last executing test programs: 26m57.012214858s ago: executing program 0 (id=21): socket$inet_sctp(0x2, 0x1, 0x84) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, 0x0) r0 = socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) ioctl$VIDIOC_CREATE_BUFS(0xffffffffffffffff, 0xc100565c, 0x0) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000001280), 0x0) r3 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000280), 0x40000, 0x0) ioctl$RTC_ALM_SET(r3, 0x40247007, &(0x7f00000002c0)={0x14, 0x10, 0x3, 0xb, 0x4, 0x2, 0x3, 0x84, 0x1}) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_tcp_TCP_CONGESTION(r4, 0x6, 0xd, &(0x7f0000000080)='cubic', 0x4) bind$inet6(r4, 0x0, 0x0) connect$inet6(r4, 0x0, 0x0) sendmmsg$inet6(r4, &(0x7f0000000e40)=[{{0x0, 0x0, &(0x7f0000002c40)=[{&(0x7f00000002c0)=';', 0x1}], 0x1}}], 0x1, 0x10) sendmsg$NL80211_CMD_LEAVE_IBSS(r0, &(0x7f0000000480)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000440)={0x0}, 0x1, 0x0, 0x0, 0x400c001}, 0x40480b0) setsockopt$inet6_tcp_TCP_CONGESTION(r4, 0x6, 0xd, 0x0, 0x0) socket(0x1e, 0x5, 0x0) r5 = syz_open_dev$vim2m(&(0x7f00000001c0), 0x1, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r5, 0xc0145608, &(0x7f0000000140)={0x7, 0x1, 0x2}) ioctl$vim2m_VIDIOC_PREPARE_BUF(r5, 0xc058565d, &(0x7f0000002dc0)=@multiplanar_userptr={0x0, 0x1, 0x4, 0x0, 0x7, {0x77359400}, {0x0, 0x0, 0x0, 0x0, 0x20, 0x0, "488dc807"}, 0x1006, 0x2, {0x0}, 0x10000003}) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) r6 = fsopen(&(0x7f0000000040)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r6, 0x1, &(0x7f0000000140)='source\x00\xb5\x838\x8d\xbd\xdf\xfe\x9a\xf2RM\xb6\xe0\xf9\xac\xa2\x06\x1cD\xe7C\xa5<\xd1=\x93\xf7\xf7Sn\xcb\xd5\xa7\xc9@D\x81\xff\xaar\xc8\xa9\x13\b\x9a\x8bF\v\x8a\x93F\x00\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f00000001c0)='.\n#)|.\x02\xd8\b\xb2f\xcd\x04\xb9\xc7\x9d\xb2a\r\xd7\xef\xc5\x112s\x88\x06\x13o\xd6w\xbf\xfa\xd5?\xa3\'\xca%\xd0\x8fKAq\x89f\xbb\x9dC\xd6\xea\xa8\xc2z\xbfe\xadSb3L)Hy\xfao\b\xa4\xb6\xff\xff\xff\xff\xff\xff\xff\xf7\xc7\xa4\xdcY\x9aM\x90\xa4\x05\xa8\xec\xf3\xa4h\x11\x19\x87E$\n://\xf3\x96\xaf\x1c8\b\x84x\'+\xd5\xd4?[e\x19\xa3\\J\xe9\x8a\xb9\xe495/\x00d\xd2\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf0\xb7\x1e\xf7Ys#m\xd40\xceP\xdc\x15FI>\x01\xfa\x15\x93\x9a&\xb4):\xc7?\x8d\x8e\x02\xc6\xf61\xbd\xbcBq\xba\xc6\x8e\x89\x15UTaf\xfc\x89\xab\x19\xd7\x82\x16\x94m\x0e\xb7$\x8c\xd76K\xdc\xd1;\\QPh@$\x06F\x81\xc9\xf8\xf8H\xb2\x85\xa8Cl\xa6\xcd\xb5\xf0\xd0\x1f\'\xc30]\xad7\x1eZA7\x89\xf5\x81b\r\xc1\x7f[\x84y\xac\x12\xaa\xa2-t\x16>V\xfc\xbf\xdb\xe4\x9a\x9eE^\x90oe\xc0\xd9\xc68\x0f\xd4\xcdKC\xadp\xba\xaa\xab\'\x1cRO\x89\x17i\x88\"\x8dQI\xed\x1d\xe1v\xe6&\xd3\x14\xe92\xca\x9dBe\\\x8f\xff\x9b\xc7Sd!\xf8(Z\xd42\xa2\xcdjjBP\xae3\xbd\xec\x8a\x8f:\xeb1\x1cK\xf2\x04s\b\xcb\xa9\x17\x8529\xd7`\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf1\xa4C\x81\xc8iy\xc4\xf7\x7f\x90\xf80\x18jT\xd45\xde\b\x88\xc9Xw\xe9\xf4\xa4\x94Q\x03s/\xac\xd4\xb7o\x99\xf5\xdb\xf9\x99,+\b\x17\xe4\xf4r}\xda\xf5\x12\x16\xb6g\x00\'(\x02[\xef\x03\x90W% \xe6b\xa2\\\x86\xac\xdax\x997AOJ=\x1f\x00\xe1/\n\xael\x15\xcfR\v\x0e\xbc!\xe8\x1cV-`\xf0$\xa6a \x93PV\x8dm@\x9c', 0x0) 26m55.004754459s ago: executing program 0 (id=24): socket$nl_generic(0x10, 0x3, 0x10) r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000100)={0x1, "ff0f000000000000f5a72d866b0000000000f0ffdefe00"}) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) r2 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r2, 0xc0184800, &(0x7f0000000100)={0x4, r1}) ioctl$DMA_BUF_SET_NAME_A(r3, 0x40086203, &(0x7f00000001c0)='\x02\x00\x00\x00\x05\x00\x00\x00-control\x00') ioctl$DMA_BUF_IOCTL_SYNC(r3, 0xc0086202, 0x0) 26m54.696138539s ago: executing program 0 (id=25): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000480)={0x64, 0x2, 0x6, 0x301, 0x0, 0x20000000, {}, [@IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x11}, @IPSET_ATTR_BUCKETSIZE={0x5, 0x15, 0x2}]}, @IPSET_ATTR_TYPENAME={0x15, 0x3, 'hash:ip,port,net\x00'}]}, 0x64}}, 0x0) sendto$inet6(r0, &(0x7f0000000300)="a6", 0x1, 0x20004945, &(0x7f0000000140)={0xa, 0x2, 0xffff, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x3}, 0x1c) 26m54.158531396s ago: executing program 0 (id=26): socket$nl_generic(0x11, 0x3, 0x10) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='md=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', 0x0, 0x24000, 0x0) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='fd=', @ANYRESOCT=r3, @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r3, &(0x7f0000002140)={0x2020}, 0x2020) r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r4, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) r5 = socket(0x40000000015, 0x5, 0x0) connect$inet(r5, &(0x7f0000000080)={0x2, 0x0, @loopback}, 0x10) bind$inet(r5, &(0x7f0000000340)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r5, 0x0, 0x0, 0x0, 0x0, 0x0) sendto$inet(r5, 0x0, 0x0, 0x0, 0x0, 0x0) getsockopt(r5, 0x200000000114, 0x271e, 0x0, &(0x7f0000000000)) open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) write$tun(r0, &(0x7f00000004c0)={@void, @val={0x2, 0x0, 0x2, 0x0, 0xc6}, @mpls={[], @ipv4=@gre={{0x5, 0x4, 0x1, 0x26, 0xca, 0x67, 0x0, 0x7, 0x2f, 0x0, @multicast2, @dev={0xac, 0x14, 0x14, 0xb}}, {{0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x880b, 0x0, 0x3}, {0x1, 0x0, 0x0, 0x1}, {0x0, 0x0, 0x0, 0x1}, {0x8, 0x88be, 0x2, {{0x2, 0x1, 0xc, 0x0, 0x0, 0x1, 0x6, 0x7}, 0x1, {0x80000001}}}, {0x8, 0x22eb, 0x80000004, {{0x9, 0x2, 0x8, 0x1, 0x0, 0x3, 0x1, 0x3}, 0x2, {0x5, 0x8, 0x3, 0x8, 0x0, 0x1, 0x3, 0x1}}}, {0x8, 0x6558, 0x3, "1ff18f2d258c8fcd69a5ef81e9cb8219e1cd5f721895283078889b13b0c8315a1f1dc898391f163696fc6335e97ec4a1bc0c045d611ee2039f1d27e52ad787e7ba5fc7be1dd2f1f4ecb71aa9f1eec8bcbb9e8873fe3e6fa184ed922d5306b3fc97f4aa98b8816822709ebcc9ecc052a368d3"}}}}}, 0xd4) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r6, &(0x7f00000bd000), 0x318, 0x0) listen(r6, 0x7) setxattr$trusted_overlay_opaque(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240), &(0x7f0000000280), 0x2, 0x3) getsockopt$IP_VS_SO_GET_TIMEOUT(0xffffffffffffffff, 0x0, 0x486, 0x0, &(0x7f0000000140)) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) mlock(&(0x7f0000494000/0x2000)=nil, 0x2000) mlock(&(0x7f0000bfc000/0x3000)=nil, 0x3000) mbind(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x8000, 0x0, 0x1000000, 0x2) 26m52.09084798s ago: executing program 0 (id=31): unshare(0x6a040000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket$nl_audit(0x10, 0x3, 0x9) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) sched_setattr(0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_msfilter(0xffffffffffffffff, 0x0, 0x29, 0x0, 0x28) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, 0x0) ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000340)={0x2, @win={{0x1000, 0x0, 0x9, 0x9}, 0x6, 0xfffffffc, &(0x7f0000000180)={{0x200, 0x4, 0x7f, 0x2}, &(0x7f0000000140)={{0x4, 0xfffffff7, 0xe9, 0xfffffff9}, &(0x7f00000000c0)={{0x1, 0x5, 0x9, 0x40}}}}, 0xffff, &(0x7f0000000240)="6de61793998deafbcf62f1c45f21eccf313033d081139a93df0a7abf0f263c391387aea667ccaf4b290a06414dabe456c9f4513999ed7e7928cffe69f6bcb044c397983d7a425c8e92060081bcba5156cf2c497008f854ba5e7a3e0f58fc04ebe76865987e76fdd957d00cb3fc1137f7ee39f762932875bca0a5a62c17c0c57bd6241943f4725594"}}) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000000)='bbr', 0x3) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendto$inet(r0, &(0x7f0000000580)="17", 0xfdef, 0x10008095, 0x0, 0x0) r1 = socket(0x11, 0x800000002, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000540)={'wlan0\x00', {0x2, 0x0, @private=0xf30a4000}}) r2 = socket(0x10, 0x80002, 0x0) sendmsg(r2, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000040)="24000000180003041dfffd946f610500020100000005fe060c10880008000f00fff3c00e", 0x24}], 0x1}, 0x0) r3 = socket$rds(0x15, 0x5, 0x0) bind$rds(r3, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10) sendmsg$rds(r3, &(0x7f00000005c0)={&(0x7f0000000100)={0x2, 0x4e21, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0xc4}, 0x0) 26m51.3415878s ago: executing program 0 (id=33): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000080)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x4, 0x7ffc0002}]}) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0x2, 0xfa11, 0xffffffff}, 0x0) syz_open_dev$evdev(&(0x7f00000000c0), 0x2, 0x903d01) r2 = syz_open_dev$evdev(0x0, 0x2, 0x20180) ioctl$EVIOCGABS20(r2, 0x80184560, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x18, 0xfa00, {0x4, 0x0, 0x13f, 0x1}}, 0x20) ioctl$VHOST_SET_VRING_KICK(0xffffffffffffffff, 0x4008af20, 0x0) add_key$keyring(&(0x7f0000000240), &(0x7f00000001c0)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffc) keyctl$set_timeout(0xf, 0x0, 0x6) open_by_handle_at(r0, &(0x7f0000000180)=ANY=[], 0x28000) mprotect(&(0x7f0000a94000/0x2000)=nil, 0x2000, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuset.memory_pressure\x00', 0x275a, 0x0) write$cgroup_subtree(r3, &(0x7f0000000180)=ANY=[], 0x10448) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x3000001, 0x12, r3, 0x0) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet6_tcp_buf(r4, 0x6, 0x19, 0x0, &(0x7f0000000000)) socket$inet6_mptcp(0xa, 0x1, 0x106) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000300)="d8000000180081054e81f782db4cb904021d080406037c09e8fe55a10a0015400400142603600e122f00160006000600a8000600200005400700027c035c0461c1d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360db798262f3d40fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9e", 0xbb}], 0x1, 0x0, 0x0, 0x4a0f0000}, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000100)={0x5, &(0x7f0000000140)=[{0x29, 0x7f, 0x4, 0x6}, {0x590, 0x7, 0x7f, 0x2}, {0xfff7, 0x7, 0x2, 0x2}, {0x8000, 0x80, 0xc, 0x8}, {0xd6b1, 0x4, 0x9, 0x3}]}) syz_open_dev$vbi(0x0, 0x1, 0x2) fcntl$dupfd(r0, 0x406, r1) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000080)={0x1, &(0x7f0000000040)=[{0x6}]}) socket$pppl2tp(0x18, 0x1, 0x1) 26m50.789801068s ago: executing program 32 (id=33): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000080)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x4, 0x7ffc0002}]}) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0x2, 0xfa11, 0xffffffff}, 0x0) syz_open_dev$evdev(&(0x7f00000000c0), 0x2, 0x903d01) r2 = syz_open_dev$evdev(0x0, 0x2, 0x20180) ioctl$EVIOCGABS20(r2, 0x80184560, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x18, 0xfa00, {0x4, 0x0, 0x13f, 0x1}}, 0x20) ioctl$VHOST_SET_VRING_KICK(0xffffffffffffffff, 0x4008af20, 0x0) add_key$keyring(&(0x7f0000000240), &(0x7f00000001c0)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffc) keyctl$set_timeout(0xf, 0x0, 0x6) open_by_handle_at(r0, &(0x7f0000000180)=ANY=[], 0x28000) mprotect(&(0x7f0000a94000/0x2000)=nil, 0x2000, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuset.memory_pressure\x00', 0x275a, 0x0) write$cgroup_subtree(r3, &(0x7f0000000180)=ANY=[], 0x10448) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x3000001, 0x12, r3, 0x0) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet6_tcp_buf(r4, 0x6, 0x19, 0x0, &(0x7f0000000000)) socket$inet6_mptcp(0xa, 0x1, 0x106) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000300)="d8000000180081054e81f782db4cb904021d080406037c09e8fe55a10a0015400400142603600e122f00160006000600a8000600200005400700027c035c0461c1d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360db798262f3d40fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9e", 0xbb}], 0x1, 0x0, 0x0, 0x4a0f0000}, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000100)={0x5, &(0x7f0000000140)=[{0x29, 0x7f, 0x4, 0x6}, {0x590, 0x7, 0x7f, 0x2}, {0xfff7, 0x7, 0x2, 0x2}, {0x8000, 0x80, 0xc, 0x8}, {0xd6b1, 0x4, 0x9, 0x3}]}) syz_open_dev$vbi(0x0, 0x1, 0x2) fcntl$dupfd(r0, 0x406, r1) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000080)={0x1, &(0x7f0000000040)=[{0x6}]}) socket$pppl2tp(0x18, 0x1, 0x1) 9m19.403796921s ago: executing program 4 (id=3203): openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$packet(0x11, 0x3, 0x300) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = fsopen(&(0x7f0000000040)='9p\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) r3 = openat$kvm(0xffffffffffffff9c, 0x0, 0x420481, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_XEN_HVM_CONFIG(r4, 0x8010aebc, &(0x7f0000000100)={0x2, 0x892, 0x0, 0x0, 0x40}) r5 = fsmount(r2, 0x0, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r2, 0x4, &(0x7f0000000080)='dirsync\x00', &(0x7f00000000c0)='./file0\x00', r5) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffdffffffffff, 0xfa11, 0xffffffff}, 0x0) syz_emit_ethernet(0xc2, 0x0, 0x0) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) socket$nl_netfilter(0x10, 0x3, 0xc) r6 = syz_open_dev$sndctrl(&(0x7f00000012c0), 0x1, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r6, 0xc2c45512, &(0x7f0000000a00)={{0x5, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0xfffffff9, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10000005, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x4, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x8, 0x0, 0x20000000, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x101, 0x3, 0x1]}) connect$unix(r5, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x38, 0x5, 0x11, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) 9m16.606629477s ago: executing program 4 (id=3211): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) getsockname$packet(r2, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000540)=ANY=[@ANYBLOB="3800000010000507000000000004000000000000", @ANYRES32=r3, @ANYBLOB="0000000a010000001800120008000100736974000c0002000800030036"], 0x38}}, 0x0) ioctl$vim2m_VIDIOC_DQBUF(0xffffffffffffffff, 0xc0585611, &(0x7f0000000200)=@multiplanar_userptr={0x9, 0x1, 0x4, 0x20, 0x4, {0x0, 0x2710}, {0x0, 0xc, 0xf8, 0x7, 0x1, 0x0, "3b051c46"}, 0x10000, 0x2, {0x0}, 0x1}) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0xe8381, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) sendto$inet(0xffffffffffffffff, &(0x7f00000000c0)="8689d46205a34100bf2bbe11a5ce7839edaf02afe39ead95913e9c4f8cf31440006769ebdf12cfacae8e8c03f5db079da7d9ecda75e2a7d49d5cbcb370c4d789390a328ba42c9c60cf2154d1", 0x4c, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000200)={0x0, 0x0, 0xf000, 0x2000, &(0x7f0000f9a000/0x2000)=nil}) r8 = dup(r7) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r9 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="01000000040000000400000001"], 0x48) bpf$BPF_GET_MAP_INFO(0x15, &(0x7f0000000740)={r9, 0x58, &(0x7f00000006c0)}, 0x10) ioctl$KVM_SET_VCPU_EVENTS(r8, 0x4400ae8f, &(0x7f0000000000)=@arm64={0x9, 0xfc, 0x2, '\x00', 0x8001}) ioctl$KVM_SET_VAPIC_ADDR(r8, 0x4008ae93, &(0x7f00000002c0)=0x10000) ioctl$KVM_RUN(r7, 0xae80, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000880)=@newlink={0x40, 0x10, 0x439, 0x70bd2a, 0xffffffea, {0x0, 0x0, 0xe403, r4, 0x3, 0x610c3}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @sit={{0x8}, {0x14, 0x2, 0x0, 0x1, [@IFLA_IPTUN_REMOTE={0x8, 0x3, @remote}, @IFLA_IPTUN_6RD_RELAY_PREFIX={0x8, 0xc, 0xee}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x8000}, 0x4008040) r10 = fsopen(&(0x7f00000003c0)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r10, 0x6, 0x0, 0x0, 0x0) r11 = fsmount(r10, 0x0, 0x0) setsockopt$inet_msfilter(r11, 0x0, 0x29, &(0x7f0000000180)={@private=0xa010101, @empty, 0x1, 0x9, [@broadcast, @dev={0xac, 0x14, 0x14, 0x10}, @private=0xa010100, @local, @broadcast, @multicast1, @dev={0xac, 0x14, 0x14, 0x3a}, @local, @local]}, 0x34) syz_emit_vhci(&(0x7f0000000000)=ANY=[], 0x7) syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) r12 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r12, 0x8933, &(0x7f0000000540)={'wlan0\x00'}) 9m15.778962761s ago: executing program 4 (id=3213): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet(0xa, 0x801, 0x84) semctl$SEM_STAT(0x0, 0x4, 0x12, &(0x7f0000000000)=""/129) connect$inet(r0, 0x0, 0x0) listen(r0, 0x8) setsockopt$inet_sctp6_SCTP_ASSOCINFO(0xffffffffffffffff, 0x84, 0x1, 0x0, 0x0) timer_create(0x3, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000001180)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRESDEC, @ANYBLOB="43da5f2e"], 0x48) timer_settime(0x0, 0x1, 0x0, 0x0) r1 = syz_io_uring_setup(0x5ce, &(0x7f0000000240)={0x0, 0x6734, 0x80, 0x40000, 0x34f}, &(0x7f00000000c0)=0x0, &(0x7f00000001c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000400)={0x1, &(0x7f0000000200)=[{0x2e, 0x0, 0x0, 0x4}]}, 0x10) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r4 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0xc, 0x4010, r1, 0x0) r5 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) syz_io_uring_submit(r4, r3, &(0x7f0000000300)=@IORING_OP_WRITEV={0x2, 0x2, 0x2000, @fd_index=0x2, 0x80, &(0x7f00000002c0)=[{&(0x7f0000000100)="79bc2a6ad3cb14f69424da5c5b0c439e3324bdcb9e0c53cc0a5a03f96c25e745e8f02cd44205a33ad1e077311dcfff7f0a402fe665076062b00c2020759014601331dcddb91cb5e06aeaea71aaf157e6e631bc5f7ef2b5a02a44ab3281737556173bc9c4e056", 0x66}], 0x1, 0x2, 0x1, {0x0, r5}}) io_uring_enter(r1, 0x57de, 0x0, 0x0, 0x0, 0x0) 9m15.445069682s ago: executing program 4 (id=3216): bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r0 = socket$kcm(0x11, 0x200000000000003, 0x300) r1 = add_key$keyring(&(0x7f0000000540), &(0x7f0000000180)={'syz', 0x2}, 0x0, 0x0, 0xffffffffffffffff) r2 = add_key$user(&(0x7f0000000080), &(0x7f0000000100)={'syz', 0x1}, &(0x7f00000003c0)="aebc", 0x2, r1) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r1, &(0x7f0000000200)='asymmetric\x00', &(0x7f0000000300)=@secondary) keyctl$link(0x8, r2, r1) setsockopt$sock_attach_bpf(r0, 0x107, 0xf, &(0x7f00000003c0), 0x4) recvmsg$kcm(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000006c0), 0x60}, 0x0) r3 = socket$inet6(0xa, 0x800000000000002, 0x0) connect$inet6(r3, &(0x7f0000000040)={0xa, 0x4e1d, 0x1, @mcast1, 0x8}, 0x1c) setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000000)=0x28, 0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r4, &(0x7f00000021c0)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) syz_mount_image$fuse(&(0x7f0000000000), &(0x7f0000000040)='./file0/file0\x00', 0x404, &(0x7f0000000180)={{'fd', 0x3d, r4}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id', 0x3d, r6}, 0x2c, {'group_id', 0x3d, r7}}, 0x0, 0x0, 0x0) write$FUSE_INIT(r4, &(0x7f0000004200)={0x50, 0x0, r5, {0x7, 0x1f, 0x0, 0x20000d10, 0x2d, 0x0, 0x6, 0x5, 0x0, 0x0, 0x10}}, 0x50) syz_fuse_handle_req(r4, &(0x7f000000ac00)="a062030607792c01386f28a428828947de99f79cc542703d923c7cb9d4e1f6fd95fbf2f747ab32f6fb041861fb3f87a88cb85405b4e73c0b6b12c81e42a9f13d82c32b7ddb172bcba1aac5c38f083747ac179f08d4d6d342a87ba8dd9bb7a9680f27433c3357b4f6ac97b19a973592f1ac6e7853a0b15ba42a28efb9cc30b146346b546018966e94976ca28f26a1950dd64c0adbb0c2e09bbd9caa9e7886a2b3d6e2b6d6616b718f1322ea2881ca59ef73948b1bcdc2dd3970e63cbc1043ce42af0ea1f95d17268cbc3ef062c8c31a537e94a20c1c505a6022d5ece7f51bd9c754d8c47cbe80bbb30b2159991a94dd3a25e64aff8a7a17374b5a71e0c7c241cbfd7f084e18a50bea512ada902210a3881ffcd42071ab09c4d80139d8980d6dc5d12c2595ced445caf22f80d8fb1a4c243da47fadb8e28e9c04fea820a8a2f032f5adff8b7d9269e63db68d196bf7f416405e52b6b8abd8bb9d9694b8b5eddae348209963738cd9710bd6c291af1c8eaf0e52d2f2f24bef8c8bc9f77eed40104e07c8ee1b4cb358fc73e2653fef6232b5e9f5d0be26b91a0b7967ed5e3bf10c449424ff4d11951d963677001d9576425d6a9c4503268a407d74854f5e1caacc0ccc463dc56e684db1d80b370da238915579ab82cdbd7d155adf10b96ed71100ea92834e8a4e4f5b7b831bff6fb4febe01bb398ea4065446f277f107aa3cc06e0b7a6e98434bf57744ba9ecb8effe704d7f852e16bc33ac113649f7540b7a7a67cf5493b400ce06e571d485af1732938b79ded4de7dad97a7e1c0be7bd479dc264647bb76503168423e3f6fc95f8ac8ea35e39f476ab54e88286fcf73eead1f794784465592fe4ad112ac63bbc3b3f35b87c40bc5fa6e3ca6cad878f9772a61a23aa00491a9e2442eb90a32af2bd74e99d075bcda20288bfc30f3b00a7e8e1a0b4791573abd65284bbb53e2b7d667239b95b332dd423e4d7c512de559bd53fde5285add9795bda81ec142620e693af9c787a4499dd76ca0d77d9c7c4043e537ec6c1cd0b9a642b12adc782a0e00f6c1ed7379d5fff4c2feb19182db977f657b195e4710ff00f78e35a146119897495b0e1a0068a6606292ee72bf65adcd2cd29b4e59a4b3f82eac77d5254013d03d2fb2511975558906741912d09304f0d4cf08c8f62690c67968c869f75a4025224d8e84baf7a42e01b4ecf7e55d7c45839778c2266880d1bb73e3aad618d1a4f8d5a16914d64d70438a88512649fd4caa90506e5a2d58a33ecaebc9b2e5f8a4fbeca57c829ae02fd2dc146e939c3d295ada7df4a07e74b356c6ffd7a9c546b9eddf7e013cbcb2b57ae0d225249f7e06a415681d9f597a060fd55e39bd56f04b863efeca458a0cbc54b660db50ca40d27a3fda3416860e691cfc780593f06b467700968bb918c32547e378b14b4e0dcd11cb0b2fb36ea70946ac62290184b4eed38b51c322a75367b50f558e063bf363341a17c28ddcbf9ce53da06f26303fd156423a25f686809bc9845a78e0cc3d94e04bc8da85f22a4a8ece2c4ac2c79e54dcc4eabc61e067060ad880377a71fe0c2c0305256e4f3c637575f086e4ae3d7ab5d106fde03d24c47dccba3da23a244c1f50a4f60cd8d71b77390c5ce6d5612fd0260a2f33389b064ae6acac783eca62874232fd3808fb2188151a43de6cebc7e245106183f7d929f1eeff6f972da3e3d967170247925fb0f04bf38e88d06321f9ff9d2c296553d842b69036a2b6de2aad3879aedee723ff00736f7b0dffe6182104105ff0f0b636f5192d6bb5ae7ef950825827d2f3d6285d83aedca3f31474e0ad50ce6290a0e546c30d900e5b4208ecc8b3aca0ba3d110fc3c0a7e004a53e5d0ba1cc1c2bb42c3dbcbb4ceb6674151932ae56f6b03cc34ce450c292fecd2456ddcf42b075e6fd49305fbf265a36f3cff61321dd60f16e844089d659130947672a2d059e04af9ef653e8afec926b5a5d411f60a2a435437095a1df8dc60a616bd1a1ce7b5251ed8f905becffebd635eee8ff0055c40f146f1350a406b853ecb005c6ede4dc270ce6751cff915aa27f5f6b0736da14c9949de599d57868c29cc97ad03bd89502a34b88ad29c8762d0dc24a6df759821882a32e70531cab51fa1752a4fc49cf0706cb24d203174b2940f29ef8b0ce65b40cfde4e0c7310c685cc8de8384e485a951192fa8c36c11f9b88a48caf027dca480caa4fccae70ea6c837eb82f926ad7691c7709f217220d71f6e374fb8522a84c118b5c25f3d56acfb25afbe676fc9e574b6c5a59c00a0bbeeff61fd82a1677f3da9bb596133db491a8f11b945d930c8a67de9ce80025c764d518efcbae25d9194dc96c31ed02c63b1ac976715f7233ffed7cb6e929bbb5afabd34bc37c095acd0abbbdb1ea48e40a30ac99550f0ccca19ecef5acb2604c48fffb53b352d114fac72d6fc019ddec558406668f773fed9476148133c0f9ca4d1fd7e70dd04bfa089dc57e5940f29a5fd33dc79913ff48853794fdaf891d71de94c4a4fed0544e09f2bd578b07003031b8602f08ca8a79fa5ebfd5477f4d4f031c3efe0db273446a99d0cbe21a3cf43f3b82774e4657bb4f9675adbaf71c52953f0b18a61e05a9c770536fbad215848f8238e8730b9085189ea4621780dac500d7d7dc7815b45e232f86592498f1515ac8c50306013524cc5f0a74b67bc85d435d332ce69f00641c86a3e91be84b78ac358f35b18d69679df4197d3be8554417cf44aee6dc623f68ce3388df18168efa1c87c776cbda792f6110b6af178eb8200a91dfb72c1e23b5e5a66b5a3ee3f4c2bba2ccac939dcb036006b86e894093922a95fd70baba9424a3d0327a0f209fe10b39f3cec3f669d301a2834e58fd56f94d622dccf653f08e776c9f3e1b0e5b3cdef133834b93c41c70438d51a0b127262868d49ca91623c3d8b75c2cce0b771b9ac941bb96029e782224a3686a7c0dd164e162ede667e0e5817e7bde85ad3bf30a6a5bdc420f751679be74a02f84aa93b971c3f45a67d155f7ecb1d5284660918dbf102bc16f496fb62a1290e6b88ddaff55740583cba13076afd623276634e0c11663be50766980949095003ef5bc6f90a98bbad436b67928513e70115224f672ca2a24e27bb98bd5288c49ea23d47ef13c5ff28c43ce53ca16a6caeccc1f601226253c4a38a88a93828f6c800547cadbaa6d7ad26db618cccd38a671507cad5ba0065ce2edba81a059b95c36c5d04ab456fd6fd81ec3738ebe546d973c0886a5e7b83dd9c2f58f5d6c19519e67575b3732a486555f8d8c4ae004a62e8d07ab2c8ef74cdb96aa99d75aeb1c25985996f281d71106910a3c3da17de35e04dbe00e2b7b75ec2fed177a7f2d04fbf68bd0b8af682b30911867d4d1497ba060b662f4e97a8e7fd3613015cc34302377497cd08bcdc29f06dae240820d2ccddbf8c95c76a4ba5d3e1b37a62369ce3f79fb74ebd9bc82c3fa3edad4034b6715c2853fa7781c974b5a4e541e8b69bf4bd653fcce4e4340d9409fe9112e4d253a3b7e9d43f4426127b10f2d5d3fcd2193490f7d933e0cc53dae552f2d7c9d77b8f9b27c59105cfae43a0aab314a0820fbb5684bf20986e3be215688b42938d272c4c0edd17bcdc84a514d2483456d6cfb4f5c1218859ee55bfc77da36c9c75734932a12fd03df38232063ed92024f8ee7c21f314129feb10670bb4d6a0ad4fb3dc57a64cfe6509a0770650cdec0efd5e0b1fd29433cf871c9ddbe648319bd481357326ac1eb32b4bef4ad89ab6122e92dc786decac88624a4a3963ae771f8023b9a92e446114764c53d7efc07e3ea77a9daac5cabbe648a223e249db62102ef7b7b6d06df46b6ff913911b89848a47aecc0563fb06b6d77fe1daf4541cf619105ab68e0bcdf7a05af22b0551323bf33dec8167df2b7fac62dc9e286dd3462f488c82ad194f7fd5d3ca72fe9c0c37cdb6d75684326e5cb30319ab333fc70bb197320acda161d2e685e78ac2cb1417223f64742b12a316d590b18a4173b2a105a381baf6f383ec2e81d04860b5cc536475d7c5d05bd6a7db1a5d93930bacba8c1de63707bd24785e19fc1f15ba724660ac00d0f2ebbcd5528b8cbe4f3ca332e8611e937a310fc79d234be6c1cd09d6a5cb06ab36a9d667188144c81f86aaf0851763573b36cc21462ba4f3d6e95d38d1e9b943085661d234ef6d079bc9d84c7447c85baba88263451ba10559e1ce326fee5074b26b54872e690a9a1e589e1c444daa3224b292bf9ec4a604dc512760084084f27386c89a1190b8905f0d720508c0ed69272f396725805480188aa4602a26e833c16aa5079c0577a8203ec0b2b929ef3b410bb427c168b7fefd1be652f06efc61c7a295a5d07a9fd61bd5bfe67ac5f74e485a66c92950a1b460257084ca3a3489943ad450300967234b487fa3def4010f9b715196562ebb0846b7ac3eba47646af6285582b4402f64aa684dff7d9cf81fbe1aa88959f7906f06839389f2ad56efb5029afe1d5ceac99a3e698f49ff0da7db06d7c9e94a8773a13fab93def139667b4dc6b741bd2769da7786acecbe315f9006bb6b72abe5bdc587d8d5aa8f67aaefef68197fd2e7874d9b7da2c3a5618720c12e8fc31db3e334c47abcbf10c6181ec14af4f9e90e19a35360a793b1e9b336e49b3ed67568a860cd4c298f967ba323d315821959629e5b7aaac367e1ddb8a1c5d61500afa69331a4c90861852f533657b28b97a343bc531a11ff634b157a6d859a35f0d2a595375e11a32457575f1d73da033bf5eeda12337b9fdd46bce192d3aaaa240a8c65bf47704d6aa64a9531f9de14a96fc9fe380db35dd5ec52321c67fb4c18abcaf22fbe8f602ed201232251317e1a1b71e1e2c924a92d84685de348eec97fed954b7f6681ddf521b4ee03a1aeb2e446ee2a7f4dfa37b1c53831139fc624c14dcc4d144ccdf758fd9f344b4cdc1df70f6a24fa78cab136c912d1ebffa7053ccbc9b9445762236dca409820f738370117d5c369dfc50fd42277f14eeaf29110aedcd503008c42914d04e219a8b6c01e337d04724919b07157e2275ba6365a9dba5ebc8019bd1aa1b8668023f64cf47e1b49b4fbcfc10d560bb74405c90751504db8100d8a8a1a3ff84d98f1262fbbd6b962f492b9531a7411c08e7e56eb0f838075f754b6a395b6b58a8e4c47eb46bfaba2ac94800a396749d18ba0e6219f8d616ec71a1e60b3bcc24e19d4a20ddbc6a871e6d7efa50a362610598d892a5adecbcfe217534deee3620dfc88c7992ec2e710e083ef0a50c20621405f654804d1af4f24d22b8ca48f26303e6969127a74f0b276a5624c3b84410d4d5ee3c62605876e60a88df2bd6e8db8c7e486fdb452178563e7add6bc126b721b9ef8b12181989b87031573a4010d88e34f15a2344e4808b74c99ad68f0c2aca4e8d504397c03e1328c4b1ec43fd902d206c3cfb63d7541ac57fdbc70b0033f87514286101231fe7e79668c802e1c23d61540cdf13a5e675b736e221ddc29ab747d9c64f6213f51d3c1ded2e2b0efc4e45183d90468f61ec1720f7a0b87947e2c54125cebe6563ee4415d886bbe869d17d36371c942c11db1e13c1dd40ed24cabaf7ee80eae6c4db934e982d9619d753dcd679c5650cd95d21582e31b259043a0d03371cd294f4cc028042c75070c9b534a2d79f164ab9d773295795280d1584ca664b53b263fe2e23534d27b0d85742fae8061e03187795129dd272041c6eb9c10c3406da1f752f4ca697bdbddd74975cd4dbba5687fb30ac4fd5d2579494eac73053a63821a852cf41a80f6668006f7e1c4e30b48d638ebab470c558d42baeed1adc8fc71f73e95f3ca212a4b009b508e89898727f805685e4e7650a2961d62c117d1ee9017236a6bffa0c36ae11bc52d346c83399e43c42cdb9f443aa307109a97ee66ceb7a29eeb2f1a2bb3ee1492229116db07301b2aa4126aee7775daa2d0eab4d206fae11b3c6b565dcc4c7b4dd1cf2abec81150d0629803f6eb221be384b8772fe6d6c4fa98c928a9d0a02e9ff8bb7a2168dbebe140323d93bee8983c496bccf752c372b795a3493624cefb3cfeb4307bd39826cac1ea3f18912deef1b8c8db30bc016990a477bc0a925fb36453a9e21354b2d7e6e3d4ca4dd20f27a8db05429d44b7a485365191dc4ba977a815958faf6434813a9f4046054763dd55dbb7fae892b746e169ae046ae3361a9f75cf622b03f75b1633da864395bd1c3a594fab0b1fb37f088dd1f2776e2b795c78635c2026a8ce7ff40968a1960786049a217dd8872ac0c01f4bafcf2d3d751dd46a5e1bec00540a9ca7afca3ef37575d4a8b1291d05be94913092890a9b4bfff39edbff307e5654896e79228777c0f8ea46c55bfe19e522bf457ab4e6b0167d776dbcd0160598370a12c4a03e4edc82b245a7608797b03d4ed89dfc2a5bf07b9fcb251fb8608553f3b3774818717a9aabe6b2ded811515ba454b390a6065bbc59552f3bfe51d38f139792e1aae60093a7c5770b52a1730feb1049c14a7d5261d644f6b738e22ee72aafa422bd93f61e1ccac0a5ef4726c66f61bb539acb937bd63da82c700c0860be90ce5621ced22b52b63d041266fc258fbfa6641aef22e97804e5138ad2ce4405eaf76bb0acd7fc61b2d6de4aabc5c28a850fcf219cff77c97d3cb6bec0067c171b912d11d82c56cbad56c0032a9657d4cdd1eacaca53f40f5e3fe911127e1cd30781351f180e1413933cee2d46ca0eea31ee01fe4e99a567edd0b10565d47b87c8a48366143e889e52d0ff13c920aea092c2545fa9b7056204fec156549d3c0a997bc1cf4a01338483bf5c69d6958ae038f1c3e3b84baeb2c1f9e064c0750602c34c6c483c316391d975f94f21f6dfe74e92c33228b408a9e2b9abcda33c497abba9c48a63e5c8f1a8d0f4c24d36a44e1601e8a09e8a5c7179bd4c44b17e542dd99cace87aab60a5e53325d544c991b6fa5deffa49fd886332980deeca9229cb2f67f495a7b743153854ed81e1623b12dbd65512d08a5732fee2db3fb455cf6df5a1701a2b8674633c6792162dc86ac76e30da225b0167a7e704ad33ba694f9c902afbeed58eef609874767053f59414d4d3eccbbcdbc7eba997c71f9b1f5139bb020d5dae1db6e2dcfbb51b5371b08bdbc3312b05ee6d8c03c8b5a7d4f23da45f276394f222b1a0bdf4e2603243cdba60ee0530387c88bb457ca9932f2283a4d55bb1195e6d325ed93f714e21908b1baafa467f1cec7fa26e5c384ee6828e77978bd1abd014de549a5e5966f2b2f4ba000f9d77f1abfe3a6c337cdb852c1ec59f61b63d543f3062dd2616a163ed7ca60168b0347b5c5646a678dafb4c502c333a0a48f0341b47f5c5946e42e571db0bfa0682a449ca64e71b5661a842975182399245c6de241512c67ac918d7e0c5cb66565010e881b8333567ca584321ead1c383b099d8bf1c56dac08cb218cde4226ad420d6d6313f9c4884d6394722304fdaa76e61db8c0d54eb1151344c41ce1130272928eecb2f9f0f23c752622374eb1223a80efcf0b937dff7d813d7be0340226c0a7b163741d9aecafcb7ddae5a219323323f621c802be82399e06d2e1cc582e759ffa303c5103f8a44d7129d2853b02e506abda57ad2836d7ff16f95232149fbeb8b62e586d3536bb4ae042ecd9e25d1dee789353071f9c89d4361000c47b763556e8902f1f25cbd8ae71679e03ff27db0ec75eeee3fccafc7fcf22c377ac60d3c61a43cb53abf6162118f2efc86a5ce80e69a02bc1db80018beeef6d567941232e4412a958ed012bf7a832c1eaf68134ecabc4927ad666b3d0f21d4e8d52fa37e0a9751124efed8bf47544299138a6f69d89e295677f12606c79b72451c263fca3eec22bf0c47c641159a0bbfb3b2b03154af533e5c06a149e52adcfae31bfc55f30064a8903c8d3b828d275a937b1e4adffa0597da5e253b50bd71b33f057ffeff0b2a0829b3bf33350fbe67c7c79034f80d69e6a21be495a848d328f416f15966491b218eab390544e39d498258ad80ddae248634c845cbe6f1c1e93e7c2b02075411e075fe936bcc75f4a4e1a3687cb3dbbb61cb31ddfbbc87a1859b3a48fccdd8e5915c8bf4eebe8f7093cef6a7a91c8682915f9908c854c483e90c9643467292884d284134dbaddafdbc74d94a5f9713719d62b4f6b4236803d210181847ca27129fde264156895f4e1822ef78a3b215ef56d7e36d2b94c93f5e931a0d13a3a3030061ce62de595eecf47eae6bf698530145757700df18f66fd7261a12c119d6679663b3c0f99d1705aebe66dc862eb21ccb7360b93f54507149b577abf521113991e06f345e8282fdc18de673e1ca7b188ee34b14f37f86ddcf97fef0b913c33cf8e5d5d33707dbcdbe4b27cef056670252f186735cdd02f6ed6bfe5318a704f00e34ffc4fda9855bf37c51be6a7423e44dd8a98883c8fa82ca37c90d681fb7a0db915576b50e49aff545b99aa3aa6343b814ba0bf64e53b2a1edcae2231bf20d65e4bb4da6dc8382120ede652adfb7c30a46e0ee784cbde74563d83eb8d89a1573fa104fddca9d4833c49dc904bda905426c7dee3e48b596c8ee201bea57fedb1a0649457eaac3c5b5f4519af3adb66f10b861e711cd4034448890e15047c2f8902588268b5645051f3f3968ed8d630e050ccef0d01b61ffeade51e4e72d8fd46bba4c20009396e984c424d174934a67a1930665fbea04c809e7cda0a2cdfd3a14d6b99c3a8d8b3691825830456876f188ff871fc861e4c6a0ca377dc1f0cb0f929f7eb1f5da045d9a588a393312acacca5c5a3b15bb1b488b08fc40ad65ae2c1df187eccd8377525a81d80df57579ae52f775fb2efdd172a41c370300fcc594c2635dcf50e9eb9d34fa8b4bbfd13078422e3a7734a8ae6cc09e39d07c7ee19838f8da4cbafe4162c8f8dc44e284840bd0a5c80bfc657c22e37e0d9a96dda34a51ce616c9ccdc95955cf85d93860da902ab30f11aa333eacc25c47981d8636038761ed4d84fcbb0ca92dd2e07863b9505b451c3c49e36a172527578123049ff2dc2b4e258a3f698a12ca4705a6fd0ce6bc4f1767b4d9c2e57c9ed1388527964ac96ff5e4cf5ad6fdb6a853b43905df32af8bd788b520fd526cbb95195a1bc00d654cb080acdf67938517a6cdac741d86730358be16465b4e1301f47f6a444c4e8d2980b8bd98a8dcd6617cde0b287e2d1f59167b5c445146fa49728111b8a2729428cabd02facb8fbddbdb2769680f288648d6baac53e0d909335da3e2b4c13ebd41f32820c9f491e9124ca444a0532f60e2816e15a5810baa91f64454aa355f9d362c7d1a461561689d08b1350a216b6f1bda57aae0706b3710a1b8e52a7e3084e600b5ee3dc540bba0c16267d549304a7840659a32e40070715c9bb912792d4a7b84fa06e73b9ddbc2f06c4edc19d25f5a198c7e3fc6226842e6215da5d826fcf5949612889f78e9de39d4e64b86b7033b5717a21f8f2b81c799a3fc0bfe6f5837b252eefa360c91a6148296bd19d50a343d909c1edf5261e70c8dfb2c488940cf236941ad3fd01247e37902a4bbfdd1839f7c92c260a2c494022fac08629303c8e54108d78ae2c94289c7f998ba3b622b48931ee7c17c59f5499d282467a1b8050acc94a0b17b21836c80b69f519b9b077d18e33c027faad562fa09f2cc6120f8cf5ee18cf7db9d729ffbb9de58885713215b7aebb8c98d9fa009be0a9ef3ceccdb2b31968db555b26c5c94e382d06ebf6d356e8caa85def5813dd1596d823924c4fb63dba5bd094cb64f204d1e59d31287715f831a1f0be95d8749f2166ba0b0b6b64a37991be1fe1c1e922835f2da0c074ec9413561d52166576b1c4f1e18f078dc046d1c284964b80217b55c59a474740c3649116b33e927479736bff6005859c7c00598f22cb8eca38af802f4c86836e8330492ac7ef3707890a8ff856dc7786ed769bba75b18484b257b3b022eeb51aa720639f79e6e6bd3d3c9a61f7822abe562867b4693f0b2f61135aaeaa510b31112efeec48d2602c6d4f2ddeeb51bb03ab18c18d8e127a37e22881febca47742b9332d3f2251003b1a46c40eca111d02446466b669568c70971bd33254ca577777f126f86f8a3665f065b645ff261e78e0f532e83a81b99c5de3488de74ca82daa0e4e7404eff911ae955acbb800f9f91b774e472bc14aa92817b6d85877b1861a6ca92c03c83b6f1490068bad8eab1f58c9e91e1029683de2ca45c99966966031ee86d8c9995f0612480e2a6d5396e8ae361d6fd2e24557613a1191f5019d4c8078628013512ea3a59532efffa6cfe4970d28d8c7aa8c866c4275ff2b0b4ef1a7e56854d7ee4bc445713da9349d13e30a4a802cb9db2f10280fd9ea043b5b3480441e8ed2d907eae1259befba9d87a04ce42b0010c70af157b90e0bf72549852fd122edd6cf3475f76852b13b4bf887cf32e25ad34aed7fd5a6e97b307f9b4ff1c07b2b55beef5ef3dd96eeb2a57720c18209d911a55341cee67e6ff577f7acaba01c2c9690b15a3b8aaa5b9d734196467a8c074b2eeeb5ae931ddf3deb15b1a8d603e72125c2e68ad206f2c4252a659f8248ff882a8e54126ebc0c77a46101072272460e683d465279a3695be6b64c9eeb4a576d95fd520be42eab5c95cbace0dfd80e2d67bab9f683a1cc9c006c02f0f90a21a0f51218c628f5608fbf1abc79aa63452bde1002383033578f32980e3779a8edeb226f6d3f9b36d8f07bddd7479b60346a4b4fa883940e3aef8ad8d834dad4405960a4409a6255e8753d0c0ad0960ff3ef48ce93fbe6b165e86eab36fccb8b989f5b54e6ccaa19749ff065a0a732d15c41b9072bbc6f07e1fd5a3df2775874e46b61ed50714e8c403fbed6884ec06f52ab71d2c191fcc56ac0b17ba3c46d2dab3e11c79383bd8867ff14b5fbca73b9ae594b6a09fb73a2e8f15aee59150e8d6d3dad9659025d045bbd1b9ca257c67bb78abe8f7eb9c8b3bc32951c41f7390bacc8c7059a2a9b078ab50413605aec604e4666a6ace765b0e7ab558fe6232f2703d07811e3d0ac5bf9434e87876e99250ee9db6527a8ccb4a3ee3bde738563c9746f941cf2cd7efacdbd2593cafdbe5171864b2982b54dc5a32c86638c0e650a331625033b8dd65851965ae791880349d5cd52548f4422a317f96ed79e7ccf3bd671e6dc70365f521c65206386eb1f99570a544d11b3d36fea285f8a3770ca303a965a0c1d598ebe3696e647be734ccf760d3d47dec75e236d7ac08019b6622a7b9f08bc8f0937ab75e75a047a7386befbd56fc4b2f89c852dadce8df946cb3fafe4eed2678caadf1a913ae32b2c0b8a37984cb700343c5e24609f8c5ddeff5e653837a9332a41c8e21466a13d79224125d5f6a4fef79b5adae7f4ab7d351c55400545edd3c00637bd27164828925e9bb5d79f1f1e6eb3270ab799ae38772f779565d92c47503de695f7aad7ddacda6f6c71e755b3737231b64715bf07849d3466e4f92239f733436ce674389bd16900", 0x2000, &(0x7f0000008b40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000480)={0x90, 0x0, 0x8, {0x100000000404, 0x1, 0xc, 0xfffffffffffffffe, 0x3, 0x0, {0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x3}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) r8 = syz_open_dev$sndpcmp(&(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_PCM_IOCTL_HW_REFINE(r8, 0xc25c4110, &(0x7f0000000080)={0x0, [[0x7fff], [0x0, 0xfffffff9], [0x403]], '\x00', [{0x7, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0xffffffff}], '\x00', 0x100}) sendto$inet6(r3, 0x0, 0x0, 0x400ad80, &(0x7f00000000c0)={0xa, 0x4e23, 0x5b3, @ipv4={'\x00', '\xff\xff', @multicast1}, 0x8}, 0x1c) sendmmsg$inet6(r3, &(0x7f0000001ec0)=[{{0x0, 0x0, &(0x7f0000000540)=[{&(0x7f00000001c0)="b3ab706204ee39c9dae21a1718ee351ebc92d2f0d482a863ae5c0b4d768ffe745af2c53a083d9b761b", 0x29}], 0x1}}], 0x1, 0x0) 9m14.444891179s ago: executing program 4 (id=3218): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000780), 0xffffffffffffffff) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000200)={0x2, 0x4e20, @empty}, 0x10) fcntl$setstatus(r1, 0x4, 0x40800) connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000140)='syz_tun\x00', 0x10) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) sendto$inet(r1, &(0x7f0000000040)="e3aac5fb8d0848bed8494419c0c8864e1e7d445e57", 0x15, 0x8100, &(0x7f0000000100)={0x2, 0x4e21, @rand_addr=0x64010101}, 0x10) ftruncate(r2, 0x2000009) sendfile(r1, r2, 0x0, 0x7ffff004) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) r4 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000040)='.log\x00', 0x802442, 0x0) ioctl$FICLONE(r4, 0x40049409, r4) sendmsg$NL80211_CMD_JOIN_MESH(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="050000000000feff01004400000008000300", @ANYRES32=r3, @ANYBLOB="0c009900020000007b0000000a001800030303030303000008002600b409000008000d0008000000050024009d0000e1"], 0x4c}}, 0x0) 9m14.158228097s ago: executing program 4 (id=3221): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat(0xffffffffffffff9c, 0x0, 0x246742, 0x0) r3 = openat$cgroup_int(r2, 0x0, 0x2, 0x0) write$cgroup_int(r3, &(0x7f0000000080)=0xfffffffe, 0x12) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x400200, 0x0) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0x6, 0xfa11, 0xffffffff}, 0x0) r4 = socket(0x10, 0x3, 0x0) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r4, 0x8902, &(0x7f0000000180)={'tunl0\x00', 0x0}) r5 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r5, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x8001}, 0x4) syz_emit_ethernet(0x32, &(0x7f0000000740)=ANY=[@ANYBLOB="aaaaaaaaaaaabbbbbbbbbbbb080045000024000040020011"], 0x0) syz_emit_ethernet(0x32, &(0x7f00000002c0)={@random="e904a200", @link_local, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0xe000, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x0, 0x10, 0x0, @gue={{0x2, 0x1, 0x1, 0x4}}}}}}}, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x7c}}, 0x0) r7 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r7, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000100)={0x2, 0x2, 0x0, 0x0, 0x4, 0x0, 0x70bd2c, 0x0, [@sadb_sa={0x2, 0x18, 0x0, 0x0, 0x0, 0x0, 0x18}]}, 0x20}, 0x1, 0x7}, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000b40)=ANY=[@ANYBLOB="1c0000003d0007010000000000020000047c00000800378004003980"], 0x1c}}, 0x0) (fail_nth: 11) 9m13.445932209s ago: executing program 33 (id=3221): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat(0xffffffffffffff9c, 0x0, 0x246742, 0x0) r3 = openat$cgroup_int(r2, 0x0, 0x2, 0x0) write$cgroup_int(r3, &(0x7f0000000080)=0xfffffffe, 0x12) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x400200, 0x0) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0x6, 0xfa11, 0xffffffff}, 0x0) r4 = socket(0x10, 0x3, 0x0) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r4, 0x8902, &(0x7f0000000180)={'tunl0\x00', 0x0}) r5 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r5, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x8001}, 0x4) syz_emit_ethernet(0x32, &(0x7f0000000740)=ANY=[@ANYBLOB="aaaaaaaaaaaabbbbbbbbbbbb080045000024000040020011"], 0x0) syz_emit_ethernet(0x32, &(0x7f00000002c0)={@random="e904a200", @link_local, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0xe000, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x0, 0x10, 0x0, @gue={{0x2, 0x1, 0x1, 0x4}}}}}}}, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x7c}}, 0x0) r7 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r7, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000100)={0x2, 0x2, 0x0, 0x0, 0x4, 0x0, 0x70bd2c, 0x0, [@sadb_sa={0x2, 0x18, 0x0, 0x0, 0x0, 0x0, 0x18}]}, 0x20}, 0x1, 0x7}, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000b40)=ANY=[@ANYBLOB="1c0000003d0007010000000000020000047c00000800378004003980"], 0x1c}}, 0x0) (fail_nth: 11) 34.97943198s ago: executing program 3 (id=4761): r0 = socket$nl_route(0x10, 0x3, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) rseq(&(0x7f0000000600)={0x0, 0x0, 0x0, 0x3}, 0x20, 0x0, 0x0) futex(&(0x7f000000cffc)=0x4, 0x80000000000b, 0x4, 0x0, &(0x7f0000048000), 0xfffefffc) futex(&(0x7f000000cffc), 0xc, 0x1, 0x0, &(0x7f0000048000), 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000200)={'wlan0\x00'}) socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)={0x20, 0x2, 0x3, 0x3, 0x0, 0x0, {}, [@NFQA_CFG_PARAMS={0x9, 0x2, {0x738e, 0x2}}]}, 0x20}}, 0x0) sendmsg$NFQNL_MSG_VERDICT_BATCH(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000000)={0x20, 0x3, 0x3, 0x101, 0x0, 0x0, {}, [@NFQA_VERDICT_HDR={0xc, 0x2, {0x3, 0xff}}]}, 0x20}, 0x1, 0x0, 0x0, 0x20004000}, 0x4) socket$xdp(0x2c, 0x3, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x17) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(0xffffffffffffffff, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x43, 0x0, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=ANY=[@ANYBLOB="4c000000020603000000000000000000000000001400078008001240000000000500150002000000050001000600000005000500020000000500040000000000090002"], 0x4c}}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000050000080900010073797a30000000005c000000030a03000000000000000000050000000900010073797a30000000000900030073797a300000000008000c40000000032800048008000240000000120800014000000000140004"], 0xa4}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) openat$nullb(0xffffffffffffff9c, 0x0, 0x1c3902, 0x0) 34.853710188s ago: executing program 2 (id=4763): bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0x8, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000020000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70200000500000085000000860000008500000007"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mkdir(&(0x7f0000000000)='./cgroup/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0) umount2(&(0x7f0000001000)='./cgroup/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0xf) rename(&(0x7f0000000140)='./file1\x00', 0x0) r0 = msgget$private(0x0, 0x3ac) msgsnd(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="0200000019"], 0x8, 0x0) msgsnd(r0, &(0x7f0000000140)=ANY=[], 0x8, 0x0) msgrcv(r0, 0x0, 0x0, 0x2, 0x3800) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_usb_connect(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x4e, 0x6a, 0xf3, 0x10, 0xbfd, 0x121, 0x6c9, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x2, 0xae, 0xeb, 0xfd, 0x0, [], [{{0x9, 0x5, 0xc}}, {{0x9, 0x5, 0x8}}]}}]}}]}}, 0x0) keyctl$KEYCTL_CAPABILITIES(0x1f, &(0x7f00000010c0)=""/4096, 0x1000) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0], 0x0, 0x0, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[]) openat2$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)={0x474283, 0x0, 0x14}, 0x20) r2 = syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0) ioctl$VIDIOC_S_FMT(r2, 0xc0d05605, &(0x7f0000000180)={0x1, @pix={0x200, 0x7c2, 0x41414770, 0x9, 0x425, 0x10001, 0x6, 0x2, 0xfeedcafe, 0x2, 0x2, 0x6}}) 33.373310806s ago: executing program 3 (id=4764): gettid() socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) io_setup(0x3, &(0x7f0000000180)=0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000040), 0x20a02, 0x0) io_getevents(r2, 0x0, 0x0, 0x0, 0x0) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r3 = openat$fuse(0xffffff9c, &(0x7f0000000000), 0x2, 0x0) write$FUSE_NOTIFY_STORE(r3, &(0x7f0000000040)={0x28, 0x4, 0x0, {0x4, 0x7aa1}}, 0x28) openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x161642, 0x0) keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='new default user:syz'], 0x2a, 0xfffffffffffffff9) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) syz_open_procfs(0x0, &(0x7f00000005c0)='net/udplite6\x00') r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CAP_X86_DISABLE_EXITS(r5, 0x4068aea3, &(0x7f0000000180)={0x8f, 0x0, 0x2}) r6 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r6, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) write$FUSE_NOTIFY_INVAL_ENTRY(0xffffffffffffffff, &(0x7f0000000180)={0x35, 0x3, 0x0, {0x210000000006, 0x14, 0x0, '\xbb\xbb\xa4_\x1e\x7f\xd8X\x9e\x166\x14\xafb\"\xa3`\xbb\xbb\xd8'}}, 0x35) r7 = syz_open_dev$dri(&(0x7f0000000000), 0x1f, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r7, 0xc04064a0, &(0x7f0000000200)={0x0, &(0x7f0000000140)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r7, 0xc02064b9, &(0x7f0000000280)={&(0x7f0000000400)=[0x0, 0x0], &(0x7f0000000280), 0x2, r8}) ioctl$DRM_IOCTL_MODE_ATOMIC(r6, 0xc03864bc, &(0x7f0000000040)={0x0, 0x1, &(0x7f0000000380)=[r8], &(0x7f00000003c0)=[0x7], &(0x7f00000000c0)=[r9], &(0x7f0000000180), 0x0, 0xff}) r10 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x1) ioctl$KVM_NMI(r10, 0xae9a) ioctl$KVM_RUN(r10, 0xae80, 0x0) 31.862074731s ago: executing program 3 (id=4767): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x60003, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet6(r2, &(0x7f00000007c0)=[{{&(0x7f00000000c0)={0xa, 0x4e22, 0x4, @remote, 0x7}, 0x1c, &(0x7f00000003c0)=[{&(0x7f0000000280)="e9", 0x1}], 0x1}}], 0x1, 0x931766f6319eed14) shutdown(r2, 0x1) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000001100)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000200)=@assoc_value, &(0x7f0000001080)=0xffffff98) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, 0x0, &(0x7f0000000180)) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f00000001c0)={0x0, @in={{0x2, 0x4e24, @empty}}, 0xf2a, 0x714, 0x38e8, 0x8, 0x80, 0x40008, 0x40}, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x101, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x2) ioctl$KVM_SET_CPUID2(r5, 0x4008ae90, &(0x7f0000000140)=ANY=[@ANYRES16=r5]) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_SET_CPUID2(r5, 0x4008ae90, &(0x7f0000000040)=ANY=[@ANYRES32=r5]) r6 = openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r6, 0x3b81, &(0x7f00000002c0)={0xc}) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f000057a000/0x1000)=nil, 0x1000, 0x0, 0x3fe, 0x1c0000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) r7 = mq_open(&(0x7f000084dff0)='z\xbf\x17', 0x6e93ebbbcc0884f2, 0x0, &(0x7f0000000040)={0x0, 0x6, 0x101}) syz_io_uring_setup(0x239, 0x0, &(0x7f0000000180), &(0x7f00000001c0)) mq_timedsend(r7, 0x0, 0x0, 0x0, 0x0) 31.760660764s ago: executing program 5 (id=4768): r0 = socket$nl_generic(0x10, 0x3, 0x10) flock(r0, 0x1) syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x14, 0x1, 0x0, 0x1, 0x75b, 0x8, 0x10000, 0x1}, 0x0) socket$inet6_sctp(0xa, 0x801, 0x84) r3 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$SNDCTL_DSP_CHANNELS(r3, 0xc0045006, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) ioctl$FS_IOC_SETFLAGS(r4, 0x40046602, &(0x7f0000000180)=0x400000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) openat$ptmx(0xffffffffffffff9c, 0x0, 0x121301, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) munmap(&(0x7f0000002000/0x1000)=nil, 0x1000) r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r6 = dup(r5) syz_open_dev$loop(&(0x7f00000000c0), 0xd03b, 0x410000) write$6lowpan_enable(r6, 0x0, 0x0) write$6lowpan_enable(r6, &(0x7f0000000000)='0', 0xfffffd2c) r7 = socket(0x2b, 0x80801, 0x1) connect$inet6(r7, &(0x7f00000001c0)={0xa, 0x0, 0x0, @empty, 0x400005}, 0x1c) ioctl$sock_inet6_udp_SIOCOUTQ(r7, 0x894b, &(0x7f0000000040)) 31.25464993s ago: executing program 1 (id=4770): r0 = socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301"], 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) ftruncate(0xffffffffffffffff, 0x2000009) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f00000005c0), 0x0, 0x0) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000018c0), 0xe0c81) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_INFO(r4, 0xc08c5334, 0x0) ioctl$MEDIA_IOC_REQUEST_ALLOC(0xffffffffffffffff, 0x80047c05, &(0x7f0000000100)) poll(&(0x7f0000000000), 0x20000000000000b5, 0x9) munmap(&(0x7f0000002000/0x2000)=nil, 0x2000) syz_emit_ethernet(0x6a, &(0x7f0000000480)=ANY=[@ANYBLOB="0180c2000000aaaaaaaaaa1208004500005c00000000002f907800000000000000002480655800000000b4bf050fff000086dd08006abf000000"], 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1000000, 0x5d032, 0xffffffffffffffff, 0x0) r5 = syz_open_procfs$pagemap(0x0, &(0x7f0000000240)) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r0, 0x89f8, &(0x7f0000000000)={'sit0\x00', &(0x7f00000002c0)={'syztnl0\x00', 0x0, 0x1, 0x80, 0xfff, 0x9, {{0x1a, 0x4, 0x1, 0x1f, 0x68, 0x65, 0x0, 0x3, 0x0, 0x0, @rand_addr=0x64010100, @remote, {[@ra={0x94, 0x4}, @cipso={0x86, 0x22, 0x3, [{0x1, 0x9, "f8fa4b23e466fc"}, {0x6, 0xf, "3dbd6483adaadeb2ec8890776b"}, {0x2, 0x4, "c2f6"}]}, @timestamp_addr={0x44, 0xc, 0xf9, 0x1, 0x7, [{@loopback, 0xff}]}, @rr={0x7, 0x1f, 0x53, [@local, @broadcast, @broadcast, @multicast2, @initdev={0xac, 0x1e, 0x1, 0x0}, @initdev={0xac, 0x1e, 0x0, 0x0}, @private=0xa010102]}]}}}}}) ioctl$PAGEMAP_SCAN(r5, 0xc0606610, 0x0) ioctl$VIDIOC_CREATE_BUFS(0xffffffffffffffff, 0xc100565c, &(0x7f0000000040)={0x0, 0xfff, 0x4, {0x1, @pix_mp={0x12, 0x5be7, 0xb5315258, 0x6, 0xb, [{0x80000004, 0x7}, {0x7ff, 0x5}, {0x10000001, 0x9}, {0x63d, 0x7fd}, {0x1, 0xfff}, {0x7, 0x489aa92e}, {0x5}, {0xfffffffe, 0x7}], 0x1, 0xc, 0x0, 0x0, 0x3}}, 0xfffffffd}) 31.247906133s ago: executing program 2 (id=4771): bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x1, '\x00', 0x0, @fallback=0x24, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000580)={'veth0\x00'}) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000000)=0xf3f, 0x4) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000040)=[{0x30, 0x2, 0xfe, 0xfffff034}, {0x80000006}]}, 0x8) socket$kcm(0x10, 0x400000002, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f00000003c0)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x7, 0x2, 0x1}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4040001}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newtfilter={0x40, 0x2c, 0xd27, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {0xfff0, 0xe}, {}, {0x7}}, [@filter_kind_options=@f_matchall={{0xd}, {0xc, 0x2, [@TCA_MATCHALL_CLASSID={0x8, 0x1, {0x2, 0xb}}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x10}, 0x0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r7, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r8, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r7, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r9 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r9, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="020b000102"], 0x10}}, 0x0) r10 = socket$inet_udp(0x2, 0x2, 0x0) sendmsg$key(r9, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) connect$inet(r10, &(0x7f0000000200)={0x2, 0x0, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r10, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@dev, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x3}, {}, 0x0, 0x0, 0x1}, {{@in=@empty, 0x0, 0x33}, 0x0, @in=@private=0xa010100, 0x0, 0x0, 0x0, 0xb7, 0xffffffff}}, 0xe8) sendmmsg(r10, &(0x7f0000007fc0), 0x800001d, 0x0) 29.83837638s ago: executing program 6 (id=4773): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DEL(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000001c0)={0x0}, 0x1, 0x0, 0x0, 0x4800}, 0x48080) 29.636133124s ago: executing program 2 (id=4774): r0 = socket$nl_route(0x10, 0x3, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) rseq(&(0x7f0000000600)={0x0, 0x0, 0x0, 0x3}, 0x20, 0x0, 0x0) futex(&(0x7f000000cffc)=0x4, 0x80000000000b, 0x4, 0x0, &(0x7f0000048000), 0xfffefffc) futex(&(0x7f000000cffc), 0xc, 0x1, 0x0, &(0x7f0000048000), 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000200)={'wlan0\x00'}) socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)={0x20, 0x2, 0x3, 0x3, 0x0, 0x0, {}, [@NFQA_CFG_PARAMS={0x9, 0x2, {0x738e, 0x2}}]}, 0x20}}, 0x0) sendmsg$NFQNL_MSG_VERDICT_BATCH(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000000)={0x20, 0x3, 0x3, 0x101, 0x0, 0x0, {}, [@NFQA_VERDICT_HDR={0xc, 0x2, {0x3, 0xff}}]}, 0x20}, 0x1, 0x0, 0x0, 0x20004000}, 0x4) socket$xdp(0x2c, 0x3, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x17) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(0xffffffffffffffff, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x43, 0x0, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=ANY=[@ANYBLOB="4c000000020603000000000000000000000000001400078008001240000000000500150002000000050001000600000005000500020000000500040000000000090002"], 0x4c}}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000050000080900010073797a30000000005c000000030a03000000000000000000050000000900010073797a30000000000900030073797a300000000008000c40000000032800048008000240000000120800014000000000140004"], 0xa4}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) openat$nullb(0xffffffffffffff9c, 0x0, 0x1c3902, 0x0) 29.52727861s ago: executing program 3 (id=4775): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x14, 0x1, 0x0, 0x1, 0x75b, 0x8, 0x10000, 0x1}, 0x0) socket$inet6_sctp(0xa, 0x801, 0x84) r2 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$SNDCTL_DSP_CHANNELS(r2, 0xc0045006, 0x0) ioctl$SNDCTL_DSP_SETFMT(r2, 0xc0045005, &(0x7f0000000640)=0x10) r3 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) ioctl$FS_IOC_SETFLAGS(r3, 0x40046602, &(0x7f0000000180)=0x400000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) openat$ptmx(0xffffffffffffff9c, 0x0, 0x121301, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, 0x0}, 0x0) munmap(&(0x7f0000002000/0x1000)=nil, 0x1000) r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r6 = dup(r5) syz_open_dev$loop(&(0x7f00000000c0), 0xd03b, 0x410000) write$6lowpan_enable(r6, 0x0, 0x0) write$6lowpan_enable(r6, &(0x7f0000000000)='0', 0xfffffd2c) read$FUSE(r6, &(0x7f0000003780)={0x2020}, 0x2020) r7 = socket(0x2b, 0x80801, 0x1) connect$inet6(r7, &(0x7f00000001c0)={0xa, 0x0, 0x0, @empty, 0x400005}, 0x1c) ioctl$sock_inet6_udp_SIOCOUTQ(r7, 0x894b, &(0x7f0000000040)) 29.450263358s ago: executing program 6 (id=4776): r0 = syz_open_dev$usbmon(&(0x7f0000000080), 0xa7, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000140)) r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000640)='/sys/power/pm_test', 0x42, 0x0) io_setup(0x20, &(0x7f0000001140)=0x0) io_submit(r3, 0x1, &(0x7f00000001c0)=[&(0x7f0000000d80)={0xf, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000c40)="0d32818e2fa06dfbac13", 0xa}]) syz_open_dev$usbfs(&(0x7f00000006c0), 0x205, 0x2581) 29.318661182s ago: executing program 5 (id=4777): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e24, @multicast2}, 0x10) connect$inet(r0, &(0x7f00000001c0)={0x2, 0x4e24, @loopback}, 0x10) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="d8000000180081064e81f782db44b904021d080006007c09e8fe55a10a0015400100142603600e120800060000000401a80016", 0x33}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x3, 0x2}}, 0x50, 0x0}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="d8001c00180081064e81f782db44b9b545c7910006007c09e8fe55a10a0017", 0x1f}], 0x1}, 0x0) r1 = memfd_secret(0x0) r2 = signalfd(r1, &(0x7f0000000340)={[0x3, 0x7]}, 0x8) sendmsg$kcm(r2, &(0x7f0000000400)={0x0, 0x46, &(0x7f00000001c0)=[{&(0x7f0000000000)="d8000000210081044e81f7d28344b904020000", 0xfffffdef}], 0x200002fd}, 0x0) r3 = socket$kcm(0x10, 0x2, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000600)=ANY=[@ANYBLOB="90000000", @ANYRES16=r5, @ANYBLOB="0100000000000002000005000000180001801400020073797a5f74756e000000000000000000080005000a0f00005c00038004000100540003800c000180080001"], 0x90}}, 0x0) sendmsg$ETHTOOL_MSG_LINKMODES_GET(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x14, r5, 0x2, 0x70bd2d, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x20004004}, 0x0) write$cgroup_subtree(r3, &(0x7f0000000000)=ANY=[], 0x33fe0) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f0000000100)={@local}) r6 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet6_mptcp_buf(r6, 0x11c, 0x3, &(0x7f0000000100)=""/222, &(0x7f0000000240)=0x61637879) r7 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KDSETKEYCODE(r1, 0x4b4d, &(0x7f0000000380)={0x1, 0x1}) r8 = dup(r7) io_setup(0x19, &(0x7f00000009c0)) ioctl$SNDCTL_DSP_SPEED(r7, 0xc0045002, &(0x7f0000000040)) read$FUSE(r8, &(0x7f0000002a40)={0x2020}, 0x2020) sendmmsg(r0, &(0x7f0000002100)=[{{0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000940)='5', 0x1}], 0x1}}], 0x1, 0x40008d0) recvmmsg(r0, &(0x7f00000034c0)=[{{0x0, 0x0, &(0x7f0000003680)=[{0x0}, {&(0x7f0000000a40)=""/4096, 0x1000}], 0x2}, 0x10001}, {{0x0, 0x0, 0x0}, 0xe}, {{0x0, 0x0, 0x0}}], 0x3, 0x10122, 0x0) 28.414357838s ago: executing program 6 (id=4778): openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x400, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket(0x1, 0x80802, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000d40)={0x44, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_TYPENAME={0xc, 0x3, 'hash:ip\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x44}}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) fcntl$getown(r2, 0x9) sendmsg$IPSET_CMD_ADD(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)={0x44, 0x9, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x1c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @multicast2}}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @multicast1=0xe0004001}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x10000047}, 0x0) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) r5 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) dup(r5) ioctl$AUTOFS_IOC_CATATONIC(r5, 0x9362, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000002340)={{0x12, 0x1, 0x0, 0xd4, 0x26, 0x7a, 0x10, 0x1004, 0x61aa, 0x4f75, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x2, 0x6}}]}}]}}, 0x0) syz_usb_connect$uac1(0x0, 0xd1, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0xff, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xbf, 0x3, 0x1, 0x8, 0x30, 0x8, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0xc, 0x7}, [@mixer_unit={0x9, 0x24, 0x4, 0x3, 0x5, "536dd8e1"}, @extension_unit={0xc, 0x24, 0x8, 0x60, 0x0, 0xfd, "7742946023"}, @mixer_unit={0x6, 0x24, 0x4, 0x3, 0x9, '\f'}, @input_terminal={0xc, 0x24, 0x2, 0x5, 0x201, 0x1, 0x3, 0x1000, 0x6}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_continuous={0x8, 0x24, 0x2, 0x1, 0x7, 0x2, 0x6c, 0x5}, @as_header={0x7, 0x24, 0x1, 0x29, 0x2, 0x4}]}, {{0x9, 0x5, 0x1, 0x9, 0x10, 0xfb, 0x5, 0xef, {0x7, 0x25, 0x1, 0x81, 0x2, 0xc}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_discrete={0xe, 0x24, 0x2, 0x1, 0x9, 0x2, 0x3, 0xb, "9c3722c40930"}, @format_type_ii_discrete={0x11, 0x24, 0x2, 0x2, 0x74f4, 0x5, 0x4, "36b97ec7d2587d5c"}, @format_type_i_continuous={0xb, 0x24, 0x2, 0x1, 0x4, 0x4, 0x6, 0x79, "9187ad"}]}, {{0x9, 0x5, 0x82, 0x9, 0x40, 0x0, 0x3, 0xf3, {0x7, 0x25, 0x1, 0x1, 0x4e, 0x3ff}}}}}}}]}}, &(0x7f0000000200)={0xa, &(0x7f0000000000)={0xa, 0x6, 0x110, 0xc, 0x2, 0x3, 0x40, 0xe}, 0x1a, &(0x7f0000000040)={0x5, 0xf, 0x1a, 0x2, [@ss_cap={0xa, 0x10, 0x3, 0x0, 0x3, 0x8, 0x8, 0x5}, @wireless={0xb, 0x10, 0x1, 0x2, 0x44, 0x40, 0x1, 0x2}]}}) r6 = openat$audio1(0xffffffffffffff9c, &(0x7f0000000040), 0x203a2, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r6, 0xc004500a, &(0x7f0000000200)=0x12) syz_usb_connect(0x2, 0x3b, &(0x7f0000001b80)=ANY=[@ANYBLOB="12010102a39ab910b80c0bc9ae0d01020301090229000101f8400409048afc0101033e080724010205050009050c021000050001072501"], &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0}) r7 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_MAX_BURST(r7, 0x84, 0xc, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) r9 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_MAXSEG(r9, 0x84, 0xd, &(0x7f0000000140)=@assoc_value={r8, 0x5fc}, 0x8) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r6, 0x84, 0x6, &(0x7f0000000080)={r8, @in={{0x2, 0x4e20, @multicast1}}}, &(0x7f0000000000)=0x84) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) 27.87590323s ago: executing program 2 (id=4779): getsockopt$netlink(0xffffffffffffffff, 0x10e, 0x9, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, 0x0, 0x4000) recvmmsg(r2, 0x0, 0x0, 0x20, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000000c0)=@newqdisc={0x24, 0x24, 0xf0b, 0x70bd2b, 0x0, {0x0, 0x0, 0x12, 0x0, {}, {0xffff, 0xffff}, {0x2}}}, 0x24}}, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$KVM_CREATE_PIT2(r4, 0x4040ae77, &(0x7f0000000040)={0x1}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_CAP_X86_APIC_BUS_CYCLES_NS(r4, 0x4068aea3, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f00000003c0)={[0x5fffffffffe, 0x1000000000, 0x0, 0x40, 0x2000001, 0x0, 0x2004cb, 0x0, 0x0, 0x68fc, 0x5, 0x0, 0x3, 0x0, 0x0, 0xfffffffffffffffe], 0x100000, 0x202}) ioctl$KVM_RUN(r5, 0xae80, 0x0) 25.414609049s ago: executing program 5 (id=4780): r0 = socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, 0x0, 0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000340)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0xc, 0x8, 0x4, 0x3}, 0x0) openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0) r3 = openat$uinput(0xffffffffffffff9c, &(0x7f00000010c0), 0x403, 0x0) ioctl$UI_DEV_SETUP(r3, 0x405c5503, &(0x7f0000000480)={{0x0, 0x3, 0x0, 0x3}, 'syz0\x00', 0x2}) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-3way\x00'}, 0x45) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000100)="add9ca0000e0278653344eadff000000", 0x10) ioctl$UI_SET_KEYBIT(r3, 0x40045565, 0x2c0) ioctl$UI_DEV_CREATE(r3, 0x5501) ioctl$KVM_SET_CPUID2(0xffffffffffffffff, 0x4008ae90, &(0x7f0000000240)=ANY=[@ANYBLOB]) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, &(0x7f0000000000)=ANY=[@ANYBLOB="0100000000"]) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f00000000c0)={0x0, 0x4, 0x0, 'queue0\x00'}) ioctl$MEDIA_IOC_ENUM_LINKS(0xffffffffffffffff, 0xc0287c02, &(0x7f0000000100)={0x80000000, 0x0, &(0x7f0000000200)=[{{}, {0x80000000, 0x0}}, {{}, {0x80000000, 0x0}}]}) keyctl$dh_compute(0x17, 0x0, 0x0, 0x0, 0x0) keyctl$read(0xb, 0x0, &(0x7f0000000000)=""/2, 0x2) ioctl$MEDIA_IOC_SETUP_LINK(0xffffffffffffffff, 0xc0347c03, &(0x7f00000001c0)={{r6, r5, 0x1, [0x0, 0xf7df]}, {r6, r7, 0x4, [0x6]}, 0x1, [0x8, 0x3df]}) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x38, 0x3f, 0x400, 0xfffffffe, 0xfffffffe, {0x1, 0x7c}, [@nested={0x4, 0x142}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}]}, @nested={0x14, 0x2, 0x0, 0x1, [@nested={0x10, 0x14, 0x0, 0x1, [@nested={0xc, 0x16, 0x0, 0x1, [@typed={0x8, 0xb6, 0x0, 0x0, @fd=r2}]}]}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) 24.546220136s ago: executing program 6 (id=4781): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000600)={{0x12, 0x1, 0x0, 0x35, 0xff, 0xaa, 0x20, 0xccd, 0x10af, 0x384e, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0x59, 0x2, 0x1, 0x9b, 0x1e, 0x2a, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) unshare(0x24020400) r1 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000180), 0x48) bpf$BPF_GET_MAP_INFO(0x3, &(0x7f0000000080)={r1, 0x58, &(0x7f0000000300)}, 0x10) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000540)={0x2c, &(0x7f0000000300)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, 0x0) unshare(0x28040680) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = eventfd(0x40048c67) ioctl$KVM_IOEVENTFD(r3, 0x4040ae79, &(0x7f0000000180)={0xfffffdfffffffffc, 0x0, 0x1, r4, 0x1}) ioctl$KVM_IOEVENTFD(r3, 0x4040ae79, &(0x7f0000000240)={0x27800000000, 0x0, 0x1, r4, 0x1}) ioctl$KVM_IOEVENTFD(r3, 0x4040ae79, &(0x7f0000000040)={0x27800000000, 0x0, 0x1, r4, 0x5}) r5 = syz_usb_connect$cdc_ecm(0x2, 0x80, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6e, 0x1, 0x1, 0xc, 0x7afd29e9b2234063, 0x4, [{{0x9, 0x4, 0x0, 0x5, 0x3, 0x2, 0x6, 0x0, 0xaa, {{0x8, 0x24, 0x6, 0x0, 0x0, "8cac50"}, {0x5, 0x24, 0x0, 0x2}, {0xd, 0x24, 0xf, 0x1, 0x2, 0x6, 0xfffa, 0x3}, [@network_terminal={0x7, 0x24, 0xa, 0x6, 0x3, 0x8, 0x2}, @call_mgmt={0x5, 0x24, 0x1, 0x2, 0x5}, @mbim_extended={0x8, 0x24, 0x1c, 0x5, 0x5}, @network_terminal={0x7, 0x24, 0xa, 0x7, 0x80, 0x60, 0x1}, @dmm={0x7, 0x24, 0x14, 0x8, 0x9a14}, @obex={0x5, 0x24, 0x15, 0x4}]}, {[{{0x9, 0x5, 0x81, 0x3, 0x3ff, 0x1f, 0x6, 0x7}}], {{0x9, 0x5, 0x82, 0x2, 0x20, 0xf7, 0x8, 0x69}}, {{0x9, 0x5, 0x3, 0x2, 0x10, 0xd, 0x10, 0x68}}}}}]}}]}}, &(0x7f0000000580)={0xa, &(0x7f0000000080)={0xa, 0x6, 0x310, 0x1, 0x40, 0x2, 0xff, 0x7}, 0xfe, &(0x7f00000000c0)={0x5, 0xf, 0xfe, 0x5, [@ext_cap={0x7, 0x10, 0x2, 0x18, 0x7, 0x9, 0x9}, @generic={0xda, 0x10, 0x3, "1d5bf4712220bfed9b0b67a01f7b1b74bf1e0dd7286e04c345278c345c85015b369391c91fa2518981595e71e69dbc550d709634c64d77c2b6017dc80354e88761557897bbc3e623756f0fe14888c192e79312c8e271f81ce4252264cff735ee8b7b5016d53f687b7791958c6f04a5d576d1df427888c7dcc9739fb8805489cb157ffc18538ddc7d1f9648a3d2da83c6f3aaccae588a4e645008274109559825ca17a0ef27f391443f22b30c6424d8635d085bcc6bd5f6e6c565960309aa834f0737f0e5681bfa923838709c78bfc87e86aff79200ecfc"}, @wireless={0xb, 0x10, 0x1, 0x0, 0xe1, 0x6, 0xfc, 0x9}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x2, 0xf0, 0x2, 0x6}, @ptm_cap={0x3}]}, 0x6, [{0x4, &(0x7f00000001c0)=@lang_id={0x4, 0x3, 0x2401}}, {0x5b, &(0x7f0000000200)=@string={0x5b, 0x3, "f73411a749aae2a2f1bfa707d182c3c4989b72c6361bb787be633e5b6548ed3c808bf9613699f77e434b7701bc48e27f116535fc74b8889db0ebaa9e4d3f37fd759a11ecb71cad58ad5efa4997b3bbea9be5273a576231d267"}}, {0x67, &(0x7f0000000280)=@string={0x67, 0x3, "08275c4320591652d2c18bcc535ae4592756005f456ffc6f424e4d79e94a9d97c81c6cc7d57bfdc5495ac60b1098096fd314d93f537310207393eb4cc8692ed23e0111306fbea35c9112b46620f6a63dd6d90038d8ca051e4095ded4a982633aecf881a500"}}, {0x4d, &(0x7f0000000300)=@string={0x4d, 0x3, "ec0c885b1eb864c8ba711f7887379f45bbd4c45ed977d7fce9031bd5b16b3f07e92a8011ca2b52ca8da2b7c880ecc375cd9fe21e465a1d51769894749815a1498d78fcd34d0fb4f05382b6"}}, {0x0, 0x0}, {0x4, &(0x7f0000000380)=@lang_id={0x4, 0x3, 0x43f}}]}) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000bc0)={0x1c, &(0x7f0000000980)={0x20, 0xa641f0264ead7266, 0x74, "e301b9215390512d3dca158efec3a26da564b37d2bd94718ad842ddfd1920f84f09a4fc4e8499bc9410f687ccfe37814b6206b23392e2160fe6569cb4f331d3658635d71f84c7de6cd0780d5dffe478876c4125d3e77722fbb82e62822f2fcff9dddbeb7ea1e5a71e4b18900785464563404dba4"}, &(0x7f0000000a00)={0x0, 0xa, 0x1, 0xcf}, &(0x7f0000000a40)={0x0, 0x8, 0x1, 0x1}, &(0x7f0000000a80)={0x20, 0x0, 0x9d, {0x9b, "347c4e3cc30528b9fcabdd48290996fee2bcac9a1a7a415cc800f85a0d8ebeb7ec8d8ec3ffdeb9001dfd95daf18b6940e35c076a80272058e46b3cae28f7ffc23679869c157f5492d42c02001062d8cc857679ed79692947b31db23bbdb729ee078fdfc15fef909a0038309a1e4939760f919847b878e025c38f2c9b7747fe044798a24838a8376564ad372cf08f7c53e90534e7bcf87f903853fe"}}, &(0x7f0000000b40)={0x20, 0x1, 0x1, 0xa}, &(0x7f0000000b80)={0x20, 0x0, 0x1, 0x5}}) r6 = syz_open_dev$radio(&(0x7f0000000000), 0x3, 0x2) ioctl$VIDIOC_G_MODULATOR(r6, 0xc0445636, &(0x7f0000000040)={0x0, "ee22f67dc829c0c3d3e6c348a52d1f485cf6ad827da723359d4602397835a388"}) ioctl$VIDIOC_G_JPEGCOMP(r6, 0x808c563d, &(0x7f0000000c00)) syz_usb_control_io$cdc_ecm(r5, &(0x7f00000006c0)={0xc, &(0x7f0000000640)={0x40, 0x21, 0x65, {0x65, 0x1, "a56ab0752110827e9fc28d542b376e29c398d8f71ca66a81cd95e6587d482130023c5f42040f6d28713ee691b6710356aeac3947ca3fbb6cb5b977fbc48b8fd87735d4a3024443378be87f15819aa15c3a31d843efdd207c056dcc73387f07f761ed5d"}}, &(0x7f0000000500)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000840)={0x10, &(0x7f0000000740)={0x0, 0x17, 0x28, "f82a282db153f11ea04bfa7c011b40a1f81cbc28507e602584b48f43191d904ddc3a50d5bf10d6b9"}, &(0x7f00000007c0)={0x0, 0xa, 0x1, 0xe}, &(0x7f0000000800)={0x0, 0x8, 0x1, 0x9}}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, &(0x7f0000000e00)={0xc, &(0x7f0000000cc0)={0x20, 0x21, 0x4a, {0x4a, 0xf, "ad4f30672e7fc0be7101b61a96381a85ab5b501b534bf5ff13ebc8ba7368f4f834b74c20101a4987005cbd6d325557dbd8744278dd130004271239e68c1bf0598bac180cd40a5fc9"}}, &(0x7f0000000d40)={0x0, 0x3, 0xa2, @string={0xa2, 0x3, "360b86fb2008c031fd104f71e762a128b4f28a5afbf22935fb304f0e2bcc63e9db9c52bbeba48ef33d71673c98c12c23e4bec6cd381d466be3546fd6e3434e5ca96628692a0ee15219a4308264f15a215f0fb4bca23d647eaf2c66d108563b35a6d33055c55232cabf947e49960ab84f98fce35fe8c093ad0f4b4c1fa9508f307a74cad366c3914a1ba04a813e89d366ebc0c2dd767af2284095585146c96626"}}}, &(0x7f0000001040)={0x1c, &(0x7f0000000e40)={0x40, 0x5, 0x2f, "80fa2d6bfdd21e4c373d6325c9b212f4bb87cdc75962934a62c5c551d20bad5675a5a139272662630dd81c235756ce"}, &(0x7f0000000e80)={0x0, 0xa, 0x1, 0x2}, &(0x7f0000000ec0)={0x0, 0x8, 0x1, 0x1}, &(0x7f0000000f00)={0x20, 0x0, 0xac, {0xaa, "f4593ad5c997491a1a280d8b0c8388f4de7b700f8d4e43af2183e59aa8b9ed27a7525ee7e40a6b5518970bd6fed20af06fade1cddeff49f76c4eb711d03dbcb185ca51e0156fe439f74e2d548a4e5d07e017da62bd1434b744c69f932e780776050804c1cde7dd267ce853d78ff90cc27525ad79acd54eab700edd9394ccf4f2229a16fd822a98d284f22b227406fb71219149481fcc59527dff46757ccca91b0155a7e962712181e6b6"}}, &(0x7f0000000fc0)={0x20, 0x1, 0x1, 0x8}, &(0x7f0000001000)={0x20, 0x0, 0x1, 0x4}}) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000700)={0x1c, &(0x7f00000003c0)={0x40, 0x65497d0588c24846, 0x1, "91"}, 0x0, 0x0, 0x0, 0x0, 0x0}) 24.137923983s ago: executing program 3 (id=4782): pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80080) writev(r1, &(0x7f00000006c0)=[{&(0x7f0000000280)="fa", 0x1}], 0x1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x8, 0x0, 0x10) mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000800), 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000040000,u', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r4, &(0x7f00000021c0)={0x2020}, 0x2020) write$FUSE_INIT(r4, 0x0, 0x0) creat(&(0x7f0000000180)='./file0/file0\x00', 0x0) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, 0x0) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r5, 0x84, 0x9, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), r1) bind$inet6(r5, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r5, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) shutdown(r5, 0x2) close(r5) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x8, 0x4, &(0x7f0000000680)=ANY=[@ANYBLOB="180000000000000000006fded70000007b018e0f000000009d00000000000000"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r0}, 0x94) socket$netlink(0x10, 0x3, 0x13) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) 23.48861196s ago: executing program 1 (id=4783): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_IPV6_HOPOPTS(r0, 0x29, 0x36, &(0x7f0000000480)=ANY=[], 0x8) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x1fff, 0x0, @mcast2, 0x5}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040)='batadv0\x00', 0x10) write(r0, &(0x7f0000000140)="8465000000000000", 0x5ac) 20.0622019s ago: executing program 5 (id=4784): bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x1, '\x00', 0x0, @fallback=0x24, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000580)={'veth0\x00'}) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000000)=0xf3f, 0x4) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000040)=[{0x30, 0x2, 0xfe, 0xfffff034}, {0x80000006}]}, 0x8) socket$kcm(0x10, 0x400000002, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f00000003c0)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x7, 0x2, 0x1}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4040001}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newtfilter={0x40, 0x2c, 0xd27, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {0xfff0, 0xe}, {}, {0x7}}, [@filter_kind_options=@f_matchall={{0xd}, {0xc, 0x2, [@TCA_MATCHALL_CLASSID={0x8, 0x1, {0x2, 0xb}}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x10}, 0x0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r7, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r8, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r7, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r9 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r9, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="020b000102"], 0x10}}, 0x0) r10 = socket$inet_udp(0x2, 0x2, 0x0) sendmsg$key(r9, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) connect$inet(r10, &(0x7f0000000200)={0x2, 0x0, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r10, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@dev, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x3}, {}, 0x0, 0x0, 0x1}, {{@in=@empty, 0x0, 0x33}, 0x0, @in=@private=0xa010100, 0x0, 0x0, 0x0, 0xb7, 0xffffffff}}, 0xe8) sendmmsg(r10, &(0x7f0000007fc0), 0x800001d, 0x0) 19.341112616s ago: executing program 1 (id=4785): timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) 18.330242083s ago: executing program 2 (id=4786): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x60003, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet6(r2, &(0x7f00000007c0)=[{{&(0x7f00000000c0)={0xa, 0x4e22, 0x4, @remote, 0x7}, 0x1c, &(0x7f00000003c0)=[{&(0x7f0000000280)="e9", 0x1}], 0x1}}], 0x1, 0x931766f6319eed14) shutdown(r2, 0x1) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000001100)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000200)=@assoc_value, &(0x7f0000001080)=0xffffff98) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, 0x0, &(0x7f0000000180)) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f00000001c0)={0x0, @in={{0x2, 0x4e24, @empty}}, 0xf2a, 0x714, 0x38e8, 0x8, 0x80, 0x40008, 0x40}, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x101, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x2) ioctl$KVM_SET_CPUID2(r5, 0x4008ae90, &(0x7f0000000140)=ANY=[@ANYRES16=r5]) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_SET_CPUID2(r5, 0x4008ae90, &(0x7f0000000040)=ANY=[@ANYRES32=r5]) r6 = openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r6, 0x3b81, &(0x7f00000002c0)={0xc}) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f000057a000/0x1000)=nil, 0x1000, 0x0, 0x3fe, 0x1c0000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) r7 = mq_open(&(0x7f000084dff0)='z\xbf\x17', 0x6e93ebbbcc0884f2, 0x0, &(0x7f0000000040)={0x0, 0x6, 0x101}) syz_io_uring_setup(0x239, 0x0, &(0x7f0000000180), &(0x7f00000001c0)) mq_timedsend(r7, 0x0, 0x0, 0x0, 0x0) 17.842587942s ago: executing program 1 (id=4787): r0 = socket$nl_generic(0x10, 0x3, 0x10) flock(r0, 0x1) syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x14, 0x1, 0x0, 0x1, 0x75b, 0x8, 0x10000, 0x1}, 0x0) socket$inet6_sctp(0xa, 0x801, 0x84) r3 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$SNDCTL_DSP_CHANNELS(r3, 0xc0045006, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) ioctl$FS_IOC_SETFLAGS(r4, 0x40046602, &(0x7f0000000180)=0x400000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) openat$ptmx(0xffffffffffffff9c, 0x0, 0x121301, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) munmap(&(0x7f0000002000/0x1000)=nil, 0x1000) r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r6 = dup(r5) syz_open_dev$loop(&(0x7f00000000c0), 0xd03b, 0x410000) write$6lowpan_enable(r6, 0x0, 0x0) write$6lowpan_enable(r6, &(0x7f0000000000)='0', 0xfffffd2c) r7 = socket(0x2b, 0x80801, 0x1) connect$inet6(r7, &(0x7f00000001c0)={0xa, 0x0, 0x0, @empty, 0x400005}, 0x1c) ioctl$sock_inet6_udp_SIOCOUTQ(r7, 0x894b, &(0x7f0000000040)) 17.658183569s ago: executing program 6 (id=4788): syz_usb_connect(0x5, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000096d5c4004233e0269d7010203010902120001000000000904"], 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$inet(0xa, 0x1, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff000000000200000009000100"], 0x7c}}, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r5, &(0x7f0000000000), 0x10) setsockopt$CAN_RAW_FILTER(r5, 0x65, 0x1, &(0x7f00000000c0), 0xf00) close(r5) 10.97277786s ago: executing program 5 (id=4789): socket$kcm(0x10, 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_emit_ethernet(0x87, &(0x7f0000000080)=ANY=[@ANYBLOB="ffffffffffd2a9dc6da626c0e21677ffaaaaaaaaaa2b86dd6700000100513afffe880000000000000000000000000201ff02000000000000000000000000000189009078000000002001000000000000000000000001fe800000000000000000000000000038220560aeb59d3fb13258c6f29dd7eed9c5aaa04a18f74d2a890000"], 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) r3 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000400), 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x8031, r3, 0x1000) r4 = syz_open_dev$dri(&(0x7f0000000100), 0x1f, 0x0) ioctl$DRM_IOCTL_DROP_MASTER(r4, 0x641f) syz_open_dev$dri(&(0x7f0000000000), 0x1ff, 0x100) ioctl$DRM_IOCTL_SET_MASTER(r4, 0x641e) syz_open_dev$hidraw(&(0x7f00000004c0), 0x0, 0x14a042) read(r1, 0x0, 0x0) add_key$keyring(&(0x7f00000000c0), &(0x7f0000000040)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) close_range(r2, 0xffffffffffffffff, 0x0) 10.896289366s ago: executing program 3 (id=4790): r0 = socket$inet6(0xa, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f00000002c0)=ANY=[@ANYBLOB="12010000000000106d049cc20000000000010902"], 0x0) syz_open_dev$sg(0x0, 0x0, 0x0) r3 = socket$inet(0x2b, 0x800, 0xc) splice(r3, 0x0, 0xffffffffffffffff, 0x0, 0x39000, 0x9) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, 0x0, 0x0) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000a00)=ANY=[], 0x478) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto$inet6(r0, 0x0, 0x0, 0x40000, &(0x7f0000000000)={0xa, 0x0, 0xfffffffd, @empty}, 0x1c) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) sendto$inet6(r7, 0x0, 0x0, 0x40840, &(0x7f0000000180)={0xa, 0x4e20, 0x10, @mcast1, 0x4}, 0x1c) sendmsg$NFT_BATCH(r6, 0x0, 0x0) sendmsg$nl_route(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@mpls_getnetconf={0x14, 0x4e, 0x1}, 0x14}}, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8b33, &(0x7f0000000000)={'wlan1\x00'}) r9 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$AUTOFS_IOC_FAIL(r9, 0x4c80, 0x7000000) r10 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r10, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000000)=@bridge_getvlan={0x18, 0x72, 0x7e3bfe4fa73db39f, 0x70bd29}, 0x18}, 0x1, 0x0, 0x0, 0x20004040}, 0x20041040) 10.52212066s ago: executing program 1 (id=4791): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = socket$key(0xf, 0x3, 0x2) r3 = fsopen(&(0x7f0000000000)='cifs\x00', 0x0) socket$nl_route(0x10, 0x3, 0x0) fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f0000000040)='source', &(0x7f0000005fc0)='//\xf2/\x06\b/\xdf/o\xdc\xea\x95\x9a\x82\x10\x97W\x8f7\x98\x9b\\/\\\xf9\rmD\x94)U\xdb\x15X.I\n}\xf3\x9d\xe4_\x05\x9cqf4I^#b?9\xde\xafu\'\x83L\xe0\x97\xe1n_\xa4%\xb1\x97\x93\xafv\xce/\\\xb4L\xf2_\xa7\xfb\xf4\x84\x1fA\xeas^\xef\xa2\x85\xa3!\xfb\x93\xd7R\xab2\x1eW\xe9h\x9b\xf7ul\xf9D\xd4\x82X5\x13\xaa\x87\xf9\xba\xa9m\x14\x14R_\x9a\\>4\xce\x8e_#\xf8D\xb1\xdep\x01\xcc:\xa6\xc5n\xeb\xab\xf70\x99\xef\x8b4\xce\x8e_#\xf8D\xb1\xdep\x01\xcc:\xa6\xc5n\xeb\xab\xf70\x99\xef\x8b0x0}) sendmsg$nl_route_sched(r7, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=@newqdisc={0x90, 0x24, 0x4ee4e6a52ff56541, 0x0, 0xfffffffe, {0x0, 0x0, 0x0, r9, {}, {0xffff, 0xffff}}, [@TCA_STAB={0x6c, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x6, 0x3, 0x4, 0xffffff80, 0xcd574cbc5b439c78, 0xff, 0x2}}, {0x4}}, {{0x1c, 0x1, {0x4, 0x7, 0xffff, 0x82, 0x0, 0x101, 0x8a, 0x2}}, {0x8, 0x2, [0xfffe, 0x7ff]}}, {{0x1c, 0x1, {0x1, 0xff, 0x3, 0x8, 0x0, 0x4, 0x1, 0x1}}, {0x6, 0x2, [0x800]}}]}]}, 0x90}}, 0x0) 7.616574988s ago: executing program 1 (id=4792): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x14, 0x1, 0x0, 0x1, 0x75b, 0x8, 0x10000, 0x1}, 0x0) socket$inet6_sctp(0xa, 0x801, 0x84) r2 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$SNDCTL_DSP_CHANNELS(r2, 0xc0045006, 0x0) ioctl$SNDCTL_DSP_SETFMT(r2, 0xc0045005, &(0x7f0000000640)=0x10) r3 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) ioctl$FS_IOC_SETFLAGS(r3, 0x40046602, &(0x7f0000000180)=0x400000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) openat$ptmx(0xffffffffffffff9c, 0x0, 0x121301, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, 0x0}, 0x0) munmap(&(0x7f0000002000/0x1000)=nil, 0x1000) r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r6 = dup(r5) syz_open_dev$loop(&(0x7f00000000c0), 0xd03b, 0x410000) write$6lowpan_enable(r6, 0x0, 0x0) write$6lowpan_enable(r6, &(0x7f0000000000)='0', 0xfffffd2c) read$FUSE(r6, &(0x7f0000003780)={0x2020}, 0x2020) r7 = socket(0x2b, 0x80801, 0x1) connect$inet6(r7, &(0x7f00000001c0)={0xa, 0x0, 0x0, @empty, 0x400005}, 0x1c) ioctl$sock_inet6_udp_SIOCOUTQ(r7, 0x894b, &(0x7f0000000040)) 7.226394905s ago: executing program 2 (id=4793): syz_usb_connect(0x5, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000096d5c4004233e0269d7010203010902120001000000000904"], 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$inet(0xa, 0x1, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff000000000200000009000100"], 0x7c}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bind$can_raw(0xffffffffffffffff, &(0x7f0000000000), 0x10) setsockopt$CAN_RAW_FILTER(0xffffffffffffffff, 0x65, 0x1, &(0x7f00000000c0), 0xf00) close(0xffffffffffffffff) 6.229282613s ago: executing program 5 (id=4794): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e24, @multicast2}, 0x10) connect$inet(r0, &(0x7f00000001c0)={0x2, 0x4e24, @loopback}, 0x10) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="d8000000180081064e81f782db44b904021d080006007c09e8fe55a10a0015400100142603600e120800060000000401a80016", 0x33}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x3, 0x2}}, 0x50, 0x0}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="d8001c00180081064e81f782db44b9b545c7910006007c09e8fe55a10a0017", 0x1f}], 0x1}, 0x0) r1 = memfd_secret(0x0) r2 = signalfd(r1, &(0x7f0000000340)={[0x3, 0x7]}, 0x8) sendmsg$kcm(r2, &(0x7f0000000400)={0x0, 0x46, &(0x7f00000001c0)=[{&(0x7f0000000000)="d8000000210081044e81f7d28344b904020000", 0xfffffdef}], 0x200002fd}, 0x0) r3 = socket$kcm(0x10, 0x2, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000600)=ANY=[@ANYBLOB="90000000", @ANYRES16=r5, @ANYBLOB="0100000000000002000005000000180001801400020073797a5f74756e000000000000000000080005000a0f00005c00038004000100540003800c000180080001"], 0x90}}, 0x0) sendmsg$ETHTOOL_MSG_LINKMODES_GET(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x14, r5, 0x2, 0x70bd2d, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x20004004}, 0x0) write$cgroup_subtree(r3, &(0x7f0000000000)=ANY=[], 0x33fe0) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f0000000100)={@local}) r6 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet6_mptcp_buf(r6, 0x11c, 0x3, &(0x7f0000000100)=""/222, &(0x7f0000000240)=0x61637879) r7 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KDSETKEYCODE(r1, 0x4b4d, &(0x7f0000000380)={0x1, 0x1}) r8 = dup(r7) io_setup(0x19, &(0x7f00000009c0)) ioctl$SNDCTL_DSP_SPEED(r7, 0xc0045002, &(0x7f0000000040)) read$FUSE(r8, &(0x7f0000002a40)={0x2020}, 0x2020) sendmmsg(r0, &(0x7f0000002100)=[{{0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000940)='5', 0x1}], 0x1}}], 0x1, 0x40008d0) recvmmsg(r0, &(0x7f00000034c0)=[{{0x0, 0x0, &(0x7f0000003680)=[{0x0}, {&(0x7f0000000a40)=""/4096, 0x1000}], 0x2}, 0x10001}, {{0x0, 0x0, 0x0}, 0xe}, {{0x0, 0x0, 0x0}}], 0x3, 0x10122, 0x0) 0s ago: executing program 6 (id=4795): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) set_mempolicy(0x2, 0x0, 0xf5) socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, 0x0, 0x0) syz_emit_ethernet(0x8a, &(0x7f00000006c0)={@local, @link_local, @void, {@ipv4={0x800, @tipc={{0x7, 0x4, 0x0, 0x0, 0x7c, 0x0, 0x0, 0x0, 0x6, 0x0, @empty, @broadcast, {[@noop, @ra={0x94, 0x4}]}}, @name_distributor={{0x60, 0x0, 0x0, 0x0, 0x0, 0xa, 0xb, 0x2, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x3, 0x3}, [{}, {}]}}}}}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x1, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xfffffffc}, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000040)='net/route\x00') pread64(r2, 0x0, 0x0, 0x200) syz_open_dev$sndctrl(&(0x7f0000000580), 0x2, 0x141240) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x5, 0x0, 0x0, 0x0, 0x61, 0x10, 0xa4}, [@ldst={0x4, 0x3, 0x5}]}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r3 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r3, 0x0, 0x80, &(0x7f00000000c0)=@filter={'filter\x00', 0xe, 0x88, 0x90, [0x0, 0x80000580, 0x800005b0, 0x800005e0], 0x0, 0x0, &(0x7f0000000580)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x8800}]}, 0xe0) fsopen(&(0x7f0000000140)='hpfs\x00', 0x1) io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, 0x0, 0x0) syz_open_dev$vbi(&(0x7f00000001c0), 0x1, 0x2) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[], 0x84}, 0x1, 0x0, 0x0, 0x1}, 0x20000000) kernel console output (not intermixed with test programs): .0: AC97 chip type couldn't be determined [ 1534.002510][ T5880] em28xx 2-1:0.0: No AC97 audio processor [ 1534.241720][T24389] usb usb8: usbfs: process 24389 (syz.5.4387) did not claim interface 0 before use [ 1534.266832][ T5880] usb 2-1: USB disconnect, device number 30 [ 1534.611938][ T7882] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 1534.648182][ T5880] em28xx 2-1:0.0: Disconnecting em28xx [ 1534.679676][ T5880] em28xx 2-1:0.0: Freeing device [ 1534.813883][ T7882] usb 3-1: Using ep0 maxpacket: 8 [ 1534.821324][ T7882] usb 3-1: config index 0 descriptor too short (expected 301, got 45) [ 1534.833882][ T7882] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1534.870861][ T7882] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1534.895718][ T7882] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1534.924163][ T7882] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1534.993825][ T7882] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1535.025123][ T7882] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1535.069684][T24396] fuse: Bad value for 'fd' [ 1535.269192][ T7882] usb 3-1: usb_control_msg returned -32 [ 1535.278046][ T7882] usbtmc 3-1:16.0: can't read capabilities [ 1536.365423][T24414] usbtmc 3-1:16.0: usb_control_msg returned -32 [ 1536.466471][T24382] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4385'. [ 1536.476738][T24382] netlink: 'syz.2.4385': attribute type 5 has an invalid length. [ 1536.494194][T24382] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4385'. [ 1536.509025][T24382] geneve2: entered promiscuous mode [ 1536.525115][T24382] geneve2: entered allmulticast mode [ 1536.605493][T22415] netdevsim netdevsim2 netdevsim1: set [1, 1] type 2 family 0 port 256 - 0 [ 1536.615543][T22415] netdevsim netdevsim2 netdevsim2: set [1, 1] type 2 family 0 port 256 - 0 [ 1536.637192][T22415] netdevsim netdevsim2 netdevsim3: set [1, 1] type 2 family 0 port 256 - 0 [ 1537.524577][ T7898] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 1538.825228][ T7900] usb 3-1: USB disconnect, device number 30 [ 1538.844648][ T7898] usb 4-1: Using ep0 maxpacket: 32 [ 1538.859071][ T7898] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1538.997376][ T7898] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1539.244749][ T7898] usb 4-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 1539.254638][ T7898] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1539.282020][ T7898] usb 4-1: Product: syz [ 1539.290247][ T7898] usb 4-1: Manufacturer: syz [ 1539.298395][ T7898] usb 4-1: SerialNumber: syz [ 1539.309539][ T7898] usb 4-1: config 0 descriptor?? [ 1539.974185][ T7898] usb 7-1: new high-speed USB device number 32 using dummy_hcd [ 1540.444545][ T7900] usb 6-1: new high-speed USB device number 62 using dummy_hcd [ 1540.464650][ T7898] usb 7-1: Using ep0 maxpacket: 32 [ 1540.610508][T24457] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4400'. [ 1540.685423][ T7901] usb 4-1: USB disconnect, device number 2 [ 1540.705946][ T7898] usb 7-1: config 0 has an invalid interface number: 89 but max is 0 [ 1540.737079][ T7900] usb 6-1: Using ep0 maxpacket: 16 [ 1540.747179][ T7898] usb 7-1: config 0 has no interface number 0 [ 1540.764791][ T7898] usb 7-1: config 0 interface 89 has no altsetting 0 [ 1540.802503][ T7900] usb 6-1: New USB device found, idVendor=1004, idProduct=61aa, bcdDevice=4f.75 [ 1540.812586][ T7900] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1540.826471][ T7900] usb 6-1: Product: syz [ 1540.830895][ T7900] usb 6-1: Manufacturer: syz [ 1540.836315][ T7900] usb 6-1: SerialNumber: syz [ 1540.841645][ T7898] usb 7-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4e [ 1540.851792][ T7898] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1540.866492][ T7900] usb 6-1: config 0 descriptor?? [ 1540.875890][ T7898] usb 7-1: Product: syz [ 1540.886980][ T7898] usb 7-1: Manufacturer: syz [ 1540.900504][ T7898] usb 7-1: SerialNumber: syz [ 1540.917495][ T7900] usb 6-1: bad CDC descriptors [ 1540.967305][ T7898] usb 7-1: config 0 descriptor?? [ 1540.983368][T24462] tipc: Enabled bearer , priority 0 [ 1541.007497][ T7898] em28xx 7-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 1541.026082][ T7898] em28xx 7-1:0.89: Video interface 89 found: bulk [ 1541.026285][T24462] syzkaller0: entered promiscuous mode [ 1541.034650][ T7901] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 1541.042556][T24462] syzkaller0: entered allmulticast mode [ 1541.126323][T24452] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1541.137321][T24452] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1541.192422][T24462] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 1541.222519][T24462] tipc: Resetting bearer [ 1541.228917][ T7901] usb 4-1: Using ep0 maxpacket: 8 [ 1541.295971][ T7901] usb 4-1: config index 0 descriptor too short (expected 30, got 18) [ 1541.306253][ T7901] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1541.317189][ T7901] usb 4-1: config 0 has no interfaces? [ 1541.327492][ T7901] usb 4-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 1541.337936][ T7901] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1541.346629][ T7901] usb 4-1: Product: syz [ 1541.357183][ T7901] usb 4-1: Manufacturer: syz [ 1541.431618][ T7901] usb 4-1: SerialNumber: syz [ 1541.467761][ T7901] usb 4-1: config 0 descriptor?? [ 1541.534077][ T7879] usb 3-1: new high-speed USB device number 31 using dummy_hcd [ 1541.616284][ T7898] em28xx 7-1:0.89: unknown em28xx chip ID (0) [ 1541.695161][T24460] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 1541.714869][ T7879] usb 3-1: Using ep0 maxpacket: 32 [ 1541.734194][ T7879] usb 3-1: unable to get BOS descriptor or descriptor too short [ 1541.748854][ T7879] usb 3-1: config 14 has an invalid interface number: 120 but max is 0 [ 1541.763609][ T7879] usb 3-1: config 14 has no interface number 0 [ 1541.795466][ T7879] usb 3-1: config 14 interface 120 has no altsetting 0 [ 1541.829597][ T7879] usb 3-1: New USB device found, idVendor=0403, idProduct=f850, bcdDevice=22.cd [ 1541.839124][ T7879] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1541.850717][ T7879] usb 3-1: Product: syz [ 1541.864696][ T7879] usb 3-1: Manufacturer: syz [ 1541.879708][ T7879] usb 3-1: SerialNumber: syz [ 1542.084159][ T7881] tipc: Node number set to 2134431527 [ 1542.119470][T24461] tipc: Resetting bearer [ 1542.223452][T24461] tipc: Disabling bearer [ 1542.224407][ T7879] ftdi_sio 3-1:14.120: FTDI USB Serial Device converter detected [ 1542.243594][ T7879] ftdi_sio ttyUSB0: unknown device type: 0x22cd [ 1542.787001][T24472] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1542.803332][ T7879] usb 3-1: USB disconnect, device number 31 [ 1542.809542][T24473] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1542.819829][T24471] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1542.834646][T24473] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1542.848340][ T7879] ftdi_sio 3-1:14.120: device disconnected [ 1543.355741][ T7901] usb 6-1: USB disconnect, device number 62 [ 1543.453086][ T7898] em28xx 7-1:0.89: read from i2c device at 0xa0 failed with unknown error (status=145) [ 1543.468149][ T7898] em28xx 7-1:0.89: board has no eeprom [ 1543.757724][T24483] fuse: Unknown parameter '00000000000000000000' [ 1544.315275][ T7898] em28xx 7-1:0.89: Identified as Terratec Grabby (card=67) [ 1544.323655][ T7898] em28xx 7-1:0.89: analog set to bulk mode. [ 1544.336163][ T7900] em28xx 7-1:0.89: Registering V4L2 extension [ 1544.363094][ T7898] usb 7-1: USB disconnect, device number 32 [ 1544.415071][ T5880] usb 4-1: USB disconnect, device number 3 [ 1544.425853][T23184] IPVS: starting estimator thread 0... [ 1544.454535][ T7898] em28xx 7-1:0.89: Disconnecting em28xx [ 1544.554979][T24496] IPVS: using max 31 ests per chain, 74400 per kthread [ 1544.684007][ T7882] usb 2-1: new high-speed USB device number 31 using dummy_hcd [ 1544.777657][ T7900] em28xx 7-1:0.89: Config register raw data: 0xffffffed [ 1544.785279][ T7900] em28xx 7-1:0.89: AC97 chip type couldn't be determined [ 1544.817347][ T7900] em28xx 7-1:0.89: No AC97 audio processor [ 1544.825166][ T7900] usb 7-1: Decoder not found [ 1544.833550][ T7900] em28xx 7-1:0.89: failed to create media graph [ 1544.845849][ T7882] usb 2-1: Using ep0 maxpacket: 32 [ 1544.848637][ T7900] em28xx 7-1:0.89: V4L2 device video103 deregistered [ 1544.863300][ T7900] em28xx 7-1:0.89: Registering snapshot button... [ 1544.879825][ T7882] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1544.882551][ T7900] input: em28xx snapshot button as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.89/input/input224 [ 1544.912852][ T7900] em28xx 7-1:0.89: Remote control support is not available for this card. [ 1544.924544][ T7898] em28xx 7-1:0.89: Closing input extension [ 1544.930380][ T7898] em28xx 7-1:0.89: Deregistering snapshot button [ 1544.943951][ T7882] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1545.015134][ T7898] em28xx 7-1:0.89: Freeing device [ 1545.182121][ T7882] usb 2-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 1545.204328][ T7882] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1545.307515][ T7882] usb 2-1: Product: syz [ 1545.355326][ T7882] usb 2-1: Manufacturer: syz [ 1545.394668][ T7882] usb 2-1: SerialNumber: syz [ 1545.716246][ T7882] usb 2-1: config 0 descriptor?? [ 1545.851911][ T1303] ieee802154 phy0 wpan0: encryption failed: -22 [ 1545.858351][ T1303] ieee802154 phy1 wpan1: encryption failed: -22 [ 1546.276487][T24522] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4413'. [ 1546.391419][T24525] netlink: 12 bytes leftover after parsing attributes in process `syz.6.4415'. [ 1546.409931][T24525] FAULT_INJECTION: forcing a failure. [ 1546.409931][T24525] name failslab, interval 1, probability 0, space 0, times 0 [ 1546.463315][T24525] CPU: 0 UID: 0 PID: 24525 Comm: syz.6.4415 Not tainted syzkaller #0 PREEMPT(full) [ 1546.463340][T24525] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1546.463351][T24525] Call Trace: [ 1546.463360][T24525] [ 1546.463369][T24525] dump_stack_lvl+0x189/0x250 [ 1546.463400][T24525] ? __pfx____ratelimit+0x10/0x10 [ 1546.463427][T24525] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1546.463441][T24525] ? __pfx__printk+0x10/0x10 [ 1546.463454][T24525] ? __pfx___might_resched+0x10/0x10 [ 1546.463471][T24525] should_fail_ex+0x414/0x560 [ 1546.463489][T24525] should_failslab+0xa8/0x100 [ 1546.463503][T24525] __kmalloc_cache_noprof+0x6f/0x6f0 [ 1546.463515][T24525] ? nft_setelem_insert+0x22c/0x3f0 [ 1546.463528][T24525] ? __asan_memcpy+0x40/0x70 [ 1546.463536][T24525] ? nft_trans_elem_alloc+0x55/0x320 [ 1546.463555][T24525] nft_setelem_insert+0x22c/0x3f0 [ 1546.463584][T24525] nf_tables_newsetelem+0x2585/0x4330 [ 1546.463645][T24525] ? __pfx_nf_tables_newsetelem+0x10/0x10 [ 1546.463664][T24525] ? __lock_acquire+0xab9/0xd20 [ 1546.463694][T24525] ? nla_validate_array+0xfc/0x260 [ 1546.463721][T24525] ? __pfx___nla_validate_parse+0x10/0x10 [ 1546.463734][T24525] ? __lock_acquire+0xab9/0xd20 [ 1546.463760][T24525] ? nfnl_pernet+0x23/0x240 [ 1546.463788][T24525] ? __nla_parse+0x40/0x60 [ 1546.463811][T24525] nfnetlink_rcv+0x11d9/0x2590 [ 1546.463870][T24525] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 1546.463908][T24525] ? ref_tracker_free+0x63a/0x7d0 [ 1546.463971][T24525] ? __netlink_deliver_tap+0x807/0x850 [ 1546.463995][T24525] ? netlink_deliver_tap+0x2e/0x1b0 [ 1546.464038][T24525] netlink_unicast+0x82f/0x9e0 [ 1546.464069][T24525] ? __pfx_netlink_unicast+0x10/0x10 [ 1546.464093][T24525] ? netlink_sendmsg+0x642/0xb30 [ 1546.464115][T24525] ? skb_put+0x11b/0x210 [ 1546.464145][T24525] netlink_sendmsg+0x805/0xb30 [ 1546.464179][T24525] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1546.464206][T24525] ? __import_iovec+0x5d4/0x7f0 [ 1546.464227][T24525] ? aa_sock_msg_perm+0xf1/0x1d0 [ 1546.464250][T24525] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1546.464273][T24525] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1546.464298][T24525] __sock_sendmsg+0x21c/0x270 [ 1546.464324][T24525] ____sys_sendmsg+0x505/0x830 [ 1546.464353][T24525] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1546.464392][T24525] ___sys_sendmsg+0x21f/0x2a0 [ 1546.464418][T24525] ? __pfx____sys_sendmsg+0x10/0x10 [ 1546.464471][T24525] ? __fget_files+0x2a/0x420 [ 1546.464492][T24525] ? __fget_files+0x3a0/0x420 [ 1546.464524][T24525] __sys_sendmsg+0x164/0x220 [ 1546.464538][T24525] ? __pfx___sys_sendmsg+0x10/0x10 [ 1546.464557][T24525] ? __pfx_ksys_write+0x10/0x10 [ 1546.464570][T24525] ? syscall_enter_from_user_mode_prepare+0x8f/0x110 [ 1546.464582][T24525] ? lockdep_hardirqs_on+0x9c/0x150 [ 1546.464594][T24525] __do_fast_syscall_32+0xb6/0x2b0 [ 1546.464605][T24525] ? lockdep_hardirqs_on+0x9c/0x150 [ 1546.464617][T24525] do_fast_syscall_32+0x34/0x80 [ 1546.464628][T24525] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1546.464641][T24525] RIP: 0023:0xf703d539 [ 1546.464651][T24525] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1546.464665][T24525] RSP: 002b:00000000f542d55c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 1546.464685][T24525] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800000c0 [ 1546.464698][T24525] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 1546.464709][T24525] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1546.464720][T24525] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1546.464732][T24525] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1546.464762][T24525] [ 1547.274439][ T7882] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 1547.279381][ T7898] usb 2-1: USB disconnect, device number 31 [ 1547.463915][ T7882] usb 4-1: Using ep0 maxpacket: 16 [ 1547.477613][ T7882] usb 4-1: New USB device found, idVendor=1004, idProduct=61aa, bcdDevice=4f.75 [ 1547.487077][ T7882] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1547.495245][ T7882] usb 4-1: Product: syz [ 1547.514757][ T7882] usb 4-1: Manufacturer: syz [ 1547.527400][ T7882] usb 4-1: SerialNumber: syz [ 1547.558026][ T7882] usb 4-1: config 0 descriptor?? [ 1547.565640][ T7882] usb 4-1: bad CDC descriptors [ 1547.811696][T24521] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1547.912885][T24538] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1548.125631][T24521] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1548.174526][T24540] fuse: Unknown parameter '00000000000000000000' [ 1549.404174][ T7883] usb 6-1: new high-speed USB device number 63 using dummy_hcd [ 1549.483902][ T7882] usb 2-1: new high-speed USB device number 32 using dummy_hcd [ 1549.558742][ T7900] usb 4-1: USB disconnect, device number 4 [ 1549.578611][ T7883] usb 6-1: Using ep0 maxpacket: 16 [ 1549.587067][ T7883] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1549.620854][ T7883] usb 6-1: New USB device found, idVendor=0458, idProduct=0087, bcdDevice= 0.00 [ 1549.630607][ T7883] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1549.653075][T24556] fuse: Unknown parameter '00000000000000000000' [ 1549.681398][ T7882] usb 2-1: Using ep0 maxpacket: 32 [ 1549.695089][ T7882] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1549.705563][ T7882] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1549.738317][ T7883] usb 6-1: config 0 descriptor?? [ 1549.780596][ T7882] usb 2-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 1549.832280][ T7882] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1549.844519][ T7882] usb 2-1: Product: syz [ 1549.849059][ T7882] usb 2-1: Manufacturer: syz [ 1549.855416][ T7882] usb 2-1: SerialNumber: syz [ 1549.868431][ T7882] usb 2-1: config 0 descriptor?? [ 1550.934389][ T7882] usb 2-1: USB disconnect, device number 32 [ 1551.589378][T24579] fuse: Unknown parameter '00000000000000000000' [ 1551.743079][T24583] netlink: 'syz.6.4428': attribute type 2 has an invalid length. [ 1551.792351][T24583] netlink: 8 bytes leftover after parsing attributes in process `syz.6.4428'. [ 1551.823912][ T30] audit: type=1326 audit(1760519906.993:3229): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24580 comm="syz.6.4428" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf703d539 code=0x7ffc0000 [ 1552.063711][ T30] audit: type=1326 audit(1760519906.993:3230): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24580 comm="syz.6.4428" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf703d539 code=0x7ffc0000 [ 1552.159467][ T30] audit: type=1326 audit(1760519906.993:3231): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24580 comm="syz.6.4428" exe="/root/syz-executor" sig=0 arch=40000003 syscall=5 compat=1 ip=0xf703d539 code=0x7ffc0000 [ 1552.183169][ T7883] usbhid 6-1:0.0: can't add hid device: -71 [ 1552.189302][ T7883] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 1552.250501][ T7883] usb 6-1: USB disconnect, device number 63 [ 1552.678581][ T30] audit: type=1326 audit(1760519906.993:3232): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24580 comm="syz.6.4428" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf703d539 code=0x7ffc0000 [ 1552.700671][ C1] vkms_vblank_simulate: vblank timer overrun [ 1552.751562][ T30] audit: type=1326 audit(1760519906.993:3233): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24580 comm="syz.6.4428" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf703d539 code=0x7ffc0000 [ 1552.899258][ T30] audit: type=1326 audit(1760519906.993:3234): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24580 comm="syz.6.4428" exe="/root/syz-executor" sig=0 arch=40000003 syscall=357 compat=1 ip=0xf703d539 code=0x7ffc0000 [ 1552.968729][T24595] input: syz0 as /devices/virtual/input/input225 [ 1552.987264][T24596] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=2142054965 (4284109930 ns) > initial count (2850433972 ns). Using initial count to start timer. [ 1553.066738][ T30] audit: type=1326 audit(1760519906.993:3235): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24580 comm="syz.6.4428" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf703d539 code=0x7ffc0000 [ 1553.171198][ T30] audit: type=1326 audit(1760519906.993:3236): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24580 comm="syz.6.4428" exe="/root/syz-executor" sig=0 arch=40000003 syscall=357 compat=1 ip=0xf703d539 code=0x7ffc0000 [ 1553.292131][ T30] audit: type=1326 audit(1760519906.993:3237): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24580 comm="syz.6.4428" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf703d539 code=0x7ffc0000 [ 1553.315969][ T30] audit: type=1326 audit(1760519906.993:3238): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24580 comm="syz.6.4428" exe="/root/syz-executor" sig=0 arch=40000003 syscall=357 compat=1 ip=0xf703d539 code=0x7ffc0000 [ 1555.733923][ T7881] usb 7-1: new high-speed USB device number 33 using dummy_hcd [ 1555.931750][ T7881] usb 7-1: Using ep0 maxpacket: 32 [ 1555.950476][ T7881] usb 7-1: config 0 has an invalid interface number: 89 but max is 0 [ 1555.959327][ T7881] usb 7-1: config 0 has no interface number 0 [ 1555.969198][ T7881] usb 7-1: config 0 interface 89 has no altsetting 0 [ 1555.991306][ T7881] usb 7-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4e [ 1556.001758][ T7881] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1556.049959][ T7881] usb 7-1: Product: syz [ 1556.094190][ T7881] usb 7-1: Manufacturer: syz [ 1556.137366][ T7881] usb 7-1: SerialNumber: syz [ 1556.164911][ T7881] usb 7-1: config 0 descriptor?? [ 1556.173546][ T7881] em28xx 7-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 1556.184459][ T7881] em28xx 7-1:0.89: Video interface 89 found: bulk [ 1556.213854][ T7883] usb 2-1: new high-speed USB device number 33 using dummy_hcd [ 1556.374124][ T7883] usb 2-1: Using ep0 maxpacket: 32 [ 1556.638637][ T7883] usb 2-1: config 0 has an invalid interface number: 66 but max is 0 [ 1556.663033][T24642] fuse: Unknown parameter '00000000000000000000' [ 1556.778192][ T7883] usb 2-1: config 0 has no interface number 0 [ 1556.797472][ T7883] usb 2-1: New USB device found, idVendor=0fe9, idProduct=d501, bcdDevice=23.50 [ 1556.809346][ T7883] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1556.817533][ T7883] usb 2-1: Product: syz [ 1556.821769][ T7883] usb 2-1: Manufacturer: syz [ 1556.826493][ T7883] usb 2-1: SerialNumber: syz [ 1556.876903][ T7883] usb 2-1: config 0 descriptor?? [ 1556.888125][ T7883] dvb-usb: found a 'DViCO FusionHDTV5 USB Gold' in warm state. [ 1556.898511][ T7883] dvb-usb: bulk message failed: -22 (2/0) [ 1556.913388][ T7883] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1556.940263][ T7883] dvbdev: DVB: registering new adapter (DViCO FusionHDTV5 USB Gold) [ 1556.957999][ T7883] usb 2-1: media controller created [ 1556.989602][ T7883] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1557.066194][ T7881] em28xx 7-1:0.89: unknown em28xx chip ID (0) [ 1557.093293][ T7883] cxusb: set interface failed [ 1557.099526][T24633] FAULT_INJECTION: forcing a failure. [ 1557.099526][T24633] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1557.194618][T24633] CPU: 1 UID: 0 PID: 24633 Comm: syz.1.4440 Not tainted syzkaller #0 PREEMPT(full) [ 1557.194643][T24633] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1557.194653][T24633] Call Trace: [ 1557.194661][T24633] [ 1557.194669][T24633] dump_stack_lvl+0x189/0x250 [ 1557.194694][T24633] ? __pfx____ratelimit+0x10/0x10 [ 1557.194719][T24633] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1557.194738][T24633] ? __pfx__printk+0x10/0x10 [ 1557.194756][T24633] ? __might_fault+0xb0/0x130 [ 1557.194770][ T7883] dvb-usb: bulk message failed: -22 (1/0) [ 1557.194783][T24633] should_fail_ex+0x414/0x560 [ 1557.194812][T24633] _copy_from_user+0x2d/0xb0 [ 1557.194831][T24633] memdup_user+0x5e/0xd0 [ 1557.194853][T24633] i2cdev_ioctl_rdwr+0x1c6/0x740 [ 1557.194884][T24633] compat_i2cdev_ioctl+0x5a8/0x5c0 [ 1557.194910][T24633] ? __pfx_compat_i2cdev_ioctl+0x10/0x10 [ 1557.194935][T24633] ? __fget_files+0x3a0/0x420 [ 1557.194959][T24633] ? __fget_files+0x2a/0x420 [ 1557.194982][T24633] ? bpf_lsm_file_ioctl_compat+0x9/0x20 [ 1557.195009][T24633] __ia32_compat_sys_ioctl+0x543/0x840 [ 1557.195030][T24633] ? __pfx___ia32_compat_sys_ioctl+0x10/0x10 [ 1557.195048][T24633] ? __fget_files+0x3a0/0x420 [ 1557.195075][T24633] ? fput+0xa0/0xd0 [ 1557.195098][T24633] ? ksys_write+0x22a/0x250 [ 1557.195127][T24633] ? __pfx_ksys_write+0x10/0x10 [ 1557.195148][T24633] ? syscall_enter_from_user_mode_prepare+0x8f/0x110 [ 1557.195169][T24633] ? lockdep_hardirqs_on+0x9c/0x150 [ 1557.195190][T24633] __do_fast_syscall_32+0xb6/0x2b0 [ 1557.195215][T24633] do_fast_syscall_32+0x34/0x80 [ 1557.195234][T24633] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1557.195255][T24633] RIP: 0023:0xf70dd539 [ 1557.195271][T24633] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1557.195287][T24633] RSP: 002b:00000000f54cd55c EFLAGS: 00000206 ORIG_RAX: 0000000000000036 [ 1557.195306][T24633] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000000707 [ 1557.195318][T24633] RDX: 0000000080000380 RSI: 0000000000000000 RDI: 0000000000000000 [ 1557.195330][T24633] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1557.195340][T24633] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1557.195350][T24633] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1557.195377][T24633] [ 1557.537392][T24633] dvb-usb: bulk message failed: -22 (3/0) [ 1557.571929][ T7883] DVB: Unable to find symbol lgdt330x_attach() [ 1557.579547][ T7883] dvb-usb: no frontend was attached by 'DViCO FusionHDTV5 USB Gold' [ 1557.933816][ T7883] rc_core: IR keymap rc-dvico-portable not found [ 1557.944149][ T7883] Registered IR keymap rc-empty [ 1557.957641][ T7883] rc rc0: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.1/usb2/2-1/rc/rc0 [ 1558.007968][ T7883] input: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.1/usb2/2-1/rc/rc0/input226 [ 1558.030452][ T7883] dvb-usb: schedule remote query interval to 100 msecs. [ 1558.063864][ T7883] dvb-usb: DViCO FusionHDTV5 USB Gold successfully initialized and connected. [ 1558.089724][ T7883] usb 2-1: USB disconnect, device number 33 [ 1558.547929][T24653] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1558.564177][ T7883] dvb-usb: DViCO FusionHDTV5 USB Gold successfully deinitialized and disconnected. [ 1558.601300][T24653] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1558.889597][T24665] input: syz0 as /devices/virtual/input/input227 [ 1559.054352][T24668] input: syz0 as /devices/virtual/input/input228 [ 1559.069835][ T7881] em28xx 7-1:0.89: read from i2c device at 0xa0 failed with unknown error (status=145) [ 1559.097049][ T7881] em28xx 7-1:0.89: board has no eeprom [ 1559.359615][T24666] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4446'. [ 1560.224154][ T7881] em28xx 7-1:0.89: Identified as Terratec Grabby (card=67) [ 1560.253812][ T7881] em28xx 7-1:0.89: analog set to bulk mode. [ 1560.310782][ T7883] em28xx 7-1:0.89: Registering V4L2 extension [ 1560.376994][T24678] usb usb4: usbfs: process 24678 (syz.6.4450) did not claim interface 0 before use [ 1560.418116][ T7881] usb 7-1: USB disconnect, device number 33 [ 1560.463907][ T7881] em28xx 7-1:0.89: Disconnecting em28xx [ 1560.492317][ T7883] em28xx 7-1:0.89: Config register raw data: 0xffffffed [ 1560.531556][ T7883] em28xx 7-1:0.89: AC97 chip type couldn't be determined [ 1560.560637][ T7883] em28xx 7-1:0.89: No AC97 audio processor [ 1560.575513][ T7883] usb 7-1: Decoder not found [ 1560.589854][T24684] input: syz0 as /devices/virtual/input/input229 [ 1560.616554][ T7883] em28xx 7-1:0.89: failed to create media graph [ 1560.672924][ T7883] em28xx 7-1:0.89: V4L2 device video103 deregistered [ 1560.681172][T24687] netlink: 1 bytes leftover after parsing attributes in process `syz.5.4451'. [ 1560.692807][T24687] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1560.752426][ T7883] em28xx 7-1:0.89: Registering snapshot button... [ 1560.824350][ T7883] input: em28xx snapshot button as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.89/input/input230 [ 1560.855613][ T7883] em28xx 7-1:0.89: Remote control support is not available for this card. [ 1560.887661][ T7881] em28xx 7-1:0.89: Closing input extension [ 1560.907918][ T7881] em28xx 7-1:0.89: Deregistering snapshot button [ 1561.290194][ T7881] em28xx 7-1:0.89: Freeing device [ 1561.425660][T24700] fuse: Bad value for 'fd' [ 1561.934192][ T7881] usb 7-1: new high-speed USB device number 34 using dummy_hcd [ 1562.294261][ T7881] usb 7-1: Using ep0 maxpacket: 32 [ 1562.311046][ T7881] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1562.324085][ T7881] usb 7-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1562.395987][ T7881] usb 7-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 1562.414498][ T7881] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1562.422705][ T7881] usb 7-1: Product: syz [ 1562.443030][ T7881] usb 7-1: Manufacturer: syz [ 1562.473490][ T7881] usb 7-1: SerialNumber: syz [ 1562.493129][ T7881] usb 7-1: config 0 descriptor?? [ 1562.845619][T24718] fuse: Unknown parameter '00000000000000000000' [ 1562.894536][ T7883] usb 6-1: new high-speed USB device number 64 using dummy_hcd [ 1563.443827][ T7883] usb 6-1: Using ep0 maxpacket: 32 [ 1563.451392][ T7883] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1563.461882][ T7883] usb 6-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1563.478948][ T7883] usb 6-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 1563.492676][ T7883] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1563.522067][ T7883] usb 6-1: config 0 descriptor?? [ 1563.635638][ T7882] usb 7-1: USB disconnect, device number 34 [ 1564.046863][ T7883] hub 6-1:0.0: bad descriptor, ignoring hub [ 1564.070995][ T7883] hub 6-1:0.0: probe with driver hub failed with error -5 [ 1564.490395][T24728] netlink: 28 bytes leftover after parsing attributes in process `syz.6.4458'. [ 1566.226005][ T7883] usb 6-1: USB disconnect, device number 64 [ 1566.414508][ T7900] usb 3-1: new high-speed USB device number 32 using dummy_hcd [ 1566.701969][T24760] fuse: Bad value for 'fd' [ 1566.714318][ T7900] usb 3-1: Using ep0 maxpacket: 32 [ 1567.163554][ T7900] usb 3-1: config 0 has an invalid interface number: 89 but max is 0 [ 1567.179282][ T7900] usb 3-1: config 0 has no interface number 0 [ 1567.265252][ T7900] usb 3-1: config 0 interface 89 has no altsetting 0 [ 1567.298912][ T7900] usb 3-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4e [ 1567.310839][ T7900] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1567.339341][ T7900] usb 3-1: Product: syz [ 1567.349386][ T7900] usb 3-1: Manufacturer: syz [ 1567.364353][ T7900] usb 3-1: SerialNumber: syz [ 1567.385728][T24765] input: syz0 as /devices/virtual/input/input231 [ 1567.440063][ T7900] usb 3-1: config 0 descriptor?? [ 1567.496713][ T7900] em28xx 3-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 1567.745910][ T7900] em28xx 3-1:0.89: Video interface 89 found: bulk [ 1568.175149][ T7900] em28xx 3-1:0.89: unknown em28xx chip ID (0) [ 1568.325501][T24769] netlink: 'syz.1.4468': attribute type 21 has an invalid length. [ 1568.689851][T24772] openvswitch: netlink: Message has 4 unknown bytes. [ 1569.016969][T24737] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1569.026141][T24737] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1569.364390][ T7883] usb 2-1: new high-speed USB device number 34 using dummy_hcd [ 1569.454419][ T7900] em28xx 3-1:0.89: read from i2c device at 0xa0 failed with unknown error (status=145) [ 1569.467365][ T7900] em28xx 3-1:0.89: board has no eeprom [ 1569.523955][ T7883] usb 2-1: Using ep0 maxpacket: 32 [ 1569.543637][ T7883] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x9 has an invalid bInterval 128, changing to 11 [ 1569.557421][ T7883] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 1569.572779][ T7883] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1569.584385][ T7883] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 1569.601129][ T7883] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 1569.621782][ T7883] usb 2-1: New USB device found, idVendor=0e6f, idProduct=582c, bcdDevice=31.68 [ 1569.642802][ T7883] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1569.655091][ T7883] usb 2-1: Product: syz [ 1569.659822][ T7883] usb 2-1: Manufacturer: syz [ 1569.666410][ T7883] usb 2-1: SerialNumber: syz [ 1569.683879][ T7883] usb 2-1: config 0 descriptor?? [ 1569.690293][T24779] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 1569.711088][ T7883] input: Generic X-Box pad as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/input/input232 [ 1569.741562][ T5183] xpad 2-1:0.0: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 1569.775832][ T5183] xpad 2-1:0.0: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 1569.882932][T20458] xpad 2-1:0.0: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 1569.931958][ T5183] xpad 2-1:0.0: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 1570.095966][ C0] xpad 2-1:0.0: xpad_irq_in - usb_submit_urb failed with result -1 [ 1570.193943][T24779] xpad 2-1:0.0: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 1570.251488][T24793] netlink: 'syz.3.4474': attribute type 22 has an invalid length. [ 1570.320389][ T5183] xpad 2-1:0.0: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 1570.331851][ T5183] xpad 2-1:0.0: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 1570.445738][ T5183] xpad 2-1:0.0: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 1570.474781][ T7900] em28xx 3-1:0.89: Identified as Terratec Grabby (card=67) [ 1570.482124][ T7900] em28xx 3-1:0.89: analog set to bulk mode. [ 1570.501415][ T7898] em28xx 3-1:0.89: Registering V4L2 extension [ 1570.533132][ T7900] usb 3-1: USB disconnect, device number 32 [ 1570.539663][ T5880] usb 6-1: new high-speed USB device number 65 using dummy_hcd [ 1570.567719][ T7900] em28xx 3-1:0.89: Disconnecting em28xx [ 1570.710578][ T7898] em28xx 3-1:0.89: Config register raw data: 0xffffffed [ 1570.719732][ T5880] usb 6-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 1570.746702][ T5880] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1570.757674][ T7898] em28xx 3-1:0.89: AC97 chip type couldn't be determined [ 1570.775130][ T5880] usb 6-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 1570.799686][ T5880] usb 6-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 1570.819660][ T7898] em28xx 3-1:0.89: No AC97 audio processor [ 1570.840459][ T7898] usb 3-1: Decoder not found [ 1570.848454][ T5880] usb 6-1: Product: syz [ 1570.857969][ T7898] em28xx 3-1:0.89: failed to create media graph [ 1570.864981][ T5880] usb 6-1: Manufacturer: syz [ 1570.869646][ T5880] usb 6-1: SerialNumber: syz [ 1570.878043][ T7901] usb 2-1: USB disconnect, device number 34 [ 1570.895104][ T7898] em28xx 3-1:0.89: V4L2 device video103 deregistered [ 1570.912873][ T5880] usb 6-1: config 0 descriptor?? [ 1570.926816][ T7898] em28xx 3-1:0.89: Registering snapshot button... [ 1570.949963][ T5880] usb 6-1: selecting invalid altsetting 0 [ 1570.961651][ T7898] input: em28xx snapshot button as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.89/input/input233 [ 1571.001515][ T7898] em28xx 3-1:0.89: Remote control support is not available for this card. [ 1571.031311][ T7900] em28xx 3-1:0.89: Closing input extension [ 1571.075309][ T7900] em28xx 3-1:0.89: Deregistering snapshot button [ 1571.140589][ T7900] em28xx 3-1:0.89: Freeing device [ 1571.327771][T24809] netlink: 28 bytes leftover after parsing attributes in process `syz.6.4476'. [ 1571.534139][ T7900] usb 3-1: new high-speed USB device number 33 using dummy_hcd [ 1571.760172][ T7900] usb 3-1: New USB device found, idVendor=055f, idProduct=c230, bcdDevice=b6.ac [ 1571.994670][ T7900] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1572.074111][ T7900] usb 3-1: Product: syz [ 1572.136370][ T7900] usb 3-1: Manufacturer: syz [ 1572.141045][ T7900] usb 3-1: SerialNumber: syz [ 1572.164490][ T7900] usb 3-1: config 0 descriptor?? [ 1572.191586][ T7900] gspca_main: sunplus-2.14.0 probing 055f:c230 [ 1572.761434][T24798] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1572.770787][T24798] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1572.838675][ T7900] gspca_sunplus: reg_r err -71 [ 1572.858716][ T7900] sunplus 3-1:0.0: probe with driver sunplus failed with error -71 [ 1572.972278][ T7900] usb 3-1: USB disconnect, device number 33 [ 1573.095950][T24825] fuse: Unknown parameter '00000000000000000000' [ 1573.140319][ T7881] usb 6-1: USB disconnect, device number 65 [ 1574.061989][T24841] netlink: 36 bytes leftover after parsing attributes in process `syz.5.4483'. [ 1574.248812][T24844] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 1574.545373][T24841] fuse: Bad value for 'fd' [ 1575.844128][ T7881] usb 6-1: new high-speed USB device number 66 using dummy_hcd [ 1575.890434][T24857] fuse: Unknown parameter 'group_id00000000000000000000' [ 1576.007694][ T7881] usb 6-1: New USB device found, idVendor=2304, idProduct=023e, bcdDevice=d7.69 [ 1576.016922][ T7881] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1576.031546][ T7881] usb 6-1: Product: syz [ 1576.035991][ T7881] usb 6-1: Manufacturer: syz [ 1576.040651][ T7881] usb 6-1: SerialNumber: syz [ 1576.052107][ T7881] usb 6-1: config 0 descriptor?? [ 1576.064182][ T7881] hub 6-1:0.0: bad descriptor, ignoring hub [ 1576.070134][ T7881] hub 6-1:0.0: probe with driver hub failed with error -5 [ 1576.367963][T24868] netlink: 1 bytes leftover after parsing attributes in process `syz.1.4491'. [ 1576.377372][T24868] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1576.437899][T24871] netlink: 28 bytes leftover after parsing attributes in process `syz.6.4492'. [ 1576.506463][T24873] netlink: 12 bytes leftover after parsing attributes in process `syz.5.4487'. [ 1578.226860][T24891] fuse: Unknown parameter '00000000000000000000' [ 1578.808667][T24895] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4497'. [ 1579.476212][T24905] netlink: 36 bytes leftover after parsing attributes in process `syz.3.4498'. [ 1579.519261][T24905] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 1579.534190][T24905] fuse: Bad value for 'fd' [ 1579.908064][ T7881] dvb-usb: found a 'Pinnacle PCTV Hybrid Stick Solo' in cold state, will try to load a firmware [ 1580.372831][ T7881] dvb-usb: downloading firmware from file 'dvb-usb-dib0700-1.20.fw' [ 1580.426349][ T7881] dib0700: firmware download failed at 7 with -22 [ 1580.457856][T24916] fuse: Bad value for 'user_id' [ 1580.479437][T24916] fuse: Bad value for 'user_id' [ 1580.490201][ T7881] usb 6-1: USB disconnect, device number 66 [ 1581.039383][T24922] input: syz0 as /devices/virtual/input/input234 [ 1581.289096][T24928] input: syz0 as /devices/virtual/input/input235 [ 1581.650183][T24938] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4504'. [ 1581.709039][T24939] input: syz0 as /devices/virtual/input/input236 [ 1583.153288][T24946] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4508'. [ 1583.325908][T24955] fuse: Bad value for 'user_id' [ 1583.330884][T24955] fuse: Bad value for 'user_id' [ 1583.988825][ T7900] usb 3-1: new high-speed USB device number 34 using dummy_hcd [ 1584.073924][ T7881] usb 2-1: new high-speed USB device number 35 using dummy_hcd [ 1584.176920][ T7900] usb 3-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 1584.188105][ T7900] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1584.202472][ T7900] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1584.231601][ T7900] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 1584.259178][ T7900] usb 3-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 1584.269313][ T7900] usb 3-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 1584.278352][ T7900] usb 3-1: Manufacturer: syz [ 1584.348392][ T7881] usb 2-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 1584.357578][ T7881] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1584.365637][ T7881] usb 2-1: Product: syz [ 1584.369866][ T7881] usb 2-1: Manufacturer: syz [ 1584.378413][ T7900] usb 3-1: config 0 descriptor?? [ 1584.387860][ T7881] usb 2-1: SerialNumber: syz [ 1584.612676][T24967] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4514'. [ 1584.627208][T24967] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4514'. [ 1584.639616][ T7881] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPROTO [ 1584.657265][ T7881] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): lan78xx_setup_irq_domain() failed : -71 [ 1584.673319][ T7881] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 1584.781694][ T7881] lan78xx 2-1:1.0: probe with driver lan78xx failed with error -71 [ 1584.809498][ T7900] appleir 0003:05AC:8243.0046: unknown main item tag 0x0 [ 1584.822719][ T7900] appleir 0003:05AC:8243.0046: hiddev0,hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.2-1/input0 [ 1584.850805][ T7881] usb 2-1: USB disconnect, device number 35 [ 1585.403337][ T7901] usb 3-1: USB disconnect, device number 34 [ 1585.842355][T24983] netlink: 36 bytes leftover after parsing attributes in process `syz.1.4516'. [ 1585.899656][T24983] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 1585.937825][T24983] fuse: Bad value for 'fd' [ 1586.802108][T24993] fuse: Unknown parameter '0x0000000000000007' [ 1587.421313][T24986] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=2142054965 (4284109930 ns) > initial count (2850433972 ns). Using initial count to start timer. [ 1587.524371][T25004] input: syz0 as /devices/virtual/input/input237 [ 1588.046949][ T7882] usb 6-1: new high-speed USB device number 67 using dummy_hcd [ 1588.118344][ T7883] usb 7-1: new high-speed USB device number 35 using dummy_hcd [ 1588.204808][ T7882] usb 6-1: Using ep0 maxpacket: 32 [ 1588.211428][ T7882] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1588.221935][ T7882] usb 6-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1588.259046][ T7882] usb 6-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 1588.270219][ T7882] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1588.280776][ T7882] usb 6-1: Product: syz [ 1588.287993][ T7882] usb 6-1: Manufacturer: syz [ 1588.294274][ T7883] usb 7-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 1588.305579][ T7883] usb 7-1: config 0 interface 0 has no altsetting 0 [ 1588.315571][ T7882] usb 6-1: SerialNumber: syz [ 1588.321311][ T7883] usb 7-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 1588.330923][ T7883] usb 7-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 1588.353245][ T7882] usb 6-1: config 0 descriptor?? [ 1588.364303][ T7883] usb 7-1: Product: syz [ 1588.368489][ T7883] usb 7-1: Manufacturer: syz [ 1588.383297][ T7883] usb 7-1: SerialNumber: syz [ 1588.434032][ T7883] usb 7-1: config 0 descriptor?? [ 1588.461111][ T7883] usb 7-1: selecting invalid altsetting 0 [ 1588.717207][ T5880] usb 7-1: USB disconnect, device number 35 [ 1589.709978][ T5880] usb 7-1: new high-speed USB device number 36 using dummy_hcd [ 1589.844725][ T7882] usb 6-1: USB disconnect, device number 67 [ 1589.935739][ T5880] usb 7-1: device descriptor read/64, error -71 [ 1590.136770][ T7898] usb 2-1: new high-speed USB device number 36 using dummy_hcd [ 1590.184347][ T5880] usb 7-1: new high-speed USB device number 37 using dummy_hcd [ 1590.294372][ T7898] usb 2-1: Using ep0 maxpacket: 32 [ 1590.301315][ T7898] usb 2-1: config 0 has an invalid interface number: 89 but max is 0 [ 1590.310249][ T7898] usb 2-1: config 0 has no interface number 0 [ 1590.317244][ T5880] usb 7-1: device descriptor read/64, error -71 [ 1590.324241][ T7882] usb 3-1: new high-speed USB device number 35 using dummy_hcd [ 1590.324696][ T7898] usb 2-1: config 0 interface 89 has no altsetting 0 [ 1590.453312][ T5880] usb usb7-port1: attempt power cycle [ 1590.467492][ T7898] usb 2-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4e [ 1590.478159][ T7898] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1590.486682][ T7898] usb 2-1: Product: syz [ 1590.496899][ T7898] usb 2-1: Manufacturer: syz [ 1590.504324][ T7900] usb 6-1: new high-speed USB device number 68 using dummy_hcd [ 1590.515876][ T7898] usb 2-1: SerialNumber: syz [ 1590.529888][ T7898] usb 2-1: config 0 descriptor?? [ 1590.534272][ T7882] usb 3-1: New USB device found, idVendor=2304, idProduct=023e, bcdDevice=d7.69 [ 1590.547542][ T7898] em28xx 2-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 1590.560709][ T7882] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1590.564384][ T7898] em28xx 2-1:0.89: Video interface 89 found: bulk [ 1590.576625][ T7882] usb 3-1: Product: syz [ 1590.581030][ T7882] usb 3-1: Manufacturer: syz [ 1590.592074][ T7882] usb 3-1: SerialNumber: syz [ 1590.610102][ T7882] usb 3-1: config 0 descriptor?? [ 1590.621559][ T7882] hub 3-1:0.0: bad descriptor, ignoring hub [ 1590.628457][ T7882] hub 3-1:0.0: probe with driver hub failed with error -5 [ 1590.661160][ T7900] usb 6-1: New USB device found, idVendor=16ca, idProduct=1502, bcdDevice=a9.25 [ 1590.670723][ T7900] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1590.685677][ T7900] usb 6-1: Product: syz [ 1590.692980][ T7900] usb 6-1: Manufacturer: syz [ 1590.702061][ T7900] usb 6-1: SerialNumber: syz [ 1590.723162][ T7900] usb 6-1: config 0 descriptor?? [ 1590.794730][ T5880] usb 7-1: new high-speed USB device number 38 using dummy_hcd [ 1590.827595][ T5880] usb 7-1: device descriptor read/8, error -71 [ 1590.962119][ T7883] usb 6-1: USB disconnect, device number 68 [ 1591.010831][T25045] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4530'. [ 1591.175775][ T7898] em28xx 2-1:0.89: unknown em28xx chip ID (0) [ 1591.395569][T25050] netlink: 1 bytes leftover after parsing attributes in process `syz.6.4533'. [ 1591.405632][T25050] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1591.744152][T25054] netlink: 1 bytes leftover after parsing attributes in process `syz.3.4534'. [ 1591.753293][T25054] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1592.214003][T25060] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1592.428566][T25060] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1593.354314][ T7898] em28xx 2-1:0.89: read from i2c device at 0xa0 failed with unknown error (status=145) [ 1593.374702][ T7898] em28xx 2-1:0.89: board has no eeprom [ 1593.578764][ T7882] dvb-usb: found a 'Pinnacle PCTV Hybrid Stick Solo' in cold state, will try to load a firmware [ 1593.648793][ T7882] dvb-usb: downloading firmware from file 'dvb-usb-dib0700-1.20.fw' [ 1593.702362][ T7882] dib0700: firmware download failed at 7 with -22 [ 1593.797203][T25069] fuse: Unknown parameter '0x0000000000000007' [ 1593.894566][ T7882] usb 3-1: USB disconnect, device number 35 [ 1594.344411][ T7898] em28xx 2-1:0.89: Identified as Terratec Grabby (card=67) [ 1594.351773][ T7898] em28xx 2-1:0.89: analog set to bulk mode. [ 1594.358468][ T5880] em28xx 2-1:0.89: Registering V4L2 extension [ 1594.394748][ T7898] usb 2-1: USB disconnect, device number 36 [ 1594.496087][ T7898] em28xx 2-1:0.89: Disconnecting em28xx [ 1594.517313][ T5880] em28xx 2-1:0.89: Config register raw data: 0xffffffed [ 1594.538289][ T5880] em28xx 2-1:0.89: AC97 chip type couldn't be determined [ 1594.632635][ T5880] em28xx 2-1:0.89: No AC97 audio processor [ 1594.671739][ T5880] usb 2-1: Decoder not found [ 1594.688203][ T5880] em28xx 2-1:0.89: failed to create media graph [ 1594.732856][ T5880] em28xx 2-1:0.89: V4L2 device video103 deregistered [ 1594.850584][ T5880] em28xx 2-1:0.89: Registering snapshot button... [ 1594.891876][ T5880] input: em28xx snapshot button as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.89/input/input238 [ 1594.906136][ T5880] em28xx 2-1:0.89: Remote control support is not available for this card. [ 1594.915810][ T7898] em28xx 2-1:0.89: Closing input extension [ 1594.921751][ T7898] em28xx 2-1:0.89: Deregistering snapshot button [ 1594.950911][ T7898] em28xx 2-1:0.89: Freeing device [ 1595.244181][ T7898] usb 2-1: new high-speed USB device number 37 using dummy_hcd [ 1595.350448][T25085] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4540'. [ 1595.438141][ T7898] usb 2-1: Using ep0 maxpacket: 32 [ 1595.592989][ T7898] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1595.604575][ T7898] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1595.632358][ T7898] usb 2-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 1595.807924][ T5880] IPVS: starting estimator thread 0... [ 1595.817994][ T7898] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1595.832260][ T7898] usb 2-1: Product: syz [ 1595.889041][ T7898] usb 2-1: Manufacturer: syz [ 1595.904744][T25095] IPVS: using max 28 ests per chain, 67200 per kthread [ 1595.950291][ T7898] usb 2-1: SerialNumber: syz [ 1595.961746][ T7898] usb 2-1: config 0 descriptor?? [ 1596.039541][T25099] input: syz0 as /devices/virtual/input/input239 [ 1597.338674][ T5880] usb 2-1: USB disconnect, device number 37 [ 1597.615092][T25123] netlink: 1 bytes leftover after parsing attributes in process `syz.1.4547'. [ 1597.624249][T25123] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1598.204446][ T5880] usb 3-1: new high-speed USB device number 36 using dummy_hcd [ 1598.434233][ T5880] usb 3-1: Using ep0 maxpacket: 32 [ 1598.440694][ T5880] usb 3-1: config 0 has an invalid interface number: 89 but max is 0 [ 1598.449197][ T5880] usb 3-1: config 0 has no interface number 0 [ 1598.459467][ T5880] usb 3-1: config 0 interface 89 has no altsetting 0 [ 1598.487022][ T5880] usb 3-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4e [ 1598.497290][ T5880] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1598.514474][ T5880] usb 3-1: Product: syz [ 1598.550560][ T5880] usb 3-1: Manufacturer: syz [ 1598.575501][ T5880] usb 3-1: SerialNumber: syz [ 1598.601370][ T5880] usb 3-1: config 0 descriptor?? [ 1598.696524][ T5880] em28xx 3-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 1598.729057][ T5880] em28xx 3-1:0.89: Video interface 89 found: bulk [ 1598.747718][T25134] FAULT_INJECTION: forcing a failure. [ 1598.747718][T25134] name failslab, interval 1, probability 0, space 0, times 0 [ 1598.761019][T25134] CPU: 0 UID: 0 PID: 25134 Comm: syz.3.4550 Not tainted syzkaller #0 PREEMPT(full) [ 1598.761044][T25134] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1598.761054][T25134] Call Trace: [ 1598.761061][T25134] [ 1598.761069][T25134] dump_stack_lvl+0x189/0x250 [ 1598.761092][T25134] ? __pfx____ratelimit+0x10/0x10 [ 1598.761118][T25134] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1598.761135][T25134] ? __pfx__printk+0x10/0x10 [ 1598.761162][T25134] should_fail_ex+0x414/0x560 [ 1598.761192][T25134] should_failslab+0xa8/0x100 [ 1598.761217][T25134] __kmalloc_cache_noprof+0x6f/0x6f0 [ 1598.761237][T25134] ? __hw_addr_add_ex+0x1f4/0x770 [ 1598.761250][T25134] ? do_raw_spin_lock+0x121/0x290 [ 1598.761272][T25134] __hw_addr_add_ex+0x1f4/0x770 [ 1598.761296][T25134] dev_mc_add+0xa1/0x120 [ 1598.761317][T25134] garp_init_applicant+0x1a9/0x450 [ 1598.761341][T25134] register_vlan_dev+0x225/0x800 [ 1598.761370][T25134] vlan_newlink+0x4b2/0x610 [ 1598.761396][T25134] ? __pfx_vlan_newlink+0x10/0x10 [ 1598.761421][T25134] rtnl_newlink_create+0x310/0xb00 [ 1598.761450][T25134] ? __lock_acquire+0xab9/0xd20 [ 1598.761477][T25134] ? __pfx_rtnl_newlink_create+0x10/0x10 [ 1598.761503][T25134] ? __pfx___mutex_lock+0x10/0x10 [ 1598.761533][T25134] ? ns_capable+0x8a/0xf0 [ 1598.761560][T25134] rtnl_newlink+0x16e4/0x1c80 [ 1598.761583][T25134] ? netlink_deliver_tap+0x19c/0x1b0 [ 1598.761616][T25134] ? __pfx_rtnl_newlink+0x10/0x10 [ 1598.761663][T25134] ? kasan_quarantine_put+0xdd/0x220 [ 1598.761690][T25134] ? lockdep_hardirqs_on+0x9c/0x150 [ 1598.761714][T25134] ? nlmon_xmit+0xb0/0x100 [ 1598.761734][T25134] ? kmem_cache_free+0x19b/0x690 [ 1598.761765][T25134] ? __local_bh_enable_ip+0x12d/0x1c0 [ 1598.761788][T25134] ? lockdep_hardirqs_on+0x9c/0x150 [ 1598.761806][T25134] ? __local_bh_enable_ip+0x12d/0x1c0 [ 1598.761827][T25134] ? __pfx___local_bh_enable_ip+0x10/0x10 [ 1598.761855][T25134] ? __dev_queue_xmit+0x27b/0x3b50 [ 1598.761874][T25134] ? __dev_queue_xmit+0x27b/0x3b50 [ 1598.761891][T25134] ? __dev_queue_xmit+0x27b/0x3b50 [ 1598.761911][T25134] ? __dev_queue_xmit+0x1d79/0x3b50 [ 1598.761928][T25134] ? kasan_save_track+0x3e/0x80 [ 1598.761945][T25134] ? __kasan_slab_alloc+0x6c/0x80 [ 1598.761968][T25134] ? __lock_acquire+0xab9/0xd20 [ 1598.762012][T25134] ? __pfx_rtnl_newlink+0x10/0x10 [ 1598.762035][T25134] rtnetlink_rcv_msg+0x7cf/0xb70 [ 1598.762063][T25134] ? rtnetlink_rcv_msg+0x1ab/0xb70 [ 1598.762085][T25134] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1598.762107][T25134] ? ref_tracker_free+0x63a/0x7d0 [ 1598.762127][T25134] ? __asan_memcpy+0x40/0x70 [ 1598.762143][T25134] ? __pfx_ref_tracker_free+0x10/0x10 [ 1598.762159][T25134] ? __skb_clone+0x63/0x7a0 [ 1598.762184][T25134] netlink_rcv_skb+0x208/0x470 [ 1598.762208][T25134] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1598.762238][T25134] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1598.762273][T25134] ? netlink_deliver_tap+0x2e/0x1b0 [ 1598.762306][T25134] netlink_unicast+0x82f/0x9e0 [ 1598.762339][T25134] ? __pfx_netlink_unicast+0x10/0x10 [ 1598.762360][T25134] ? netlink_sendmsg+0x642/0xb30 [ 1598.762383][T25134] ? skb_put+0x11b/0x210 [ 1598.762410][T25134] netlink_sendmsg+0x805/0xb30 [ 1598.762442][T25134] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1598.762470][T25134] ? __import_iovec+0x5d4/0x7f0 [ 1598.762491][T25134] ? aa_sock_msg_perm+0xf1/0x1d0 [ 1598.762512][T25134] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1598.762534][T25134] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1598.762558][T25134] __sock_sendmsg+0x21c/0x270 [ 1598.762580][T25134] ____sys_sendmsg+0x505/0x830 [ 1598.762611][T25134] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1598.762652][T25134] ___sys_sendmsg+0x21f/0x2a0 [ 1598.762673][T25134] ? __pfx____sys_sendmsg+0x10/0x10 [ 1598.762737][T25134] ? __fget_files+0x2a/0x420 [ 1598.762758][T25134] ? __fget_files+0x3a0/0x420 [ 1598.762791][T25134] __sys_sendmsg+0x164/0x220 [ 1598.762812][T25134] ? __pfx___sys_sendmsg+0x10/0x10 [ 1598.762848][T25134] ? __pfx_ksys_write+0x10/0x10 [ 1598.762872][T25134] ? syscall_enter_from_user_mode_prepare+0x8f/0x110 [ 1598.762893][T25134] ? lockdep_hardirqs_on+0x9c/0x150 [ 1598.762915][T25134] __do_fast_syscall_32+0xb6/0x2b0 [ 1598.762937][T25134] ? lockdep_hardirqs_on+0x9c/0x150 [ 1598.762959][T25134] do_fast_syscall_32+0x34/0x80 [ 1598.762980][T25134] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1598.763002][T25134] RIP: 0023:0xf709d539 [ 1598.763019][T25134] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1598.763035][T25134] RSP: 002b:00000000f548d55c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 1598.763055][T25134] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000280 [ 1598.763068][T25134] RDX: 0000000008000002 RSI: 0000000000000000 RDI: 0000000000000000 [ 1598.763080][T25134] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1598.763092][T25134] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1598.763103][T25134] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1598.763134][T25134] [ 1599.243508][ C0] vkms_vblank_simulate: vblank timer overrun [ 1599.663658][ T5880] em28xx 3-1:0.89: unknown em28xx chip ID (0) [ 1600.051124][T25156] input: syz0 as /devices/virtual/input/input240 [ 1600.481575][T25160] fuse: Unknown parameter '0x0000000000000007' [ 1600.855753][T25128] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1600.866471][T25128] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1601.107141][T25164] dvmrp0: entered allmulticast mode [ 1601.328237][ T5880] em28xx 3-1:0.89: read from i2c device at 0xa0 failed with unknown error (status=145) [ 1601.338552][ T5880] em28xx 3-1:0.89: board has no eeprom [ 1601.681127][T25172] input: syz0 as /devices/virtual/input/input241 [ 1602.004508][ T7901] usb 7-1: new high-speed USB device number 40 using dummy_hcd [ 1602.206982][ T7901] usb 7-1: Using ep0 maxpacket: 32 [ 1602.213556][ T5880] em28xx 3-1:0.89: Identified as Terratec Grabby (card=67) [ 1602.236741][ T5880] em28xx 3-1:0.89: analog set to bulk mode. [ 1602.245521][ T7901] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1602.258023][ T7901] usb 7-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1602.276115][ T7900] em28xx 3-1:0.89: Registering V4L2 extension [ 1602.288118][ T5880] usb 3-1: USB disconnect, device number 36 [ 1602.304748][ T7901] usb 7-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 1602.320331][ T5880] em28xx 3-1:0.89: Disconnecting em28xx [ 1602.332285][ T7901] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1602.357481][ T7901] usb 7-1: Product: syz [ 1602.371942][ T7901] usb 7-1: Manufacturer: syz [ 1602.447745][ T7901] usb 7-1: SerialNumber: syz [ 1602.455308][ T7901] usb 7-1: config 0 descriptor?? [ 1602.685535][ T7900] em28xx 3-1:0.89: Config register raw data: 0xffffffed [ 1602.692587][ T7900] em28xx 3-1:0.89: AC97 chip type couldn't be determined [ 1602.830945][ T7900] em28xx 3-1:0.89: No AC97 audio processor [ 1602.908386][T25187] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4560'. [ 1602.952836][ T7900] usb 3-1: Decoder not found [ 1602.958969][ T7900] em28xx 3-1:0.89: failed to create media graph [ 1603.052229][ T7900] em28xx 3-1:0.89: V4L2 device video103 deregistered [ 1603.089510][ T7900] em28xx 3-1:0.89: Registering snapshot button... [ 1603.170568][ T7900] input: em28xx snapshot button as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.89/input/input242 [ 1603.233914][ T7900] em28xx 3-1:0.89: Remote control support is not available for this card. [ 1603.342572][ T5880] em28xx 3-1:0.89: Closing input extension [ 1603.366816][ T5880] em28xx 3-1:0.89: Deregistering snapshot button [ 1603.438157][ T5880] em28xx 3-1:0.89: Freeing device [ 1603.460002][ T7879] usb 7-1: USB disconnect, device number 40 [ 1603.817311][T25200] fuse: Bad value for 'fd' [ 1603.894742][ T7900] usb 6-1: new high-speed USB device number 69 using dummy_hcd [ 1604.135724][T25210] input: syz0 as /devices/virtual/input/input243 [ 1604.175084][ T7900] usb 6-1: Using ep0 maxpacket: 32 [ 1604.274423][ T5880] usb 3-1: new high-speed USB device number 37 using dummy_hcd [ 1604.306891][ T7900] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1604.322480][ T7900] usb 6-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1604.336979][ T7900] usb 6-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 1604.359887][ T7900] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1604.422053][ T7900] usb 6-1: config 0 descriptor?? [ 1604.436380][ T7900] hub 6-1:0.0: bad descriptor, ignoring hub [ 1604.447542][ T7900] hub 6-1:0.0: probe with driver hub failed with error -5 [ 1604.461327][ T7900] usbhid 6-1:0.0: couldn't find an input interrupt endpoint [ 1604.471176][ T5880] usb 3-1: Using ep0 maxpacket: 32 [ 1604.479826][ T5880] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1604.496389][ T5880] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1604.522837][T25215] input: syz0 as /devices/virtual/input/input244 [ 1604.545142][ T5880] usb 3-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 1604.563195][ T5880] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1604.602226][ T5880] usb 3-1: config 0 descriptor?? [ 1604.612172][ T5880] hub 3-1:0.0: bad descriptor, ignoring hub [ 1604.626415][ T5880] hub 3-1:0.0: probe with driver hub failed with error -5 [ 1604.757005][T25219] fuse: Unknown parameter 'fd0x0000000000000007' [ 1604.822541][ T5880] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 1606.269241][T25227] input: syz0 as /devices/virtual/input/input245 [ 1606.435007][T15751] usb 2-1: new high-speed USB device number 38 using dummy_hcd [ 1606.512024][T25235] FAULT_INJECTION: forcing a failure. [ 1606.512024][T25235] name failslab, interval 1, probability 0, space 0, times 0 [ 1606.536572][T25235] CPU: 1 UID: 0 PID: 25235 Comm: syz.3.4573 Not tainted syzkaller #0 PREEMPT(full) [ 1606.536599][T25235] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1606.536611][T25235] Call Trace: [ 1606.536619][T25235] [ 1606.536628][T25235] dump_stack_lvl+0x189/0x250 [ 1606.536654][T25235] ? __pfx____ratelimit+0x10/0x10 [ 1606.536682][T25235] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1606.536701][T25235] ? __pfx__printk+0x10/0x10 [ 1606.536733][T25235] ? __pfx___might_resched+0x10/0x10 [ 1606.536757][T25235] ? fs_reclaim_acquire+0x7d/0x100 [ 1606.536783][T25235] should_fail_ex+0x414/0x560 [ 1606.536821][T25235] should_failslab+0xa8/0x100 [ 1606.536846][T25235] kmem_cache_alloc_node_noprof+0x77/0x710 [ 1606.536866][T25235] ? __alloc_skb+0x112/0x2d0 [ 1606.536896][T25235] __alloc_skb+0x112/0x2d0 [ 1606.536924][T25235] rtmsg_fib+0xea/0x4c0 [ 1606.536951][T25235] ? fib_find_node+0x2b0/0x2f0 [ 1606.536973][T25235] fib_table_delete+0xca9/0xf80 [ 1606.537020][T25235] ? __pfx_fib_table_delete+0x10/0x10 [ 1606.537046][T25235] ? l3mdev_fib_table+0x18/0x160 [ 1606.537069][T25235] ? fib_new_table+0x10a/0x2d0 [ 1606.537094][T25235] fib_magic+0x2e4/0x390 [ 1606.537122][T25235] ? __pfx_fib_magic+0x10/0x10 [ 1606.537158][T25235] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 1606.537185][T25235] ? __pfx_queue_work_on+0x10/0x10 [ 1606.537217][T25235] fib_del_ifaddr+0xfe3/0x1480 [ 1606.537238][T25235] ? __pfx_preempt_schedule_notrace+0x10/0x10 [ 1606.537260][T25235] ? inetaddr_event+0xe3/0x140 [ 1606.537285][T25235] ? preempt_schedule_notrace_thunk+0x16/0x30 [ 1606.537319][T25235] fib_inetaddr_event+0xbb/0x190 [ 1606.537347][T25235] notifier_call_chain+0x1b6/0x3e0 [ 1606.537380][T25235] blocking_notifier_call_chain+0x6a/0x90 [ 1606.537408][T25235] __inet_del_ifa+0x87d/0x1040 [ 1606.537447][T25235] inetdev_event+0x632/0x15b0 [ 1606.537475][T25235] ? __pfx_inetdev_event+0x10/0x10 [ 1606.537507][T25235] notifier_call_chain+0x1b6/0x3e0 [ 1606.537540][T25235] netif_set_mtu_ext+0x594/0x7d0 [ 1606.537572][T25235] ? __pfx_netif_set_mtu_ext+0x10/0x10 [ 1606.537596][T25235] ? __mutex_trylock_common+0x153/0x260 [ 1606.537625][T25235] ? __pfx___mutex_trylock_common+0x10/0x10 [ 1606.537655][T25235] ? rcu_is_watching+0x15/0xb0 [ 1606.537680][T25235] ? trace_contention_end+0x39/0x120 [ 1606.537728][T25235] netif_set_mtu+0xa4/0x150 [ 1606.537754][T25235] ? __pfx_netif_set_mtu+0x10/0x10 [ 1606.537775][T25235] ? __lock_acquire+0xab9/0xd20 [ 1606.537810][T25235] ? netdev_name_node_lookup+0xdf/0x120 [ 1606.537839][T25235] dev_set_mtu+0x126/0x260 [ 1606.537868][T25235] dev_ioctl+0x7b4/0x1150 [ 1606.537896][T25235] sock_do_ioctl+0x22c/0x300 [ 1606.537921][T25235] ? __pfx_sock_do_ioctl+0x10/0x10 [ 1606.537948][T25235] ? pppox_ioctl+0x247/0x300 [ 1606.537969][T25235] ? pppox_ioctl+0x247/0x300 [ 1606.537992][T25235] compat_sock_ioctl+0xb8d/0xc80 [ 1606.538019][T25235] ? __pfx_compat_sock_ioctl+0x10/0x10 [ 1606.538043][T25235] ? __fget_files+0x3a0/0x420 [ 1606.538064][T25235] ? __fget_files+0x2a/0x420 [ 1606.538089][T25235] ? bpf_lsm_file_ioctl_compat+0x9/0x20 [ 1606.538117][T25235] __ia32_compat_sys_ioctl+0x543/0x840 [ 1606.538139][T25235] ? __pfx___ia32_compat_sys_ioctl+0x10/0x10 [ 1606.538157][T25235] ? __fget_files+0x3a0/0x420 [ 1606.538185][T25235] ? fput+0xa0/0xd0 [ 1606.538209][T25235] ? ksys_write+0x22a/0x250 [ 1606.538225][T25235] ? exc_page_fault+0x82/0x100 [ 1606.538244][T25235] ? __pfx_ksys_write+0x10/0x10 [ 1606.538265][T25235] ? syscall_enter_from_user_mode_prepare+0x8f/0x110 [ 1606.538282][T25235] ? lockdep_hardirqs_on+0x9c/0x150 [ 1606.538304][T25235] __do_fast_syscall_32+0xb6/0x2b0 [ 1606.538323][T25235] ? lockdep_hardirqs_on+0x9c/0x150 [ 1606.538344][T25235] do_fast_syscall_32+0x34/0x80 [ 1606.538363][T25235] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1606.538384][T25235] RIP: 0023:0xf709d539 [ 1606.538402][T25235] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1606.538418][T25235] RSP: 002b:00000000f548d55c EFLAGS: 00000206 ORIG_RAX: 0000000000000036 [ 1606.538439][T25235] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000008922 [ 1606.538452][T25235] RDX: 0000000080003e40 RSI: 0000000000000000 RDI: 0000000000000000 [ 1606.538464][T25235] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1606.538475][T25235] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1606.538487][T25235] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1606.538517][T25235] [ 1607.097972][T15751] usb 2-1: Using ep0 maxpacket: 32 [ 1607.106900][T15751] usb 2-1: config 0 has an invalid interface number: 89 but max is 0 [ 1607.115383][T15751] usb 2-1: config 0 has no interface number 0 [ 1607.121476][T15751] usb 2-1: config 0 interface 89 has no altsetting 0 [ 1607.136015][T15751] usb 2-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4e [ 1607.145409][T15751] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1607.153390][T15751] usb 2-1: Product: syz [ 1607.154252][ T7883] usb 6-1: USB disconnect, device number 69 [ 1607.158363][T15751] usb 2-1: Manufacturer: syz [ 1607.168359][T15751] usb 2-1: SerialNumber: syz [ 1607.193431][T15751] usb 2-1: config 0 descriptor?? [ 1607.206955][T15751] em28xx 2-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 1607.217756][T15751] em28xx 2-1:0.89: Video interface 89 found: bulk [ 1607.290580][ T1303] ieee802154 phy0 wpan0: encryption failed: -22 [ 1607.303867][ T1303] ieee802154 phy1 wpan1: encryption failed: -22 [ 1607.475095][ T7900] usb 3-1: USB disconnect, device number 37 [ 1607.554295][T25248] input: syz0 as /devices/virtual/input/input246 [ 1607.713218][T25256] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4577'. [ 1608.313646][T15751] em28xx 2-1:0.89: unknown em28xx chip ID (0) [ 1609.397065][T25225] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1609.431713][T25225] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1609.829794][T25274] fuse: Unknown parameter 'fd0x0000000000000007' [ 1609.878272][T15751] em28xx 2-1:0.89: read from i2c device at 0xa0 failed with unknown error (status=145) [ 1609.972497][T15751] em28xx 2-1:0.89: board has no eeprom [ 1610.206447][T25279] input: syz0 as /devices/virtual/input/input247 [ 1610.374364][ T5880] usb 3-1: new high-speed USB device number 38 using dummy_hcd [ 1610.626840][T25287] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4583'. [ 1610.744001][T15751] em28xx 2-1:0.89: Identified as Terratec Grabby (card=67) [ 1610.784801][T15751] em28xx 2-1:0.89: analog set to bulk mode. [ 1610.806841][ T5880] usb 3-1: Using ep0 maxpacket: 32 [ 1610.819163][ T7901] em28xx 2-1:0.89: Registering V4L2 extension [ 1610.850332][T15751] usb 2-1: USB disconnect, device number 38 [ 1610.887010][T15751] em28xx 2-1:0.89: Disconnecting em28xx [ 1610.903186][ T5880] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1610.946251][ T5880] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1611.005298][ T7901] em28xx 2-1:0.89: Config register raw data: 0xffffffed [ 1611.078270][T25296] netlink: 1 bytes leftover after parsing attributes in process `syz.1.4586'. [ 1611.087855][T25296] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1611.519588][ T5880] usb 3-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 1611.533069][ T7901] em28xx 2-1:0.89: AC97 chip type couldn't be determined [ 1611.561982][ T7901] em28xx 2-1:0.89: No AC97 audio processor [ 1611.568694][ T5880] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1611.579421][ T7901] usb 2-1: Decoder not found [ 1611.589061][ T7901] em28xx 2-1:0.89: failed to create media graph [ 1611.597782][ T5880] usb 3-1: config 0 descriptor?? [ 1611.603103][ T7901] em28xx 2-1:0.89: V4L2 device video103 deregistered [ 1611.612602][ T5880] hub 3-1:0.0: bad descriptor, ignoring hub [ 1611.618932][ T5880] hub 3-1:0.0: probe with driver hub failed with error -5 [ 1611.627494][ T5880] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 1611.638671][ T7901] em28xx 2-1:0.89: Registering snapshot button... [ 1611.650170][ T7901] input: em28xx snapshot button as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.89/input/input248 [ 1611.663191][ T7901] em28xx 2-1:0.89: Remote control support is not available for this card. [ 1611.692721][T15751] em28xx 2-1:0.89: Closing input extension [ 1611.709840][T15751] em28xx 2-1:0.89: Deregistering snapshot button [ 1611.762695][T15751] em28xx 2-1:0.89: Freeing device [ 1612.136191][ T7901] usb 7-1: new high-speed USB device number 41 using dummy_hcd [ 1612.154653][ T7898] usb 6-1: new high-speed USB device number 70 using dummy_hcd [ 1612.355437][ T7898] usb 6-1: Using ep0 maxpacket: 32 [ 1612.442960][ T7901] usb 7-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 1612.461785][T25313] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4591'. [ 1612.471265][ T7901] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1612.484715][ T7901] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1612.495126][ T7901] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 1612.512444][ T7901] usb 7-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 1612.526916][ T7901] usb 7-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 1612.536048][ T7898] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1612.547140][ T7901] usb 7-1: Manufacturer: syz [ 1612.551848][ T7898] usb 6-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1612.571966][ T7901] usb 7-1: config 0 descriptor?? [ 1612.612654][ T7898] usb 6-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 1612.629246][ T7898] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1612.681497][ T7898] usb 6-1: config 0 descriptor?? [ 1612.690911][ T7898] hub 6-1:0.0: bad descriptor, ignoring hub [ 1612.699481][ T7898] hub 6-1:0.0: probe with driver hub failed with error -5 [ 1612.709293][ T7898] usbhid 6-1:0.0: couldn't find an input interrupt endpoint [ 1613.038931][ T7901] appleir 0003:05AC:8243.0047: unknown main item tag 0x0 [ 1613.051989][ T7901] appleir 0003:05AC:8243.0047: hiddev0,hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.6-1/input0 [ 1613.335676][ T7898] usb 3-1: USB disconnect, device number 38 [ 1613.585276][ T7883] usb 7-1: USB disconnect, device number 41 [ 1614.257374][T25338] netlink: 120 bytes leftover after parsing attributes in process `syz.1.4597'. [ 1615.144202][ T7883] usb 7-1: new high-speed USB device number 42 using dummy_hcd [ 1615.385261][ T7883] usb 7-1: Using ep0 maxpacket: 32 [ 1615.446893][ T7883] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1615.458740][ T7883] usb 7-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1615.471885][ T7883] usb 7-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 1615.481253][ T7883] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1615.496833][ T7883] usb 7-1: Product: syz [ 1615.514230][ T7883] usb 7-1: Manufacturer: syz [ 1615.523706][ T7883] usb 7-1: SerialNumber: syz [ 1615.524694][ T7901] usb 6-1: USB disconnect, device number 70 [ 1615.551363][ T7883] usb 7-1: config 0 descriptor?? [ 1615.589324][T25346] fuse: Unknown parameter '0x0000000000000007' [ 1616.356040][T25353] netlink: 24 bytes leftover after parsing attributes in process `syz.5.4601'. [ 1616.533713][ T5880] usb 7-1: USB disconnect, device number 42 [ 1617.004337][ T7883] usb 2-1: new high-speed USB device number 39 using dummy_hcd [ 1617.274153][ T7883] usb 2-1: Using ep0 maxpacket: 32 [ 1617.290496][ T7883] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1617.306656][ T7883] usb 2-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1617.320451][ T7883] usb 2-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 1617.366732][ T7883] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1617.449238][ T7883] usb 2-1: config 0 descriptor?? [ 1617.544472][T25382] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4608'. [ 1617.580663][ T7883] hub 2-1:0.0: bad descriptor, ignoring hub [ 1617.651942][ T7883] hub 2-1:0.0: probe with driver hub failed with error -5 [ 1617.711546][ T7883] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 1617.757237][T25385] fuse: Unknown parameter 'u00000000000000000000' [ 1618.234772][T25378] syz.5.4607 (25378): drop_caches: 2 [ 1618.314093][T25378] syz.5.4607 (25378): drop_caches: 2 [ 1618.644892][ T7901] usb 7-1: new high-speed USB device number 43 using dummy_hcd [ 1618.809060][ T7901] usb 7-1: Using ep0 maxpacket: 32 [ 1618.817703][ T7901] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1618.859176][ T7901] usb 7-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1618.888936][ T7901] usb 7-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 1618.919270][ T7901] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1618.945054][ T7901] usb 7-1: config 0 descriptor?? [ 1618.964578][ T7901] hub 7-1:0.0: bad descriptor, ignoring hub [ 1618.972210][ T7901] hub 7-1:0.0: probe with driver hub failed with error -5 [ 1619.021112][ T7901] usbhid 7-1:0.0: couldn't find an input interrupt endpoint [ 1619.944734][ T7883] usb 2-1: reset high-speed USB device number 39 using dummy_hcd [ 1620.106015][ T7883] usb 2-1: device firmware changed [ 1620.113981][ T7883] usb 2-1: USB disconnect, device number 39 [ 1620.389099][T25409] netlink: 80 bytes leftover after parsing attributes in process `syz.2.4613'. [ 1620.426799][T25408] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4613'. [ 1620.436444][ T7901] usb 6-1: new high-speed USB device number 71 using dummy_hcd [ 1620.754158][ T7883] usb 2-1: new high-speed USB device number 40 using dummy_hcd [ 1620.829126][ T7901] usb 6-1: Using ep0 maxpacket: 32 [ 1620.846860][ T7901] usb 6-1: config 0 has an invalid interface number: 89 but max is 0 [ 1620.857148][ T7901] usb 6-1: config 0 has no interface number 0 [ 1620.863326][ T7901] usb 6-1: config 0 interface 89 has no altsetting 0 [ 1620.876586][ T7901] usb 6-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4e [ 1620.887199][ T7901] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1620.897308][ T7901] usb 6-1: Product: syz [ 1620.901615][ T7901] usb 6-1: Manufacturer: syz [ 1620.908179][ T7901] usb 6-1: SerialNumber: syz [ 1620.917202][ T7883] usb 2-1: Using ep0 maxpacket: 32 [ 1620.951947][ T7883] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1620.960114][ T7901] usb 6-1: config 0 descriptor?? [ 1620.963456][ T7883] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1621.008247][ T7901] em28xx 6-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 1621.019657][ T7901] em28xx 6-1:0.89: Video interface 89 found: bulk [ 1621.024868][ T7883] usb 2-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 1621.059324][ T7883] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1621.077204][ T7883] usb 2-1: Product: syz [ 1621.091632][ T7883] usb 2-1: Manufacturer: syz [ 1621.107450][ T7883] usb 2-1: SerialNumber: syz [ 1621.247435][ T7883] usb 2-1: config 0 descriptor?? [ 1621.395458][ T7898] usb 7-1: USB disconnect, device number 43 [ 1621.656227][ T7901] em28xx 6-1:0.89: unknown em28xx chip ID (0) [ 1621.663826][T25423] IPVS: stopping backup sync thread 25424 ... [ 1621.673373][T25424] IPVS: sync thread started: state = BACKUP, mcast_ifn = wlan1, syncid = 0, id = 0 [ 1622.281614][T25430] netlink: 4 bytes leftover after parsing attributes in process `syz.6.4622'. [ 1622.292874][T25430] netlink: 104 bytes leftover after parsing attributes in process `syz.6.4622'. [ 1622.302812][T25430] netlink: 104 bytes leftover after parsing attributes in process `syz.6.4622'. [ 1622.445471][ T7879] usb 2-1: USB disconnect, device number 40 [ 1622.579390][T25434] input: syz0 as /devices/virtual/input/input249 [ 1623.182313][T25440] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1623.228077][T25440] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1623.266289][T25443] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4623'. [ 1623.728693][ T7901] em28xx 6-1:0.89: read from i2c device at 0xa0 failed with unknown error (status=145) [ 1623.745428][ T7898] usb 7-1: new high-speed USB device number 44 using dummy_hcd [ 1623.760044][ T7901] em28xx 6-1:0.89: board has no eeprom [ 1623.925274][ T7898] usb 7-1: Using ep0 maxpacket: 32 [ 1623.947061][ T7898] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1623.958332][ T7898] usb 7-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1623.994817][ T7898] usb 7-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 1624.034864][ T7898] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1624.075570][ T7898] usb 7-1: config 0 descriptor?? [ 1624.100509][ T7898] hub 7-1:0.0: bad descriptor, ignoring hub [ 1624.151886][ T7898] hub 7-1:0.0: probe with driver hub failed with error -5 [ 1624.176590][ T7898] usbhid 7-1:0.0: couldn't find an input interrupt endpoint [ 1624.436037][T25463] input: syz0 as /devices/virtual/input/input250 [ 1624.584943][T25466] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4630'. [ 1624.684397][ T7901] em28xx 6-1:0.89: Identified as Terratec Grabby (card=67) [ 1624.691810][ T7901] em28xx 6-1:0.89: analog set to bulk mode. [ 1624.698784][ T7898] em28xx 6-1:0.89: Registering V4L2 extension [ 1624.716246][ T7901] usb 6-1: USB disconnect, device number 71 [ 1624.749133][ T7901] em28xx 6-1:0.89: Disconnecting em28xx [ 1624.805329][ T7898] em28xx 6-1:0.89: Config register raw data: 0xffffffed [ 1624.817143][ T7898] em28xx 6-1:0.89: AC97 chip type couldn't be determined [ 1624.832425][ T7898] em28xx 6-1:0.89: No AC97 audio processor [ 1624.982623][ T7898] usb 6-1: Decoder not found [ 1625.006491][ T7898] em28xx 6-1:0.89: failed to create media graph [ 1625.028949][ T7898] em28xx 6-1:0.89: V4L2 device video103 deregistered [ 1625.058750][ T7898] em28xx 6-1:0.89: Registering snapshot button... [ 1625.092968][ T7898] input: em28xx snapshot button as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.89/input/input251 [ 1625.784999][ T7898] em28xx 6-1:0.89: Remote control support is not available for this card. [ 1625.796928][ T7901] em28xx 6-1:0.89: Closing input extension [ 1626.164739][ T7901] em28xx 6-1:0.89: Deregistering snapshot button [ 1626.496050][ T7901] em28xx 6-1:0.89: Freeing device [ 1627.074114][T25493] netlink: 1 bytes leftover after parsing attributes in process `syz.5.4636'. [ 1627.083228][T25493] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1627.093458][ T7882] usb 7-1: USB disconnect, device number 44 [ 1627.094461][ T7901] usb 3-1: new high-speed USB device number 39 using dummy_hcd [ 1627.338602][ T7901] usb 3-1: New USB device found, idVendor=2304, idProduct=023e, bcdDevice=d7.69 [ 1627.349048][ T7901] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1627.360866][ T7901] usb 3-1: Product: syz [ 1627.368687][ T7901] usb 3-1: Manufacturer: syz [ 1627.383187][ T7901] usb 3-1: SerialNumber: syz [ 1627.401113][ T7901] usb 3-1: config 0 descriptor?? [ 1627.435470][ T7901] hub 3-1:0.0: bad descriptor, ignoring hub [ 1627.444654][ T7901] hub 3-1:0.0: probe with driver hub failed with error -5 [ 1627.836221][T25498] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4634'. [ 1629.002180][T25508] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4640'. [ 1629.304712][ T7882] usb 2-1: new high-speed USB device number 41 using dummy_hcd [ 1629.528352][ T7882] usb 2-1: Using ep0 maxpacket: 32 [ 1629.541622][ T7882] usb 2-1: config 0 has an invalid interface number: 89 but max is 0 [ 1629.551021][ T7882] usb 2-1: config 0 has no interface number 0 [ 1629.559753][ T7882] usb 2-1: config 0 interface 89 has no altsetting 0 [ 1629.599380][ T7882] usb 2-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4e [ 1629.609627][ T7882] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1629.670510][ T7882] usb 2-1: Product: syz [ 1629.749901][ T7882] usb 2-1: Manufacturer: syz [ 1629.774097][ T7882] usb 2-1: SerialNumber: syz [ 1629.792615][ T7882] usb 2-1: config 0 descriptor?? [ 1629.827166][ T7882] em28xx 2-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 1629.874966][ T7882] em28xx 2-1:0.89: Video interface 89 found: bulk [ 1630.384630][ T7900] usb 6-1: new high-speed USB device number 72 using dummy_hcd [ 1630.446465][ T7882] em28xx 2-1:0.89: unknown em28xx chip ID (0) [ 1630.556387][ T7900] usb 6-1: Using ep0 maxpacket: 32 [ 1630.565429][ T7900] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1630.592409][ T7900] usb 6-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1630.616345][ T7900] usb 6-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 1630.626185][T25530] netlink: 'syz.6.4648': attribute type 22 has an invalid length. [ 1630.658996][ T7900] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1630.792718][ T7900] usb 6-1: config 0 descriptor?? [ 1630.852401][ T7900] hub 6-1:0.0: bad descriptor, ignoring hub [ 1630.865567][ T7900] hub 6-1:0.0: probe with driver hub failed with error -5 [ 1630.876788][ T7900] usbhid 6-1:0.0: couldn't find an input interrupt endpoint [ 1630.917865][ T7901] dvb-usb: found a 'Pinnacle PCTV Hybrid Stick Solo' in cold state, will try to load a firmware [ 1630.930966][ T7901] dvb-usb: downloading firmware from file 'dvb-usb-dib0700-1.20.fw' [ 1630.973476][ T7901] dib0700: firmware download failed at 7 with -22 [ 1631.047538][ T7901] usb 3-1: USB disconnect, device number 39 [ 1631.295571][T25510] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1631.312894][T25510] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1631.740475][ T7882] em28xx 2-1:0.89: read from i2c device at 0xa0 failed with unknown error (status=145) [ 1631.753173][ T7882] em28xx 2-1:0.89: board has no eeprom [ 1632.019967][T25553] fuse: Unknown parameter 'use00000000000000000000' [ 1632.666425][ T7882] em28xx 2-1:0.89: Identified as Terratec Grabby (card=67) [ 1632.685593][ T7882] em28xx 2-1:0.89: analog set to bulk mode. [ 1632.698041][ T7879] em28xx 2-1:0.89: Registering V4L2 extension [ 1632.718775][ T7882] usb 2-1: USB disconnect, device number 41 [ 1632.737096][ T7882] em28xx 2-1:0.89: Disconnecting em28xx [ 1632.839264][ T7879] em28xx 2-1:0.89: Config register raw data: 0xffffffed [ 1632.863433][ T7879] em28xx 2-1:0.89: AC97 chip type couldn't be determined [ 1632.881389][ T7879] em28xx 2-1:0.89: No AC97 audio processor [ 1632.899847][ T7879] usb 2-1: Decoder not found [ 1632.912097][ T7879] em28xx 2-1:0.89: failed to create media graph [ 1632.930193][ T7879] em28xx 2-1:0.89: V4L2 device video103 deregistered [ 1632.956473][ T7879] em28xx 2-1:0.89: Registering snapshot button... [ 1632.965882][ T7879] input: em28xx snapshot button as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.89/input/input252 [ 1632.982229][ T7879] em28xx 2-1:0.89: Remote control support is not available for this card. [ 1632.992269][ T7882] em28xx 2-1:0.89: Closing input extension [ 1632.999524][ T7882] em28xx 2-1:0.89: Deregistering snapshot button [ 1633.021963][ T7882] em28xx 2-1:0.89: Freeing device [ 1633.051807][T25570] input: syz0 as /devices/virtual/input/input253 [ 1633.844166][ T7879] usb 6-1: USB disconnect, device number 72 [ 1634.115717][T25586] input: syz0 as /devices/virtual/input/input254 [ 1635.289512][T25592] netlink: 4 bytes leftover after parsing attributes in process `syz.5.4665'. [ 1635.307540][T25592] dvmrp0: entered allmulticast mode [ 1635.382465][T25595] FAULT_INJECTION: forcing a failure. [ 1635.382465][T25595] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1635.402644][T25595] CPU: 1 UID: 0 PID: 25595 Comm: syz.1.4667 Not tainted syzkaller #0 PREEMPT(full) [ 1635.402671][T25595] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1635.402681][T25595] Call Trace: [ 1635.402688][T25595] [ 1635.402697][T25595] dump_stack_lvl+0x189/0x250 [ 1635.402720][T25595] ? __pfx____ratelimit+0x10/0x10 [ 1635.402747][T25595] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1635.402764][T25595] ? __pfx__printk+0x10/0x10 [ 1635.402792][T25595] should_fail_ex+0x414/0x560 [ 1635.402823][T25595] _copy_to_user+0x31/0xb0 [ 1635.402849][T25595] simple_read_from_buffer+0xe1/0x170 [ 1635.402880][T25595] proc_fail_nth_read+0x1b3/0x220 [ 1635.402914][T25595] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1635.402943][T25595] ? rw_verify_area+0x2a6/0x4d0 [ 1635.402961][T25595] ? __lock_acquire+0xab9/0xd20 [ 1635.402982][T25595] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1635.403010][T25595] vfs_read+0x200/0xa30 [ 1635.403029][T25595] ? fdget_pos+0x247/0x320 [ 1635.403055][T25595] ? __pfx___mutex_lock+0x10/0x10 [ 1635.403075][T25595] ? __pfx_vfs_read+0x10/0x10 [ 1635.403097][T25595] ? __fget_files+0x2a/0x420 [ 1635.403146][T25595] ? __fget_files+0x3a0/0x420 [ 1635.403167][T25595] ? __fget_files+0x2a/0x420 [ 1635.403198][T25595] ksys_read+0x145/0x250 [ 1635.403220][T25595] ? __pfx_ksys_read+0x10/0x10 [ 1635.403243][T25595] ? syscall_enter_from_user_mode_prepare+0x8f/0x110 [ 1635.403265][T25595] ? lockdep_hardirqs_on+0x9c/0x150 [ 1635.403285][T25595] __do_fast_syscall_32+0xb6/0x2b0 [ 1635.403305][T25595] ? lockdep_hardirqs_on+0x9c/0x150 [ 1635.403326][T25595] do_fast_syscall_32+0x34/0x80 [ 1635.403343][T25595] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1635.403362][T25595] RIP: 0023:0xf70dd539 [ 1635.403379][T25595] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1635.403395][T25595] RSP: 002b:00000000f54cd590 EFLAGS: 00000206 ORIG_RAX: 0000000000000003 [ 1635.403415][T25595] RAX: ffffffffffffffda RBX: 0000000000000008 RCX: 00000000f54cd620 [ 1635.403428][T25595] RDX: 000000000000000f RSI: 00000000f7475ff4 RDI: 0000000000000000 [ 1635.403439][T25595] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 [ 1635.403450][T25595] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1635.403462][T25595] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1635.403492][T25595] [ 1635.638129][ C1] vkms_vblank_simulate: vblank timer overrun [ 1636.314153][ T7901] usb 2-1: new high-speed USB device number 42 using dummy_hcd [ 1636.494891][ T7901] usb 2-1: Using ep0 maxpacket: 32 [ 1636.501792][ T7901] usb 2-1: config 0 has an invalid interface number: 89 but max is 0 [ 1636.515121][ T7901] usb 2-1: config 0 has no interface number 0 [ 1636.525986][ T7901] usb 2-1: config 0 interface 89 has no altsetting 0 [ 1636.538521][ T7901] usb 2-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4e [ 1636.552436][ T7901] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1636.561573][ T7901] usb 2-1: Product: syz [ 1636.567227][ T7901] usb 2-1: Manufacturer: syz [ 1636.572100][ T7901] usb 2-1: SerialNumber: syz [ 1636.585548][ T7901] usb 2-1: config 0 descriptor?? [ 1636.611570][T25613] input: syz0 as /devices/virtual/input/input255 [ 1636.618494][ T7901] em28xx 2-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 1636.635003][ T7901] em28xx 2-1:0.89: Video interface 89 found: bulk [ 1637.566669][ T7901] em28xx 2-1:0.89: unknown em28xx chip ID (0) [ 1637.728171][T25629] netlink: 'syz.2.4675': attribute type 22 has an invalid length. [ 1638.518574][T25603] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1638.551030][T25603] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1638.580661][T25642] fuse: Unknown parameter 'u00000000000000000000' [ 1638.997591][ T7901] em28xx 2-1:0.89: read from i2c device at 0xa0 failed with unknown error (status=145) [ 1639.008091][ T7901] em28xx 2-1:0.89: board has no eeprom [ 1639.754723][ T7879] usb 6-1: new high-speed USB device number 73 using dummy_hcd [ 1639.831997][T25660] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4683'. [ 1639.971829][ T7879] usb 6-1: New USB device found, idVendor=2304, idProduct=023e, bcdDevice=d7.69 [ 1640.009290][ T7879] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1640.018485][ T7879] usb 6-1: Product: syz [ 1640.023307][ T7879] usb 6-1: Manufacturer: syz [ 1640.028070][ T7879] usb 6-1: SerialNumber: syz [ 1640.041527][ T7879] usb 6-1: config 0 descriptor?? [ 1640.061170][ T7879] hub 6-1:0.0: bad descriptor, ignoring hub [ 1640.067909][ T7879] hub 6-1:0.0: probe with driver hub failed with error -5 [ 1640.144646][ T7901] em28xx 2-1:0.89: Identified as Terratec Grabby (card=67) [ 1640.152515][ T7881] usb 3-1: new high-speed USB device number 40 using dummy_hcd [ 1640.199575][ T7901] em28xx 2-1:0.89: analog set to bulk mode. [ 1640.234372][ T7900] em28xx 2-1:0.89: Registering V4L2 extension [ 1640.245988][T25665] input: syz0 as /devices/virtual/input/input256 [ 1640.290851][ T7901] usb 2-1: USB disconnect, device number 42 [ 1640.314176][ T7881] usb 3-1: Using ep0 maxpacket: 16 [ 1640.387362][T25670] netlink: 12 bytes leftover after parsing attributes in process `syz.5.4681'. [ 1640.444581][ T7881] usb 3-1: New USB device found, idVendor=1004, idProduct=61aa, bcdDevice=4f.75 [ 1640.525090][ T7901] em28xx 2-1:0.89: Disconnecting em28xx [ 1640.551568][ T7881] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1640.570032][ T7900] em28xx 2-1:0.89: Config register raw data: 0xffffffed [ 1640.776506][ T7900] em28xx 2-1:0.89: AC97 chip type couldn't be determined [ 1640.924155][ T7881] usb 3-1: Product: syz [ 1640.935686][ T7881] usb 3-1: Manufacturer: syz [ 1640.938543][ T7900] em28xx 2-1:0.89: No AC97 audio processor [ 1640.953692][ T7881] usb 3-1: SerialNumber: syz [ 1640.966838][ T7900] usb 2-1: Decoder not found [ 1640.975029][ T7900] em28xx 2-1:0.89: failed to create media graph [ 1640.989142][ T7900] em28xx 2-1:0.89: V4L2 device video103 deregistered [ 1640.998041][ T7881] usb 3-1: config 0 descriptor?? [ 1641.022139][ T7900] em28xx 2-1:0.89: Registering snapshot button... [ 1641.039859][T25676] netlink: 'syz.3.4686': attribute type 22 has an invalid length. [ 1641.289999][ T7900] input: em28xx snapshot button as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.89/input/input257 [ 1641.339600][ T7900] em28xx 2-1:0.89: Remote control support is not available for this card. [ 1641.360607][ T7881] usb 3-1: bad CDC descriptors [ 1641.362383][ T7901] em28xx 2-1:0.89: Closing input extension [ 1641.392198][ T7901] em28xx 2-1:0.89: Deregistering snapshot button [ 1641.569924][T25661] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1641.580201][T25661] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1641.601587][T25661] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1641.614826][T25661] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1641.638885][ T7901] em28xx 2-1:0.89: Freeing device [ 1642.938896][ T7879] dvb-usb: found a 'Pinnacle PCTV Hybrid Stick Solo' in cold state, will try to load a firmware [ 1643.142888][ T7879] dvb-usb: downloading firmware from file 'dvb-usb-dib0700-1.20.fw' [ 1643.171693][ T7879] dib0700: firmware download failed at 7 with -22 [ 1643.294753][ T7879] usb 6-1: USB disconnect, device number 73 [ 1643.304972][T25698] fuse: Unknown parameter 'user_i00000000000000000000' [ 1643.484470][ T7900] usb 3-1: USB disconnect, device number 40 [ 1643.621566][T25705] fuse: Unknown parameter 'u00000000000000000000' [ 1645.033959][ T7881] usb 7-1: new high-speed USB device number 45 using dummy_hcd [ 1645.213923][ T7881] usb 7-1: Using ep0 maxpacket: 32 [ 1645.235479][ T7881] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1645.281546][ T7881] usb 7-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1645.296086][ T7881] usb 7-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 1645.309691][ T7881] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1645.324423][ T7881] usb 7-1: config 0 descriptor?? [ 1645.337151][ T7881] hub 7-1:0.0: bad descriptor, ignoring hub [ 1645.343458][ T7881] hub 7-1:0.0: probe with driver hub failed with error -5 [ 1645.393319][ T7881] usbhid 7-1:0.0: couldn't find an input interrupt endpoint [ 1645.524347][ T7901] usb 2-1: new high-speed USB device number 43 using dummy_hcd [ 1645.734545][ T7901] usb 2-1: Using ep0 maxpacket: 32 [ 1645.745405][ T7901] usb 2-1: config 0 has an invalid interface number: 89 but max is 0 [ 1645.754353][ T7901] usb 2-1: config 0 has no interface number 0 [ 1645.760584][ T7901] usb 2-1: config 0 interface 89 has no altsetting 0 [ 1645.773638][ T7901] usb 2-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4e [ 1645.784374][ T7901] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1645.792555][ T7901] usb 2-1: Product: syz [ 1645.797839][ T7901] usb 2-1: Manufacturer: syz [ 1645.802610][ T7901] usb 2-1: SerialNumber: syz [ 1645.821629][ T7901] usb 2-1: config 0 descriptor?? [ 1645.840169][ T7901] em28xx 2-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 1645.858618][ T7901] em28xx 2-1:0.89: Video interface 89 found: bulk [ 1646.446565][ T7901] em28xx 2-1:0.89: unknown em28xx chip ID (0) [ 1647.016796][T25744] loop8: detected capacity change from 0 to 8 [ 1647.033510][T25744] loop8: [CUMANA/ADFS] p1 [ADFS] p1 [ 1647.042690][T25744] loop8: partition table partially beyond EOD, truncated [ 1647.054465][T25744] loop8: p1 size 3004527350 extends beyond EOD, truncated [ 1647.293050][T25725] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1647.316288][T25725] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1647.469032][ T7881] usb 3-1: new high-speed USB device number 41 using dummy_hcd [ 1647.668791][ T7881] usb 3-1: New USB device found, idVendor=2304, idProduct=023e, bcdDevice=d7.69 [ 1647.678342][ T7881] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1647.702557][ T7881] usb 3-1: Product: syz [ 1647.712665][ T7881] usb 3-1: Manufacturer: syz [ 1647.715078][ T7900] usb 7-1: USB disconnect, device number 45 [ 1647.743483][ T7881] usb 3-1: SerialNumber: syz [ 1647.752171][ T7901] em28xx 2-1:0.89: read from i2c device at 0xa0 failed with unknown error (status=145) [ 1647.765069][ T7901] em28xx 2-1:0.89: board has no eeprom [ 1647.805197][ T7881] usb 3-1: config 0 descriptor?? [ 1647.819192][T25749] fuse: Unknown parameter 'user_i00000000000000000000' [ 1647.827902][ T7881] hub 3-1:0.0: bad descriptor, ignoring hub [ 1647.856604][ T7881] hub 3-1:0.0: probe with driver hub failed with error -5 [ 1648.129538][T25757] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4702'. [ 1648.406430][ T30] kauditd_printk_skb: 6 callbacks suppressed [ 1648.406446][ T30] audit: type=1326 audit(1760520003.453:3245): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25750 comm="syz.3.4704" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709d539 code=0x7ffc0000 [ 1648.787276][ T30] audit: type=1326 audit(1760520003.463:3246): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25750 comm="syz.3.4704" exe="/root/syz-executor" sig=0 arch=40000003 syscall=277 compat=1 ip=0xf709d539 code=0x7ffc0000 [ 1648.896014][ T7901] em28xx 2-1:0.89: Identified as Terratec Grabby (card=67) [ 1648.918029][ T30] audit: type=1326 audit(1760520003.463:3247): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25750 comm="syz.3.4704" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709d539 code=0x7ffc0000 [ 1648.941849][ T7901] em28xx 2-1:0.89: analog set to bulk mode. [ 1649.030149][T15751] em28xx 2-1:0.89: Registering V4L2 extension [ 1649.077503][ T7901] usb 2-1: USB disconnect, device number 43 [ 1649.116796][ T7901] em28xx 2-1:0.89: Disconnecting em28xx [ 1649.165518][T25771] fuse: Unknown parameter 'u00000000000000000000' [ 1649.245178][ T30] audit: type=1326 audit(1760520003.463:3248): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25750 comm="syz.3.4704" exe="/root/syz-executor" sig=0 arch=40000003 syscall=281 compat=1 ip=0xf709d539 code=0x7ffc0000 [ 1649.271906][ T30] audit: type=1326 audit(1760520003.463:3249): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25750 comm="syz.3.4704" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709d539 code=0x7ffc0000 [ 1649.318849][ T30] audit: type=1326 audit(1760520003.463:3250): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25750 comm="syz.3.4704" exe="/root/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf709d539 code=0x7ffc0000 [ 1649.318902][T15751] em28xx 2-1:0.89: Config register raw data: 0xffffffed [ 1649.395073][ T30] audit: type=1326 audit(1760520003.463:3251): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25750 comm="syz.3.4704" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709d539 code=0x7ffc0000 [ 1649.612498][T15751] em28xx 2-1:0.89: AC97 chip type couldn't be determined [ 1649.649881][T15751] em28xx 2-1:0.89: No AC97 audio processor [ 1649.665759][ T30] audit: type=1326 audit(1760520003.463:3252): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25750 comm="syz.3.4704" exe="/root/syz-executor" sig=0 arch=40000003 syscall=354 compat=1 ip=0xf709d539 code=0x7ffc0000 [ 1649.738799][T15751] usb 2-1: Decoder not found [ 1649.820977][ T30] audit: type=1326 audit(1760520003.473:3253): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25750 comm="syz.3.4704" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709d539 code=0x7ffc0000 [ 1649.845080][T15751] em28xx 2-1:0.89: failed to create media graph [ 1649.919634][ T30] audit: type=1326 audit(1760520003.483:3254): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25750 comm="syz.3.4704" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709d539 code=0x7ffc0000 [ 1649.953349][T15751] em28xx 2-1:0.89: V4L2 device video103 deregistered [ 1650.205162][T15751] em28xx 2-1:0.89: Registering snapshot button... [ 1650.323586][ T7881] dvb-usb: found a 'Pinnacle PCTV Hybrid Stick Solo' in cold state, will try to load a firmware [ 1650.345765][ T7881] dvb-usb: downloading firmware from file 'dvb-usb-dib0700-1.20.fw' [ 1650.373922][ T7881] dib0700: firmware download failed at 7 with -22 [ 1650.392392][T15751] input: em28xx snapshot button as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.89/input/input258 [ 1650.424494][ T7881] usb 3-1: USB disconnect, device number 41 [ 1650.506469][T15751] em28xx 2-1:0.89: Remote control support is not available for this card. [ 1650.562049][ T7901] em28xx 2-1:0.89: Closing input extension [ 1650.574439][ T7901] em28xx 2-1:0.89: Deregistering snapshot button [ 1650.660518][ T7901] em28xx 2-1:0.89: Freeing device [ 1650.690422][T25782] netlink: 'syz.6.4709': attribute type 22 has an invalid length. [ 1651.054921][T25798] fuse: Unknown parameter 'user_i00000000000000000000' [ 1651.204350][ T7901] usb 6-1: new high-speed USB device number 74 using dummy_hcd [ 1651.407470][ T7901] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1651.442070][ T7901] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1651.475672][ T7901] usb 6-1: New USB device found, idVendor=10fd, idProduct=1513, bcdDevice=7e.ce [ 1651.495793][ T7901] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1651.715531][ T7881] usb 2-1: new high-speed USB device number 44 using dummy_hcd [ 1651.804436][ T7901] usb 6-1: Product: syz [ 1651.854630][ T7901] usb 6-1: Manufacturer: syz [ 1651.889445][ T7901] usb 6-1: SerialNumber: syz [ 1651.909326][ T7901] usb 6-1: config 0 descriptor?? [ 1651.930757][ T7901] dvb-usb: found a 'MSI DIGI VOX mini II DVB-T USB2.0' in warm state. [ 1651.944376][ T7881] usb 2-1: Using ep0 maxpacket: 32 [ 1651.956270][ T7881] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1651.971432][ T7881] usb 2-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1651.989112][ T7881] usb 2-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 1652.009527][ T7881] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1652.018596][ T7901] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1652.040528][ T7881] usb 2-1: config 0 descriptor?? [ 1652.056638][ T7901] dvbdev: DVB: registering new adapter (MSI DIGI VOX mini II DVB-T USB2.0) [ 1652.071910][ T7881] hub 2-1:0.0: bad descriptor, ignoring hub [ 1652.102771][T25813] netlink: 1 bytes leftover after parsing attributes in process `syz.6.4718'. [ 1652.112426][T25813] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1652.121841][ T7901] usb 6-1: media controller created [ 1652.123170][ T7881] hub 2-1:0.0: probe with driver hub failed with error -5 [ 1652.134673][ T7879] usb 3-1: new high-speed USB device number 42 using dummy_hcd [ 1652.146881][ T7881] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 1652.169104][T25794] netlink: 16 bytes leftover after parsing attributes in process `syz.5.4713'. [ 1652.283597][ T7901] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1652.324124][ T7879] usb 3-1: Using ep0 maxpacket: 16 [ 1652.331842][ T7879] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 1652.341874][ T7879] usb 3-1: config 0 has no interface number 0 [ 1652.368563][ T7879] usb 3-1: New USB device found, idVendor=04fc, idProduct=1528, bcdDevice=6d.5d [ 1652.385755][ T7879] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1652.404995][ T7879] usb 3-1: Product: syz [ 1652.415430][ T7879] usb 3-1: Manufacturer: syz [ 1652.421690][ T7879] usb 3-1: SerialNumber: syz [ 1652.445526][ T7879] usb 3-1: config 0 descriptor?? [ 1652.461245][ T7879] gspca_main: spca1528-2.14.0 probing 04fc:1528 [ 1652.528586][T25818] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4719'. [ 1652.734933][ T7901] DVB: Unable to find symbol tda10046_attach() [ 1652.741245][ T7901] dvb-usb: no frontend was attached by 'MSI DIGI VOX mini II DVB-T USB2.0' [ 1652.751802][ T7901] dvb-usb: MSI DIGI VOX mini II DVB-T USB2.0 successfully initialized and connected. [ 1653.024185][T25794] netlink: 12 bytes leftover after parsing attributes in process `syz.5.4713'. [ 1653.408742][ T7901] dvb_usb_m920x 6-1:0.0: probe with driver dvb_usb_m920x failed with error -71 [ 1653.452938][ T7901] usb 6-1: USB disconnect, device number 74 [ 1653.474045][ T7879] gspca_spca1528: reg_w err -110 [ 1653.494275][ T7879] spca1528 3-1:0.1: probe with driver spca1528 failed with error -110 [ 1653.698787][ T5880] usb 3-1: USB disconnect, device number 42 [ 1654.011562][T25827] input: syz0 as /devices/virtual/input/input259 [ 1654.224677][ T7879] usb 2-1: USB disconnect, device number 44 [ 1654.549947][T25842] netlink: 28 bytes leftover after parsing attributes in process `syz.5.4722'. [ 1654.628949][ T30] kauditd_printk_skb: 61 callbacks suppressed [ 1654.628962][ T30] audit: type=1326 audit(1760520009.803:3316): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25834 comm="syz.1.4723" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70dd539 code=0x7fc00000 [ 1655.147223][T25853] fuse: Unknown parameter 'u00000000000000000000' [ 1655.284796][ T30] audit: type=1326 audit(1760520010.273:3317): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25834 comm="syz.1.4723" exe="/root/syz-executor" sig=0 arch=40000003 syscall=20 compat=1 ip=0xf70dd539 code=0x7fc00000 [ 1655.354698][ T30] audit: type=1326 audit(1760520010.273:3318): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25834 comm="syz.1.4723" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70dd539 code=0x7fc00000 [ 1655.444936][ T30] audit: type=1326 audit(1760520010.273:3319): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25834 comm="syz.1.4723" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70dd539 code=0x7fc00000 [ 1655.594222][ T30] audit: type=1326 audit(1760520010.273:3320): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25834 comm="syz.1.4723" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70dd539 code=0x7fc00000 [ 1655.691135][ T30] audit: type=1326 audit(1760520010.273:3321): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25834 comm="syz.1.4723" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70dd539 code=0x7fc00000 [ 1655.753405][ T30] audit: type=1326 audit(1760520010.273:3322): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25834 comm="syz.1.4723" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70dd539 code=0x7fc00000 [ 1655.843955][ T30] audit: type=1326 audit(1760520010.273:3323): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25834 comm="syz.1.4723" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70dd539 code=0x7fc00000 [ 1655.894459][ T30] audit: type=1326 audit(1760520010.273:3324): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25834 comm="syz.1.4723" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70dd539 code=0x7fc00000 [ 1656.010425][ T30] audit: type=1326 audit(1760520010.273:3325): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25834 comm="syz.1.4723" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70dd539 code=0x7fc00000 [ 1656.078736][T25863] netlink: 'syz.2.4728': attribute type 22 has an invalid length. [ 1656.129212][T25864] input: syz0 as /devices/virtual/input/input260 [ 1656.840609][T25875] sctp_transport_update_pmtu: 83 callbacks suppressed [ 1656.840624][T25875] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 1656.871564][T25875] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 1656.892262][T25875] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 1656.932150][T25875] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 1657.289220][T25875] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 1657.302610][T25875] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 1657.339480][T25875] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 1657.374652][ T5880] usb 6-1: new high-speed USB device number 75 using dummy_hcd [ 1657.388279][T25875] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 1657.461663][T25875] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 1657.474847][T25875] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 1657.559503][ T5880] usb 6-1: Using ep0 maxpacket: 8 [ 1657.577184][ T5880] usb 6-1: config index 0 descriptor too short (expected 301, got 45) [ 1657.731525][T25888] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4732'. [ 1658.107068][ T5880] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1658.128717][ T5880] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1658.216938][ T5880] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1658.232679][ T5880] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1658.261285][ T5880] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1658.280312][ T5880] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1658.719569][ T5880] usb 6-1: usb_control_msg returned -32 [ 1658.725587][ T5880] usbtmc 6-1:16.0: can't read capabilities [ 1659.201236][ T7882] usb 2-1: new high-speed USB device number 45 using dummy_hcd [ 1659.384291][ T5880] usb 7-1: new high-speed USB device number 46 using dummy_hcd [ 1659.413992][ T7882] usb 2-1: Using ep0 maxpacket: 32 [ 1659.423885][ T7882] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1659.442735][ T7882] usb 2-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1659.492517][ T7882] usb 2-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 1659.539309][ T7882] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1659.556417][ T5880] usb 7-1: Using ep0 maxpacket: 32 [ 1659.565469][T25874] usbtmc 6-1:16.0: usb_control_msg returned -32 [ 1659.571905][T25877] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4730'. [ 1659.588894][ T5880] usb 7-1: config 0 has an invalid interface number: 89 but max is 0 [ 1659.597671][T25877] netlink: 'syz.5.4730': attribute type 5 has an invalid length. [ 1659.607025][ T5880] usb 7-1: config 0 has no interface number 0 [ 1659.613327][ T5880] usb 7-1: config 0 interface 89 has no altsetting 0 [ 1659.621177][T25877] netlink: 20 bytes leftover after parsing attributes in process `syz.5.4730'. [ 1659.647347][ T5880] usb 7-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4e [ 1659.658590][ T5880] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1659.667820][ T5880] usb 7-1: Product: syz [ 1659.672132][ T5880] usb 7-1: Manufacturer: syz [ 1659.682262][ T5880] usb 7-1: SerialNumber: syz [ 1659.697532][ T7882] usb 2-1: config 0 descriptor?? [ 1659.712456][ T7882] hub 2-1:0.0: bad descriptor, ignoring hub [ 1659.762124][ T5880] usb 7-1: config 0 descriptor?? [ 1659.775269][T25911] input: syz0 as /devices/virtual/input/input261 [ 1659.810804][ T7882] hub 2-1:0.0: probe with driver hub failed with error -5 [ 1659.816247][ T5880] em28xx 7-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 1659.846962][ T7882] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 1659.847357][T25877] geneve2: entered promiscuous mode [ 1659.862640][T25877] geneve2: entered allmulticast mode [ 1659.882568][ T5880] em28xx 7-1:0.89: Video interface 89 found: bulk [ 1659.960733][T10430] netdevsim netdevsim5 netdevsim0: set [1, 1] type 2 family 0 port 256 - 0 [ 1659.984590][T10430] netdevsim netdevsim5 netdevsim1: set [1, 1] type 2 family 0 port 256 - 0 [ 1660.066269][T10430] netdevsim netdevsim5 netdevsim2: set [1, 1] type 2 family 0 port 256 - 0 [ 1660.110673][T10430] netdevsim netdevsim5 netdevsim3: set [1, 1] type 2 family 0 port 256 - 0 [ 1660.441981][ T5880] em28xx 7-1:0.89: unknown em28xx chip ID (0) [ 1661.218931][ T7883] usb 6-1: USB disconnect, device number 75 [ 1661.298472][T25902] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1661.362576][T25902] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1661.829077][ T5880] em28xx 7-1:0.89: read from i2c device at 0xa0 failed with unknown error (status=145) [ 1661.840598][ T5880] em28xx 7-1:0.89: board has no eeprom [ 1661.874314][ T7881] usb 2-1: USB disconnect, device number 45 [ 1662.090993][T25934] netlink: 'syz.2.4742': attribute type 1 has an invalid length. [ 1662.149053][T25937] FAULT_INJECTION: forcing a failure. [ 1662.149053][T25937] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1662.188289][T25934] bond1: entered promiscuous mode [ 1662.195561][T25934] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1662.205318][T25937] CPU: 1 UID: 0 PID: 25937 Comm: syz.2.4742 Not tainted syzkaller #0 PREEMPT(full) [ 1662.205344][T25937] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1662.205354][T25937] Call Trace: [ 1662.205363][T25937] [ 1662.205371][T25937] dump_stack_lvl+0x189/0x250 [ 1662.205397][T25937] ? __pfx____ratelimit+0x10/0x10 [ 1662.205425][T25937] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1662.205444][T25937] ? __pfx__printk+0x10/0x10 [ 1662.205464][T25937] ? __might_fault+0xb0/0x130 [ 1662.205494][T25937] should_fail_ex+0x414/0x560 [ 1662.205524][T25937] _copy_from_iter+0x1de/0x1790 [ 1662.205551][T25937] ? rcu_is_watching+0x15/0xb0 [ 1662.205580][T25937] ? kmalloc_reserve+0xbd/0x290 [ 1662.205605][T25937] ? __pfx__copy_from_iter+0x10/0x10 [ 1662.205628][T25937] ? __build_skb_around+0x262/0x3f0 [ 1662.205655][T25937] ? netlink_sendmsg+0x642/0xb30 [ 1662.205677][T25937] ? skb_put+0x11b/0x210 [ 1662.205703][T25937] netlink_sendmsg+0x6b2/0xb30 [ 1662.205737][T25937] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1662.205764][T25937] ? __import_iovec+0x5d4/0x7f0 [ 1662.205782][T25937] ? aa_sock_msg_perm+0xf1/0x1d0 [ 1662.205802][T25937] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1662.205824][T25937] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1662.205849][T25937] __sock_sendmsg+0x21c/0x270 [ 1662.205873][T25937] ____sys_sendmsg+0x505/0x830 [ 1662.205904][T25937] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1662.205956][T25937] ___sys_sendmsg+0x21f/0x2a0 [ 1662.205975][T25937] ? __pfx____sys_sendmsg+0x10/0x10 [ 1662.206027][T25937] ? __fget_files+0x2a/0x420 [ 1662.206047][T25937] ? __fget_files+0x3a0/0x420 [ 1662.206078][T25937] __sys_sendmsg+0x164/0x220 [ 1662.206098][T25937] ? __pfx___sys_sendmsg+0x10/0x10 [ 1662.206132][T25937] ? __pfx_ksys_write+0x10/0x10 [ 1662.206155][T25937] ? syscall_enter_from_user_mode_prepare+0x8f/0x110 [ 1662.206176][T25937] ? lockdep_hardirqs_on+0x9c/0x150 [ 1662.206198][T25937] __do_fast_syscall_32+0xb6/0x2b0 [ 1662.206217][T25937] ? lockdep_hardirqs_on+0x9c/0x150 [ 1662.206240][T25937] do_fast_syscall_32+0x34/0x80 [ 1662.206260][T25937] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1662.206282][T25937] RIP: 0023:0xf707d539 [ 1662.206298][T25937] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1662.206314][T25937] RSP: 002b:00000000f542b55c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 1662.206334][T25937] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000280 [ 1662.206347][T25937] RDX: 0000000002000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 1662.206359][T25937] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1662.206371][T25937] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1662.206382][T25937] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1662.206410][T25937] [ 1662.724975][T25951] netlink: 'syz.3.4743': attribute type 22 has an invalid length. [ 1662.934635][ T5880] em28xx 7-1:0.89: Identified as Terratec Grabby (card=67) [ 1662.961091][ T5880] em28xx 7-1:0.89: analog set to bulk mode. [ 1663.001051][T15751] em28xx 7-1:0.89: Registering V4L2 extension [ 1663.034573][ T7881] usb 7-1: USB disconnect, device number 46 [ 1663.064242][ T7881] em28xx 7-1:0.89: Disconnecting em28xx [ 1663.217360][T15751] em28xx 7-1:0.89: Config register raw data: 0xffffffed [ 1663.376105][T15751] em28xx 7-1:0.89: AC97 chip type couldn't be determined [ 1663.413690][T15751] em28xx 7-1:0.89: No AC97 audio processor [ 1663.432736][T15751] usb 7-1: Decoder not found [ 1663.684760][ T7883] usb 3-1: new high-speed USB device number 43 using dummy_hcd [ 1663.757081][T15751] em28xx 7-1:0.89: failed to create media graph [ 1663.889004][ T7883] usb 3-1: New USB device found, idVendor=2304, idProduct=023e, bcdDevice=d7.69 [ 1663.899375][ T7883] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1663.919628][ T7883] usb 3-1: Product: syz [ 1663.925264][T15751] em28xx 7-1:0.89: V4L2 device video103 deregistered [ 1664.007834][T15751] em28xx 7-1:0.89: Registering snapshot button... [ 1664.015314][ T7883] usb 3-1: Manufacturer: syz [ 1664.024963][T15751] input: em28xx snapshot button as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.89/input/input262 [ 1664.039756][T15751] em28xx 7-1:0.89: Remote control support is not available for this card. [ 1664.050476][ T7881] em28xx 7-1:0.89: Closing input extension [ 1664.388524][ T7881] em28xx 7-1:0.89: Deregistering snapshot button [ 1664.398644][ T7883] usb 3-1: SerialNumber: syz [ 1664.470793][ T7881] em28xx 7-1:0.89: Freeing device [ 1664.544440][ T7883] usb 3-1: config 0 descriptor?? [ 1664.548093][T25980] input: syz0 as /devices/virtual/input/input263 [ 1664.558049][ T7883] hub 3-1:0.0: bad descriptor, ignoring hub [ 1664.581577][ T7883] hub 3-1:0.0: probe with driver hub failed with error -5 [ 1664.865296][T25987] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4749'. [ 1665.056661][ T7881] usb 6-1: new high-speed USB device number 76 using dummy_hcd [ 1665.313895][ T7881] usb 6-1: Using ep0 maxpacket: 32 [ 1665.321926][ T7881] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1665.433645][ T7881] usb 6-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1665.501975][ T7881] usb 6-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 1665.604674][ T7881] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1665.801448][T25995] netlink: 1 bytes leftover after parsing attributes in process `syz.6.4753'. [ 1665.816842][T25995] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1665.875094][ T7881] usb 6-1: config 0 descriptor?? [ 1665.934307][ T7881] hub 6-1:0.0: bad descriptor, ignoring hub [ 1665.980803][ T7881] hub 6-1:0.0: probe with driver hub failed with error -5 [ 1666.014888][ T7881] usbhid 6-1:0.0: couldn't find an input interrupt endpoint [ 1666.487156][ T7883] dvb-usb: found a 'Pinnacle PCTV Hybrid Stick Solo' in cold state, will try to load a firmware [ 1666.514734][ T7883] dvb-usb: downloading firmware from file 'dvb-usb-dib0700-1.20.fw' [ 1666.550145][ T7883] dib0700: firmware download failed at 7 with -22 [ 1666.684993][ T7883] usb 3-1: USB disconnect, device number 43 [ 1668.378840][ T7882] usb 6-1: USB disconnect, device number 76 [ 1668.447012][ T7883] usb 2-1: new high-speed USB device number 46 using dummy_hcd [ 1668.614406][ T7883] usb 2-1: Using ep0 maxpacket: 32 [ 1668.621410][ T7883] usb 2-1: config 0 has an invalid interface number: 89 but max is 0 [ 1668.629669][ T7883] usb 2-1: config 0 has no interface number 0 [ 1668.639351][ T7883] usb 2-1: config 0 interface 89 has no altsetting 0 [ 1668.669420][T26036] input: syz0 as /devices/virtual/input/input264 [ 1668.724947][ T1303] ieee802154 phy0 wpan0: encryption failed: -22 [ 1668.731856][ T1303] ieee802154 phy1 wpan1: encryption failed: -22 [ 1668.745074][ T7883] usb 2-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4e [ 1668.754785][ T7883] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1668.762891][ T7883] usb 2-1: Product: syz [ 1668.768181][ T7883] usb 2-1: Manufacturer: syz [ 1668.773496][ T7883] usb 2-1: SerialNumber: syz [ 1668.786914][ T7883] usb 2-1: config 0 descriptor?? [ 1668.827591][ T7883] em28xx 2-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 1668.977956][ T7883] em28xx 2-1:0.89: Video interface 89 found: bulk [ 1669.104396][ T5880] usb 3-1: new high-speed USB device number 44 using dummy_hcd [ 1669.414464][ T5880] usb 3-1: Using ep0 maxpacket: 16 [ 1669.512688][ T5880] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0xC has invalid wMaxPacketSize 0 [ 1669.523576][ T5880] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8 has invalid wMaxPacketSize 0 [ 1669.558768][ T5880] usb 3-1: New USB device found, idVendor=0bfd, idProduct=0121, bcdDevice= 6.c9 [ 1669.590710][ T5880] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1669.744371][ T5880] usb 3-1: Product: syz [ 1669.758920][ T5880] usb 3-1: Manufacturer: syz [ 1669.762461][ T7883] em28xx 2-1:0.89: unknown em28xx chip ID (0) [ 1669.763563][ T5880] usb 3-1: SerialNumber: syz [ 1669.802718][ T5880] usb 3-1: config 0 descriptor?? [ 1669.816166][ T5880] kvaser_usb 3-1:0.0: error -ENODEV: Cannot get usb endpoint(s) [ 1670.386358][T26052] input: syz0 as /devices/virtual/input/input265 [ 1670.625765][T26015] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1670.635718][T26015] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1671.093656][ T7883] em28xx 2-1:0.89: read from i2c device at 0xa0 failed with unknown error (status=145) [ 1671.107484][ T7883] em28xx 2-1:0.89: board has no eeprom [ 1672.116485][ T7901] usb 3-1: USB disconnect, device number 44 [ 1672.201982][ T7883] em28xx 2-1:0.89: Identified as Terratec Grabby (card=67) [ 1672.283708][ T7883] em28xx 2-1:0.89: analog set to bulk mode. [ 1672.295409][ T7882] em28xx 2-1:0.89: Registering V4L2 extension [ 1672.331391][ T7883] usb 2-1: USB disconnect, device number 46 [ 1672.362293][ T7883] em28xx 2-1:0.89: Disconnecting em28xx [ 1672.499792][ T7882] em28xx 2-1:0.89: Config register raw data: 0xffffffed [ 1672.540282][ T7882] em28xx 2-1:0.89: AC97 chip type couldn't be determined [ 1672.759516][ T7882] em28xx 2-1:0.89: No AC97 audio processor [ 1672.835419][ T7882] usb 2-1: Decoder not found [ 1672.845228][ T7882] em28xx 2-1:0.89: failed to create media graph [ 1672.999205][ T7882] em28xx 2-1:0.89: V4L2 device video103 deregistered [ 1673.092834][ T7882] em28xx 2-1:0.89: Registering snapshot button... [ 1673.466128][ T7882] input: em28xx snapshot button as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.89/input/input266 [ 1673.591774][ T7882] em28xx 2-1:0.89: Remote control support is not available for this card. [ 1673.749316][ T7883] em28xx 2-1:0.89: Closing input extension [ 1673.868188][ T7883] em28xx 2-1:0.89: Deregistering snapshot button [ 1673.986996][ T7883] em28xx 2-1:0.89: Freeing device [ 1674.337102][ T7883] usb 2-1: new high-speed USB device number 47 using dummy_hcd [ 1674.591857][T26117] netlink: 'syz.5.4777': attribute type 22 has an invalid length. [ 1674.680218][ T7883] usb 2-1: Using ep0 maxpacket: 32 [ 1675.073966][ T7883] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1675.364184][ T7883] usb 2-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1675.402149][ T7883] usb 2-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 1675.510221][ T7883] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1675.625970][ T7883] usb 2-1: config 0 descriptor?? [ 1677.790202][ T7882] usb 7-1: new high-speed USB device number 47 using dummy_hcd [ 1678.103941][ T7882] usb 7-1: Using ep0 maxpacket: 16 [ 1678.711209][ T7882] usb 7-1: unable to read config index 0 descriptor/all [ 1678.996105][ T7882] usb 7-1: can't read configurations, error -71 [ 1679.446492][ T7883] usb 2-1: can't set config #0, error -71 [ 1679.554416][T26136] input: syz0 as /devices/virtual/input/input267 [ 1679.905295][ T7883] usb 2-1: USB disconnect, device number 47 [ 1683.384126][T19246] usb 7-1: new high-speed USB device number 49 using dummy_hcd [ 1683.471104][T26144] fuse: Unknown parameter 'u00000000000000000000' [ 1684.104191][T19246] usb 7-1: Using ep0 maxpacket: 32 [ 1684.516695][T19246] usb 7-1: config 0 has an invalid interface number: 89 but max is 0 [ 1684.554545][T19246] usb 7-1: config 0 has no interface number 0 [ 1684.560688][T19246] usb 7-1: config 0 interface 89 has no altsetting 0 [ 1684.965251][T19246] usb 7-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4e [ 1685.014556][T19246] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1685.396971][T19246] usb 7-1: Product: syz [ 1685.401176][T19246] usb 7-1: Manufacturer: syz [ 1685.479315][T19246] usb 7-1: SerialNumber: syz [ 1685.534838][T19246] usb 7-1: config 0 descriptor?? [ 1685.710806][T19246] usb 7-1: can't set config #0, error -71 [ 1685.794471][T19246] usb 7-1: USB disconnect, device number 49 [ 1687.053878][T19246] usb 7-1: new high-speed USB device number 50 using dummy_hcd [ 1687.912769][T19246] usb 7-1: New USB device found, idVendor=2304, idProduct=023e, bcdDevice=d7.69 [ 1688.074212][T19246] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1688.101733][T19246] usb 7-1: Product: syz [ 1688.116363][T19246] usb 7-1: Manufacturer: syz [ 1688.269138][T19246] usb 7-1: SerialNumber: syz [ 1688.305552][T19246] usb 7-1: config 0 descriptor?? [ 1688.463718][T19246] hub 7-1:0.0: bad descriptor, ignoring hub [ 1688.469800][T19246] hub 7-1:0.0: probe with driver hub failed with error -5 [ 1693.651459][T19246] dvb-usb: found a 'Pinnacle PCTV Hybrid Stick Solo' in cold state, will try to load a firmware [ 1693.734774][T26190] netlink: 44 bytes leftover after parsing attributes in process `syz.1.4791'. [ 1693.751906][T19246] dvb-usb: downloading firmware from file 'dvb-usb-dib0700-1.20.fw' [ 1694.845265][T19246] dib0700: firmware download failed at 7 with -22 [ 1697.783936][ T7879] usb 3-1: new high-speed USB device number 45 using dummy_hcd [ 1698.348232][ T7879] usb 3-1: New USB device found, idVendor=2304, idProduct=023e, bcdDevice=d7.69 [ 1698.357599][ T7879] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1698.593922][ T7879] usb 3-1: Product: syz [ 1698.770450][T15751] usb 7-1: USB disconnect, device number 50 [ 1701.883781][ C1] sched: DL replenish lagged too much [ 1714.053975][ T7879] usb 3-1: Manufacturer: syz [ 1714.058629][ T7879] usb 3-1: SerialNumber: syz [ 1730.288482][ T1303] ieee802154 phy0 wpan0: encryption failed: -22 [ 1730.471528][ T1303] ieee802154 phy1 wpan1: encryption failed: -22 [ 1801.954469][ T1303] ieee802154 phy0 wpan0: encryption failed: -22 [ 1801.969154][ T1303] ieee802154 phy1 wpan1: encryption failed: -22 [ 1803.393772][ C0] rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: [ 1803.400764][ C0] rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P26200/1:b..l [ 1803.409343][ C0] rcu: (detected by 0, t=10503 jiffies, g=176161, q=771 ncpus=2) [ 1803.417166][ C0] task:syz.1.4792 state:R running task stack:24936 pid:26200 tgid:26198 ppid:18395 task_flags:0x20400040 flags:0x10080000 [ 1803.432040][ C0] Call Trace: [ 1803.435332][ C0] [ 1803.438272][ C0] __schedule+0x1798/0x4cc0 [ 1803.442816][ C0] ? __pfx___schedule+0x10/0x10 [ 1803.447701][ C0] ? preempt_schedule_irq+0xaa/0x150 [ 1803.453098][ C0] preempt_schedule_irq+0xb5/0x150 [ 1803.458223][ C0] ? __pfx_preempt_schedule_irq+0x10/0x10 [ 1803.463965][ C0] ? rcu_irq_exit_check_preempt+0xdf/0x210 [ 1803.469785][ C0] irqentry_exit+0x6f/0x90 [ 1803.474205][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1803.480191][ C0] RIP: 0010:unwind_next_frame+0x99/0x2390 [ 1803.485924][ C0] Code: c1 ec 03 41 0f b6 04 2c 84 c0 0f 85 de 1b 00 00 41 8b 06 85 c0 0f 84 32 02 00 00 89 84 24 84 00 00 00 4c 89 bc 24 90 00 00 00 42 7a 33 00 4c 8d 3d 00 00 00 00 48 c7 c7 e0 d2 13 8e 31 f6 31 [ 1803.505534][ C0] RSP: 0018:ffffc9000be66a18 EFLAGS: 00000202 [ 1803.511610][ C0] RAX: 0000000000000001 RBX: ffffffff81ac6c7c RCX: aa6466d4a8f1f900 [ 1803.519587][ C0] RDX: dffffc0000000000 RSI: ffffffff81ac6c7c RDI: ffffc9000be66ae8 [ 1803.527565][ C0] RBP: dffffc0000000000 R08: ffffc9000be66bb0 R09: 0000000000000000 [ 1803.535539][ C0] R10: ffffc9000be66b38 R11: ffffffff81ac6cd0 R12: 1ffff920017ccd5d [ 1803.543512][ C0] R13: ffffc9000be66b20 R14: ffffc9000be66ae8 R15: ffffc9000be66b80 [ 1803.551492][ C0] ? stack_trace_save+0x9c/0xe0 [ 1803.556352][ C0] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 1803.562512][ C0] ? stack_trace_save+0x9c/0xe0 [ 1803.567371][ C0] ? arch_stack_walk+0xe4/0x150 [ 1803.572241][ C0] ? __unwind_start+0x5b9/0x760 [ 1803.577103][ C0] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 1803.583260][ C0] arch_stack_walk+0x11c/0x150 [ 1803.588039][ C0] ? stack_trace_save+0x9c/0xe0 [ 1803.592898][ C0] stack_trace_save+0x9c/0xe0 [ 1803.597575][ C0] ? __pfx_stack_trace_save+0x10/0x10 [ 1803.602963][ C0] kasan_save_track+0x3e/0x80 [ 1803.607698][ C0] __kasan_kmalloc+0x93/0xb0 [ 1803.612296][ C0] __kmalloc_cache_noprof+0x3d5/0x6f0 [ 1803.617676][ C0] ? kmem_cache_free+0x16f/0x690 [ 1803.622620][ C0] ? __phys_addr+0xd3/0x180 [ 1803.627133][ C0] ? blk_update_request+0x57e/0xe60 [ 1803.632344][ C0] kmem_cache_free+0x16f/0x690 [ 1803.637113][ C0] ? bio_put+0x92/0x820 [ 1803.641274][ C0] ? mempool_free+0x9b/0x6a0 [ 1803.645880][ C0] blk_update_request+0x57e/0xe60 [ 1803.650926][ C0] blk_mq_end_request+0x3e/0x70 [ 1803.655785][ C0] null_queue_rq+0xbfe/0xe30 [ 1803.660404][ C0] null_queue_rqs+0x123/0x270 [ 1803.665097][ C0] ? blk_mq_dispatch_queue_requests+0x11a/0x800 [ 1803.671348][ C0] blk_mq_dispatch_queue_requests+0x417/0x800 [ 1803.677431][ C0] blk_mq_flush_plug_list+0x432/0x550 [ 1803.683068][ C0] ? blk_add_rq_to_plug+0x300/0x450 [ 1803.688277][ C0] ? blk_mq_submit_bio+0x1a65/0x25b0 [ 1803.693565][ C0] ? __pfx_blk_mq_flush_plug_list+0x10/0x10 [ 1803.699477][ C0] __blk_flush_plug+0x3d3/0x4b0 [ 1803.704342][ C0] ? __pfx___blk_flush_plug+0x10/0x10 [ 1803.709730][ C0] __submit_bio+0x2d3/0x5a0 [ 1803.714244][ C0] ? __pfx___submit_bio+0x10/0x10 [ 1803.719270][ C0] ? blk_cgroup_bio_start+0x59d/0x640 [ 1803.724668][ C0] submit_bio_noacct_nocheck+0x2fb/0xa50 [ 1803.730305][ C0] ? bio_associate_blkg+0x6d/0x230 [ 1803.735429][ C0] ? __pfx_submit_bio_noacct_nocheck+0x10/0x10 [ 1803.741591][ C0] ? submit_bio_noacct+0xe0c/0x1b80 [ 1803.746813][ C0] block_read_full_folio+0x599/0x830 [ 1803.752115][ C0] ? __pfx_blkdev_get_block+0x10/0x10 [ 1803.757503][ C0] filemap_read_folio+0x117/0x380 [ 1803.762544][ C0] ? __pfx_blkdev_read_folio+0x10/0x10 [ 1803.768011][ C0] ? __pfx_filemap_read_folio+0x10/0x10 [ 1803.773574][ C0] ? down_read+0x1ad/0x2e0 [ 1803.777998][ C0] filemap_get_pages+0x1690/0x1de0 [ 1803.783154][ C0] ? lockdep_hardirqs_on+0x9c/0x150 [ 1803.788383][ C0] ? __pfx_filemap_get_pages+0x10/0x10 [ 1803.793858][ C0] ? __pfx___might_resched+0x10/0x10 [ 1803.799167][ C0] filemap_read+0x3f6/0x11a0 [ 1803.803765][ C0] ? aa_file_perm+0x13a/0x1550 [ 1803.808556][ C0] ? __pfx_filemap_read+0x10/0x10 [ 1803.813617][ C0] ? down_read+0x1ad/0x2e0 [ 1803.818042][ C0] blkdev_read_iter+0x30a/0x440 [ 1803.822907][ C0] vfs_read+0x55a/0xa30 [ 1803.827079][ C0] ? __pfx_vfs_read+0x10/0x10 [ 1803.831772][ C0] ? __fget_files+0x2a/0x420 [ 1803.836377][ C0] ksys_read+0x145/0x250 [ 1803.840624][ C0] ? __pfx_ksys_read+0x10/0x10 [ 1803.845393][ C0] ? syscall_enter_from_user_mode_prepare+0x8f/0x110 [ 1803.852074][ C0] ? lockdep_hardirqs_on+0x9c/0x150 [ 1803.857281][ C0] __do_fast_syscall_32+0xb6/0x2b0 [ 1803.862408][ C0] do_fast_syscall_32+0x34/0x80 [ 1803.867266][ C0] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1803.873602][ C0] RIP: 0023:0xf70dd539 [ 1803.877670][ C0] RSP: 002b:00000000f54ac55c EFLAGS: 00000206 ORIG_RAX: 0000000000000003 [ 1803.886092][ C0] RAX: ffffffffffffffda RBX: 000000000000000a RCX: 0000000080003780 [ 1803.894062][ C0] RDX: 0000000000002020 RSI: 0000000000000000 RDI: 0000000000000000 [ 1803.902032][ C0] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1803.910001][ C0] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1803.917972][ C0] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1803.925969][ C0] [ 1803.928996][ C0] rcu: rcu_preempt kthread starved for 2463 jiffies! g176161 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402 ->cpu=1 [ 1803.940389][ C0] rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior. [ 1803.950353][ C0] rcu: RCU grace-period kthread stack dump: [ 1803.956236][ C0] task:rcu_preempt state:I stack:26056 pid:16 tgid:16 ppid:2 task_flags:0x208040 flags:0x00080000 [ 1803.968166][ C0] Call Trace: [ 1803.971444][ C0] [ 1803.974380][ C0] __schedule+0x1798/0x4cc0 [ 1803.978917][ C0] ? __pfx___schedule+0x10/0x10 [ 1803.983777][ C0] ? __lock_acquire+0xab9/0xd20 [ 1803.988646][ C0] ? preempt_schedule_irq+0xaa/0x150 [ 1803.993936][ C0] preempt_schedule_irq+0xb5/0x150 [ 1803.999051][ C0] ? __pfx_preempt_schedule_irq+0x10/0x10 [ 1804.004779][ C0] ? rcu_irq_exit_check_preempt+0xdf/0x210 [ 1804.010597][ C0] irqentry_exit+0x6f/0x90 [ 1804.015015][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1804.021000][ C0] RIP: 0010:timer_init_key_on_stack+0x13/0x110 [ 1804.027160][ C0] Code: 09 cc 0f 1f 44 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 55 41 57 41 56 41 55 41 54 53 50 4c 89 04 24 <49> 89 ce 89 d5 49 89 f4 49 89 ff 48 bb 00 00 00 00 00 fc ff df e8 [ 1804.046774][ C0] RSP: 0018:ffffc90000157a00 EFLAGS: 00000246 [ 1804.052849][ C0] RAX: ffff88801c2c5ac0 RBX: 0000000100024133 RCX: ffffffff8b6d0c80 [ 1804.060828][ C0] RDX: 0000000000000000 RSI: ffffffff81ae2280 RDI: ffffc90000157a60 [ 1804.068802][ C0] RBP: ffffc90000157b30 R08: ffffffff99a0c380 R09: 0000000000000000 [ 1804.076778][ C0] R10: ffffc90000157a60 R11: fffff5200002af56 R12: 1ffff9200002af48 [ 1804.084754][ C0] R13: 1ffffffff1bc2240 R14: ffffc90000157a60 R15: dffffc0000000000 [ 1804.092737][ C0] ? __pfx_process_timeout+0x10/0x10 [ 1804.098045][ C0] schedule_timeout+0x119/0x270 [ 1804.102905][ C0] ? __pfx_schedule_timeout+0x10/0x10 [ 1804.108285][ C0] ? _raw_spin_unlock_irqrestore+0x85/0x110 [ 1804.114196][ C0] ? prepare_to_swait_event+0x341/0x380 [ 1804.119757][ C0] rcu_gp_fqs_loop+0x301/0x1540 [ 1804.124626][ C0] ? lockdep_hardirqs_on+0x9c/0x150 [ 1804.129825][ C0] ? __pfx_rcu_watching_snap_recheck+0x10/0x10 [ 1804.135992][ C0] ? __pfx_rcu_gp_fqs_loop+0x10/0x10 [ 1804.141285][ C0] ? _raw_spin_unlock_irq+0x2e/0x50 [ 1804.146501][ C0] ? finish_swait+0xcd/0x1f0 [ 1804.151099][ C0] rcu_gp_kthread+0x99/0x390 [ 1804.155699][ C0] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 1804.160906][ C0] ? __kthread_parkme+0x7b/0x200 [ 1804.165855][ C0] ? __kthread_parkme+0x1a1/0x200 [ 1804.170899][ C0] kthread+0x711/0x8a0 [ 1804.174980][ C0] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 1804.180183][ C0] ? __pfx_kthread+0x10/0x10 [ 1804.184780][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 1804.189988][ C0] ? lockdep_hardirqs_on+0x9c/0x150 [ 1804.195188][ C0] ? __pfx_kthread+0x10/0x10 [ 1804.199784][ C0] ret_from_fork+0x4bc/0x870 [ 1804.204387][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 1804.209511][ C0] ? __switch_to_asm+0x39/0x70 [ 1804.214284][ C0] ? __switch_to_asm+0x33/0x70 [ 1804.219050][ C0] ? __pfx_kthread+0x10/0x10 [ 1804.223642][ C0] ret_from_fork_asm+0x1a/0x30 [ 1804.228426][ C0] [ 1804.231444][ C0] rcu: Stack dump where RCU GP kthread last ran: [ 1804.237772][ C0] Sending NMI from CPU 0 to CPUs 1: [ 1804.242983][ C1] NMI backtrace for cpu 1 [ 1804.243002][ C1] CPU: 1 UID: 0 PID: 26212 Comm: kworker/u8:6 Not tainted syzkaller #0 PREEMPT(full) [ 1804.243040][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1804.243063][ C1] Workqueue: wg-kex-wg0 wg_packet_handshake_send_worker [ 1804.243101][ C1] RIP: 0010:__rcu_read_unlock+0x63/0xe0 [ 1804.243140][ C1] Code: 75 1d 4c 8d b7 88 04 00 00 4c 89 f0 48 c1 e8 03 42 0f b6 04 38 84 c0 75 66 41 83 3e 00 75 27 43 0f b6 04 3c 84 c0 75 41 8b 03 <3d> 00 00 00 40 73 0f 5b 41 5c 41 5d 41 5e 41 5f e9 58 ac a7 09 cc [ 1804.243169][ C1] RSP: 0018:ffffc90000a07da8 EFLAGS: 00000246 [ 1804.243197][ C1] RAX: 0000000000000002 RBX: ffff88802660a2c4 RCX: dbfd35a4452d6600 [ 1804.243221][ C1] RDX: 0000000000000004 RSI: ffffffff8d9d1546 RDI: ffff888026609e40 [ 1804.243232][ C1] RBP: dffffc0000000000 R08: ffffc90000a08220 R09: 0000000000000000 [ 1804.243244][ C1] R10: ffffc90000a07ef8 R11: fffff52000140fe1 R12: 1ffff11004cc1458 [ 1804.243257][ C1] R13: ffffc90000a01000 R14: ffffc90000a07ea8 R15: dffffc0000000000 [ 1804.243270][ C1] FS: 0000000000000000(0000) GS:ffff888125e0c000(0000) knlGS:0000000000000000 [ 1804.243284][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1804.243296][ C1] CR2: 00000000f73d6250 CR3: 000000005683a000 CR4: 00000000003526f0 [ 1804.243311][ C1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1804.243321][ C1] DR3: 000000000000000e DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 1804.243332][ C1] Call Trace: [ 1804.243339][ C1] [ 1804.243347][ C1] ? unwind_next_frame+0xa5/0x2390 [ 1804.243368][ C1] unwind_next_frame+0x19ae/0x2390 [ 1804.243392][ C1] ? unwind_next_frame+0xa5/0x2390 [ 1804.243413][ C1] ? kasan_save_track+0x3e/0x80 [ 1804.243432][ C1] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 1804.243449][ C1] arch_stack_walk+0x11c/0x150 [ 1804.243474][ C1] ? __kasan_save_free_info+0x46/0x50 [ 1804.243497][ C1] stack_trace_save+0x9c/0xe0 [ 1804.243512][ C1] ? __pfx_stack_trace_save+0x10/0x10 [ 1804.243527][ C1] ? __kasan_save_free_info+0x46/0x50 [ 1804.243549][ C1] ? consume_skb+0x9e/0xf0 [ 1804.243568][ C1] ? nft_synproxy_eval_v4+0x376/0x560 [ 1804.243586][ C1] ? nft_synproxy_do_eval+0x345/0x570 [ 1804.243604][ C1] ? __lock_acquire+0xab9/0xd20 [ 1804.243623][ C1] kasan_save_track+0x3e/0x80 [ 1804.243639][ C1] ? kasan_save_track+0x3e/0x80 [ 1804.243679][ C1] ? nft_synproxy_eval_v4+0x376/0x560 [ 1804.243695][ C1] __kasan_save_free_info+0x46/0x50 [ 1804.243716][ C1] __kasan_slab_free+0x5c/0x80 [ 1804.243733][ C1] kmem_cache_free+0x19b/0x690 [ 1804.243758][ C1] nft_synproxy_eval_v4+0x376/0x560 [ 1804.243778][ C1] ? __pfx_nft_synproxy_eval_v4+0x10/0x10 [ 1804.243796][ C1] ? nf_ip_checksum+0x13c/0x510 [ 1804.243815][ C1] nft_synproxy_do_eval+0x345/0x570 [ 1804.243834][ C1] ? __pfx_nft_synproxy_do_eval+0x10/0x10 [ 1804.243851][ C1] ? __pfx___ip_vs_conn_in_get+0x10/0x10 [ 1804.243870][ C1] ? ip_vs_conn_out_get+0xa16/0xa70 [ 1804.243892][ C1] nft_do_chain+0x40c/0x1920 [ 1804.243916][ C1] ? __pfx_nft_do_chain+0x10/0x10 [ 1804.243946][ C1] ? __pfx_nf_nat_inet_fn+0x10/0x10 [ 1804.243965][ C1] nft_do_chain_inet+0x25d/0x340 [ 1804.243982][ C1] ? __pfx_nft_do_chain_inet+0x10/0x10 [ 1804.244002][ C1] ? nf_nat_ipv4_local_in+0x223/0x720 [ 1804.244023][ C1] ? __pfx_nft_do_chain_inet+0x10/0x10 [ 1804.244040][ C1] nf_hook_slow+0xc5/0x220 [ 1804.244063][ C1] NF_HOOK+0x206/0x3a0 [ 1804.244084][ C1] ? __pfx_ip_local_deliver_finish+0x10/0x10 [ 1804.244105][ C1] ? NF_HOOK+0x9a/0x3a0 [ 1804.244124][ C1] ? __pfx_NF_HOOK+0x10/0x10 [ 1804.244143][ C1] ? ip_rcv_finish_core+0xda3/0x1c00 [ 1804.244165][ C1] ? __pfx_ip_local_deliver_finish+0x10/0x10 [ 1804.244187][ C1] ? skb_dst+0x4f/0xd0 [ 1804.244207][ C1] ? ip_local_deliver+0x12a/0x1b0 [ 1804.244234][ C1] NF_HOOK+0x30c/0x3a0 [ 1804.244255][ C1] ? __pfx_ip_rcv_finish+0x10/0x10 [ 1804.244274][ C1] ? NF_HOOK+0x9a/0x3a0 [ 1804.244293][ C1] ? __pfx_NF_HOOK+0x10/0x10 [ 1804.244312][ C1] ? ip_rcv_core+0x7f7/0xd00 [ 1804.244332][ C1] ? __pfx_ip_rcv_finish+0x10/0x10 [ 1804.244357][ C1] ? __pfx_ip_rcv+0x10/0x10 [ 1804.244376][ C1] __netif_receive_skb+0x143/0x380 [ 1804.244396][ C1] ? process_backlog+0x2d5/0x14f0 [ 1804.244416][ C1] process_backlog+0x60e/0x14f0 [ 1804.244442][ C1] ? __pfx_process_backlog+0x10/0x10 [ 1804.244465][ C1] __napi_poll+0xc7/0x360 [ 1804.244482][ C1] ? skb_defer_free_flush+0x229/0x250 [ 1804.244501][ C1] net_rx_action+0x5f7/0xdf0 [ 1804.244518][ C1] ? lockdep_hardirqs_on+0x9c/0x150 [ 1804.244534][ C1] ? _raw_spin_unlock_irq+0x2e/0x50 [ 1804.244559][ C1] ? __pfx_net_rx_action+0x10/0x10 [ 1804.244594][ C1] handle_softirqs+0x286/0x870 [ 1804.244615][ C1] ? do_softirq+0xec/0x180 [ 1804.244636][ C1] ? __pfx_handle_softirqs+0x10/0x10 [ 1804.244658][ C1] ? mod_peer_timer+0x21/0x260 [ 1804.244673][ C1] do_softirq+0xec/0x180 [ 1804.244690][ C1] [ 1804.244696][ C1] [ 1804.244703][ C1] ? __pfx_do_softirq+0x10/0x10 [ 1804.244725][ C1] ? lockdep_softirqs_on+0x13b/0x1c0 [ 1804.244744][ C1] __local_bh_enable_ip+0x17d/0x1c0 [ 1804.244763][ C1] ? __pfx___local_bh_enable_ip+0x10/0x10 [ 1804.244782][ C1] ? mod_peer_timer+0x21/0x260 [ 1804.244797][ C1] ? mod_peer_timer+0x20c/0x260 [ 1804.244813][ C1] wg_packet_handshake_send_worker+0x184/0x320 [ 1804.244832][ C1] ? __pfx_wg_packet_handshake_send_worker+0x10/0x10 [ 1804.244859][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 1804.244878][ C1] ? process_scheduled_works+0x9ef/0x17b0 [ 1804.244897][ C1] ? process_scheduled_works+0x9ef/0x17b0 [ 1804.244917][ C1] process_scheduled_works+0xae1/0x17b0 [ 1804.244950][ C1] ? __pfx_process_scheduled_works+0x10/0x10 [ 1804.244977][ C1] worker_thread+0x8a0/0xda0 [ 1804.245009][ C1] kthread+0x711/0x8a0 [ 1804.245025][ C1] ? __pfx_worker_thread+0x10/0x10 [ 1804.245045][ C1] ? __pfx_kthread+0x10/0x10 [ 1804.245061][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 1804.245080][ C1] ? lockdep_hardirqs_on+0x9c/0x150 [ 1804.245094][ C1] ? __pfx_kthread+0x10/0x10 [ 1804.245109][ C1] ret_from_fork+0x4bc/0x870 [ 1804.245130][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 1804.245152][ C1] ? __switch_to_asm+0x39/0x70 [ 1804.245169][ C1] ? __switch_to_asm+0x33/0x70 [ 1804.245185][ C1] ? __pfx_kthread+0x10/0x10 [ 1804.245201][ C1] ret_from_fork_asm+0x1a/0x30 [ 1804.245230][ C1] [ 1810.671834][ T5198] udevd[5198]: worker [17515] /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0 is taking a long time