x1, 0x80, 0xc, {}, {}, {0x3, 0x0, 0x1, 0x1}, 0x1, @can={{0x2}, 0x1, 0x3, 0x0, 0x0, "2eb8e563a3af7540"}}, 0x48}}, 0x20000000) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x2, 0x11, r7, 0x0) (async) setsockopt$inet6_int(r6, 0x29, 0x8, &(0x7f00000000c0)=0xf2b, 0x4) (async) getsockopt$inet6_buf(r6, 0x29, 0x6, &(0x7f0000001500)=""/17, &(0x7f0000000080)=0x11) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000096c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newtaction={0x18, 0x30, 0x1, 0x0, 0x0, {}, [{0x4}]}, 0x18}}, 0x0) (async) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x0, &(0x7f0000000480)}) (async) io_uring_register$IORING_REGISTER_FILES(0xffffffffffffffff, 0x23, &(0x7f0000000000), 0x0) lseek(0xffffffffffffffff, 0x9, 0x1) (async) r8 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000000000020bd28940000000000000109022400010000000009040100010300000009210000000122070009058103"], 0x0) syz_usb_control_io(r8, 0x0, 0x0) syz_usb_control_io(r8, &(0x7f0000000480)={0x2c, &(0x7f0000000040)=ANY=[@ANYBLOB="000607"], 0x0, 0x0, 0x0, 0x0}, 0x0) (async) r9 = syz_usb_connect$uac1(0x3, 0x9f, &(0x7f0000000700)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x20, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x8d, 0x3, 0x1, 0x74, 0x80, 0x53, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x3, 0x1}, [@feature_unit={0xb, 0x24, 0x6, 0x2, 0x5, 0x2, [0x4, 0xc55a6b5e701fc943], 0x7}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x400, 0x4, 0xfa, 0x7, {0x7, 0x25, 0x1, 0x5, 0x3, 0x9}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_ii_discrete={0x12, 0x24, 0x2, 0x2, 0x5, 0x9, 0x80, "677e87d78e46b5d7d3"}, @format_type_i_discrete={0x11, 0x24, 0x2, 0x1, 0x73, 0x2, 0x7, 0xbb, "818bf272cec44307f5"}]}, {{0x9, 0x5, 0x82, 0x9, 0x40, 0x2, 0x2, 0x81, {0x7, 0x25, 0x1, 0x1, 0x6, 0x4}}}}}}}]}}, &(0x7f0000000200)={0xa, &(0x7f0000000000)={0xa, 0x6, 0x200, 0x1, 0x3, 0x0, 0x10, 0x9}, 0xf, &(0x7f0000000180)={0x5, 0xf, 0xf, 0x1, [@ss_cap={0xa, 0x10, 0x3, 0x0, 0x7, 0x1, 0x6, 0x1}]}, 0x1, [{0x4, &(0x7f00000001c0)=@lang_id={0x4, 0x3, 0xcc16b3e633461348}}]}) syz_usb_control_io$uac1(r9, &(0x7f0000000380)={0x14, &(0x7f0000000240)={0x40, 0x23, 0xed, {0xed, 0xb, "42ebef396541fe14f9f34e60985cb2f7e733ca7893bfcc659753ddd636bf93ab2260c5115bc786cc483e0ddb58e6b509cd91daf2ff0c5d556265b5319152f047e1e0cd4b51da90f9f5a5ab0e99e6efe26d7f8cea9b8326f74b6f95edb87abcaff5d0f843ccb08a6298519352ec01dfeccd2d2498a77656c399610bdc8ba6f058f5a024f05d3fbf2207e99dfa8864e11b83b26f0751630f74068b1ef3154929fe03f21b4dc82e4e295478cd8074adf258c37837a5cbbd68c95c80bbdb9b50d95367d82dd13652f204fb6f0884931fd950617ba6b2cfa29de2b7d1c38c2505c0a569672f6a7388227bba91d4"}}, &(0x7f0000000340)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x418}}}, &(0x7f0000000680)={0x44, &(0x7f00000003c0)={0x20, 0xb, 0x8c, "3c8a122089a3c6ac7bd0503be49516ad672b73d84496e85b8a80563879cd7e33d27fa423543f5bb7cebec9868817d01a530eabb06b19bc13c276eeb3f303128f71f278a769ea0941b914d977344d2886ebccf62a3e6e772b06fd71958705ca23c5b0116564df0c72ffe0107f6542c1245d2a4bf26b9544cb3ae278e604227a080a5f7930fb53467826d03e18"}, &(0x7f00000004c0)={0x0, 0xa, 0x1, 0x2}, &(0x7f0000000500)={0x0, 0x8, 0x1, 0x2}, &(0x7f0000000540)={0x20, 0x81, 0x2, "77cc"}, &(0x7f0000000580)={0x20, 0x82, 0x3, "e408e1"}, &(0x7f00000005c0)={0x20, 0x83, 0x3, "3af0f2"}, &(0x7f0000000600)={0x20, 0x84, 0x1, '\v'}, &(0x7f0000000640)={0x20, 0x85, 0x3, "792610"}}) 2.367235186s ago: executing program 6 (id=3970): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000040)={0x2, &(0x7f0000000000)=[{0x3c, 0x3, 0x4, 0x7f}, {0x6, 0xff, 0x2, 0xfffffff3}]}) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000500)={'veth1\x00', &(0x7f0000000200)=@ethtool_per_queue_op={0x4b, 0xf, [0xa, 0x1, 0x8, 0x1, 0x4, 0x9, 0xa4, 0xffb, 0x7, 0xb69, 0xc1, 0x4, 0x1, 0x3, 0x5, 0x101, 0x1000, 0x9, 0x3, 0x3, 0x1, 0xfffffffa, 0x0, 0x6, 0x9, 0x4, 0x7, 0x5, 0x100000, 0x762, 0x3, 0xd, 0xe, 0x2b12, 0x100, 0x6, 0x11c00, 0xb, 0x7, 0xbed4, 0x8, 0x8000100, 0x3, 0x0, 0x11000, 0xb, 0x5, 0x79b, 0x2, 0x1, 0x7f, 0x4, 0xb, 0x7, 0xf, 0x101, 0xd7, 0x1fa0860a, 0x7, 0xaa, 0x81, 0x2, 0x180000, 0x4007, 0x8b, 0x5, 0x2af, 0xf7, 0x5, 0x2, 0x6, 0x9, 0x4, 0x7, 0x4009, 0x1, 0x4, 0x100002, 0x8, 0x752, 0x0, 0x3, 0x0, 0x10001, 0x2, 0xffffffff, 0x6, 0x6, 0x9, 0x80000000, 0xfdffffff, 0x2, 0x2, 0x84, 0x100, 0x5, 0x252, 0x81, 0xb, 0x5, 0x20006, 0x5, 0x2, 0xb, 0x2, 0xd9a, 0xd, 0x2a2, 0xfffffffd, 0x3, 0x2, 0x5, 0x8, 0x3, 0x4, 0x2, 0x40, 0x808, 0x4, 0x4, 0x401, 0x66cd, 0xb, 0x8, 0x4, 0x1fc, 0xc5c, 0xffffffff]}}) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f000052e000/0x2000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, 0x0}, 0x68) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet(0xa, 0x801, 0x84) connect$inet(r1, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r1, 0x8) r2 = accept4(r1, 0x0, 0x0, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x4004) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000340)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in=@multicast2, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x80, 0x29}, {0x0, 0xffffffffffffffff, 0x9, 0x0, 0x0, 0x2, 0x100000000}, {0x0, 0x0, 0x0, 0xffffffffffffffff}, 0x7}}, 0xb8}}, 0x10) sendto$inet6(r2, &(0x7f0000000200)='x', 0x1, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r2, 0x84, 0x7b, &(0x7f0000000140)={0x0, 0x1}, 0x8) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r2, 0x84, 0x7c, &(0x7f0000001400)={0x0, 0x0, 0x7}, 0x8) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r2, 0x84, 0x7c, &(0x7f00000005c0)={0x0, 0x2, 0x9}, 0x8) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r5, 0x6, 0xd, &(0x7f0000000000)='dctcp', 0x5) setsockopt$inet6_tcp_int(r5, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) sendto$inet6(r5, &(0x7f0000001b00)="a6", 0x1, 0x20000045, 0x0, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r7 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x170bd2a, 0xffffffff, {0x0, 0x0, 0x0, r8, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xffe5, 0x10}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0xfffd}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001300)=@newtfilter={0x78, 0x2c, 0xd27, 0x70bd25, 0x2, {0x0, 0x0, 0x0, r8, {0x0, 0x1}, {}, {0x8, 0x10}}, [@filter_kind_options=@f_fw={{0x7}, {0x44, 0x2, [@TCA_FW_POLICE={0x40, 0x2, [@TCA_POLICE_TBF={0x3c, 0x1, {0xffffffff, 0x0, 0x3, 0x0, 0x8, {0x5, 0x2, 0x0, 0xa, 0xccc}, {0x5, 0x1, 0x0, 0x6, 0x2, 0x4}, 0x1, 0x0, 0x800000}}]}]}}, @TCA_RATE={0x6, 0x5, {0x1}}]}, 0x78}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r0, @ANYBLOB="06001500070000000c00168008000100", @ANYRES8=r0], 0x38}}, 0x10) 1.895948181s ago: executing program 5 (id=3971): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000b80)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x101, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x4c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x8}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x8}, @NFTA_SET_DATA_TYPE={0x8, 0x6, 0x1, 0x0, 0xffffff00}]}, @NFT_MSG_NEWSETELEM={0x44, 0xc, 0xa, 0x101, 0x0, 0x0, {0x7, 0x0, 0x4004}, [@NFTA_SET_ELEM_LIST_ELEMENTS={0x18, 0x3, 0x0, 0x1, [{0x14, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_DATA={0x8, 0x2, 0x0, 0x1, [@NFTA_DATA_VALUE={0x4}]}]}]}, @NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0xd8}, 0x1, 0x0, 0x0, 0x8000}, 0x0) 1.803968265s ago: executing program 5 (id=3972): r0 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=@updpolicy={0x1fc, 0x19, 0x1, 0x0, 0x0, {{@in6=@private0, @in6=@empty, 0x0, 0x3, 0x0, 0x0, 0xa, 0x0, 0x0, 0x5e}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}}, [@tmpl={0x144, 0x5, [{{@in6=@empty, 0x0, 0x32}, 0x0, @in=@dev={0xac, 0x14, 0x14, 0x1d}, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x1}, {{@in6=@private2, 0x0, 0x32}, 0x0, @in=@broadcast}, {{@in6=@remote, 0x0, 0x3c}, 0x2, @in6=@empty, 0x0, 0x1, 0x3}, {{@in6=@empty, 0x0, 0x2b}, 0x2, @in=@dev, 0xffffffef}, {{@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x0, 0x6c}, 0x0, @in6=@mcast2, 0x0, 0x4, 0x2}]}]}, 0x1fc}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x88, 0x0, 0x1, 0x401, 0x0, 0x1a14, {0x2, 0x0, 0xffff}, [@CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0x1}, @CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @multicast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x24, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x2, 0x0}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_MASTER={0x24, 0xe, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x4, 0x1, 0x93}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @remote}, {0x8, 0x2, @rand_addr=0x64010102}}}]}]}, 0x88}}, 0x0) ioctl$VIDIOC_TRY_FMT(r0, 0xc0d05640, &(0x7f00000001c0)={0xa, @pix={0x0, 0x80, 0x34324142, 0x0, 0x0, 0x0, 0x25, 0x0, 0x1, 0x6, 0x0, 0x6}}) 1.452588907s ago: executing program 5 (id=3973): r0 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$VIDIOC_TRY_FMT(r0, 0xc0d05640, &(0x7f00000001c0)={0xa, @pix={0x0, 0x80, 0x34324142, 0x0, 0x0, 0x0, 0x25, 0x300, 0x1, 0x0, 0x0, 0x6}}) 1.224966715s ago: executing program 6 (id=3974): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x3) (async) r2 = syz_open_procfs$pagemap(0x0, &(0x7f0000000c80)) ioctl$PAGEMAP_SCAN(r2, 0xc0606610, &(0x7f0000000d80)={0x60, 0x3, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0xffffffff, &(0x7f0000000cc0)=[{0x0, 0x7d, 0x3}], 0x1, 0x8, 0x80, 0x0, 0x49, 0x1}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = socket$rds(0x15, 0x5, 0x0) ioctl$sock_ifreq(r3, 0x8931, &(0x7f0000000100)={'bond0\x00', @ifru_data=0x0}) r4 = landlock_create_ruleset(&(0x7f00000000c0)={0xc814, 0x1, 0x3}, 0x18, 0x2) landlock_restrict_self(r4, 0x4) (async) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r5, 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) (async) socket$inet_udp(0x2, 0x2, 0x0) (async) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@abs, 0x6e) (async) sendmmsg$unix(r7, &(0x7f00000bd000), 0x318, 0x0) (async) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffdffffffffff, 0xfa11, 0xffffffff}, 0x0) (async) syz_emit_ethernet(0xc2, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(0xffffffffffffffff, 0x40505330, &(0x7f0000000400)={0x2, 0xfffffffb, 0x5, 0xe1d9, 0x10ff, 0x7}) (async) r8 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r8, 0x0, 0x482, &(0x7f0000000080)={0x84, @local, 0x15, 0x3, 'sh\x00', 0x28, 0x5, 0x72}, 0x2c) r9 = socket$kcm(0xa, 0x2, 0x0) (async) r10 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$IP_VS_SO_SET_ADDDEST(r10, 0x0, 0x487, &(0x7f0000000140)={{0x84, @empty, 0x4e24, 0x3, 'sed\x00', 0x5, 0x8, 0x77}, {@remote, 0x4e20, 0x4, 0xc, 0x2, 0x2}}, 0x44) sendmsg$sock(r9, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e23, 0x0, @ipv4={'\x00', '\xff\xff', @private=0xa010101}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) 1.220686289s ago: executing program 5 (id=3975): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) openat$ptp0(0xffffffffffffff9c, &(0x7f0000000000), 0x80042, 0x0) (async) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x3a, [0x8002, 0xc95a, 0x1, 0x5, 0x7fffffff, 0x2, 0x8000b, 0x7f, 0x20000006, 0x4d, 0x6, 0x2000005f, 0x9, 0x5, 0xffff2d37, 0xffffff01, 0x8, 0x3, 0x5e00, 0x5, 0x24, 0x1, 0x0, 0x3c5b, 0x1, 0x21, 0x6, 0x1, 0x5, 0x200, 0xe661, 0x4, 0x7, 0x89d2, 0x8, 0x4c76, 0x80000000, 0x40000, 0x4, 0x0, 0x0, 0x80008071, 0x7, 0x17, 0xd, 0x407, 0x5, 0x3a, 0x8f, 0x4006, 0x6, 0x80000000, 0x0, 0x4, 0x8, 0x400, 0x80, 0x0, 0x4, 0x7, 0x8, 0x4, 0xfffffffe, 0x40], [0x10000003, 0xf0000000, 0x8000012f, 0x8004, 0x5, 0x6, 0x129432e6, 0xc8, 0xf9, 0x800, 0x2bf, 0x6c7, 0x9, 0xfffffffc, 0x3, 0x0, 0x0, 0x1, 0x2f, 0x10, 0x315, 0xd, 0xea4, 0xffffffff, 0x4, 0x7, 0x7fff, 0x5a7c, 0x420, 0x8, 0x6, 0x0, 0xff, 0x4000001, 0x1000005, 0x5f31, 0x7, 0x4e2, 0x2, 0x4, 0xb, 0x8, 0x20009, 0x9, 0x9, 0x9, 0x47, 0x8000, 0x4001, 0xfe000000, 0xffff, 0xfffffffb, 0x7, 0x9, 0x5, 0x3, 0x4, 0x9b, 0x3, 0x7, 0xbc45, 0x48c93690, 0x42, 0x3], [0x3, 0x408, 0x8004, 0x0, 0xfffffffe, 0x100, 0x8d2, 0x89, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x5, 0x9, 0x5, 0x4, 0x4a61eab3, 0x5, 0x8, 0x10000, 0x3, 0x5, 0x2, 0xb, 0x5, 0x2, 0x2, 0x3, 0x20000008, 0x4, 0x6d01, 0x6, 0x1, 0x800003, 0x1fd, 0x7b, 0x7, 0x4, 0x2950bfaf, 0xffe, 0xa2, 0x16, 0xa9, 0x5, 0x5, 0xac8, 0x2000af, 0x2, 0x3, 0x7ff, 0x12e, 0x4, 0x1, 0x0, 0x6b, 0x5, 0x1c, 0x120000, 0x3, 0x2004, 0x80a2ed, 0x4, 0x25], [0x9, 0xbb33, 0x7, 0x8000b, 0x8, 0x938, 0x6, 0x6, 0x0, 0xb9, 0x8, 0x9, 0x3, 0x58, 0x451, 0x3, 0x101, 0x10000, 0x4, 0x7fff, 0xffff, 0x2000a620, 0x2, 0x5, 0x1, 0x2, 0x5, 0xe7, 0x4, 0x16, 0xfffffffe, 0x80000003, 0x6, 0x4, 0x8, 0x9, 0xffffefff, 0x10003, 0x3, 0x7e, 0xfd, 0x9602, 0x7, 0x5, 0x7, 0x6, 0xffffffff, 0x5, 0x5, 0x8, 0x8d67, 0x5, 0xf3e, 0x6, 0x1, 0xffd, 0xfffffffd, 0x4, 0x5, 0xb1e, 0xd7, 0x200, 0xffff3441, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x1, 0x2a, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000b50000008200000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000008200000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8a00fe00000000bfa200000000000007020000f8ffffffb703000008000000b7040000010000008500000082000000bf91000000000000b7020000010000008500000085000000b70000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0xf, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = landlock_create_ruleset(&(0x7f0000000180)={0x100}, 0x18, 0x0) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r1, 0x1, &(0x7f0000000340)={0x100}, 0x0) add_key$fscrypt_v1(&(0x7f0000000040), &(0x7f0000000080)={'fscrypt:', @auto=[0x65, 0x62, 0x37, 0x37, 0x63, 0x0, 0x38, 0x64, 0x63, 0x32, 0x33, 0x61, 0x62, 0x37, 0x66, 0x63]}, &(0x7f0000000100)={0x0, "377353172e55361c9e1b72fe45e47274537ebf5a9a0e9628897e4d780e537ae70e0180653ea2f4b32e8a203e97c34ce7631abe264be8e8f299e0c511f28eff2d", 0x22}, 0x48, 0xffffffffffffffff) (async) pipe2$watch_queue(&(0x7f0000000180), 0x80) 892.403861ms ago: executing program 5 (id=3976): r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/rcu_normal', 0x149a82, 0x15a) write$cgroup_int(r0, &(0x7f0000000040)=0x800000000001c9, 0x12) 790.376141ms ago: executing program 6 (id=3977): syz_usb_connect(0x3, 0x3d, &(0x7f0000000240)=ANY=[@ANYBLOB="12010000bdce4208110f80106afc0000000109022b00010000000009043700022ee5cd0009058010ff037f790209050e0320000980070705ab0b78"], 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) r0 = syz_io_uring_setup(0x239c, &(0x7f0000000140)={0x0, 0xc60b, 0x8, 0x1, 0x26f}, &(0x7f00000001c0), &(0x7f00000002c0)) add_key(&(0x7f0000000300)='blacklist\x00', &(0x7f0000000340)={'syz', 0x3}, &(0x7f0000000380)="d42756a83ce8f145b39e937a964b73275938366514cfbf459739561a99d154d9126041668f11f151d7eb5117ef941c3780ef4e97178775f8deca2453d96595c9ffd55e21c0e72dce80ef6b0631766847dccd014943a22ac00b514790f6658a6ba45fc90a7bfad1201f53ec25df7d993dfb55c7f0342b683100770b7b2d5e0ec9f2604403a20b86f4e309669dba6f3acaf79fb70d41bfef8246ed45d6ff54", 0x9e, 0xfffffffffffffff9) r1 = syz_io_uring_setup(0xd2, &(0x7f00000000c0)={0x0, 0xdffd, 0x10800, 0x0, 0x20002e9, 0x0, r0}, &(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0) syz_usb_connect(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="130100002add1e20ef050a023691010203010902240001000000000904000002ea1998000905a6a700000000000905", @ANYRES32], 0x0) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) accept4(r4, 0x0, 0x0, 0x800) setsockopt$SO_J1939_PROMISC(r4, 0x6b, 0x2, 0x0, 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd_index=0x4, 0x0, 0x0}) io_uring_enter(r1, 0x47ba, 0x0, 0x0, 0x0, 0x0) 774.188356ms ago: executing program 2 (id=3978): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={0x0, 0xac}, 0x1, 0x0, 0x0, 0x1}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[], 0xac}, 0x1, 0x0, 0x0, 0x4000}, 0x4000894) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r2, 0x29, 0x2a, &(0x7f0000000080)={0x20, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @remote, 0x8}}}, 0x108) close(r2) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r4, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000140)={&(0x7f0000000280)=ANY=[@ANYBLOB="1c00000001042cac0000000080000000060000a188ec3491ec81da560e9b26a0474864b1da3fab7b27ce4166e0078c9550edb491252ea39d86d8aaae9fb5f3f7a52fb8f72a475e795d69f71b45307709783a98373f5e2156a5b6fe1b8eaa26cabec046fc07763817c96e3b5b08f0360ff4a51b"], 0x1c}, 0x1, 0x0, 0x0, 0x4001}, 0x800) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000016000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, 0x0}], 0x1, 0x0, &(0x7f0000000180)=[@cr4={0x1, 0x40002}], 0x1) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000008000/0x18000)=nil, &(0x7f0000000200)=[@textreal={0x8, &(0x7f00000003c0)="0f0d51f40f01d10fc75800f30fc73600102ed5c01dc0000000008ec0640f017400aa66b9e408000066b81f6269e766ba000000000f309c0c0cb8d09bbc8966efbafc0cedba4300ba210066ed3626f00fc70d", 0x52}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 533.863501ms ago: executing program 5 (id=3979): r0 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000000), 0x41, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_open_dev$sndmidi(0x0, 0x2, 0x141101) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@bridge_getneigh={0x20, 0x1e, 0x1, 0x70bd26, 0x25dfdbfe, {0x7, 0x0, 0x0, 0x0, 0x0, 0x2000a}}, 0x20}, 0x1, 0x0, 0x0, 0x4001}, 0x20000800) connect$unix(r1, &(0x7f00000000c0)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000180)='personality\x00') ioctl$AUTOFS_IOC_SETTIMEOUT(r2, 0x80049367, &(0x7f0000000140)=0x7) socket(0x400000000010, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = syz_open_dev$video(&(0x7f00000001c0), 0x2, 0x101000) ioctl$VIDIOC_S_FMT(r3, 0xc0d05605, &(0x7f0000000380)={0x1, @pix_mp={0x8, 0xfffffffe, 0x3136564e, 0x6, 0xc, [{0x3, 0x10001}, {0x9, 0x5}, {0x800004, 0x9}, {0x2, 0x5}, {0x9, 0x5}, {0x1964, 0x10000}, {0x5, 0x402}, {0x7, 0x3000000}], 0xd, 0x7, 0x1, 0x1, 0x7}}) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r4, 0x0, 0x40, &(0x7f0000000540)=@nat={'nat\x00', 0x670, 0x5, 0x4d8, 0x2c8, 0x0, 0xffffffff, 0x228, 0x370, 0x440, 0x440, 0xffffffff, 0x440, 0x440, 0x5, 0x0, {[{{@ip={@rand_addr=0x64010104, @local, 0xff0000ff, 0xffffff00, 'veth1_to_bridge\x00', 'wg1\x00', {}, {0xff}, 0x16}, 0x0, 0x1f0, 0x228, 0x48, {}, [@common=@unspec=@string={{0xc0}, {0x5, 0xc, 'bm\x00', "9401d3e4c6b2bfd892aa7400051624fa86999b13d39b99407a9b7abe75a728baa18da576811985de44110b8602025e1298ea55f1c5087ab16f67b18ca90ac68f0b3d6a068f727f7d23fa5fad26a59a5da2651212bdf9d29248ae63e2349b2470915eea2c39ade5129ff26b6fe772493180cfda2cdd49412e9469d85abdb467ba", 0x79, 0x2, {0x1}}}, @common=@unspec=@conntrack2={{0xc0}, {{@ipv6=@dev={0xfe, 0x80, '\x00', 0x10}, [0xffffff00, 0xffffffff, 0x0, 0xff000000], @ipv4=@dev={0xac, 0x14, 0x14, 0x29}, [0x0, 0xffffff00, 0xff000000, 0xffffffff], @ipv6=@local, [0xff000000, 0xff, 0x0, 0xff], @ipv4=@broadcast, [0xffffffff, 0x0, 0xff], 0x7, 0x1, 0x5c, 0x4e1c, 0x4e22, 0x4e24, 0x4e24, 0x814, 0x20c0}, 0x80, 0x2}}]}, @DNAT0={0x38, 'DNAT\x00', 0x0, {0x1, {0xf, @local, @initdev={0xac, 0x1e, 0x0, 0x0}, @icmp_id=0x65, @port=0x4e24}}}}, {{@uncond, 0x0, 0x70, 0xa0}, @common=@inet=@SET2={0x30, 'SET\x00', 0x2, {{0xffffffffffffffff, 0xd, 0x1}, {0x2, 0x4, 0x3}, 0x1000, 0x100}}}, {{@ip={@multicast2, @broadcast, 0xff, 0x0, 'virt_wifi0\x00', 'batadv_slave_1\x00'}, 0x0, 0x70, 0xa8}, @MASQUERADE={0x38, 'MASQUERADE\x00', 0x0, {0x1, {0x2, @loopback, @empty, @icmp_id=0x68, @port=0x4e22}}}}, {{@uncond, 0x0, 0x98, 0xd0, 0x0, {}, [@common=@icmp={{0x28}, {0x4, "1542", 0x1}}]}, @DNAT0={0x38, 'DNAT\x00', 0x0, {0x1, {0x10, @rand_addr, @dev={0xac, 0x14, 0x14, 0x2a}, @icmp_id, @icmp_id}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x538) r5 = syz_io_uring_setup(0x4172, &(0x7f00000002c0)={0x0, 0x2, 0x10100, 0x0, 0x4}, 0x0, &(0x7f00000000c0)) io_uring_enter(r5, 0x567, 0x0, 0x0, 0x0, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=@ipv4_newroute={0x34, 0x18, 0x1, 0xfffffffd, 0x25dfdbfb, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd, 0x9}, [@RTA_ENCAP={0x18, 0x16, 0x0, 0x1, @LWTUNNEL_IP6_SRC={0x14, 0x3, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010141}}}]}, 0x34}}, 0x0) r8 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r9, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x3}}}]}, 0x38}}, 0x0) unshare(0x2000400) write$nbd(r0, &(0x7f0000000340)={0x1000000, 0x0, 0x0, 0x40, 0x9, "82b0cfc4337965941538be09000000000000000000007400a391793ba70d0000000000fdf700000000baffda6e4a4d83"}, 0x40) syz_usb_connect(0x5, 0x24, &(0x7f0000000340)={{0x12, 0x1, 0x310, 0x5c, 0x90, 0xae, 0x40, 0xb95, 0x2790, 0xa9a2, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0xb6, 0x3, 0x90, 0x2, [{{0x9, 0x4, 0x84, 0x1e, 0x0, 0xff, 0x2e, 0xc4}}]}}]}}, 0x0) 272.497251ms ago: executing program 2 (id=3980): syz_emit_ethernet(0x3b6, &(0x7f00000003c0)={@multicast, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "122d92", 0x380, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x0, 0x0, 0xf5, 0x0, 0x0, [{0x0, 0xa, "a78ce54006598080a8030037004023493b87aafaffffffffffffff23732472eefa45ad96579269748e254c1e4a8a8b3f0ab0c430d3be27df3e34066d42ca0a5c15b37adac15084dbaf736b41e5af1802"}, {0x0, 0x20000000000000f2, "000000000000000026000400"}, {0x18, 0x18, "fe906d26efe39393fe08f73eabc5977b1190a3a6ad8338f1511cdd10c35d8f6de79fc7fd175f75649fa368a32c829af02d7f44d92324a7051e460a13ddde25a5b85b9d930914625d8a049b4cf0d129806a610ad8477a2499a9a0527f75b655a6653d0363a979acf93f88eea07d68423e90280409de1657275f716a2bf2915d1783e8eb477b0d1170f0ecbdef4c23e1b76e9ab3d2fbe4b34438d2a77577edd0ebed9682b851b380ae0cab282af9d7ebe668177704c5fd4698c934de4731f3f61effc978"}, {0x0, 0x1d, "06aa85616177c41bc943afcb84619755403946b0730a18d5c38cf7dcad830f2dc8674b87ba8b58f81ece27975cc39e595e9af90b4fe92a38d25551c2d9ebfc5dfc5a2a501b7e483de3f808895c5f4a1a2367bc591dd8b094822ff0dea07c9a1f643c822a18b79f7c5eba31fb68b2d734a6671e27182aee96f24a4a5cf390dab23b500b0c0272479611e4f7f4299ec4d926d443367b105185e6ecd9602ba95392343e9bbd047ef6bc1ba42399907ccd0a562db212baa39eb8164e240069f656d3a05fecf894222a141123f5ac010000000000000090aa235a670670ffc5dc49dfb58d00000000000000"}, {0x18, 0xb, "17dcea46805d4809c20547406b18901b0aeff04c0300f3c75dc2d227a83b89483b1084743475671545e65eb2e9ac946a3f0e2bc4619f91394c02bcfbbb7d71138537d68e2d2c6393a9f3becd1a9f51a948b5b303f4f003"}, {0x21, 0x7, "000000ffffff0000000000020000000000000000000000ffff008879e66485201a0015ca8374000000000000000000000000e3ef266d00"}, {0x1, 0x14, "5e14f0e7e72d42cfb3f27fafb60845f90b6dfc2e37bc87c6905bbc94d33e1ea71a28105f543e868a8a53b360a9d33e2b1e26eb1d18065daa7628cf9ef083611c9f6ae2e1eb3d8bf9c6ab2642c4808288e62afbf03269f1f98aea6ab3beb5fdc5fdaabc2c676d8800871a6aa54155dea2d995cb22c9924e0ad38c6967052cc7786d779b8353aac33a57d79b05613a12328f61129017fa632dbf04542188b196e213408c"}, {0x3, 0x5, "d5170000dce9674a36da018dff16e70b8b14c4b7a94fe18e88605aa6be1a02a326a6bce65f81ed"}]}}}}}}, 0x0) 98.331074ms ago: executing program 8 (id=3981): r0 = syz_open_dev$video4linux(&(0x7f0000002300), 0x0, 0x0) ioctl$VIDIOC_SUBDEV_S_FMT(r0, 0xc0205648, &(0x7f0000000500)={0xf010000, 0x0, {0x100, 0x0, 0x3005, 0x0, 0x0, 0x3}}) connect$unix(0xffffffffffffffff, 0x0, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$binfmt_aout(r1, &(0x7f00000000c0)=ANY=[], 0xff2e) ioctl$TCXONC(r1, 0x540a, 0x0) ioctl$int_in(r1, 0x5452, &(0x7f0000000040)=0x7) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000340)=0x5) ioctl$TCXONC(r1, 0x540a, 0x1) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0xa4242, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000007, 0x38011, r2, 0x35425000) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000000)={[0xcb, 0xe, 0x4, 0x101, 0x2, 0x1002, 0xf1, 0x0, 0xfffffffffffffff7, 0x8d, 0xfffffffffffffffe, 0x1, 0x0, 0x4, 0x0, 0x3fdb], 0xf000, 0x67a64fa265d59501}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) syz_clone3(&(0x7f0000000080)={0x180803400, 0x0, 0x0, 0x0, {0x39}, 0x0, 0x0, 0x0, 0x0}, 0x58) r3 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000001d00), 0x2e03, 0x0) ioctl$PTP_CLOCK_GETCAPS(r3, 0x43403d0e, &(0x7f0000001d40)) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) syz_emit_ethernet(0x4e, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r5, &(0x7f0000000000), 0xfffffecc) syz_io_uring_setup(0x404c7, &(0x7f0000000000)={0x0, 0xd20b, 0x80, 0x5, 0x106}, &(0x7f00000006c0)=0x0, &(0x7f00000000c0)=0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) getxattr(&(0x7f0000000140)='./bus\x00', &(0x7f00000001c0)=@known='system.posix_acl_access\x00', 0x0, 0x0) syz_io_uring_setup(0x100210d, &(0x7f0000000280)={0x0, 0x211d, 0x400, 0x40205, 0x11e}, &(0x7f0000000240)=0x0, &(0x7f00000001c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r8, 0x4, &(0x7f0000000040)=0xefefffd7, 0x0, 0x4) syz_io_uring_submit(r8, r9, &(0x7f0000000000)=@IORING_OP_ACCEPT={0xd, 0x8, 0x1, 0xffffffffffffffff, 0x0}) syz_memcpy_off$IO_URING_METADATA_GENERIC(r8, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r6, r7, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x6000, @fd=r4, 0x1, &(0x7f0000000600)=[{&(0x7f0000001000)=""/4085, 0xff5}], 0x1}) 0s ago: executing program 2 (id=3982): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x19, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000040000000000000200000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000d0018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffe4ffb703000008000000b70400000200000085000000820000008500000007000000bf91000000000000b70200f2010000008500000084000000b700000000000000950000"], &(0x7f0000000000)='GPL\x00', 0x8, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) kernel console output (not intermixed with test programs): 248.147148][ T5936] dvb-usb: Technotrend TT Connect S2-3600 successfully initialized and connected. [ 1248.249815][ T5936] dvb-usb: bulk message failed: -22 (4/0) [ 1248.256515][ T5936] dvb-usb: error -22 while querying for an remote control event. [ 1248.427712][ T5936] dvb-usb: bulk message failed: -22 (4/0) [ 1248.447816][ T5936] dvb-usb: error -22 while querying for an remote control event. [ 1248.549189][T19372] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1248.559554][T19372] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1248.581974][ T5936] dvb-usb: bulk message failed: -22 (4/0) [ 1248.593885][ T5936] dvb-usb: error -22 while querying for an remote control event. [ 1248.636603][T19372] sctp: [Deprecated]: syz.5.3470 (pid 19372) Use of int in max_burst socket option deprecated. [ 1248.636603][T19372] Use struct sctp_assoc_value instead [ 1248.737356][ T5936] dvb-usb: bulk message failed: -22 (4/0) [ 1248.743165][ T5936] dvb-usb: error -22 while querying for an remote control event. [ 1248.862286][ T5936] dvb-usb: bulk message failed: -22 (4/0) [ 1248.878413][ T5936] dvb-usb: error -22 while querying for an remote control event. [ 1249.047008][ T5936] dvb-usb: bulk message failed: -22 (4/0) [ 1249.059015][ T5936] dvb-usb: error -22 while querying for an remote control event. [ 1249.193703][ T5936] dvb-usb: bulk message failed: -22 (4/0) [ 1249.200965][ T5936] dvb-usb: error -22 while querying for an remote control event. [ 1249.318289][ T5936] dvb-usb: bulk message failed: -22 (4/0) [ 1249.324944][ T5936] dvb-usb: error -22 while querying for an remote control event. [ 1249.449556][ T5936] dvb-usb: bulk message failed: -22 (4/0) [ 1249.456101][ T5936] dvb-usb: error -22 while querying for an remote control event. [ 1249.593560][ T5936] dvb-usb: bulk message failed: -22 (4/0) [ 1249.618267][ T5936] dvb-usb: error -22 while querying for an remote control event. [ 1249.767875][ T5936] dvb-usb: bulk message failed: -22 (4/0) [ 1249.774855][ T5936] dvb-usb: error -22 while querying for an remote control event. [ 1249.931236][ T5936] dvb-usb: bulk message failed: -22 (4/0) [ 1249.938003][ T5936] dvb-usb: error -22 while querying for an remote control event. [ 1249.951745][ T5837] usb 5-1: USB disconnect, device number 25 [ 1250.039554][T19383] netlink: 148 bytes leftover after parsing attributes in process `syz.4.3472'. [ 1250.054914][ T5837] dvb-usb: Technotrend TT Connect S2-3600 successfully deinitialized and disconnected. [ 1250.101679][T19383] A link change request failed with some changes committed already. Interface gre0 may have been left with an inconsistent configuration, please check. [ 1250.801924][T19398] i2c i2c-0: Frontend requested software zigzag, but didn't set the frequency step size [ 1251.019523][T19397] input: syz1 as /devices/virtual/input/input79 [ 1251.268622][ T24] usb 7-1: new high-speed USB device number 19 using dummy_hcd [ 1251.427511][ T24] usb 7-1: Using ep0 maxpacket: 32 [ 1251.458135][ T24] usb 7-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 1251.488162][ T24] usb 7-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 1251.517553][ T24] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1251.620244][ T24] usb 7-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 1251.686622][ T24] usb 7-1: config 1 has no interface number 1 [ 1251.737883][ T24] usb 7-1: too many endpoints for config 1 interface 2 altsetting 12: 66, using maximum allowed: 30 [ 1251.834900][ T29] kauditd_printk_skb: 37 callbacks suppressed [ 1251.834914][ T29] audit: type=1326 audit(1772113634.473:5534): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19407 comm="syz.5.3480" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1f65b9c629 code=0x7ffc0000 [ 1251.840362][ T24] usb 7-1: config 1 interface 2 altsetting 12 has 0 endpoint descriptors, different from the interface descriptor's value: 66 [ 1251.861344][ T29] audit: type=1326 audit(1772113634.473:5535): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19407 comm="syz.5.3480" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1f65b9c629 code=0x7ffc0000 [ 1251.968917][ T29] audit: type=1326 audit(1772113634.473:5536): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19407 comm="syz.5.3480" exe="/root/syz-executor" sig=0 arch=c000003e syscall=43 compat=0 ip=0x7f1f65b9c629 code=0x7ffc0000 [ 1252.040615][ T29] audit: type=1326 audit(1772113634.473:5537): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19407 comm="syz.5.3480" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1f65b9c629 code=0x7ffc0000 [ 1252.047582][ T24] usb 7-1: config 1 interface 2 has no altsetting 0 [ 1252.097991][T19411] syzkaller0: entered promiscuous mode [ 1252.103650][T19411] syzkaller0: entered allmulticast mode [ 1252.167329][ T5936] usb 3-1: new high-speed USB device number 85 using dummy_hcd [ 1252.195139][T19409] tipc: Enabled bearer , priority 0 [ 1252.219865][ T29] audit: type=1326 audit(1772113634.483:5538): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19407 comm="syz.5.3480" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f1f65b9c629 code=0x7ffc0000 [ 1252.271689][ T24] usb 7-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1252.281309][ T24] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1252.296856][ T29] audit: type=1326 audit(1772113634.483:5539): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19407 comm="syz.5.3480" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1f65b9c629 code=0x7ffc0000 [ 1252.319572][ T29] audit: type=1326 audit(1772113634.483:5540): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19407 comm="syz.5.3480" exe="/root/syz-executor" sig=0 arch=c000003e syscall=54 compat=0 ip=0x7f1f65b9c629 code=0x7ffc0000 [ 1252.353300][ T29] audit: type=1326 audit(1772113634.483:5541): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19407 comm="syz.5.3480" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1f65b9c629 code=0x7ffc0000 [ 1252.358173][T19407] tipc: Resetting bearer [ 1252.377068][ T29] audit: type=1326 audit(1772113634.483:5542): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19407 comm="syz.5.3480" exe="/root/syz-executor" sig=0 arch=c000003e syscall=172 compat=0 ip=0x7f1f65b9c629 code=0x7ffc0000 [ 1252.426401][ T29] audit: type=1326 audit(1772113634.483:5543): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19407 comm="syz.5.3480" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1f65b9c629 code=0x7ffc0000 [ 1252.426430][ T24] usb 7-1: Product: syz [ 1252.453362][ T5936] usb 3-1: Using ep0 maxpacket: 16 [ 1252.484622][T19416] netlink: 24 bytes leftover after parsing attributes in process `syz.7.3482'. [ 1252.503350][ T5936] usb 3-1: config 0 contains an unexpected descriptor of type 0x1, skipping [ 1252.534826][ T5936] usb 3-1: config 0 has an invalid descriptor of length 167, skipping remainder of the config [ 1252.605966][ T24] usb 7-1: Manufacturer: syz [ 1252.611539][ T5936] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 1252.638993][ T24] usb 7-1: SerialNumber: syz [ 1252.641921][T19407] tipc: Disabling bearer [ 1252.669296][ T5936] usb 3-1: config 0 has no interface number 0 [ 1252.717859][ T5936] usb 3-1: config 0 interface 1 altsetting 174 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 1252.793154][ T5936] usb 3-1: config 0 interface 1 has no altsetting 0 [ 1252.856577][T19417] mac80211_hwsim hwsim23 syzkaller0: entered promiscuous mode [ 1252.868162][T19417] mac80211_hwsim hwsim23 syzkaller0: entered allmulticast mode [ 1252.897548][ T5936] usb 3-1: New USB device found, idVendor=13d3, idProduct=3219, bcdDevice=7a.01 [ 1252.939263][ T5936] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1253.002424][ T5936] usb 3-1: Product: ᰊ [ 1253.017727][ T5936] usb 3-1: Manufacturer: ᐇ [ 1253.027674][ T5936] usb 3-1: SerialNumber: syz [ 1253.076271][ T5936] usb 3-1: config 0 descriptor?? [ 1253.402852][T19410] netlink: 'syz.2.3479': attribute type 13 has an invalid length. [ 1253.506473][ T796] udl 6-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffe0 [ 1254.111449][ T5936] usb 3-1: USB disconnect, device number 85 [ 1254.904400][ T24] usb 7-1: cannot find UAC_HEADER [ 1255.285647][ T24] snd-usb-audio 7-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 1255.447021][ T24] usb 7-1: USB disconnect, device number 19 [ 1255.516289][T14960] udevd[14960]: error opening ATTR{/sys/devices/platform/dummy_hcd.6/usb7/7-1/7-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1255.858547][ T24] usb 7-1: new high-speed USB device number 20 using dummy_hcd [ 1256.058901][ T24] usb 7-1: Using ep0 maxpacket: 8 [ 1256.066761][ T24] usb 7-1: unable to get BOS descriptor or descriptor too short [ 1256.126776][ T24] usb 7-1: config 0 interface 0 has no altsetting 0 [ 1256.180107][ T24] usb 7-1: string descriptor 0 read error: -22 [ 1256.186550][ T24] usb 7-1: New USB device found, idVendor=050e, idProduct=6610, bcdDevice=48.05 [ 1256.262633][ T24] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1256.365739][ T24] usb 7-1: config 0 descriptor?? [ 1256.545162][T19461] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3495'. [ 1256.619505][T19461] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3495'. [ 1256.634277][T19465] tipc: Enabling of bearer rejected, failed to enable media [ 1256.684136][T19461] netlink: 'syz.4.3495': attribute type 6 has an invalid length. [ 1256.957782][ T5936] usb 5-1: new full-speed USB device number 26 using dummy_hcd [ 1257.129317][ T5936] usb 5-1: config 5 has an invalid interface number: 123 but max is 0 [ 1257.141399][ T5936] usb 5-1: config 5 has no interface number 0 [ 1257.157417][ T5936] usb 5-1: config 5 interface 123 altsetting 7 has an endpoint descriptor with address 0xEB, changing to 0x8B [ 1257.181845][ T5936] usb 5-1: config 5 interface 123 altsetting 7 has an endpoint descriptor with address 0xE6, changing to 0x86 [ 1257.213935][ T5936] usb 5-1: config 5 interface 123 altsetting 7 endpoint 0x86 has invalid wMaxPacketSize 0 [ 1257.257143][ T5936] usb 5-1: config 5 interface 123 has no altsetting 0 [ 1257.290383][ T5936] usb 5-1: New USB device found, idVendor=3923, idProduct=718a, bcdDevice=d8.d7 [ 1257.321014][ T5936] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1257.348643][ T5936] usb 5-1: Product: syz [ 1257.367029][ T5936] usb 5-1: Manufacturer: syz [ 1257.383364][ T5936] usb 5-1: SerialNumber: syz [ 1257.501204][T19478] netlink: 'syz.2.3499': attribute type 10 has an invalid length. [ 1257.539179][T19474] fuse: Bad value for 'fd' [ 1257.635210][ T5936] ni6501 5-1:5.123: driver 'ni6501' failed to auto-configure device. [ 1257.683120][ T5936] usb 5-1: USB disconnect, device number 26 [ 1258.226125][T10305] usb 7-1: USB disconnect, device number 20 [ 1258.932556][T10305] usb 5-1: new high-speed USB device number 27 using dummy_hcd [ 1258.940572][T19494] loop2: detected capacity change from 0 to 7 [ 1258.957735][T19494] loop2: [ 1258.960753][T19494] loop2: partition table partially beyond EOD, truncated [ 1259.137257][T10305] usb 5-1: Using ep0 maxpacket: 16 [ 1259.164406][T10305] usb 5-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1259.191773][T10305] usb 5-1: config 0 interface 0 has no altsetting 0 [ 1259.212041][T10305] usb 5-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00 [ 1259.242341][T10305] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1259.350406][T10305] usb 5-1: config 0 descriptor?? [ 1259.531490][ T5931] usb 3-1: new high-speed USB device number 86 using dummy_hcd [ 1259.707768][ T5931] usb 3-1: unable to get BOS descriptor or descriptor too short [ 1259.726729][ T5931] usb 3-1: config 81 has an invalid interface number: 13 but max is 0 [ 1259.745296][ T5931] usb 3-1: config 81 has an invalid descriptor of length 0, skipping remainder of the config [ 1259.785927][T10305] nzxt-smart2 0003:1E71:2009.0038: hidraw0: USB HID v0.05 Device [HID 1e71:2009] on usb-dummy_hcd.4-1/input0 [ 1259.813129][ T5931] usb 3-1: config 81 has no interface number 0 [ 1259.847642][ T5931] usb 3-1: config 81 interface 13 has no altsetting 0 [ 1259.874578][ T5931] usb 3-1: New USB device found, idVendor=12d1, idProduct=0ec1, bcdDevice=29.23 [ 1259.887347][ T5931] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1259.906963][ T5931] usb 3-1: Product: syz [ 1259.914566][ T5931] usb 3-1: Manufacturer: syz [ 1259.937370][ T5931] usb 3-1: SerialNumber: syz [ 1260.283434][T10305] usb 5-1: USB disconnect, device number 27 [ 1260.466631][ T5931] qmi_wwan 3-1:81.13: bogus CDC Union: master=0, slave=1 [ 1260.497869][ T5931] qmi_wwan 3-1:81.13: probe with driver qmi_wwan failed with error -22 [ 1260.548257][ T5931] usb 3-1: USB disconnect, device number 86 [ 1261.207346][ T5936] usb 7-1: new high-speed USB device number 21 using dummy_hcd [ 1261.408136][ T5936] usb 7-1: Using ep0 maxpacket: 16 [ 1261.428211][ T5936] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1261.455284][ T5936] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1261.530046][ T5936] usb 7-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1261.583482][ T5936] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1261.613046][ T5936] usb 7-1: Product: syz [ 1261.632939][ T5936] usb 7-1: Manufacturer: syz [ 1261.671607][ T5936] usb 7-1: SerialNumber: syz [ 1261.698175][ T24] usb 3-1: new high-speed USB device number 87 using dummy_hcd [ 1261.847383][ T24] usb 3-1: device descriptor read/64, error -71 [ 1262.113976][ T24] usb 3-1: new high-speed USB device number 88 using dummy_hcd [ 1262.155897][ T5936] usb 7-1: 0:2 : does not exist [ 1262.280854][ T24] usb 3-1: device descriptor read/64, error -71 [ 1262.292234][ T5936] usb 7-1: 5:0: failed to get current value for ch 0 (-22) [ 1262.391807][ T24] usb usb3-port1: attempt power cycle [ 1262.529819][ T5936] usb 7-1: USB disconnect, device number 21 [ 1262.645860][T14960] udevd[14960]: error opening ATTR{/sys/devices/platform/dummy_hcd.6/usb7/7-1/7-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1262.691152][T10305] usb 5-1: new low-speed USB device number 28 using dummy_hcd [ 1262.790065][ T24] usb 3-1: new high-speed USB device number 89 using dummy_hcd [ 1262.858693][ T24] usb 3-1: device descriptor read/8, error -71 [ 1262.938682][T10305] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 1262.946791][T10305] usb 5-1: config 0 has no interface number 0 [ 1262.987301][T10305] usb 5-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 1263.057353][T10305] usb 5-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 1263.102594][T10305] usb 5-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 1263.127398][ T24] usb 3-1: new high-speed USB device number 90 using dummy_hcd [ 1263.129711][T10305] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1263.192289][T10305] usb 5-1: config 0 descriptor?? [ 1263.221011][T19530] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 1263.286505][T10305] iowarrior 5-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 1263.297539][ T24] usb 3-1: device descriptor read/8, error -71 [ 1263.389912][T19539] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1263.452088][ T24] usb usb3-port1: unable to enumerate USB device [ 1263.546469][T10305] usb 5-1: USB disconnect, device number 28 [ 1263.587899][T19539] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1263.826024][ T24] udl 6-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffe0 [ 1264.699989][T19548] netlink: 136 bytes leftover after parsing attributes in process `syz.2.3517'. [ 1264.713035][T19548] A link change request failed with some changes committed already. Interface ip6gretap0 may have been left with an inconsistent configuration, please check. [ 1265.025285][T19551] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1265.070503][T19551] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1266.397975][T19568] fuse: Bad value for 'fd' [ 1266.762470][T19576] netlink: 40 bytes leftover after parsing attributes in process `syz.4.3526'. [ 1267.692952][T19582] netlink: 136 bytes leftover after parsing attributes in process `syz.5.3528'. [ 1267.737433][T19582] A link change request failed with some changes committed already. Interface ip6_vti0 may have been left with an inconsistent configuration, please check. [ 1268.164349][T19590] netlink: 148 bytes leftover after parsing attributes in process `syz.6.3531'. [ 1268.183931][T19590] A link change request failed with some changes committed already. Interface gre0 may have been left with an inconsistent configuration, please check. [ 1268.340794][T19592] netlink: 'syz.5.3530': attribute type 4 has an invalid length. [ 1268.352649][T19592] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1268.362128][T19592] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1269.732556][T19610] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1269.780888][T19610] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1269.967337][T10305] usb 5-1: new high-speed USB device number 29 using dummy_hcd [ 1270.148575][T10305] usb 5-1: Using ep0 maxpacket: 16 [ 1270.168349][T10305] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1270.203839][T10305] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1270.246923][T10305] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1270.448001][T10305] usb 5-1: New USB device found, idVendor=056a, idProduct=0317, bcdDevice= 0.00 [ 1270.492613][T10305] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1270.543207][T10305] usb 5-1: config 0 descriptor?? [ 1270.888955][T10305] usbhid 5-1:0.0: can't add hid device: -71 [ 1270.899006][T10305] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 1270.930202][T10305] usb 5-1: USB disconnect, device number 29 [ 1272.010960][T19636] netlink: 148 bytes leftover after parsing attributes in process `syz.5.3542'. [ 1272.097292][T19636] A link change request failed with some changes committed already. Interface gre0 may have been left with an inconsistent configuration, please check. [ 1273.979262][ T24] udl 6-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffe0 [ 1274.314620][T19670] tipc: Enabled bearer , priority 0 [ 1275.042940][T19682] netlink: 152 bytes leftover after parsing attributes in process `syz.2.3554'. [ 1275.133961][T19682] team0: Port device team_slave_0 removed [ 1275.203547][T19682] A link change request failed with some changes committed already. Interface team_slave_0 may have been left with an inconsistent configuration, please check. [ 1275.427375][ T5931] tipc: Node number set to 761650971 [ 1277.062986][T19663] tipc: Disabling bearer [ 1277.512401][T16030] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1277.523143][T16030] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1277.531774][T16030] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1277.544962][T16030] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1277.557651][ T24] usb 3-1: new high-speed USB device number 91 using dummy_hcd [ 1277.583310][T16030] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1277.668219][ T5931] usb 5-1: new high-speed USB device number 30 using dummy_hcd [ 1277.743307][ T24] usb 3-1: Using ep0 maxpacket: 16 [ 1277.808701][ T24] usb 3-1: unable to get BOS descriptor or descriptor too short [ 1277.875067][ T24] usb 3-1: config 8 has an invalid interface number: 1 but max is 0 [ 1277.875637][ T5931] usb 5-1: too many configurations: 13, using maximum allowed: 8 [ 1277.929127][ T24] usb 3-1: config 8 has no interface number 0 [ 1277.935255][ T24] usb 3-1: config 8 interface 1 altsetting 6 bulk endpoint 0x5 has invalid maxpacket 1023 [ 1277.991852][ T24] usb 3-1: config 8 interface 1 has no altsetting 0 [ 1278.000257][ T5931] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 1278.009448][ T5931] usb 5-1: can't read configurations, error -61 [ 1278.023650][ T24] usb 3-1: New USB device found, idVendor=0742, idProduct=2008, bcdDevice=49.20 [ 1278.050176][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1278.096731][ T24] usb 3-1: Product: syz [ 1278.132566][ T24] usb 3-1: Manufacturer: syz [ 1278.162949][ T24] usb 3-1: SerialNumber: syz [ 1278.200322][T19698] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 1278.237756][ T5931] usb 5-1: new high-speed USB device number 31 using dummy_hcd [ 1278.430870][ T5931] usb 5-1: too many configurations: 13, using maximum allowed: 8 [ 1278.453991][ T5931] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 1278.493724][ T5931] usb 5-1: can't read configurations, error -61 [ 1278.510037][ T24] HFC-S_USB 3-1:8.1: probe with driver HFC-S_USB failed with error -5 [ 1278.512005][ T5931] usb usb5-port1: attempt power cycle [ 1278.564931][ T24] usb 3-1: USB disconnect, device number 91 [ 1278.632813][T19705] chnl_net:caif_netlink_parms(): no params data found [ 1278.639755][ T5936] usb 7-1: new high-speed USB device number 22 using dummy_hcd [ 1278.827288][ T5936] usb 7-1: Using ep0 maxpacket: 8 [ 1278.868610][ T5936] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 1278.907272][ T5936] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1278.935599][ T5936] usb 7-1: New USB device found, idVendor=0af0, idProduct=6751, bcdDevice=75.8b [ 1278.947372][ T5931] usb 5-1: new high-speed USB device number 32 using dummy_hcd [ 1278.970154][ T5936] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1278.986879][ T5931] usb 5-1: too many configurations: 13, using maximum allowed: 8 [ 1278.992273][T19705] bridge0: port 1(bridge_slave_0) entered blocking state [ 1279.002728][ T5931] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 1279.011935][ T5931] usb 5-1: can't read configurations, error -61 [ 1279.031253][ T5936] usb 7-1: config 0 descriptor?? [ 1279.058911][ T5936] hso 7-1:0.0: Can't find BULK IN endpoint [ 1279.068174][T19705] bridge0: port 1(bridge_slave_0) entered disabled state [ 1279.075520][T19705] bridge_slave_0: entered allmulticast mode [ 1279.108500][T19705] bridge_slave_0: entered promiscuous mode [ 1279.149995][ T5931] usb 5-1: new high-speed USB device number 33 using dummy_hcd [ 1279.159326][T19705] bridge0: port 2(bridge_slave_1) entered blocking state [ 1279.166484][T19705] bridge0: port 2(bridge_slave_1) entered disabled state [ 1279.193380][ T5931] usb 5-1: too many configurations: 13, using maximum allowed: 8 [ 1279.204362][ T5931] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 1279.212668][ T5931] usb 5-1: can't read configurations, error -61 [ 1279.221625][ T5931] usb usb5-port1: unable to enumerate USB device [ 1279.340827][T19705] bridge_slave_1: entered allmulticast mode [ 1279.369600][T19705] bridge_slave_1: entered promiscuous mode [ 1279.521644][T19705] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1279.568673][T19705] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1279.657739][T16030] Bluetooth: hci2: command tx timeout [ 1279.684982][T19705] team0: Port device team_slave_0 added [ 1279.711726][T19705] team0: Port device team_slave_1 added [ 1279.906029][T19705] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1279.933944][T19705] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1280.158039][T19705] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1280.230121][T19705] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1280.255422][T19705] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1280.320043][T19705] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1280.437730][ T5936] usb 3-1: new high-speed USB device number 92 using dummy_hcd [ 1280.599999][ T5936] usb 3-1: Using ep0 maxpacket: 8 [ 1280.634019][ T5936] usb 3-1: New USB device found, idVendor=0c45, idProduct=614a, bcdDevice=c4.6d [ 1280.645698][ T5936] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1280.655496][T19730] IPv6: addrconf: prefix option has invalid lifetime [ 1280.672785][ T5936] usb 3-1: Product: syz [ 1280.673146][T19705] hsr_slave_0: entered promiscuous mode [ 1280.722126][T19705] hsr_slave_1: entered promiscuous mode [ 1280.741189][ T5936] usb 3-1: Manufacturer: syz [ 1280.753263][T19705] debugfs: 'hsr0' already exists in 'hsr' [ 1280.775640][ T5936] usb 3-1: SerialNumber: syz [ 1280.777506][T19705] Cannot create hsr debugfs directory [ 1280.830462][ T796] usb 7-1: USB disconnect, device number 22 [ 1280.957049][ T5936] usb 3-1: config 0 descriptor?? [ 1281.003601][ T5936] gspca_main: sonixj-2.14.0 probing 0c45:614a [ 1281.024457][T19732] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1281.041329][T19732] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1281.317306][ T796] usb 7-1: new low-speed USB device number 23 using dummy_hcd [ 1281.360324][T19736] tipc: Enabled bearer , priority 0 [ 1281.387931][T19735] syzkaller0: entered promiscuous mode [ 1281.408386][T19735] syzkaller0: entered allmulticast mode [ 1281.415032][ T5936] gspca_sonixj: reg_r err -32 [ 1281.434495][ T5936] sonixj 3-1:0.0: probe with driver sonixj failed with error -32 [ 1281.467311][ T796] usb 7-1: device descriptor read/64, error -71 [ 1281.650029][T19735] tipc: Resetting bearer [ 1281.680840][T19734] tipc: Resetting bearer [ 1281.718266][T19734] tipc: Disabling bearer [ 1281.728843][ T796] usb 7-1: new low-speed USB device number 24 using dummy_hcd [ 1281.737336][T16030] Bluetooth: hci2: command tx timeout [ 1281.935965][ T796] usb 7-1: device descriptor read/64, error -71 [ 1282.057902][ T796] usb usb7-port1: attempt power cycle [ 1282.170643][T19705] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 1282.213792][T19705] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 1282.228438][T19705] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 1282.241498][T19705] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 1282.407359][ T796] usb 7-1: new low-speed USB device number 25 using dummy_hcd [ 1282.438186][ T796] usb 7-1: device descriptor read/8, error -71 [ 1282.757331][ T796] usb 7-1: new low-speed USB device number 26 using dummy_hcd [ 1282.779336][ T796] usb 7-1: device descriptor read/8, error -71 [ 1282.887629][ T796] usb usb7-port1: unable to enumerate USB device [ 1283.051179][T10305] usb 7-1: new low-speed USB device number 27 using dummy_hcd [ 1283.159632][T19705] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1283.185777][T19705] 8021q: adding VLAN 0 to HW filter on device team0 [ 1283.227830][T10305] usb 7-1: device descriptor read/64, error -71 [ 1283.251297][ T5931] usb 3-1: USB disconnect, device number 92 [ 1283.279297][ T80] bridge0: port 1(bridge_slave_0) entered blocking state [ 1283.286481][ T80] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1283.351185][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 1283.358410][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1283.497462][T10305] usb 7-1: new low-speed USB device number 28 using dummy_hcd [ 1283.498793][T19705] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 1283.532623][T19705] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1283.636536][T19705] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1283.714237][T19705] veth0_vlan: entered promiscuous mode [ 1283.720004][T10305] usb 7-1: device descriptor read/64, error -71 [ 1283.777579][ T5931] usb 3-1: new high-speed USB device number 93 using dummy_hcd [ 1283.795232][T19705] veth1_vlan: entered promiscuous mode [ 1283.817433][T16030] Bluetooth: hci2: command tx timeout [ 1283.857836][T10305] usb usb7-port1: attempt power cycle [ 1283.956425][T19705] veth0_macvtap: entered promiscuous mode [ 1283.978957][ T5931] usb 3-1: Using ep0 maxpacket: 8 [ 1284.013572][ T5931] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1284.042851][ T5931] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1284.096341][ T5931] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1284.129364][T19705] veth1_macvtap: entered promiscuous mode [ 1284.129497][ T5931] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1284.173365][ T5931] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1284.213477][ T5931] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1284.228425][ T796] udl 6-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffe0 [ 1284.282403][T19525] syz_tun (unregistering): left allmulticast mode [ 1284.398193][T19705] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1284.515837][ T5931] usb 3-1: GET_CAPABILITIES returned 0 [ 1284.541241][ T5931] usbtmc 3-1:16.0: can't read capabilities [ 1284.626296][T19705] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1284.708711][T19774] netlink: 'syz.6.3577': attribute type 62 has an invalid length. [ 1284.775278][T17697] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1284.810327][T19777] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1284.840870][T19777] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1284.945486][T17697] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1285.103247][T19780] IPv6: addrconf: prefix option has invalid lifetime [ 1285.130237][T17697] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1285.371599][T17697] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1285.827498][T19764] usb 5-1: new high-speed USB device number 34 using dummy_hcd [ 1285.902104][T16030] Bluetooth: hci2: command tx timeout [ 1286.033049][T19764] usb 5-1: Using ep0 maxpacket: 32 [ 1286.129710][ T148] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1286.137644][T19764] usb 5-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 1286.137677][T19764] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1286.163748][T19764] usb 5-1: config 0 descriptor?? [ 1286.258909][ T148] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1286.422631][T19764] dvb-usb: found a 'Elgato EyeTV Sat' in cold state, will try to load a firmware [ 1286.436523][T19764] usb 5-1: Direct firmware load for dvb-usb-az6027-03.fw failed with error -2 [ 1286.462733][T19764] usb 5-1: Falling back to sysfs fallback for: dvb-usb-az6027-03.fw [ 1286.511284][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1286.541828][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1286.605697][ T80] bridge_slave_1: left allmulticast mode [ 1286.614462][ T80] bridge_slave_1: left promiscuous mode [ 1286.648383][ T80] bridge0: port 2(bridge_slave_1) entered disabled state [ 1286.694261][ T80] bridge_slave_0: left allmulticast mode [ 1286.714995][ T80] bridge_slave_0: left promiscuous mode [ 1286.736543][ T80] bridge0: port 1(bridge_slave_0) entered disabled state [ 1287.414609][ T80] dvmrp6 (unregistering): left allmulticast mode [ 1287.582567][ T5837] usb 3-1: USB disconnect, device number 93 [ 1287.802460][ T80] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1287.899017][ T80] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1287.958978][ T80] bond0 (unregistering): Released all slaves [ 1288.015148][ T80] bond1 (unregistering): Released all slaves [ 1288.094997][ T80] bond2 (unregistering): Released all slaves [ 1288.187602][T14574] usb 7-1: new high-speed USB device number 30 using dummy_hcd [ 1288.319316][ T80] tipc: Disabling bearer [ 1288.334088][ T80] tipc: Left network mode [ 1288.403184][T14574] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1288.458870][T14574] usb 7-1: New USB device found, idVendor=05f3, idProduct=0240, bcdDevice=1b.24 [ 1288.491256][T14574] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1288.511469][T14574] usb 7-1: Product: syz [ 1288.515691][T14574] usb 7-1: Manufacturer: syz [ 1288.559949][T14574] usb 7-1: SerialNumber: syz [ 1288.581534][T14574] usb 7-1: config 0 descriptor?? [ 1288.609609][T14574] powermate 7-1:0.0: probe with driver powermate failed with error -22 [ 1288.805729][ T5837] usb 7-1: USB disconnect, device number 30 [ 1288.853996][ T80] hsr_slave_0: left promiscuous mode [ 1288.883238][ T80] hsr_slave_1: left promiscuous mode [ 1290.258607][T15296] usb 3-1: new high-speed USB device number 94 using dummy_hcd [ 1290.411187][T15296] usb 3-1: device descriptor read/64, error -71 [ 1290.511802][ T80] IPVS: stop unused estimator thread 0... [ 1290.518494][ T5931] usb 7-1: new high-speed USB device number 31 using dummy_hcd [ 1290.657392][T15296] usb 3-1: new high-speed USB device number 95 using dummy_hcd [ 1290.701982][ T5931] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1290.733621][ T5931] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 1290.764345][ T5931] usb 7-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 1290.798598][T15296] usb 3-1: device descriptor read/64, error -71 [ 1290.816912][ T5931] usb 7-1: New USB device found, idVendor=8086, idProduct=0b5b, bcdDevice=e1.c5 [ 1290.851396][ T5931] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1290.861151][ T796] usb 9-1: new high-speed USB device number 2 using dummy_hcd [ 1290.902914][ T5931] usb 7-1: Product: syz [ 1290.908187][ T5931] usb 7-1: Manufacturer: syz [ 1290.912192][T15296] usb usb3-port1: attempt power cycle [ 1290.918643][ T5931] usb 7-1: SerialNumber: syz [ 1290.964105][ T5931] usb 7-1: config 0 descriptor?? [ 1290.998902][ T5931] uvcvideo 7-1:0.0: probe with driver uvcvideo failed with error -22 [ 1291.027395][ T796] usb 9-1: Using ep0 maxpacket: 16 [ 1291.061301][ T796] usb 9-1: config 0 has no interfaces? [ 1291.080023][ T796] usb 9-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1291.096569][ T796] usb 9-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1291.123266][ T796] usb 9-1: Manufacturer: syz [ 1291.153534][ T796] usb 9-1: config 0 descriptor?? [ 1291.258155][T19899] netlink: 'syz.6.3596': attribute type 10 has an invalid length. [ 1291.297353][T15296] usb 3-1: new high-speed USB device number 96 using dummy_hcd [ 1291.329703][T15296] usb 3-1: device descriptor read/8, error -71 [ 1291.362886][T19901] netlink: 'syz.6.3596': attribute type 10 has an invalid length. [ 1291.382309][T19890] netlink: 'syz.8.3597': attribute type 1 has an invalid length. [ 1291.424124][T19890] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1291.491152][T19892] bond0: (slave gretap1): making interface the new active one [ 1291.515876][T19892] bond0: (slave gretap1): Enslaving as an active interface with an up link [ 1291.568094][T15296] usb 3-1: new high-speed USB device number 97 using dummy_hcd [ 1291.598301][T15296] usb 3-1: device descriptor read/8, error -71 [ 1291.693857][T19890] vlan0: entered allmulticast mode [ 1291.716952][T19890] bond0: entered allmulticast mode [ 1291.723786][T19890] gretap1: entered allmulticast mode [ 1291.732583][T15296] usb usb3-port1: unable to enumerate USB device [ 1291.807812][T19890] bond0: (slave vlan0): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 1292.295625][ T29] kauditd_printk_skb: 46 callbacks suppressed [ 1292.295804][ T29] audit: type=1326 audit(1772113674.933:5590): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19922 comm="syz.4.3601" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fbdc919c629 code=0x0 [ 1293.152122][T15296] usb 7-1: USB disconnect, device number 31 [ 1293.365154][T19935] netlink: 'syz.6.3603': attribute type 5 has an invalid length. [ 1293.408147][T14574] usb 9-1: USB disconnect, device number 2 [ 1294.005264][ T65] bond0 (unregistering): (slave gretap1): Releasing active interface [ 1294.064453][ T65] gretap1 (unregistering): left allmulticast mode [ 1294.189935][ T65] bond0 (unregistering): Released all slaves [ 1294.468261][T14574] udl 6-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffe0 [ 1295.178157][T19974] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1296.008332][T14574] usb 3-1: new high-speed USB device number 98 using dummy_hcd [ 1296.387397][T14574] usb 3-1: config 205 has an invalid interface number: 48 but max is 2 [ 1296.396064][T14574] usb 3-1: config 205 has an invalid descriptor of length 0, skipping remainder of the config [ 1296.437038][T14574] usb 3-1: config 205 has 1 interface, different from the descriptor's value: 3 [ 1296.456662][T14574] usb 3-1: config 205 has no interface number 0 [ 1296.473198][T14574] usb 3-1: config 205 interface 48 altsetting 85 endpoint 0x6 has an invalid bInterval 166, changing to 7 [ 1296.547644][T14574] usb 3-1: config 205 interface 48 altsetting 85 endpoint 0x6 has invalid maxpacket 16968, setting to 1024 [ 1296.717427][T14574] usb 3-1: config 205 interface 48 altsetting 85 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 1296.761316][T14574] usb 3-1: config 205 interface 48 has no altsetting 0 [ 1296.780740][T14574] usb 3-1: New USB device found, idVendor=19d2, idProduct=ff79, bcdDevice=68.a0 [ 1296.797455][T14574] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1296.826027][T14574] usb 3-1: Product: syz [ 1296.840596][T14574] usb 3-1: Manufacturer: syz [ 1296.845250][T14574] usb 3-1: SerialNumber: syz [ 1297.117438][ T796] usb 7-1: new high-speed USB device number 32 using dummy_hcd [ 1297.129984][T19977] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1297.154782][T19977] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1297.317330][ T796] usb 7-1: Using ep0 maxpacket: 16 [ 1297.378821][ T796] usb 7-1: descriptor type invalid, skip [ 1297.387550][ T796] usb 7-1: config 0 has no interfaces? [ 1297.431764][ T796] usb 7-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 1297.462231][T14574] option 3-1:205.48: GSM modem (1-port) converter detected [ 1297.497294][ T796] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1297.543548][T14574] usb 3-1: USB disconnect, device number 98 [ 1297.549593][ T796] usb 7-1: Product: syz [ 1297.553789][ T796] usb 7-1: Manufacturer: syz [ 1297.590286][ T796] usb 7-1: SerialNumber: syz [ 1297.602805][T14574] option 3-1:205.48: device disconnected [ 1297.612059][ T796] usb 7-1: config 0 descriptor?? [ 1297.679252][T20000] netlink: 8 bytes leftover after parsing attributes in process `syz.8.3614'. [ 1297.745818][T20005] netlink: 148 bytes leftover after parsing attributes in process `syz.4.3616'. [ 1297.755050][T20005] A link change request failed with some changes committed already. Interface gre0 may have been left with an inconsistent configuration, please check. [ 1297.857297][ T29] audit: type=1326 audit(1772113680.483:5591): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20007 comm="syz.4.3618" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fbdc919c629 code=0x0 [ 1297.998478][T20013] IPv6: addrconf: prefix option has invalid lifetime [ 1298.344460][T20021] fuse: Bad value for 'group_id' [ 1298.356558][T20021] fuse: Bad value for 'group_id' [ 1299.004049][T20025] usb 7-1: USB disconnect, device number 32 [ 1299.935559][T20044] netlink: 816 bytes leftover after parsing attributes in process `syz.2.3625'. [ 1300.356014][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 1300.367349][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 1301.340561][T20051] netlink: 148 bytes leftover after parsing attributes in process `syz.4.3628'. [ 1301.375864][T20051] A link change request failed with some changes committed already. Interface gre0 may have been left with an inconsistent configuration, please check. [ 1301.697228][T20059] IPv6: addrconf: prefix option has invalid lifetime [ 1301.870844][T20061] netlink: 8 bytes leftover after parsing attributes in process `syz.8.3632'. [ 1302.048146][T20067] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1302.090930][T20064] bond3: entered allmulticast mode [ 1302.148176][T20064] 8021q: adding VLAN 0 to HW filter on device bond3 [ 1302.385065][T20079] fuse: Unknown parameter '0xffffffffffffffff00000000000000000000' [ 1302.400100][T20079] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3637'. [ 1302.410126][T20079] veth0_vlan: entered allmulticast mode [ 1302.419183][T14574] usb 9-1: new high-speed USB device number 3 using dummy_hcd [ 1302.619252][T14574] usb 9-1: device descriptor read/64, error -71 [ 1302.638461][T20085] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1302.667736][T20085] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1302.867799][T14574] usb 9-1: new high-speed USB device number 4 using dummy_hcd [ 1303.028251][T14574] usb 9-1: device descriptor read/64, error -71 [ 1303.137828][T14574] usb usb9-port1: attempt power cycle [ 1303.479375][T14574] usb 9-1: new high-speed USB device number 5 using dummy_hcd [ 1303.519397][T14574] usb 9-1: device descriptor read/8, error -71 [ 1303.578101][T20096] loop9: detected capacity change from 0 to 7 [ 1303.598472][T20096] Dev loop9: unable to read RDB block 7 [ 1303.604215][T20096] loop9: AHDI p1 p2 p3 [ 1303.608773][T20096] loop9: partition table partially beyond EOD, truncated [ 1303.616807][T20096] loop9: p1 start 1601398130 is beyond EOD, truncated [ 1303.623909][T20096] loop9: p2 start 1702059890 is beyond EOD, truncated [ 1303.641249][T20097] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1303.740732][T20099] vivid-003: disconnect [ 1303.787322][T14574] usb 9-1: new high-speed USB device number 6 using dummy_hcd [ 1303.814168][T14574] usb 9-1: device descriptor read/8, error -71 [ 1303.881050][T20104] vhci_hcd vhci_hcd.0: pdev(5) rhport(0) sockfd(8) [ 1303.887846][T20104] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 1303.903461][T20104] vhci_hcd vhci_hcd.0: Device attached [ 1303.930337][T14574] usb usb9-port1: unable to enumerate USB device [ 1304.139783][T14574] usb 43-1: new low-speed USB device number 2 using vhci_hcd [ 1304.150643][T20115] binder: BINDER_SET_CONTEXT_MGR already set [ 1304.156799][T20115] binder: 20114:20115 ioctl 4018620d 200000004a80 returned -16 [ 1304.174274][T20115] binder: 20114:20115 ioctl c0306201 200000004a40 returned -14 [ 1304.315902][T20117] xt_ipcomp: unknown flags 1D [ 1304.459186][T20119] create_pit_timer: 11 callbacks suppressed [ 1304.459201][T20119] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 1304.496667][T20091] vivid-003: reconnect [ 1304.621191][T20106] vhci_hcd: connection reset by peer [ 1304.645467][ T13] vhci_hcd vhci_hcd.5: stop threads [ 1304.663617][ T13] vhci_hcd vhci_hcd.5: release socket [ 1304.681513][ T13] vhci_hcd vhci_hcd.5: disconnect device [ 1304.697974][ T5936] udl 6-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffe0 [ 1304.718378][T10304] usb 3-1: new high-speed USB device number 99 using dummy_hcd [ 1304.869336][T10304] usb 3-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1304.886717][T10304] usb 3-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 1304.904021][T10304] usb 3-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 1304.928807][T10304] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1304.971656][T20119] raw-gadget.4 gadget.2: fail, usb_ep_enable returned -22 [ 1304.992170][T10304] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 1305.232724][T10304] usb 3-1: USB disconnect, device number 99 [ 1305.447068][T20134] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1305.484256][T20134] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1306.358238][ T5936] usb 3-1: new high-speed USB device number 100 using dummy_hcd [ 1306.527352][ T5936] usb 3-1: Using ep0 maxpacket: 16 [ 1306.545724][ T5936] usb 3-1: config 0 has an invalid interface number: 24 but max is 0 [ 1306.574258][ T5936] usb 3-1: config 0 has no interface number 0 [ 1306.595360][ T5936] usb 3-1: config 0 interface 24 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1306.635501][ T5936] usb 3-1: config 0 interface 24 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1306.656362][ T5936] usb 3-1: New USB device found, idVendor=6161, idProduct=4d15, bcdDevice= 0.00 [ 1306.672020][ T5936] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1306.722404][ T5936] usb 3-1: config 0 descriptor?? [ 1306.797392][T20160] usb 9-1: new high-speed USB device number 7 using dummy_hcd [ 1306.955291][T20156] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1306.977160][T20160] usb 9-1: too many configurations: 9, using maximum allowed: 8 [ 1306.985725][T20156] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1307.001006][T20160] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1307.036690][T20160] usb 9-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1307.071378][T20160] usb 9-1: config 0 interface 0 has no altsetting 0 [ 1307.083738][T20160] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1307.099169][T20160] usb 9-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1307.168411][T20160] usb 9-1: config 0 interface 0 has no altsetting 0 [ 1307.178074][ T24] usb 7-1: new high-speed USB device number 33 using dummy_hcd [ 1307.253873][T20160] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1307.272758][T20160] usb 9-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1307.284526][T20160] usb 9-1: config 0 interface 0 has no altsetting 0 [ 1307.292754][T20160] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1307.302662][T20160] usb 9-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1307.313816][T20160] usb 9-1: config 0 interface 0 has no altsetting 0 [ 1307.320648][ T24] usb 7-1: device descriptor read/64, error -71 [ 1307.331873][T20160] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1307.345153][T20160] usb 9-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1307.373637][T20160] usb 9-1: config 0 interface 0 has no altsetting 0 [ 1307.562296][T20160] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1307.585111][T20160] usb 9-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1307.596224][ T24] usb 7-1: new high-speed USB device number 34 using dummy_hcd [ 1307.626398][T20160] usb 9-1: config 0 interface 0 has no altsetting 0 [ 1307.658081][T20160] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1307.672641][T20160] usb 9-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1307.715373][T20160] usb 9-1: config 0 interface 0 has no altsetting 0 [ 1307.739229][ T24] usb 7-1: device descriptor read/64, error -71 [ 1307.756866][T20160] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1307.781937][T20160] usb 9-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1307.824045][T20160] usb 9-1: config 0 interface 0 has no altsetting 0 [ 1307.849667][T20160] usb 9-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 1307.860074][ T24] usb usb7-port1: attempt power cycle [ 1307.879544][T20160] usb 9-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 1307.911194][T20160] usb 9-1: Product: syz [ 1307.925592][T20160] usb 9-1: Manufacturer: syz [ 1307.947126][T20160] usb 9-1: SerialNumber: syz [ 1308.115798][T20160] usb 9-1: config 0 descriptor?? [ 1308.161951][T20160] yurex 9-1:0.0: USB YUREX device now attached to Yurex #0 [ 1308.223968][ T24] usb 7-1: new high-speed USB device number 35 using dummy_hcd [ 1308.260980][ T24] usb 7-1: device descriptor read/8, error -71 [ 1308.324773][T20185] usb 9-1: USB disconnect, device number 7 [ 1308.333545][T20185] yurex 9-1:0.0: USB YUREX #0 now disconnected [ 1308.694995][ T24] usb 7-1: new high-speed USB device number 36 using dummy_hcd [ 1308.829400][ T24] usb 7-1: device descriptor read/8, error -71 [ 1308.913618][T20201] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1308.964713][ T24] usb usb7-port1: unable to enumerate USB device [ 1309.260421][T14574] vhci_hcd vhci_hcd.5: vhci_device speed not set [ 1310.233240][ T5936] usbhid 3-1:0.24: can't add hid device: -71 [ 1310.267347][ T5936] usbhid 3-1:0.24: probe with driver usbhid failed with error -71 [ 1310.317607][ T5936] usb 3-1: USB disconnect, device number 100 [ 1310.395521][ T29] audit: type=1804 audit(1772113693.033:5592): pid=20235 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.6.3670" name="bus" dev="ramfs" ino=105172 res=1 errno=0 [ 1311.328411][T20256] rdma_op ffff888035c1d9f0 conn xmit_rdma 0000000000000000 [ 1311.378076][T20259] rdma_op ffff888035c1d1f0 conn xmit_rdma 0000000000000000 [ 1311.827328][ T5837] usb 9-1: new high-speed USB device number 8 using dummy_hcd [ 1311.978446][ T5837] usb 9-1: Using ep0 maxpacket: 32 [ 1312.004286][ T5837] usb 9-1: New USB device found, idVendor=05a9, idProduct=1550, bcdDevice=e4.bb [ 1312.047361][ T5837] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1312.078508][ T5837] usb 9-1: Product: syz [ 1312.093055][ T5837] usb 9-1: Manufacturer: syz [ 1312.147812][ T5837] usb 9-1: SerialNumber: syz [ 1312.199836][ T5837] usb 9-1: config 0 descriptor?? [ 1312.225175][ T5837] gspca_main: ov534_9-2.14.0 probing 05a9:1550 [ 1312.321626][T20276] vti0: entered promiscuous mode [ 1312.398083][T20278] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1312.464483][T20278] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1312.539964][T20251] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3675'. [ 1312.648732][ T29] audit: type=1326 audit(1772113695.283:5593): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20284 comm="syz.4.3682" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbdc919c629 code=0x7ffc0000 [ 1312.752704][ T29] audit: type=1326 audit(1772113695.283:5594): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20284 comm="syz.4.3682" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbdc919c629 code=0x7ffc0000 [ 1312.997783][T20264] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1313.038517][T20264] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 1313.110923][T20300] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3686'. [ 1313.155204][T20300] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3686'. [ 1313.232551][T20294] syz_tun: entered allmulticast mode [ 1313.298079][ T5837] gspca_ov534_9: reg_w failed -110 [ 1313.316754][T20263] syz_tun: left allmulticast mode [ 1313.566867][T20309] FAULT_INJECTION: forcing a failure. [ 1313.566867][T20309] name failslab, interval 1, probability 0, space 0, times 0 [ 1313.606950][ T5837] gspca_ov534_9: Unknown sensor 0000 [ 1313.607057][ T5837] ov534_9 9-1:0.0: probe with driver ov534_9 failed with error -22 [ 1313.617442][T20309] CPU: 1 UID: 0 PID: 20309 Comm: syz.6.3688 Tainted: G L syzkaller #0 PREEMPT(full) [ 1313.617534][T20309] Tainted: [L]=SOFTLOCKUP [ 1313.617557][T20309] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1313.617596][T20309] Call Trace: [ 1313.617618][T20309] [ 1313.617647][T20309] dump_stack_lvl+0xe8/0x150 [ 1313.617743][T20309] should_fail_ex+0x412/0x560 [ 1313.617834][T20309] should_failslab+0xa8/0x100 [ 1313.617908][T20309] __kmalloc_noprof+0xe8/0x760 [ 1313.617971][T20309] ? tomoyo_encode+0x28b/0x550 [ 1313.618068][T20309] tomoyo_encode+0x28b/0x550 [ 1313.618159][T20309] tomoyo_realpath_from_path+0x58d/0x5d0 [ 1313.618297][T20309] ? tomoyo_path_number_perm+0x219/0x630 [ 1313.618353][T20309] tomoyo_path_number_perm+0x246/0x630 [ 1313.618426][T20309] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1313.618500][T20309] ? __lock_acquire+0x6b5/0x2cf0 [ 1313.618603][T20309] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 1313.618711][T20309] ? __fget_files+0x2a/0x420 [ 1313.618811][T20309] ? __fget_files+0x2a/0x420 [ 1313.618886][T20309] ? __fget_files+0x3a0/0x420 [ 1313.618960][T20309] ? __fget_files+0x2a/0x420 [ 1313.619044][T20309] security_file_ioctl+0xc3/0x2a0 [ 1313.619138][T20309] __se_sys_ioctl+0x47/0x170 [ 1313.619224][T20309] do_syscall_64+0x14d/0xf80 [ 1313.619304][T20309] ? trace_irq_disable+0x3b/0x150 [ 1313.619383][T20309] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1313.619436][T20309] ? clear_bhb_loop+0x40/0x90 [ 1313.619505][T20309] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1313.619578][T20309] RIP: 0033:0x7fc18c79c629 [ 1313.619643][T20309] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1313.619686][T20309] RSP: 002b:00007fc18d5e8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1313.619756][T20309] RAX: ffffffffffffffda RBX: 00007fc18ca15fa0 RCX: 00007fc18c79c629 [ 1313.619805][T20309] RDX: 00002000000001c0 RSI: 00000000c0d05640 RDI: 0000000000000003 [ 1313.619830][T20309] RBP: 00007fc18d5e8090 R08: 0000000000000000 R09: 0000000000000000 [ 1313.619869][T20309] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1313.619900][T20309] R13: 00007fc18ca16038 R14: 00007fc18ca15fa0 R15: 00007fc18cb3fa48 [ 1313.619995][T20309] [ 1313.620314][T20309] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1313.725775][ T5837] usb 9-1: USB disconnect, device number 8 [ 1314.046986][T20314] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1314.087670][T20314] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1314.409091][T20328] netlink: 816 bytes leftover after parsing attributes in process `syz.6.3690'. [ 1314.550260][ T5936] usb 3-1: new high-speed USB device number 101 using dummy_hcd [ 1315.003267][ T24] udl 6-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffe0 [ 1315.040077][ T5936] usb 3-1: Using ep0 maxpacket: 16 [ 1315.058503][ T5936] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1315.071525][T20336] x_tables: duplicate underflow at hook 1 [ 1315.157817][ T5936] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1315.214496][T20336] x_tables: ip6_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 1315.327331][ T5936] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1315.397443][ T5936] usb 3-1: New USB device found, idVendor=056a, idProduct=0317, bcdDevice= 0.00 [ 1315.447561][ T5936] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1315.567004][ T5936] usb 3-1: config 0 descriptor?? [ 1315.685013][T20347] binfmt_misc: register: failed to install interpreter file ./file0 [ 1316.078095][ T24] usb 9-1: new high-speed USB device number 9 using dummy_hcd [ 1316.152249][ T5936] wacom 0003:056A:0317.0039: item fetching failed at offset 0/11 [ 1316.182020][ T5936] wacom 0003:056A:0317.0039: parse failed [ 1316.207370][ T5936] wacom 0003:056A:0317.0039: probe with driver wacom failed with error -22 [ 1316.278273][ T24] usb 9-1: device descriptor read/64, error -71 [ 1316.310125][T20361] netlink: 36 bytes leftover after parsing attributes in process `syz.5.3696'. [ 1316.340600][T20361] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1316.386529][T20363] program syz.4.3698 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1316.396828][T20363] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 1316.458978][T20323] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1316.509836][T20361] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1316.517891][ T24] usb 9-1: new high-speed USB device number 10 using dummy_hcd [ 1316.563732][T20323] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1316.579877][T20323] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1316.603838][T20323] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1316.730346][ T5837] usb 3-1: USB disconnect, device number 101 [ 1316.757599][ T24] usb 9-1: device descriptor read/64, error -71 [ 1317.007947][ T24] usb usb9-port1: attempt power cycle [ 1317.357367][ T24] usb 9-1: new high-speed USB device number 11 using dummy_hcd [ 1317.377967][ T24] usb 9-1: device descriptor read/8, error -71 [ 1317.402053][T20369] FAULT_INJECTION: forcing a failure. [ 1317.402053][T20369] name failslab, interval 1, probability 0, space 0, times 0 [ 1317.433429][T20369] CPU: 0 UID: 0 PID: 20369 Comm: syz.2.3700 Tainted: G L syzkaller #0 PREEMPT(full) [ 1317.433469][T20369] Tainted: [L]=SOFTLOCKUP [ 1317.433478][T20369] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1317.433494][T20369] Call Trace: [ 1317.433504][T20369] [ 1317.433513][T20369] dump_stack_lvl+0xe8/0x150 [ 1317.433550][T20369] should_fail_ex+0x412/0x560 [ 1317.433580][T20369] should_failslab+0xa8/0x100 [ 1317.433608][T20369] __kmalloc_noprof+0xe8/0x760 [ 1317.433628][T20369] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 1317.433650][T20369] ? video_usercopy+0x1b1/0x14b0 [ 1317.433679][T20369] video_usercopy+0x1b1/0x14b0 [ 1317.433706][T20369] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 1317.433729][T20369] ? __pfx___video_do_ioctl+0x10/0x10 [ 1317.433754][T20369] ? __pfx_video_usercopy+0x10/0x10 [ 1317.433790][T20369] ? __fget_files+0x2a/0x420 [ 1317.433823][T20369] ? __fget_files+0x2a/0x420 [ 1317.433851][T20369] ? __fget_files+0x3a0/0x420 [ 1317.433884][T20369] v4l2_ioctl+0x18d/0x1e0 [ 1317.433908][T20369] ? __pfx_v4l2_ioctl+0x10/0x10 [ 1317.433930][T20369] __se_sys_ioctl+0xfc/0x170 [ 1317.433956][T20369] do_syscall_64+0x14d/0xf80 [ 1317.433986][T20369] ? trace_irq_disable+0x3b/0x150 [ 1317.434017][T20369] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1317.434039][T20369] ? clear_bhb_loop+0x40/0x90 [ 1317.434065][T20369] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1317.434086][T20369] RIP: 0033:0x7f82b3f9c629 [ 1317.434105][T20369] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1317.434124][T20369] RSP: 002b:00007f82b4e11028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1317.434146][T20369] RAX: ffffffffffffffda RBX: 00007f82b4215fa0 RCX: 00007f82b3f9c629 [ 1317.434162][T20369] RDX: 00002000000001c0 RSI: 00000000c0d05640 RDI: 0000000000000003 [ 1317.434176][T20369] RBP: 00007f82b4e11090 R08: 0000000000000000 R09: 0000000000000000 [ 1317.434190][T20369] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1317.434202][T20369] R13: 00007f82b4216038 R14: 00007f82b4215fa0 R15: 00007f82b433fa48 [ 1317.434233][T20369] [ 1317.789602][ T24] usb 9-1: new high-speed USB device number 12 using dummy_hcd [ 1318.013488][T20377] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3703'. [ 1318.035842][T20377] netlink: 60 bytes leftover after parsing attributes in process `syz.6.3703'. [ 1318.093452][ T24] usb 9-1: device descriptor read/8, error -71 [ 1318.222636][ T24] usb usb9-port1: unable to enumerate USB device [ 1318.431902][T14574] usb 3-1: new high-speed USB device number 102 using dummy_hcd [ 1318.599203][T14574] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1318.614370][T14574] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1318.638770][T14574] usb 3-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 1318.730209][T14574] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 1318.739098][T14574] usb 3-1: SerialNumber: syz [ 1319.175388][T14574] usb 3-1: skipping empty audio interface (v1) [ 1319.302416][T14574] snd-usb-audio 3-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 1319.329651][T14574] usb 3-1: USB disconnect, device number 102 [ 1319.400824][T14960] udevd[14960]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1319.735484][T20405] netlink: 12 bytes leftover after parsing attributes in process `syz.6.3711'. [ 1320.032702][T20410] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3712'. [ 1320.223467][T20410] fuse: Bad value for 'group_id' [ 1320.229373][T20410] fuse: Bad value for 'group_id' [ 1320.306939][T20411] fuse: Bad value for 'group_id' [ 1320.315563][T20411] fuse: Bad value for 'group_id' [ 1320.714931][T20423] netlink: 136 bytes leftover after parsing attributes in process `syz.5.3716'. [ 1321.123906][ T29] audit: type=1326 audit(1772113703.763:5595): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20432 comm="syz.5.3719" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1f65b9c629 code=0x7ffc0000 [ 1321.162254][T20436] netlink: 232 bytes leftover after parsing attributes in process `syz.5.3719'. [ 1321.212197][ T29] audit: type=1326 audit(1772113703.793:5596): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20432 comm="syz.5.3719" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1f65b9c629 code=0x7ffc0000 [ 1321.287277][ T29] audit: type=1326 audit(1772113703.793:5597): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20432 comm="syz.5.3719" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1f65b9c629 code=0x7ffc0000 [ 1321.464407][ T29] audit: type=1326 audit(1772113703.793:5598): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20432 comm="syz.5.3719" exe="/root/syz-executor" sig=0 arch=c000003e syscall=12 compat=0 ip=0x7f1f65b9c629 code=0x7ffc0000 [ 1321.569822][ T29] audit: type=1326 audit(1772113703.793:5599): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20432 comm="syz.5.3719" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1f65b9c629 code=0x7ffc0000 [ 1321.667398][ T29] audit: type=1326 audit(1772113703.793:5600): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20432 comm="syz.5.3719" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1f65b9c629 code=0x7ffc0000 [ 1321.744095][ T29] audit: type=1326 audit(1772113703.793:5601): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20432 comm="syz.5.3719" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1f65b9c629 code=0x7ffc0000 [ 1321.772063][T20442] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3722'. [ 1321.788324][T20442] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3722'. [ 1321.858070][ T29] audit: type=1326 audit(1772113703.793:5602): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20432 comm="syz.5.3719" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1f65b9c629 code=0x7ffc0000 [ 1321.954445][ T29] audit: type=1326 audit(1772113703.793:5603): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20432 comm="syz.5.3719" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1f65b9c629 code=0x7ffc0000 [ 1322.025431][ T29] audit: type=1326 audit(1772113703.793:5604): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20432 comm="syz.5.3719" exe="/root/syz-executor" sig=0 arch=c000003e syscall=49 compat=0 ip=0x7f1f65b9c629 code=0x7ffc0000 [ 1322.127290][T10304] usb 3-1: new high-speed USB device number 103 using dummy_hcd [ 1322.296515][T10304] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1322.309299][T10304] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1322.354937][T10304] usb 3-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 1322.395194][T10304] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1322.445702][T10304] usb 3-1: config 0 descriptor?? [ 1322.477436][T14574] usb 9-1: new high-speed USB device number 13 using dummy_hcd [ 1322.708458][T14574] usb 9-1: Using ep0 maxpacket: 16 [ 1322.728859][T10304] usbhid 3-1:0.0: can't add hid device: -71 [ 1322.735007][T10304] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 1322.735820][T14574] usb 9-1: config 146 has too many interfaces: 237, using maximum allowed: 32 [ 1322.846979][T14574] usb 9-1: config 146 has an invalid descriptor of length 0, skipping remainder of the config [ 1322.873502][T14574] usb 9-1: config 146 has 0 interfaces, different from the descriptor's value: 237 [ 1322.889101][T10304] usb 3-1: USB disconnect, device number 103 [ 1322.894939][T14574] usb 9-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 1322.917130][T14574] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1323.145313][T14574] usb 9-1: string descriptor 0 read error: -71 [ 1323.169588][T14574] usb 9-1: USB disconnect, device number 13 [ 1323.256941][T20483] input: syz0 as /devices/virtual/input/input81 [ 1323.307498][T10304] usb 3-1: new high-speed USB device number 104 using dummy_hcd [ 1323.517046][T10304] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1323.536190][T10304] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1323.547410][T10304] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 1323.574307][T10304] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1323.587437][T10304] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1323.604727][T10304] usb 3-1: config 0 descriptor?? [ 1323.703739][T20488] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1323.719162][T20488] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1323.803698][T20490] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3727'. [ 1323.814253][T20490] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3727'. [ 1323.827480][T20490] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3727'. [ 1323.844414][T20490] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3727'. [ 1323.859192][T20490] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3727'. [ 1324.138841][T10304] plantronics 0003:047F:FFFF.003A: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 1324.597384][ T5936] usb 7-1: new high-speed USB device number 37 using dummy_hcd [ 1324.671663][T14574] usb 9-1: new high-speed USB device number 14 using dummy_hcd [ 1324.757358][ T5936] usb 7-1: Using ep0 maxpacket: 8 [ 1324.790572][ T5936] usb 7-1: config 5 has an invalid interface number: 160 but max is 0 [ 1324.814122][ T5936] usb 7-1: config 5 has an invalid interface number: 107 but max is 0 [ 1324.834990][ T5936] usb 7-1: config 5 has 2 interfaces, different from the descriptor's value: 1 [ 1324.857682][T14574] usb 9-1: Using ep0 maxpacket: 32 [ 1324.880605][T14574] usb 9-1: config 0 has an invalid interface number: 184 but max is 0 [ 1324.904741][T14574] usb 9-1: config 0 has no interface number 0 [ 1324.913358][ T5936] usb 7-1: config 5 has no interface number 0 [ 1324.929567][T20507] kvm: requested 135771 ns i8254 timer period limited to 200000 ns [ 1324.939327][T14574] usb 9-1: config 0 interface 184 has no altsetting 0 [ 1324.946220][ T5936] usb 7-1: config 5 has no interface number 1 [ 1324.954529][T20507] kvm: requested 18438 ns i8254 timer period limited to 200000 ns [ 1324.964834][ T5936] usb 7-1: config 5 interface 160 altsetting 6 has an invalid descriptor for endpoint zero, skipping [ 1324.979138][T20507] kvm: requested 24304 ns i8254 timer period limited to 200000 ns [ 1324.986667][T14574] usb 9-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 1325.005174][ T5936] usb 7-1: too many endpoints for config 5 interface 107 altsetting 226: 223, using maximum allowed: 30 [ 1325.027911][T14574] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1325.036442][T14574] usb 9-1: Product: syz [ 1325.052217][ T5936] usb 7-1: config 5 interface 107 altsetting 226 has 0 endpoint descriptors, different from the interface descriptor's value: 223 [ 1325.086574][T14574] usb 9-1: Manufacturer: syz [ 1325.094028][T14574] usb 9-1: SerialNumber: syz [ 1325.105095][ T5936] usb 7-1: config 5 interface 160 has no altsetting 0 [ 1325.125803][T14574] usb 9-1: config 0 descriptor?? [ 1325.137944][ T5936] usb 7-1: config 5 interface 107 has no altsetting 0 [ 1325.159393][ T5936] usb 7-1: New USB device found, idVendor=046d, idProduct=08a1, bcdDevice=6e.7b [ 1325.168983][ T5936] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1325.179411][ T24] udl 6-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffe0 [ 1325.190796][ T5936] usb 7-1: Product: syz [ 1325.199908][ T5936] usb 7-1: Manufacturer: syz [ 1325.212484][ T5936] usb 7-1: SerialNumber: syz [ 1325.467287][ T10] usb 3-1: reset high-speed USB device number 104 using dummy_hcd [ 1325.503765][ T5936] usb 7-1: USB disconnect, device number 37 [ 1326.171478][T14574] smsc75xx 9-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 1326.207501][T14574] smsc75xx 9-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 1326.447104][T14574] smsc75xx 9-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 1326.498882][T14574] smsc75xx 9-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -71 [ 1326.530662][T14574] smsc75xx 9-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_reset [ 1326.561157][T14574] smsc75xx 9-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -71 [ 1326.587410][T14574] smsc75xx 9-1:0.184: probe with driver smsc75xx failed with error -71 [ 1326.627612][T20522] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1326.651843][T14574] usb 9-1: USB disconnect, device number 14 [ 1326.657924][T20522] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1326.695192][T20522] binder: 20521:20522 ioctl 400c620e 200000000080 returned -22 [ 1326.709224][T20532] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3739'. [ 1326.926813][T20542] unsupported nlmsg_type 40 [ 1327.048502][T20544] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3743'. [ 1327.256621][T20554] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3748'. [ 1327.265992][T20554] tipc: Invalid UDP bearer configuration [ 1327.266040][T20554] tipc: Enabling of bearer rejected, failed to enable media [ 1327.329531][T14574] usb 9-1: new full-speed USB device number 15 using dummy_hcd [ 1327.408267][T20560] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1327.427328][ T10] usb 3-1: device descriptor read/64, error -71 [ 1327.427610][T20560] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1327.509112][T14574] usb 9-1: config 0 has an invalid interface number: 1 but max is 0 [ 1327.517381][T14574] usb 9-1: config 0 has no interface number 0 [ 1327.523498][T14574] usb 9-1: config 0 interface 1 altsetting 128 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 1327.535372][T14574] usb 9-1: config 0 interface 1 altsetting 128 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1327.546007][T14574] usb 9-1: config 0 interface 1 altsetting 128 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1327.559290][T14574] usb 9-1: config 0 interface 1 has no altsetting 0 [ 1327.565948][T14574] usb 9-1: New USB device found, idVendor=145f, idProduct=0212, bcdDevice= 0.00 [ 1327.575558][T14574] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1327.586703][T14574] usb 9-1: config 0 descriptor?? [ 1327.677581][ T10] usb 3-1: reset high-speed USB device number 104 using dummy_hcd [ 1327.690689][ T10] usb 3-1: device reset changed ep0 maxpacket size! [ 1327.698818][T10304] usb 3-1: USB disconnect, device number 104 [ 1327.839120][T10304] usb 3-1: new high-speed USB device number 105 using dummy_hcd [ 1328.001944][T10304] usb 3-1: Using ep0 maxpacket: 16 [ 1328.027203][T10304] usb 3-1: config 0 has an invalid interface number: 168 but max is 0 [ 1328.035532][T10304] usb 3-1: config 0 has no interface number 0 [ 1328.046866][T10304] usb 3-1: config 0 interface 168 has no altsetting 0 [ 1328.071066][T10304] usb 3-1: New USB device found, idVendor=0c45, idProduct=613a, bcdDevice=a8.fe [ 1328.088341][T10304] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1328.106657][T10304] usb 3-1: Product: syz [ 1328.111576][T10304] usb 3-1: Manufacturer: syz [ 1328.116224][T10304] usb 3-1: SerialNumber: syz [ 1328.137470][T10304] usb 3-1: config 0 descriptor?? [ 1328.188517][T10305] usb 7-1: new high-speed USB device number 38 using dummy_hcd [ 1328.216347][T14574] input: HID 145f:0212 as /devices/platform/dummy_hcd.8/usb9/9-1/9-1:0.1/0003:145F:0212.003B/input/input83 [ 1328.247497][T14574] input: HID 145f:0212 as /devices/platform/dummy_hcd.8/usb9/9-1/9-1:0.1/0003:145F:0212.003B/input/input84 [ 1328.380658][T10305] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1328.394511][T10305] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1328.405657][T10305] usb 7-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 1328.415502][T10305] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 1328.426137][T10304] usb-storage 3-1:0.168: USB Mass Storage device detected [ 1328.450367][T14574] uclogic 0003:145F:0212.003B: input,hidraw0: USB HID v4.06 Keypad [HID 145f:0212] on usb-dummy_hcd.8-1/input1 [ 1328.472928][T10305] usb 7-1: SerialNumber: syz [ 1328.529682][ T29] kauditd_printk_skb: 12 callbacks suppressed [ 1328.529723][ T29] audit: type=1326 audit(1772113711.173:5617): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20580 comm="syz.4.3760" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fbdc919c629 code=0x0 [ 1328.583760][T14574] usb 9-1: USB disconnect, device number 15 [ 1328.642155][T20582] fido_id[20582]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.8/usb9/9-1/report_descriptor': No such file or directory [ 1328.670809][T10304] gspca_main: sonixj-2.14.0 probing 0c45:613a [ 1328.697734][T10304] gspca_sonixj: reg_w1 err -71 [ 1328.702673][T10304] sonixj 3-1:0.168: probe with driver sonixj failed with error -71 [ 1328.736014][T10305] usb 7-1: 0:2 : does not exist [ 1328.741525][T10305] usb 7-1: unit 5: unexpected type 0x09 [ 1328.752648][T10304] usb 3-1: USB disconnect, device number 105 [ 1328.896151][T10305] usb 7-1: USB disconnect, device number 38 [ 1329.029018][T14960] udevd[14960]: error opening ATTR{/sys/devices/platform/dummy_hcd.6/usb7/7-1/7-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1329.296211][T20597] syzkaller1: entered promiscuous mode [ 1329.314075][T20597] syzkaller1: entered allmulticast mode [ 1329.412152][T20603] fuse: Unknown parameter '00000000000000000000' [ 1329.796225][T20621] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1329.824096][T20621] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1330.074272][T20634] netlink: 96 bytes leftover after parsing attributes in process `syz.2.3783'. [ 1330.139535][T10305] usb 9-1: new high-speed USB device number 16 using dummy_hcd [ 1330.307980][T10305] usb 9-1: Using ep0 maxpacket: 8 [ 1330.315463][T10305] usb 9-1: config 179 has an invalid interface number: 65 but max is 0 [ 1330.325266][T10305] usb 9-1: config 179 has an invalid descriptor of length 255, skipping remainder of the config [ 1330.336965][T10305] usb 9-1: config 179 has no interface number 0 [ 1330.348476][T10305] usb 9-1: config 179 interface 65 altsetting 12 has 0 endpoint descriptors, different from the interface descriptor's value: 23 [ 1330.367540][T10305] usb 9-1: config 179 interface 65 has no altsetting 0 [ 1330.386637][T10305] usb 9-1: New USB device found, idVendor=12ab, idProduct=0004, bcdDevice= 0.00 [ 1330.396710][T10305] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1330.664916][T10305] usb 9-1: string descriptor 0 read error: -71 [ 1330.695976][T10305] usb 9-1: USB disconnect, device number 16 [ 1330.887622][ T10] usb 7-1: new high-speed USB device number 39 using dummy_hcd [ 1331.067502][ T10] usb 7-1: Using ep0 maxpacket: 32 [ 1331.075079][ T10] usb 7-1: config 0 has an invalid interface number: 188 but max is 0 [ 1331.087351][ T10] usb 7-1: config 0 has no interface number 0 [ 1331.097130][ T10] usb 7-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 1331.111402][ T10] usb 7-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 1331.123628][T20664] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1331.135234][ T10] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1331.148361][T20664] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1331.156174][ T10] usb 7-1: Product: syz [ 1331.160522][ T10] usb 7-1: Manufacturer: syz [ 1331.165150][ T10] usb 7-1: SerialNumber: syz [ 1331.179499][ T10] usb 7-1: config 0 descriptor?? [ 1331.187819][T20650] raw-gadget.3 gadget.6: fail, usb_ep_enable returned -22 [ 1331.406089][T20650] raw-gadget.3 gadget.6: fail, usb_ep_enable returned -22 [ 1331.637314][T10304] usb 9-1: new high-speed USB device number 17 using dummy_hcd [ 1331.697317][ T5936] usb 3-1: new high-speed USB device number 106 using dummy_hcd [ 1331.789226][T10304] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1331.800414][T10304] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1331.810345][T10304] usb 9-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 1331.828342][T10304] usb 9-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1331.838209][T10304] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1331.849835][T10304] usb 9-1: config 0 descriptor?? [ 1331.857256][ T5936] usb 3-1: Using ep0 maxpacket: 32 [ 1331.864797][ T5936] usb 3-1: config 0 has an invalid interface number: 196 but max is 0 [ 1331.873873][ T5936] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1331.885773][ T5936] usb 3-1: config 0 has no interface number 0 [ 1331.892244][ T5936] usb 3-1: config 0 interface 196 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 1331.909678][ T5936] usb 3-1: New USB device found, idVendor=05ac, idProduct=77c2, bcdDevice=eb.3a [ 1331.921633][ T5936] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1331.929897][ T5936] usb 3-1: Product: syz [ 1331.934136][ T5936] usb 3-1: Manufacturer: syz [ 1331.940351][ T5936] usb 3-1: SerialNumber: syz [ 1331.948689][ T5936] usb 3-1: config 0 descriptor?? [ 1331.958435][ T5936] ipheth 3-1:0.196: Unable to find alternate settings interface [ 1332.162120][ T5837] usb 3-1: USB disconnect, device number 106 [ 1332.279172][T10304] plantronics 0003:047F:FFFF.003C: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.8-1/input0 [ 1332.501460][T20679] fuse: Bad value for 'user_id' [ 1332.506482][T20679] fuse: Bad value for 'user_id' [ 1332.823763][T20686] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3480241289 (13920965156 ns) > initial count (268 ns). Using initial count to start timer. [ 1333.050134][ T10] asix 7-1:0.188 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 1333.072972][ T10] asix 7-1:0.188 (unnamed net_device) (uninitialized): Failed to send software reset: ffffffb9 [ 1333.084318][ T10] asix 7-1:0.188: probe with driver asix failed with error -71 [ 1333.117917][ T10] usb 7-1: USB disconnect, device number 39 [ 1333.297654][T20699] netlink: 220 bytes leftover after parsing attributes in process `syz.4.3813'. [ 1333.587719][ C1] plantronics 0003:047F:FFFF.003C: usb_submit_urb(ctrl) failed: -1 [ 1333.601196][ T10] usb 9-1: USB disconnect, device number 17 [ 1333.695716][T20711] fuse: Unknown parameter 'measure' [ 1334.548343][ T5837] usb 7-1: new low-speed USB device number 40 using dummy_hcd [ 1334.757404][ T5837] usb 7-1: Invalid ep0 maxpacket: 64 [ 1334.887289][ T5837] usb 7-1: new low-speed USB device number 41 using dummy_hcd [ 1335.037686][ T24] usb 3-1: new high-speed USB device number 107 using dummy_hcd [ 1335.107268][ T5837] usb 7-1: Invalid ep0 maxpacket: 64 [ 1335.187284][ T24] usb 3-1: Using ep0 maxpacket: 16 [ 1335.260151][ T24] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1335.345377][ T24] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1335.355654][ T24] usb 3-1: New USB device found, idVendor=05ac, idProduct=024b, bcdDevice= 0.00 [ 1335.369735][ T5837] usb usb7-port1: attempt power cycle [ 1335.386079][ T24] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1335.398643][ T24] usb 3-1: config 0 descriptor?? [ 1335.421683][T14574] udl 6-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffe0 [ 1335.790810][ T5837] usb 7-1: new low-speed USB device number 42 using dummy_hcd [ 1335.825790][ T5837] usb 7-1: Invalid ep0 maxpacket: 64 [ 1335.835825][T20755] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1335.885548][T20755] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1335.987999][ T5837] usb 7-1: new low-speed USB device number 43 using dummy_hcd [ 1336.020084][ T5837] usb 7-1: Invalid ep0 maxpacket: 64 [ 1336.025818][ T5837] usb usb7-port1: unable to enumerate USB device [ 1336.312618][T10304] usb 6-1: USB disconnect, device number 90 [ 1336.420071][ T24] usbhid 3-1:0.0: can't add hid device: -71 [ 1336.428067][ T24] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 1336.503086][ T24] usb 3-1: USB disconnect, device number 107 [ 1336.600653][T20767] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1336.615323][T20767] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1336.628339][T20767] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1336.636404][T20767] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1336.644322][T20767] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1336.867443][ T24] usb 3-1: new high-speed USB device number 108 using dummy_hcd [ 1336.990042][T20774] chnl_net:caif_netlink_parms(): no params data found [ 1337.017863][ T24] usb 3-1: Using ep0 maxpacket: 32 [ 1337.025049][ T24] usb 3-1: config 0 has no interfaces? [ 1337.033505][ T24] usb 3-1: New USB device found, idVendor=1915, idProduct=2235, bcdDevice=98.82 [ 1337.043175][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1337.051548][ T24] usb 3-1: Product: syz [ 1337.056218][ T24] usb 3-1: Manufacturer: syz [ 1337.061820][ T24] usb 3-1: SerialNumber: syz [ 1337.077387][ T24] usb 3-1: config 0 descriptor?? [ 1337.242494][T20774] bridge0: port 1(bridge_slave_0) entered blocking state [ 1337.249826][T20774] bridge0: port 1(bridge_slave_0) entered disabled state [ 1337.257002][T20774] bridge_slave_0: entered allmulticast mode [ 1337.278252][T20774] bridge_slave_0: entered promiscuous mode [ 1337.286516][T20766] fuse: Unknown parameter 'hash' [ 1337.299004][T20774] bridge0: port 2(bridge_slave_1) entered blocking state [ 1337.330921][T20774] bridge0: port 2(bridge_slave_1) entered disabled state [ 1337.372861][ T10] usb 3-1: USB disconnect, device number 108 [ 1337.385823][T20774] bridge_slave_1: entered allmulticast mode [ 1337.407315][ T24] usb 9-1: new high-speed USB device number 18 using dummy_hcd [ 1337.419156][T20774] bridge_slave_1: entered promiscuous mode [ 1337.489471][ T65] netdevsim netdevsim5 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1337.518442][ T65] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1337.566487][ T24] usb 9-1: New USB device found, idVendor=0813, idProduct=0001, bcdDevice=3a.08 [ 1337.598450][ T24] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1337.619982][ T24] usb 9-1: config 0 descriptor?? [ 1337.658139][ T24] gspca_main: cpia1-2.14.0 probing 0813:0001 [ 1337.746221][ T65] netdevsim netdevsim5 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1337.756928][ T65] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1337.785518][T20774] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1337.862664][ T65] netdevsim netdevsim5 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1337.887670][ T65] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1337.934541][T20810] netlink: 'syz.8.3842': attribute type 10 has an invalid length. [ 1337.982945][T20774] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1338.073018][T20810] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 1338.185758][ T65] netdevsim netdevsim5 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1338.210917][ T65] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1338.268064][T20806] netlink: 5128 bytes leftover after parsing attributes in process `syz.4.3847'. [ 1338.281894][T20806] netlink: 5128 bytes leftover after parsing attributes in process `syz.4.3847'. [ 1338.357876][T20788] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1338.383842][T20806] netlink: 332 bytes leftover after parsing attributes in process `syz.4.3847'. [ 1338.396871][T20774] team0: Port device team_slave_0 added [ 1338.408946][ T24] gspca_cpia1: usb_control_msg 03, error -71 [ 1338.419679][ T24] gspca_cpia1: usb_control_msg 01, error -71 [ 1338.437709][T20774] team0: Port device team_slave_1 added [ 1338.444225][ T24] cpia1 9-1:0.0: only firmware version 1 is supported (got: 0) [ 1338.493770][ T24] usb 9-1: USB disconnect, device number 18 [ 1338.560267][T20774] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1338.578600][T20774] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1338.637400][T20774] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1338.697501][T20767] Bluetooth: hci0: command tx timeout [ 1338.721278][T20774] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1338.741533][T20774] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1338.822458][T20774] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1339.120027][T20774] hsr_slave_0: entered promiscuous mode [ 1339.148447][T20774] hsr_slave_1: entered promiscuous mode [ 1339.160917][ T65] bridge_slave_1: left allmulticast mode [ 1339.190042][ T65] bridge_slave_1: left promiscuous mode [ 1339.212021][ T65] bridge0: port 2(bridge_slave_1) entered disabled state [ 1339.267555][ T5837] usb 7-1: new low-speed USB device number 44 using dummy_hcd [ 1339.276912][ T65] bridge_slave_0: left allmulticast mode [ 1339.297991][ T65] bridge_slave_0: left promiscuous mode [ 1339.304007][ T65] bridge0: port 1(bridge_slave_0) entered disabled state [ 1339.437344][ T5837] usb 7-1: Invalid ep0 maxpacket: 64 [ 1339.568909][ T5837] usb 7-1: new low-speed USB device number 45 using dummy_hcd [ 1339.721019][ T65] bond1 (unregistering): (slave geneve2): Releasing active interface [ 1339.737473][ T5837] usb 7-1: Invalid ep0 maxpacket: 64 [ 1339.744802][ T5837] usb usb7-port1: attempt power cycle [ 1339.827482][ T65] bond3 (unregistering): (slave bridge1): Releasing active interface [ 1339.926483][ T65] team0: Port device bond0 removed [ 1339.939533][ T65] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1339.955724][ T65] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1339.973447][ T65] bond0 (unregistering): Released all slaves [ 1339.987076][ T65] bond1 (unregistering): Released all slaves [ 1340.010013][ T65] bond2 (unregistering): Released all slaves [ 1340.034039][ T65] bond3 (unregistering): Released all slaves [ 1340.063730][ T65] bond4 (unregistering): Released all slaves [ 1340.087439][ T5837] usb 7-1: new low-speed USB device number 46 using dummy_hcd [ 1340.103185][ T65] bond5 (unregistering): Released all slaves [ 1340.130193][ T5837] usb 7-1: Invalid ep0 maxpacket: 64 [ 1340.147109][ T65] bond6 (unregistering): (slave bond7): Releasing backup interface [ 1340.168641][ T65] bond6 (unregistering): Released all slaves [ 1340.230471][ T65] bond7 (unregistering): Released all slaves [ 1340.288389][ T5837] usb 7-1: new low-speed USB device number 47 using dummy_hcd [ 1340.318409][ T5837] usb 7-1: Invalid ep0 maxpacket: 64 [ 1340.342314][ T5837] usb usb7-port1: unable to enumerate USB device [ 1340.349438][T20844] dummy0: Caught tx_queue_len zero misconfig [ 1340.506821][ T65] tipc: Left network mode [ 1340.777525][T20767] Bluetooth: hci0: command tx timeout [ 1341.028319][ T24] usb 9-1: new high-speed USB device number 19 using dummy_hcd [ 1341.199473][ T24] usb 9-1: Using ep0 maxpacket: 8 [ 1341.224565][ T24] usb 9-1: New USB device found, idVendor=0c45, idProduct=613a, bcdDevice=c4.6d [ 1341.246835][ T24] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1341.266082][ T24] usb 9-1: Product: syz [ 1341.274409][ T24] usb 9-1: Manufacturer: syz [ 1341.291008][ T24] usb 9-1: SerialNumber: syz [ 1341.306500][ T24] usb 9-1: config 0 descriptor?? [ 1341.364170][ T24] gspca_main: sonixj-2.14.0 probing 0c45:613a [ 1341.610180][ T65] hsr_slave_0: left promiscuous mode [ 1341.624167][ T65] hsr_slave_1: left promiscuous mode [ 1341.668907][ T65] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1341.676356][ T65] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1341.695323][ T65] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1341.703444][ T65] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1341.728935][ T65] veth1_macvtap: left promiscuous mode [ 1341.734859][ T65] veth0_macvtap: left promiscuous mode [ 1342.002899][ T65] team0 (unregistering): Port device team_slave_1 removed [ 1342.021897][ T65] team0 (unregistering): Port device team_slave_0 removed [ 1342.642877][T20774] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 1342.716665][T20774] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 1342.780766][T20774] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 1342.807433][T20774] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 1342.859598][T20767] Bluetooth: hci0: command tx timeout [ 1343.174884][T20912] syzkaller0: entered promiscuous mode [ 1343.218557][T20912] syzkaller0: entered allmulticast mode [ 1343.230243][ T24] gspca_sonixj: reg_r err -32 [ 1343.267392][ T24] sonixj 9-1:0.0: probe with driver sonixj failed with error -32 [ 1343.337932][T20912] FAULT_INJECTION: forcing a failure. [ 1343.337932][T20912] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1343.370137][ T65] IPVS: stop unused estimator thread 0... [ 1343.398821][T20774] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1343.428982][T20912] CPU: 0 UID: 0 PID: 20912 Comm: syz.2.3870 Tainted: G L syzkaller #0 PREEMPT(full) [ 1343.429022][T20912] Tainted: [L]=SOFTLOCKUP [ 1343.429031][T20912] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1343.429045][T20912] Call Trace: [ 1343.429055][T20912] [ 1343.429065][T20912] dump_stack_lvl+0xe8/0x150 [ 1343.429101][T20912] should_fail_ex+0x412/0x560 [ 1343.429132][T20912] _copy_from_user+0x2d/0xb0 [ 1343.429166][T20912] __copy_msghdr+0x3c5/0x5b0 [ 1343.429203][T20912] ___sys_sendmsg+0x213/0x360 [ 1343.429241][T20912] ? __pfx____sys_sendmsg+0x10/0x10 [ 1343.429308][T20912] ? __fget_files+0x2a/0x420 [ 1343.429339][T20912] ? __fget_files+0x3a0/0x420 [ 1343.429379][T20912] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1343.429414][T20912] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1343.429456][T20912] ? __pfx_ksys_write+0x10/0x10 [ 1343.429489][T20912] do_syscall_64+0x14d/0xf80 [ 1343.429519][T20912] ? trace_irq_disable+0x3b/0x150 [ 1343.429551][T20912] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1343.429573][T20912] ? clear_bhb_loop+0x40/0x90 [ 1343.429599][T20912] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1343.429621][T20912] RIP: 0033:0x7f82b3f9c629 [ 1343.429641][T20912] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1343.429661][T20912] RSP: 002b:00007f82b4e11028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1343.429683][T20912] RAX: ffffffffffffffda RBX: 00007f82b4215fa0 RCX: 00007f82b3f9c629 [ 1343.429700][T20912] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 1343.429713][T20912] RBP: 00007f82b4e11090 R08: 0000000000000000 R09: 0000000000000000 [ 1343.429728][T20912] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1343.429741][T20912] R13: 00007f82b4216038 R14: 00007f82b4215fa0 R15: 00007f82b433fa48 [ 1343.429773][T20912] [ 1343.755209][T20774] 8021q: adding VLAN 0 to HW filter on device team0 [ 1343.869644][ T80] bridge0: port 1(bridge_slave_0) entered blocking state [ 1343.876835][ T80] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1343.979248][ T80] bridge0: port 2(bridge_slave_1) entered blocking state [ 1343.986448][ T80] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1344.295803][ T5837] usb 9-1: USB disconnect, device number 19 [ 1344.320742][T20774] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1344.347262][T14574] usb 3-1: new high-speed USB device number 109 using dummy_hcd [ 1344.501504][T20774] veth0_vlan: entered promiscuous mode [ 1344.532296][T20774] veth1_vlan: entered promiscuous mode [ 1344.538349][T14574] usb 3-1: Using ep0 maxpacket: 8 [ 1344.554945][T14574] usb 3-1: unable to get BOS descriptor or descriptor too short [ 1344.588317][T14574] usb 3-1: config 7 has an invalid interface number: 67 but max is 0 [ 1344.608314][T14574] usb 3-1: config 7 has no interface number 0 [ 1344.661920][T14574] usb 3-1: string descriptor 0 read error: -22 [ 1344.673682][T14574] usb 3-1: New USB device found, idVendor=16c0, idProduct=05df, bcdDevice=6b.16 [ 1344.702592][T20774] veth0_macvtap: entered promiscuous mode [ 1344.712403][T14574] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1344.731646][T20774] veth1_macvtap: entered promiscuous mode [ 1344.800184][T20774] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1344.817675][ T5837] usb 9-1: new low-speed USB device number 20 using dummy_hcd [ 1344.851735][T20774] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1344.915420][ T65] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1344.940811][ T65] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1344.947413][T20767] Bluetooth: hci0: command tx timeout [ 1344.987814][T20938] IPv6: addrconf: prefix option has invalid lifetime [ 1345.001322][ T5837] usb 9-1: Invalid ep0 maxpacket: 64 [ 1345.024157][ T65] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1345.038929][ T10] usb 3-1: USB disconnect, device number 109 [ 1345.065665][ T65] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1345.134833][T20941] syzkaller0: entered promiscuous mode [ 1345.140576][ T5837] usb 9-1: new low-speed USB device number 21 using dummy_hcd [ 1345.149367][T20941] syzkaller0: entered allmulticast mode [ 1345.234958][ T65] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1345.258186][ T65] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1345.293590][ T1326] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1345.303456][ T1326] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1345.318319][ T5837] usb 9-1: Invalid ep0 maxpacket: 64 [ 1345.324906][ T5837] usb usb9-port1: attempt power cycle [ 1345.335485][T20949] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1345.356431][T20949] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1345.407347][T14574] usb 7-1: new high-speed USB device number 48 using dummy_hcd [ 1345.547596][T14574] usb 7-1: device descriptor read/64, error -71 [ 1345.628434][T20952] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3837'. [ 1345.677307][ T5837] usb 9-1: new low-speed USB device number 22 using dummy_hcd [ 1345.707933][ T5837] usb 9-1: Invalid ep0 maxpacket: 64 [ 1345.770840][T20955] syzkaller0: entered promiscuous mode [ 1345.779601][T20955] syzkaller0: entered allmulticast mode [ 1345.795856][T14574] usb 7-1: new high-speed USB device number 49 using dummy_hcd [ 1345.802413][T20955] FAULT_INJECTION: forcing a failure. [ 1345.802413][T20955] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1345.819065][T20955] CPU: 0 UID: 0 PID: 20955 Comm: syz.5.3880 Tainted: G L syzkaller #0 PREEMPT(full) [ 1345.819099][T20955] Tainted: [L]=SOFTLOCKUP [ 1345.819107][T20955] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1345.819122][T20955] Call Trace: [ 1345.819131][T20955] [ 1345.819140][T20955] dump_stack_lvl+0xe8/0x150 [ 1345.819177][T20955] should_fail_ex+0x412/0x560 [ 1345.819209][T20955] _copy_from_iter+0x1d3/0x1670 [ 1345.819238][T20955] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 1345.819264][T20955] ? process_measurement+0x195e/0x1c80 [ 1345.819298][T20955] ? process_measurement+0x311/0x1c80 [ 1345.819348][T20955] ? __pfx__copy_from_iter+0x10/0x10 [ 1345.819382][T20955] ? dev_get_by_index+0x22/0x2e0 [ 1345.819405][T20955] ? dev_get_by_index+0x22/0x2e0 [ 1345.819435][T20955] packet_sendmsg+0x30b2/0x50f0 [ 1345.819482][T20955] ? __pfx_aa_label_sk_perm+0x10/0x10 [ 1345.819513][T20955] ? __lock_acquire+0x6b5/0x2cf0 [ 1345.819569][T20955] ? aa_sk_perm+0x6d5/0x900 [ 1345.819592][T20955] ? __pfx_packet_sendmsg+0x10/0x10 [ 1345.819630][T20955] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 1345.819666][T20955] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1345.819693][T20955] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1345.819719][T20955] ? __pfx_packet_sendmsg+0x10/0x10 [ 1345.819757][T20955] ____sys_sendmsg+0xa68/0xad0 [ 1345.819802][T20955] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1345.819843][T20955] ? import_iovec+0x73/0xa0 [ 1345.819877][T20955] ___sys_sendmsg+0x2a5/0x360 [ 1345.819914][T20955] ? __pfx____sys_sendmsg+0x10/0x10 [ 1345.819975][T20955] ? __fget_files+0x2a/0x420 [ 1345.820000][T20955] ? __fget_files+0x3a0/0x420 [ 1345.820033][T20955] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1345.820062][T20955] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1345.820096][T20955] ? __pfx_ksys_write+0x10/0x10 [ 1345.820123][T20955] do_syscall_64+0x14d/0xf80 [ 1345.820150][T20955] ? trace_irq_disable+0x3b/0x150 [ 1345.820177][T20955] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1345.820195][T20955] ? clear_bhb_loop+0x40/0x90 [ 1345.820217][T20955] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1345.820235][T20955] RIP: 0033:0x7f05e679c629 [ 1345.820252][T20955] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1345.820268][T20955] RSP: 002b:00007f05e7688028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1345.820288][T20955] RAX: ffffffffffffffda RBX: 00007f05e6a15fa0 RCX: 00007f05e679c629 [ 1345.820301][T20955] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 1345.820313][T20955] RBP: 00007f05e7688090 R08: 0000000000000000 R09: 0000000000000000 [ 1345.820324][T20955] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1345.820335][T20955] R13: 00007f05e6a16038 R14: 00007f05e6a15fa0 R15: 00007f05e6b3fa48 [ 1345.820362][T20955] [ 1345.948131][T14574] usb 7-1: device descriptor read/64, error -71 [ 1345.986415][ T5837] usb 9-1: new low-speed USB device number 23 using dummy_hcd [ 1345.996657][T20957] netlink: 136 bytes leftover after parsing attributes in process `syz.2.3879'. [ 1346.029246][ T5837] usb 9-1: Invalid ep0 maxpacket: 64 [ 1346.142220][ T5837] usb usb9-port1: unable to enumerate USB device [ 1346.148274][T14574] usb usb7-port1: attempt power cycle [ 1346.497842][T14574] usb 7-1: new high-speed USB device number 50 using dummy_hcd [ 1346.518276][T14574] usb 7-1: device descriptor read/8, error -71 [ 1346.757859][T14574] usb 7-1: new high-speed USB device number 51 using dummy_hcd [ 1346.779550][T14574] usb 7-1: device descriptor read/8, error -71 [ 1346.887577][T14574] usb usb7-port1: unable to enumerate USB device [ 1347.199638][T20975] kvm: vcpu 2: requested lapic timer restore with starting count register 0x390=198462431 (396924862 ns) > initial count (200000 ns). Using initial count to start timer. [ 1347.253491][T20976] kvm: vcpu 2: requested lapic timer restore with starting count register 0x390=198462431 (396924862 ns) > initial count (200000 ns). Using initial count to start timer. [ 1347.713806][T20984] netlink: 32 bytes leftover after parsing attributes in process `syz.5.3886'. [ 1347.926845][T20987] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3886'. [ 1348.246890][T20990] netlink: 148 bytes leftover after parsing attributes in process `syz.6.3889'. [ 1348.290364][T20990] A link change request failed with some changes committed already. Interface gre0 may have been left with an inconsistent configuration, please check. [ 1348.357269][ T5837] usb 6-1: new high-speed USB device number 91 using dummy_hcd [ 1348.507699][ T5837] usb 6-1: device descriptor read/64, error -71 [ 1348.689421][T21000] netlink: 36 bytes leftover after parsing attributes in process `syz.6.3892'. [ 1348.807903][T21004] syzkaller0: entered promiscuous mode [ 1348.813520][T21004] syzkaller0: entered allmulticast mode [ 1348.827308][ T5837] usb 6-1: new high-speed USB device number 92 using dummy_hcd [ 1348.907071][ T29] audit: type=1326 audit(1772113731.543:5618): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21006 comm="syz.6.3895" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fc18c79c629 code=0x0 [ 1348.998175][T21010] loop8: detected capacity change from 0 to 16384 [ 1349.010448][T21011] netlink: 104 bytes leftover after parsing attributes in process `syz.6.3895'. [ 1349.027632][ T5837] usb 6-1: device descriptor read/64, error -71 [ 1349.160684][ T5837] usb usb6-port1: attempt power cycle [ 1349.283142][T21012] loop8: detected capacity change from 16384 to 0 [ 1349.303783][ C0] I/O error, dev loop8, sector 4744 op 0x0:(READ) flags 0x80700 phys_seg 9 prio class 2 [ 1349.528005][ T5837] usb 6-1: new high-speed USB device number 93 using dummy_hcd [ 1349.569178][ T5837] usb 6-1: device descriptor read/8, error -71 [ 1349.827353][ T5837] usb 6-1: new high-speed USB device number 94 using dummy_hcd [ 1349.926161][ T5837] usb 6-1: device descriptor read/8, error -71 [ 1350.048369][ T5837] usb usb6-port1: unable to enumerate USB device [ 1351.475698][T19764] dvb-usb: did not find the firmware file 'dvb-usb-az6027-03.fw' (status -110). You can use /scripts/get_dvb_firmware to get the firmware [ 1351.498677][T19764] dvb_usb_az6027 5-1:0.0: probe with driver dvb_usb_az6027 failed with error -110 [ 1351.518227][T19764] usb 5-1: USB disconnect, device number 34 [ 1351.920494][T19764] usb 5-1: new low-speed USB device number 35 using dummy_hcd [ 1352.149002][T19764] usb 5-1: Invalid ep0 maxpacket: 64 [ 1352.427420][ T5837] usb 7-1: new high-speed USB device number 52 using dummy_hcd [ 1352.617840][ T5837] usb 7-1: Using ep0 maxpacket: 8 [ 1352.628212][ T5837] usb 7-1: config 0 has an invalid interface number: 55 but max is 0 [ 1352.642925][ T5837] usb 7-1: config 0 has no interface number 0 [ 1352.667265][ T5837] usb 7-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1352.689992][ T5837] usb 7-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 1352.727208][ T5837] usb 7-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1352.745103][ T5837] usb 7-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 1352.765856][ T5837] usb 7-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 1352.776148][ T5837] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1352.799200][ T5837] usb 7-1: config 0 descriptor?? [ 1352.831577][ T5837] ldusb 7-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 1353.153021][ T5837] usb 7-1: USB disconnect, device number 52 [ 1353.159205][ C0] ldusb 7-1:0.55: usb_submit_urb failed (-19) [ 1353.171754][T21047] lo: Caught tx_queue_len zero misconfig [ 1353.188912][ T5837] ldusb 7-1:0.55: LD USB Device #0 now disconnected [ 1353.367886][T19764] usb 5-1: new high-speed USB device number 37 using dummy_hcd [ 1353.557301][T19764] usb 5-1: Using ep0 maxpacket: 8 [ 1353.612588][T21056] syzkaller0: entered promiscuous mode [ 1353.618379][T21056] syzkaller0: entered allmulticast mode [ 1353.644402][T19764] usb 5-1: config index 0 descriptor too short (expected 28277, got 36) [ 1353.671366][T19764] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1353.693293][T21057] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3907'. [ 1353.712994][T19764] usb 5-1: config 0 has no interfaces? [ 1353.722732][T19764] usb 5-1: New USB device found, idVendor=046d, idProduct=c20e, bcdDevice= 0.00 [ 1353.755986][T19764] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1353.818138][T19764] usb 5-1: config 0 descriptor?? [ 1354.214923][T21030] syz.5.3900 (21030): drop_caches: 2 [ 1354.317114][T21029] syz.5.3900 (21029): drop_caches: 2 [ 1354.365819][ T24] usb 5-1: USB disconnect, device number 37 [ 1354.917311][ T5837] usb 9-1: new high-speed USB device number 24 using dummy_hcd [ 1355.257349][ T5837] usb 9-1: Using ep0 maxpacket: 32 [ 1355.280803][T21076] netlink: 148 bytes leftover after parsing attributes in process `syz.6.3914'. [ 1355.290896][T21076] A link change request failed with some changes committed already. Interface gre0 may have been left with an inconsistent configuration, please check. [ 1355.329060][ T5837] usb 9-1: New USB device found, idVendor=055f, idProduct=d001, bcdDevice=88.92 [ 1355.357633][ T5837] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1355.399878][ T5837] gspca_main: nw80x-2.14.0 probing 055f:d001 [ 1355.437252][ T24] usb 3-1: new low-speed USB device number 110 using dummy_hcd [ 1355.598515][ T24] usb 3-1: Invalid ep0 maxpacket: 64 [ 1355.753731][ T24] usb 3-1: new low-speed USB device number 111 using dummy_hcd [ 1355.773318][T21082] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3916'. [ 1355.935195][ T24] usb 3-1: Invalid ep0 maxpacket: 64 [ 1355.957568][ T24] usb usb3-port1: attempt power cycle [ 1356.116275][ T5837] gspca_nw80x: reg_r err -110 [ 1356.121452][ T5837] nw80x 9-1:3.0: probe with driver nw80x failed with error -110 [ 1356.127919][ T29] audit: type=1326 audit(1772113738.753:5619): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21077 comm="syz.6.3915" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fc18c79c629 code=0x0 [ 1356.367503][ T24] usb 3-1: new low-speed USB device number 112 using dummy_hcd [ 1356.407454][ T24] usb 3-1: Invalid ep0 maxpacket: 64 [ 1356.417282][T19764] usb 6-1: new high-speed USB device number 95 using dummy_hcd [ 1356.493484][T21068] xt_AUDIT: Audit type out of range (valid range: 0..2) [ 1356.539986][ T24] usb 3-1: new low-speed USB device number 113 using dummy_hcd [ 1356.588025][ T24] usb 3-1: Invalid ep0 maxpacket: 64 [ 1356.596522][T21093] netlink: 'syz.4.3919': attribute type 6 has an invalid length. [ 1356.598421][ T24] usb usb3-port1: unable to enumerate USB device [ 1356.604896][T19764] usb 6-1: Using ep0 maxpacket: 8 [ 1356.622089][T19764] usb 6-1: unable to get BOS descriptor or descriptor too short [ 1356.640686][T19764] usb 6-1: config 8 has an invalid interface number: 137 but max is 0 [ 1356.652597][T19764] usb 6-1: config 8 has no interface number 0 [ 1356.659934][T19764] usb 6-1: config 8 interface 137 altsetting 5 bulk endpoint 0xF has invalid maxpacket 84 [ 1356.716005][T19764] usb 6-1: config 8 interface 137 has no altsetting 0 [ 1356.730643][T19764] usb 6-1: New USB device found, idVendor=0c4b, idProduct=0100, bcdDevice=e5.0d [ 1356.747306][T19764] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1356.755342][T19764] usb 6-1: Product: syz [ 1356.764501][T19764] usb 6-1: Manufacturer: syz [ 1356.772843][T19764] usb 6-1: SerialNumber: syz [ 1356.798873][T21091] raw-gadget.2 gadget.5: fail, usb_ep_enable returned -22 [ 1356.815492][T21101] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 1356.875235][T21103] netlink: 'syz.6.3920': attribute type 10 has an invalid length. [ 1356.913382][ T24] usb 9-1: USB disconnect, device number 24 [ 1357.011197][T21091] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3918'. [ 1357.051477][T19764] cyberjack 6-1:8.137: Reiner SCT Cyberjack USB card reader converter detected [ 1357.090234][T19764] cyberjack ttyUSB0: usb_submit_urb(read int) failed [ 1357.106637][T19764] usb 6-1: Reiner SCT Cyberjack USB card reader converter now attached to ttyUSB0 [ 1357.130266][T19764] usb 6-1: USB disconnect, device number 95 [ 1357.150809][T19764] cyberjack ttyUSB0: Reiner SCT Cyberjack USB card reader converter now disconnected from ttyUSB0 [ 1357.163966][T19764] cyberjack 6-1:8.137: device disconnected [ 1357.367471][ T24] usb 9-1: new low-speed USB device number 25 using dummy_hcd [ 1357.540351][ T24] usb 9-1: config 0 has an invalid interface number: 1 but max is 0 [ 1357.557845][ T24] usb 9-1: config 0 has no interface number 0 [ 1357.567969][ T24] usb 9-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 1357.599056][ T24] usb 9-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 1357.617313][ T796] usb 5-1: new high-speed USB device number 38 using dummy_hcd [ 1357.631156][ T24] usb 9-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 1357.677950][ T24] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1357.713937][ T24] usb 9-1: config 0 descriptor?? [ 1357.732120][T21105] raw-gadget.0 gadget.8: fail, usb_ep_enable returned -22 [ 1357.759868][ T24] iowarrior 9-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 1357.779907][T21118] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3927'. [ 1357.822588][ T796] usb 5-1: Using ep0 maxpacket: 16 [ 1357.829839][ T796] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1357.859373][ T796] usb 5-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 1357.879966][ T796] usb 5-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice= 7.c9 [ 1357.907254][ T796] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1357.925501][ T796] usb 5-1: Product: syz [ 1357.932633][ T796] usb 5-1: Manufacturer: syz [ 1357.947280][ T796] usb 5-1: SerialNumber: syz [ 1358.030850][T19764] usb 9-1: USB disconnect, device number 25 [ 1358.030939][ C1] iowarrior 9-1:0.1: iowarrior_callback - usb_submit_urb failed with result -19 [ 1358.170873][T20767] Bluetooth: hci4: unexpected event for opcode 0x0c03 [ 1358.532429][ T796] usb 3-1: new high-speed USB device number 114 using dummy_hcd [ 1358.687325][ T796] usb 3-1: Using ep0 maxpacket: 8 [ 1358.698855][ T796] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 1358.706910][ T796] usb 3-1: config 0 has no interface number 0 [ 1358.713134][ T796] usb 3-1: config 0 interface 1 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1358.807272][ T796] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 1358.928792][T21143] Invalid argument reading file caps for ./file0 [ 1359.026774][ T796] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1359.046344][ T796] usb 3-1: New USB device found, idVendor=0af0, idProduct=6751, bcdDevice=75.cb [ 1359.084832][ T796] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1359.111477][ T796] usb 3-1: config 0 descriptor?? [ 1359.134371][ T796] hso 3-1:0.1: Failed to find BULK IN ep [ 1359.269664][T10305] usb 7-1: new high-speed USB device number 53 using dummy_hcd [ 1359.333703][T19764] usb 3-1: USB disconnect, device number 114 [ 1359.437585][T10305] usb 7-1: Using ep0 maxpacket: 8 [ 1359.445377][T10305] usb 7-1: unable to get BOS descriptor or descriptor too short [ 1359.454965][T10305] usb 7-1: config 4 interface 0 has no altsetting 0 [ 1359.476293][T10305] usb 7-1: string descriptor 0 read error: -22 [ 1359.484062][T10305] usb 7-1: New USB device found, idVendor=058f, idProduct=6610, bcdDevice=48.05 [ 1359.499795][T10305] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1359.572195][T10305] usb 7-1: dvb_usb_v2: found a 'Sigmatek DVB-110' in warm state [ 1359.602580][T10305] usb 7-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 1359.630101][T10305] dvbdev: DVB: registering new adapter (Sigmatek DVB-110) [ 1359.649646][T10305] usb 7-1: media controller created [ 1359.675449][T10305] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1359.771830][T10305] zl10353_read_register: readreg error (reg=127, ret==0) [ 1359.779494][T19764] usb 9-1: new high-speed USB device number 26 using dummy_hcd [ 1359.884308][T10305] usb 7-1: USB disconnect, device number 53 [ 1359.947310][T19764] usb 9-1: Using ep0 maxpacket: 8 [ 1359.955962][T19764] usb 9-1: config index 0 descriptor too short (expected 301, got 45) [ 1359.964677][T19764] usb 9-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1360.060585][T19764] usb 9-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1360.094929][T19764] usb 9-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1360.239244][T19764] usb 9-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1360.253294][T19764] usb 9-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1360.272405][T19764] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1360.427281][ T796] usb 3-1: new full-speed USB device number 115 using dummy_hcd [ 1360.524599][T19764] usb 9-1: usb_control_msg returned -32 [ 1360.530351][T19764] usbtmc 9-1:16.0: can't read capabilities [ 1360.687522][ T24] usb 7-1: new high-speed USB device number 54 using dummy_hcd [ 1360.730746][ T796] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x5 has an invalid bInterval 0, changing to 10 [ 1360.746879][T14574] usb 5-1: USB disconnect, device number 38 [ 1360.816315][ T796] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1360.857519][ T24] usb 7-1: Using ep0 maxpacket: 16 [ 1360.873045][ T24] usb 7-1: config 132 has an invalid interface number: 4 but max is 0 [ 1360.886090][ T24] usb 7-1: config 132 has no interface number 0 [ 1360.922834][ T24] usb 7-1: config 132 interface 4 altsetting 0 bulk endpoint 0xC has invalid maxpacket 1023 [ 1360.935719][ T796] usb 3-1: New USB device found, idVendor=133e, idProduct=0815, bcdDevice=7e.66 [ 1360.979900][ T24] usb 7-1: config 132 interface 4 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 431 [ 1360.993723][ T796] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1361.001838][ T796] usb 3-1: Product: syz [ 1361.006034][ T796] usb 3-1: Manufacturer: syz [ 1361.010746][ T24] usb 7-1: config 132 interface 4 altsetting 0 endpoint 0xF has an invalid bInterval 241, changing to 11 [ 1361.025925][ T796] usb 3-1: SerialNumber: syz [ 1361.049504][ T24] usb 7-1: New USB device found, idVendor=34ef, idProduct=202b, bcdDevice=36.09 [ 1361.061364][ T796] usb 3-1: config 0 descriptor?? [ 1361.076641][ T24] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1361.089264][ T796] snd-usb-audio 3-1:0.0: probe with driver snd-usb-audio failed with error -90 [ 1361.102723][ T24] usb 7-1: Product: syz [ 1361.106934][ T24] usb 7-1: Manufacturer: syz [ 1361.118760][T10305] usb 9-1: USB disconnect, device number 26 [ 1361.165554][ T24] usb 7-1: SerialNumber: syz [ 1361.209693][T21160] raw-gadget.3 gadget.6: fail, usb_ep_enable returned -22 [ 1361.237714][T21160] raw-gadget.3 gadget.6: fail, usb_ep_enable returned -22 [ 1361.468024][T21160] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1361.483700][T21160] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1361.653571][ T24] usb 7-1: USB disconnect, device number 54 [ 1361.663567][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 1361.672971][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 1361.936073][ T29] audit: type=1326 audit(1772113744.573:5620): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21177 comm="syz.8.3943" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f2d9019c629 code=0x0 [ 1362.097372][ T24] usb 7-1: new full-speed USB device number 55 using dummy_hcd [ 1362.455630][ T24] usb 7-1: unable to get BOS descriptor or descriptor too short [ 1362.465822][ T24] usb 7-1: not running at top speed; connect to a high speed hub [ 1362.475383][ T24] usb 7-1: config 6 has an invalid interface number: 30 but max is 0 [ 1362.484418][ T24] usb 7-1: config 6 has no interface number 0 [ 1362.500844][ T24] usb 7-1: config 6 interface 30 altsetting 0 has an endpoint descriptor with address 0x47, changing to 0x7 [ 1362.526469][ T24] usb 7-1: config 6 interface 30 altsetting 0 endpoint 0x7 has invalid maxpacket 40968, setting to 64 [ 1362.554603][ T24] usb 7-1: config 6 interface 30 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 1362.605260][ T24] usb 7-1: New USB device found, idVendor=fff0, idProduct=fff0, bcdDevice=1e.11 [ 1362.614902][ T24] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1362.623622][ T24] usb 7-1: Product: syz [ 1362.638222][ T24] usb 7-1: Manufacturer: syz [ 1362.657266][ T24] usb 7-1: SerialNumber: syz [ 1362.674908][T21171] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 1362.888073][T21171] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3941'. [ 1362.967391][T21183] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1362.977307][T21184] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1362.986609][T21183] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1363.023354][T21171] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3941'. [ 1363.041412][T21184] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1363.199278][T21187] program syz.6.3944 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1364.077430][ T10] usb 9-1: new full-speed USB device number 27 using dummy_hcd [ 1364.099558][T21204] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1364.110448][T21204] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1364.248703][ T10] usb 9-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 1364.274448][ T10] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1364.288298][ T10] usb 9-1: Product: syz [ 1364.292518][ T10] usb 9-1: Manufacturer: syz [ 1364.297785][ T10] usb 9-1: SerialNumber: syz [ 1364.317025][ T10] usb 9-1: config 0 descriptor?? [ 1364.525502][ T10] usb 9-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 1364.581968][T21158] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3938'. [ 1364.791695][ T29] audit: type=1326 audit(1772113747.433:5621): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21214 comm="syz.5.3954" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f05e679c629 code=0x0 [ 1364.801611][T10305] usb 3-1: USB disconnect, device number 115 [ 1364.904159][T21218] netlink: 104 bytes leftover after parsing attributes in process `syz.5.3954'. [ 1364.932490][T21217] ip6t_REJECT: ECHOREPLY is not supported [ 1365.142022][T21223] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1365.151549][T21223] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1366.960081][T21239] xt_ecn: cannot match TCP bits for non-tcp packets [ 1367.260221][ T10] dvb_usb_rtl28xxu 9-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 1367.278784][ T10] usb 9-1: USB disconnect, device number 27 [ 1367.417456][ T796] usb 3-1: new high-speed USB device number 116 using dummy_hcd [ 1367.580753][ T796] usb 3-1: config 0 has an invalid interface number: 20 but max is 0 [ 1367.609001][ T796] usb 3-1: config 0 has no interface number 0 [ 1367.615248][ T796] usb 3-1: config 0 interface 20 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1367.671154][ T796] usb 3-1: config 0 interface 20 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1367.700606][ T796] usb 3-1: config 0 interface 20 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1367.739121][ T796] usb 3-1: New USB device found, idVendor=28bd, idProduct=0935, bcdDevice= 0.00 [ 1367.754528][ T796] usb 3-1: New USB device strings: Mfr=51, Product=0, SerialNumber=0 [ 1367.769626][ T24] usbtest 7-1:6.30: usb test device [ 1367.778941][ T24] usbtest 7-1:6.30: full-speed {control in/out iso-out} tests (+alt) [ 1367.794459][ T796] usb 3-1: Manufacturer: syz [ 1367.815892][ T796] usb 3-1: config 0 descriptor?? [ 1368.158645][ T5837] usb 5-1: new high-speed USB device number 39 using dummy_hcd [ 1368.376574][ T5837] usb 5-1: Using ep0 maxpacket: 16 [ 1368.389202][ T5837] usb 5-1: config 0 has an invalid interface number: 251 but max is 0 [ 1368.404715][T21257] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3961'. [ 1368.478142][ T5837] usb 5-1: config 0 has no interface number 0 [ 1368.484555][ T5837] usb 5-1: config 0 interface 251 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 16 [ 1368.503096][T21262] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1368.539063][ T5837] usb 5-1: config 0 interface 251 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64 [ 1368.579424][T21262] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1368.600573][ T5837] usb 5-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 1368.651480][ T5837] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1368.662794][ T796] uclogic 0003:28BD:0935.003D: interface is invalid, ignoring [ 1368.670307][ T5837] usb 5-1: Product: syz [ 1368.690771][ T5837] usb 5-1: Manufacturer: syz [ 1368.711197][ T5837] usb 5-1: SerialNumber: syz [ 1368.718019][ T29] audit: type=1326 audit(1772113751.343:5622): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21263 comm="syz.6.3970" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fc18c79c629 code=0x0 [ 1368.766475][ T5837] usb 5-1: config 0 descriptor?? [ 1368.804202][T21254] raw-gadget.4 gadget.4: fail, usb_ep_enable returned -22 [ 1368.826643][T21254] raw-gadget.4 gadget.4: fail, usb_ep_enable returned -22 [ 1368.852646][T21268] netlink: 104 bytes leftover after parsing attributes in process `syz.6.3970'. [ 1369.172907][T21272] netlink: 'syz.5.3972': attribute type 1 has an invalid length. [ 1369.258199][T21274] raw-gadget.4 gadget.4: fail, usb_ep_enable returned -22 [ 1369.265582][T21274] raw-gadget.4 gadget.4: fail, usb_ep_enable returned -22 [ 1369.855594][T21281] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 1369.869237][T21281] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 1369.989281][ T29] audit: type=1326 audit(1772113752.623:5623): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21238 comm="syz.2.3961" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f82b3f9c629 code=0x7fc00000 [ 1370.072746][ T796] usb 3-1: USB disconnect, device number 116 [ 1370.221978][T21288] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1370.260126][T21288] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1370.401810][T21288] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1370.424408][T21288] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1370.668673][T21296] Cannot find del_set index 2 as target [ 1370.827926][T21297] IPv6: addrconf: prefix option has invalid lifetime [ 1370.879436][T21299] [ 1370.881803][T21299] ===================================================== [ 1370.888747][T21299] WARNING: SOFTIRQ-safe -> SOFTIRQ-unsafe lock order detected [ 1370.896237][T21299] syzkaller #0 Tainted: G L [ 1370.902244][T21299] ----------------------------------------------------- [ 1370.909194][T21299] syz.8.3981/21299 [HC0[0]:SC0[0]:HE0:SE1] is trying to acquire: [ 1370.916940][T21299] ffff888030de5be8 (&new->fa_lock){....}-{3:3}, at: kill_fasync+0x199/0x4d0 [ 1370.925670][T21299] [ 1370.925670][T21299] and this task is already holding: [ 1370.933043][T21299] ffff88804477e468 (&tty->flow.lock){....}-{3:3}, at: n_tty_ioctl_helper+0xe0/0x4d0 [ 1370.942459][T21299] which would create a new lock dependency: [ 1370.948360][T21299] (&tty->flow.lock){....}-{3:3} -> (&new->fa_lock){....}-{3:3} [ 1370.956056][T21299] [ 1370.956056][T21299] but this new dependency connects a SOFTIRQ-irq-safe lock: [ 1370.965546][T21299] (kbd_event_lock){..-.}-{3:3} [ 1370.965575][T21299] [ 1370.965575][T21299] ... which became SOFTIRQ-irq-safe at: [ 1370.978150][T21299] lock_acquire+0xf0/0x2e0 [ 1370.982680][T21299] _raw_spin_lock+0x2e/0x40 [ 1370.987287][T21299] kbd_event+0xd6/0x40d0 [ 1370.991633][T21299] input_handle_events_default+0xd4/0x1a0 [ 1370.997460][T21299] input_pass_values+0x288/0x890 [ 1371.002567][T21299] input_event_dispose+0x3e5/0x6b0 [ 1371.007789][T21299] input_event+0x89/0xe0 [ 1371.012136][T21299] hidinput_hid_event+0x142d/0x1e60 [ 1371.017442][T21299] hid_process_event+0x4be/0x620 [ 1371.022477][T21299] hid_report_raw_event+0xe8f/0x1720 [ 1371.027851][T21299] hid_input_report+0x44b/0x580 [ 1371.032792][T21299] hid_irq_in+0x47e/0x6d0 [ 1371.037245][T21299] __usb_hcd_giveback_urb+0x376/0x540 [ 1371.042712][T21299] dummy_timer+0xbbd/0x45d0 [ 1371.047323][T21299] __hrtimer_run_queues+0x53a/0xcc0 [ 1371.052647][T21299] hrtimer_run_softirq+0x182/0x5a0 [ 1371.057869][T21299] handle_softirqs+0x22a/0x870 [ 1371.062746][T21299] __irq_exit_rcu+0x5f/0x150 [ 1371.067441][T21299] irq_exit_rcu+0x9/0x30 [ 1371.071784][T21299] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 1371.077538][T21299] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1371.083627][T21299] __sanitizer_cov_trace_const_cmp8+0x10/0x90 [ 1371.089803][T21299] __virt_addr_valid+0xd2/0x5b0 [ 1371.094760][T21299] kasan_addr_to_slab+0xf/0x60 [ 1371.099623][T21299] kasan_record_aux_stack+0xf/0xd0 [ 1371.104871][T21299] call_rcu+0xee/0x890 [ 1371.109056][T21299] __slab_free+0x263/0x2b0 [ 1371.113572][T21299] qlist_free_all+0x97/0x100 [ 1371.118279][T21299] kasan_quarantine_reduce+0x148/0x160 [ 1371.123837][T21299] __kasan_slab_alloc+0x22/0x80 [ 1371.128784][T21299] __kvmalloc_node_noprof+0x4d7/0x8a0 [ 1371.134259][T21299] seq_read_iter+0x202/0xe10 [ 1371.138946][T21299] vfs_read+0x582/0xa70 [ 1371.143291][T21299] ksys_read+0x150/0x270 [ 1371.147638][T21299] do_syscall_64+0x14d/0xf80 [ 1371.152343][T21299] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1371.158362][T21299] [ 1371.158362][T21299] to a SOFTIRQ-irq-unsafe lock: [ 1371.165393][T21299] (tasklist_lock){.+.+}-{3:3} [ 1371.165423][T21299] [ 1371.165423][T21299] ... which became SOFTIRQ-irq-unsafe at: [ 1371.178101][T21299] ... [ 1371.178110][T21299] lock_acquire+0xf0/0x2e0 [ 1371.185222][T21299] _raw_read_lock+0x36/0x50 [ 1371.189840][T21299] __do_wait+0xde/0x740 [ 1371.194099][T21299] do_wait+0x1e7/0x540 [ 1371.198292][T21299] kernel_wait+0xd6/0x1c0 [ 1371.202726][T21299] call_usermodehelper_exec_work+0xbe/0x230 [ 1371.208730][T21299] process_scheduled_works+0xb02/0x1830 [ 1371.214380][T21299] worker_thread+0xa50/0xfc0 [ 1371.219090][T21299] kthread+0x388/0x470 [ 1371.223287][T21299] ret_from_fork+0x51e/0xb90 [ 1371.227983][T21299] ret_from_fork_asm+0x1a/0x30 [ 1371.232863][T21299] [ 1371.232863][T21299] other info that might help us debug this: [ 1371.232863][T21299] [ 1371.243106][T21299] Chain exists of: [ 1371.243106][T21299] kbd_event_lock --> &tty->flow.lock --> tasklist_lock [ 1371.243106][T21299] [ 1371.255904][T21299] Possible interrupt unsafe locking scenario: [ 1371.255904][T21299] [ 1371.264229][T21299] CPU0 CPU1 [ 1371.269602][T21299] ---- ---- [ 1371.274978][T21299] lock(tasklist_lock); [ 1371.279230][T21299] local_irq_disable(); [ 1371.286001][T21299] lock(kbd_event_lock); [ 1371.292889][T21299] lock(&tty->flow.lock); [ 1371.299837][T21299] [ 1371.303300][T21299] lock(kbd_event_lock); [ 1371.307813][T21299] [ 1371.307813][T21299] *** DEADLOCK *** [ 1371.307813][T21299] [ 1371.315970][T21299] 4 locks held by syz.8.3981/21299: [ 1371.321177][T21299] #0: ffff88804477e0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 1371.330958][T21299] #1: ffff88804477e468 (&tty->flow.lock){....}-{3:3}, at: n_tty_ioctl_helper+0xe0/0x4d0 [ 1371.340894][T21299] #2: ffff88804477e0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref+0x1c/0x90 [ 1371.350244][T21299] #3: ffffffff8e7602e0 (rcu_read_lock){....}-{1:3}, at: kill_fasync+0x53/0x4d0 [ 1371.359325][T21299] [ 1371.359325][T21299] the dependencies between SOFTIRQ-irq-safe lock and the holding lock: [ 1371.369736][T21299] -> (kbd_event_lock){..-.}-{3:3} { [ 1371.375050][T21299] IN-SOFTIRQ-W at: [ 1371.379125][T21299] lock_acquire+0xf0/0x2e0 [ 1371.385395][T21299] _raw_spin_lock+0x2e/0x40 [ 1371.391740][T21299] kbd_event+0xd6/0x40d0 [ 1371.397828][T21299] input_handle_events_default+0xd4/0x1a0 [ 1371.405387][T21299] input_pass_values+0x288/0x890 [ 1371.412169][T21299] input_event_dispose+0x3e5/0x6b0 [ 1371.419132][T21299] input_event+0x89/0xe0 [ 1371.425225][T21299] hidinput_hid_event+0x142d/0x1e60 [ 1371.432361][T21299] hid_process_event+0x4be/0x620 [ 1371.439139][T21299] hid_report_raw_event+0xe8f/0x1720 [ 1371.446267][T21299] hid_input_report+0x44b/0x580 [ 1371.452955][T21299] hid_irq_in+0x47e/0x6d0 [ 1371.459142][T21299] __usb_hcd_giveback_urb+0x376/0x540 [ 1371.466356][T21299] dummy_timer+0xbbd/0x45d0 [ 1371.472707][T21299] __hrtimer_run_queues+0x53a/0xcc0 [ 1371.479749][T21299] hrtimer_run_softirq+0x182/0x5a0 [ 1371.486709][T21299] handle_softirqs+0x22a/0x870 [ 1371.493313][T21299] __irq_exit_rcu+0x5f/0x150 [ 1371.499741][T21299] irq_exit_rcu+0x9/0x30 [ 1371.505829][T21299] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 1371.513317][T21299] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1371.521146][T21299] __sanitizer_cov_trace_const_cmp8+0x10/0x90 [ 1371.529062][T21299] __virt_addr_valid+0xd2/0x5b0 [ 1371.535749][T21299] kasan_addr_to_slab+0xf/0x60 [ 1371.542357][T21299] kasan_record_aux_stack+0xf/0xd0 [ 1371.549483][T21299] call_rcu+0xee/0x890 [ 1371.555400][T21299] __slab_free+0x263/0x2b0 [ 1371.561648][T21299] qlist_free_all+0x97/0x100 [ 1371.568077][T21299] kasan_quarantine_reduce+0x148/0x160 [ 1371.575390][T21299] __kasan_slab_alloc+0x22/0x80 [ 1371.582075][T21299] __kvmalloc_node_noprof+0x4d7/0x8a0 [ 1371.589296][T21299] seq_read_iter+0x202/0xe10 [ 1371.595735][T21299] vfs_read+0x582/0xa70 [ 1371.601723][T21299] ksys_read+0x150/0x270 [ 1371.607799][T21299] do_syscall_64+0x14d/0xf80 [ 1371.614231][T21299] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1371.621971][T21299] INITIAL USE at: [ 1371.626072][T21299] lock_acquire+0xf0/0x2e0 [ 1371.632253][T21299] _raw_spin_lock_irqsave+0x40/0x60 [ 1371.639206][T21299] vt_reset_unicode+0x2b/0x1a0 [ 1371.645748][T21299] reset_vc+0x68/0x1b0 [ 1371.651565][T21299] vc_init+0x70/0x4a0 [ 1371.657297][T21299] con_init+0x377/0x6a0 [ 1371.663213][T21299] console_init+0x10b/0x4d0 [ 1371.669474][T21299] start_kernel+0x22b/0x3d0 [ 1371.675732][T21299] x86_64_start_reservations+0x24/0x30 [ 1371.682962][T21299] x86_64_start_kernel+0x143/0x1c0 [ 1371.689833][T21299] common_startup_64+0x13e/0x147 [ 1371.696519][T21299] } [ 1371.699121][T21299] ... key at: [] kbd_event_lock+0x18/0xa0 [ 1371.707033][T21299] -> (&tty->flow.lock){....}-{3:3} { [ 1371.712358][T21299] INITIAL USE at: [ 1371.716267][T21299] lock_acquire+0xf0/0x2e0 [ 1371.722272][T21299] _raw_spin_lock_irqsave+0x40/0x60 [ 1371.729062][T21299] start_tty+0x20/0x70 [ 1371.734758][T21299] n_tty_set_termios+0xa7c/0x10c0 [ 1371.741354][T21299] tty_set_termios+0xdb3/0x1800 [ 1371.747793][T21299] set_termios+0x566/0x710 [ 1371.753820][T21299] tty_mode_ioctl+0x4a6/0x7d0 [ 1371.760082][T21299] tty_ioctl+0x9c5/0xde0 [ 1371.765904][T21299] __se_sys_ioctl+0xfc/0x170 [ 1371.772075][T21299] do_syscall_64+0x14d/0xf80 [ 1371.778264][T21299] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1371.785745][T21299] } [ 1371.788266][T21299] ... key at: [] alloc_tty_struct.__key.35+0x0/0x20 [ 1371.797011][T21299] ... acquired at: [ 1371.800833][T21299] _raw_spin_lock_irqsave+0x40/0x60 [ 1371.806232][T21299] stop_tty+0x2f/0x150 [ 1371.810489][T21299] kbd_event+0x2ec1/0x40d0 [ 1371.815100][T21299] input_handle_events_default+0xd4/0x1a0 [ 1371.821012][T21299] input_pass_values+0x288/0x890 [ 1371.826141][T21299] input_event_dispose+0x330/0x6b0 [ 1371.831533][T21299] input_inject_event+0x1dd/0x340 [ 1371.836844][T21299] evdev_write+0x325/0x4c0 [ 1371.841451][T21299] vfs_write+0x29a/0xb90 [ 1371.845883][T21299] ksys_write+0x150/0x270 [ 1371.850403][T21299] do_syscall_64+0x14d/0xf80 [ 1371.855210][T21299] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1371.861293][T21299] [ 1371.863627][T21299] [ 1371.863627][T21299] the dependencies between the lock to be acquired [ 1371.863637][T21299] and SOFTIRQ-irq-unsafe lock: [ 1371.877175][T21299] -> (tasklist_lock){.+.+}-{3:3} { [ 1371.882585][T21299] HARDIRQ-ON-R at: [ 1371.886789][T21299] lock_acquire+0xf0/0x2e0 [ 1371.893236][T21299] _raw_read_lock+0x36/0x50 [ 1371.899775][T21299] __do_wait+0xde/0x740 [ 1371.906705][T21299] do_wait+0x1e7/0x540 [ 1371.912799][T21299] kernel_wait+0xd6/0x1c0 [ 1371.919142][T21299] call_usermodehelper_exec_work+0xbe/0x230 [ 1371.927053][T21299] process_scheduled_works+0xb02/0x1830 [ 1371.934624][T21299] worker_thread+0xa50/0xfc0 [ 1371.941235][T21299] kthread+0x388/0x470 [ 1371.947315][T21299] ret_from_fork+0x51e/0xb90 [ 1371.953925][T21299] ret_from_fork_asm+0x1a/0x30 [ 1371.960789][T21299] SOFTIRQ-ON-R at: [ 1371.964951][T21299] lock_acquire+0xf0/0x2e0 [ 1371.971487][T21299] _raw_read_lock+0x36/0x50 [ 1371.978017][T21299] __do_wait+0xde/0x740 [ 1371.984209][T21299] do_wait+0x1e7/0x540 [ 1371.990377][T21299] kernel_wait+0xd6/0x1c0 [ 1371.996721][T21299] call_usermodehelper_exec_work+0xbe/0x230 [ 1372.004628][T21299] process_scheduled_works+0xb02/0x1830 [ 1372.012210][T21299] worker_thread+0xa50/0xfc0 [ 1372.018936][T21299] kthread+0x388/0x470 [ 1372.025020][T21299] ret_from_fork+0x51e/0xb90 [ 1372.031646][T21299] ret_from_fork_asm+0x1a/0x30 [ 1372.038420][T21299] INITIAL USE at: [ 1372.042504][T21299] lock_acquire+0xf0/0x2e0 [ 1372.048841][T21299] _raw_write_lock_irq+0x3d/0x50 [ 1372.055715][T21299] copy_process+0x247a/0x3cf0 [ 1372.062318][T21299] kernel_clone+0x248/0x8e0 [ 1372.068754][T21299] user_mode_thread+0x110/0x180 [ 1372.075552][T21299] rest_init+0x23/0x300 [ 1372.081654][T21299] start_kernel+0x385/0x3d0 [ 1372.088179][T21299] x86_64_start_reservations+0x24/0x30 [ 1372.095581][T21299] x86_64_start_kernel+0x143/0x1c0 [ 1372.102690][T21299] common_startup_64+0x13e/0x147 [ 1372.109734][T21299] INITIAL READ USE at: [ 1372.114310][T21299] lock_acquire+0xf0/0x2e0 [ 1372.121156][T21299] _raw_read_lock+0x36/0x50 [ 1372.128038][T21299] __do_wait+0xde/0x740 [ 1372.134572][T21299] do_wait+0x1e7/0x540 [ 1372.141014][T21299] kernel_wait+0xd6/0x1c0 [ 1372.147744][T21299] call_usermodehelper_exec_work+0xbe/0x230 [ 1372.156018][T21299] process_scheduled_works+0xb02/0x1830 [ 1372.163952][T21299] worker_thread+0xa50/0xfc0 [ 1372.170925][T21299] kthread+0x388/0x470 [ 1372.177357][T21299] ret_from_fork+0x51e/0xb90 [ 1372.184320][T21299] ret_from_fork_asm+0x1a/0x30 [ 1372.191451][T21299] } [ 1372.194140][T21299] ... key at: [] tasklist_lock+0x18/0x40 [ 1372.202064][T21299] ... acquired at: [ 1372.206077][T21299] _raw_read_lock+0x36/0x50 [ 1372.210778][T21299] send_sigurg+0x12b/0x420 [ 1372.215381][T21299] sk_send_sigurg+0x6c/0x2e0 [ 1372.220184][T21299] queue_oob+0x42c/0x4f0 [ 1372.224616][T21299] unix_stream_sendmsg+0xcb1/0xe80 [ 1372.229925][T21299] ____sys_sendmsg+0xa68/0xad0 [ 1372.234971][T21299] ___sys_sendmsg+0x2a5/0x360 [ 1372.239844][T21299] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1372.244976][T21299] do_syscall_64+0x14d/0xf80 [ 1372.249766][T21299] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1372.255859][T21299] [ 1372.258202][T21299] -> (&f_owner->lock){....}-{3:3} { [ 1372.263539][T21299] INITIAL USE at: [ 1372.267532][T21299] lock_acquire+0xf0/0x2e0 [ 1372.273715][T21299] _raw_write_lock_irq+0x3d/0x50 [ 1372.280508][T21299] __f_setown+0x67/0x370 [ 1372.286512][T21299] f_setown+0x23a/0x300 [ 1372.292447][T21299] do_fcntl+0x6cd/0x1a20 [ 1372.298451][T21299] __se_sys_fcntl+0xc8/0x150 [ 1372.304795][T21299] do_syscall_64+0x14d/0xf80 [ 1372.311151][T21299] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1372.318803][T21299] INITIAL READ USE at: [ 1372.323261][T21299] lock_acquire+0xf0/0x2e0 [ 1372.329869][T21299] _raw_read_lock_irq+0x45/0x60 [ 1372.336916][T21299] f_getown+0x54/0x2a0 [ 1372.343166][T21299] sock_ioctl+0x586/0x7f0 [ 1372.349683][T21299] __se_sys_ioctl+0xfc/0x170 [ 1372.356455][T21299] do_syscall_64+0x14d/0xf80 [ 1372.363242][T21299] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1372.371329][T21299] } [ 1372.374014][T21299] ... key at: [] file_f_owner_allocate.__key+0x0/0x20 [ 1372.382986][T21299] ... acquired at: [ 1372.386887][T21299] _raw_read_lock_irqsave+0x48/0x60 [ 1372.392290][T21299] send_sigio+0x38/0x370 [ 1372.396720][T21299] kill_fasync+0x24d/0x4d0 [ 1372.401319][T21299] lease_break_callback+0x26/0x30 [ 1372.406529][T21299] __break_lease+0x81c/0x1e80 [ 1372.411404][T21299] do_dentry_open+0x1010/0x14e0 [ 1372.416444][T21299] vfs_open+0x3b/0x340 [ 1372.420698][T21299] path_openat+0x2e08/0x3860 [ 1372.425471][T21299] do_file_open+0x23e/0x4a0 [ 1372.430163][T21299] do_open_execat+0x12b/0x580 [ 1372.435031][T21299] open_exec+0x29/0x40 [ 1372.439315][T21299] load_misc_binary+0x8bf/0xc40 [ 1372.444372][T21299] bprm_execve+0x93d/0x1460 [ 1372.449154][T21299] do_execveat_common+0x50d/0x690 [ 1372.454368][T21299] __x64_sys_execveat+0xc7/0xf0 [ 1372.459418][T21299] do_syscall_64+0x14d/0xf80 [ 1372.464219][T21299] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1372.470301][T21299] [ 1372.472637][T21299] -> (&new->fa_lock){....}-{3:3} { [ 1372.477782][T21299] INITIAL USE at: [ 1372.481692][T21299] lock_acquire+0xf0/0x2e0 [ 1372.487701][T21299] _raw_write_lock_irq+0x3d/0x50 [ 1372.494232][T21299] fasync_remove_entry+0xf1/0x1c0 [ 1372.500843][T21299] lease_modify+0x4f7/0x6c0 [ 1372.506957][T21299] locks_remove_file+0x5f0/0xf70 [ 1372.513497][T21299] __fput+0x3ae/0xa70 [ 1372.519079][T21299] task_work_run+0x1d9/0x270 [ 1372.525253][T21299] exit_to_user_mode_loop+0xed/0x480 [ 1372.532149][T21299] do_syscall_64+0x32d/0xf80 [ 1372.538342][T21299] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1372.545831][T21299] INITIAL READ USE at: [ 1372.550175][T21299] lock_acquire+0xf0/0x2e0 [ 1372.556624][T21299] _raw_read_lock_irqsave+0x48/0x60 [ 1372.563930][T21299] kill_fasync+0x199/0x4d0 [ 1372.570358][T21299] lease_break_callback+0x26/0x30 [ 1372.577391][T21299] __break_lease+0x81c/0x1e80 [ 1372.584097][T21299] do_dentry_open+0x1010/0x14e0 [ 1372.590977][T21299] vfs_open+0x3b/0x340 [ 1372.597073][T21299] path_openat+0x2e08/0x3860 [ 1372.603690][T21299] do_file_open+0x23e/0x4a0 [ 1372.610227][T21299] do_open_execat+0x12b/0x580 [ 1372.616932][T21299] open_exec+0x29/0x40 [ 1372.623052][T21299] load_misc_binary+0x8bf/0xc40 [ 1372.629921][T21299] bprm_execve+0x93d/0x1460 [ 1372.636444][T21299] do_execveat_common+0x50d/0x690 [ 1372.643474][T21299] __x64_sys_execveat+0xc7/0xf0 [ 1372.650341][T21299] do_syscall_64+0x14d/0xf80 [ 1372.656957][T21299] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1372.664866][T21299] } [ 1372.667390][T21299] ... key at: [] fasync_insert_entry.__key+0x0/0x20 [ 1372.676090][T21299] ... acquired at: [ 1372.679908][T21299] _raw_read_lock_irqsave+0x48/0x60 [ 1372.685314][T21299] kill_fasync+0x199/0x4d0 [ 1372.689921][T21299] __start_tty+0x18c/0x220 [ 1372.694563][T21299] n_tty_ioctl_helper+0x128/0x4d0 [ 1372.699785][T21299] tty_ioctl+0x9c5/0xde0 [ 1372.704229][T21299] __se_sys_ioctl+0xfc/0x170 [ 1372.709007][T21299] do_syscall_64+0x14d/0xf80 [ 1372.713802][T21299] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1372.719883][T21299] [ 1372.722217][T21299] [ 1372.722217][T21299] stack backtrace: [ 1372.728175][T21299] CPU: 0 UID: 0 PID: 21299 Comm: syz.8.3981 Tainted: G L syzkaller #0 PREEMPT(full) [ 1372.728203][T21299] Tainted: [L]=SOFTLOCKUP [ 1372.728210][T21299] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1372.728223][T21299] Call Trace: [ 1372.728232][T21299] [ 1372.728241][T21299] dump_stack_lvl+0xe8/0x150 [ 1372.728269][T21299] __lock_acquire+0x2a94/0x2cf0 [ 1372.728303][T21299] lock_acquire+0xf0/0x2e0 [ 1372.728325][T21299] ? kill_fasync+0x199/0x4d0 [ 1372.728347][T21299] _raw_read_lock_irqsave+0x48/0x60 [ 1372.728373][T21299] ? kill_fasync+0x199/0x4d0 [ 1372.728390][T21299] kill_fasync+0x199/0x4d0 [ 1372.728408][T21299] ? kill_fasync+0x53/0x4d0 [ 1372.728425][T21299] ? __pfx_n_tty_write_wakeup+0x10/0x10 [ 1372.728443][T21299] __start_tty+0x18c/0x220 [ 1372.728464][T21299] n_tty_ioctl_helper+0x128/0x4d0 [ 1372.728486][T21299] ? __pfx_n_tty_ioctl+0x10/0x10 [ 1372.728501][T21299] tty_ioctl+0x9c5/0xde0 [ 1372.728524][T21299] ? __pfx_tty_ioctl+0x10/0x10 [ 1372.728548][T21299] __se_sys_ioctl+0xfc/0x170 [ 1372.728568][T21299] do_syscall_64+0x14d/0xf80 [ 1372.728596][T21299] ? trace_irq_disable+0x3b/0x150 [ 1372.728623][T21299] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1372.728641][T21299] ? clear_bhb_loop+0x40/0x90 [ 1372.728661][T21299] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1372.728680][T21299] RIP: 0033:0x7f2d9019c629 [ 1372.728698][T21299] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1372.728715][T21299] RSP: 002b:00007f2d91068028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1372.728735][T21299] RAX: ffffffffffffffda RBX: 00007f2d90415fa0 RCX: 00007f2d9019c629 [ 1372.728750][T21299] RDX: 0000000000000001 RSI: 000000000000540a RDI: 0000000000000004 [ 1372.728761][T21299] RBP: 00007f2d90232b39 R08: 0000000000000000 R09: 0000000000000000 [ 1372.728773][T21299] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1372.728791][T21299] R13: 00007f2d90416038 R14: 00007f2d90415fa0 R15: 00007f2d9053fa48 [ 1372.728812][T21299] [ 1373.121155][ T5837] asix 5-1:0.251 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 1373.131317][ T5837] asix 5-1:0.251 (unnamed net_device) (uninitialized): Failed to read MAC address: -71 [ 1373.141112][ T5837] asix 5-1:0.251: probe with driver asix failed with error -5 [ 1373.187530][ T5837] usb 5-1: USB disconnect, device number 39 [ 1373.367316][T10305] usb 6-1: new high-speed USB device number 96 using dummy_hcd [ 1373.727247][T10305] usb 6-1: device not accepting address 96, error -71