last executing test programs: 11.086688069s ago: executing program 0 (id=4143): r0 = fsopen(&(0x7f00000000c0)='minix\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x300, 0x0, 0x0, 0x0) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x2002, 0x0) ioctl$SNDCTL_DSP_SETFMT(r1, 0xc0045005, &(0x7f0000001180)=0x2000000) mmap$dsp(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x3, 0x12, r1, 0x0) (async) r2 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/asound/card0/oss_mixer\x00', 0x80, 0x0) pread64(r2, &(0x7f0000001240)=""/102400, 0x19000, 0x1000000300) ioctl$SNDCTL_DSP_GETOPTR(r1, 0x5008, 0x0) (async) ioctl$SNDCTL_DSP_GETOPTR(r1, 0x800c5012, &(0x7f0000000200)) 8.556078506s ago: executing program 3 (id=4152): r0 = socket$inet6(0xa, 0x3, 0x5) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x9, @mcast1, 0x48f}, 0x1c) sendmmsg(r0, &(0x7f0000000500)=[{{&(0x7f0000000380)=@l2tp6={0xa, 0x12, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) 8.17512028s ago: executing program 3 (id=4154): r0 = socket$inet6(0xa, 0x3, 0x5) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x9, @mcast1, 0x48f}, 0x1c) sendmmsg(r0, &(0x7f0000000500)=[{{&(0x7f0000000380)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="28000000000000002900000002"], 0x28}}], 0x1, 0x4000000) (fail_nth: 4) 8.113871678s ago: executing program 3 (id=4156): ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000140)=0x80d) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x5, 0x9, 0x6, 0x0, 0x2, 0x8, 0xa, 0x2, 0x3}, 0x0) r2 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000000), 0x103902, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000020000000900010073797a300000000040000000030a09020000000000000000020000000900010073797a30000000000900030073797a3200000000140004800800014000000000080002400000000014000000110001"], 0x88}}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYRESOCT=r4], 0x60}}, 0x401) keyctl$read(0xb, 0x0, &(0x7f0000000b40)=""/145, 0x91) r5 = socket$inet_sctp(0x2, 0x1, 0x84) sendmmsg$inet_sctp(r5, &(0x7f0000000180)=[{&(0x7f0000000040)=@in={0x2, 0x4f21, @rand_addr=0x64010101}, 0x10, &(0x7f0000000240), 0x0, 0x0, 0x0, 0x24000000}], 0x1, 0x62048800) setsockopt$sock_int(r5, 0x1, 0x7, &(0x7f0000000140)=0x1000, 0x4) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) r8 = add_key(&(0x7f0000000000)='big_key\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)="ae", 0x1, 0xffffffffffffffff) keyctl$read(0x2, r8, &(0x7f00000020c0)=""/4093, 0xffd) socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_open_dev$vim2m(&(0x7f0000000040), 0x23, 0x2) ioctl$vim2m_VIDIOC_ENUM_FRAMESIZES(r9, 0xc02c564a, &(0x7f0000000000)={0x3, 0x1014, 0x2, @stepwise={0x60000000, 0x8108081, 0x7, 0x5, 0x9, 0x5}}) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000540)=ANY=[], 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000280)=ANY=[@ANYRESDEC=r9], 0x70}, 0x1, 0x0, 0x0, 0x600480d0}, 0x40) r10 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000240)='./binderfs2/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r10, 0xc0306201, &(0x7f0000000b00)={0xf8, 0x0, &(0x7f0000000940)=[@reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000640)={@fd={0x66642a85, 0x0, r5}, @ptr={0x70742a85, 0x0, &(0x7f0000000540)=""/247, 0xf7, 0x0, 0x36}, @fda={0x66646185, 0x3, 0x2, 0x1f}}, &(0x7f00000006c0)={0x0, 0x18, 0x40}}, 0x400}, @increfs_done={0x40106308, 0x1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f00000007c0)={@flat=@weak_binder={0x77622a85, 0x120b}, @ptr={0x70742a85, 0x1, &(0x7f0000000700)=""/150, 0x96, 0x2, 0x30}, @fd={0x66642a85, 0x0, r6}}, &(0x7f0000000840)={0x0, 0x18, 0x40}}, 0x1000}, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000880)={@fd={0x66642a85, 0x0, r2}, @flat=@handle={0x73682a85, 0x100b, 0x3}, @fda={0x66646185, 0x1, 0x0, 0xb}}, &(0x7f0000000900)={0x0, 0x18, 0xfc28}}}], 0xbc, 0x0, &(0x7f0000000a40)="35bb395c7ca1685417e546cd4a04fd600d45e86520a4f6a9a9d6b8074eefd3bffbbb06b73264c5ae47b672e2e4d500e83e14de5bb1933e6f5308c5c80b5eea7a410685f3a0c869be2b5260703bf6cdc417693ebb4a3c6820c222d8b2abca3e918f9997556b41db754a79a48a729443ad3b464c39ebd5e9a9f4b0a26ce705f1559646db8d327709c393be2a7ba97f79d2fae37c00d561fd65cd634024ba252871779e6a25e3f3bcb14f52711aaa59771508727be822503b6f7cf3a05e"}) syz_usb_connect$uac1(0x0, 0xb1, &(0x7f0000000440)=ANY=[@ANYRESOCT=r5, @ANYRES64=r9, @ANYRESDEC, @ANYRES32=r0, @ANYRESDEC=r7, @ANYRES16=r8, @ANYRESDEC=r8], 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000380), 0xf812eba0f582543, 0x0) 5.933408192s ago: executing program 4 (id=4165): syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000000000200304306000000000000109022400010000000009040000010300000009210000000122020009058103"], 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs={0x1, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000005600)=[{{&(0x7f0000000100)=@pppoe={0x18, 0x0, {0x0, @link_local}}, 0x80, &(0x7f0000002fc0)=[{&(0x7f00000009c0)=""/4096, 0x1000}, {&(0x7f00000003c0)=""/257, 0x101}, {&(0x7f0000001ac0)=""/249, 0xf9}, {&(0x7f0000001bc0)=""/166, 0xa6}, {&(0x7f0000001c80)=""/142, 0x8e}, {&(0x7f0000001d40)=""/124, 0x7c}, {&(0x7f0000001dc0)=""/4096, 0x1000}, {&(0x7f0000002dc0)=""/162, 0xa2}, {&(0x7f0000002e80)=""/114, 0x72}, {&(0x7f0000002f00)=""/132, 0x84}], 0xa, &(0x7f0000003080)=""/4096, 0x1000}, 0x7}, {{&(0x7f0000004080)=@vsock={0x28, 0x0, 0x0, @my}, 0x80, &(0x7f0000004380)=[{&(0x7f0000004100)=""/121, 0x79}, {&(0x7f0000004180)=""/167, 0xa7}, {&(0x7f0000004240)=""/72, 0x48}, {&(0x7f00000042c0)=""/180, 0xb4}], 0x4, &(0x7f00000043c0)=""/32, 0x20}, 0xa241}, {{&(0x7f0000004400)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @ipv4}}}, 0x80, &(0x7f0000004640)=[{&(0x7f0000004480)=""/131, 0x83}, {&(0x7f0000004540)=""/103, 0x67}, {&(0x7f00000045c0)=""/75, 0x4b}], 0x3, &(0x7f0000004680)=""/203, 0xcb}, 0x4}, {{&(0x7f0000004780)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, 0x80, &(0x7f00000048c0)=[{&(0x7f0000000040)=""/25, 0x19}, {&(0x7f0000004840)=""/109, 0x6d}], 0x2}, 0x4}, {{&(0x7f0000004900)=@l2={0x1f, 0x0, @fixed}, 0x80, &(0x7f0000004dc0)=[{&(0x7f00000019c0)=""/207, 0xcf}, {&(0x7f0000004a80)=""/8, 0x8}, {&(0x7f0000004ac0)=""/253, 0xfd}, {&(0x7f0000004bc0)=""/91, 0x5b}, {&(0x7f0000004c40)=""/92, 0x5c}, {&(0x7f0000004cc0)=""/244, 0xf4}], 0x6, &(0x7f0000004e40)}, 0x4}, {{&(0x7f0000000200)=@rc, 0x80, &(0x7f0000000800)=[{&(0x7f0000000500)=""/237, 0xed}, {&(0x7f0000000600)=""/157, 0x9d}, {&(0x7f00000006c0)=""/213, 0xd5}], 0x3, &(0x7f0000000840)=""/193, 0xc1}, 0x1ff}, {{0x0, 0x0, &(0x7f0000005480)=[{&(0x7f0000004980)=""/89, 0x59}, {&(0x7f0000004e40)=""/247, 0xf7}, {&(0x7f0000005140)=""/156, 0x9c}, {&(0x7f0000005200)=""/83, 0x53}, {&(0x7f0000005280)=""/242, 0xf2}, {&(0x7f0000005380)=""/233, 0xe9}], 0x6, &(0x7f0000005500)=""/212, 0xd4}, 0x2}], 0x7, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) r0 = io_uring_setup(0x2e01, &(0x7f0000000700)={0x0, 0xafd3, 0x1000, 0x2, 0x2d2}) r1 = io_uring_setup(0x7625, &(0x7f0000000600)={0x0, 0x653f, 0x0, 0x0, 0x28e, 0x0, r0}) io_uring_register$IORING_REGISTER_FILES(r1, 0x1e, &(0x7f0000000000)=[r0], 0x1) madvise(&(0x7f000082f000/0x2000)=nil, 0x2000, 0x19) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="2c0000001a00010000000000000008001d000000000306001ce820120e509882c2ff469611e41f1cdb220000"], 0x2c}}, 0x4008010) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x0, 0x1, 0x0, 0x40, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x4000, 0x3, &(0x7f0000814000/0x4000)=nil) prctl$PR_SET_IO_FLUSHER(0x43, 0x1) openat$dsp(0xffffffffffffff9c, &(0x7f0000000180), 0x400, 0x0) creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, &(0x7f00000001c0)={0x6, 0x2000027, 0x20000000, 0x1}, 0x10) syz_usb_connect(0x0, 0x24, &(0x7f0000000980)=ANY=[@ANYBLOB="120100009080e140fc044a500243010203010902120001000000000904"], 0x0) semtimedop(0xffffffffffffffff, 0x0, 0x0, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) syz_usb_connect(0x2, 0x36, 0x0, 0x0) r4 = dup(r3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x13, r4, 0x2000) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x17) r5 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r5, 0x84, 0x76, &(0x7f0000000500)={0x1003, 0x8000, 0x8204, 0x100009, 0xfffffffc, 0x8, 0x3ff, 0x40000008}, &(0x7f0000000280)=0x20) inotify_add_watch(r3, &(0x7f0000000000)='./file0\x00', 0x2000100) 4.689432317s ago: executing program 3 (id=4166): getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000280)={0x0, @dev, @local}, &(0x7f00000002c0)=0xc) bpf$PROG_LOAD(0x5, &(0x7f0000001000)={0x4, 0x1c, &(0x7f0000000400)=ANY=[@ANYBLOB="bf1600000000bd5930680000fe85"], 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', r0, @fallback=0x34, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x101}, 0x94) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000008300), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x0, &(0x7f0000002100)=ANY=[@ANYBLOB="670300", @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) r2 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'team_slave_1\x00', 0x0}) r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r4, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) sendmsg$NFT_MSG_GETGEN(r4, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x14, 0x10, 0xa, 0x5, 0x0, 0x0, {0xa, 0x0, 0x5}, ["", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x24000004}, 0x8004) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f00000000c0)={r3, 0x1, 0x6, @link_local}, 0x10) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000140)={'syzkaller1\x00', 0xc201}) r6 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r5, &(0x7f00000016c0)=ANY=[@ANYBLOB="110086dd0000110000000000000060ec970000382c00fe8000000000000000000000000000aaff02000000000000000000000000000104"], 0xfdef) name_to_handle_at(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)=ANY=[], 0x0, 0x402) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="010000000000000000000100050900030000001400200080000287ff1531a4c5565fffe000000108000a0000000000060002000100000014001f00"/69], 0x5c}, 0x1, 0x6c, 0x0, 0x40005}, 0x8840) 4.687962587s ago: executing program 1 (id=4167): r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x595f, 0x400, 0x0, 0x3c9}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f0000000280)=@IORING_OP_BIND=@ipv6={0x38, 0x0, 0x0, r0, 0x0, 0x0}) io_uring_enter(r1, 0x1fff, 0x2a7e, 0x8, 0x0, 0x300) 4.439231255s ago: executing program 1 (id=4168): socketpair$unix(0x1, 0x3, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) r0 = socket$inet6(0xa, 0x80003, 0xff) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r2, 0x1, 0x3c, &(0x7f0000000040)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR(r2, 0x6, 0x13, &(0x7f00000000c0)=0x1, 0x4) connect$inet(r2, &(0x7f0000000080)={0x2, 0x0, @loopback}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r2, 0x6, 0x13, 0x0, 0x0) sendto(r2, &(0x7f0000000100)="0700bad5da0f7abb94ae529561beed4fbbaba97564c5f39e644541bd3a45cb9835bb2bff7fb568c90f15682d1efb94ac44443ff43aeecb3f5641f57198628519f8fb26ff23ad9413c2fef9d765ff2079940ce299bfb474772f2e6e153a474d5a6391b0", 0xfffffffffffffe68, 0x404c8d5, 0x0, 0xfffffeeb) sendmmsg$inet(r2, &(0x7f00000060c0)=[{{0x0, 0x0, &(0x7f0000000a40)=[{&(0x7f0000000800)='a', 0x1}], 0x1}}], 0x1, 0x4000000) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040), 0x0) setsockopt$inet6_int(r0, 0x29, 0x16, &(0x7f0000000000)=0x401, 0x4) r3 = mmap$IORING_OFF_CQ_RING(0x0, 0x4, 0xd, 0x8010, 0xffffffffffffffff, 0x8000000) r4 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x0, 0x10000, 0x1, 0x40055}, &(0x7f0000000100)=0x0, 0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r5, 0x0, r6, &(0x7f00000001c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x1, {0x2011}}) syz_io_uring_submit(0x0, 0x0, 0x0, &(0x7f0000000180)=@IORING_OP_SYMLINKAT={0x26, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}) syz_io_uring_submit(0x0, r3, r6, &(0x7f00000000c0)=@IORING_OP_FALLOCATE={0x11, 0x0, 0x0, @fd, 0xffff, 0x0, 0x1}) r7 = fcntl$getown(r4, 0x9) timer_create(0x6, &(0x7f0000000240)={0x0, 0x8, 0x0, @tid=r7}, &(0x7f0000000280)) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x14) 4.359049701s ago: executing program 1 (id=4169): shmget(0x1, 0x1000, 0x2, &(0x7f00003ae000/0x1000)=nil) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) syz_open_dev$sndpcmp(0x0, 0xfffffffffffffff1, 0x402000) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) madvise(&(0x7f000004f000/0x2000)=nil, 0x2000, 0x3) landlock_create_ruleset(&(0x7f00000001c0)={0xa019, 0x1, 0x3}, 0x18, 0x0) r2 = landlock_create_ruleset(&(0x7f0000000240)={0x1fff, 0xc, 0x2, 0x86cb}, 0x30, 0x1) landlock_restrict_self(r2, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r4 = socket$nl_route(0x10, 0x3, 0x0) mlock(&(0x7f0000ffb000/0x3000)=nil, 0x3000) move_pages(0x0, 0x2, &(0x7f00000003c0)=[&(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil], &(0x7f0000000000)=[0x1, 0x1], &(0x7f00000000c0), 0x0) sendmsg$nl_route(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=@newlink={0x38, 0x10, 0x403, 0x70bd27, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x429a4}, [@IFLA_XDP={0x4}, @IFLA_ALT_IFNAME={0x14, 0x35, 'wlan1\x00'}]}, 0x38}}, 0x48000) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x400, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) close(r6) syz_clone3(&(0x7f00000003c0)={0x122125000, &(0x7f00000000c0), 0x0, 0x0, {0x22}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000000c0)={'wlan1\x00'}) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000100)='ns/ipc\x00') syz_emit_ethernet(0x4a, &(0x7f0000000100)={@link_local={0xd}, @multicast, @void, {@ipv4={0x800, @udp={{0xc, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x8, 0x73, 0x0, @private, @broadcast, {[@timestamp_prespec={0x44, 0x1c, 0xe, 0x3, 0xd, [{@local, 0x8}, {@loopback, 0x5}, {@local, 0x8}]}]}}, {0x0, 0x0, 0xc, 0x0, @gue={{0x1, 0x0, 0x0, 0x0, 0x0, @void}}}}}}}, 0x0) syz_open_procfs$userns(0xffffffffffffffff, 0x0) ioctl$NS_GET_PARENT(0xffffffffffffffff, 0xb702, 0x0) sendmsg$ETHTOOL_MSG_DEBUG_SET(r3, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)={0x14, 0x0, 0x1, 0x400000, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x24}, 0x804) 4.283489394s ago: executing program 3 (id=4170): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x4c02}) readv(r0, &(0x7f0000000080)=[{&(0x7f0000000980)=""/4096, 0x1000}], 0x1) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, &(0x7f0000000100)=0x730) syz_emit_ethernet(0x4a, &(0x7f0000000480)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x2b}, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "00ff0f", 0x14, 0x6, 0xff, @local, @local, {[], {{0x0, 0x4001, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0xffffffffffffffff, 0x100, 0x0, 0x3}}}}}}}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', @link_local}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) timerfd_create(0x5, 0x800) 3.111259418s ago: executing program 3 (id=4172): syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000000000200304306000000000000109022400010000000009040000010300000009210000000122020009058103"], 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs={0x1, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000004fc0)=[{{&(0x7f0000000100)=@pppoe={0x18, 0x0, {0x0, @link_local}}, 0x80, &(0x7f0000002fc0)=[{&(0x7f00000009c0)=""/4096, 0x1000}, {&(0x7f00000003c0)=""/257, 0x101}, {&(0x7f0000001ac0)=""/249, 0xf9}, {&(0x7f0000001bc0)=""/166, 0xa6}, {&(0x7f0000001c80)=""/142, 0x8e}, {&(0x7f0000001d40)=""/124, 0x7c}, {&(0x7f0000001dc0)=""/4096, 0x1000}, {&(0x7f0000002dc0)=""/162, 0xa2}, {&(0x7f0000002e80)=""/114, 0x72}, {&(0x7f0000002f00)=""/132, 0x84}], 0xa, &(0x7f0000003080)=""/4096, 0x1000}, 0x7}, {{&(0x7f0000004080)=@vsock={0x28, 0x0, 0x0, @my}, 0x80, &(0x7f0000004380)=[{&(0x7f0000004100)=""/121, 0x79}, {&(0x7f0000004180)=""/167, 0xa7}, {&(0x7f0000004240)=""/72, 0x48}, {&(0x7f00000042c0)=""/180, 0xb4}], 0x4, &(0x7f00000043c0)=""/32, 0x20}, 0xa241}, {{&(0x7f0000004400)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @ipv4}}}, 0x80, &(0x7f0000004640)=[{&(0x7f0000004480)=""/131, 0x83}, {&(0x7f0000004540)=""/103, 0x67}, {&(0x7f00000045c0)=""/75, 0x4b}], 0x3, &(0x7f0000004680)=""/203, 0xcb}, 0x4}, {{&(0x7f0000004780)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, 0x80, &(0x7f00000048c0)=[{&(0x7f0000000040)=""/25, 0x19}, {&(0x7f0000004840)=""/109, 0x6d}], 0x2}, 0x4}, {{&(0x7f0000004900)=@l2={0x1f, 0x0, @fixed}, 0x80, &(0x7f0000004dc0)=[{&(0x7f00000019c0)=""/207, 0xcf}, {&(0x7f0000004a80)=""/8, 0x8}, {&(0x7f0000004ac0)=""/253, 0xfd}, {&(0x7f0000004bc0)=""/91, 0x5b}, {&(0x7f0000004c40)=""/92, 0x5c}, {&(0x7f0000004cc0)=""/244, 0xf4}], 0x6, &(0x7f0000004e40)}, 0x4}, {{&(0x7f0000000200)=@rc, 0x80, &(0x7f0000000800)=[{&(0x7f0000000500)=""/237, 0xed}, {&(0x7f0000000600)=""/157, 0x9d}, {&(0x7f00000006c0)=""/213, 0xd5}], 0x3, &(0x7f0000000840)=""/193, 0xc1}, 0x1ff}], 0x6, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x2100) r0 = io_uring_setup(0x2e01, &(0x7f0000000700)={0x0, 0xafd3, 0x1000, 0x2, 0x2d2}) r1 = io_uring_setup(0x7625, &(0x7f0000000600)={0x0, 0x653f, 0x0, 0x0, 0x28e, 0x0, r0}) io_uring_register$IORING_REGISTER_FILES(r1, 0x1e, &(0x7f0000000000)=[r0], 0x1) madvise(&(0x7f000082f000/0x2000)=nil, 0x2000, 0x19) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="2c0000001a00010000000000000008001d000000000306001ce820120e509882c2ff469611e41f1cdb220000"], 0x2c}}, 0x4008010) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x0, 0x1, 0x0, 0x40, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x4000, 0x3, &(0x7f0000814000/0x4000)=nil) prctl$PR_SET_IO_FLUSHER(0x43, 0x1) openat$dsp(0xffffffffffffff9c, &(0x7f0000000180), 0x400, 0x0) creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) r3 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r3, 0x10e, 0xc, &(0x7f0000000380)={0x6, 0x2000027, 0x20000000, 0x1}, 0x10) syz_usb_connect(0x0, 0x24, &(0x7f0000000980)=ANY=[@ANYBLOB="120100009080e140fc044a500243010203010902120001000000000904"], 0x0) semtimedop(0xffffffffffffffff, 0x0, 0x0, 0x0) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) syz_usb_connect(0x2, 0x36, 0x0, 0x0) r5 = dup(r4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x13, r5, 0x2000) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x17) r6 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r6, 0x84, 0x76, &(0x7f0000000500)={0x1003, 0x8000, 0x8204, 0x100009, 0xfffffffc, 0x8, 0x3ff, 0x40000008}, &(0x7f0000000280)=0x20) inotify_add_watch(r4, &(0x7f0000000000)='./file0\x00', 0x2000100) 3.016194906s ago: executing program 4 (id=4173): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000000040)={0x0, 0xfdff, &(0x7f0000000080)=[{&(0x7f0000000100)={0x24, 0x13, 0x821, 0x0, 0x0, "", [@typed={0x6, 0x0, 0x0, 0x0, @str='!\xa5'}, @typed={0xc, 0x1, 0x0, 0x0, @u64=0x3}]}, 0x24}], 0x1}, 0x0) 2.867241577s ago: executing program 4 (id=4174): connect$unix(0xffffffffffffffff, 0x0, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) socket$inet(0xa, 0x801, 0x84) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x4001, 0x40000000, @dev={0xfe, 0x80, '\x00', 0x1b}, 0xd}, 0x1c) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) write$binfmt_script(r0, &(0x7f0000000200), 0xfffffd9d) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00003, 0x8) socket$nl_generic(0x10, 0x3, 0x10) 2.797916557s ago: executing program 2 (id=4175): r0 = socket$inet(0x2, 0x2, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) io_uring_setup(0xfd2, &(0x7f0000000040)={0x0, 0x366, 0xc000, 0x800c, 0xa0002f5}) setsockopt$inet_mreqn(r0, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0x40) r1 = socket$netlink(0x10, 0x3, 0x0) writev(r1, &(0x7f00000003c0)=[{&(0x7f0000000180)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r1, &(0x7f0000000100)=[{&(0x7f00000001c0)="390000001300034700bb5be1c3e4feff06000000010000004500000025000000190004000400ad000d00000000000006040000000000f93132", 0x39}], 0x1) r2 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r2, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0x40) setsockopt$inet_msfilter(r2, 0x0, 0x29, &(0x7f0000000000)=ANY=[@ANYBLOB="e00000027f0000010000"], 0x57) setsockopt$inet_mreqsrc(r0, 0x0, 0x24, &(0x7f0000000440)={@multicast2, @loopback, @empty}, 0xc) 2.766416419s ago: executing program 1 (id=4176): r0 = socket(0x10, 0x803, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFVLAN_GET_VLAN_REALDEV_NAME_CMD(r1, 0x8982, &(0x7f0000000380)={0x8, 'syz_tun\x00', {'veth1_to_bridge\x00'}, 0x5}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="5400000013000500010000000000000007000000", @ANYRES32=r3, @ANYBLOB="000000000000000034001a00060000000200000028000480240008800800010001000000040002"], 0x54}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000200)=@newlink={0x68, 0x10, 0x439, 0x70bd2c, 0x25dfdbff, {0x0, 0x0, 0xe403, 0x0, 0x40083}, [@IFLA_LINKINFO={0x48, 0x12, 0x0, 0x1, @ip6gre={{0xb}, {0x38, 0x2, 0x0, 0x1, [@IFLA_GRE_ENCAP_FLAGS={0x6, 0xf, 0x6}, @IFLA_GRE_ERSPAN_DIR={0x5}, @IFLA_GRE_ERSPAN_DIR={0x5}, @IFLA_GRE_ENCAP_SPORT={0x6, 0x10, 0x4e20}, @IFLA_GRE_REMOTE={0x14, 0x7, @ipv4={'\x00', '\xff\xff', @remote}}]}}}]}, 0x68}, 0x1, 0x0, 0x0, 0x8000}, 0x4040) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000001c0)={@map, 0x7, 0x0, 0x8, &(0x7f0000000040)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x9, 0x0, &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000100)=[0x0, 0x0], &(0x7f0000000180)=[0x0, 0x0, 0x0], 0x0}, 0x40) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x1, 0x100004, 0x20104, 0x4, 0x1, 0x1}, 0x48) bpf$BPF_PROG_DETACH(0x9, &(0x7f00000006c0)={@map=r5, 0xffffffffffffffff, 0x7}, 0x10) r6 = bpf$OBJ_GET_PROG(0x7, &(0x7f0000000340)=@o_path={&(0x7f0000000300)='./file0\x00', 0x0, 0x0, r0}, 0x18) bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000002c0)={0xffffffffffffffff, r2, 0x16, 0x0, @val=@netkit={@void, @value=r6, @void, @void, r4}}, 0x1c) 2.661752444s ago: executing program 2 (id=4177): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$DVB_DVR_DMX_EXPBUF(r0, 0xc00c6f3e, &(0x7f00000000c0)={0x1, 0x0, r0}) ioctl$FIOCLEX(r1, 0x5451) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0x1}, {0xffff, 0xffff}, {0x0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x1, 0x8}}}]}, 0x38}}, 0x0) ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000000600)={0x0, 0x0, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) sendmsg$nl_route_sched(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=@getqdisc={0x24, 0x26, 0x100, 0x70bd2b, 0x25dfdbff, {0x0, 0x0, 0x0, r4, {0x5, 0xfff3}, {0x10, 0x9}, {0x3, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0x20048084}, 0x20084010) r5 = fsopen(&(0x7f00000029c0)='tmpfs\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r5, 0x1, &(0x7f0000000ac0)='gid', &(0x7f0000000440)='0\x00#\x00\xd0\x00 \x00\x00qS\x00\x00\x00\x00\x00\x00\x00\x00$\xf6_\xbdI\x1c\xf2\xa9]\xcc\xe0*\xef\x01\x8d\x15\xd2h\x93\xc9\xb57\xc3\xea\\Eb\xf8\xe6,\xdf\xd4\xfae\x84\xcc\xd5\"d\xf0D-\x98\x9f\x81{\xfc$\xc4\xbcF\xf8\xc8\x8d\xcb\xb8\xf2\x1e\xe4\'U\xb3\xb8\xd3\xe6\xd7\x80Y\xc2\xeb\n\xb8_\xe8\x96YY\xe3\xc7\xe6\xf28\x19\xa6\xa7\xfa\xdb\x1ce\xc1\x03\x86J\xb2fh\x19\xee#\xcc\x0f\xed\xfea\xdc\x88\xcb%bW\xd35\xda=\xac\x1d\xae\x93\xfd\'T6\x94\n\xa4\x9cU\xc4\fA~[\xbf\x8b\x90\xfe\x04\xe7U\xf3h\x81\x14l7u\x95\x96t\\\x0f\xef;\x03\xa4C\xbc(Vc!a\xc1\xe39\xc6b\x905\xf8\xc9@h\x01\xf5\xcb\x88\xdf9\xaf5\xc8a:z\xe4\xcbag&67\x814\xf6}\xe10v6l\xd6,\x1e\xa0\xcc\xbf\xfdkm\b?\x839\x85N\x1c\xc1\xcb\xfc\x85\xd2\n\x02\"\xf2\x81g\x90\x01n%\x7f_\xe1.f>>\xa5\xfb\"\xab\xdb\x06\x12e\x14\x11~\x9a\bR-\x85\xc3\xa9\xe6\xf6R\x11\"\xc3\xc9\xfc\x14s X\xec\xdd\xc2qB\x85\xf0\xd7\x04\xdd<\x9a\x84\'\xa3\xf1\xd9<\xb9k', 0x0) 2.640217836s ago: executing program 1 (id=4178): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x4c02}) readv(r0, &(0x7f0000000080)=[{&(0x7f0000000980)=""/4096, 0x1000}], 0x1) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, &(0x7f0000000100)=0x730) syz_emit_ethernet(0x4a, &(0x7f0000000480)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x2b}, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "00ff0f", 0x14, 0x6, 0xff, @local, @local, {[], {{0x0, 0x4001, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0xffffffffffffffff, 0x100, 0x0, 0x3}}}}}}}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', @link_local}) 2.605921278s ago: executing program 0 (id=4179): socketpair$unix(0x1, 0x3, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) r0 = socket$inet6(0xa, 0x80003, 0xff) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r2, 0x1, 0x3c, &(0x7f0000000040)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR(r2, 0x6, 0x13, &(0x7f00000000c0)=0x1, 0x4) connect$inet(r2, &(0x7f0000000080)={0x2, 0x0, @loopback}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r2, 0x6, 0x13, 0x0, 0x0) sendto(r2, &(0x7f0000000100)="0700bad5da0f7abb94ae529561beed4fbbaba97564c5f39e644541bd3a45cb9835bb2bff7fb568c90f15682d1efb94ac44443ff43aeecb3f5641f57198628519f8fb26ff23ad9413c2fef9d765ff2079940ce299bfb474772f2e6e153a474d5a6391b0", 0xfffffffffffffe68, 0x404c8d5, 0x0, 0xfffffeeb) sendmmsg$inet(r2, &(0x7f00000060c0)=[{{0x0, 0x0, &(0x7f0000000a40)=[{&(0x7f0000000800)='a', 0x1}], 0x1}}], 0x1, 0x4000000) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040), 0x0) setsockopt$inet6_int(r0, 0x29, 0x16, &(0x7f0000000000)=0x401, 0x4) r3 = mmap$IORING_OFF_CQ_RING(0x0, 0x4, 0xd, 0x8010, 0xffffffffffffffff, 0x8000000) r4 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x0, 0x10000, 0x1, 0x40055}, &(0x7f0000000100)=0x0, 0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r5, 0x0, r6, &(0x7f00000001c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x1, {0x2011}}) syz_io_uring_submit(0x0, 0x0, 0x0, &(0x7f0000000180)=@IORING_OP_SYMLINKAT={0x26, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}) syz_io_uring_submit(0x0, r3, r6, &(0x7f00000000c0)=@IORING_OP_FALLOCATE={0x11, 0x0, 0x0, @fd, 0xffff, 0x0, 0x1}) r7 = fcntl$getown(r4, 0x9) timer_create(0x6, &(0x7f0000000240)={0x0, 0x8, 0x0, @tid=r7}, &(0x7f0000000280)) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x14) 2.466650825s ago: executing program 2 (id=4180): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="18000000260001031dbd7002fadbdf25010000000400ae"], 0x18}}, 0x0) recvmmsg(r0, &(0x7f00000064c0)=[{{0x0, 0x0, 0x0}, 0xffffffff}, {{0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000001500)=""/4112, 0x1010}, {&(0x7f0000000100)=""/7, 0x7}, {&(0x7f0000000080)=""/82, 0x52}, {&(0x7f0000000340)=""/99, 0x63}, {&(0x7f0000000200)=""/209, 0xd1}, {&(0x7f00000001c0)=""/27, 0x1b}], 0x6}, 0x400000}, {{0x0, 0x0, 0x0}}], 0x3, 0x30100, 0x0) 2.465422809s ago: executing program 0 (id=4181): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='net_prio.prioidx\x00', 0x275a, 0x0) r1 = fanotify_init(0x200, 0x0) fanotify_mark(r1, 0x101, 0xb, r0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20942, 0x56) writev(r2, &(0x7f0000000000)=[{&(0x7f0000000380)="c194", 0x2}], 0x1) (fail_nth: 1) 2.388926705s ago: executing program 2 (id=4182): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket(0x10, 0x3, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f000002f000/0x3000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ff6000/0x3000)=nil, &(0x7f000005f000/0x3000)=nil, &(0x7f0000ff8000/0x8000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffa000/0x2000)=nil, &(0x7f0000144000/0x1000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0xfffffffffffffee3) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r1 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0x8e44, 0x1f400, 0x8, 0xc1}) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1600000004"], 0x50) io_uring_enter(r1, 0x2219, 0x7721, 0x16, 0x0, 0x0) write(r0, &(0x7f0000000580)="240000001e005f031400ff01000000f80700b3586ff606c2e553797c080008e467dc0000", 0x24) (fail_nth: 5) 1.973228942s ago: executing program 2 (id=4183): r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000180)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x3a}}]}}, 0x0) syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x10, &(0x7f0000000040)=@ready={0x0, 0x0, 0x8, "b326b0dc", {0x1, 0x8, 0x7, 0x9}}) (async) r1 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'ip6gre0\x00', 0x0}) (async, rerun: 32) openat(0xffffffffffffff9c, &(0x7f0000000580)='./file0\x00', 0x2c41, 0x0) (async, rerun: 32) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000340), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) (async) read$FUSE(r3, &(0x7f000000b0c0)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) (async) open(&(0x7f00000000c0)='./file0\x00', 0x109281, 0x0) write$FUSE_INIT(r3, &(0x7f0000002280)={0x50, 0x0, r4, {0x7, 0x9, 0x0, 0x110002, 0x10, 0x0, 0x3, 0x0, 0x0, 0x0, 0x10}}, 0x50) (async, rerun: 32) syz_fuse_handle_req(r3, &(0x7f0000007080)="f5201a6b6542be6cbad26e239346ffe3dbc7125e4eb0daba2e9ba73337e45b1a2c2828afbe1d99c856f2d7c9b91364a83e3c477d5e9569cf8787de2fd830003be5c3bbb4a246c4e13764c6e255ef511c263c70adb80380cc2b3247fb61ebddd2b945820fc646375953f1322be813b875bf64256ac7a8debe881f8352dc9fd70b9473bf07932110a5d1a94144b2ab0b4cd92458041eef085b29b5c115df0d7db2bea67006c66b64015fc980343e5ff451373afc63f2ae21d63cddeb3b0c53bbb4e0e31663f5b1b53de22517869df6114ac9047ee98a692b4f0e3e7cfc4e42368f217cc705f2bc5d10454ab30eda651c6ee29f0cc5a6ca7b384949955785844742121b5734a8cf3f3fe1d3e5c2085da26a028ba6c84d5cbce6afbe13cbb179d4c251e1d2d68e8c7d9c34eee698ceeb6e40aed55c62c45d8c7fcb2cfe95ce261238ca5c4458647ed7a001788e991e3d2ecfc77bedec164efda9e4a5d5f03043628fd8b5f906371c52e7de2e760b820dce5c3629610a48a036cd54f23ec3ef274f8da724f45c482505864c87359d4411cad79d7434c9a9d79323410b671880a344b933a47d735abd0e63308cf7f6e15790a50ccbcce072526952c763775066125af0fcde57ba3c514301aef17391c76adfc2419829a88e0d91b947d278cd03d94ce98ec639a6163eaa9755b1813685080ce588251fbd4240a7f65cdc1074503b0fe49b24996e52c6899ac90014d9a58566e841bcac357ed59f7e7274b6e94f7a526a5b420c5d6ababab7e7f8ba6ef6f3455a5aed80f4aaadb58fb38f725d524b4fd63238dc7936d62e81ef46bb7346d7f55c4fdbe7606b1053f6faf6d80612311823efe1e6522fd5bbb77c52c868362f263e56ea1447b612d681828561adefdd28fb855fd81f27e2698cc02bbcf7d653cf8dc9eea252f2b1f48c0d2ab70ece454daf9b5829d7106eb8ca8807eebd07d1bf6af6a4523577db893995778759e1be294aea8edb9226a9acbd44f98f60641f87195521491e621b10cc2032434f319e76743601a0bcc99fb3636389172a790e25260de7cb58961f9ad44d16c7604402bbca8cf82be528a64107c0dd114fd3458c0f1e97888c1c739dc678b43b202c603946cb5720a1e7331282a48afb12b461c41b6fd92b97c6960ac9f664f509b02c8267d722f372b007befada669d4cc36fb931763ffd8744b10e78cb849d40f88d190778a70f902faa4f34cae0b9e163b59b1bae96a933afecbc6a768f1d7ae20bf2771f28c1a3d333ae0b6f691d2f985e1ed6d0e1c29d7db36234b9bec18a1ee98b9ae90e4706d1c952f6059cc4d64bfc14152a88443f260d179c705df71e006a60981fefaa8a51c9c368680b830967b01b60734b9924335d7700b083bd7e87b3ad2f3d497e914368a15c5456d08861fb7513e96acb49935dc3f46fcaa297cdbdc759cb8a5a2515a482ca60440da8b7d5a8c79659d99e3892f9086b372d78622d3689267652c4dd60754cb8eb45028b0c237adff5ffaeaf78ed5a541c57feeb014a53e2a98042d5712d5f7a779b7a12bc120b8cf6df35b258fe1ad7ebdbee88d25355560fad504dce4bd878df5e43c55e765ac324dd8d65ce29c2a93f9e085bb51ff75dbbf314ed6aa3a36330fd146d28654c659f1c6c5089c3619be1c7707be835500fb15bf873ab35517b743207621346db75d16fb21624c04ceddda2d607642004f611db7414e1c593ef38c62e4d27a8b7833436609c284a46edc9b973e790aba0bf4c6bc0069ce9372c6c7b93d15740771ddf9c704338f4af870c649ecdaeab106b1242dbb74c284bfb5d87aa688d27befe1dc0d1019fde1842e89eee67e11f925672ebff47e4503e02fa989297e9461d540000b5e0ed2d957efc3b77a10181597c7fb2c94e62db50e46c46d10c1127573bae01166170467b7641d7e07dcd879f04b8dc08dcf460bef8e83aae33151a72eddf9ccac4eb95c48cb4008ba3fea542b2e3c6c4c07850cd4ca551536a20d18ed18852baaaf7339908583aae41f08f3c6f5811cd730e849dc8382e8bdf3519ab900d38a0a9822400d619b52a957b1bbe8384619e5d65588a2ca6bf068ca27fce9aa0448a60d04b3b230db3a939409ec7df45d70a944b34baaf0bf951d205667c8281e9e87468d1a2f6edf79a7d5df12a8564e56d3a952efa4c4be2b09be2c3d699b05268e8cfe998a9f37b8714c92647ada8a8129bc4084624c6f1059f834193deef961f5dbfe500c1bf781f45441984d52800d81d814a82ec4f859c7217146ac447c8462612574a1a8603148ed46bf3e195d417bbe43aa6bf83ea8fb525941ef8dd56149bd6fdcbf626609ddb699e40e83fa4792b39384eb0d1b78c97c6798537b192753caed3a5eaa4a33d54b473b43851cb282cd857ae11a4d34c6b53fc1c334f8ec42672295b88a326b65d338a70bb3d5d866ff55a9ce0345c7a890cd6dee36012c76d862802c9cbaf1abbab99dc898eb432f50474ae6c202121d19f8d0467fcb1279457accf9b777c75390756762dde795d94aaba4c1729f559adc33966fbf517fc91fae21bd8ef22e914bbe6bae774246749ad63d8d16f21c9aebc80a97be408443ae60af610dd3ad9964b2401e049b09dbb46f6126d3d534a7786bb3663719943111231d18e51ed534b1e28807c062280924e5d53a8a1316ca2b5936911a267d5b799fd7d8e5e725271d5b8eb90e3dd9ef9eb1400c68eb8f88622f548af7df4846758cfb74aeb48588d1820f504e97ae1d818feb7113175b04e7c0bae6239672c987253cdf0e9845119f3f200d40f586ab986312144c3525acb78a5784f5707217105bae651e0c000792f4e88c1a924d33fbe5474a71b1e193a8d3a6a65dc485f2a299e7d07a6cf621260dcfc5d79c9243618f57507ca025baa53b3e684667f33dfb8ab9065cc548ad5c881bceb5d937462ea850fc197f5ae8c9489815b2cff853895e987e684195a094d8460ee52ef9d8f6fa0ba01092f0cdffcc7a682ca3125058ce9ed0064d7d0a868b0419b49ded3d93f0c7e1d700288350ff4c130cf6e0b507ce6064623294536c8fc4011b9b40299bfe02144806411d5b36997db26033a5ddeecd6bf3faefd3ca0a6cb70b0561106b2dabb06cf88bb6fa283e43dcd2fa1f33063183e15450385ba6fed4436502211d3181351db793a76ae11ebde2b23f340b7522748a4602ec469b88eb7f3d1325baa536ab8096c58c6f2b4863a541f618112643e194a5873cdae4172bb3005743782d8af22dbf23ab60e7d0f4ceb3ef0c46e23e1ecee1839558bc5c146dd97aba7651dfd2401fb8aec4eda71b1b15a2570130f0f5ff489ad4355a708a6eafa9752eb5c9f7a83f43c3e3b317e7e68133573f585fc27c5cfc0d90016f5be8594e1cfac36b24570cebb5be46d3f5917441ccadc355536b8b9b455b87667edd802b77178251afdefe9a4b5f0ff7e59fa5cf9b449e18bc4bf8154f15913128a2584f7d60a3c09f467233783690df422d3d9982200eb604ec2ef50830bba6f82e8b91823808fac0b07bc0e51a671c32dea0f2f9aa2cfbbc91cdf54b719b6009ce750bab1680cac77398b2a619d550161fa70e7e8b86fb535f8797fca75708efba7f0d95da4ac235d9de68a50c998a72c0c2da90f511ea456f776c881b8416b894cd835ad13c62b035ef4d220a66c86c1c00de534690e42d064bf4fff946af98aec3f9490d6f0586e891d272a4bfb776ab84bd693af6526c4b09beab2460634d929bcc61cf75b041f067e7b503ecd6a80934e169ebb0ac926a85b53cb1d7b63eee6abcd9e250834da6e4da23b3b3d90c2f726861760ca14b78d5e895eb7fa2e8b39f724a0371412b1c94c6a42f1beeae2328e353971531bddcda730b6a0d90f7c58e3ce5953cf5a6c9e3fd657c92fe4b5b8b0b659353944afa5c69c309527d6d4039e78c675c8d2f527fbcb2b765864fed987f785221862bd7deb66e6676ddebdd19cf4cb26869f562928dc98088bb69281615fc6a2dafc466e70ff9ea1a411e1a3ba3f94ed7d429796afc9f0c95da19a4db691c36407985e5f08473dd8afd9de88b2c26b6ebd2ea35177238e18dfc36d579a80074c06f5cca60cf6d64d27eeb121c6c8e5e09aa3165c101068cb748694695e803540d947f33740d30616001448173ef57bbcb82fcb213348a2a58e2d14480b1ce1ad346729631b91f7e343e37abd8e787274ff4598acc99cc58f3578979e6e6a1926333bd8818a256b58e67c6f77145ee26f24998cab89021423e03326c175adaa8ea905122553948ece311cbcb770222e7f4f373398497c8c301480d031fc53c2a7018d91777cec253e89e28a82d15e01c12c0ccae1b56ecff35b90b19769bff4b786d4624679abe852780e9e4b9985e0564ee604027dc2a60f65d2fcf1d354e163a8465f77eb67e2a6c9fa89ea0768f9cf117fd1ea8969e592da11d34f6f9b7adb24f3261dd14199fea6da6b5d31f825b3706492b3305cbf6ef553fadfcad51a0484f09a8d2491c8a937fdd36d9e0b94fb6bdca6e80a6079739cc1d455fd735e89fe89938a7132dc0c9f181953dd9cf2d106a3f1478b46ddf35aae9bc6932227d79ac4f534967be2cbc30fa254658b61752b534257fc10bd8db219ec394b41e7fe541f9086ce19d28e13d2b3c384745fc88ed0cb5ef414e23e8782f99307c49121a733875e9fb9c8559d8ad6bab256dde2bfdee4286c1419b80acf55dd09da71116c0fa902d8e89465c313c311f272a11cd17417372dc74e01f3ba1a9afd8bcb9fad57cde63ad59a6999caaa359e6e5b4216dd3b0bc8d310e28c8a1232cefcbd5070d0537097e370433bc1017b7b1c4efa694a25b4385bccbdf79affb0b6d203b3cefe637fd6f7b51f5ec297471c874a57145b254bd14b89fe62709c94ca3cae304739294c7b4a871768e11cb7a2db0aaeff4abbd00c70b4d4e5e8f8c6d34afe3d619404e20ccf628f7902c17ab1200644fe465751587800d59acb3abd1f8ad9cbd8bfa64c94c44fb3086fd21c046d7430a1faadbd9b1625ee70c1071bede890f1c07113aed9b1a35ab0fb823e2cb38d2ee6376800f63d28326ec3be129333e1024d17c46198e329779a79f4ee69b56374268fefdd29995e411052bcc92318c636aa9fa634f3e537712f720a52cd95d5472cdd6b4eb66bd1ed2c41cb37c615eb486855671d964ba46ee44eb61ffcb0b22b20632ce3222e4c3037f348d5dec196f9e2bcc2335284f5529e4de9e6b4b84fc559de63357bc8ca0a00c16bdea79372b13abb251fd4bc52f1f732811b65b4c51715da133b20caba229244060fdec0ad4c47fdf1963b6aa1acf998585c59867b5afcd08958dceb9937a97e87b2153f45970ca77e5524c5160c69963717630795e3a4768e2521617bc211926e5cb08edea70cae99c6d7eff4c1e041c7ab0d3473d6ceb3cbc24a9f45c5818896463360490911b1fb77a24aa3b394e3ee1155ea2fbc6686db2c715670dc9187b33f3051b4b894b616bdf7fb287113c315413d83e0540676fe9a48d523bef3280611165fb77c7bb33c0a087fc06e7702fc7d8ea4f7aa264c7ed332af03ae3e392bc0f96ec11e3bca6604ccb7941043fb043b4880de676efaf3f0fba185e90db8e8e6718058fd1d26c49d0a163264d4aaf7094d02d6898f75c6edf2e49edf7b0a645018220535e8694baa1e910df6e493c0812c2cbb16966cb22af208279947f9490f2f5d3a49596050604f920af8fa41c5a339609659f331f24fa0aec3787d052a02541137dd1ccdc30970a879e4a42e491137bb3cddf2c87ea6368bc4d9aad9089af50b71d56bd296d891ac2fbec84303486739a44850680353efa2203d7fcfa00d9cd81433adcad3e6aac009784b63a3b7aca58155b24274b2d41de998321bdf0229ce74a0c61a24d74ceb30d4ba766632c4a48d9db4e3b3334830b12f3136158fb16fa745c2ebad16b65b279d28332894755de3e7ae2aa88f9e2af8a46200c427540eb68907152ee7d53212b55c170ab67c47c884db89757b09dc035ea59fe2be1f384b3edef6925c399753832d32296100ca4e2699154d6ed86bc145e92d699e43c2269ed359a004aee75ac5e730dffec87f239328bc95cc281a9c0bba661f6d36ac11d1151851c70cf39fbbabff2190b619294db73008e3d32acb0b29aa3d28d1e50784dbe35eb911d838bd710336612170666ea5f42b72c32be4d83c4ff61987acd1b1f0cebe281806af8ad4b6e7041c31bcb8a93cf0f44826821b0bb9c053468b4d8d034c084ba1c8dfcad9fac6ec379da5425492dc6f770000000050bd9a930ead9e4faf5b557eebe4461320476a7ae12b0dcc9d171f6d2737b824db7259e62915779dc5e8a08bc69c0c68784202aa3462bdff06af76bdf9f106dd6228211534c4433717947dfaca4b7b61a21d706217e3718b5ccac40c3c4692bd59f222d0c2e98af1ff1919256d7b0540ed69b11f212a9598c7499ba634d1677ecf17517e207d40baed5aa0e25b7e70b6b16f6d6f0c36a146db0644ababd31bc50f5039b3bc4f12b603da2675e121b09fe92c69548dfb9df18d0e50c1387280b7bb1366bf5bbabfcef5557a05ce24df1a02f22f791e06c5e3e21e5fd6db7f2c90ffb83b154b0fd9866c46609dc10b274954caf80e83693f5581f23fd765a18aa4e294bbf7a8721015ea6a6e1ba64f79f6609924d43757fd0752024af79e296415b42de3428f14d9d89f84c2e076a0821cc8921fff677ec7b91178bcbd755ece28477a6bd01fd429d824ddfb62edcdab7c4495edc5a3d27826ea4bddaeacfa7cb17632cee0095ca55d3973812033d96ec5e5ed6880b3a998b4998fb7441e11dd060515bdbfd5aa32aac6ae1fceb8e92d7e8985949946a458ca2f69637de6b92410986f8fa5ba4b1598d8383fdbff2e004dee71500302e3e9270371b39237260bde0888702c7b2bcff69192bd381cfe59b197b9dbe5e2eee27b64c17e95a1dade453a6f29dc8bef1bdd34a92a5275972a2cb18f6f553f99c6098f50198b68cd35d2877d9cdd15074422b43b03170f23138dda44b62b5e161705405d2e9a007f8cc9ec7920d1a6e947ccc57b1a51a728fe1afcb84115fe48be15c894cce96391ab3cdc1bd9aa4cf58213c15d1a849c3f38c8ee34b208766129bbb493558c139f2bfc39df29fc73422127823fc9c993f20d9df9e0acaf0b1729437458e0a857ebfe4a373fd491952a475e9c391b7ee02b79554807c0f12293aa385a3c6b18bfbfc690a7aa9bc85d8adb705eac642ec8611ac62d09d2a6892cd671629d457c2191eb5940114113ed8cd4e8411d96200d3d66f947baa7915610c396402d38f109837d29c8e937fb6223a9d0d605a3d91312908fb5a7df36122c35f7e47855d526915c3a7cea432ca4524fcae3b5c6fbad196c1efef0d129d9b3f9d23104fc3c8a90dbcea0400311e51de50c5abb62fcbedf998ebc1cf23fd76bcc2aea2451f6d0d3b8fdd337ce8d24d7ce2a5b29318df58adb0006d4295c138b4b03060134802626e31a5da92b5a7a8677132523affbdc8d958b955eb4615370497429cd3767f2f708c2cadc233bc3e5efc8c837385749da08c6dd573e3b105ce459d659f790dcaf53c1d0b4d8e0c64b6bce15559e59e66b3b0b2695703e9bd5b1c5bb3c5b1028441391f8fbeadc032e890fe5e3be78569056d147a891f4bc85406e78f962b532eb436b0e047a7d3c88bb89455ffbf1da360207af5d827e9fbbedd8393a828a92382329ff444d9a8128c40e302453550426de4babcdee45108e79533b9747fd21b8f775a76e1d4d54a8a98a65ee3c183be34172877c26e600c89949ced85004d69c24d4fee6f87d2ff24900d41577c78dfbff698d438c0e26ebe15d7b75b49a5b2a5c627da3b13f6458aeff3f0a1944a339b4be5e13d58a71928bb77053beaf7b68568205b62f5a4a9b3c0fef441ede90f012047b0cf2228481fab85d94219ce9f417e4e2b6018b319270a6b6f0de93d0147842f582bd4e41f00720626be2b2f9116875ea4f92e380bcfc33058505ee0336e10c71a5abf6f32c72fe68c68c166454db8e101b3a271f04e4dda8947743e0ac408c73cff69c10e7c015c6b078bab0a1c7aab14a26df087b2b4c859e684aebadff5033d1ebd6c6589a27ac75a075e6ef801f5dece0dbd1e477bb70d2b8553a88b13e304e00735e183feab89edf469cb90c0a5bbf778809a9996f4e72b16417672cd97bdd1c0baa64ea2d782aea9d58ea357b54d06f316076b5c413417061b3c7485b534fcc8bf25d2adf043b47a3d47f0755fe6225bba7569fe672d3507c8e15f7139ef7f606c616c52733413befb248eee53c4a9a16f952ac56e18e221626c4f51eb90c1314167c9677a7eb7004b9b42fd6ec21dd38d5b9032c441166be3f8e9dfed39fb0e654ca3126003decf8e50bf8ace994e16fdbe3f53a36a11ed6f06d1bb8e54f574a83035eba379f2453f2346d11414cafbde87cb5d66b650a5e25ebaced402188c1b4b941e788e1af908fff3ef84c1dadef0550687f0b6aeef6063dc1c8c8efe09d611253efb4d288ea407ef3c043aacc3dfc19a18449b38fb97d9fc0bb67de3e1744f782d3a9d1fc449c3a902b1ec8789e336f731a51cc7fefc43736e04942167fbfdac9f15c5b3f921aaa3df0c9709c21339ce890cd4054828615f18fd12548258440a06dbec3d72719b3e9f5f9967525f90f16993cab09c9eab2b27b29c959c002dbb028cc96297d40822772c16b4b786cc57cd581c02f143d6e728eeac1ab4eca6170748002c0e2269611a2b402f9fa8190d9216b1e1b7de8f81074b8dbb665f0d69c52cf573d07ca0752fd6fe7da88dcf4a915ab1533f5686b766393fe9bf1aeef9d17414d1803708e61973dd205097eb1ed466c8dcfb2c7710caf9df713a11c774fd0469880534ae2ccd1e40216ffa145f0fc832b166896810a678f3a47dd24bc2e6835c16e405a444971068dbd47926f430871121be8f19c8ac4fd0a9e3ff7cd961f90f24265de455694cc291de76437953ac314b1791acbe96d3fcae4fa397287a02eac86f13c931f4d4f49ad52cf1db0efdf7027ee8e468d64d316a2208ae33d8fc3274861b41f2e064c99fbba37b7a0c46a3df8dc4589de7ac28df63ed697a48011c863049345c371f10f7d53a56947e348d07e4ff71eaaaf9aaa09bf1147b80d62a60dcec6d7dd4cbf52f2b0b89d2c7de1f16d63ccc0260b0982fcf105736b50001c19eda998426284713670aab21ce128a80b57920d8c3436edb859d4afd7ed835985b5bec01df5447e66ee8511b28671646e71c0669ab2203c4c9a020000279ba87f089d04924cb33ff82f59da9399ce3f20932c073289938e4e7101d357cce920a2aae72f94d6e1aaf9a3905f4da18a7ee849a39f0d1e83adc67ffab826490d4bfff1f80e8c2c180b08e013daf6d054be660390fc4f872b8d60f14951f05ac0dcb4c4281f71ac2d4cb4d68ffdfe8f5c43160d99ea0077486219bb9400a8fc1faacf12878379a7ea5eae2adbbe2871c1664bea1985d594963935019446d605a61ff79802e114a34610d002cf27e0f4b96c6ff880785307161813f48b68c6f9130a6faee6f332e77755fb68b68248ec113030575b1c262c2430c000d11b269ce4e98a32eea3af403630e83aeaaed1420c9fd66eadcf34d6d1fbe457c5216481ddaf6b397912630999fbc5298eab15ab3cce9de7741367264a4e30a61ff7f1d5e7e64290218d9f6f5c9898cd23ee1ac35ab8d3691bf3df31cef54c161bdf3093390ad2322b6f71f22199ac68c5eab4aa7523b4957202751b675fe82c9d42432c92c2fec148da6e5514e9d5f2618d5a616cdbc4a560b3e36eb6cb8baca3251d8e819ea8f552f07ecca0664e7ef22a3a6c11d023eade70f1b872cf58e89c625f561e4858877e39d324dd448b041e4435b676ce0e86de9045e8b9e8305ae60cb7a41c01ce2318af7f9fa011d24aac2b2d31360ce7b437c46df5756d94d1005a0359b57534c49d1e8e173ba183666a19ff6e6c63388250985249eb40f0f981a2bc34e8196e9c468b1bf329c4ac9cf5f19e46734b1238f99f1e6d8c95ecca9cfafc15c756bb4780b675ec9781bfdb583bd91a7df33ed49daec1d65d14f26d7cfadb9e1de06e922939e924b034e4d128cd66a2f7a87c9399c622922e6e33af68c5115053f42c519a054e295b5f8e420630dc116bb2562ac87a6402e4635bd6c6b95943820f86acd5f48ac519b06f1b0bf1c7a70d69e84c95600e017a67e64536197447b810c21cf86a9d09c37aaf6cc39333b414844ce883cec0ffb23e36d5560e9ff6922a9237a6503c72346ebebf57e59c13e7320f670e1826c802b9cc674b55284ddb061e6e38b16c58532497709028ccc4c000604d4a72b3255170a217ac411ea68e64fb3b63653b985abc42bf21629775a05812ef159992320c3cb93805bbebb250e2f9f92b2c8795c388fea24de5e70d45f8ad1764a6e39a1d588191f77fd7bd0408252c784deef806464edc1b4d3de83df34f1b615e10ba20948ca9f28c4f435163e1f5a6fdd0bc8ef397c25b7d704e1ff1dca065022b99778c05ad39f806c3f7ae4278b768eac09b7d317ec5e07db3fc5579a29fb42658ba66c68afb3b8401b2e09c13bc0652309b26cfab2febc3e96a6da6341e6e860468aca74caf06bfc576124594c3f123d5e987319862b0700bd257cff3ea8abff23ebf1a62e575741db2902761578de5c72f4d37bf9186c2391dfff0fcdf2969df27ac0c34d3f07feb0d1887de871e96916add75c15ce2f795749ceadacca94df5808a1629ccd906b3776e7c2a9e94393243de87656432ec21be389731be9821fc035859fffd503f9c8279bd4a36f3be1e3ba0beecaaf6ee44203d8b76c4ca97da38f63fd07ed7812601ab9095a77d52397ecc31819b91d3c28f639bda94c46a5d527abe34bc579338a4db395c57dbeec31a37685ee8121284b63583e026783e47d58deaad78a17e9a946ae7a3db89d8d78d9f37ee5861de7ca92e7335dade99819ecfd63770413b17de97bf403a6d97e163f7eead7d8c182b77cc3d0e0f28f30839445ef751bcf4f21b5803a4e8754fd9a3addb2553ad1d81879addbdc2668e5f2e15926ed805ce7b4ae01be9677c322d59d619cfc806a4946f59010aac481e49d0a0b2ccd0fbd88abf07d4912a081c81633f4a6e0e68eceee686d58a43c45d3bec1046d3bb8d7fc727dda7cfe22af174219bc8e928ca15ff9ce2c707bcea190f8fdeb86a2dc99d7ca81b78efdb0062f1967bb66132164d227e149aa52f39af5e763705373c864323a5885dc6061b5a2ee5501d0b1aa465d93052f29d033a750b1b9cc85fddc0cf168ddc62fb2d1570458d246906fbb689bc8ee3864901eb43f96c19482a7ba7a52fe08b241a32aa9a2774359132b5e1905a08ba37244265070f6d69a428a5834f10d9ba45f476f9e88e856ac223d8cf6ff04894faa2590ecd0a3f6938d661d8aecf6223ae99c414962a86fdc1c2599cee39e9f0153a57ed809bd90023c8d688cc1aa7b5eec5fcd01d07d00100", 0x2000, &(0x7f0000006dc0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000006600)={0x20, 0x0, 0x4, {0x0, 0x5}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async, rerun: 32) newfstatat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', &(0x7f0000000180), 0x1000) (async) read$FUSE(r3, &(0x7f0000009080)={0x2020, 0x0, 0x0, 0x0}, 0xfffffdca) write$FUSE_INTERRUPT(r3, &(0x7f0000002240)={0x10, 0xffffffffffffffda, r6}, 0x10) (async) syz_fuse_handle_req(r3, &(0x7f0000002380)="d37f438c8ff0a793bb0fd85e80a3add0f8f65f17e46f60227e8b09439e47ae441d91f7c50d52383be1a08cfa58969071ef9251774b2aa82db4b537beb0834e94c9f625097a9fd8ae5d86ccc28ae9a5fbf7a931329d6c0aa28650849abea29afd035f5eb12f8126d5b8c277c8c14f25965396c229226cf8b0c6da769454f1981c1b0a8180b80469005a03d24fee1d6f5543a43d7156a0da6f40f6e4344cdfe5f96f373459fabd8c1fb029f3cbb965f11e04c92468dc54884926996135312816573b5f052907705fb31ed724a8097b4eb9a547bd0a4f9c66421393b19fe59fbc07bc8c6319225509823784428ca5f20741130774b9090811966d1de850ef61c965ba07e2fe52380c4bee79f58db0931b3d0c06cfac96c9e8676eb0e10ddcecb47f17e8c4ea80d3f67a9e04f5edae06ec33863b9fb5edf40c87fbdc5a00936d260eb32c3df5a905d3041a54d0fade7b220027169911111af6142645e771ce84efdff5ef5f3fe5b1efdb67ba83dd9f94008f787ecee2ec9849c34a8699900b3151e799fb1704100f2075cf313f719efba77efdfdf5e37379232785af24729608cf1099a9eeb643813fe492fbd86788f43e231fe0a6f3f0bf302efeaffa32890b1e48818959d7d2aabb83f062e356a81605f55da96df097b11471c46947910bb3e5e40a5a5c92077231d68efaec50b848907d1e37e18d885f5bd95d939ade1852a5e2f516781e1868f0894c8c0872c84d9c80fcfe085ac88e2a8caf63b3444f6d5f63c4582e766f1fb06a204d7b8c266e29bb43e04f42dc241b0f6926ea4b0340f0b3ac232d92677f2ec099b17361d988b72311e5e93d6d93ca3bb711c5fb979684f67f6ba32901b8adb223fea467157c55e8d5540743af46d36e6670fe21254ed91e207044db3424d42a63d780f2269ca3417aeb73632fb93dd42b07eff0f5ed90707423066f834c2881ae5272af5b3c04c6b9cadb8b234d24c5341696960a23f242837d91d6751695e9f07577bb81aea171df43b27c44ca5b815e66f63848403320ffdf2926f500b16e7496b835ae7a09288847cbb232e2e271cd732e38309d41ffb55391dc4a157e0c02505f54430a70a9ac197f5573a0b11722aec13a9adea4d8e0022810ca28414964d40cbcbf9d2704aa82637e13d561c4fed2ed602be375e547a7fa7198e6a75293abb3903d0b8204ba21dd369a79159cdd810162c2a2ee722bf4e43b7679dfb8b4ac9e768fb3d391fc4f1839f2e91f1c62050b8154cafb6dd19a3f8716a5c072725c5dad281281605ac02632d041accf07bed8135f4cab566db7e01c6902be5728fb01cd6b17edb8870e3417897a604ec795c440334b1bf9b6180ac13d13298b80b8f4352b0bb36ac151607d6ebedae06f8a0582ecd3963a6df647c38c64402ab29ed79533efbe311df5c29d9f1928371e99094f3e7d8aa3d277fe0e3471c6746ca5dab72d6ec161e05b46829c7b437cbbfd82e8600e53f23205f051002e23a17906056a50a0d402814df2bfc1de9906b2ab651770a482315e06146af144acf0beea22a5a9bc61931d293483d0f3bf04e62e89cce3e3ee781b3340f59f8a026228e6f3cab05f23ea71334eadcaa1068f1b67f1eee3ee1698e92bc68759a3534069de9132ef7d853f4e20dc1cac32b42a995da861ee19c52e8387528db1ff0245807a1fb19c1670bc3c56f44db0333d7568eef79964f00d6d242a3735cf372c844d6cfcd9bd8934f14dbd5cb907108190fb7ed919840429d4da052d95a242e93db7f07c2c1f8f141026e15a767cc9386b31a18ecc82c4603354236446e9c79ad6899049648b4244446dad02225c5837fb8b033ce4db1fb044df7131bc99316434f232b8049701d33235e581341c5bb08208703e4daa83c0d4e1ab73e8c0724d0e9d6be114927acd0b792ab9464dd3b67963ed235243ebbc16e6af057e984fffc2554582cdd6548d9a929a89b39650a12511ea208ea9553703ec994318d50cea6a632724b08b0af3c11a4ca9d95dba675112563fbd166463cde649917402548547d54cede66d711d805060beed06c79be0c682dde2548a899bb121926ac690ecf1220764874c37810abc3c64291fef538f8959ed50a4b9f6058b8c45735fc783f3ec592c022b066583950037fed74e12f0fc8f04db78cae682c706fdc3783a206167336ff9e4707ce741893beec04916626c4ed07db0a73bfa5d786e3f3585e4b7b37f3968f08f8971963fefa07b7311d4bef7b5a5d72d3c40297da80d995d866220e005713d69b5dec9a4481301e9aa6ba8a6bb1f911c1d9f827838edb81348231f3da450c1044c9c722d31a1fadccbbac0d82de32f2a46c0a083ec89e2baf21b2b1655702e7d58b950df5904f76f129d15c93f95550e3b52c72eb79a1e09aa253c35fce97977f881f61acc6268c2596b755f18d1c95be938b390565d780929c4c6ba4c8d417775facfffce5c0bcc1f075913f5477563d06b3583c3bdcc7330bd6d1a8bdcce29f8452668a9f2a613f21d5195ba1a1bf134e80be88ee8fdd994936b1b40a0f2e98723d8bc53aef7b5af884f5fccd3eaf2dda01278be0b26eccd63cf68278e06e59889b8b9327550b615df368d99bd6d19636477c4d592e365b0c8c43a23d434ec3d622184f325d6d1c8b704aeac87359d9c09012deb32db9bc034fbf10b4662d6618b4d849a9546f00ed3265c22807072482b0ea4eacad35e10bded78ddc4e4025c7ba521b709e4923cfa8b6964fff4ef513965c4c71a77447daf08f7ddd10f2319b57c8075046ed4820e135f883fd4358edf30fc9965b16885aeb0f82cef2556f67bd33c44edad1a2e3bafe648f5e3797a62931218a468f637832f7ec481526824ebb8de5c207733c54313add8a24131f6de8eb8ddab462b5ac7693f7b278b38728449c9d595af99ba5b1548fd942b7b8538456a261a3ee3a7d18fb3e6180b6cfc9adc76a1defa797b57bcbcb9cb47fdeb2316fd2d913dd4aa0239638fc5c3d29df965aec2ade1f556ad58c9159c9f1b6e05691f476c5ff73230eb74a891f7b285de923d1cab7cf1fe2c82cc6ebcee9dd0be04bbc4d01b2ba8c2525fc4120ffae3df6bfe44663ee532ceb5a21db4f2204386f84e2f51666af55cda90dba169a9cd1adeadd7c90322af2656c3166fee2dc39b2db56e2e18b6f7a24bb7b0494320d2000d629e93427d224587dedb5c196b1796fec0c526a8a0355951045677733b33cb42ec170f137b934c4c6e141a8f8ebbeb1970797a29225901780f96521939b2edf85b1a456e9f97d02782104583757126159f264d9ed95e801561d63f0ca075543813c732e75deb01e585fb5b7bdbd7311d9f346e512b36e972489988f53f42118bbfefd3a52ff1fb97f47eaab7f8baa8e1f397bf877588c1c898690885273e47c1bdce3f220f80828fb7489283d5529756514842974a55cd95aa5a75a18627897836311486300bde4fec1c312c735e5ba3419028cbeeaef709d97752a12f83650aec7305232f22f90b8718113f06b3cf48cae0b365c456aa17610a78454fb81020c84ab51e27891dfe6e3820bb8c4ce0a5f72c72f2523b10be64a3c05f76e7bcb7b6c9aab9e49bc0c2b6044b66c475988f0a078f53912a9c442a40243da943376c8f75e74eac306c61004f6a88a818e3e992c0ccadf44e48c95472359c79f04462598dd467cc140e665e57b9b98702096750b82f291ee11b80a9064dc4a0c790107ac0aca2166e4a964aeadab9ec1ed1ca686b36ff00f75a3a131c09e3297d0471b689475941d09e09c62d94840a6083b1e8d80c22c9e10f3575cf53fe80702e0ef82f43bb13a1128a4f76a1728da93d86a5c86fe831334442deb1e003c96cc40a65ee721e219c06c01e75176d1035ec855258d3fc565f0d6eb31910c3c4e4450c65755ca563f0d877861df816160dbccce49865e0c6e9dc7cc281481b9f6bb8dee95d6a572421f1b2dc1995e0a3fde00ae6073015ae4176519e586ef434df534667d30ab103b7815f5a992e51004471ecdbbd8d9d464e7c24124a928b5aa925458825024ad03ad526a5b08ba1b30fef04288035749c266612bdd5caf4ed5245f67f5fccaabc6b2d8994c395dc7f8ce00089f4eacefb18e65a2d9d04136cd9172ce5aedad596d11fdd4b599f7f544f92a398042821b7c1e6ffdf053a35f95f9997791bbf6a0ecbc69531d14b2fd6b18dce4267816ef2fc135b24d76be1b59e35fd76796e9fd92dcb38c08968d9be724eb8a22575e7a7e2649f2a27fb3fac57f6aa53917ae27cd8efc4b6469de6155c3b9654a70ca7fa318682d1fbbf7e3e9f85f3fdf91f96eba538c899f3aebb79fa0ff96f122859061c2aca2a2fbac5640807cc7dec2a5f37a84cfe69af9775a703281d271a38ce08adcfe26ad3df7d0a1065393791dcb526634ceb5c33061fd83b4e1c72fa175585e0f839c9651002896fc7a6ced33919105de91d17083c8f6985e24ffd0fb35dd558af58cab9003e1fb7f87075704396ff677ae7a99725ac2c50c3a9edb15cce24de9a734f81f5187099b2ec316c6cf536c628445799bfc13803c6e94fa844de4b294b6f9b7f96ecf666c1088eee0997dc3d925e45fe9157ff86699e68ad786e973468de54ca6c9156c2e30541e97fb7b845ec2acdbfab05a03009de8260b444c48c0e64940a441d56446b33c698631f480dbcd6f8726e4c287c262bbb6de251c930e717797af777283e0575e8e1304af50cdc493f429dcbfa518e592550e980bf4516ff177a725c59ed0f8d9384bf9bbfe024560062eaf58bc6dd4ad29d71a39f02e00f6ca44ea68b9019387add513c767693d5535e46b3ff697aaeaeffe8e85b86ae877586fd706fbdcc492208c1b61556b80af1f80b018391a4d409030d89e57c8c8c323c23805551954bcfeffb2c08f9043f24db22a9285f9edb6c66e1091b9dd8e51a228dac137df945491c53014a79b3e033305b1678d7664afc79bd04b0c397c0fb4a12fe3116b24e4d42830e3fb611b337f449c1e0e9667b09690b37789e45cc3007f4a56539c782fa41cbc30f8b213f36e03a1bcee413ae9b4706561c5c68e0ad645423eb5e799ca52a0cbb7e9468a7a0e253b5ea76f6a79a5dc9d72d5aab07703a814922f1fbe1eba0336659ae0acc46b46088b895846435a02bbacd4663f652c0e1289411bada43f1335d48d8ca7a021a60c8a19a8a894aa3375758a140bd040e24aabb0736f79ad95f2090a78418360cfba57398dbf3645bd6c964e53923ded0751512e8cadb650ab833ec3167e8bf385bfbbba46e0845e745810d0133cea434ddab18ef066caea680f16604baf0ee56b1f631f5ccf754fc79285af9d17d99346f7bcd7048dcbb3f0fbd6c2aaa415821f73e4ef5c09fffa911a7ecda2961342d0db95a92d597e8755e41fda1e39c65efc82ca82b22172b3e2017ec5bfbbdbecccc318190eca29ca4dfe393afbbaede3fbc53aa54fde14a1d98a3f0e673bd710d73a978cd7b37901915811c1a8478c61c4021792bd07d42a0e4f7f367139fd78ad1b6cc23c94bfc98bf73c8891c5c69c00c0aa4ba3d76472543fd8d2fef44f4fa928906a60f726a7aed2c6435ea80ffa1d91efc4a605b48845a1e66a7a79c92a869549383256e7724f796aa893c3a86c8c501dcef329d79d7ad5836cd41d48d0ddee68cd5dce8e59724bcf7a0d6872deae7dd15939db46b978fdb77158c3076ecc720b3fe3fefff15b28f7f1304c375a435f20c714576dfc8c9f53af9b6dd7d7ba14d8fe4408f8ffbd61aa0f1194e3c57d63519f96e42fdc97e7adfd686fdbef39bdca9a2716b337e406a909f3b2eed19e24408e8dbe91b5aa98fa62b6fb6f9f13dee6a5da24b24cd2cd859029aabb2bace5492de4985a19c508d2062e6b580bac1a55a41aecabf0d63f48315a6497f11a5a09bdfd1649203eedcd03069cac0bde4f7691e57e2a054e1c192f6d78f2647af7cfffc4daad033521b87103c5bbb81eafb0ff72c4cfc7beab3cd7074ed50f23021e917e85a0ea2dec4dd0d7f8efa68f15a1296ca768fac34f630014743eeeed57f80165e268c1cef7d5d385edb955195a3e44b8b388dcab72083fc2dc23d71913bb98ef2a34ad6df1675b936e294ebba47dbd74daa8098fcb627a1e17616d8775cf1fdec8676d57ce31bd4bfbe821a03ef251f651ce97dbae57f99c6755470e9cdd17699c568ada69a64621dd5625d95b0b550c596292b1816b9516cc7d8f02f8be32afda1f4357419b28363ced9bf7429e7687531fb00de4d2e03fe4ca448e66ad17c58d909df244f4f7ed265164b42273187816e0872e6818b8bdf48097d108f4c67ffa10038f7d2a705b4489c9af1284a7b34dec3e5b56f350c880277fca26427e0746eece173de1ae1104b7822a9fd45b262e5f3ce16a64dfa69e84f077296144f0c119bd2aac2251f463b3e8177dc259088c8a1794953b248b95e7c6e6f91ed45a7d3bce7e91ec72b98c06ba6c625bfdefc69c7416d89a0b1f3bcab5aed96370d74c6812ef0338368756f83f4be0331cde6d11d9a917483f25beda96af71882c3d4d1b3785932fa0bc93d611c919dcb116699db1a3d26ad6826937a984fa121fac7a45ff220520f702ee942793dbf7023b98c9cca4f150bccd29f26aff58e2255aa73fb7a7abd24b501bd403f24900d42e88c57494ab5ef8bacc07ff9904b100d709cc9b1018cacfa42d839476b7aeceeb2236e2c1151d441b167036bef84069401d67a1473d5d11cc109bd39a1fca5d5aa347c4fd5f6f3c12a8f5d1ec344dc1717f5e8e1aae6d7b7c42aa633ffdcb46c32ac667d933cb9fdaf6d83eefe77d8733a59fcf394d063efa474df67697f881991a34fa79bb78f3b19e9b29cc7b03ca7390b0ca6064a961f3fed249db4ff2c01840373b6242034cbac645d59743f1a90f372ee0c17efade2cef03e3f0edc640dfb629c6b98dc2f28ce06aff3574a2cbdb4b06fba31b2dfe34bba7e34e02a786fa4473d5ba847f4f1e644c1bad62ebd5ca9306219ad6beacb8a54ba299e1bad887293f1b65ff956ea2a562e290df607a608503afee3ae180d600f1d14a9459cd5a399c7e2c7bbde19c11ac869d34ea5e990a759e346c3d538108a277894d6ec7bc6fcd65862a2d9d0696551a4a37379feafb313a09f2575c52641db9f46f4cc5e851f67ce633572b6ffcea7b7c24b44b40d32e55e4f3b426e464c07741648f30d51fe3eb162cadcecf21b7182cc915ffd887e85c385b5989f87910c5c990d639f8d2cd9234c534400088ef49733c94f39131fd51d784a407a07eae6d5359acfa35994ec3760ca3866404a5faed0fb210ce1b849868a6007c8e839ac7518172928277bf2dc43d163d2a0f6146cca1738ec3526762e8e2caf69606a3980bd08fba42ec7cbf48d315e45b834bfb14221de8259250c4ae9590520288c73bfc7d8076d3fe46b772491173ea0daa76cb5cb40637a038ce734d72c0c020494062843715e762d71a8f8518fa7d837391c06b62c96efc17651158657db8ea9a57634b0b5628b06fd5d568fb02185a63a6beb56013cfb4fd1695b102fb58f39161232af39f6d87c5ff6af247df3d549b7f6f81cddf4e3cb12b18634e69df5af55127f72670a3104ce5aba7877c32ee4b0cfa076247a95750e830a240b092baec2f473e83581e5799d69593247f0e78ad8e44c0e0d09fc55888107c4badcdb20b2c82d5915b3b03060e53d199b20b29ad6742655bf62343421f826daf1a3c0c493c96bf719bdf0a8dc9a4fc3f75bcebec3aebfd898ef161cd4e2e33a142c36f673cd8da72edae4f691a42a047562f91f0e87972e3ae5abb75e352f28c81351c4be6a34e5a01b8ed8461f14e21d1afc9260d838b43e9e2ae078d64b6c718232bcd2b26d3c57beb3c605e00c6f9c1031a3bae4b1872ba5d6c23199253929f1cf57a2e961d798ca9d315fa6b9855c8e7efcc24ccde498a3f1ba23755360044f024753f886f97016bd45a56d802f3e9e040a84f6c46cd5aa99fd4471b97cdb0bd8d265853fb79c42b4cad7eda49ca08d3cefffee2d3f1b5f083a06ea4be4b0acf84ca27e5a8d579d3135f3e59bd5b823b2bef7708189f54c8f0d576e4c6bdbf932b55bc792bb302cddc5c555e4903eff45b493f9498f7bf184035335ad1ba1547795a443c9afb30f932e7d1b042fe1690cd34d98e2331cbe38108be26f8ed615590e8bd99fd01b700b21e6ed61de92297d8b447c723089cee359ccd4517328d54ebc43a3f9173698c4362a6130508c9a0ea57b9a8a74a997a21e3e2a7223ad3debd80f70aff2eba5a862aa667052462bf6635eca2dd3350ef70fda58f8492d34c5b819c802f97b8765680c39fcab3b92f8a8be88a93b5bfc1dbba3fbfd3051c4443e766f4cc6a9d0f96b66a081e9316a44efe5973479ae74bf13c18711218f75d7f4e6f70b0a34ff2a1aec8d1e3181a65b4d5f21f0c19789a2ff90ae5e1298e707628e97e6a5048ac29d916193577506a7f5a9cfb0c73d16a67a2e1f872c8026891e98df07579877460c845bf967f87d75295ed29ddf626340f313bb35a04f9304e34773eda19650f25a08b2bd603297d9edd7f7d1b88d0b18e7bc35b0593961e7403a03550a20a0eab83cb00e659f5fccc189d14b28f11b8f55db517ab124b3718e70868d2131c74640bc682ee785a75cf960a79fead7965d0798d98e386598efb5ce92b0ceeec4e63e2eee3a15642ac72691517c4197a667de3e57a56e2d6e4ecb5a2bc401f90ec2239baf6a9a418267fe2228f7776c7f932a048cd9aada01c2e6d9466ecc434ba61eb97a0d6eb00e719940b3dca3ae25b94e9040ee238184eeaf46e51b61d855ce476d10dd9cb09df18c585304bc4f9e88060e4bdd6e624dd90d7ae8874c0af1e17e67d3bb27babd15880cc61f22b6a0b24df6d03faa13f0c918a7c8078706939934d9ae90edc40251fb53c9fde3ee255e49c8541d995a644d35b46ab202e56ad1de3da1c5ee587f167b398392d0fba4a43eedeaccb0ba16f571055381fe3885490c71e0805b1b3186bf2652b9a9df69d8d1232cf704fddfb5e7d3ff78ba5ae3b843f4f9b82161e223343240c33a9cd21eb312806163ebb2e60bc98b68b3d95bdd923f6ea831083c13ca65e4a06e999b2d014d0ed218d72c5b776fd21ae21d14e23e9074de20d6d16520b1061aa4db3b5b8077b1c43aa375c68a6243ad582a148dc6878ceb2ab6792cac38ef21765df51171436a412f60f5dc68fba51aae8c4909efa690340fd8a63cbfa4af6235c1c904a20578f54b9c91b1fb8017d05321e0bb9eda1502c1506f3d2939977af87d1f9329e237c129d5cb65e093396f016eb0c2f0aa5cab92a00259f6056532ef188be500fec4cd4614e29daf5b41da2b4742b02999e651c42d2f405344a232e36278785dc7a681d0ee2014ce3214f44ff9d2c3e083e18c299cd7cc8ddea4b805c673cb7479a553f28349235d37874ae3da878a5b6321e501c2b77470dd15b35ace69b1b8e3ba20cce47acb8350f206d136dfdcea697bf558bf3426bb1e0ebcf2797a1c7a181fad43b8c68633b361d40868c279896eb1c628656a9b57dcde8444ff92f2cc1d2dfa1998054487d8fcf11b852019ac21ae0582b1c8f4ff90f31d862e20740d7b803b0f109a8d1506137ca58167e8be1d13e6a5590e2bf2af5cbb7e79db2f4cdec83983463e1e830f54f8534e4c660039c0d372c7c757be3498f6be9ff6b6d13b88ca0ee07a0fd4df8cb13de0fa094cd3b9eb87032a6aaa757a6391ccf98fa7f9d99065b4f747e70ca497af77fbad520c589445d3401c67972ff7e274571b8c35a17ae78de90c81f791a69d70975208153f94ac7199c45de1ca5746887ec677452fd1a018b7287ac45e14ecdf1876229964153cfe6b39f1d50a9be63a0eb10016607ff338751cf9bb97c917d532be1174d0410e26dcfab873769b71db87758c0ad015b1db4b7565e244925ea0dc24313ac65f0355abcfa96c786b8ab7b32166bbf4c7ddae0d3f63d1aad63a9b105e05825aa012e075ba3e1c20b757e1dce75f6fe14e891a20988d365cb5e69206a1b7d8caf2effc73eb577330cb56495fbeaa6b7aef3467a32f53634e468208a8e55d626f98a2b51d39b48341c27306e59c0fc5c8058719b526eac245ce857288976abdfc9be1d4f220817f879c15cf0a258f89cd8269113821b0a1073165923748c6e8e0331ae9e7df11e62a80bf28559850cce385a98e0f48209ebcf69e8938a7605e96f4ffcf580b6c1df742766458763dc91b34035c12396b06ca5995b8feee35e1a3891cca0402fb9e739d8f8aa1a637b7c8c2c458493a323fbe5a76f866e2d9adf0d1d76950bc527a969f61c8519508eb5a93447d212e209c724aa16a949d8be1b14c8711d4c85e728e9d50b5b78b76242f9d59d866a86da0f129201a5b665611360ab3f4b678746cbba1b47884d2bfe4d3e38bf441fac354654c5077620cdf5870fda1fd5ca2bf4780d474a27cb660dd9d7ea83d423240c7ffe743dbefa3b922ac6d5f9544a7d5477dc44761a1d47633f67fe220f37630d678daeb62360b5f4f5d40493169f6554897c5d05c4909834fb2ef1494f8bbbf9e986761b931a26b0ab76b88d4f9b9bd9a024dc39819e0a139eefba8f617401811b4a7b97212aa82965e6008447979d19bfeacceedd48a24d65b8a1705d686fa8c44100d27dca9bc764b74345e1da71bfd9604e2f5bfdd28097f90e98f91ca81b08e827f7a3e742e6c019691afb612042a375985b01b94b3eb61a484fc2ece84f53ba5738273c80047663ec335d31f1ce43c6205a78fe7712626e8e6ff691b5bb9fe1a41909db60d8644d73936c4eb663bbfef030499c8c7d31f4eacae3cbf736a1eba6f85008139ba7eaf5f1ef8804f617e56c820c24f139b7036887f2ed2de32fd63574d0359ad4026e67c550b4ae960a2ce234a20e076da3f91a7ed60bd59a38e1acd7941a66bf3e755a431cead3f01600c6e47564167340f3f853efae37b036988bf4b30849d9dd5d0d09b1799bf9fadca76c497a1345018c8724065291bd8cc633e06359b72040a7673ffe5e86c240d043963bf2d76a0fbf50243a63d45d7f3358e1b9d1f3cbffd7e60429afee778f305e7d8f07c3e49a104f3a4e92118ce84cd11839f507656757d6e89ff296cf792ca2f1429aa80c8092b970d6f065eda3fb25b6b8a699561f8fe5236bbbc96f15860e29326a5a2671a88545a65e587d986615998a124a97820a65f81779b3101086e6f261177a66858d788c5c66521408a9e70238719614aa6232a3ef7a33e99d3b1dcdc20c33e8124b1dabe50ce9e4eadf34685560039e7d7e08f038f2004da7703bc4a30a28409719092e6640e743ee8a4e75dea106314a26ed5cae5d02bf9c8b0e96020a6b7941db7f0c311476f377a992caccff7f1919062f9db36ba72b29e9dc0880fb8eb24f41e0a6cbaa487058c6fbe6b062b372e0b84c9fcfd64d84724b6cda7fb3f582abaa6757782b20f9c1fad78f98273129caaa9496c1dbbbd167b52bae60dc327d1e18d82450ff9b6b108a0f20cbee500", 0x2000, &(0x7f00000009c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000045c0)={0x78, 0x0, 0x10006, {0x8, 0x7, 0x0, {0x0, 0x5, 0x1, 0x4, 0x400000004, 0x401, 0xe767, 0x800, 0xe96, 0x8000, 0x2, r7, r5, 0x80000001, 0xe}}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2b, 0xfffffffd, {0x0, 0x0, 0x0, r2, {0x0, 0xfff3}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0x0, 0xf, 0x0, 0x3}}]}}]}, 0x44}}, 0x4c840) (async) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="0c00004e1550"]) 1.724259507s ago: executing program 0 (id=4184): socket$netlink(0x10, 0x3, 0xb) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x4c23, 0x8, @ipv4={'\x00', '\xff\xff', @remote}, 0x20000005}, 0x1c) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000055000/0x2000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ff7000/0x2000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r1 = io_uring_setup(0x3893, &(0x7f0000000040)={0x0, 0x1000c89b, 0xc000, 0x800007, 0x41, 0x0, r0}) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4048011}, 0x24008802) r2 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r2, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000040)=0x8) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000000)='/', 0x1}], 0x1, 0x0, 0x0, 0x2c}, 0x4000845) io_uring_enter(r1, 0x2219, 0x7721, 0x16, 0x0, 0x4000) 1.595111622s ago: executing program 4 (id=4185): r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000140), 0x40000000040201, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000500)={0xa00, 0x18, 0xfa00, {0x100000000000000, 0x0}}, 0xfc36) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000480)={0xffffffffffffffff}, 0x2, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_QUERY(r1, &(0x7f0000000540)={0x13, 0x10, 0xfa00, {&(0x7f0000000280), r2}}, 0x18) ioctl$SNDCTL_DSP_SPEED(r0, 0xc0045002, &(0x7f0000000240)=0x6f3) 1.455269837s ago: executing program 0 (id=4186): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) r1 = socket$nl_route(0x10, 0x3, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) getsockopt$netlink(r1, 0x10e, 0xa, 0x0, &(0x7f0000000540)) fstatfs(r0, &(0x7f00000000c0)) r2 = fanotify_init(0x200, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x0) fanotify_mark(r2, 0x105, 0x9165, r3, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYRESHEX, @ANYRES64=r2, @ANYBLOB="f7f6bc5eb4a8c0a4f1563685f18a9d37a8054bd037d6bff798dd4b3465d1480b4c53206d6b60e7ec02df59213f0404018980d5ddb52c6dbc7ccb1fceb16179f16dcbc17d5be7d7c1b904dd6e3d74a505b9caeaa1391a1f3040f978050e6ec479bfa871dc18917d402526d19167e631bbc67abc", @ANYRES32=r2], 0x50) r5 = socket$inet_mptcp(0x2, 0x1, 0x106) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000180)="d8000000180081064e81f782db4cb904021d0800fd007c05e8fe55a10a000b000140020203600e4109000800ac00060311000000160012000a00ffac0000035c3b61c1d67f6f94007134cf6efb8000a007a290457f01a7cee4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5ae24e25ccca9e00360db79826835d3a71d95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703920723f9000000008af26c8b7b55f4d2a6823a45f28fcb1d", 0xd8}], 0x1}, 0x4000000) getsockopt$inet_tcp_int(r5, 0x6, 0x6, 0x0, &(0x7f0000000040)) r7 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$IOCTL_VMCI_INIT_CONTEXT(r7, 0x7a0, &(0x7f0000000140)={@my=0x1}) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r7, 0x7a8, &(0x7f0000000380)={{@my=0x1, 0xffffffff}, @host, 0xb, 0x0, 0x8000002, 0x0, 0x6}) futex(&(0x7f000000cffc)=0x1, 0xd, 0xfffffffe, 0x0, 0x0, 0x6fd) futex(&(0x7f000000cffc)=0x2, 0x5, 0x1, 0x0, &(0x7f0000000000), 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x9, 0x2a, &(0x7f0000000280)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x5, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000}, 0x94) sendfile(r4, r0, &(0x7f0000000240)=0x1, 0x5) 1.350726328s ago: executing program 0 (id=4187): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000440)=ANY=[@ANYBLOB="12011f00abbe6740e9174e8b089c000000010902120001000000000904000000ff"], 0x0) syz_usb_control_io(r0, &(0x7f0000000000)={0x2c, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$uac3(r0, 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r1, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r1, 0xc04064a0, &(0x7f0000000540)={0x0, &(0x7f0000000140)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_ATOMIC(r1, 0xc03864bc, &(0x7f0000000740)={0x0, 0x1, &(0x7f0000000380)=[r2], &(0x7f00000003c0), 0x0, 0x0, 0x0, 0x800000000000c}) 1.175313238s ago: executing program 1 (id=4188): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = epoll_create(0x10000e9) r2 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2) r3 = memfd_create(&(0x7f0000000340)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea_\x8cZ7\xe7a\x9b\x11x\x0e\xa1\xcf\x1a\x98S7\xc9\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x04\x879\xa24\xa9am\xde\xb2\xd3\xcbZJoa\xc4\x1acB\xaa\xc1\xfb Q\xd4\xf4\x01\xa52\xe2DG\xd4\xbd{\x9f\xa9\x97\x9b@\xdb\x00b\xe1br\xb6\x008\xe3\x10\xff\xc2\x9d\r2\x9e\x8e\x04sW\x1b\xb7\xb3\xa2\xc9&@\xca\xda\xdc\xe2/\x97X\xac\b\xb0\xc2<\x80E\x1a\xbc\xc7W\xda9VsA\xaf\xc6\xcf\xe1\xa1\xb5M\xa2\x85\xa6y\xc4J\xf1\xf7\xfcD\x95\xe3\xeb\xc7\xbc\x91\xb0\xa8\x9eo\xebF(\x9dL\x01vRk\xaacB\x04\xa7I\v\x86EZ\x96\xd5\x14OD\\\xe8R\xe4\xcd\xec\xcc\xd1\x0fre\xe86\xcd\xeb\xc4$\x98\x06J\xd6dD\x8d_U`ji{\xab\x97\xaf;l\x1f\xaf\xb38U\xcb\xfa\xb3j\x92\f\x81\xa0\xa2-g\b\x99\x0e\x8d\x8d\x16\xd9w\\\xf8\xce\xb0j\x9d\'\x93\xef\x1d\xa0H\xd9\xbd\xd9\xaf\x12$\x8d\x16%\x8b\x00', 0x3) ftruncate(r3, 0xffff) fcntl$addseals(r3, 0x409, 0x7) r4 = ioctl$UDMABUF_CREATE(r2, 0x40187542, &(0x7f0000000100)={r3, 0x0, 0x0, 0x1000}) r5 = fcntl$dupfd(r4, 0x0, r1) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r5, &(0x7f0000000240)) r6 = syz_genetlink_get_family_id$ethtool(&(0x7f0000002380), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000023c0)={'veth1_to_batadv\x00', 0x0}) sendmsg$ETHTOOL_MSG_FEATURES_SET(r0, &(0x7f0000002580)={0x0, 0x0, &(0x7f0000002540)={&(0x7f0000002400)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010000000000000000000c0000000c00018008000100", @ANYRES32=r7, @ANYBLOB="200003800400010010000400004017b402000000000000000800020049"], 0x40}}, 0x0) msgrcv(0x0, 0x0, 0x0, 0x1, 0x2800) r8 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7", @ANYRES64=r0, @ANYRES16=r7], 0x0) syz_usb_control_io$hid(r8, 0x0, 0x0) r9 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) ioctl$HIDIOCGUCODE(r9, 0xc018480d, &(0x7f0000000280)={0x3, 0x100, 0x300, 0x4, 0x80000}) 476.822427ms ago: executing program 4 (id=4189): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)={0x5c, 0x9, 0x6, 0x801, 0xffffffef, 0x0, {0x7}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x34, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0x18, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @remote}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0xe1f}, @IPSET_ATTR_PROTO={0x5, 0x7, 0x88}, @IPSET_ATTR_PORT_TO={0x6, 0x5, 0x1, 0x0, 0x4e22}]}]}, 0x5c}, 0x1, 0x0, 0x0, 0x10000042}, 0x90) 161.857623ms ago: executing program 4 (id=4190): r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0xc0042, 0x1ee) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket(0x400000000010, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1840, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000500)={'syzkaller0\x00', 0x1}) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) sendmmsg$inet(r2, &(0x7f0000001540)=[{{0x0, 0xfffffffffffffda1, 0x0}}], 0x40001b6, 0x0) connect$tipc(r2, &(0x7f0000000100)=@id={0x1e, 0x3, 0x3, {0x4e22}}, 0x10) r3 = syz_open_dev$sndpcmp(&(0x7f0000000100), 0x1, 0x0) ioctl$SNDRV_PCM_IOCTL_PREPARE(r3, 0x4140, 0x0) ioctl$SNDRV_PCM_IOCTL_SW_PARAMS(r3, 0xc0884113, &(0x7f0000000140)={0x1, 0x7, 0x1, 0x4, 0x401, 0x0, 0xffffffffffffffff, 0x9, 0x2, 0x8, 0x341, 0x5}) ioctl$SNDRV_PCM_IOCTL_START(r3, 0x4142, 0x0) r4 = socket(0x21, 0xa, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000380)={'syzkaller0\x00'}) socket$inet6_udp(0xa, 0x2, 0x0) mknod(&(0x7f0000000040)='./file0\x00', 0x8001420, 0x0) openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x4) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x101003, 0x30) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="0200000099000000040000100100000080000000aa15c35bb1c7d8f435c25c8819c0e6fc4eb38b75d5f322ee7b77070000000000004972e28bd6c6ac3d99d678d20b3ed94211dd028b2accec3f6eb5249c9ea0e59c6b18f63f4917fcea10d15227daeb77ae00307d19bc4dee0b341424c429102f19f0e5f505d6d4f5ff51b250fea353f41ced1c5d9f50f2ff409b74e170e333aa38e157396a7df6fa74250b30e82e2927fa2e997c2be7733602e43f14bcdcfe935366b995a5b1ef163fc7ff5bfe90f5d2be65accfce01adeaf8cf43966c2e5cb243994da66a7ea2a84058b7bd048072769bf8", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x48) bpf$BPF_MAP_FREEZE(0x16, &(0x7f0000000140)=r5, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x4, &(0x7f0000000240)=ANY=[@ANYBLOB="18210000", @ANYRES32=r5, @ANYBLOB="00000000000000006110fdff000700"/24], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = socket$netlink(0x10, 0x3, 0x0) connect$inet(r4, &(0x7f0000000080)={0x2, 0x4e22, @multicast1}, 0x10) bind$netlink(r6, &(0x7f00000001c0)={0x10, 0x0, 0x25dfdbff, 0x2ffffffff}, 0xc) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r6, 0x10e, 0x4, &(0x7f0000000180)=0xdb, 0x4) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x105000, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) socket$nl_route(0x10, 0x3, 0x0) sendmsg$RDMA_NLDEV_CMD_PORT_GET(r0, &(0x7f00000003c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000340)={&(0x7f0000000400)=ANY=[@ANYBLOB="800000000514000427bd7000fcdbdf250800010002000000080003000100000008000100020000000800030002000000080001000000000b000000000000000008000100000000000800030004000000080001000100f379532eae5e21bf00030000000800010000000000080003000300000000000000000000000000000000b8b51f56e8b8770a4f47582c98b10b303bb55ccc6134f542412fdffc66f49f9d1f01a332a39fe510f99af2c721de19b9b4831dc68697dbd1671942efa7e7921897a30484494bd6b579f15064de077b01f09a00f489008f36c41b473deaa6ea435de6"], 0x80}, 0x1, 0x0, 0x0, 0x10004000}, 0x8050) 0s ago: executing program 2 (id=4191): socketpair$unix(0x1, 0x3, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) r0 = socket$inet6(0xa, 0x80003, 0xff) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r2, 0x1, 0x3c, &(0x7f0000000040)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR(r2, 0x6, 0x13, &(0x7f00000000c0)=0x1, 0x4) connect$inet(r2, &(0x7f0000000080)={0x2, 0x0, @loopback}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r2, 0x6, 0x13, &(0x7f00000001c0)=0xffffffffffffffff, 0x4) sendto(r2, 0x0, 0x0, 0x404c8d5, 0x0, 0x0) sendmmsg$inet(r2, &(0x7f00000060c0)=[{{0x0, 0x0, &(0x7f0000000a40)=[{&(0x7f0000000800)='a', 0x1}], 0x1}}], 0x1, 0x4000000) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040), 0x0) setsockopt$inet6_int(r0, 0x29, 0x16, &(0x7f0000000000)=0x401, 0x4) r3 = mmap$IORING_OFF_CQ_RING(0x0, 0x4, 0xd, 0x8010, 0xffffffffffffffff, 0x8000000) r4 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x0, 0x10000, 0x1, 0x40055}, &(0x7f0000000100)=0x0, 0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r5, 0x0, r6, &(0x7f00000001c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x1, {0x2011}}) syz_io_uring_submit(0x0, 0x0, 0x0, &(0x7f0000000180)=@IORING_OP_SYMLINKAT={0x26, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}) syz_io_uring_submit(0x0, r3, r6, &(0x7f00000000c0)=@IORING_OP_FALLOCATE={0x11, 0x0, 0x0, @fd, 0xffff, 0x0, 0x1}) r7 = fcntl$getown(r4, 0x9) timer_create(0x6, &(0x7f0000000240)={0x0, 0x8, 0x0, @tid=r7}, &(0x7f0000000280)) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x14) kernel console output (not intermixed with test programs): _kernel_text_address+0xd/0x30 [ 705.206308][T17549] ? unwind_get_return_address+0x4d/0x90 [ 705.206331][T17549] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 705.206352][T17549] ? arch_stack_walk+0xfb/0x150 [ 705.206386][T17549] ? stack_trace_save+0xa9/0x100 [ 705.206405][T17549] ? __pfx_stack_trace_save+0x10/0x10 [ 705.206423][T17549] ? kasan_save_track+0x4f/0x80 [ 705.206450][T17549] ? stack_depot_save_flags+0x33/0x7f0 [ 705.206478][T17549] ? __lock_acquire+0x747/0x2de0 [ 705.206503][T17549] ? kfree+0x1c5/0x650 [ 705.206520][T17549] ? __se_sys_ioctl+0x47/0x170 [ 705.206540][T17549] ? do_syscall_64+0x166/0x520 [ 705.206568][T17549] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 705.206605][T17549] ? __mutex_trylock_common+0x15f/0x270 [ 705.206636][T17549] ? __pfx___mutex_trylock_common+0x10/0x10 [ 705.206665][T17549] ? rcu_is_watching+0x16/0xb0 [ 705.206690][T17549] ? trace_contention_end+0x3d/0x140 [ 705.206718][T17549] ? __mutex_lock+0x30b/0x1550 [ 705.206750][T17549] ? kasan_quarantine_put+0xbb/0x1f0 [ 705.206776][T17549] ? kvm_vcpu_ioctl+0x27f/0xfd0 [ 705.206800][T17549] ? __pfx___mutex_lock+0x10/0x10 [ 705.206829][T17549] ? tomoyo_path_number_perm+0x219/0x5f0 [ 705.206858][T17549] ? do_vfs_ioctl+0x116f/0x1530 [ 705.206884][T17549] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 705.206911][T17549] kvm_vcpu_ioctl+0x7e3/0xfd0 [ 705.206938][T17549] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 705.206958][T17549] ? hook_file_ioctl+0x1f2/0x600 [ 705.207002][T17549] ? __fget_files+0x2a/0x420 [ 705.207041][T17549] ? __fget_files+0x2a/0x420 [ 705.207068][T17549] ? __fget_files+0x3a2/0x420 [ 705.207095][T17549] ? __fget_files+0x2a/0x420 [ 705.207127][T17549] ? bpf_lsm_file_ioctl+0x9/0x20 [ 705.207156][T17549] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 705.207178][T17549] __se_sys_ioctl+0xfc/0x170 [ 705.207203][T17549] do_syscall_64+0x166/0x520 [ 705.207229][T17549] ? trace_irq_disable+0x3b/0x140 [ 705.207249][T17549] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 705.207269][T17549] ? clear_bhb_loop+0x70/0xc0 [ 705.207293][T17549] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 705.207312][T17549] RIP: 0033:0x7f042319e159 [ 705.207332][T17549] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 705.207349][T17549] RSP: 002b:00007f0423f97028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 705.207371][T17549] RAX: ffffffffffffffda RBX: 00007f0423425fa0 RCX: 00007f042319e159 [ 705.207386][T17549] RDX: 0000200000000100 RSI: 000000004008ae89 RDI: 0000000000000005 [ 705.207399][T17549] RBP: 00007f0423f97090 R08: 0000000000000000 R09: 0000000000000000 [ 705.207412][T17549] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 705.207424][T17549] R13: 00007f0423426038 R14: 00007f0423425fa0 R15: 00007f042354fa48 [ 705.207456][T17549] [ 705.636133][ T30] usb 2-1: USB disconnect, device number 25 [ 705.637613][ T5723] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 705.733280][T17554] team0: Cannot enslave team device to itself [ 705.767039][ T5723] usb 5-1: USB disconnect, device number 104 [ 705.813885][T17555] xt_cgroup: path and classid specified [ 705.868498][T17555] input: syz1 as /devices/virtual/input/input65 [ 705.871591][ T1183] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 705.891674][T17561] openvswitch: netlink: Tunnel attr 68 out of range max 16 [ 705.990694][T17567] netlink: 72 bytes leftover after parsing attributes in process `syz.1.3873'. [ 706.025719][T17568] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3873'. [ 706.038908][T17568] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3873'. [ 706.056656][T17568] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3873'. [ 706.057671][T17568] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3873'. [ 706.065577][T17568] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3873'. [ 706.065610][T17568] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3873'. [ 706.192367][ T30] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 706.338444][ T13] nvmet: connect request for invalid subsystem t! [ 706.348604][T17561] nvme nvme0: Connect Invalid Data Parameter, subsysnqn "t" [ 706.765637][ T1234] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 707.234891][ T5723] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 707.283825][T17596] kernel profiling enabled (shift: 7) [ 707.806977][T17599] binder_alloc: binder_alloc_mmap_handler: 17597 200000ffd000-200000fff000 already mapped failed -16 [ 707.988470][ T150] bond0 (unregistering): Released all slaves [ 708.009022][ T150] bond1 (unregistering): Released all slaves [ 708.043237][ T150] bond2 (unregistering): Released all slaves [ 708.213604][ T5615] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 708.262893][ T1234] usb 2-1: new high-speed USB device number 26 using dummy_hcd [ 708.284150][ T25] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 708.308210][T17609] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 708.425972][ T1234] usb 2-1: Using ep0 maxpacket: 16 [ 708.427957][ T1234] usb 2-1: New USB device found, idVendor=05ac, idProduct=0225, bcdDevice= 0.40 [ 708.434885][ T1234] usb 2-1: config 1 interface 0 altsetting 4 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 708.434915][ T1234] usb 2-1: config 1 interface 0 has no altsetting 0 [ 708.447352][ T1234] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 708.447378][ T1234] usb 2-1: Product: syz [ 708.447393][ T1234] usb 2-1: Manufacturer: syz [ 708.447406][ T1234] usb 2-1: SerialNumber: syz [ 708.485643][ T1234] input: bcm5974 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/input/input66 [ 708.822848][T17604] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 708.826343][T17604] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 709.011022][ T1183] usb 4-1: new high-speed USB device number 82 using dummy_hcd [ 709.067186][ T150] hsr_slave_0: left promiscuous mode [ 709.069458][ T150] hsr_slave_1: left promiscuous mode [ 709.106476][ T150] veth0_macvtap: left promiscuous mode [ 709.172090][ T1183] usb 4-1: New USB device found, idVendor=0543, idProduct=e621, bcdDevice= 0.00 [ 709.173570][ T1183] usb 4-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 709.173600][ T1183] usb 4-1: config 0 interface 0 has no altsetting 0 [ 709.173673][ T1183] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 709.183129][ T1183] usb 4-1: config 0 descriptor?? [ 709.600806][T17626] netlink: 'syz.0.3889': attribute type 4 has an invalid length. [ 709.602753][ T5615] usb 5-1: new high-speed USB device number 105 using dummy_hcd [ 709.674655][ T25] usb 3-1: new high-speed USB device number 54 using dummy_hcd [ 709.782985][ T5615] usb 5-1: Using ep0 maxpacket: 32 [ 709.784403][ T5615] usb 5-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 709.785706][ T5615] usb 5-1: config 0 has an invalid interface number: 51 but max is 0 [ 709.785730][ T5615] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 709.785749][ T5615] usb 5-1: config 0 has no interface number 0 [ 709.785796][ T5615] usb 5-1: config 0 interface 51 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 709.788811][ T5615] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 709.788835][ T5615] usb 5-1: Product: syz [ 709.788850][ T5615] usb 5-1: Manufacturer: syz [ 709.788889][ T5615] usb 5-1: SerialNumber: syz [ 709.793782][ T5615] usb 5-1: config 0 descriptor?? [ 709.810275][ T5615] quatech2 5-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 709.833460][ T25] usb 3-1: Using ep0 maxpacket: 32 [ 709.840794][ T25] usb 3-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 709.870124][ T25] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 709.915154][ T25] usb 3-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 709.915183][ T25] usb 3-1: Product: syz [ 709.915199][ T25] usb 3-1: Manufacturer: syz [ 709.915214][ T25] usb 3-1: SerialNumber: syz [ 709.981985][ T25] usb 3-1: config 0 descriptor?? [ 709.984504][T17623] raw-gadget.4 gadget.2: fail, usb_ep_enable returned -22 [ 710.209879][T17623] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 710.222411][T17623] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 710.326618][ T1183] viewsonic 0003:0543:E621.0015: unknown main item tag 0x0 [ 710.326672][ T1183] viewsonic 0003:0543:E621.0015: unknown main item tag 0x0 [ 710.326696][ T1183] viewsonic 0003:0543:E621.0015: unknown main item tag 0x0 [ 710.326720][ T1183] viewsonic 0003:0543:E621.0015: unknown main item tag 0x0 [ 710.326744][ T1183] viewsonic 0003:0543:E621.0015: unknown main item tag 0x0 [ 710.326769][ T1183] viewsonic 0003:0543:E621.0015: unknown main item tag 0x0 [ 710.328046][ T1183] viewsonic 0003:0543:E621.0015: unknown main item tag 0x0 [ 710.328075][ T1183] viewsonic 0003:0543:E621.0015: unknown main item tag 0x0 [ 710.328122][ T1183] viewsonic 0003:0543:E621.0015: unknown main item tag 0x0 [ 710.328148][ T1183] viewsonic 0003:0543:E621.0015: unknown main item tag 0x0 [ 710.351590][ T25] net_ratelimit: 3 callbacks suppressed [ 710.351608][ T25] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 710.441860][ T1183] viewsonic 0003:0543:E621.0015: hidraw0: USB HID v7f.fd Device [HID 0543:e621] on usb-dummy_hcd.3-1/input0 [ 710.879809][T17636] netlink: 'syz.0.3890': attribute type 1 has an invalid length. [ 711.017949][T17639] __nla_validate_parse: 20 callbacks suppressed [ 711.017971][T17639] netlink: 36 bytes leftover after parsing attributes in process `syz.0.3890'. [ 711.154613][T17636] 8021q: adding VLAN 0 to HW filter on device bond1 [ 711.174160][ T4968] bcm5974 2-1:1.0: could not read from device [ 711.177634][T17631] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 711.190167][T17637] bond1: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 711.192451][T17631] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 711.222934][ T4968] bcm5974 2-1:1.0: could not read from device [ 711.282266][ T4968] bcm5974 2-1:1.0: could not read from device [ 711.289791][ T1234] usb 2-1: USB disconnect, device number 26 [ 711.296485][ T4968] bcm5974 2-1:1.0: could not read from device [ 711.409031][ T150] IPVS: stop unused estimator thread 0... [ 711.810750][ T5615] usb 5-1: qt2_attach - failed to power on unit: -71 [ 711.810905][ T5615] quatech2 5-1:0.51: probe with driver quatech2 failed with error -71 [ 711.830910][ T30] usb 4-1: USB disconnect, device number 82 [ 711.901369][ T5615] usb 5-1: USB disconnect, device number 105 [ 712.321090][ T1234] usb 1-1: new high-speed USB device number 63 using dummy_hcd [ 712.434911][ T5615] usb 3-1: USB disconnect, device number 54 [ 712.471186][ T1234] usb 1-1: Using ep0 maxpacket: 8 [ 712.473305][ T1234] usb 1-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 712.474235][ T1234] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 712.474259][ T1234] usb 1-1: config 0 has no interfaces? [ 712.474288][ T1234] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 712.478169][ T1234] usb 1-1: config 0 descriptor?? [ 712.479069][T17663] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3897'. [ 712.554917][T17665] binder_alloc: binder_alloc_mmap_handler: 17660 200000ffd000-200000fff000 already mapped failed -16 [ 712.572112][ T31] kauditd_printk_skb: 147 callbacks suppressed [ 712.572132][ T31] audit: type=1400 audit(1791032588.348:2389): apparmor="DENIED" operation="change_hat" class="file" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=17666 comm="syz.2.3898" [ 712.574096][T17667] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3898'. [ 712.591485][ T30] usb 2-1: new high-speed USB device number 27 using dummy_hcd [ 712.727299][T17669] AppArmor: change_hat: Invalid input '0x' [ 712.747385][ T30] usb 2-1: Using ep0 maxpacket: 16 [ 712.748924][ T30] usb 2-1: New USB device found, idVendor=0b05, idProduct=18c6, bcdDevice= 0.00 [ 712.750378][ T30] usb 2-1: config 0 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 712.750410][ T30] usb 2-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 712.750436][ T30] usb 2-1: config 0 interface 0 has no altsetting 0 [ 712.750470][ T30] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 712.766664][ T30] usb 2-1: config 0 descriptor?? [ 713.108947][T17673] netlink: 'syz.4.3900': attribute type 4 has an invalid length. [ 713.421204][ T30] input: HID 0b05:18c6 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:0B05:18C6.0016/input/input67 [ 713.549036][ T30] asus 0003:0B05:18C6.0016: input,hiddev0,hidraw0: USB HID v0.00 Device [HID 0b05:18c6] on usb-dummy_hcd.1-1/input0 [ 713.814824][ T5615] usb 2-1: USB disconnect, device number 27 [ 714.651459][T17708] binder: BINDER_SET_CONTEXT_MGR already set [ 714.651478][T17708] binder: 17707:17708 ioctl 4018620d 200000000100 returned -16 [ 714.657963][T17708] binder: BINDER_SET_CONTEXT_MGR already set [ 714.657978][T17708] binder: 17707:17708 ioctl 4018620d 2000000002c0 returned -16 [ 714.892390][ T1234] usb 4-1: new high-speed USB device number 83 using dummy_hcd [ 715.059947][ T1234] usb 4-1: unable to get BOS descriptor or descriptor too short [ 715.059979][ T1234] usb 4-1: New USB device found, idVendor=05e1, idProduct=0408, bcdDevice=a4.d6 [ 715.080965][ T1234] usb 4-1: config 12 has an invalid interface number: 99 but max is 0 [ 715.080995][ T1234] usb 4-1: config 12 has no interface number 0 [ 715.081027][ T1234] usb 4-1: config 12 interface 99 altsetting 14 endpoint 0xD has invalid maxpacket 552, setting to 64 [ 715.081043][ T1234] usb 4-1: config 12 interface 99 has no altsetting 0 [ 715.082942][ T1234] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 715.082957][ T1234] usb 4-1: Product: syz [ 715.082966][ T1234] usb 4-1: Manufacturer: syz [ 715.082973][ T1234] usb 4-1: SerialNumber: syz [ 715.237616][ T5723] usb 1-1: USB disconnect, device number 63 [ 715.321244][T17720] binder: 17719:17720 ioctl c0306201 200000000080 returned -14 [ 715.323263][T17720] binder: 17719:17720 ioctl c0306201 2000000003c0 returned -14 [ 715.323543][T17720] binder_alloc: 17719: binder_alloc_buf, no vma [ 715.411182][T17722] syzkaller1: tun_chr_ioctl cmd 1074025680 [ 715.422387][T17706] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3910'. [ 715.422848][T17706] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3910'. [ 715.423183][T17706] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 715.674867][T17709] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3910'. [ 715.841093][ T5723] usb 1-1: new high-speed USB device number 64 using dummy_hcd [ 715.978079][T17738] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3922'. [ 715.993110][ T5723] usb 1-1: unable to get BOS descriptor or descriptor too short [ 715.993162][ T5723] usb 1-1: New USB device found, idVendor=05ac, idProduct=0263, bcdDevice=1d.cd [ 715.994777][ T5723] usb 1-1: config 3 has an invalid interface number: 151 but max is 0 [ 715.994801][ T5723] usb 1-1: config 3 has no interface number 0 [ 715.994828][ T5723] usb 1-1: config 3 interface 151 has no altsetting 0 [ 715.997135][ T5723] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 715.997160][ T5723] usb 1-1: Product: syz [ 715.997174][ T5723] usb 1-1: Manufacturer: syz [ 715.997188][ T5723] usb 1-1: SerialNumber: syz [ 716.123073][ T5615] usb 5-1: new high-speed USB device number 106 using dummy_hcd [ 716.207657][T17725] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 716.208181][T17725] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 716.212841][T17725] netlink: 64 bytes leftover after parsing attributes in process `syz.0.3917'. [ 716.249169][ T5723] input: bcm5974 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:3.151/input/input68 [ 716.254888][ T4968] bcm5974 1-1:3.151: could not read from device [ 716.267828][ T4968] bcm5974 1-1:3.151: could not read from device [ 716.275778][ T5723] usb 1-1: USB disconnect, device number 64 [ 716.279935][ T4968] bcm5974 1-1:3.151: could not read from device [ 716.291654][ T5615] usb 5-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 716.293308][ T5615] usb 5-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 716.293340][ T5615] usb 5-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 716.293403][ T5615] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 716.310613][T17730] raw-gadget.2 gadget.4: fail, usb_ep_enable returned -22 [ 716.311659][ T5680] usb 2-1: new high-speed USB device number 28 using dummy_hcd [ 716.366495][ T5615] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 716.424153][ T1234] usb 4-1: no audio or video endpoints found [ 716.447344][ T1234] usb 4-1: USB disconnect, device number 83 [ 716.462587][ T5680] usb 2-1: Using ep0 maxpacket: 16 [ 716.463458][ T5680] usb 2-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 716.475212][ T5680] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 716.475240][ T5680] usb 2-1: Product: syz [ 716.475254][ T5680] usb 2-1: Manufacturer: syz [ 716.475269][ T5680] usb 2-1: SerialNumber: syz [ 716.534368][ T5680] r8152-cfgselector 2-1: Unknown version 0x0000 [ 716.534394][ T5680] r8152-cfgselector 2-1: config 0 descriptor?? [ 716.591597][T17730] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 716.979687][ T5723] usb 5-1: USB disconnect, device number 106 [ 717.253149][ T25] usb 4-1: new high-speed USB device number 84 using dummy_hcd [ 717.401167][ T25] usb 4-1: Using ep0 maxpacket: 8 [ 717.406643][ T25] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 717.411937][ T25] usb 4-1: config index 0 descriptor too short (expected 301, got 45) [ 717.411964][ T25] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 717.411983][ T25] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 717.412040][ T25] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 717.465771][ T25] usb 4-1: config 0 descriptor?? [ 717.762763][T17764] netlink: 'syz.0.3928': attribute type 4 has an invalid length. [ 717.936762][T17767] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 718.058510][T17773] FAULT_INJECTION: forcing a failure. [ 718.058510][T17773] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 718.058545][T17773] CPU: 0 UID: 0 PID: 17773 Comm: syz.0.3930 Tainted: G L syzkaller #0 PREEMPT(full) [ 718.058560][T17773] Tainted: [L]=SOFTLOCKUP [ 718.058567][T17773] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 718.058578][T17773] Call Trace: [ 718.058587][T17773] [ 718.058596][T17773] dump_stack_lvl+0xe8/0x150 [ 718.058633][T17773] should_fail_ex+0x410/0x560 [ 718.058662][T17773] _copy_to_user+0x31/0xb0 [ 718.058679][T17773] simple_read_from_buffer+0xe1/0x170 [ 718.058698][T17773] proc_fail_nth_read+0x1bb/0x230 [ 718.058710][T17773] ? common_file_perm+0x20e/0x2b0 [ 718.058733][T17773] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 718.058758][T17773] ? rw_verify_area+0x24a/0x4c0 [ 718.058789][T17773] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 718.058810][T17773] vfs_read+0x213/0xa80 [ 718.058824][T17773] ? __pfx_vfs_read+0x10/0x10 [ 718.058834][T17773] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 718.058849][T17773] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 718.058862][T17773] ? mon_bin_ioctl+0x766/0xe20 [ 718.058889][T17773] ksys_read+0x150/0x270 [ 718.058911][T17773] ? __pfx_ksys_read+0x10/0x10 [ 718.058941][T17773] do_syscall_64+0x166/0x520 [ 718.058963][T17773] ? trace_irq_disable+0x3b/0x140 [ 718.058974][T17773] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 718.058986][T17773] ? clear_bhb_loop+0x70/0xc0 [ 718.058998][T17773] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 718.059013][T17773] RIP: 0033:0x7f042315e98e [ 718.059031][T17773] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 718.059048][T17773] RSP: 002b:00007f0423f96fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 718.059070][T17773] RAX: ffffffffffffffda RBX: 00007f0423f976c0 RCX: 00007f042315e98e [ 718.059085][T17773] RDX: 000000000000000f RSI: 00007f0423f970a0 RDI: 0000000000000004 [ 718.059098][T17773] RBP: 00007f0423f97090 R08: 0000000000000000 R09: 0000000000000000 [ 718.059110][T17773] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 718.059117][T17773] R13: 00007f0423426038 R14: 00007f0423425fa0 R15: 00007f042354fa48 [ 718.059133][T17773] [ 718.873981][T17785] netlink: 'syz.4.3933': attribute type 4 has an invalid length. [ 719.152872][ T5680] r8152-cfgselector 2-1: Unknown version 0x0000 [ 719.153162][ T5680] r8152-cfgselector 2-1: No union descriptors [ 719.168342][ T5680] r8152-cfgselector 2-1: USB disconnect, device number 28 [ 719.763838][T17797] tc action pedit 'at' offset 5 out of bounds [ 720.462867][T17815] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3941'. [ 720.554346][T17819] netlink: 'syz.0.3944': attribute type 4 has an invalid length. [ 720.849601][ T31] audit: type=1400 audit(1791032596.628:2390): apparmor="DENIED" operation="setprocattr" info="current" error=-22 profile="unconfined" pid=17820 comm="syz.4.3945" [ 720.894848][ T1234] usb 4-1: USB disconnect, device number 84 [ 721.021104][ T5615] usb 3-1: new high-speed USB device number 55 using dummy_hcd [ 721.172299][ T5615] usb 3-1: Using ep0 maxpacket: 8 [ 721.173178][ T5615] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 721.203799][ T5615] usb 3-1: config index 0 descriptor too short (expected 301, got 45) [ 721.203830][ T5615] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 721.203849][ T5615] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 721.203881][ T5615] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 721.210752][ T5615] usb 3-1: config 0 descriptor?? [ 721.266216][T17829] tipc: Started in network mode [ 721.266236][T17829] tipc: Node identity 00000000000000000000000000000001, cluster identity 4711 [ 721.266278][T17829] tipc: Enabling of bearer rejected, failed to enable media [ 721.341570][ T5680] usb 5-1: new high-speed USB device number 107 using dummy_hcd [ 721.395116][ T5723] usb 4-1: new high-speed USB device number 85 using dummy_hcd [ 721.492233][ T5680] usb 5-1: New USB device found, idVendor=06cd, idProduct=0131, bcdDevice= 1.00 [ 721.493185][ T5680] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 721.493200][ T5680] usb 5-1: config 0 has no interfaces? [ 721.497155][ T5680] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 721.497170][ T5680] usb 5-1: Product: syz [ 721.497178][ T5680] usb 5-1: Manufacturer: syz [ 721.497186][ T5680] usb 5-1: SerialNumber: syz [ 721.502543][ T5680] usb 5-1: config 0 descriptor?? [ 721.541672][ T5723] usb 4-1: Using ep0 maxpacket: 32 [ 721.542493][ T5723] usb 4-1: New USB device found, idVendor=041e, idProduct=403c, bcdDevice=cc.d7 [ 721.545272][ T5723] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 721.557492][ T5723] usb 4-1: config 0 descriptor?? [ 721.599940][ T5723] gspca_main: sq930x-2.14.0 probing 041e:403c [ 721.731720][T17838] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 721.736691][T17838] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 721.792387][ T30] usb 5-1: USB disconnect, device number 107 [ 721.793361][T17781] bridge_slave_1: left allmulticast mode [ 721.793673][T17781] bridge0: port 2(bridge_slave_1) entered disabled state [ 721.849585][ T5680] usb 1-1: new full-speed USB device number 65 using dummy_hcd [ 721.870320][T17781] bridge_slave_0: left allmulticast mode [ 721.870576][T17781] bridge0: port 1(bridge_slave_0) entered disabled state [ 721.930293][T17781] pimreg3: left allmulticast mode [ 722.052421][T17842] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 722.052842][T17842] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 722.460888][ T31] audit: type=1804 audit(1791032598.238:2391): pid=17848 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.3953" name="/newroot/105/file0" dev="fuse" ino=1 res=1 errno=0 [ 722.792247][ T5680] usb 1-1: New USB device found, idVendor=a257, idProduct=2013, bcdDevice= 0.01 [ 722.795285][ T5680] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 722.795323][ T5680] usb 1-1: can't read configurations, error -71 [ 722.951180][T17845] usb 5-1: new high-speed USB device number 108 using dummy_hcd [ 723.104307][T17845] usb 5-1: New USB device found, idVendor=04e6, idProduct=0005, bcdDevice= 1.00 [ 723.106521][T17845] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 723.106551][T17845] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 723.123292][T17845] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 723.123342][T17845] usb 5-1: Product: syz [ 723.123358][T17845] usb 5-1: Manufacturer: syz [ 723.123373][T17845] usb 5-1: SerialNumber: syz [ 723.183353][ T1234] hid-generic 0008:046D:C082.0017: hidraw0: HID v0.04 Device [syz0] on syz0 [ 723.216174][T17845] ums-sddr09 5-1:1.0: USB Mass Storage device detected [ 723.236720][T17781] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 723.242401][T17845] ums-sddr09 5-1:1.0: This device (04e6,0005,0100 S 06 P 50) has an unneeded SubClass entry in unusual_devs.h (kernel syzkaller) [ 723.242401][T17845] Please send a copy of this message to and [ 723.310533][T17781] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 723.327772][T17781] bond0 (unregistering): Released all slaves [ 723.347257][T17781] bond1 (unregistering): Released all slaves [ 723.398462][T17781] bond2 (unregistering): Released all slaves [ 723.585488][T17864] fido_id[17864]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 723.654309][T17845] ums-sddr09 5-1:1.0: probe with driver ums-sddr09 failed with error -22 [ 723.693741][T17845] usb 5-1: USB disconnect, device number 108 [ 723.713585][T17781] tipc: Disabling bearer [ 723.713721][T17781] tipc: Left network mode [ 723.852088][T17781] IPVS: stopping master sync thread 7423 ... [ 724.021187][ T5680] usb 1-1: new high-speed USB device number 67 using dummy_hcd [ 724.144210][ T1234] usb 4-1: USB disconnect, device number 85 [ 724.164826][ T5680] usb 1-1: device descriptor read/64, error -71 [ 724.277052][T17874] FAULT_INJECTION: forcing a failure. [ 724.277052][T17874] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 724.277086][T17874] CPU: 0 UID: 0 PID: 17874 Comm: syz.1.3960 Tainted: G L syzkaller #0 PREEMPT(full) [ 724.277112][T17874] Tainted: [L]=SOFTLOCKUP [ 724.277120][T17874] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 724.277132][T17874] Call Trace: [ 724.277140][T17874] [ 724.277149][T17874] dump_stack_lvl+0xe8/0x150 [ 724.277183][T17874] should_fail_ex+0x410/0x560 [ 724.277211][T17874] _copy_from_iter+0x1d3/0x1660 [ 724.277234][T17874] ? __alloc_skb+0x27a/0x7a0 [ 724.277258][T17874] ? __alloc_skb+0x27a/0x7a0 [ 724.277285][T17874] ? __alloc_skb+0x27a/0x7a0 [ 724.277310][T17874] ? __pfx__copy_from_iter+0x10/0x10 [ 724.277333][T17874] ? kmem_cache_alloc_node_noprof+0x1f9/0x610 [ 724.277354][T17874] ? __alloc_skb+0x27a/0x7a0 [ 724.277378][T17874] ? __alloc_skb+0x27a/0x7a0 [ 724.277409][T17874] ? netlink_sendmsg+0x650/0xb40 [ 724.277431][T17874] ? skb_put+0x112/0x210 [ 724.277461][T17874] netlink_sendmsg+0x6c0/0xb40 [ 724.277492][T17874] ? __pfx_netlink_sendmsg+0x10/0x10 [ 724.277522][T17874] ? apparmor_socket_sendmsg+0x98/0x360 [ 724.277550][T17874] ? __pfx_netlink_sendmsg+0x10/0x10 [ 724.277571][T17874] sock_sendmsg_nosec+0x13a/0x180 [ 724.277597][T17874] ____sys_sendmsg+0x54e/0x850 [ 724.277632][T17874] ? __pfx_____sys_sendmsg+0x10/0x10 [ 724.277677][T17874] ? import_iovec+0x73/0xa0 [ 724.277704][T17874] ___sys_sendmsg+0x2a5/0x360 [ 724.277730][T17874] ? __lock_acquire+0x747/0x2de0 [ 724.277756][T17874] ? __pfx____sys_sendmsg+0x10/0x10 [ 724.277816][T17874] ? __fget_files+0x2a/0x420 [ 724.277844][T17874] ? __fget_files+0x3a2/0x420 [ 724.277883][T17874] __x64_sys_sendmsg+0x1b1/0x290 [ 724.277915][T17874] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 724.277963][T17874] do_syscall_64+0x166/0x520 [ 724.277990][T17874] ? trace_irq_disable+0x3b/0x140 [ 724.278010][T17874] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 724.278028][T17874] ? clear_bhb_loop+0x70/0xc0 [ 724.278049][T17874] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 724.278070][T17874] RIP: 0033:0x7fe9eeb9e159 [ 724.278089][T17874] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 724.278106][T17874] RSP: 002b:00007fe9efa65028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 724.278128][T17874] RAX: ffffffffffffffda RBX: 00007fe9eee25fa0 RCX: 00007fe9eeb9e159 [ 724.278144][T17874] RDX: 0000000000000084 RSI: 00002000000006c0 RDI: 0000000000000003 [ 724.278156][T17874] RBP: 00007fe9efa65090 R08: 0000000000000000 R09: 0000000000000000 [ 724.278167][T17874] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 724.278177][T17874] R13: 00007fe9eee26038 R14: 00007fe9eee25fa0 R15: 00007fe9eef4fa48 [ 724.278208][T17874] [ 724.451109][ T5680] usb 1-1: new high-speed USB device number 68 using dummy_hcd [ 724.662763][ T5680] usb 1-1: device descriptor read/64, error -71 [ 724.767073][T17876] tipc: Started in network mode [ 724.767091][T17876] tipc: Node identity , cluster identity 4711 [ 724.767106][T17876] tipc: Failed to obtain node identity [ 724.767131][T17876] tipc: Enabling of bearer rejected, failed to enable media [ 724.791576][ T5680] usb usb1-port1: attempt power cycle [ 724.867083][T17878] netlink: 40 bytes leftover after parsing attributes in process `syz.3.3964'. [ 725.058894][T17883] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 725.131512][ T5680] usb 1-1: new high-speed USB device number 69 using dummy_hcd [ 725.151912][ T5680] usb 1-1: device descriptor read/8, error -71 [ 725.318983][T17845] usb 3-1: USB disconnect, device number 55 [ 725.385024][ T31] audit: type=1326 audit(1791032601.168:2392): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17892 comm="syz.4.3967" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff48539e159 code=0x7ffc0000 [ 725.385079][ T31] audit: type=1326 audit(1791032601.168:2393): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17892 comm="syz.4.3967" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff48539e159 code=0x7ffc0000 [ 725.388610][ T31] audit: type=1326 audit(1791032601.168:2394): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17892 comm="syz.4.3967" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=334 compat=0 ip=0x7ff48539e159 code=0x7ffc0000 [ 725.388723][ T31] audit: type=1326 audit(1791032601.168:2395): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17892 comm="syz.4.3967" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff48539e159 code=0x7ffc0000 [ 725.388876][ T31] audit: type=1326 audit(1791032601.168:2396): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17892 comm="syz.4.3967" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff48539e159 code=0x7ffc0000 [ 725.392138][ T5680] usb 1-1: new high-speed USB device number 70 using dummy_hcd [ 725.415910][ T31] audit: type=1326 audit(1791032601.178:2397): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17892 comm="syz.4.3967" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=157 compat=0 ip=0x7ff48539e159 code=0x7ffc0000 [ 725.415982][ T31] audit: type=1326 audit(1791032601.178:2398): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17892 comm="syz.4.3967" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff48539e159 code=0x7ffc0000 [ 725.416024][ T31] audit: type=1326 audit(1791032601.178:2399): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17892 comm="syz.4.3967" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff48539e159 code=0x7ffc0000 [ 725.419046][ T5680] usb 1-1: device descriptor read/8, error -71 [ 725.522986][ T5680] usb usb1-port1: unable to enumerate USB device [ 726.280575][T17781] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 726.311971][T17781] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 726.379646][T17781] batman_adv: batadv0: Removing interface: dummy0 [ 726.440346][T17909] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3973'. [ 726.472796][ T5680] usb 5-1: new high-speed USB device number 109 using dummy_hcd [ 726.550870][T17911] FAULT_INJECTION: forcing a failure. [ 726.550870][T17911] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 726.550906][T17911] CPU: 0 UID: 0 PID: 17911 Comm: syz.1.3974 Tainted: G L syzkaller #0 PREEMPT(full) [ 726.550943][T17911] Tainted: [L]=SOFTLOCKUP [ 726.550950][T17911] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 726.550960][T17911] Call Trace: [ 726.550967][T17911] [ 726.550976][T17911] dump_stack_lvl+0xe8/0x150 [ 726.551006][T17911] should_fail_ex+0x410/0x560 [ 726.551033][T17911] _copy_from_iter+0x1d3/0x1660 [ 726.551057][T17911] ? __alloc_skb+0x27a/0x7a0 [ 726.551083][T17911] ? __alloc_skb+0x27a/0x7a0 [ 726.551108][T17911] ? __alloc_skb+0x27a/0x7a0 [ 726.551131][T17911] ? __pfx__copy_from_iter+0x10/0x10 [ 726.551153][T17911] ? kmem_cache_alloc_node_noprof+0x1f9/0x610 [ 726.551172][T17911] ? __alloc_skb+0x27a/0x7a0 [ 726.551193][T17911] ? __alloc_skb+0x27a/0x7a0 [ 726.551222][T17911] ? netlink_sendmsg+0x650/0xb40 [ 726.551243][T17911] ? skb_put+0x112/0x210 [ 726.551269][T17911] netlink_sendmsg+0x6c0/0xb40 [ 726.551295][T17911] ? __pfx_netlink_sendmsg+0x10/0x10 [ 726.551323][T17911] ? apparmor_socket_sendmsg+0x18b/0x360 [ 726.551349][T17911] ? __pfx_netlink_sendmsg+0x10/0x10 [ 726.551368][T17911] sock_sendmsg_nosec+0x13a/0x180 [ 726.551392][T17911] ____sys_sendmsg+0x54e/0x850 [ 726.551424][T17911] ? __pfx_____sys_sendmsg+0x10/0x10 [ 726.551460][T17911] ? import_iovec+0x73/0xa0 [ 726.551487][T17911] ___sys_sendmsg+0x2a5/0x360 [ 726.551518][T17911] ? __lock_acquire+0x747/0x2de0 [ 726.551542][T17911] ? __pfx____sys_sendmsg+0x10/0x10 [ 726.551599][T17911] ? __fget_files+0x2a/0x420 [ 726.551627][T17911] ? __fget_files+0x3a2/0x420 [ 726.551658][T17911] __x64_sys_sendmsg+0x1b1/0x290 [ 726.551675][T17911] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 726.551700][T17911] do_syscall_64+0x166/0x520 [ 726.551715][T17911] ? trace_irq_disable+0x3b/0x140 [ 726.551727][T17911] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 726.551738][T17911] ? clear_bhb_loop+0x70/0xc0 [ 726.551751][T17911] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 726.551762][T17911] RIP: 0033:0x7fe9eeb9e159 [ 726.551773][T17911] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 726.551783][T17911] RSP: 002b:00007fe9efa65028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 726.551796][T17911] RAX: ffffffffffffffda RBX: 00007fe9eee25fa0 RCX: 00007fe9eeb9e159 [ 726.551804][T17911] RDX: 0000000020004000 RSI: 0000200000000100 RDI: 0000000000000003 [ 726.551811][T17911] RBP: 00007fe9efa65090 R08: 0000000000000000 R09: 0000000000000000 [ 726.551818][T17911] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 726.551825][T17911] R13: 00007fe9eee26038 R14: 00007fe9eee25fa0 R15: 00007fe9eef4fa48 [ 726.551841][T17911] [ 726.612750][ T5680] usb 5-1: device descriptor read/64, error -71 [ 726.861966][ T5680] usb 5-1: new high-speed USB device number 110 using dummy_hcd [ 726.885917][T17913] FAULT_INJECTION: forcing a failure. [ 726.885917][T17913] name failslab, interval 1, probability 0, space 0, times 0 [ 726.886079][T17913] CPU: 0 UID: 0 PID: 17913 Comm: syz.0.3975 Tainted: G L syzkaller #0 PREEMPT(full) [ 726.886106][T17913] Tainted: [L]=SOFTLOCKUP [ 726.886114][T17913] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 726.886126][T17913] Call Trace: [ 726.886135][T17913] [ 726.886144][T17913] dump_stack_lvl+0xe8/0x150 [ 726.886175][T17913] should_fail_ex+0x410/0x560 [ 726.886205][T17913] should_failslab+0xa8/0x100 [ 726.886234][T17913] __kmalloc_cache_noprof+0xa3/0x600 [ 726.886258][T17913] ? percpu_ref_init+0xc5/0x350 [ 726.886279][T17913] ? percpu_ref_init+0xc5/0x350 [ 726.886305][T17913] ? __pfx_free_ioctx_reqs+0x10/0x10 [ 726.886324][T17913] percpu_ref_init+0xc5/0x350 [ 726.886344][T17913] ? __pfx_free_ioctx_users+0x10/0x10 [ 726.886370][T17913] ioctx_alloc+0x23f/0x830 [ 726.886392][T17913] ? __might_fault+0xaf/0x130 [ 726.886426][T17913] __se_sys_io_setup+0x7b/0x1d0 [ 726.886450][T17913] do_syscall_64+0x166/0x520 [ 726.886479][T17913] ? trace_irq_disable+0x3b/0x140 [ 726.886500][T17913] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 726.886530][T17913] ? clear_bhb_loop+0x70/0xc0 [ 726.886555][T17913] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 726.886575][T17913] RIP: 0033:0x7f042319e159 [ 726.886595][T17913] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 726.886612][T17913] RSP: 002b:00007f0423f97028 EFLAGS: 00000246 ORIG_RAX: 00000000000000ce [ 726.886634][T17913] RAX: ffffffffffffffda RBX: 00007f0423425fa0 RCX: 00007f042319e159 [ 726.886648][T17913] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000004 [ 726.886660][T17913] RBP: 00007f0423f97090 R08: 0000000000000000 R09: 0000000000000000 [ 726.886673][T17913] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 726.886685][T17913] R13: 00007f0423426038 R14: 00007f0423425fa0 R15: 00007f042354fa48 [ 726.886718][T17913] [ 726.994946][ T5680] usb 5-1: device descriptor read/64, error -71 [ 727.107875][ T5680] usb usb5-port1: attempt power cycle [ 727.358270][T17918] FAULT_INJECTION: forcing a failure. [ 727.358270][T17918] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 727.358295][T17918] CPU: 0 UID: 0 PID: 17918 Comm: syz.1.3976 Tainted: G L syzkaller #0 PREEMPT(full) [ 727.358311][T17918] Tainted: [L]=SOFTLOCKUP [ 727.358315][T17918] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 727.358322][T17918] Call Trace: [ 727.358326][T17918] [ 727.358332][T17918] dump_stack_lvl+0xe8/0x150 [ 727.358352][T17918] should_fail_ex+0x410/0x560 [ 727.358368][T17918] _copy_from_iter+0x1d3/0x1660 [ 727.358382][T17918] ? trace_kmem_cache_alloc+0x29/0xe0 [ 727.358394][T17918] ? __build_skb+0x62/0x440 [ 727.358409][T17918] ? trace_kmalloc+0x2a/0xf0 [ 727.358419][T17918] ? __build_skb+0x62/0x440 [ 727.358432][T17918] ? __build_skb+0x62/0x440 [ 727.358445][T17918] ? __pfx__copy_from_iter+0x10/0x10 [ 727.358463][T17918] ? __build_skb+0x2a2/0x440 [ 727.358477][T17918] ? netlink_sendmsg+0x650/0xb40 [ 727.358489][T17918] ? skb_put+0x112/0x210 [ 727.358504][T17918] netlink_sendmsg+0x6c0/0xb40 [ 727.358520][T17918] ? __pfx_netlink_sendmsg+0x10/0x10 [ 727.358535][T17918] ? apparmor_socket_sendmsg+0x98/0x360 [ 727.358550][T17918] ? __pfx_netlink_sendmsg+0x10/0x10 [ 727.358561][T17918] sock_sendmsg_nosec+0x13a/0x180 [ 727.358575][T17918] __sys_sendto+0x408/0x5a0 [ 727.358589][T17918] ? ksys_write+0x1e6/0x270 [ 727.358601][T17918] ? __pfx___sys_sendto+0x10/0x10 [ 727.358613][T17918] ? __mutex_unlock_slowpath+0x731/0x900 [ 727.358642][T17918] ? __pfx_ksys_write+0x10/0x10 [ 727.358655][T17918] __x64_sys_sendto+0xde/0x100 [ 727.358670][T17918] do_syscall_64+0x166/0x520 [ 727.358685][T17918] ? trace_irq_disable+0x3b/0x140 [ 727.358696][T17918] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 727.358708][T17918] ? clear_bhb_loop+0x70/0xc0 [ 727.358721][T17918] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 727.358732][T17918] RIP: 0033:0x7fe9eeb9e159 [ 727.358743][T17918] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 727.358753][T17918] RSP: 002b:00007fe9efa44028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 727.358765][T17918] RAX: ffffffffffffffda RBX: 00007fe9eee26090 RCX: 00007fe9eeb9e159 [ 727.358774][T17918] RDX: 0000000000010a73 RSI: 0000200000000000 RDI: 0000000000000003 [ 727.358781][T17918] RBP: 00007fe9efa44090 R08: 0000000000000000 R09: 4b6ae4f95a5de35b [ 727.358788][T17918] R10: 0000000000000800 R11: 0000000000000246 R12: 0000000000000001 [ 727.358795][T17918] R13: 00007fe9eee26128 R14: 00007fe9eee26090 R15: 00007fe9eef4fa48 [ 727.358811][T17918] [ 727.561130][ T5680] usb 5-1: new high-speed USB device number 111 using dummy_hcd [ 727.609092][ T5680] usb 5-1: device descriptor read/8, error -71 [ 727.666463][T17781] team0 (unregistering): Port device team_slave_1 removed [ 727.705563][T17781] team0 (unregistering): Port device team_slave_0 removed [ 727.854512][ T5680] usb 5-1: new high-speed USB device number 112 using dummy_hcd [ 727.875968][ T5680] usb 5-1: device descriptor read/8, error -71 [ 727.982172][ T5680] usb usb5-port1: unable to enumerate USB device [ 728.554254][T17929] bridge0: port 1(bridge_slave_0) entered disabled state [ 728.666337][T17929] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 728.669397][T17929] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 728.872168][T17948] syzkaller0: entered promiscuous mode [ 728.872186][T17948] syzkaller0: entered allmulticast mode [ 729.111604][ T1234] usb 1-1: new high-speed USB device number 71 using dummy_hcd [ 729.254095][T17961] netlink: 48 bytes leftover after parsing attributes in process `syz.4.3990'. [ 729.254118][T17961] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3990'. [ 729.254135][T17961] netlink: 48 bytes leftover after parsing attributes in process `syz.4.3990'. [ 729.254147][T17961] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3990'. [ 729.279201][ T1234] usb 1-1: Using ep0 maxpacket: 8 [ 729.297861][ T1234] usb 1-1: New USB device found, idVendor=047d, idProduct=5003, bcdDevice=2f.8c [ 729.362314][ T1234] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 729.362341][ T1234] usb 1-1: Product: syz [ 729.362353][ T1234] usb 1-1: Manufacturer: syz [ 729.362366][ T1234] usb 1-1: SerialNumber: syz [ 729.364981][ T1234] usb 1-1: config 0 descriptor?? [ 729.387356][ T1234] gspca_main: se401-2.14.0 probing 047d:5003 [ 729.830063][T17971] fuse: Bad value for 'fd' [ 730.345999][ T1234] usb 1-1: reset high-speed USB device number 71 using dummy_hcd [ 730.864770][ T1234] gspca_se401: read req failed req 0x06 error -71 [ 730.864907][ T1234] se401 1-1:0.0: probe with driver se401 failed with error -71 [ 730.892375][ T1234] usb 1-1: USB disconnect, device number 71 [ 732.651632][ T2216] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 732.651686][ T2216] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 732.651723][ T2216] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 732.651759][ T2216] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 732.651964][T17978] syz_tun: entered allmulticast mode [ 732.652178][T17978] syz_tun: left allmulticast mode [ 732.723135][T17781] IPVS: stop unused estimator thread 0... [ 732.812779][T17982] netlink: 'syz.3.3997': attribute type 4 has an invalid length. [ 733.109481][T17993] netlink: 'syz.3.4001': attribute type 10 has an invalid length. [ 733.145422][T17993] team0: Port device dummy0 added [ 733.148964][T17993] netlink: 'syz.3.4001': attribute type 10 has an invalid length. [ 733.170053][T17993] team0: Port device dummy0 removed [ 733.422435][T18015] FAULT_INJECTION: forcing a failure. [ 733.422435][T18015] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 733.422484][T18015] CPU: 1 UID: 0 PID: 18015 Comm: syz.3.4008 Tainted: G L syzkaller #0 PREEMPT(full) [ 733.422513][T18015] Tainted: [L]=SOFTLOCKUP [ 733.422521][T18015] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 733.422533][T18015] Call Trace: [ 733.422541][T18015] [ 733.422550][T18015] dump_stack_lvl+0xe8/0x150 [ 733.422582][T18015] should_fail_ex+0x410/0x560 [ 733.422624][T18015] _copy_to_user+0x31/0xb0 [ 733.422660][T18015] simple_read_from_buffer+0xe1/0x170 [ 733.422693][T18015] proc_fail_nth_read+0x1bb/0x230 [ 733.422713][T18015] ? common_file_perm+0x20e/0x2b0 [ 733.422742][T18015] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 733.422765][T18015] ? rw_verify_area+0x24a/0x4c0 [ 733.422796][T18015] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 733.422816][T18015] vfs_read+0x213/0xa80 [ 733.422843][T18015] ? __pfx_vfs_read+0x10/0x10 [ 733.422866][T18015] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 733.422893][T18015] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 733.422916][T18015] ? __wake_up_common_lock+0x195/0x1f0 [ 733.422952][T18015] ksys_read+0x150/0x270 [ 733.422972][T18015] ? __pfx_ksys_read+0x10/0x10 [ 733.423000][T18015] do_syscall_64+0x166/0x520 [ 733.423023][T18015] ? trace_irq_disable+0x3b/0x140 [ 733.423044][T18015] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 733.423067][T18015] ? clear_bhb_loop+0x70/0xc0 [ 733.423089][T18015] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 733.423109][T18015] RIP: 0033:0x7fec1475e98e [ 733.423127][T18015] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 733.423144][T18015] RSP: 002b:00007fec15633fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 733.423166][T18015] RAX: ffffffffffffffda RBX: 00007fec156346c0 RCX: 00007fec1475e98e [ 733.423181][T18015] RDX: 000000000000000f RSI: 00007fec156340a0 RDI: 0000000000000004 [ 733.423194][T18015] RBP: 00007fec15634090 R08: 0000000000000000 R09: 0000000000000000 [ 733.423207][T18015] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 733.423220][T18015] R13: 00007fec14a26038 R14: 00007fec14a25fa0 R15: 00007fec14b4fa48 [ 733.423251][T18015] [ 733.467353][T18018] netlink: 'syz.0.4009': attribute type 21 has an invalid length. [ 733.467467][T18018] netlink: 128 bytes leftover after parsing attributes in process `syz.0.4009'. [ 733.467539][T18018] netlink: 'syz.0.4009': attribute type 4 has an invalid length. [ 733.467553][T18018] netlink: 'syz.0.4009': attribute type 5 has an invalid length. [ 733.467566][T18018] netlink: 3 bytes leftover after parsing attributes in process `syz.0.4009'. [ 733.730652][T18013] netlink: 16 bytes leftover after parsing attributes in process `syz.4.4007'. [ 733.730680][T18013] netlink: 16 bytes leftover after parsing attributes in process `syz.4.4007'. [ 733.759644][T18023] netlink: 'syz.3.4010': attribute type 4 has an invalid length. [ 733.921120][ T5680] usb 1-1: new high-speed USB device number 72 using dummy_hcd [ 734.072222][ T5680] usb 1-1: Using ep0 maxpacket: 16 [ 734.073053][ T5680] usb 1-1: New USB device found, idVendor=0bd3, idProduct=0555, bcdDevice= 0.5b [ 734.074532][ T5680] usb 1-1: config 0 has an invalid interface number: 64 but max is 0 [ 734.074560][ T5680] usb 1-1: config 0 has an invalid descriptor of length 97, skipping remainder of the config [ 734.074580][ T5680] usb 1-1: config 0 has no interface number 0 [ 734.074625][ T5680] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 734.083960][ T5680] usb 1-1: config 0 descriptor?? [ 734.124675][T18033] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 734.209795][T18037] batman_adv: batadv0: Adding interface: dummy0 [ 734.209837][T18037] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 734.212034][T18037] batman_adv: batadv0: Interface activated: dummy0 [ 734.221170][ T5687] usb 2-1: new high-speed USB device number 29 using dummy_hcd [ 734.286564][T18038] batadv0: mtu less than device minimum [ 734.287990][T18038] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 734.289320][T18038] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 734.290705][T18038] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 734.292095][T18038] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 734.293446][T18038] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 734.294875][T18038] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 734.296303][T18038] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 734.297685][T18038] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 734.299101][T18038] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 734.305814][T18018] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 734.308623][T18018] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 734.316995][ T5680] usb 1-1: string descriptor 0 read error: -71 [ 734.317055][ T5680] uvcvideo 1-1:0.64: Found UVC 0.00 device (0bd3:0555) [ 734.317082][ T5680] uvcvideo 1-1:0.64: No valid video chain found. [ 734.327084][ T5680] usb 1-1: USB disconnect, device number 72 [ 734.372715][ T5687] usb 2-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 734.373741][ T5687] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 734.373784][ T5687] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 734.384098][ T5687] usb 2-1: config 0 descriptor?? [ 734.611675][T15944] usb 4-1: new high-speed USB device number 86 using dummy_hcd [ 734.630879][T18045] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 734.763062][T15944] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 734.764656][T15944] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 734.764687][T15944] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 734.764713][T15944] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 734.764735][T15944] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 734.764798][T15944] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 734.774231][T15944] usb 4-1: config 0 descriptor?? [ 734.809606][ T5687] keytouch 0003:0926:3333.0018: fixing up Keytouch IEC report descriptor [ 734.826777][ T5687] input: HID 0926:3333 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:0926:3333.0018/input/input69 [ 734.981964][ T5687] keytouch 0003:0926:3333.0018: input,hidraw0: USB HID v0.00 Keyboard [HID 0926:3333] on usb-dummy_hcd.1-1/input0 [ 735.175490][T18047] syz.4.4020 (18047): drop_caches: 2 [ 735.177883][T18047] syz.4.4020 (18047): drop_caches: 2 [ 735.279028][T15944] plantronics 0003:047F:FFFF.0019: hiddev0,hidraw1: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 735.339000][T18054] netlink: 'syz.0.4022': attribute type 4 has an invalid length. [ 735.383260][T15944] usb 2-1: USB disconnect, device number 29 [ 735.636769][T18066] netlink: 'syz.4.4027': attribute type 4 has an invalid length. [ 735.638728][T18066] netlink: 'syz.4.4027': attribute type 4 has an invalid length. [ 735.787476][T18072] fuse: Bad value for 'fd' [ 736.122346][ T1183] usb 4-1: USB disconnect, device number 86 [ 736.147161][T15944] usb 3-1: new high-speed USB device number 56 using dummy_hcd [ 736.291067][T15944] usb 3-1: Using ep0 maxpacket: 8 [ 736.291891][T15944] usb 3-1: New USB device found, idVendor=05ac, idProduct=0290, bcdDevice= 0.00 [ 736.293035][T15944] usb 3-1: config 0 interface 0 altsetting 16 endpoint 0x81 has invalid maxpacket 9865, setting to 1024 [ 736.293067][T15944] usb 3-1: config 0 interface 0 has no altsetting 0 [ 736.293099][T15944] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 736.301350][T15944] usb 3-1: config 0 descriptor?? [ 736.302033][T18077] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 736.410239][T18098] fuse: Unknown parameter '0xffffffffffffffff0xffffffffffffffff' [ 736.506542][T18077] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 736.507053][T18077] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 736.746307][T18108] Cannot find del_set index 4 as target [ 736.823407][T18112] FAULT_INJECTION: forcing a failure. [ 736.823407][T18112] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 736.823444][T18112] CPU: 0 UID: 0 PID: 18112 Comm: syz.3.4042 Tainted: G L syzkaller #0 PREEMPT(full) [ 736.823472][T18112] Tainted: [L]=SOFTLOCKUP [ 736.823479][T18112] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 736.823492][T18112] Call Trace: [ 736.823500][T18112] [ 736.823506][T18112] dump_stack_lvl+0xe8/0x150 [ 736.823527][T18112] should_fail_ex+0x410/0x560 [ 736.823544][T18112] _copy_from_user+0x2d/0xb0 [ 736.823560][T18112] memdup_user+0x5e/0xd0 [ 736.823583][T18112] ucma_set_option+0x2cb/0xce0 [ 736.823612][T18112] ? __pfx_ucma_set_option+0x10/0x10 [ 736.823630][T18112] ? __lock_acquire+0x747/0x2de0 [ 736.823661][T18112] ? aa_file_perm+0x4ed/0x15f0 [ 736.823678][T18112] ? aa_file_perm+0x18b/0x15f0 [ 736.823699][T18112] ? lock_acquire+0x115/0x350 [ 736.823730][T18112] ucma_write+0x24e/0x2f0 [ 736.823756][T18112] ? common_file_perm+0x20e/0x2b0 [ 736.823786][T18112] ? __pfx_ucma_write+0x10/0x10 [ 736.823812][T18112] ? security_file_permission+0x75/0x260 [ 736.823826][T18112] ? rw_verify_area+0x203/0x4c0 [ 736.823843][T18112] ? __pfx_ucma_write+0x10/0x10 [ 736.823857][T18112] vfs_write+0x296/0xba0 [ 736.823877][T18112] ? __pfx_vfs_write+0x10/0x10 [ 736.823898][T18112] ? __fget_files+0x2a/0x420 [ 736.823930][T18112] ? __fget_files+0x2a/0x420 [ 736.823958][T18112] ? __fget_files+0x3a2/0x420 [ 736.823974][T18112] ? __fget_files+0x2a/0x420 [ 736.823992][T18112] ksys_write+0x150/0x270 [ 736.824005][T18112] ? __pfx_ksys_write+0x10/0x10 [ 736.824022][T18112] do_syscall_64+0x166/0x520 [ 736.824050][T18112] ? trace_irq_disable+0x3b/0x140 [ 736.824072][T18112] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 736.824092][T18112] ? clear_bhb_loop+0x70/0xc0 [ 736.824114][T18112] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 736.824124][T18112] RIP: 0033:0x7fec1479e159 [ 736.824136][T18112] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 736.824147][T18112] RSP: 002b:00007fec15634028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 736.824160][T18112] RAX: ffffffffffffffda RBX: 00007fec14a25fa0 RCX: 00007fec1479e159 [ 736.824168][T18112] RDX: 0000000000000020 RSI: 0000200000000180 RDI: 0000000000000003 [ 736.824180][T18112] RBP: 00007fec15634090 R08: 0000000000000000 R09: 0000000000000000 [ 736.824192][T18112] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 736.824205][T18112] R13: 00007fec14a26038 R14: 00007fec14a25fa0 R15: 00007fec14b4fa48 [ 736.824236][T18112] [ 736.844324][ T1183] usb 1-1: new high-speed USB device number 73 using dummy_hcd [ 737.082444][ T1183] usb 1-1: Using ep0 maxpacket: 32 [ 737.103056][ T1183] usb 1-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 737.129615][ T1183] usb 1-1: config 0 has an invalid interface number: 51 but max is 0 [ 737.129644][ T1183] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 737.129671][ T1183] usb 1-1: config 0 has no interface number 0 [ 737.129709][ T1183] usb 1-1: config 0 interface 51 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 737.132651][T15944] usb 3-1: string descriptor 0 read error: -71 [ 737.154438][T15944] input: bcm5974 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/input/input71 [ 737.187516][ T1183] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 737.187545][ T1183] usb 1-1: Product: syz [ 737.187560][ T1183] usb 1-1: Manufacturer: syz [ 737.187576][ T1183] usb 1-1: SerialNumber: syz [ 737.190434][ T1183] usb 1-1: config 0 descriptor?? [ 737.221336][ T1183] quatech2 1-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 737.227600][T15944] usb 3-1: USB disconnect, device number 56 [ 737.363254][T18124] FAULT_INJECTION: forcing a failure. [ 737.363254][T18124] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 737.363290][T18124] CPU: 1 UID: 0 PID: 18124 Comm: syz.2.4048 Tainted: G L syzkaller #0 PREEMPT(full) [ 737.363316][T18124] Tainted: [L]=SOFTLOCKUP [ 737.363323][T18124] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 737.363335][T18124] Call Trace: [ 737.363346][T18124] [ 737.363355][T18124] dump_stack_lvl+0xe8/0x150 [ 737.363388][T18124] should_fail_ex+0x410/0x560 [ 737.363418][T18124] _copy_to_user+0x31/0xb0 [ 737.363448][T18124] simple_read_from_buffer+0xe1/0x170 [ 737.363481][T18124] proc_fail_nth_read+0x1bb/0x230 [ 737.363501][T18124] ? common_file_perm+0x20e/0x2b0 [ 737.363529][T18124] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 737.363551][T18124] ? rw_verify_area+0x24a/0x4c0 [ 737.363591][T18124] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 737.363623][T18124] vfs_read+0x213/0xa80 [ 737.363647][T18124] ? __pfx___mutex_lock+0x10/0x10 [ 737.363676][T18124] ? __pfx_vfs_read+0x10/0x10 [ 737.363696][T18124] ? __fget_files+0x2a/0x420 [ 737.363728][T18124] ? __fget_files+0x3a2/0x420 [ 737.363755][T18124] ? __fget_files+0x2a/0x420 [ 737.363792][T18124] ksys_read+0x150/0x270 [ 737.363814][T18124] ? __pfx_ksys_read+0x10/0x10 [ 737.363844][T18124] do_syscall_64+0x166/0x520 [ 737.363871][T18124] ? trace_irq_disable+0x3b/0x140 [ 737.363891][T18124] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 737.363912][T18124] ? clear_bhb_loop+0x70/0xc0 [ 737.363937][T18124] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 737.363956][T18124] RIP: 0033:0x7f860115e98e [ 737.363975][T18124] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 737.363992][T18124] RSP: 002b:00007f8601fcbfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 737.364013][T18124] RAX: ffffffffffffffda RBX: 00007f8601fcc6c0 RCX: 00007f860115e98e [ 737.364029][T18124] RDX: 000000000000000f RSI: 00007f8601fcc0a0 RDI: 0000000000000006 [ 737.364042][T18124] RBP: 00007f8601fcc090 R08: 0000000000000000 R09: 0000000000000000 [ 737.364054][T18124] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 737.364068][T18124] R13: 00007f8601426038 R14: 00007f8601425fa0 R15: 00007f860154fa48 [ 737.364100][T18124] [ 737.472757][T18123] x_tables: arp_tables: CLASSIFY target: used from hooks INPUT, but only usable from FORWARD/OUTPUT [ 737.639853][T18126] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 737.643770][T18127] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 737.647082][T18126] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 737.689150][T18130] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4050'. [ 737.689184][T18130] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4050'. [ 738.040804][T18106] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 738.051981][T18106] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 738.072729][ T1183] usb 1-1: qt2_attach - failed to power on unit: -71 [ 738.072875][ T1183] quatech2 1-1:0.51: probe with driver quatech2 failed with error -71 [ 738.100173][ T1183] usb 1-1: USB disconnect, device number 73 [ 738.146747][T18143] binder_alloc: binder_alloc_mmap_handler: 18136 200000ffd000-200000fff000 already mapped failed -16 [ 738.252127][ T5723] usb 2-1: new high-speed USB device number 30 using dummy_hcd [ 738.362181][T18147] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4055'. [ 738.401088][ T5723] usb 2-1: Using ep0 maxpacket: 32 [ 738.402881][ T5723] usb 2-1: New USB device found, idVendor=05ac, idProduct=021c, bcdDevice= 0.00 [ 738.404722][ T5723] usb 2-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 738.404756][ T5723] usb 2-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 10 [ 738.404783][ T5723] usb 2-1: config 0 interface 0 has no altsetting 0 [ 738.404816][ T5723] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 738.407490][ T5723] usb 2-1: config 0 descriptor?? [ 738.471535][T18148] netlink: 40 bytes leftover after parsing attributes in process `syz.3.4055'. [ 738.929056][ T5723] hid_parser_main: 218 callbacks suppressed [ 738.929084][ T5723] apple 0003:05AC:021C.001A: unknown main item tag 0x0 [ 738.929116][ T5723] apple 0003:05AC:021C.001A: unknown main item tag 0x0 [ 738.929143][ T5723] apple 0003:05AC:021C.001A: unexpected long global item [ 738.929904][ T5723] apple 0003:05AC:021C.001A: parse failed [ 738.930008][ T5723] apple 0003:05AC:021C.001A: probe with driver apple failed with error -22 [ 739.133624][T15944] usb 2-1: USB disconnect, device number 30 [ 739.308756][T18165] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4062'. [ 739.308817][T18165] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4062'. [ 739.501335][ T1234] usb 1-1: new high-speed USB device number 74 using dummy_hcd [ 739.661203][T15944] usb 3-1: new full-speed USB device number 57 using dummy_hcd [ 739.661753][ T1234] usb 1-1: New USB device found, idVendor=1286, idProduct=2046, bcdDevice= 1.00 [ 739.681440][ T1234] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 739.687934][ T1234] usb 1-1: NFC: intf ffff88807d655000 id ffffffff8f85c4c0 [ 739.813170][T15944] usb 3-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 739.816335][T15944] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 739.816362][T15944] usb 3-1: Product: syz [ 739.816377][T15944] usb 3-1: Manufacturer: syz [ 739.816391][T15944] usb 3-1: SerialNumber: syz [ 739.822886][T15944] usb 3-1: config 0 descriptor?? [ 740.027434][T15944] usb 3-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 740.173572][T18192] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 740.173872][T18192] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 740.432957][T18206] FAULT_INJECTION: forcing a failure. [ 740.432957][T18206] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 740.432993][T18206] CPU: 0 UID: 0 PID: 18206 Comm: syz.4.4077 Tainted: G L syzkaller #0 PREEMPT(full) [ 740.433021][T18206] Tainted: [L]=SOFTLOCKUP [ 740.433029][T18206] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 740.433041][T18206] Call Trace: [ 740.433049][T18206] [ 740.433058][T18206] dump_stack_lvl+0xe8/0x150 [ 740.433092][T18206] should_fail_ex+0x410/0x560 [ 740.433123][T18206] _copy_to_user+0x31/0xb0 [ 740.433153][T18206] simple_read_from_buffer+0xe1/0x170 [ 740.433189][T18206] proc_fail_nth_read+0x1bb/0x230 [ 740.433211][T18206] ? common_file_perm+0x20e/0x2b0 [ 740.433241][T18206] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 740.433266][T18206] ? rw_verify_area+0x24a/0x4c0 [ 740.433299][T18206] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 740.433319][T18206] vfs_read+0x213/0xa80 [ 740.433344][T18206] ? __pfx___mutex_lock+0x10/0x10 [ 740.433374][T18206] ? __pfx_vfs_read+0x10/0x10 [ 740.433403][T18206] ? __fget_files+0x2a/0x420 [ 740.433436][T18206] ? __fget_files+0x3a2/0x420 [ 740.433462][T18206] ? __fget_files+0x2a/0x420 [ 740.433498][T18206] ksys_read+0x150/0x270 [ 740.433521][T18206] ? __pfx_ksys_read+0x10/0x10 [ 740.433549][T18206] do_syscall_64+0x166/0x520 [ 740.433577][T18206] ? trace_irq_disable+0x3b/0x140 [ 740.433597][T18206] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 740.433617][T18206] ? clear_bhb_loop+0x70/0xc0 [ 740.433642][T18206] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 740.433661][T18206] RIP: 0033:0x7ff48535e98e [ 740.433679][T18206] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 740.433695][T18206] RSP: 002b:00007ff4862b0fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 740.433716][T18206] RAX: ffffffffffffffda RBX: 00007ff4862b16c0 RCX: 00007ff48535e98e [ 740.433730][T18206] RDX: 000000000000000f RSI: 00007ff4862b10a0 RDI: 0000000000000004 [ 740.433744][T18206] RBP: 00007ff4862b1090 R08: 0000000000000000 R09: 0000000000000000 [ 740.433756][T18206] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 740.433772][T18206] R13: 00007ff485626038 R14: 00007ff485625fa0 R15: 00007ff48574fa48 [ 740.433800][T18206] [ 740.906230][ T5680] usb 1-1: USB disconnect, device number 74 [ 740.922812][ T1183] usb 5-1: new high-speed USB device number 113 using dummy_hcd [ 741.051073][ T1234] usb 4-1: new high-speed USB device number 87 using dummy_hcd [ 741.073301][ T1183] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 741.074637][ T1183] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 741.074669][ T1183] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 741.074697][ T1183] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 741.074719][ T1183] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 741.074761][ T1183] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 741.078873][ T1183] usb 5-1: config 0 descriptor?? [ 741.231894][ T1234] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 741.235307][ T1234] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 741.235355][ T1234] usb 4-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 18 [ 741.237691][ T1234] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 741.237715][ T1234] usb 4-1: SerialNumber: syz [ 741.289941][ T1234] cdc_ether 4-1:1.0: invalid descriptor buffer length [ 741.289955][ T1234] cdc_ether 4-1:1.0: missing cdc ether descriptor [ 741.740186][ T1183] usbhid 5-1:0.0: can't add hid device: -71 [ 741.740355][ T1183] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 741.812700][ T1183] usb 5-1: USB disconnect, device number 113 [ 741.833784][ T5680] usb 4-1: USB disconnect, device number 87 [ 742.122067][T15944] dvb_usb_rtl28xxu 3-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 742.130618][T15944] usb 3-1: USB disconnect, device number 57 [ 742.539922][T18241] FAULT_INJECTION: forcing a failure. [ 742.539922][T18241] name failslab, interval 1, probability 0, space 0, times 0 [ 742.539957][T18241] CPU: 0 UID: 0 PID: 18241 Comm: syz.3.4091 Tainted: G L syzkaller #0 PREEMPT(full) [ 742.539984][T18241] Tainted: [L]=SOFTLOCKUP [ 742.539992][T18241] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 742.540004][T18241] Call Trace: [ 742.540013][T18241] [ 742.540022][T18241] dump_stack_lvl+0xe8/0x150 [ 742.540055][T18241] should_fail_ex+0x410/0x560 [ 742.540086][T18241] should_failslab+0xa8/0x100 [ 742.540113][T18241] ? skb_clone+0x212/0x3a0 [ 742.540133][T18241] kmem_cache_alloc_noprof+0xa1/0x600 [ 742.540156][T18241] ? skb_clone+0x212/0x3a0 [ 742.540182][T18241] skb_clone+0x212/0x3a0 [ 742.540205][T18241] __netlink_deliver_tap+0x413/0x860 [ 742.540238][T18241] ? netlink_deliver_tap+0x2e/0x1b0 [ 742.540268][T18241] netlink_deliver_tap+0x19c/0x1b0 [ 742.540292][T18241] netlink_unicast+0x781/0x940 [ 742.540333][T18241] netlink_sendmsg+0x813/0xb40 [ 742.540365][T18241] ? __pfx_netlink_sendmsg+0x10/0x10 [ 742.540395][T18241] ? apparmor_socket_sendmsg+0x98/0x360 [ 742.540424][T18241] ? __pfx_netlink_sendmsg+0x10/0x10 [ 742.540443][T18241] sock_sendmsg_nosec+0x13a/0x180 [ 742.540468][T18241] ____sys_sendmsg+0x54e/0x850 [ 742.540497][T18241] ? __pfx_____sys_sendmsg+0x10/0x10 [ 742.540536][T18241] ? import_iovec+0x73/0xa0 [ 742.540567][T18241] ___sys_sendmsg+0x2a5/0x360 [ 742.540595][T18241] ? __lock_acquire+0x747/0x2de0 [ 742.540623][T18241] ? __pfx____sys_sendmsg+0x10/0x10 [ 742.540687][T18241] ? __fget_files+0x2a/0x420 [ 742.540716][T18241] ? __fget_files+0x3a2/0x420 [ 742.540763][T18241] __x64_sys_sendmsg+0x1b1/0x290 [ 742.540801][T18241] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 742.540852][T18241] do_syscall_64+0x166/0x520 [ 742.540880][T18241] ? trace_irq_disable+0x3b/0x140 [ 742.540901][T18241] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 742.540922][T18241] ? clear_bhb_loop+0x70/0xc0 [ 742.540945][T18241] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 742.540962][T18241] RIP: 0033:0x7fec1479e159 [ 742.540980][T18241] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 742.540995][T18241] RSP: 002b:00007fec15634028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 742.541015][T18241] RAX: ffffffffffffffda RBX: 00007fec14a25fa0 RCX: 00007fec1479e159 [ 742.541030][T18241] RDX: 0000000000000000 RSI: 0000200000000700 RDI: 0000000000000003 [ 742.541042][T18241] RBP: 00007fec15634090 R08: 0000000000000000 R09: 0000000000000000 [ 742.541053][T18241] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 742.541065][T18241] R13: 00007fec14a26038 R14: 00007fec14a25fa0 R15: 00007fec14b4fa48 [ 742.541095][T18241] [ 742.568740][T18243] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4092'. [ 742.575723][T18226] net_ratelimit: 10 callbacks suppressed [ 742.575742][T18226] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 742.575953][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 742.601084][ T5723] usb 2-1: new low-speed USB device number 31 using dummy_hcd [ 742.753081][ T5723] usb 2-1: New USB device found, idVendor=0419, idProduct=0600, bcdDevice= 0.00 [ 742.761137][ T5723] usb 2-1: config 255 has too many interfaces: 229, using maximum allowed: 32 [ 742.761166][ T5723] usb 2-1: config 255 has 1 interface, different from the descriptor's value: 229 [ 742.761209][ T5723] usb 2-1: config 255 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 742.761234][ T5723] usb 2-1: config 255 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 742.761257][ T5723] usb 2-1: config 255 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 742.761297][ T5723] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 743.023916][T18253] loop9: detected capacity change from 0 to 7 [ 743.028320][ C1] blk_print_req_error: 53 callbacks suppressed [ 743.028334][ C1] I/O error, dev loop9, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 743.028388][ C1] Buffer I/O error on dev loop9, logical block 0, async page read [ 743.028786][ C1] I/O error, dev loop9, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 743.028827][ C1] Buffer I/O error on dev loop9, logical block 0, async page read [ 743.031186][ C1] I/O error, dev loop9, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 743.031262][ C1] Buffer I/O error on dev loop9, logical block 0, async page read [ 743.046036][T18232] fuse: Bad value for 'user_id' [ 743.046056][T18232] fuse: Bad value for 'user_id' [ 743.046367][ C1] I/O error, dev loop9, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 743.046446][ C1] Buffer I/O error on dev loop9, logical block 0, async page read [ 743.051073][ C1] I/O error, dev loop9, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 743.051175][ C1] Buffer I/O error on dev loop9, logical block 0, async page read [ 743.060313][ C1] I/O error, dev loop9, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 743.060410][ C1] Buffer I/O error on dev loop9, logical block 0, async page read [ 743.062314][ C1] I/O error, dev loop9, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 743.062395][ C1] Buffer I/O error on dev loop9, logical block 0, async page read [ 743.062449][T18253] ldm_validate_partition_table(): Disk read failed. [ 743.062619][ C1] I/O error, dev loop9, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 743.062679][ C1] Buffer I/O error on dev loop9, logical block 0, async page read [ 743.062836][ C1] I/O error, dev loop9, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 743.062904][ C1] Buffer I/O error on dev loop9, logical block 0, async page read [ 743.063046][ C1] I/O error, dev loop9, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 743.063118][ C1] Buffer I/O error on dev loop9, logical block 0, async page read [ 743.063678][T18253] Dev loop9: unable to read RDB block 0 [ 743.068869][T18253] loop9: unable to read partition table [ 743.069080][T18253] loop9: partition table beyond EOD, truncated [ 743.069133][T18253] loop_reread_partitions: partition scan of loop9 (ъщ) failed (rc=-5) [ 743.122780][T18253] support for the xor transformation has been removed. [ 743.320315][T18259] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4099'. [ 743.320363][T18259] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4099'. [ 743.460832][ T5723] input: HID 0419:0600 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:255.0/0003:0419:0600.001B/input/input72 [ 743.601101][ T1234] usb 1-1: new full-speed USB device number 75 using dummy_hcd [ 743.618787][ T5723] samsung 0003:0419:0600.001B: input,hidraw0: USB HID v0.00 Joystick [HID 0419:0600] on usb-dummy_hcd.1-1/input0 [ 743.751911][ T1234] usb 1-1: New USB device found, idVendor=05ac, idProduct=0231, bcdDevice= 0.00 [ 743.753009][ T1234] usb 1-1: config 0 interface 0 altsetting 255 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 743.753041][ T1234] usb 1-1: config 0 interface 0 altsetting 255 endpoint 0x81 has invalid maxpacket 1024, setting to 64 [ 743.753069][ T1234] usb 1-1: config 0 interface 0 altsetting 255 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 743.753096][ T1234] usb 1-1: config 0 interface 0 has no altsetting 0 [ 743.753129][ T1234] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 743.755070][T18273] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 743.755817][T18273] batman_adv: batadv0: Adding interface: gretap1 [ 743.755831][T18273] batman_adv: batadv0: The MTU of interface gretap1 is too small (1462) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 743.755861][T18273] batman_adv: batadv0: Interface activated: gretap1 [ 743.758524][ T1234] usb 1-1: config 0 descriptor?? [ 743.759277][T18262] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 743.895948][ T1234] input: bcm5974 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/input/input73 [ 744.023743][ T5615] usb 5-1: new high-speed USB device number 114 using dummy_hcd [ 744.045855][T18283] validate_nla: 3 callbacks suppressed [ 744.045898][T18283] netlink: 'syz.2.4108': attribute type 21 has an invalid length. [ 744.045914][T18283] netlink: 128 bytes leftover after parsing attributes in process `syz.2.4108'. [ 744.045987][T18283] netlink: 'syz.2.4108': attribute type 4 has an invalid length. [ 744.046003][T18283] netlink: 'syz.2.4108': attribute type 5 has an invalid length. [ 744.046351][T18283] netlink: 3 bytes leftover after parsing attributes in process `syz.2.4108'. [ 744.117883][T18285] netlink: 40 bytes leftover after parsing attributes in process `syz.0.4100'. [ 744.133000][T18285] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 744.133134][T18285] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 744.133302][T18285] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 744.134079][T18285] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 744.135184][T18285] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 744.135296][T18285] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 744.135387][T18285] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 744.135520][T18285] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 744.203951][ T4932] Bluetooth: hci0: command 0x0406 tx timeout [ 744.204142][ T5615] usb 5-1: Using ep0 maxpacket: 8 [ 744.232266][ T5615] usb 5-1: New USB device found, idVendor=0e8d, idProduct=763f, bcdDevice=9b.23 [ 744.234673][ T5615] usb 5-1: config 162 has an invalid interface number: 84 but max is 2 [ 744.234699][ T5615] usb 5-1: config 162 has an invalid interface number: 3 but max is 2 [ 744.234719][ T5615] usb 5-1: config 162 has no interface number 0 [ 744.234735][ T5615] usb 5-1: config 162 has no interface number 1 [ 744.234815][ T5615] usb 5-1: config 162 interface 84 altsetting 2 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 744.234845][ T5615] usb 5-1: config 162 interface 2 altsetting 1 has a duplicate endpoint with address 0x9, skipping [ 744.234864][ T5615] usb 5-1: config 162 interface 2 altsetting 1 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 744.234883][ T5615] usb 5-1: config 162 interface 2 altsetting 1 endpoint 0x86 has invalid maxpacket 23105, setting to 1024 [ 744.234924][ T5615] usb 5-1: config 162 interface 2 altsetting 1 bulk endpoint 0x86 has invalid maxpacket 1024 [ 744.234945][ T5615] usb 5-1: config 162 interface 2 altsetting 1 has 5 endpoint descriptors, different from the interface descriptor's value: 4 [ 744.234969][ T5615] usb 5-1: config 162 interface 84 has no altsetting 0 [ 744.234987][ T5615] usb 5-1: config 162 interface 2 has no altsetting 0 [ 744.235004][ T5615] usb 5-1: config 162 interface 3 has no altsetting 0 [ 744.363389][ T5615] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 744.363418][ T5615] usb 5-1: Product: syz [ 744.363433][ T5615] usb 5-1: Manufacturer: syz [ 744.363448][ T5615] usb 5-1: SerialNumber: syz [ 744.424083][ T5723] usb 2-1: USB disconnect, device number 31 [ 744.810300][T18293] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4111'. [ 744.810333][T18293] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4111'. [ 745.112090][T18299] syzkaller1: entered promiscuous mode [ 745.112105][T18299] syzkaller1: entered allmulticast mode [ 745.342163][T17000] Bluetooth: hci2: Opcode 0x0c03 failed: -71 [ 745.344397][ T5615] usb 5-1: USB disconnect, device number 114 [ 745.671146][ T5680] usb 4-1: new high-speed USB device number 88 using dummy_hcd [ 745.821089][ T5680] usb 4-1: Using ep0 maxpacket: 32 [ 745.822097][ T5680] usb 4-1: New USB device found, idVendor=05ef, idProduct=020a, bcdDevice=91.36 [ 745.823341][ T5680] usb 4-1: config 0 has an invalid descriptor of length 255, skipping remainder of the config [ 745.823386][ T5680] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 745.823413][ T5680] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x86 has an invalid bInterval 255, changing to 11 [ 745.823440][ T5680] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x86 has invalid wMaxPacketSize 0 [ 745.823462][ T5680] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 745.825697][ T5680] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 745.825720][ T5680] usb 4-1: Product: syz [ 745.825733][ T5680] usb 4-1: Manufacturer: syz [ 745.825747][ T5680] usb 4-1: SerialNumber: syz [ 745.828641][ T5680] usb 4-1: config 0 descriptor?? [ 745.932263][ T5615] usb 3-1: new high-speed USB device number 58 using dummy_hcd [ 746.061240][ T1183] usb 5-1: new high-speed USB device number 115 using dummy_hcd [ 746.091748][ T5615] usb 3-1: New USB device found, idVendor=1b96, idProduct=0011, bcdDevice= 0.00 [ 746.092921][ T5615] usb 3-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 746.092950][ T5615] usb 3-1: config 0 interface 0 altsetting 8 endpoint 0x81 has invalid wMaxPacketSize 0 [ 746.092962][ T5615] usb 3-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 746.092993][ T5615] usb 3-1: config 0 interface 0 has no altsetting 0 [ 746.093013][ T5615] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 746.095172][ T5615] usb 3-1: config 0 descriptor?? [ 746.251700][ T1183] usb 5-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 746.252870][ T1183] usb 5-1: config 0 interface 0 altsetting 255 bulk endpoint 0x4 has invalid maxpacket 61 [ 746.252889][ T1183] usb 5-1: config 0 interface 0 has no altsetting 0 [ 746.255793][ T1183] usb 5-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 746.255808][ T1183] usb 5-1: Product: syz [ 746.255836][ T1183] usb 5-1: Manufacturer: syz [ 746.255844][ T1183] usb 5-1: SerialNumber: syz [ 746.259152][ T1183] usb 5-1: config 0 descriptor?? [ 746.260120][T18310] raw-gadget.4 gadget.4: fail, usb_ep_enable returned -22 [ 746.333419][ T1183] usb 5-1: selecting invalid altsetting 0 [ 746.546346][ T5615] input: HID 1b96:0011 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:1B96:0011.001C/input/input74 [ 746.569456][T18310] usb 5-1: BOGUS urb xfer, pipe 0 != type 3 [ 746.594428][T15944] usb 5-1: USB disconnect, device number 115 [ 747.199891][ T4968] bcm5974 1-1:0.0: could not read from device [ 747.218551][ T4968] bcm5974 1-1:0.0: could not read from device [ 747.222484][ T4968] bcm5974 1-1:0.0: could not read from device [ 747.235504][ T1255] ieee802154 phy0 wpan0: encryption failed: -22 [ 747.235562][ T1255] ieee802154 phy1 wpan1: encryption failed: -22 [ 747.237086][ T4968] bcm5974 1-1:0.0: could not read from device [ 747.273715][ T1234] usb 1-1: USB disconnect, device number 75 [ 747.368512][T18316] syzkaller0: entered promiscuous mode [ 747.368535][T18316] syzkaller0: entered allmulticast mode [ 747.390128][ T5615] ntrig 0003:1B96:0011.001C: offset (1) exceeds report_count (1) [ 747.390164][ T5615] ntrig 0003:1B96:0011.001C: offset (2) exceeds report_count (1) [ 747.390183][ T5615] ntrig 0003:1B96:0011.001C: offset (3) exceeds report_count (1) [ 747.390202][ T5615] ntrig 0003:1B96:0011.001C: offset (4) exceeds report_count (1) [ 747.390221][ T5615] ntrig 0003:1B96:0011.001C: offset (5) exceeds report_count (1) [ 747.390240][ T5615] ntrig 0003:1B96:0011.001C: offset (39) exceeds report_count (1) [ 747.390259][ T5615] ntrig 0003:1B96:0011.001C: offset (9) exceeds report_count (1) [ 747.390277][ T5615] ntrig 0003:1B96:0011.001C: offset (25) exceeds report_count (1) [ 747.490379][ T5615] ntrig 0003:1B96:0011.001C: offset (2) exceeds report_count (1) [ 747.605648][ T5615] ntrig 0003:1B96:0011.001C: input,hidraw0: USB HID v0.04 Joystick [HID 1b96:0011] on usb-dummy_hcd.2-1/input0 [ 747.631345][ T5615] usb 3-1: USB disconnect, device number 58 [ 747.672323][ T5723] usb 2-1: new high-speed USB device number 32 using dummy_hcd [ 747.689125][ T5615] ntrig 0003:1B96:0011.001C: offset (2) exceeds report_count (1) [ 747.823386][ T5723] usb 2-1: Using ep0 maxpacket: 32 [ 747.826602][ T5723] usb 2-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 747.827842][ T5723] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 747.827872][ T5723] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 747.827909][ T5723] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 747.849483][ T5723] usb 2-1: config 0 descriptor?? [ 747.967490][T18329] fido_id[18329]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.2/usb3/3-1/report_descriptor': No such file or directory [ 748.035790][T18332] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4123'. [ 748.035837][T18332] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4123'. [ 748.127676][ T5723] usbhid 2-1:0.0: can't add hid device: -71 [ 748.127787][ T5723] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 748.157536][ T5723] usb 2-1: USB disconnect, device number 32 [ 748.281714][ T1234] usb 5-1: new high-speed USB device number 116 using dummy_hcd [ 748.321061][ T5615] usb 3-1: new high-speed USB device number 59 using dummy_hcd [ 748.431163][ T1234] usb 5-1: Using ep0 maxpacket: 32 [ 748.431922][ T1234] usb 5-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 748.433242][ T1234] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 748.433320][ T1234] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 748.433344][ T1234] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 748.501098][ T1234] usb 5-1: config 0 descriptor?? [ 748.521031][ T5615] usb 3-1: Using ep0 maxpacket: 8 [ 748.521723][ T5615] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 748.527019][ T5615] usb 3-1: config index 0 descriptor too short (expected 301, got 45) [ 748.527047][ T5615] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 748.527058][ T5615] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 748.527096][ T5615] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 748.529207][ T5615] usb 3-1: config 0 descriptor?? [ 748.650766][T15944] usb 4-1: USB disconnect, device number 88 [ 748.748979][ T31] kauditd_printk_skb: 19 callbacks suppressed [ 748.748999][ T31] audit: type=1326 audit(1791032624.528:2417): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18349 comm="syz.1.4128" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe9eeb9e159 code=0x7ffc0000 [ 748.765234][ T31] audit: type=1326 audit(1791032624.548:2418): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18349 comm="syz.1.4128" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe9eeb9e159 code=0x7ffc0000 [ 748.815082][ T31] audit: type=1326 audit(1791032624.598:2419): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18349 comm="syz.1.4128" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fe9eeb9e159 code=0x7ffc0000 [ 748.815132][ T31] audit: type=1326 audit(1791032624.598:2420): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18349 comm="syz.1.4128" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe9eeb9e159 code=0x7ffc0000 [ 748.815168][ T31] audit: type=1326 audit(1791032624.598:2421): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18349 comm="syz.1.4128" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe9eeb9e159 code=0x7ffc0000 [ 748.907209][ T31] audit: type=1326 audit(1791032624.688:2422): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18349 comm="syz.1.4128" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7fe9eeb9e159 code=0x7ffc0000 [ 748.907264][ T31] audit: type=1326 audit(1791032624.688:2423): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18349 comm="syz.1.4128" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe9eeb9e159 code=0x7ffc0000 [ 748.907305][ T31] audit: type=1326 audit(1791032624.688:2424): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18349 comm="syz.1.4128" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe9eeb9e159 code=0x7ffc0000 [ 748.914179][ T31] audit: type=1326 audit(1791032624.698:2425): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18349 comm="syz.1.4128" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=334 compat=0 ip=0x7fe9eeb9e159 code=0x7ffc0000 [ 748.914226][ T31] audit: type=1326 audit(1791032624.698:2426): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18349 comm="syz.1.4128" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe9eeb9e159 code=0x7ffc0000 [ 748.959977][ T5723] usb 1-1: new high-speed USB device number 76 using dummy_hcd [ 749.087624][T18354] netlink: 'syz.3.4129': attribute type 10 has an invalid length. [ 749.122260][ T5723] usb 1-1: New USB device found, idVendor=0582, idProduct=0582, bcdDevice= 0.40 [ 749.127691][ T5723] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 749.127718][ T5723] usb 1-1: config 1 has 0 interfaces, different from the descriptor's value: 3 [ 749.163563][T18354] team0 (unregistering): Port device team_slave_0 removed [ 749.167379][ T5723] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 749.167432][ T5723] usb 1-1: Product: syz [ 749.167447][ T5723] usb 1-1: Manufacturer: syz [ 749.167462][ T5723] usb 1-1: SerialNumber: syz [ 749.238819][T18354] team0 (unregistering): Port device team_slave_1 removed [ 749.521505][ T5723] usb 1-1: USB disconnect, device number 76 [ 749.989643][T18335] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 750.006479][T18335] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 750.157156][T18364] syzkaller0: entered promiscuous mode [ 750.157175][T18364] syzkaller0: entered allmulticast mode [ 750.276249][T18368] syz_tun: entered allmulticast mode [ 750.295719][T18367] syz_tun: left allmulticast mode [ 750.545318][ T1234] usbhid 5-1:0.0: can't add hid device: -71 [ 750.545414][ T1234] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 750.574751][ T1234] usb 5-1: USB disconnect, device number 116 [ 750.881072][T15944] usb 2-1: new high-speed USB device number 33 using dummy_hcd [ 750.971435][ T5723] usb 1-1: new high-speed USB device number 77 using dummy_hcd [ 751.036986][T15944] usb 2-1: New USB device found, idVendor=1d50, idProduct=614d, bcdDevice= 1.00 [ 751.038095][T15944] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 751.038135][T15944] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 751.038148][T15944] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 751.038160][T15944] usb 2-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 751.038184][T15944] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 751.126869][ T5723] usb 1-1: New USB device found, idVendor=0582, idProduct=0582, bcdDevice= 0.40 [ 751.128931][ T5723] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 751.128961][ T5723] usb 1-1: config 1 has 0 interfaces, different from the descriptor's value: 3 [ 751.131613][ T5723] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 751.131638][ T5723] usb 1-1: Product: syz [ 751.131652][ T5723] usb 1-1: Manufacturer: syz [ 751.131667][ T5723] usb 1-1: SerialNumber: syz [ 751.244135][ T5680] usb 3-1: USB disconnect, device number 59 [ 751.355716][T18385] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 751.457856][ T5723] usb 1-1: USB disconnect, device number 77 [ 751.870190][T15944] gud 2-1:1.0: probe with driver gud failed with error -71 [ 751.912515][T15944] usb 2-1: USB disconnect, device number 33 [ 752.263078][T18401] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4139'. [ 752.263113][T18401] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4139'. [ 752.731170][ T5680] usb 3-1: new high-speed USB device number 60 using dummy_hcd [ 752.749762][T18413] FAULT_INJECTION: forcing a failure. [ 752.749762][T18413] name failslab, interval 1, probability 0, space 0, times 0 [ 752.749799][T18413] CPU: 1 UID: 0 PID: 18413 Comm: syz.1.4142 Tainted: G L syzkaller #0 PREEMPT(full) [ 752.749827][T18413] Tainted: [L]=SOFTLOCKUP [ 752.749835][T18413] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 752.749848][T18413] Call Trace: [ 752.749856][T18413] [ 752.749865][T18413] dump_stack_lvl+0xe8/0x150 [ 752.749901][T18413] should_fail_ex+0x410/0x560 [ 752.749931][T18413] should_failslab+0xa8/0x100 [ 752.749961][T18413] ? skb_clone+0x212/0x3a0 [ 752.750031][T18413] kmem_cache_alloc_noprof+0xa1/0x600 [ 752.750055][T18413] ? skb_clone+0x212/0x3a0 [ 752.750080][T18413] skb_clone+0x212/0x3a0 [ 752.750102][T18413] __netlink_deliver_tap+0x413/0x860 [ 752.750136][T18413] ? netlink_deliver_tap+0x2e/0x1b0 [ 752.750160][T18413] netlink_deliver_tap+0x19c/0x1b0 [ 752.750183][T18413] netlink_unicast+0x781/0x940 [ 752.750225][T18413] netlink_sendmsg+0x813/0xb40 [ 752.750256][T18413] ? __pfx_netlink_sendmsg+0x10/0x10 [ 752.750286][T18413] ? apparmor_socket_sendmsg+0x98/0x360 [ 752.750314][T18413] ? __pfx_netlink_sendmsg+0x10/0x10 [ 752.750335][T18413] sock_sendmsg_nosec+0x13a/0x180 [ 752.750361][T18413] ____sys_sendmsg+0x54e/0x850 [ 752.750394][T18413] ? __pfx_____sys_sendmsg+0x10/0x10 [ 752.750429][T18413] ? import_iovec+0x73/0xa0 [ 752.750457][T18413] ___sys_sendmsg+0x2a5/0x360 [ 752.750485][T18413] ? __lock_acquire+0x747/0x2de0 [ 752.750506][T18413] ? __pfx____sys_sendmsg+0x10/0x10 [ 752.750539][T18413] ? __fget_files+0x2a/0x420 [ 752.750553][T18413] ? __fget_files+0x3a2/0x420 [ 752.750573][T18413] __x64_sys_sendmsg+0x1b1/0x290 [ 752.750590][T18413] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 752.750615][T18413] do_syscall_64+0x166/0x520 [ 752.750630][T18413] ? trace_irq_disable+0x3b/0x140 [ 752.750641][T18413] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 752.750653][T18413] ? clear_bhb_loop+0x70/0xc0 [ 752.750666][T18413] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 752.750676][T18413] RIP: 0033:0x7fe9eeb9e159 [ 752.750688][T18413] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 752.750697][T18413] RSP: 002b:00007fe9efa65028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 752.750711][T18413] RAX: ffffffffffffffda RBX: 00007fe9eee25fa0 RCX: 00007fe9eeb9e159 [ 752.750719][T18413] RDX: 0000000000000014 RSI: 0000200000000600 RDI: 0000000000000003 [ 752.750727][T18413] RBP: 00007fe9efa65090 R08: 0000000000000000 R09: 0000000000000000 [ 752.750736][T18413] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 752.750745][T18413] R13: 00007fe9eee26038 R14: 00007fe9eee25fa0 R15: 00007fe9eef4fa48 [ 752.750765][T18413] [ 752.861096][ T5680] usb 3-1: device descriptor read/64, error -71 [ 753.131141][ T5680] usb 3-1: new high-speed USB device number 61 using dummy_hcd [ 753.263512][ T5680] usb 3-1: device descriptor read/64, error -71 [ 753.375032][ T5680] usb usb3-port1: attempt power cycle [ 753.711328][ T5680] usb 3-1: new high-speed USB device number 62 using dummy_hcd [ 753.733830][ T5680] usb 3-1: device descriptor read/8, error -71 [ 753.811064][ T5723] usb 4-1: new high-speed USB device number 89 using dummy_hcd [ 753.961106][ T5723] usb 4-1: Using ep0 maxpacket: 32 [ 753.961825][ T5723] usb 4-1: New USB device found, idVendor=1d50, idProduct=60a1, bcdDevice=a1.4f [ 753.968432][ T5723] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 753.968534][ T5723] usb 4-1: Product: syz [ 753.968550][ T5723] usb 4-1: Manufacturer: syz [ 753.968565][ T5723] usb 4-1: SerialNumber: syz [ 753.971994][ T5680] usb 3-1: new high-speed USB device number 63 using dummy_hcd [ 753.977049][ T5723] usb 4-1: config 0 descriptor?? [ 753.999143][ T5680] usb 3-1: device descriptor read/8, error -71 [ 754.106110][ T5680] usb usb3-port1: unable to enumerate USB device [ 754.390164][ T5723] airspy 4-1:0.0: Board ID: 00 [ 754.390188][ T5723] airspy 4-1:0.0: Firmware version: [ 754.479395][T18461] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 754.479879][T18461] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 754.603904][ T5723] airspy 4-1:0.0: usb_control_msg() failed -71 request 11 [ 754.607128][ T5723] airspy 4-1:0.0: Registered as swradio24 [ 754.607149][ T5723] airspy 4-1:0.0: SDR API is still slightly experimental and functionality changes may follow [ 754.616518][ T5723] usb 4-1: USB disconnect, device number 89 [ 754.715271][T17855] usb 5-1: new high-speed USB device number 117 using dummy_hcd [ 754.862221][T17855] usb 5-1: New USB device found, idVendor=2a39, idProduct=3fd4, bcdDevice= 0.40 [ 754.863364][T17855] usb 5-1: config 1 interface 0 altsetting 0 has an endpoint descriptor with address 0xCE, changing to 0x8E [ 754.863393][T17855] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x8E has invalid maxpacket 999, setting to 64 [ 754.866260][T17855] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 754.866285][T17855] usb 5-1: Product: syz [ 754.866300][T17855] usb 5-1: Manufacturer: syz [ 754.866314][T17855] usb 5-1: SerialNumber: syz [ 755.055847][T18463] FAULT_INJECTION: forcing a failure. [ 755.055847][T18463] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 755.055886][T18463] CPU: 0 UID: 0 PID: 18463 Comm: syz.1.4149 Tainted: G L syzkaller #0 PREEMPT(full) [ 755.055912][T18463] Tainted: [L]=SOFTLOCKUP [ 755.055921][T18463] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 755.055932][T18463] Call Trace: [ 755.055940][T18463] [ 755.055950][T18463] dump_stack_lvl+0xe8/0x150 [ 755.055983][T18463] should_fail_ex+0x410/0x560 [ 755.056013][T18463] core_sys_select+0x8be/0xb40 [ 755.056038][T18463] ? get_pid_task+0x20/0x1f0 [ 755.056069][T18463] ? __pfx_core_sys_select+0x10/0x10 [ 755.056114][T18463] ? __pfx_set_user_sigmask+0x10/0x10 [ 755.056140][T18463] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 755.056175][T18463] __se_sys_pselect6+0x267/0x320 [ 755.056204][T18463] ? __pfx___se_sys_pselect6+0x10/0x10 [ 755.056230][T18463] ? __pfx_ksys_write+0x10/0x10 [ 755.056255][T18463] ? __x64_sys_pselect6+0x21/0xf0 [ 755.056282][T18463] do_syscall_64+0x166/0x520 [ 755.056307][T18463] ? trace_irq_disable+0x3b/0x140 [ 755.056328][T18463] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 755.056349][T18463] ? clear_bhb_loop+0x70/0xc0 [ 755.056372][T18463] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 755.056391][T18463] RIP: 0033:0x7fe9eeb9e159 [ 755.056410][T18463] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 755.056427][T18463] RSP: 002b:00007fe9efa44028 EFLAGS: 00000246 ORIG_RAX: 000000000000010e [ 755.056448][T18463] RAX: ffffffffffffffda RBX: 00007fe9eee26090 RCX: 00007fe9eeb9e159 [ 755.056464][T18463] RDX: 0000000000000000 RSI: 0000200000000100 RDI: 0000000000000040 [ 755.056478][T18463] RBP: 00007fe9efa44090 R08: 0000000000000000 R09: 0000000000000000 [ 755.056491][T18463] R10: 0000200000001340 R11: 0000000000000246 R12: 0000000000000001 [ 755.056504][T18463] R13: 00007fe9eee26128 R14: 00007fe9eee26090 R15: 00007fe9eef4fa48 [ 755.056535][T18463] [ 755.100702][T17855] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 755.100756][T17855] usb 5-1: MIDIStreaming interface descriptor not found [ 755.327454][T17855] usb 5-1: USB disconnect, device number 117 [ 755.425851][T18337] udevd[18337]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 755.576010][T18485] FAULT_INJECTION: forcing a failure. [ 755.576010][T18485] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 755.576047][T18485] CPU: 1 UID: 0 PID: 18485 Comm: syz.3.4154 Tainted: G L syzkaller #0 PREEMPT(full) [ 755.576074][T18485] Tainted: [L]=SOFTLOCKUP [ 755.576082][T18485] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 755.576094][T18485] Call Trace: [ 755.576102][T18485] [ 755.576111][T18485] dump_stack_lvl+0xe8/0x150 [ 755.576144][T18485] should_fail_ex+0x410/0x560 [ 755.576175][T18485] _copy_from_user+0x2d/0xb0 [ 755.576204][T18485] ____sys_sendmsg+0x303/0x850 [ 755.576240][T18485] ? __pfx_____sys_sendmsg+0x10/0x10 [ 755.576279][T18485] ? import_iovec+0x73/0xa0 [ 755.576309][T18485] ___sys_sendmsg+0x2a5/0x360 [ 755.576336][T18485] ? __lock_acquire+0x747/0x2de0 [ 755.576362][T18485] ? __pfx____sys_sendmsg+0x10/0x10 [ 755.576397][T18485] ? kstrtouint+0x6e/0xe0 [ 755.576442][T18485] ? __fget_files+0x2a/0x420 [ 755.576469][T18485] ? __fget_files+0x3a2/0x420 [ 755.576506][T18485] __sys_sendmmsg+0x273/0x4d0 [ 755.576541][T18485] ? __pfx___sys_sendmmsg+0x10/0x10 [ 755.576580][T18485] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 755.576624][T18485] ? ksys_write+0x242/0x270 [ 755.576644][T18485] ? __pfx_ksys_write+0x10/0x10 [ 755.576667][T18485] __x64_sys_sendmmsg+0xa0/0xc0 [ 755.576696][T18485] do_syscall_64+0x166/0x520 [ 755.576721][T18485] ? trace_irq_disable+0x3b/0x140 [ 755.576740][T18485] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 755.576761][T18485] ? clear_bhb_loop+0x70/0xc0 [ 755.576785][T18485] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 755.576804][T18485] RIP: 0033:0x7fec1479e159 [ 755.576832][T18485] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 755.576849][T18485] RSP: 002b:00007fec15634028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 755.576871][T18485] RAX: ffffffffffffffda RBX: 00007fec14a25fa0 RCX: 00007fec1479e159 [ 755.576886][T18485] RDX: 0000000000000001 RSI: 0000200000000500 RDI: 0000000000000003 [ 755.576900][T18485] RBP: 00007fec15634090 R08: 0000000000000000 R09: 0000000000000000 [ 755.576913][T18485] R10: 0000000004000000 R11: 0000000000000246 R12: 0000000000000001 [ 755.576926][T18485] R13: 00007fec14a26038 R14: 00007fec14a25fa0 R15: 00007fec14b4fa48 [ 755.576957][T18485] [ 755.860717][ T31] kauditd_printk_skb: 28 callbacks suppressed [ 755.860736][ T31] audit: type=1326 audit(1791032631.638:2455): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18496 comm="syz.1.4155" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe9eeb9e159 code=0x7ffc0000 [ 755.860778][ T31] audit: type=1326 audit(1791032631.638:2456): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18496 comm="syz.1.4155" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe9eeb9e159 code=0x7ffc0000 [ 755.893404][ T31] audit: type=1326 audit(1791032631.668:2457): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18496 comm="syz.1.4155" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=334 compat=0 ip=0x7fe9eeb9e159 code=0x7ffc0000 [ 755.893467][ T31] audit: type=1326 audit(1791032631.668:2458): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18496 comm="syz.1.4155" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe9eeb9e159 code=0x7ffc0000 [ 755.893510][ T31] audit: type=1326 audit(1791032631.668:2459): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18496 comm="syz.1.4155" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe9eeb9e159 code=0x7ffc0000 [ 755.897299][ T31] audit: type=1326 audit(1791032631.678:2460): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18496 comm="syz.1.4155" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fe9eeb9e159 code=0x7ffc0000 [ 755.897361][ T31] audit: type=1326 audit(1791032631.678:2461): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18496 comm="syz.1.4155" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe9eeb9e159 code=0x7ffc0000 [ 755.897401][ T31] audit: type=1326 audit(1791032631.678:2462): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18496 comm="syz.1.4155" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe9eeb9e159 code=0x7ffc0000 [ 755.897913][ T31] audit: type=1326 audit(1791032631.678:2463): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18496 comm="syz.1.4155" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fe9eeb9e159 code=0x7ffc0000 [ 755.942072][ T31] audit: type=1326 audit(1791032631.728:2464): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18496 comm="syz.1.4155" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe9eeb9e159 code=0x7ffc0000 [ 756.133642][T18500] FAULT_INJECTION: forcing a failure. [ 756.133642][T18500] name failslab, interval 1, probability 0, space 0, times 0 [ 756.133678][T18500] CPU: 1 UID: 0 PID: 18500 Comm: syz.2.4158 Tainted: G L syzkaller #0 PREEMPT(full) [ 756.133697][T18500] Tainted: [L]=SOFTLOCKUP [ 756.133701][T18500] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 756.133708][T18500] Call Trace: [ 756.133713][T18500] [ 756.133719][T18500] dump_stack_lvl+0xe8/0x150 [ 756.133739][T18500] should_fail_ex+0x410/0x560 [ 756.133756][T18500] should_failslab+0xa8/0x100 [ 756.133771][T18500] ? __break_lease+0x224/0x2060 [ 756.133782][T18500] kmem_cache_alloc_noprof+0xa1/0x600 [ 756.133794][T18500] ? __lock_acquire+0x747/0x2de0 [ 756.133808][T18500] ? __break_lease+0x224/0x2060 [ 756.133822][T18500] __break_lease+0x224/0x2060 [ 756.133834][T18500] ? evm_protected_xattr_common+0x170/0x190 [ 756.133853][T18500] ? evm_protect_xattr+0x75c/0xb20 [ 756.133863][T18500] ? apparmor_capable+0x126/0x170 [ 756.133875][T18500] ? __pfx___break_lease+0x10/0x10 [ 756.133886][T18500] ? __pfx_evm_protect_xattr+0x10/0x10 [ 756.133898][T18500] ? ns_capable+0x89/0xe0 [ 756.133913][T18500] ? evm_revalidate_status+0x4f/0xb0 [ 756.133925][T18500] ? security_inode_removexattr+0x175/0x5c0 [ 756.133946][T18500] __vfs_removexattr_locked+0x1ce/0x270 [ 756.133966][T18500] vfs_removexattr+0x7f/0x230 [ 756.133983][T18500] path_removexattrat+0x4ad/0x760 [ 756.133998][T18500] ? __pfx_path_removexattrat+0x10/0x10 [ 756.134011][T18500] ? __mutex_unlock_slowpath+0x731/0x900 [ 756.134042][T18500] ? __pfx_ksys_write+0x10/0x10 [ 756.134057][T18500] __x64_sys_fremovexattr+0x62/0x70 [ 756.134070][T18500] do_syscall_64+0x166/0x520 [ 756.134085][T18500] ? trace_irq_disable+0x3b/0x140 [ 756.134096][T18500] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 756.134108][T18500] ? clear_bhb_loop+0x70/0xc0 [ 756.134121][T18500] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 756.134132][T18500] RIP: 0033:0x7f860119e159 [ 756.134143][T18500] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 756.134153][T18500] RSP: 002b:00007f8601fcc028 EFLAGS: 00000246 ORIG_RAX: 00000000000000c7 [ 756.134166][T18500] RAX: ffffffffffffffda RBX: 00007f8601425fa0 RCX: 00007f860119e159 [ 756.134174][T18500] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000003 [ 756.134181][T18500] RBP: 00007f8601fcc090 R08: 0000000000000000 R09: 0000000000000000 [ 756.134188][T18500] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 756.134194][T18500] R13: 00007f8601426038 R14: 00007f8601425fa0 R15: 00007f860154fa48 [ 756.134211][T18500] [ 756.540060][T18502] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 756.553947][T18502] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 756.565600][T18502] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 756.570136][T18502] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 756.632759][T17855] usb 2-1: new high-speed USB device number 34 using dummy_hcd [ 756.661476][ T5723] usb 4-1: new high-speed USB device number 90 using dummy_hcd [ 756.792025][ T5723] usb 4-1: device descriptor read/64, error -71 [ 757.005419][T18517] netlink: 'syz.4.4161': attribute type 6 has an invalid length. [ 757.005442][T18517] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4161'. [ 757.032040][ T5723] usb 4-1: new high-speed USB device number 91 using dummy_hcd [ 757.163837][ T5723] usb 4-1: device descriptor read/64, error -71 [ 757.273130][ T5723] usb usb4-port1: attempt power cycle [ 757.298871][T18522] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4163'. [ 757.298904][T18522] bond0: Unable to set up delay as MII monitoring is disabled [ 757.531424][ T5680] usb 3-1: new high-speed USB device number 64 using dummy_hcd [ 757.584687][T18526] netlink: 'syz.4.4164': attribute type 4 has an invalid length. [ 757.604783][T18526] netlink: 'syz.4.4164': attribute type 4 has an invalid length. [ 757.613112][ T5723] usb 4-1: new high-speed USB device number 92 using dummy_hcd [ 757.636399][ T5723] usb 4-1: device descriptor read/8, error -71 [ 757.685012][ T5680] usb 3-1: Using ep0 maxpacket: 32 [ 757.685903][ T5680] usb 3-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 757.687237][ T5680] usb 3-1: config 0 has an invalid interface number: 51 but max is 0 [ 757.687252][ T5680] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 757.687263][ T5680] usb 3-1: config 0 has no interface number 0 [ 757.687292][ T5680] usb 3-1: config 0 interface 51 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 757.689941][ T5680] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 757.689966][ T5680] usb 3-1: Product: syz [ 757.690005][ T5680] usb 3-1: Manufacturer: syz [ 757.690020][ T5680] usb 3-1: SerialNumber: syz [ 757.708481][ T5680] usb 3-1: config 0 descriptor?? [ 757.743006][ T5680] quatech2 3-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 757.872124][ T5723] usb 4-1: new high-speed USB device number 93 using dummy_hcd [ 757.895333][ T5723] usb 4-1: device descriptor read/8, error -71 [ 758.003498][ T5723] usb usb4-port1: unable to enumerate USB device [ 758.171198][T15944] usb 5-1: new high-speed USB device number 118 using dummy_hcd [ 758.322451][T15944] usb 5-1: Using ep0 maxpacket: 32 [ 758.325419][T15944] usb 5-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 758.331458][T15944] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 758.331489][T15944] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 758.331551][T15944] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 758.346555][T15944] usb 5-1: config 0 descriptor?? [ 758.816087][T18520] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 758.816453][T18520] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 758.844965][ T5680] usb 3-1: qt2_attach - failed to power on unit: -71 [ 758.845160][ T5680] quatech2 3-1:0.51: probe with driver quatech2 failed with error -71 [ 758.869694][ T5680] usb 3-1: USB disconnect, device number 64 [ 759.146957][T18544] fuse: Unknown parameter 'g' [ 759.161413][T18544] team_slave_1: entered promiscuous mode [ 759.225000][T18544] netlink: 72 bytes leftover after parsing attributes in process `syz.3.4166'. [ 759.393829][T18543] team_slave_1: left promiscuous mode [ 759.414494][T18531] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 759.414827][T18531] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 759.925781][T18557] mac80211_hwsim hwsim46 wlan1: entered promiscuous mode [ 760.154615][T15944] usbhid 5-1:0.0: can't add hid device: -71 [ 760.154725][T15944] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 760.160674][T15944] usb 5-1: USB disconnect, device number 118 [ 760.771194][T18572] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4173'. [ 760.921655][ T1234] usb 4-1: new high-speed USB device number 94 using dummy_hcd [ 760.983597][T18577] netlink: 'syz.2.4175': attribute type 4 has an invalid length. [ 760.983965][T18577] netlink: 'syz.2.4175': attribute type 4 has an invalid length. [ 761.024341][T18580] netlink: 'syz.1.4176': attribute type 2 has an invalid length. [ 761.071682][ T1234] usb 4-1: Using ep0 maxpacket: 32 [ 761.072424][ T1234] usb 4-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 761.098416][ T1234] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 761.098459][ T1234] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 761.098497][ T1234] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 761.131355][ T1234] usb 4-1: config 0 descriptor?? [ 761.384028][T18590] FAULT_INJECTION: forcing a failure. [ 761.384028][T18590] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 761.384073][T18590] CPU: 0 UID: 0 PID: 18590 Comm: syz.0.4181 Tainted: G L syzkaller #0 PREEMPT(full) [ 761.384100][T18590] Tainted: [L]=SOFTLOCKUP [ 761.384108][T18590] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 761.384120][T18590] Call Trace: [ 761.384129][T18590] [ 761.384141][T18590] dump_stack_lvl+0xe8/0x150 [ 761.384175][T18590] should_fail_ex+0x410/0x560 [ 761.384205][T18590] prepare_alloc_pages+0x223/0x600 [ 761.384237][T18590] __alloc_frozen_pages_noprof+0x185/0x5a0 [ 761.384266][T18590] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 761.384294][T18590] ? __pfx_policy_nodemask+0x10/0x10 [ 761.384323][T18590] ? irqentry_exit+0x218/0x910 [ 761.384352][T18590] ? lockdep_hardirqs_on+0x7b/0x110 [ 761.384381][T18590] alloc_pages_mpol+0x21e/0x390 [ 761.384413][T18590] folio_alloc_mpol_noprof+0x39/0x160 [ 761.384442][T18590] shmem_alloc_and_add_folio+0x43e/0xf60 [ 761.384471][T18590] ? filemap_get_entry+0xcd/0x3f0 [ 761.384507][T18590] ? __pfx_filemap_get_entry+0x10/0x10 [ 761.384534][T18590] ? __pfx_shmem_alloc_and_add_folio+0x10/0x10 [ 761.384565][T18590] ? shmem_allowable_huge_orders+0x34c/0x6c0 [ 761.384599][T18590] shmem_get_folio_gfp+0x5da/0x16d0 [ 761.384645][T18590] shmem_write_begin+0x16c/0x330 [ 761.384681][T18590] generic_perform_write+0x2d5/0x8f0 [ 761.384714][T18590] ? __pfx_generic_perform_write+0x10/0x10 [ 761.384735][T18590] ? do_raw_spin_unlock+0xf5/0x200 [ 761.384765][T18590] ? mnt_put_write_access_file+0xc3/0x100 [ 761.384792][T18590] ? file_update_time_flags+0x3ab/0x440 [ 761.384819][T18590] shmem_file_write_iter+0xf8/0x120 [ 761.384852][T18590] do_iter_readv_writev+0x612/0x8c0 [ 761.384878][T18590] ? __pfx_do_iter_readv_writev+0x10/0x10 [ 761.384918][T18590] vfs_writev+0x343/0x990 [ 761.384953][T18590] ? __pfx_vfs_writev+0x10/0x10 [ 761.384993][T18590] ? __fget_files+0x2a/0x420 [ 761.385026][T18590] ? __fget_files+0x3a2/0x420 [ 761.385060][T18590] ? __fget_files+0x2a/0x420 [ 761.385097][T18590] do_writev+0x154/0x2e0 [ 761.385126][T18590] ? __pfx_do_writev+0x10/0x10 [ 761.385177][T18590] do_syscall_64+0x166/0x520 [ 761.385205][T18590] ? trace_irq_disable+0x3b/0x140 [ 761.385226][T18590] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 761.385247][T18590] ? clear_bhb_loop+0x70/0xc0 [ 761.385272][T18590] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 761.385293][T18590] RIP: 0033:0x7f042319e159 [ 761.385312][T18590] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 761.385330][T18590] RSP: 002b:00007f0423f97028 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 761.385352][T18590] RAX: ffffffffffffffda RBX: 00007f0423425fa0 RCX: 00007f042319e159 [ 761.385367][T18590] RDX: 0000000000000001 RSI: 0000200000000000 RDI: 0000000000000005 [ 761.385380][T18590] RBP: 00007f0423f97090 R08: 0000000000000000 R09: 0000000000000000 [ 761.385393][T18590] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 761.385406][T18590] R13: 00007f0423426038 R14: 00007f0423425fa0 R15: 00007f042354fa48 [ 761.385439][T18590] [ 761.387871][T18570] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 761.417826][T18570] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 761.421942][T18592] FAULT_INJECTION: forcing a failure. [ 761.421942][T18592] name failslab, interval 1, probability 0, space 0, times 0 [ 761.421977][T18592] CPU: 1 UID: 0 PID: 18592 Comm: syz.2.4182 Tainted: G L syzkaller #0 PREEMPT(full) [ 761.422005][T18592] Tainted: [L]=SOFTLOCKUP [ 761.422013][T18592] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 761.422025][T18592] Call Trace: [ 761.422034][T18592] [ 761.422043][T18592] dump_stack_lvl+0xe8/0x150 [ 761.422075][T18592] should_fail_ex+0x410/0x560 [ 761.422104][T18592] ? __alloc_skb+0x1db/0x7a0 [ 761.422130][T18592] should_failslab+0xa8/0x100 [ 761.422158][T18592] ? __alloc_skb+0x1db/0x7a0 [ 761.422181][T18592] kmem_cache_alloc_node_noprof+0xa1/0x610 [ 761.422202][T18592] ? __alloc_skb+0x18d/0x7a0 [ 761.422229][T18592] ? __alloc_skb+0x1db/0x7a0 [ 761.422260][T18592] __alloc_skb+0x1db/0x7a0 [ 761.422290][T18592] netlink_dump+0x1e7/0xee0 [ 761.422311][T18592] ? __netlink_lookup+0xc6/0x8b0 [ 761.422345][T18592] ? __pfx_netlink_dump+0x10/0x10 [ 761.422376][T18592] ? netlink_lookup+0x30/0x200 [ 761.422394][T18592] ? netlink_lookup+0x30/0x200 [ 761.422419][T18592] __netlink_dump_start+0x589/0x7b0 [ 761.422448][T18592] rtnetlink_rcv_msg+0xa48/0xc00 [ 761.422476][T18592] ? __pfx_rtnl_fdb_dump+0x10/0x10 [ 761.422504][T18592] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 761.422530][T18592] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 761.422562][T18592] ? ref_tracker_free+0x689/0x830 [ 761.422586][T18592] ? __pfx_rtnl_dumpit+0x10/0x10 [ 761.422612][T18592] ? __pfx_rtnl_fdb_dump+0x10/0x10 [ 761.422652][T18592] netlink_rcv_skb+0x226/0x4a0 [ 761.422674][T18592] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 761.422702][T18592] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 761.422735][T18592] ? netlink_deliver_tap+0x2e/0x1b0 [ 761.422756][T18592] ? netlink_deliver_tap+0x2e/0x1b0 [ 761.422782][T18592] netlink_unicast+0x7bd/0x940 [ 761.422822][T18592] netlink_sendmsg+0x813/0xb40 [ 761.422852][T18592] ? __pfx_netlink_sendmsg+0x10/0x10 [ 761.422878][T18592] ? apparmor_socket_sendmsg+0x98/0x360 [ 761.422901][T18592] ? lock_acquire+0x115/0x350 [ 761.422923][T18592] ? __pfx_netlink_sendmsg+0x10/0x10 [ 761.422942][T18592] sock_sendmsg_nosec+0x13a/0x180 [ 761.422967][T18592] sock_write_iter+0x2de/0x3e0 [ 761.422990][T18592] ? __pfx_sock_write_iter+0x10/0x10 [ 761.423017][T18592] ? bpf_lsm_file_permission+0x9/0x20 [ 761.423044][T18592] ? security_file_permission+0x75/0x260 [ 761.423075][T18592] vfs_write+0x612/0xba0 [ 761.423104][T18592] ? __pfx_vfs_write+0x10/0x10 [ 761.423134][T18592] ? __fget_files+0x2a/0x420 [ 761.423169][T18592] ksys_write+0x150/0x270 [ 761.423192][T18592] ? __pfx_ksys_write+0x10/0x10 [ 761.423223][T18592] do_syscall_64+0x166/0x520 [ 761.423250][T18592] ? trace_irq_disable+0x3b/0x140 [ 761.423271][T18592] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 761.423292][T18592] ? clear_bhb_loop+0x70/0xc0 [ 761.423316][T18592] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 761.423336][T18592] RIP: 0033:0x7f860119e159 [ 761.423354][T18592] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 761.423372][T18592] RSP: 002b:00007f8601fcc028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 761.423395][T18592] RAX: ffffffffffffffda RBX: 00007f8601425fa0 RCX: 00007f860119e159 [ 761.423410][T18592] RDX: 0000000000000024 RSI: 0000200000000580 RDI: 0000000000000004 [ 761.423424][T18592] RBP: 00007f8601fcc090 R08: 0000000000000000 R09: 0000000000000000 [ 761.423438][T18592] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 761.423451][T18592] R13: 00007f8601426038 R14: 00007f8601425fa0 R15: 00007f860154fa48 [ 761.423481][T18592] [ 762.333904][ T1234] usbhid 4-1:0.0: can't add hid device: -71 [ 762.334007][ T1234] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 762.338915][ T1234] usb 4-1: USB disconnect, device number 94 [ 762.402509][ T5615] usb 3-1: new high-speed USB device number 65 using dummy_hcd [ 762.554701][ T5615] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 762.555783][ T5615] usb 3-1: config 1 has an invalid descriptor of length 9, skipping remainder of the config [ 762.555836][ T5615] usb 3-1: config 1 interface 0 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 6 [ 762.557988][ T5615] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 762.558012][ T5615] usb 3-1: Product: syz [ 762.558022][ T5615] usb 3-1: Manufacturer: syz [ 762.558030][ T5615] usb 3-1: SerialNumber: syz [ 762.637540][ T5615] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 762.643601][ T5723] usb 1-1: new high-speed USB device number 78 using dummy_hcd [ 762.792107][ T5723] usb 1-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 762.793095][ T5723] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 762.796096][ T5723] usb 1-1: config 0 descriptor?? [ 762.921206][T17855] usb 2-1: new full-speed USB device number 35 using dummy_hcd [ 762.960977][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 763.050965][ T0] NOHZ tick-stop error: local softirq work is pending, handler #240!!! [ 763.065385][T15944] usb 3-1: USB disconnect, device number 65 [ 763.072134][T17855] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 763.079289][T17855] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 763.079324][T17855] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 763.079374][T17855] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 763.126511][T17855] usb 2-1: config 0 descriptor?? [ 763.234418][ T5723] udl 1-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 763.234908][ T5723] [drm:udl_init] *ERROR* Selecting channel failed [ 763.309333][ T5723] [drm] Initialized udl 0.0.1 for 1-1:0.0 on minor 1 [ 763.309361][ T5723] [drm] Initialized udl on minor 1 [ 763.327907][ T5723] udl 1-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 763.328441][ T5723] udl 1-1:0.0: [drm] Cannot find any crtc or sizes [ 763.351181][ T5680] udl 1-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 763.355476][ T5723] usb 1-1: USB disconnect, device number 78 [ 763.379660][ T5680] udl 1-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 763.379885][ T5680] udl 1-1:0.0: [drm] Cannot find any crtc or sizes [ 763.431013][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 763.451006][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 763.531003][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 763.600988][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 763.625177][T17855] usbhid 2-1:0.0: can't add hid device: -71 [ 763.625290][T17855] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 763.651306][T17855] usb 2-1: USB disconnect, device number 35 [ 763.872717][ T5615] usb 3-1: Service connection timeout for: 256 [ 763.872741][ T5615] ath9k_htc 3-1:1.0: ath9k_htc: Unable to initialize HTC services [ 763.873763][ T5615] ath9k_htc: Failed to initialize the device [ 763.874142][ C0] ================================================================== [ 763.874155][ C0] BUG: KASAN: slab-use-after-free in tasklet_action_common+0x103/0x490 [ 763.874196][ C0] Read of size 8 at addr ffff88804c549158 by task ksoftirqd/0/15 [ 763.874214][ C0] [ 763.874228][ C0] CPU: 0 UID: 0 PID: 15 Comm: ksoftirqd/0 Tainted: G L syzkaller #0 PREEMPT(full) [ 763.874256][ C0] Tainted: [L]=SOFTLOCKUP [ 763.874265][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 763.874278][ C0] Call Trace: [ 763.874286][ C0] [ 763.874296][ C0] dump_stack_lvl+0xe8/0x150 [ 763.874326][ C0] print_address_description+0x55/0x1e0 [ 763.874355][ C0] ? tasklet_action_common+0x103/0x490 [ 763.874382][ C0] print_report+0x58/0x70 [ 763.874407][ C0] kasan_report+0x117/0x150 [ 763.874434][ C0] ? tasklet_action_common+0x103/0x490 [ 763.874467][ C0] tasklet_action_common+0x103/0x490 [ 763.874499][ C0] handle_softirqs+0x226/0x860 [ 763.874527][ C0] ? run_ksoftirqd+0x36/0x60 [ 763.874557][ C0] ? smpboot_thread_fn+0x4e/0xa70 [ 763.874591][ C0] run_ksoftirqd+0x36/0x60 [ 763.874617][ C0] smpboot_thread_fn+0x565/0xa70 [ 763.874643][ C0] ? smpboot_thread_fn+0x4e/0xa70 [ 763.874678][ C0] kthread+0x38b/0x480 [ 763.874697][ C0] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 763.874723][ C0] ? __pfx_kthread+0x10/0x10 [ 763.874741][ C0] ret_from_fork+0x514/0xb70 [ 763.874760][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 763.874776][ C0] ? __switch_to+0xc89/0x1420 [ 763.874802][ C0] ? __pfx_kthread+0x10/0x10 [ 763.874819][ C0] ret_from_fork_asm+0x1a/0x30 [ 763.874853][ C0] [ 763.874862][ C0] [ 763.874867][ C0] Allocated by task 5615: [ 763.874885][ C0] kasan_save_track+0x3e/0x80 [ 763.874903][ C0] __kasan_kmalloc+0x93/0xb0 [ 763.874919][ C0] __kmalloc_cache_noprof+0x321/0x600 [ 763.874935][ C0] ath9k_init_wmi+0x4f/0x2b0 [ 763.874958][ C0] ath9k_htc_probe_device+0x1e5/0x2370 [ 763.874977][ C0] ath9k_htc_hw_init+0x32/0x70 [ 763.874997][ C0] ath9k_hif_usb_firmware_cb+0x214/0x4b0 [ 763.875019][ C0] request_firmware_work_func+0xf7/0x2d0 [ 763.875038][ C0] process_scheduled_works+0xc3d/0x1630 [ 763.875061][ C0] worker_thread+0xa47/0xfb0 [ 763.875084][ C0] kthread+0x38b/0x480 [ 763.875101][ C0] ret_from_fork+0x514/0xb70 [ 763.875118][ C0] ret_from_fork_asm+0x1a/0x30 [ 763.875143][ C0] [ 763.875149][ C0] Freed by task 5615: [ 763.875157][ C0] kasan_save_track+0x3e/0x80 [ 763.875177][ C0] kasan_save_free_info+0x40/0x50 [ 763.875202][ C0] __kasan_slab_free+0x5c/0x80 [ 763.875210][T15944] usb 3-1: ath9k_htc: USB layer deinitialized [ 763.875223][ C0] kfree+0x1c5/0x650 [ 763.875237][ C0] ath9k_htc_probe_device+0x11a9/0x2370 [ 763.875253][ C0] ath9k_htc_hw_init+0x32/0x70 [ 763.875272][ C0] ath9k_hif_usb_firmware_cb+0x214/0x4b0 [ 763.875294][ C0] request_firmware_work_func+0xf7/0x2d0 [ 763.875314][ C0] process_scheduled_works+0xc3d/0x1630 [ 763.875336][ C0] worker_thread+0xa47/0xfb0 [ 763.875359][ C0] kthread+0x38b/0x480 [ 763.875375][ C0] ret_from_fork+0x514/0xb70 [ 763.875390][ C0] ret_from_fork_asm+0x1a/0x30 [ 763.875413][ C0] [ 763.875419][ C0] The buggy address belongs to the object at ffff88804c549000 [ 763.875419][ C0] which belongs to the cache kmalloc-2k of size 2048 [ 763.875438][ C0] The buggy address is located 344 bytes inside of [ 763.875438][ C0] freed 2048-byte region [ffff88804c549000, ffff88804c549800) [ 763.875458][ C0] [ 763.875463][ C0] The buggy address belongs to the physical page: [ 763.875474][ C0] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4c548 [ 763.875493][ C0] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 763.875512][ C0] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 763.875531][ C0] page_type: f5(slab) [ 763.875550][ C0] raw: 00fff00000000040 ffff88801b042000 dead000000000100 dead000000000122 [ 763.875567][ C0] raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000 [ 763.875586][ C0] head: 00fff00000000040 ffff88801b042000 dead000000000100 dead000000000122 [ 763.875603][ C0] head: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000 [ 763.875620][ C0] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 763.875637][ C0] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 763.875646][ C0] page dumped because: kasan: bad access detected [ 763.875670][ C0] page_owner tracks the page as allocated [ 763.875678][ C0] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 6105, tgid 6102 (syz.4.126), ts 107890842177 [ 763.875709][ C0] post_alloc_hook+0x1f9/0x250 [ 763.875727][ C0] get_page_from_freelist+0x2209/0x2280 [ 763.875748][ C0] __alloc_frozen_pages_noprof+0x217/0x5a0 [ 763.875770][ C0] allocate_slab+0x7d/0x620 [ 763.875794][ C0] refill_objects+0x2d5/0x350 [ 763.875818][ C0] __pcs_replace_empty_main+0x2c8/0x6c0 [ 763.875843][ C0] __kmalloc_cache_noprof+0x39b/0x600 [ 763.875863][ C0] nbp_vlan_add+0x22a/0xb20 [ 763.875888][ C0] br_vlan_info+0x100/0x470 [ 763.875911][ C0] br_process_vlan_info+0x61f/0x8b0 [ 763.875935][ C0] br_afspec+0x3a5/0x600 [ 763.875958][ C0] br_setlink+0x34f/0x830 [ 763.875980][ C0] rtnl_bridge_setlink+0x5b6/0x7e0 [ 763.876007][ C0] rtnetlink_rcv_msg+0x7b9/0xc00 [ 763.876031][ C0] netlink_rcv_skb+0x226/0x4a0 [ 763.876050][ C0] netlink_unicast+0x7bd/0x940 [ 763.876076][ C0] page last free pid 1 tgid 1 ts 21014228525 stack trace: [ 763.876090][ C0] free_pages_prepare+0x9eb/0xaf0 [ 763.876118][ C0] __free_contig_range_common+0x174/0x340 [ 763.876142][ C0] destroy_args+0x4e5/0x570 [ 763.876167][ C0] debug_vm_pgtable+0x3f8/0x410 [ 763.876187][ C0] do_one_initcall+0x250/0x870 [ 763.876213][ C0] do_initcall_level+0x10a/0x1a0 [ 763.876234][ C0] do_initcalls+0x59/0xa0 [ 763.876252][ C0] kernel_init_freeable+0x29d/0x3e0 [ 763.876274][ C0] kernel_init+0x22/0x1d0 [ 763.876293][ C0] ret_from_fork+0x514/0xb70 [ 763.876310][ C0] ret_from_fork_asm+0x1a/0x30 [ 763.876337][ C0] [ 763.876343][ C0] Memory state around the buggy address: [ 763.876355][ C0] ffff88804c549000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 763.876369][ C0] ffff88804c549080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 763.876382][ C0] >ffff88804c549100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 763.876392][ C0] ^ [ 763.876404][ C0] ffff88804c549180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 763.876418][ C0] ffff88804c549200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 763.876428][ C0] ================================================================== [ 763.876473][ C0] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 764.562908][ C0] CPU: 0 UID: 0 PID: 15 Comm: ksoftirqd/0 Tainted: G L syzkaller #0 PREEMPT(full) [ 764.573660][ C0] Tainted: [L]=SOFTLOCKUP [ 764.577967][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 764.588008][ C0] Call Trace: [ 764.591279][ C0] [ 764.594206][ C0] vpanic+0x56d/0xa60 [ 764.598190][ C0] ? rcu_is_watching+0x16/0xb0 [ 764.602948][ C0] ? __pfx_vpanic+0x10/0x10 [ 764.607451][ C0] panic+0xc5/0xd0 [ 764.611165][ C0] ? __pfx_panic+0x10/0x10 [ 764.615575][ C0] ? tasklet_action_common+0x103/0x490 [ 764.621033][ C0] ? tasklet_action_common+0x103/0x490 [ 764.626503][ C0] check_panic_on_warn+0x89/0xb0 [ 764.631614][ C0] ? tasklet_action_common+0x103/0x490 [ 764.637707][ C0] end_report+0x73/0x170 [ 764.642062][ C0] ? tasklet_action_common+0x103/0x490 [ 764.647806][ C0] kasan_report+0x128/0x150 [ 764.652306][ C0] ? tasklet_action_common+0x103/0x490 [ 764.657763][ C0] tasklet_action_common+0x103/0x490 [ 764.663133][ C0] handle_softirqs+0x226/0x860 [ 764.667891][ C0] ? run_ksoftirqd+0x36/0x60 [ 764.672480][ C0] ? smpboot_thread_fn+0x4e/0xa70 [ 764.677503][ C0] run_ksoftirqd+0x36/0x60 [ 764.681917][ C0] smpboot_thread_fn+0x565/0xa70 [ 764.686854][ C0] ? smpboot_thread_fn+0x4e/0xa70 [ 764.691872][ C0] kthread+0x38b/0x480 [ 764.695933][ C0] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 764.701382][ C0] ? __pfx_kthread+0x10/0x10 [ 764.705960][ C0] ret_from_fork+0x514/0xb70 [ 764.710540][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 764.715634][ C0] ? __switch_to+0xc89/0x1420 [ 764.720315][ C0] ? __pfx_kthread+0x10/0x10 [ 764.724894][ C0] ret_from_fork_asm+0x1a/0x30 [ 764.729668][ C0] [ 764.732942][ C0] Kernel Offset: disabled [ 764.737272][ C0] Rebooting in 86400 seconds..