last executing test programs: 1m55.754962057s ago: executing program 3 (id=2086): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x20, 0x25, 0x301, 0x670bd24, 0x25dfdbff, {0x15}, [@typed={0xa, 0x15e, 0x0, 0x0, @binary="f81c4442d16b"}]}, 0x20}, 0x1, 0x0, 0x0, 0x40008840}, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000240)={0x1, &(0x7f0000000000)=[{0x6, 0x85, 0x7, 0x7ffc0001}]}) setregid(0x0, 0x0) (async) r1 = socket$pppl2tp(0x18, 0x1, 0x1) (async) ioctl$vim2m_VIDIOC_QUERYCAP(0xffffffffffffffff, 0x80685600, &(0x7f0000000240)) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e) close(0x3) (async) r3 = memfd_create(&(0x7f00000000c0)='-B\xd5N4\xa6Ey\xdb\xd1\xa7\xb1S\xf1:)\x00\x8a\xd7Uw\x00\xbc\xa92\xb3\xbb\x8d\xac\xacva}knh#\xcf)\x0f\xc8\xc0:\x9cc\x10d\xee\xa9\x8b\x066\xb8G\xd1c\xe1$\xff\x97\x8f~\xb90a\xa9\xb2\x04K\x98\x93=\xabQ\xf7\x19\xea\xef\xe3\xe1@\x84\x13\xefZb:\x8f\t\x01B\xec\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@Ip]D\xd6\r\xac\v#co\xd5\xb9\xc806\xa8\x99\xffs7\xa1b1\xb1;i)j\x0e\x1e\xedI\xa2\x80\x89\x1d\xd9p!\xc86s\xe07(\xee\xf9<\"\xf0\xc8\xae\x96J\xe2]\x01\x86\xb7.<\xf5N\xd3\x94W1\xff\x18z>\xa7q,\xf7\x96\xb8{\x8e\xbf4\xe0\x95\x1ce\xe4\x85\xcdi\xed\xd3>\xeb\xa5\xaf\x87\x90@\xd1\xbd`^\xfa\xb6\x9cj\x13/\xc5\\W\x04\br\x17X\xe3\xfb\xc8\xd4\xaeX\xc9s\xd18\xd9L\xbf\xa0\xa6\xdf2\a\x99i\xb1/\x19@\x1cq\xeb?\xc1z:\x913\xfa8\xac\xd3q\xe4vPGU', 0x1) r4 = dup(r3) write$binfmt_elf32(r4, &(0x7f00000013c0)={{0x7f, 0x45, 0x4c, 0x46, 0x4a, 0x3, 0x1, 0x1, 0x5, 0x2, 0x3, 0x4, 0x33e, 0x38, 0xd6, 0x7097, 0x3fe, 0x20, 0x1, 0x8007, 0x8, 0x7}, [{0x3, 0x2, 0x2, 0x400, 0xae9, 0x80000001, 0x49, 0x7}]}, 0x58) (async) r5 = fanotify_init(0x200, 0x0) fanotify_mark(r5, 0x1, 0x8001030, r4, 0x0) execveat(r4, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) (async) r6 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000200), r0) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r7, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001240)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010026bd70000400000507000000080009000200000008000c000000000008000b"], 0x34}}, 0x20) (async) r8 = timerfd_create(0x0, 0x0) ppoll(&(0x7f0000000400)=[{r8, 0x298}], 0x1, 0x0, 0x0, 0x0) ioctl$TFD_IOC_SET_TICKS(r8, 0x40085400, &(0x7f0000000380)=0x66) syz_usb_connect$uac3(0x0, 0xa7, &(0x7f00000000c0)=ANY=[@ANYBLOB="120110010000004063070320400001000000000000000001ffc010080b0002010130070904000000010130000a2401103100120d0000132403ff01040604020600000005007f00800014240202050203ff03000000080008000100000009040100000102300009040101010102300009050109200040d4040a2525060000000104000904020000010230000904020101010230cbb464438bd59df20a020a252500000000055d00"], 0x0) 1m52.620581359s ago: executing program 3 (id=2109): r0 = syz_clone(0x20000011, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) r2 = dup(r1) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f00000001c0)={0x0, 0x4}, 0x8) sendmsg$inet6(r1, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0xb, @loopback, 0x4}, 0x1c, &(0x7f0000000380)=[{&(0x7f00000000c0)="88", 0x1}], 0x1}, 0x48043) pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RSETATTR(r4, &(0x7f0000000000)={0x7, 0x1b, 0x2}, 0x7) splice(r3, 0x0, r1, 0x0, 0x317e, 0x4) write$tun(r2, &(0x7f0000000840)=ANY=[], 0x11b0) waitid(0x0, r0, 0x0, 0x4, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) io_uring_enter(0xffffffffffffffff, 0x2219, 0x771e, 0x16, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) unshare(0x100000) r6 = openat$dir(0xffffffffffffff9c, &(0x7f00000002c0)='.\x00', 0x0, 0x40) getdents64(r6, &(0x7f0000000040)=""/45, 0x2d) getdents(r6, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x3ff}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) ptrace$peekuser(0x3, r0, 0x3) timer_settime(r5, 0x1, &(0x7f0000000040), 0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000000), 0xc6202, 0x0) 1m52.070767237s ago: executing program 3 (id=2114): ioctl$FS_IOC_GETFSMAP(0xffffffffffffffff, 0xc0c0583b, &(0x7f00000001c0)={0x0, 0x0, 0x1, 0x0, '\x00', [{0x2, 0x400, 0x0, 0x101, 0x0, 0x9}, {0x3, 0x80, 0x7fffffff, 0xc, 0x1800000000000000, 0xc79}], ['\x00']}) unshare(0x66000080) r0 = socket$netlink(0x10, 0x3, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100009dea7840b418fbff7bdc010203010902"], 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'macvtap0\x00', 0x0}) r2 = gettid() sendmsg$nl_route(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="2800000010000100000000000000000700000000", @ANYRES32=r1, @ANYBLOB="6d3082610000000008001300", @ANYRES32=r2], 0x28}}, 0x0) 1m50.459262058s ago: executing program 3 (id=2129): socket$unix(0x1, 0x2, 0x0) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x60, &(0x7f0000000080)={'filter\x00', 0x7, 0x4, 0x418, 0x110, 0x220, 0x110, 0x330, 0x330, 0x330, 0x4, 0x0, {[{{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @mac=@dev={'\xaa\xaa\xaa\xaa\xaa', 0xd}, @dev={0xac, 0x14, 0x14, 0x40}, @loopback, 0xf}}}, {{@arp={@rand_addr=0x64010102, @broadcast, 0xff000000, 0x0, 0x4, 0x7, {@empty, {[0xff, 0xff, 0xff, 0x0, 0xff]}}, {@mac, {[0x0, 0x0, 0x0, 0x0, 0xff]}}, 0x2, 0x80, 0x40, 0x2, 0x8, 0x0, 'bridge_slave_0\x00', 'netpci0\x00', {}, {0xff}, 0x0, 0xb8dcc107897441c4}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@broadcast, @empty, @multicast1, @local, 0x8, 0x1}}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@multicast, @mac=@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @multicast1, @initdev={0xac, 0x1e, 0x1, 0x0}, 0x4, 0x1}}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x468) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000900)="580000001400192360834b80043f679a10ff3d420000000001000000f61bcdf1194ad353e9cc853a804824cabece4b381effffffff0057e792945f80000000050028925aaa000000c600000004002e499391db0926f27805", 0x58}], 0x1) socket$nl_xfrm(0x10, 0x3, 0x6) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x400c040) r3 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r3, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_audit(0x10, 0x3, 0x9) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)) socket$nl_generic(0x10, 0x3, 0x10) socket$kcm(0x10, 0x2, 0x0) eventfd(0x3ff) socket$igmp(0x2, 0x3, 0x2) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0, 0xffffffffffffff30}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r4 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) eventfd(0x8c66) io_uring_enter(r4, 0x2219, 0xcf74, 0x16, 0x0, 0x0) syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={0xffffffffffffffff, 0x18000000000002a0, 0x0, 0x0, 0x0, 0x0, 0x501, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x4}, 0x50) socket$inet(0x2, 0x80001, 0x84) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)) connect$inet(r3, 0x0, 0x0) 1m50.07816551s ago: executing program 3 (id=2130): prctl$PR_SET_SECCOMP(0x16, 0x2, 0x0) prlimit64(0x0, 0x7, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) ioctl$TCSETS(0xffffffffffffffff, 0x545c, 0x0) landlock_restrict_self(0xffffffffffffffff, 0xc) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x62181) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r1, 0xc08c5332, &(0x7f00000001c0)={0x0, 0x81, 0x0, 'queue0\x00'}) write$sndseq(r1, 0x0, 0x0) r2 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000018c0), 0xa8c01) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r1, 0x40605346, &(0x7f00000000c0)={0x0, 0x0, {0x3, 0x1, 0x4, 0x3, 0x3ff}, 0x9}) write$sndseq(r2, &(0x7f0000000080)=[{0x1e, 0x0, 0x8, 0xfd, @tick=0x8, {0x0, 0xdc}, {}, @result}], 0x1c) timer_create(0x0, 0x0, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, 0x0, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xb320a000) r3 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) fcntl$lock(r3, 0x410, &(0x7f00000000c0)={0x1, 0x1, 0x1, 0xfffe}) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x7a44, 0x1700) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r4 = syz_clone(0x800000, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r4) timer_create(0x4, 0x0, 0x0) socket$igmp(0x2, 0x3, 0x2) 1m49.387220681s ago: executing program 3 (id=2135): r0 = socket$kcm(0xa, 0x922000000003, 0x11) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000001180), 0x802, 0x0) ioctl$UI_SET_PROPBIT(r1, 0x4004556e, 0x19) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000040)) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x80000a, 0x31, 0xffffffffffffffff, 0xd0fb8000) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={0xffffffffffffffff, 0xfca804a0, 0x0, 0x10, 0x0, &(0x7f0000001500)=""/16, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe4e2288bca9cf3ba, 0x0, 0xfffffffe}, 0x50) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0200000000000000020000000c00000000140000", @ANYRES32, @ANYRES64=r1, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000ddffffff01000800"/28], 0x50) write$P9_RGETATTR(0xffffffffffffffff, &(0x7f0000000200)={0xa0, 0x19, 0x2, {0x200, {0xa0, 0x1, 0x2}, 0x140, 0x0, 0x0, 0x5, 0x8, 0x9, 0x2, 0x8, 0x8ac, 0x0, 0x5, 0x2, 0xffffffffffff885b, 0x7, 0x5, 0x2, 0x6, 0x98}}, 0xa0) r2 = socket$netlink(0x10, 0x3, 0x10) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r2, 0x10e, 0x8, &(0x7f0000000000)=0x2, 0x4) syz_genetlink_get_family_id$tipc(&(0x7f0000000080), r2) r3 = syz_usb_connect(0x0, 0x24, &(0x7f0000000400)=ANY=[@ANYBLOB="12010000e4c5ad101d0620c0159c010203010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r3, 0x0, &(0x7f0000000440)={0x44, &(0x7f0000000340)=ANY=[@ANYBLOB="000003"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r3, 0x0, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x37, [0xfffffff8, 0x8, 0x5, 0x9, 0x8, 0x155f, 0x6, 0x4, 0x25cd, 0x1, 0xb4, 0xa, 0xa2b9, 0x6, 0x7, 0xe4, 0x6, 0xfc000000, 0x3, 0xbbf, 0x4a732f64, 0x1, 0x8, 0xd, 0x0, 0x12a3, 0x6, 0x1, 0x2, 0x6, 0x7, 0x81, 0x8a, 0x79, 0x2, 0x10000, 0x0, 0x91, 0x4, 0x4, 0x16, 0x10, 0x5, 0x401, 0xfffffff5, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0x80000001, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x1, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x9, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0xc66, 0xa8a9, 0x20000073, 0x8e, 0xd50, 0x7, 0x5, 0x2, 0x809, 0x4, 0xa7, 0x1000, 0x0, 0x200b398, 0x400080, 0x1, 0x4, 0x1c, 0x7, 0x1, 0x2, 0x3, 0x8, 0xffffff7f, 0x400, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffffff8, 0x401, 0x46, 0xf1, 0x4, 0xab00060, 0x5, 0x6, 0x2, 0x1, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x1, 0x1cb, 0x1, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x95, 0x7fffffff, 0x4, 0xfffffff9, 0x1, 0x1000, 0xfffff801, 0x5], [0x2, 0xfffffffe, 0xffff, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x7, 0x5, 0x491, 0x8d3, 0x200006, 0x8, 0x400, 0x2, 0x400, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0x8000003, 0x4e, 0x9, 0x3, 0x3, 0x9, 0x3, 0xc7, 0xffe, 0x10000a, 0x2, 0x400, 0x3e55, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0xd, 0x9e9, 0x601, 0x101, 0xdd80, 0x60a0, 0x7f, 0x9d26, 0x10000, 0x1, 0x2, 0x2, 0x6, 0x8000, 0xf47, 0x3, 0xd500, 0x8, 0x77, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0x1], [0xa772, 0x6, 0x5, 0x1afa, 0xbfc, 0x8, 0x5, 0x7f, 0x55, 0x40, 0xff, 0x1005, 0x1, 0x7, 0x1e, 0x9, 0x81, 0x3, 0x9d82, 0xd, 0xfffffff7, 0x8, 0x140f2, 0xf, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0xffffffff, 0x3, 0x1ff, 0x2000803, 0xfffffffc, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x1, 0x26d, 0x6, 0xfffffff9, 0x4, 0xfffffff9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x6, 0x8, 0x14000, 0x1, 0x9]}, 0x45c) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000002c0)={0x1, 0x0, 0x0, &(0x7f0000000000)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0x8}, 0x94) ioctl$KVM_SET_REGS(r7, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x6, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0x7, 0x4, 0x5, 0x4, 0x8], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_GET_SUPPORTED_CPUID(0xffffffffffffffff, 0xc008ae05, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) r8 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r9 = dup(r8) ioctl$KVM_SET_USER_MEMORY_REGION(r8, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) ioctl$KVM_CREATE_VCPU(r9, 0xae41, 0x0) 1m34.000498848s ago: executing program 32 (id=2135): r0 = socket$kcm(0xa, 0x922000000003, 0x11) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000001180), 0x802, 0x0) ioctl$UI_SET_PROPBIT(r1, 0x4004556e, 0x19) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000040)) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x80000a, 0x31, 0xffffffffffffffff, 0xd0fb8000) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={0xffffffffffffffff, 0xfca804a0, 0x0, 0x10, 0x0, &(0x7f0000001500)=""/16, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe4e2288bca9cf3ba, 0x0, 0xfffffffe}, 0x50) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0200000000000000020000000c00000000140000", @ANYRES32, @ANYRES64=r1, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000ddffffff01000800"/28], 0x50) write$P9_RGETATTR(0xffffffffffffffff, &(0x7f0000000200)={0xa0, 0x19, 0x2, {0x200, {0xa0, 0x1, 0x2}, 0x140, 0x0, 0x0, 0x5, 0x8, 0x9, 0x2, 0x8, 0x8ac, 0x0, 0x5, 0x2, 0xffffffffffff885b, 0x7, 0x5, 0x2, 0x6, 0x98}}, 0xa0) r2 = socket$netlink(0x10, 0x3, 0x10) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r2, 0x10e, 0x8, &(0x7f0000000000)=0x2, 0x4) syz_genetlink_get_family_id$tipc(&(0x7f0000000080), r2) r3 = syz_usb_connect(0x0, 0x24, &(0x7f0000000400)=ANY=[@ANYBLOB="12010000e4c5ad101d0620c0159c010203010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r3, 0x0, &(0x7f0000000440)={0x44, &(0x7f0000000340)=ANY=[@ANYBLOB="000003"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r3, 0x0, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x37, [0xfffffff8, 0x8, 0x5, 0x9, 0x8, 0x155f, 0x6, 0x4, 0x25cd, 0x1, 0xb4, 0xa, 0xa2b9, 0x6, 0x7, 0xe4, 0x6, 0xfc000000, 0x3, 0xbbf, 0x4a732f64, 0x1, 0x8, 0xd, 0x0, 0x12a3, 0x6, 0x1, 0x2, 0x6, 0x7, 0x81, 0x8a, 0x79, 0x2, 0x10000, 0x0, 0x91, 0x4, 0x4, 0x16, 0x10, 0x5, 0x401, 0xfffffff5, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0x80000001, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x1, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x9, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0xc66, 0xa8a9, 0x20000073, 0x8e, 0xd50, 0x7, 0x5, 0x2, 0x809, 0x4, 0xa7, 0x1000, 0x0, 0x200b398, 0x400080, 0x1, 0x4, 0x1c, 0x7, 0x1, 0x2, 0x3, 0x8, 0xffffff7f, 0x400, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffffff8, 0x401, 0x46, 0xf1, 0x4, 0xab00060, 0x5, 0x6, 0x2, 0x1, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x1, 0x1cb, 0x1, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x95, 0x7fffffff, 0x4, 0xfffffff9, 0x1, 0x1000, 0xfffff801, 0x5], [0x2, 0xfffffffe, 0xffff, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x7, 0x5, 0x491, 0x8d3, 0x200006, 0x8, 0x400, 0x2, 0x400, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0x8000003, 0x4e, 0x9, 0x3, 0x3, 0x9, 0x3, 0xc7, 0xffe, 0x10000a, 0x2, 0x400, 0x3e55, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0xd, 0x9e9, 0x601, 0x101, 0xdd80, 0x60a0, 0x7f, 0x9d26, 0x10000, 0x1, 0x2, 0x2, 0x6, 0x8000, 0xf47, 0x3, 0xd500, 0x8, 0x77, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0x1], [0xa772, 0x6, 0x5, 0x1afa, 0xbfc, 0x8, 0x5, 0x7f, 0x55, 0x40, 0xff, 0x1005, 0x1, 0x7, 0x1e, 0x9, 0x81, 0x3, 0x9d82, 0xd, 0xfffffff7, 0x8, 0x140f2, 0xf, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0xffffffff, 0x3, 0x1ff, 0x2000803, 0xfffffffc, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x1, 0x26d, 0x6, 0xfffffff9, 0x4, 0xfffffff9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x6, 0x8, 0x14000, 0x1, 0x9]}, 0x45c) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000002c0)={0x1, 0x0, 0x0, &(0x7f0000000000)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0x8}, 0x94) ioctl$KVM_SET_REGS(r7, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x6, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0x7, 0x4, 0x5, 0x4, 0x8], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_GET_SUPPORTED_CPUID(0xffffffffffffffff, 0xc008ae05, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) r8 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r9 = dup(r8) ioctl$KVM_SET_USER_MEMORY_REGION(r8, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) ioctl$KVM_CREATE_VCPU(r9, 0xae41, 0x0) 8.548974023s ago: executing program 0 (id=2698): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x8001, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_TSC_KHZ_vm(r2, 0xaea2, 0x14) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000140)={0x1, 0x0, [{0x10, 0x0, 0x800087}]}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) close(r4) r5 = socket$unix(0x1, 0x5, 0x0) ioctl$TUNSETPERSIST(r4, 0x400454cb, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffb, {0x0, 0x0, 0x0, r6, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x6, 0x6, 0xd21, 0x101, 0x6, 0x5, 0xbd, 0x100, 0x4}}}}]}, 0x58}}, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x1, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x6a855000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) timerfd_create(0x7, 0x80000) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r7 = socket(0x400000000010, 0x3, 0x0) r8 = socket$unix(0x1, 0x1, 0x0) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = socket$nl_route(0x10, 0x3, 0x0) r11 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) copy_file_range(r10, 0x0, r11, 0x0, 0x5, 0x0) recvmmsg(r9, &(0x7f0000003b80)=[{{0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f00000004c0)=""/150, 0x96}, {&(0x7f00000014c0)=""/4096, 0x1000}, {&(0x7f0000000040)=""/25, 0x19}], 0x3}, 0xe9}, {{0x0, 0x0, 0x0}, 0x20e8c0}], 0x2, 0x0, 0x0) sendmsg$nl_generic(r9, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000002b40)=ANY=[@ANYBLOB="200000001000010700000000000000000a0000000c0002006e6c3830323131"], 0x20}}, 0x0) syz_genetlink_get_family_id$devlink(&(0x7f00000001c0), r9) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000540)=@newtfilter={0x87c, 0x2c, 0xd3f, 0x30bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r12, {0xb}, {}, {0x8, 0xa}}, [@filter_kind_options=@f_basic={{0xa}, {0x84c, 0x2, [@TCA_BASIC_POLICE={0x848, 0x4, [@TCA_POLICE_TBF={0x3c, 0x1, {0x9, 0x20000000, 0x9, 0xe, 0x4, {0x1, 0x1, 0x8, 0x1, 0x200, 0x6}, {0x1, 0x2, 0xb5, 0x0, 0x9, 0xe}, 0x8, 0x80, 0x6f8}}, @TCA_POLICE_RATE={0x404, 0x2, [0xffffff8e, 0x8, 0x1ff, 0x7b7e, 0xc0, 0xa, 0x401, 0x4, 0x6, 0x0, 0xd3d, 0x6, 0x2, 0x5, 0x4, 0x6, 0x8e01, 0x6, 0x7, 0x4, 0xea7, 0x31, 0x20000000, 0x8001, 0xfffffffb, 0x100, 0x6, 0x0, 0x0, 0x7, 0xb7, 0x7, 0x2, 0xc6e, 0x400000, 0xf79, 0xec9c, 0x5, 0x6, 0x6, 0x40, 0x401, 0xffffff54, 0x4, 0x3, 0x95, 0xf, 0x9, 0x4, 0xfffffffa, 0x0, 0x3, 0x3, 0x0, 0x100, 0x200, 0x8, 0x2, 0x4, 0x3, 0x4, 0xffffffa8, 0x0, 0x2, 0x47, 0x85ff, 0x9, 0x0, 0x964d, 0x5f, 0x5, 0x1, 0x8d5f, 0x4, 0x80b, 0xffff, 0x2, 0x80000000, 0x384a, 0x8, 0x3, 0x5, 0x7f, 0x80, 0xffffeb06, 0xf93, 0x9, 0xfffffcfc, 0x5, 0xfffffdfe, 0xed, 0x401, 0x80000000, 0x80000001, 0x5a57ee2d, 0x0, 0x8, 0x6, 0x9, 0x5, 0x0, 0x1, 0xfffffffd, 0x4, 0x8, 0x6, 0x5, 0xa3, 0x8, 0x4, 0x4b4, 0x2, 0xc6cd, 0xc4, 0x3, 0x7f, 0x4, 0x0, 0xfe, 0x9, 0x7, 0x6, 0x5, 0x5, 0xfffffffb, 0x6, 0x0, 0x6, 0x4, 0x3, 0x0, 0x6, 0x49a, 0xcb, 0x8, 0x7, 0x2, 0x2, 0x8, 0xa, 0x5, 0x6, 0x30, 0x6, 0x2cf2, 0x85398d5, 0x0, 0xfffffe01, 0x3, 0x0, 0x9, 0x5, 0x7, 0xc, 0xe571, 0x0, 0xfffffff9, 0x2a, 0x0, 0xfffffff7, 0xa4, 0xfffffffe, 0x1000, 0x3d1e, 0x0, 0x0, 0x3, 0x5, 0xec2b, 0x2, 0x2, 0xfffffffb, 0x0, 0x6, 0x9, 0x4, 0x80000000, 0x6, 0x869, 0x1ff, 0x8, 0x8, 0x9, 0x175, 0x9, 0xffffffff, 0x2, 0x7ba, 0x6, 0x0, 0x9, 0x9, 0x10000, 0x5, 0x5, 0x7fff, 0x0, 0x3, 0x5, 0x5, 0x0, 0x4cf, 0xa0000000, 0x8000, 0xc, 0x7, 0x8, 0x9, 0x401, 0xd, 0x9, 0xfffffffa, 0x4c, 0x9, 0x0, 0x80000008, 0x100, 0x9, 0x9, 0x8, 0xb, 0x7, 0x1, 0x3, 0xff, 0x4, 0x5, 0x0, 0x8, 0xff, 0x1, 0xe, 0x9, 0x1, 0x62, 0x0, 0x1, 0xc, 0x5, 0x7, 0x6, 0x7, 0x6, 0x80000, 0x9, 0x0, 0x0, 0x7f, 0x9, 0x80000000, 0x0, 0x5ae, 0x3, 0x2, 0xf1, 0xfffffffd]}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x1, 0x2, 0x9d7b, 0x2, 0xffffffff, 0x2, 0x7, 0x9, 0x2, 0x5, 0x1ff, 0x2, 0xc516, 0x0, 0xfffff0b5, 0x3, 0x3, 0x3, 0x8, 0x3ff, 0x2, 0x2, 0x3, 0xfffffffd, 0x41c, 0x46, 0x3, 0x76, 0x800, 0x3, 0x133, 0x6, 0x8, 0x2, 0x3, 0x9eca, 0x4, 0x8, 0x101, 0xa, 0x8, 0x2, 0x7ff, 0xfffff800, 0x3, 0x8001, 0x4, 0x2, 0x0, 0x0, 0x2, 0xfffffffb, 0x1, 0x82, 0x141, 0x1f8, 0x1000, 0x5, 0x0, 0x7, 0xd3, 0xfffffffc, 0x2, 0x5, 0xc8d, 0x9, 0x6, 0xc, 0x0, 0x6, 0x8, 0x7, 0x5, 0x1, 0x1, 0x2, 0x6, 0xf1, 0xa, 0xfffffff9, 0x5, 0x2, 0x1327d97c, 0xffff527b, 0x5, 0x0, 0x5, 0x7, 0x4, 0x8001, 0xff, 0xffff, 0x8, 0x7, 0x9000000, 0xde, 0x12a, 0xc, 0x8, 0xfffffeff, 0x6, 0x8, 0x76d4, 0x1, 0x7, 0x0, 0xebe2, 0xbe5, 0x3, 0x7f, 0xf, 0x9, 0x1ff, 0x0, 0x6, 0x8, 0x1, 0x8001, 0x3, 0x8, 0x7fff, 0x5, 0xe0d3, 0x3, 0x6, 0x5, 0x9, 0x4, 0x1000, 0x2, 0x5, 0x400, 0x8, 0x8, 0xff, 0x3, 0x0, 0x5, 0x1, 0x1, 0x1000, 0x80000000, 0xc, 0x3, 0x2fb, 0x5, 0x1, 0x9, 0x40, 0x1, 0xb1, 0xb, 0x4, 0x6, 0x4d444d0a, 0x100, 0xe5, 0x8, 0xfffffffe, 0x9, 0x100, 0x3, 0x4, 0x9, 0x0, 0x1, 0x0, 0xb, 0x8, 0xffff0001, 0x200, 0x1000, 0x8d9, 0x101, 0x8db, 0x8, 0x5, 0x6, 0x8, 0x7, 0x0, 0x57, 0x8, 0xb, 0x3, 0xc, 0x2, 0x0, 0x7, 0x2, 0x2, 0x9, 0x80, 0x9, 0x6, 0x401, 0x0, 0xfae, 0x4, 0x7, 0x1, 0x2, 0xba8b, 0xe3b426a, 0x1ff, 0x5, 0x6, 0x2, 0x5, 0x931e, 0x5, 0x2, 0x36bf9f05, 0xeb, 0x9, 0x9, 0x1ff, 0x7fff, 0x1, 0x8001, 0x9, 0x8, 0x80, 0x200, 0x8, 0x0, 0x7, 0x100, 0x16, 0x80000000, 0x9, 0x7fffffff, 0x1, 0x4d9, 0x7, 0x5c3, 0x2, 0x6, 0x8, 0x7, 0x4, 0x400003, 0x0, 0x7, 0x9, 0xb20, 0xff, 0x6cb7db37, 0x4, 0x2, 0x3, 0x1, 0x2, 0x4, 0x0, 0x2]}]}]}}]}, 0x87c}, 0x1, 0x0, 0x0, 0x20000010}, 0x8080) socket$unix(0x1, 0x1, 0x0) 7.495630867s ago: executing program 4 (id=2701): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) r4 = fsopen(&(0x7f0000000480)='adfs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000040)='uid', &(0x7f00000008c0)='0\x00#\x00\xd0\x00 \x00\x00qS\x00\x00\x00\x00\x00\x00\x00\x00$\xf6_\xbdI\x1c\xf2\xa9]\xcc\xe0*\xef\x01\x8d\x15\xd2h\x93\xc9\xb57\xc3\xea\\Eb\xf8\xe6,\xdf\xd4\xfae\x84\xcc\xd5\"d\xf0D-\x98\x9f\x81{\xfc$\xc4\xbcF\xf8\xc8\x8d\xcb\xb8\xf2\x1e\xe4\'U\xb3\xb8\xd3\xe6\xd7\x80=\x8a\xeb\n\xb8_\xe8\x96YY\xe3\xc7\xe6\xf28\x19\xa6\xa7\xfa\xdb\x1ce\xc1\x03\x86J\xb2fh\x19\xee#\xcc\x0f\xed\xfea\xdc\x88\xcb%bW\xd35\xda=\xac\x1d\xae\x93\xfd\'T6\x94\n\xa4\x9cU\xc4\fA~[\xbf\x8b\x90\xfe\x04\xe7U\xf3h\x81\x14l7u\x95\x96t\\\x0f\xef;\x03\xa4C\xbc(Vc!a\xc1\xe39\xc6b\x905\x1f\x03\x00\x00\x00\x00\x00\x00\xdf9\xaf5\xc8a:z\xe4\xcbag&67\x814\xf6}\xe10v6l\xd6,\x1e\xa0\xcc\xbf\xfdkm\b?\x839\x85N\x1c\xc1\xcb\xfc\x85\xd2\n\x02\"\xf2\x81g\x90\x01n%\x7f_\xe1.f>>\xa5\xfb\"\xab\xdb\x06\x12e\x14\x11~\x9a\bR-\x85\xc3\xa9\xe6\xf6R\x11\"\xc3\xc9\xfc\x14s X\xec\xdd\xc2qB\x85\xf0\xd7\x04\xdd<\x9ak\x00\x00\x00\x00\x00\x00\x00\n\xa72\xa3\xef^\xe7\x8f', 0x0) syz_open_procfs$namespace(0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r3, r5, &(0x7f000087b000/0x18000)=nil, 0x0, 0x0, 0x32, 0x0, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000240)) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, &(0x7f0000000540)) ioctl$KVM_RUN(r5, 0xae80, 0x0) execve(&(0x7f0000000080)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0, 0x0) execve(0x0, &(0x7f0000000000)={[&(0x7f0000000340)='^-%-\\x\\$})\'!&}*']}, 0x0) r6 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440)={'syz', 0x3}, &(0x7f0000000340), 0xf2, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f00000000c0)={r6, r6, r6}, 0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={'sha512\x00'}}) syz_usb_disconnect(0xffffffffffffffff) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000003, 0x20000000ec072, 0xffffffffffffffff, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, 0x0, 0x0) fcntl$notify(r0, 0x402, 0x1) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x4c840) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0xfffffff9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x13, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = openat$pidfd(0xffffffffffffff9c, &(0x7f0000000040), 0x408800, 0x0) pidfd_send_signal(r7, 0x3b, &(0x7f0000000080)={0x3b, 0x8000, 0xfa}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) 6.122998078s ago: executing program 1 (id=2702): socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x1e, &(0x7f0000000180)=0x400000001, 0xc2) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000000040)=0x1, 0x4) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0xfffffbfc, @private1={0xfc, 0x1, '\x00', 0xfe}, 0x7ffffff}, 0x1c) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r1 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0xc89f, 0xc000, 0x7, 0x112}) r2 = syz_open_dev$evdev(&(0x7f0000000200), 0x200, 0x0) ioctl$EVIOCSCLOCKID(r2, 0x40084503, &(0x7f0000ffcffc)) r3 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r3, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000040)=0x8) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000000)='/', 0x1}], 0x1, 0x0, 0x0, 0x2c}, 0x4000845) io_uring_enter(r1, 0x2219, 0x7721, 0x16, 0x0, 0x0) capset(&(0x7f0000000380)={0x20080522}, &(0x7f0000000040)={0x200000, 0x40200003, 0x0, 0x6, 0x7}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r5, 0x29, 0x20, &(0x7f0000000180)={@loopback={0xfec0ffff00000000}, 0x8000000, 0x0, 0x3, 0x3, 0x2}, 0x20) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x2000001, 0x5d031, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, 0x0) madvise(&(0x7f0000b26000/0x1000)=nil, 0x1000, 0x4) ioctl$sock_inet_SIOCSIFPFLAGS(r5, 0x8934, &(0x7f0000000040)={'\x00', 0x10}) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=ANY=[@ANYBLOB="4c00000010004b0426bd7000000000007a000000", @ANYRES32=0x0, @ANYBLOB="405666e3180000042c04002c0012800b00010062726964676500001c0002800500182f0700000000000800370f00000000050017000100"], 0x4c}}, 0x24) r6 = socket$kcm(0xa, 0x2, 0x0) setsockopt$inet_msfilter(r3, 0x0, 0x29, &(0x7f00000001c0)={@initdev={0xac, 0x1e, 0x1, 0x0}, @loopback, 0x0, 0x5, [@loopback, @remote, @multicast1, @loopback, @private=0xa010100]}, 0x24) sendmsg$sock(r6, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e23, 0x0, @ipv4={'\x00', '\xff\xff', @private=0xa010101}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x2}}], 0x18}, 0x0) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r7, 0xae03, 0x2c5) ioctl$KVM_GET_SUPPORTED_HV_CPUID_sys(r7, 0xc008aec1, &(0x7f0000000040)={0x7, 0x0, [{0xb, 0x9a2441e, 0x7, 0x3, 0x401, 0x800, 0xb}, {0xb, 0xfffffe01, 0x2, 0x1, 0x60, 0x4}, {0x40000000, 0x5, 0x2, 0xb015, 0x0, 0x1, 0x6}, {0x6, 0x5, 0x0, 0x40, 0xfffffffd, 0xff, 0x401}, {0x80000019, 0x5, 0x0, 0x5, 0x5, 0x9, 0x3ff}, {0xd, 0x4, 0x2, 0x400, 0xff, 0x7, 0x6}, {0x2, 0x7c, 0x4, 0x6, 0xd, 0xff, 0x7}]}) 5.642247338s ago: executing program 4 (id=2704): setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x211000, 0x1000}, 0x20) (async) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x211000, 0x1000}, 0x20) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x147c40, 0x0) r1 = fsopen(&(0x7f0000000040)='afs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000000)='source', &(0x7f0000000080)='#(:.', 0x0) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_int(r2, 0x29, 0x4a, 0x0, 0x0) preadv2(r0, &(0x7f0000000080)=[{&(0x7f0000001200)=""/4096, 0xffe00}], 0x5, 0x0, 0x0, 0x0) (async) preadv2(r0, &(0x7f0000000080)=[{&(0x7f0000001200)=""/4096, 0xffe00}], 0x5, 0x0, 0x0, 0x0) 5.359853355s ago: executing program 4 (id=2705): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x8000, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x90, 0x0, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) io_submit(0x0, 0x1, &(0x7f0000000780)=[&(0x7f0000000540)={0x0, 0x0, 0x0, 0x1, 0x5, r3, 0x0, 0x0, 0x200}]) sendmmsg$inet_sctp(0xffffffffffffffff, &(0x7f0000000900)=[{&(0x7f0000000000)=@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10, 0x0}], 0x1, 0x0) r4 = syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0) ioctl$VIDIOC_S_FMT(r4, 0xc0d05605, &(0x7f0000000080)={0x1, @pix_mp={0xfffffff7, 0x0, 0x47524247, 0x2, 0x8, [{0x3, 0x4}, {0x5, 0x4}, {0x7f, 0x3}, {0x9, 0x6}, {0x4, 0x30000000}, {0x7, 0x38}, {0xe, 0x2}, {0x9, 0x15}], 0x3b, 0x6, 0x1, 0x0, 0x1}}) r5 = socket$inet(0x2, 0x80001, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r5, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(0xffffffffffffffff, 0x84, 0x76, &(0x7f0000000000)={r6, 0x2}, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) r7 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r7, 0x89f1, &(0x7f0000000000)={'sit0\x00', &(0x7f0000000340)={'syztnl0\x00', 0x0, 0x10, 0x700, 0x4, 0x8001, {{0x5, 0x4, 0x0, 0x1, 0x14, 0x67, 0x0, 0x8, 0x4, 0x0, @rand_addr=0x64010102, @empty}}}}) io_setup(0x8, &(0x7f0000000040)) 4.161815485s ago: executing program 1 (id=2707): getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="02000000040000001800470001"], 0x17) epoll_create1(0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuacct.usage_percpu\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000040)=ANY=[], 0x118) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x88fd537e5e114b6f, 0x12, r1, 0x0) ioctl$I2C_RDWR(0xffffffffffffffff, 0x707, &(0x7f0000000380)={&(0x7f0000001880)=[{0x3, 0x0, 0x0, 0x0}], 0x1}) epoll_create1(0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) ioctl$IOMMU_IOAS_MAP$PAGES(0xffffffffffffffff, 0x3b85, 0x0) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000002340)={0x0, 0x0, 0x0, 0x0, 0xffffff00, r0}, 0x38) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000180)={{r0}, &(0x7f0000000000), &(0x7f0000000040)='%pI4 \x00'}, 0x20) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r3, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r4, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r5 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="280000001000030404000000feffffff00000000", @ANYRES32=r4, @ANYBLOB='\x00\x00\x00!\x00'/16], 0x28}, 0x1, 0x0, 0x0, 0x24048804}, 0x0) r6 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010800d972a440b72040155ab7010203010902120001000000000904000000ff"], 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8b29, &(0x7f0000000040)={'wlan1\x00'}) syz_usb_control_io$cdc_ncm(r6, 0x0, 0x0) syz_usb_control_io$hid(r6, 0x0, 0x0) syz_usb_control_io$uac3(r6, 0x0, &(0x7f0000001040)={0x44, &(0x7f0000000040)=ANY=[@ANYBLOB='\x00\x00\b\x00\x00\x00\x00A'], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r8 = socket(0x1, 0x803, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3c000000100001000000000000090000000036abfc958cec64afd3881d913e9100001f3057413724138c3fdf977691100d81a789af773135da990ed754d1885577abc531c3183561acba90445bc23fae3873b01d9440eb02928a6f972ffa0df8a6302d079c155d6ffe81c6cb849d35911df0598c2a5c0d218fcea201988fd12b9b5195455665f448cb83dc1192fbd0f7ef77ee5eb0cab97d34263e84a684d422c3cfe578dac4ee2fa094173e0a257a076f8fc9845f082b8e24905f10b1d1a0130489949e8d6a84abdc03afcf9e8942e25d", @ANYRES32=0x0, @ANYBLOB="0000000012000000140012800b00010062726964676500000400028008000a00", @ANYRES32=r9, @ANYBLOB="dc7c73fd35deadb49bd4fb151ee6fc173e4c650018549777e02e8d775f8c8511d643d43b2b17531d8a156fa27547c19b59607a910a81bda0ce84c1725fe2cc0544be9232963d61b81e96b0c55244b888efc5b8acabaf30e81fb0447787fa81a750f38b2718890cacfb1b9859f800bedc96f0fb03a15808c21b9967c57498764b3e005c2906c6ff2c946c8464820447d5c6cba42105e4e10eb42c324fa70c133e4d85e31310d513ba0ad412203cdf6a4d32385c9bb512a0bbb39b"], 0x3c}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)=@newqdisc={0x24, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}}}, 0x24}}, 0x0) socket$netlink(0x10, 0x3, 0x0) 4.100454429s ago: executing program 4 (id=2709): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e20, @empty}], 0x10) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f00000002c0)=[@in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}]}, &(0x7f0000000100)=0x10) 4.033405389s ago: executing program 0 (id=2710): sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000001c00010a00000000fbc298"], 0x14}}, 0x20008000) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) nanosleep(&(0x7f0000000080), 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_open_dev$dvb_dvr(&(0x7f0000000000), 0x3, 0x101000) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000003c0)={[0x0, 0x8, 0x5, 0x41, 0x4, 0x0, 0x2004cb, 0x0, 0x40000000000a1d, 0x68ff, 0x5, 0x3, 0x3, 0x2], 0x10000, 0x6342}) ioctl$KVM_RUN(r2, 0xae80, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x0, 0x4, &(0x7f00000000c0)=ANY=[@ANYBLOB="18006d88785dd000000000000000000028"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x17, 0x0, 0x0, 0x10, 0x800}, 0x94) r3 = socket$kcm(0x10, 0x2, 0x4) sendmsg$inet(r3, &(0x7f0000000540)={0x0, 0xc027, &(0x7f0000000340)=[{&(0x7f00000000c0)="98eb000014006bcd9e", 0xeb98}], 0x1, 0x0, 0x0, 0x1f000000}, 0x600) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000240)={[0x5, 0x100000001, 0x4, 0x5, 0x5, 0x9, 0x36, 0xa4, 0x129e, 0x4, 0x10, 0x401, 0x0, 0x4, 0x4a, 0x80], 0x80a0000, 0x22880}) r4 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000016c0)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x400}], 0x1, 0x4000, &(0x7f00000006c0)="02"}) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, 0xffffffffffffffff) ioctl$KVM_RUN(r2, 0xae80, 0x0) 3.989263647s ago: executing program 2 (id=2711): r0 = socket$packet(0x11, 0x3, 0x300) r1 = fsopen(&(0x7f0000000080)='binder\x00', 0x0) prlimit64(0x0, 0x7, &(0x7f0000000040)={0x0, 0x100}, 0x0) (async) signalfd4(0xffffffffffffffff, &(0x7f0000001840)={[0x9]}, 0x8, 0x80000) (async) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) (async) fsmount(r1, 0x0, 0x1) fsconfig$FSCONFIG_SET_PATH_EMPTY(r1, 0x4, &(0x7f0000000140)='ro\x00', &(0x7f0000000180)='./file1\x00', 0xffffffffffffff9c) fsconfig$FSCONFIG_CMD_RECONFIGURE(r1, 0x7, 0x0, 0x0, 0x0) (async) r2 = mq_open(0x0, 0x40, 0x100, 0x0) preadv(r2, &(0x7f00000001c0), 0x0, 0x10, 0x9) (async) r3 = syz_open_dev$vim2m(&(0x7f0000000000), 0x40000000007, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r3, 0xc0d05605, &(0x7f0000000140)={0x1, @raw_data="179e2e25b9329bca9dc1929c5670f1e1a44862f0f7dfef5e276b3fb0713901ab41726ffcad30d22063e3f8710a6f1b80e41d1d4f622313719444752ff203272a4cdea1e2eea98de192da1e6b967ac0c4c5742892f1ba521d5ec9690b6220eaa7dda4cc075682c6001dee43f01eb05b21dfeb42539ecc8e8485d1a3fe558a0c97e5ec9cd7231cf22d447929fb2a18b911edb3ab6acc9d5dc936cf6e0ddc241bf663961b8844ccac5180ccb2ee5e2ca0bf1284568d625e6162e926e75c995fa7538d517ce1192cfd0a"}) (async) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f00000000c0)=0x6, 0x4) (async) setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x770, 0x0, 0xbabd}, 0x1c) (async) syz_genetlink_get_family_id$l2tp(&(0x7f00000001c0), 0xffffffffffffffff) 3.8857274s ago: executing program 2 (id=2713): socket$inet_udp(0x2, 0x2, 0x0) r0 = syz_usb_connect$printer(0x5, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="1201000000030020f003176c4000000000010902247251000000"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r2 = syz_usb_connect$sierra_net(0x1, 0x3f, &(0x7f0000000080)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x1199, 0x68a3, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x0, 0x80, 0xfa, "", {{0x9, 0x4, 0x7, 0x0, 0x3, 0xff, 0x0, 0x0, 0x0, "", {{0x9, 0x5, 0xb, 0x2, 0x400, 0x8, 0x0, 0x9}, {0x9, 0x5, 0x6, 0x2, 0x20, 0x6, 0x0, 0x6b}, {0x9, 0x5, 0xa, 0x3, 0x3ff, 0x8, 0x6, 0x7}}}}}}]}}, 0x0) getsockopt$SO_TIMESTAMP(0xffffffffffffffff, 0x1, 0x40, &(0x7f0000000100), &(0x7f0000000140)=0x4) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0xfe, 0x7fff0006}]}) r4 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000240), 0xa2003, 0x0) syz_usb_ep_write(r0, 0x5e, 0x6f, &(0x7f0000000940)="03a5502a4c68c2614fd5d09e072b9a46f2e5f559be94ad72e9bfb918ee62b846f41cc41e9ca0a6c2eb88308ccc9bac332d7286489e3acb0d6109a05d1f8988e723b01645bd6f4a8fe4de9a11140d47247d60a5a89b51caf5765128a530141967f00fcbcb2feb3c4fb3aa2284f47e9b") ioctl$DMA_HEAP_IOCTL_ALLOC(r4, 0xc0184800, &(0x7f0000000100)={0x20004, r3, 0x2}) r6 = syz_open_dev$dri(&(0x7f0000000280), 0x1ff, 0x140) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r6, 0xc00c642e, &(0x7f00000000c0)={0x0, 0x0, r5}) ioctl$DRM_IOCTL_GEM_FLINK(r6, 0xc008640a, &(0x7f0000000300)={r7, 0x0}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) ioctl$DRM_IOCTL_GEM_OPEN(r6, 0xc010640b, &(0x7f0000000140)={r8}) syz_usb_connect$midi(0x4, 0xb7, &(0x7f0000000f80)=ANY=[@ANYBLOB="120101020000002030144b474000010203010902a5000101e42006090400000601a0acee57000603400307240301050002072401370007000624020203040b240300020209056b0a0309050310ff036802fb1106000000000000007e72f2b5207c28b309050b000ac70906de07250103f85ca5ecf433d6f1cb7c47114b363b09050b03404407074005250101a509050310ef0305030a0f25010bd210f1088e90e23a288c9f09050d1010000a0409052501013b09050403ff03dc81ec0d250109e7cde127abe0f47fa7"], &(0x7f0000000500)={0xa, &(0x7f00000005c0)={0xa, 0x6, 0x300, 0x3, 0xb2, 0x37, 0x8, 0x2}, 0x5, &(0x7f0000000580)=ANY=[@ANYBLOB="050d0500988968fb14a94c00"], 0x2, [{0x4, &(0x7f0000000a80)=@lang_id={0x4, 0x3, 0x41a}}, {0x4, &(0x7f0000000b00)=@lang_id={0x4, 0x3, 0x458}}]}) ioctl$SOUND_MIXER_WRITE_VOLUME(r1, 0xc0044d06, &(0x7f00000000c0)=0x39) syz_usb_control_io$rtl8150(r0, &(0x7f0000000780)={0x14, &(0x7f00000009c0)=ANY=[@ANYBLOB="40388b3e408200000002"], &(0x7f0000000400)={0x0, 0x3, 0x58, @string={0x58, 0x3, "8e051196023897a346b1f19a0113682eaa8426cfc1a6d73729df34a14aa56f25854e8a1924f22d4bf8cb2f7228e0942dd3da05df3db63039358b2424a1bc2e895a4da22e9fb7f137b40cf0ec938df570f1db9a033f67"}}}, &(0x7f0000000900)={0x2c, &(0x7f00000007c0)={0x0, 0x11, 0x39, "3793d1232a152a72874cf0bafc976e6dd099f229b92777ab02e8d839e886e89b969500de27a3cb51c69456d7a6cc2db9851e1c8e0ef8b30a5f"}, &(0x7f0000000800)={0x0, 0xa, 0x1, 0x9}, &(0x7f0000000840)={0x0, 0x8, 0x1, 0x33}, &(0x7f0000000880)={0xc0, 0x5, 0x1, "ed"}, &(0x7f00000008c0)=ANY=[@ANYBLOB="00000100000000"]}) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_INTERFACE(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20000080}, 0x0) sendmsg$NL80211_CMD_JOIN_MESH(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2000100}, 0xc, &(0x7f00000001c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="2000000006f69e892d257952bfe59ce6704d291b44968e", @ANYRES16=r9, @ANYBLOB="00042dbd7000fddbdf254400000008000300", @ANYRES32=0x0, @ANYBLOB="0400cc00"], 0x20}, 0x1, 0x0, 0x0, 0x40090}, 0x44000) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000c00)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_KEY(r5, &(0x7f0000000d00)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x22408800}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000a00)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="000129bd7000fcdbdf250a00000008000300c45fe9ec0069d664d5752ca4f330b9de45449d", @ANYRES32=r10, @ANYBLOB="090007000000090000000000080037000100000013000a009fd03db61df4b35ed6b67aa329e18400"], 0x44}, 0x1, 0x0, 0x0, 0x40000}, 0x0) syz_usb_disconnect(r2) syz_usb_connect$uac3(0x0, 0x80, &(0x7f0000000100)=ANY=[@ANYBLOB="1201010200000040b421810040000102030109026e0003017f0006080b0002012237230904000000010130000a2401100a00090000000904010000010230000904011c0101010230000905010960002503050a2525010400000500000904020000010230000904020101010230000905820900027706c00a2525ffffff7f01e1"], &(0x7f0000001100)={0x0, 0x0, 0x0, 0x0, 0xd, [{0x0, 0x0}, {0xba, &(0x7f0000000b40)=@string={0xba, 0x3, "194412792fc2e289e5bfbf0b75a6554c08b9706727c7eb466579f161ccdc472184c70d3392ad5d3a7ad98dd94f232eebb7f7cf3deabd8821e7fd12c66a4d6dbaa41d74834085d0eeeb8bf739b95e622a51fa7302871f50856fe52c8c8c1d9d0637d1eed01854dc7498b760e9343e9e6a0f67cc55fe0bd8d53e02b52cc34d4996d7d29e7db52764e3e214c9c018558bec14e46dfe6fc341f625fbb4688e36c8af2c46d71aaa237bbc051ce6d3270c9423d34055f2bff37b72"}}, {0x5, &(0x7f0000000d40)=@string={0x5, 0x3, "28f2e6"}}, {0x4, &(0x7f0000000d80)=@lang_id={0x4, 0x3, 0x874}}, {0x4, &(0x7f0000000dc0)=@lang_id={0x4, 0x3, 0x425}}, {0x4, &(0x7f0000000e00)=@lang_id={0x4, 0x3, 0x81d}}, {0x4, &(0x7f0000000e40)=@lang_id={0x4, 0x3, 0x423}}, {0x1b, &(0x7f0000000e80)=@string={0x1b, 0x3, "2c2addb4a0478a75d650ac952ec7f56bd8e6371fde3e838cbb"}}, {0x20, &(0x7f0000000ec0)=@string={0x20, 0x3, "2c8aec4a057a26c0e6d069c3511bc6133b549d3ee0ffd65ce343a86c493a"}}, {0x4, &(0x7f0000000f00)=@lang_id={0x4, 0x3, 0xc7a}}, {0x4, &(0x7f0000000f40)=@lang_id={0xfffffffffffffe96, 0x3, 0x2ceb}}, {0x4, &(0x7f0000001080)=@lang_id={0x4, 0x3, 0x42f}}, {0x4, &(0x7f00000010c0)=@lang_id={0x4, 0x3, 0x3801}}]}) syz_usb_connect$hid(0x4, 0x3f, &(0x7f0000000480)=ANY=[@ANYBLOB="12010002000000408a25886a40000102030109022d000101d8000509040081020301000809210800c5c805bb80a8a52508012272050905810320000401d7090502034000060f07"], &(0x7f0000000740)={0xa, &(0x7f0000000600)={0xa, 0x6, 0x250, 0x2, 0xb0, 0xff, 0x20, 0x45}, 0xf, &(0x7f0000000640)=ANY=[@ANYBLOB="050f0f00010a1003020400000000ba"], 0x3, [{0x4, &(0x7f0000000680)=@lang_id={0x4, 0x3, 0x804}}, {0x4, &(0x7f00000006c0)=@lang_id={0x4, 0x3, 0xc07}}, {0x4, &(0x7f0000000700)=@lang_id={0x4, 0x3, 0x2c01}}]}) r11 = syz_open_dev$char_usb(0xc, 0xb4, 0x80000000) ppoll(&(0x7f0000000000)=[{r11, 0x6220}], 0x1, 0x0, 0x0, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$IPCTNL_MSG_CT_GET(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="ec0100000001050500000000000000000a0000003c0002802c00018014000300ff010000000000000000001f0000000114000400ff0200000000000000000000000000010c00028005000100000080003c0001800c00028005000100000000002c00018014000300ff0200000000000000000000000000011400040000000000000000000000ffffffffffff0800074001000001340006801400040000000000000000000000000000000001140005002001000000000000000000000000000008000200e00000010800154000000003600004805c0002800c000340000000000000002505000100100000000c00034000000000000000050500020008000000050002000400000005000100aa0000000500020080000000050002000300000005000200b8000000050001000300000058000e802c00018014000300ff02000000000000000000000000000114000400fc020000000000000000000000000001060003400000000006000340000400000c000280"], 0x1ec}}, 0x0) 3.737525208s ago: executing program 0 (id=2715): socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$video(&(0x7f0000000040), 0x8, 0x101840) ioctl$VIDIOC_S_SELECTION(r2, 0xc040565f, &(0x7f0000000080)={0xa, 0x0, 0x1, {0xe7ff, 0x1, 0x406, 0x870}}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r3, 0x3ba0, &(0x7f0000000740)={0x48, 0x2, r4, 0x0, 0x0, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r3, 0x3b85, &(0x7f0000000000)={0x28, 0x7, r4, 0x0, &(0x7f0000c00000/0x400000)=nil, 0x400000, 0x1004000}) ioctl$IOMMU_HWPT_ALLOC$TEST(r3, 0x3b89, &(0x7f0000000140)={0x28, 0x4, r5, r4, 0x0, 0x0, 0xdead, 0x4, &(0x7f0000000100)}) socket$nl_route(0x10, 0x3, 0x0) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15) migrate_pages(0x0, 0x5, &(0x7f0000000000)=0x9, 0x0) r6 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0xcc, &(0x7f00000003c0)={{0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, {0xa, 0x4e26, 0x1, @local}, 0x0, {[0xfffffffd, 0x0, 0x1, 0x0, 0x0, 0x9]}}, 0x5c) r7 = socket$inet6(0xa, 0x400000000001, 0x100) sendto$inet6(r7, 0x0, 0x0, 0x20000008, &(0x7f00000001c0)={0xa, 0x4e20, 0x8, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x4}, 0xffffffffffffff18) unshare(0x80) r8 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000340)={0x1, &(0x7f0000000000)=[{0x6, 0xf, 0x0, 0x9}]}) fsopen(0x0, 0x1) close_range(r8, 0xffffffffffffffff, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r6, 0x89f0, &(0x7f00000002c0)={'ip_vti0\x00', &(0x7f0000000200)={'tunl0\x00', 0x0, 0x8, 0x700, 0x8, 0xf5ea, {{0x9, 0x4, 0x1, 0x0, 0x24, 0x68, 0x0, 0x6, 0x2f, 0x0, @multicast1, @remote, {[@rr={0x7, 0xf, 0xc2, [@dev={0xac, 0x14, 0x14, 0xc}, @rand_addr=0x64010101, @multicast2]}]}}}}}) bpf$TOKEN_CREATE(0x24, &(0x7f0000000180)={0x0, r1}, 0x8) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x1, '\x00', r9, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) openat$kvm(0xffffffffffffff9c, &(0x7f0000000780), 0x0, 0x0) creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000040)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) 3.206812175s ago: executing program 4 (id=2717): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_BEACON(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000380)={0x24, r1, 0x1, 0x70bd26, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_IE_ASSOC_RESP={0xf, 0xe, [@dsss={0x3, 0x1}, @gcr_ga={0xbd, 0x6, @broadcast}]}]}, 0x24}, 0x1, 0x0, 0x0, 0x40010}, 0x24000891) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000003c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_PROBE_MESH_LINK(0xffffffffffffffff, &(0x7f0000001200)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000011c0)={&(0x7f00000004c0)={0xccc, r1, 0x200, 0x70bd2d, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_FRAME={0xcc, 0x33, @data_frame={@a_msdu=@type10={{0x0, 0x2, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1}, {0x2}, @random="368c3e1b2fd1", @device_a, @initial, {0xd, 0x3aa}}, @random="f0d01d56a64a3fd1c7e384eb93697f3529674cd2a86e149fcaa3ac59e0640bf8d7153072404e1661943835b179aceed7c6206d164b7edabd6e2194bc4277ae4e959dab4dc2775ec23bd3783ab408aa35a1b5c335985232f08864e92b9d8d6e81f7c16d5c8f5e3e45d990c7dc1ddfc782220c7034008bf1586a4fb9fd10cbb7da3995b85d489fae17b21d65e9825d8ba308f2f6bd112e9b92af102f3d84b88e1ea319aeb90859e07dbe109d4dc7e37262"}}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_FRAME={0x363, 0x33, @data_frame={@a_msdu=@type11={{0x0, 0x2, 0x6, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1}, {0xc14}, @broadcast, @device_a, @initial, {0xf, 0x2}}, @random="83b8e29d13a8f4736ca6943cda3738c3b92f0f15d388435cccd2965de91ba1d397f164f9ef0fed09ae6a553355ec9ad563ea10a63db77cd8cfec4dd79656e36c9c2eca71ee1e1264ac8acb99c45ea43468515f03e27b3fe73d92a757d87d37ff7c73cc717625a88e0d34629497a7aecaeb52dfa5ee54f8e255b45dd479b0ca0a5672a0391dc993a6f7c8158a8495bc60a9d8842a68b1ec61bd724ed339c99ea5e3bc4946604e2f2e226abeed40bc9b89254bea547cd0ea9f8d051da91763766d00aa816091425d9d9ee81fe876f2b36e473aefe35b422f5c6dc2d284cc69b4fcfe6325dd3ec3f3ef3e38bc880a1567a6c47bf4b6624e9391eebff479fb95b929b4f7dcfd78d4ed8b55696284b5f7778ab50c757caead12b37a6fabe29d5d54e681a12885223802aceaa23a152d33a67af64d2bb1bd0fbe5f0d3aaa8bedd0a2455af88f1fdcac671793ba23d916b186b5a689125ad2ec2acca8825027be72f91db12a951aa168e4aed80eaffdfd23bd09c760f7b705e0a4deb77481343d05bb4e958efe38865360f0ba6be4cf14c7c72c9e8ea851b3c9b86b6c17362bd6037079cfca6d406ce05f3af75b1d9b96b12861e1b63483fa69f964cfd82df38692ef8c118a3416f20a3e6c964f727a3975a2bb4791715d7d7109e0c0aa5954e801e40cd996f3ecf427fa0a95037b2fcc6b18cbaf1bc80e5f9b4f97f8302f7a9939b1f956d5aa313b1bddb235076ead81557537e7c4952ac55c464f5fba04ea19a23fa9fe4445d10b4ee99479b0d0d94f971ef4d8fff2d252f1e05ac208d3e75a73a35c5ff97d0b49451537290222fcee88a68e3deb5a6786b05f090ff5eb3bfb1d84096d88272503c65f97723dbf2b5ef636b24cc14069a2e4c4b0806e6b99199ff654fa2b59e6c7f2e953490da8d621d7db1f39a5343bf0022c2fdd07427a26f734645b6900966fc62d64f637b0fa8a7a38d8cb2ece4fbcacc89dcd9eb2f519ceb0a5d4ad28aba9a3f70699316dc59a345ddadef02f236beaed9420f323ec2a047ff82ee7ca8f27111701a9d635dee9a5628de55dc15c9de088b77ce4d6b5f96b11fb88f862295d8fca7102b61e6f3634c2d745402a270225ba6ab752b18611f7c376e16924266c23fae4387fa27adccd1186e4ed27a1143baa57574b349c4303941d58"}}, @NL80211_ATTR_FRAME={0x52, 0x33, @ctrl_frame=@ba={{}, {0x1}, @device_b, @device_b, @multi={{0x1, 0x1, 0x1, 0x0, 0x4}, [{0x0, 0x2, {0x0, 0x4}, "73a73a15e305d5d3"}, {0x0, 0xa, {0x5, 0x9}, "a591af52bb8499cd"}, {0x0, 0xa, {0x6, 0xbe3}, "c8c410e8571abfea"}, {0x0, 0x5, {0x4, 0xf1}, "8497ea03614870b7"}], {0x0, 0x0, {0x9, 0x5}, "7b1a66aacb5682f2"}}}}, @NL80211_ATTR_FRAME={0x814, 0x33, @data_frame={@a_msdu=@type11={{0x0, 0x2, 0x9, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {0x8be}, @device_a, @device_b, @initial, {0x6, 0xa}, @device_b, @value={0xc, 0x0, 0x0, 0x1, 0xa5}, @value=@ver_80211n={0x0, 0x6, 0x2, 0x2, 0x0, 0x1, 0x1}}, @random="79571c32409251ba2acceafbb3b30a0753c6a2987603ba8f91d38b7bc0daea1dd8da1bc80e45405ad27b01075bce4339210d3ccde4ded94fc1f92a17aebc703d8385eafb37900c0b65cbfe7307df9a1f1c44ae2f82c39c6e765b9343721da67e5bb41124bcaaf38ad7f76ef4a7a7b5b74748995481ff54b825a2de0c701c78e61f32275c0bbd7af9afef871e4d525a2171304bc1476129b5d53cdc76b0b61a631493c799e1310513a772bd65a437e4ab43caeb557b50db0f1716b54f0f2bd2a35eb32c1f75a1cbbc23f18781a675bb989d1719b8a3fab9ae427fe92fe7558b87866da944864472bcc9da8c861a32ea6026a15ada059be81ec68f993a17c7a2a0db6826ff8a5e8dcbb7f545d960009ec4919dc2071fd5b244dd16f7ee7babe2f2d2e2eeb3b077ad90c570bc30de4dbf48df3478fc51c6c2243087756d1857563c9b4a6acb9755e0906d31305eda8601b167ab8710b6a2485ebcebdcf6367dc0034343b0d12967fc1b11f1386155f90193a6fcc94cce13013fbe733a7188c5ffb49378dde035a092d349039fa126d8f4cc96008c043310b49875cd8130d0a7d9750a446cbffefbd39a2e766f501eeaccfd69ea66dd13bb38233204fa71425b8c5af2a66b90e62ba39693b0e47569fccdf88175a9b2716c2ebe54b8984a9edc8c845daeff71d263e4ba8f9cab96dcc243f94b5aef44d75c2cb91b3947111e05354ba99658fb34a64765bb76a86f128fcc6f0608f4748139d9a73161c09c5b53697aee47148de3c6d4b70814cae91e9a32b82c503bce3034908c92d152164f10a612e60d717517d1d95ba39dee973a0b0913b8f8ddc2bf31a0103a1234561eaee87b0883ddc8a2085c722ba7e790a9418413cae6db26d5e3f78eee9c6cf83b4017d96dc2c5d7920f6dd4bac07b9640ccfe20c1d046c1bf0eef53cd731b4e5d9616785281fcc4943f1b19637341880f6bc6f5b9b873ef839a6a4af6c2bae16dc46827b27a0f238807450f1ba1f9a218f812d3a28cfbed903ae3c83872bd5491e2e3ed2aa8d1b56fec65deaedcd6e69df9fdfeb5a86f47d2fb18baf66c125b4df625588d13f3d176dc70d32cd99eec4802b0791694ecd44c10b55e7c70c5b89be4332a2232286a164cf5fd98b8e2671117eb06920700b7889c741736f244b23faa22b925d695c213a3f059671f576d493970cdb341e77710fff0a0eb3dd8055eddabe57cdef767204cfc570680eb9457bc737918ca8afc9d554d3a892395633b8c3457f6b99a8b9e8274bcfeabcd4b46fb88f60ee5be169e54339e5b302d94ed97089a6b2c9cdd179f9e5c85fed1f5d45f477d23d992b266dc9ed80440697806d06e0a386a8a9d567fb57c3b2e2310db6e580f247bc7de37894604835513816718aca64c7f6d308d220e2cccd813e32d86ae79edb7ac04c52384dbac300ca78d766e074321676e43a696473165bc314519f48e43f4f1078dae00a2d8264ae147d45da3208225d2ffefa6480f60e62eb468dcb49fcce599d6450b4ab6310381439e9c49b49279d31b6d5604b3e189207482a46d13151a6c1f3f5d0c93af3076727e8519640c3d1c1d5765ab1694acea942a4cb1ed715379a1f9f42db8c61c46e7c03761c12c586dc2720d554f540cb4fd6e4461a73187cac02e0f078d51c21c5bec0d6f03805bd5e878b0d73c4ac767a0f7abc19248ee5c0eb7b0d96eb954f0a4bcda500100a235bbc34fc980ebd013ba8be439f113915f814d0da419a8275e50f248c6d1e95359eda55e01c4ffec544d66396d7792412c3f7d76db9fe826717a43fe00fbe97b4143e13ce84eedb91b12546b27bfb711ea08aef08d09ec4729f6ae41a6095217790ed2be1b44d1c963da5aa800301b6fb50ce2b8dfbbccb577109756075c718154853c23ba268c17a17a409c51f124d94bcf33274d70c63dd6179ada328007e690488f1389e5319b797922f89bae50e0892cd3b6e21cdc4d47cec8556ee415db69c597f78de69b2d2d5ed3c7c968c2e4e10a3789444893064b5f1f276a373cf49a6eb1887726e5be0b56cbb9c0b0ebf76cd5d9189c14144f26444bdc28a08ab00ea80b0eb6595a4dabad1736f21b8bfc408b08fdd9ec154f0c9feee2daf28b9f2fe2f50a0c4fe6f36e59d9e957ac9000f1ad2043ba31f194d9ec5600a49a137058ccdedafbd970ddfbd0c2c022da8d9ce21ee1ba4129b866bfec815fa4914954686abe2a2cbc2dfc22984ebd6522d0304e0354d742715753307b8701f4809d4cfdd71b0f84b7cfafe2febf1144be097547780a17d0ea3334a417e847df7359921cf1667b59b32df782f00c291d26720e733f4832ebb03013e34ed6c6181dd422e079d21cc542020b01b0ab7cf53bcaafb1aed1e1adbeea1c71ccfa1c7b5be195ff4e613b3c26d1b47bcd048d3a7f52a813dacbbd1b26575b308adce51dcdee0715c43b842e30c1fee45190fdc999f30351089d39c77d75a0356ce478f81f73f9bfb2985e4c2df9ca4c7ae44f890c7a56605ef2fc985d12024f5a6648ecd70766e9695ef77f04f95934d0971792ed886f7f107cb748b52e6082b7aa12c1227dc358a66dab3a2df9cc204ad0ba50b822a9d5b5786344d4e48b4d15e1148f4f752a1df361559b425daca196b5f57887c1c98b7b4ef7ae6cdd402a26fcc00d2e3a4bb828b5f266bea44e46f98310079684439acbe2f48545fa57ee3132b3336f3eeb1d46fd6376bd7993ee3df6d7f6338d892fc331b1d792f8791c9907b2d966bc1e34edd28c083ad58b96b1694b0da0352d653376aeac0363a7cc16a8360e4166e2f1a2ee55a34dc1d1d4538277946dae7833e97a1da00b7d08cdaca6ffe2df745dc9e9ff2a1f62aba3ff"}}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}]}, 0xccc}, 0x1, 0x0, 0x0, 0x4000013}, 0x4800) setsockopt$inet_sctp6_SCTP_INITMSG(r2, 0x84, 0x2, &(0x7f00000000c0)={0xfffc, 0xc}, 0x8) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01040000000000000000010000000900010073797a310000000054000000030a01020000000000000000010000000900030073797a320000040028000480080002400000000008000140000000051400030076"], 0xe8}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a58000000160a0302000200000000000002000000090002"], 0x80}}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a30000000106c000000160a01000000000000000100010000000900010073797a30000000000900020073797a3000000000400003800800014000000000080002400000fbff2b0003801400010067656e6576653000000000000000000014000100776732000000000000000000c6e49c0f5c000000180a0101000b000000000000010000000900020073797a30000000000900010073797a3000000000300003802c000380140001"], 0x110}}, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_TDLS_MGMT(r5, 0x0, 0x40080) r6 = openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND_IP(r6, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f0000000280)=[@in={0x2, 0x4e23, @initdev={0xac, 0x1e, 0x2, 0x0}}]}, &(0x7f0000000140)=0x10) ioctl$sock_SIOCSIFVLAN_GET_VLAN_VID_CMD(r5, 0x8983, &(0x7f0000000240)) 2.356119007s ago: executing program 0 (id=2718): madvise(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x3) r0 = socket$pptp(0x18, 0x1, 0x2) r1 = fcntl$dupfd(0xffffffffffffffff, 0x406, r0) mremap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x1000, 0x2, &(0x7f0000ffd000/0x1000)=nil) (async) r2 = syz_open_dev$sndmidi(&(0x7f0000000000), 0x5, 0x10000) (async) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x3000004, 0x10, r1, 0x10000000) syz_io_uring_submit(0x0, 0x0, r3, &(0x7f0000000040)=@IORING_OP_NOP={0x0, 0x60}) (async) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000100)={&(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x7, 0x80800, 0x0, 0xffffffffffffffff}) (async) read$FUSE(r1, &(0x7f0000000140)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r4, &(0x7f0000002180)={0x50, 0x0, r5, {0x7, 0x2d, 0x4, 0x200, 0x0, 0x12a, 0x8, 0x1, 0x0, 0x0, 0x10, 0x4}}, 0x50) (async) ioctl$UI_GET_SYSNAME(r1, 0x8040552c, &(0x7f0000002200)) (async) ioctl$NILFS_IOCTL_SET_ALLOC_RANGE(r2, 0x40106e8c, &(0x7f0000002240)=[0x8000000000000001, 0x4]) writev(r1, &(0x7f00000024c0)=[{&(0x7f0000002280)="4672277c1ef5b01cb6fdb4b5aa800c63a459f783518c981904a107eef8fa919c61e9c7527c262908f0e32ee052ab8794eaf28b9910c1", 0x36}, {&(0x7f00000022c0)="441bc0930a407880e7e65968ff82ce55500c80c3995ffc76317648bce020a9466d42", 0x22}, {&(0x7f0000002300)="249fc4247f64df3bf26670fdcef2f398e54cee5be24eb748686f05d40f02e43a5b8577ade474414a088b23880bf613f9049824b3b0a56403082e445d4efdf9cc88ba4701665bb328bb0225a6c1159cd3f772ce0cef9268a1612cd78ce41c0598e1e3819441b8351943de0ea3477d2d32075c09bb50db097e954ba2169a0c561187dde57d1a5fce6c1b3a377cfbb443739a822c468e45e99470060895a7b8b076184a77d1bed460195dfee0728e91ccdf0c25940b82ed0022e49d8b1c462b6ff78c103ff8d3a5d611372a7f3c70dd8f59a18fd7fca405351020b6ed230cfd17d7f1bf1c9aa264cb", 0xe7}, {&(0x7f0000002400)="819e412bfd0b4adfd6da28b9baffb92c602019da4f32cf802ce31aed43a7b38d1fbd92520749836dedf8c45bf9ac78f6a9fdbb9cfcfd1eef1a93136afc919c2d6250e0ca27ae0aac1fa8174c6f10ef95328e45ec8650be73bc1d5487db40ac58eb1d28a0b5205d7c2e2ac721668f39106138c46878", 0x75}, {&(0x7f0000002480)="96cb3b660ca986aea40d0528d29e9b908c7df4883437551754807c3d658f945c1c2468f37d", 0x25}], 0x5) (async) syz_kvm_setup_cpu$x86(r4, r1, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000025c0)=[@text32={0x20, &(0x7f0000002540)="0f61dbc4c16d72e70a0f01c566ba4100b800000100efc4e27d13acb2be2e000066baf80cb808385c8cef66bafc0cb800000080ef660f38324f62829d7d3d000001c4e1f9294a06b905020000b800100000ba000000000f30", 0x58}], 0x1, 0x20, &(0x7f0000002600)=[@cstype3={0x5, 0xc}], 0x1) (async) fgetxattr(r1, &(0x7f0000002640)=@known='trusted.syz\x00', &(0x7f0000002680)=""/9, 0x9) (async) r6 = accept$inet6(r1, &(0x7f00000026c0)={0xa, 0x0, 0x0, @dev}, &(0x7f0000002700)=0x1c) setsockopt$sock_int(r6, 0x1, 0x21, &(0x7f0000002740)=0x6, 0x4) bind$unix(r1, &(0x7f0000002780)=@file={0x1, './file0\x00'}, 0x6e) (async) syz_clone(0x20000000, &(0x7f0000002800)="ae74198b83b310e9632e23133e71f136d23cc2799f607690376a27b90fcdcacdf7852dd7bad232f944a34ac00b1a1e55328ecc4f31ba9c8418452e5053eedc8d897885586d752c8153bf2056f7a550e3b1e28c1f86b51a64bbabbe21dddef9837ee8d152b5a81ea027e3e3d347c91d4024091b93e483f0c6ca9e9532d3bebc303ca1c82f54098690ff385ed23f17522988437094690198c17c1d91d59dd4ec57699307a78c704145bbe76cd56cadc93d7db10541f49f043ae5ee28bee1fab97f52a2d9a38ce6d6f5e53944aea4840af8364094525db3a90d7e1e47fe64bcbfbc7f051e3f65ff195e3b55657918bf20a9b81b8a", 0xf3, &(0x7f0000002900), &(0x7f0000002940), &(0x7f0000002980)="150b48ad1a65098853d550a0a7c9cc26b51e4d60cb94e317844ba17cdc637d37986ddb43bc55bd6147c2d2f508e54cfde0f5dde3d76455a50da3dd18f5e372e81aa21f79ebd23b85e56b9f2e88f522147d616ac41c8f54e83710262965739dff1fef50add3ec2e851a06f9e0a002f380f35007db4645d1768211465587b41f3930a0ed9797e9d2f00a4e94141accc83e814ce5947cf8a6d289bc83593fd0c464cdd49bc26aecaef1d79925de319f8b3b2395401ff417d43fde193214b9d6859d4ba9b11b93df65b71ed919") (async) r7 = socket(0xd, 0x3, 0xfffffffa) io_uring_register$IORING_REGISTER_RESTRICTIONS(r4, 0xb, &(0x7f0000002a80)=[@ioring_restriction_sqe_flags_required={0x3, 0xc}, @ioring_restriction_register_op={0x0, 0x1d}], 0x2) (async) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000002b00), r7) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000002b40)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r4, &(0x7f0000002c40)={&(0x7f0000002ac0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000002c00)={&(0x7f0000002b80)={0x44, r8, 0x100, 0x70bd27, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r9}, @val={0xc, 0x99, {0x3c1, 0x36}}}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0xc}, @NL80211_ATTR_MESH_ID={0xa}, @NL80211_ATTR_4ADDR={0x5}]}, 0x44}, 0x1, 0x0, 0x0, 0x14000080}, 0x8014) (async) ioctl$DRM_IOCTL_AGP_ALLOC(r4, 0xc0206434, &(0x7f0000002c80)={0x5, 0x0, 0x1}) (async) sendmsg$NL80211_CMD_SET_REG(r7, &(0x7f0000002fc0)={&(0x7f0000002cc0), 0xc, &(0x7f0000002f80)={&(0x7f0000002d00)={0x278, r8, 0x2, 0x70bd28, 0x25dfdbfb, {}, [@NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_REG_RULES={0x8, 0x22, 0x0, 0x1, [{0x4}]}, @NL80211_ATTR_REG_RULES={0x84, 0x22, 0x0, 0x1, [{0xc, 0x0, 0x0, 0x1, [@NL80211_ATTR_FREQ_RANGE_START={0x8, 0x2, 0xfffffeff}]}, {0x2c, 0x0, 0x0, 0x1, [@NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8, 0x6, 0x4}, @NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN={0x8}, @NL80211_ATTR_FREQ_RANGE_MAX_BW={0x8, 0x4, 0x3}, @NL80211_ATTR_FREQ_RANGE_START={0x8, 0x2, 0x7ff}, @NL80211_ATTR_FREQ_RANGE_START={0x8, 0x2, 0x3}]}, {0x24, 0x0, 0x0, 0x1, [@NL80211_ATTR_FREQ_RANGE_START={0x8, 0x2, 0x68b}, @NL80211_ATTR_DFS_CAC_TIME={0x8, 0x7, 0x5}, @NL80211_ATTR_DFS_CAC_TIME={0x8, 0x7, 0x2}, @NL80211_ATTR_DFS_CAC_TIME={0x8, 0x7, 0x4fdf}]}, {0x24, 0x0, 0x0, 0x1, [@NL80211_ATTR_FREQ_RANGE_MAX_BW={0x8, 0x4, 0x3ca5}, @NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8, 0x6, 0x6}, @NL80211_ATTR_FREQ_RANGE_END={0x8, 0x3, 0x1383}, @NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN={0x8, 0x5, 0x7ff}]}]}, @NL80211_ATTR_REG_RULES={0x1d4, 0x22, 0x0, 0x1, [{0x34, 0x0, 0x0, 0x1, [@NL80211_ATTR_FREQ_RANGE_START={0x8, 0x2, 0x4}, @NL80211_ATTR_DFS_CAC_TIME={0x8, 0x7, 0x1000}, @NL80211_ATTR_DFS_CAC_TIME={0x8, 0x7, 0xb}, @NL80211_ATTR_REG_RULE_FLAGS={0x8}, @NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8, 0x6, 0x5}, @NL80211_ATTR_FREQ_RANGE_MAX_BW={0x8, 0x4, 0x9}]}, {0x24, 0x0, 0x0, 0x1, [@NL80211_ATTR_DFS_CAC_TIME={0x8}, @NL80211_ATTR_FREQ_RANGE_START={0x8, 0x2, 0x4705}, @NL80211_ATTR_REG_RULE_FLAGS={0x8, 0x1, 0x6}, @NL80211_ATTR_FREQ_RANGE_MAX_BW={0x8, 0x4, 0x3}]}, {0x14, 0x0, 0x0, 0x1, [@NL80211_ATTR_FREQ_RANGE_END={0x8, 0x3, 0x8}, @NL80211_ATTR_FREQ_RANGE_START={0x8, 0x2, 0x3}]}, {0xc, 0x0, 0x0, 0x1, [@NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN={0x8, 0x5, 0x7}]}, {0x34, 0x0, 0x0, 0x1, [@NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN={0x8}, @NL80211_ATTR_DFS_CAC_TIME={0x8, 0x7, 0xe61}, @NL80211_ATTR_FREQ_RANGE_END={0x8, 0x3, 0x4}, @NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN={0x8, 0x5, 0xa4}, @NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8, 0x6, 0xc}, @NL80211_ATTR_FREQ_RANGE_END={0x8, 0x3, 0x2}]}, {0x2c, 0x0, 0x0, 0x1, [@NL80211_ATTR_REG_RULE_FLAGS={0x8, 0x1, 0x4}, @NL80211_ATTR_FREQ_RANGE_START={0x8, 0x2, 0xfffffff9}, @NL80211_ATTR_FREQ_RANGE_MAX_BW={0x8, 0x4, 0x1}, @NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN={0x8, 0x5, 0xb}, @NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8, 0x6, 0xfffffffe}]}, {0x14, 0x0, 0x0, 0x1, [@NL80211_ATTR_FREQ_RANGE_MAX_BW={0x8, 0x4, 0x80000001}, @NL80211_ATTR_REG_RULE_FLAGS={0x8, 0x1, 0x8000}]}, {0x44, 0x0, 0x0, 0x1, [@NL80211_ATTR_DFS_CAC_TIME={0x8, 0x7, 0x6}, @NL80211_ATTR_FREQ_RANGE_END={0x8, 0x3, 0x2}, @NL80211_ATTR_FREQ_RANGE_START={0x8, 0x2, 0x3}, @NL80211_ATTR_DFS_CAC_TIME={0x8}, @NL80211_ATTR_FREQ_RANGE_START={0x8}, @NL80211_ATTR_FREQ_RANGE_MAX_BW={0x8, 0x4, 0x4c}, @NL80211_ATTR_DFS_CAC_TIME={0x8, 0x7, 0xffffffff}, @NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8, 0x6, 0x6}]}, {0x54, 0x0, 0x0, 0x1, [@NL80211_ATTR_FREQ_RANGE_MAX_BW={0x8, 0x4, 0x5}, @NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8, 0x6, 0x4}, @NL80211_ATTR_FREQ_RANGE_MAX_BW={0x8, 0x4, 0x7fffffff}, @NL80211_ATTR_FREQ_RANGE_MAX_BW={0x8, 0x4, 0xa9}, @NL80211_ATTR_DFS_CAC_TIME={0x8, 0x7, 0x80000001}, @NL80211_ATTR_REG_RULE_FLAGS={0x8, 0x1, 0x6}, @NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8, 0x6, 0xa}, @NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN={0x8, 0x5, 0x5}, @NL80211_ATTR_FREQ_RANGE_END={0x8, 0x3, 0x4}, @NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN={0x8, 0x5, 0x87a}]}, {0x4c, 0x0, 0x0, 0x1, [@NL80211_ATTR_FREQ_RANGE_START={0x8, 0x2, 0x1}, @NL80211_ATTR_DFS_CAC_TIME={0x8, 0x7, 0x5}, @NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8, 0x6, 0x40}, @NL80211_ATTR_DFS_CAC_TIME={0x8, 0x7, 0xdb89}, @NL80211_ATTR_FREQ_RANGE_START={0x8, 0x2, 0x3}, @NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8, 0x6, 0x2}, @NL80211_ATTR_DFS_CAC_TIME={0x8, 0x7, 0x412}, @NL80211_ATTR_FREQ_RANGE_END={0x8, 0x3, 0xe0}, @NL80211_ATTR_DFS_CAC_TIME={0x8, 0x7, 0x2}]}]}]}, 0x278}, 0x1, 0x0, 0x0, 0x10}, 0x986aedd6a2c9a29f) ioctl$KVM_CREATE_VM(r1, 0xae01, 0xa) (async) ioctl$XFS_IOC_FSGROWFSDATA(r7, 0x4010586e, &(0x7f0000003000)={0x7, 0x86}) (async) landlock_restrict_self(r1, 0xa) close(r6) 2.305288789s ago: executing program 0 (id=2719): socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000011c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x0, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = socket$pppl2tp(0x18, 0x1, 0x1) r5 = fsopen(&(0x7f0000000480)='adfs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r5, 0x1, &(0x7f0000000040)='uid', &(0x7f00000008c0)='0\x00#\x00\xd0\x00 \x00\x00qS\x00\x00\x00\x00\x00\x00\x00\x00$\xf6_\xbdI\x1c\xf2\xa9]\xcc\xe0*\xef\x01\x8d\x15\xd2h\x93\xc9\xb57\xc3\xea\\Eb\xf8\xe6,\xdf\xd4\xfae\x84\xcc\xd5\"d\xf0D-\x98\x9f\x81{\xfc$\xc4\xbcF\xf8\xc8\x8d\xcb\xb8\xf2\x1e\xe4\'U\xb3\xb8\xd3\xe6\xd7\x80=\x8a\xeb\n\xb8_\xe8\x96YY\xe3\xc7\xe6\xf28\x19\xa6\xa7\xfa\xdb\x1ce\xc1\x03\x86J\xb2fh\x19\xee#\xcc\x0f\xed\xfea\xdc\x88\xcb%bW\xd35\xda=\xac\x1d\xae\x93\xfd\'T6\x94\n\xa4\x9cU\xc4\fA~[\xbf\x8b\x90\xfe\x04\xe7U\xf3h\x81\x14l7u\x95\x96t\\\x0f\xef;\x03\xa4C\xbc(Vc!a\xc1\xe39\xc6b\x905\x1f\x03\x00\x00\x00\x00\x00\x00\xdf9\xaf5\xc8a:z\xe4\xcbag&67\x814\xf6}\xe10v6l\xd6,\x1e\xa0\xcc\xbf\xfdkm\b?\x839\x85N\x1c\xc1\xcb\xfc\x85\xd2\n\x02\"\xf2\x81g\x90\x01n%\x7f_\xe1.f>>\xa5\xfb\"\xab\xdb\x06\x12e\x14\x11~\x9a\bR-\x85\xc3\xa9\xe6\xf6R\x11\"\xc3\xc9\xfc\x14s X\xec\xdd\xc2qB\x85\xf0\xd7\x04\xdd<\x9ak\x00\x00\x00\x00\x00\x00\x00\n\xa72\xa3\xef^\xe7\x8f', 0x0) syz_open_procfs$namespace(0x0, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r3, r6, &(0x7f000087b000/0x18000)=nil, 0x0, 0x0, 0x32, 0x0, 0x0) getsockopt$sock_buf(r4, 0x1, 0x1c, 0x0, &(0x7f00000010c0)=0xfffffffffffffe5d) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, &(0x7f0000000540)) ioctl$KVM_RUN(r6, 0xae80, 0x0) execve(&(0x7f0000000080)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0, 0x0) r7 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r7, &(0x7f00000000c0), 0x10) sendmsg$can_bcm(r7, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000001200)=ANY=[@ANYBLOB="0500bcce7d4e0871f3d79c7812320a8ea90f5b49a580554b09db8d992d4530bdcb3692723870ea0464ac91f0e769d7132a260577c90fe7d9673c4206fe65f3663868c2766aab488d8af030ee7dcbac740648a9a3663799b0c25d940df2d8bd83025ecbdafa6b14f1e1db4e21a821c3cd9888066ac877917b3a0ec93ffb08a5d80b12a3f19028f32f84975a377580710617feef757cef42030dca33096d6f", @ANYRES64=0x0, @ANYRES64=0xea60, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="000000000100000000000000000000003fae8a9ad451a727"], 0x48}}, 0x0) sendmsg$can_bcm(r7, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001100)={0x7, 0x240, 0x4, {}, {0x0, 0xea60}, {}, 0x1, @can={{0x3, 0x1}, 0x2, 0x3, 0x0, 0x0, "000000000091d700"}}, 0x48}, 0x1, 0x0, 0x0, 0x20000800}, 0x4c015) execve(0x0, &(0x7f0000000000)={[&(0x7f0000000340)='^-%-\\x\\$})\'!&}*']}, 0x0) r8 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440)={'syz', 0x3}, &(0x7f0000000340), 0xf2, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f00000000c0)={r8, r8, r8}, 0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={'sha512\x00'}}) syz_usb_disconnect(0xffffffffffffffff) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000003, 0x20000000ec072, 0xffffffffffffffff, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, 0x0, 0x0) fcntl$notify(r0, 0x402, 0x1) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x4c840) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0xfffffff9, 0x0, 0x0, 0x0, 0x61, '\x00', 0x0, @fallback=0x13, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 2.228379671s ago: executing program 4 (id=2720): r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x82) syz_usb_connect$hid(0x1, 0x3f, &(0x7f0000000140)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0x1b1c, 0xa75, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x3, 0x20, 0x1, "", [{{0x9, 0x4, 0x0, 0x9e, 0x1, 0x3, 0x1, 0x1, 0xc, {0x9, 0x21, 0xe, 0x2, 0x1, {0x22, 0xdcc}}, {{{0x9, 0x5, 0x81, 0x3, 0x40, 0x2, 0x8, 0x8}}, [{{0x9, 0x5, 0x2, 0x3, 0x3ff, 0x42, 0x4, 0x2}}]}}}]}}]}}, &(0x7f0000000300)={0xa, &(0x7f0000000180)={0xa, 0x6, 0x200, 0x9, 0x1, 0x9, 0x8, 0x7f}, 0x2c, &(0x7f00000001c0)={0x5, 0xf, 0x2c, 0x5, [@ptm_cap={0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x9, "9f5f6930bd7a847e67f5f31f9eef8e22"}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0xd, 0x0, 0x1, 0x4c2}, @ptm_cap={0x3}, @ptm_cap={0x3}]}, 0x3, [{0x4, &(0x7f0000000240)=@lang_id={0x4, 0x3, 0x140a}}, {0x40, &(0x7f0000000280)=@string={0x40, 0x3, "78734e79bc2da3c53180c5fcf9e7fb574efb9bc4f8204cbc84e3d5a46ee6c5a55b5b86baf4bdccb27b86e41241f61c92ee27ce0a0313069cc2e59ec81e49"}}, {0x4, &(0x7f00000002c0)=@lang_id={0x4, 0x3, 0x801}}]}) r1 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x41, &(0x7f0000000200)=0x632a, 0x4) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ff0000/0x10000)=nil, 0xffffff1b, &(0x7f0000000000)='\x00\x00') prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ff4000/0x4000)=nil, 0x4000, &(0x7f0000000040)='\x00') r2 = syz_open_dev$usbfs(&(0x7f0000000080), 0x74, 0x8581) ioctl$USBDEVFS_CLAIM_PORT(r2, 0x80045518, &(0x7f0000000000)=0x1) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x2, 0x7fff7ffc}]}) close_range(r3, 0xffffffffffffffff, 0x200000000000000) setsockopt$inet6_int(r1, 0x29, 0x31, &(0x7f0000000000)=0xb2, 0x4) sendmmsg$inet6(r1, &(0x7f0000000100)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c, 0x0}}], 0x1, 0x0) recvmmsg(r1, &(0x7f0000003880)=[{{0x0, 0x0, 0x0}, 0x2}], 0x1, 0x12141, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1000002, 0x11012, r0, 0x0) mremap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000ffd000/0x1000)=nil) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) move_pages(0x0, 0x1, &(0x7f0000000040)=[&(0x7f0000ffd000/0x3000)=nil], 0x0, &(0x7f0000001680), 0x0) 2.171369935s ago: executing program 5 (id=2721): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) (async) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) (async) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) (async) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) getsockname$inet(0xffffffffffffffff, 0x0, 0x0) (async) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x5, 0x9, 0x6, 0x0, 0xb49, 0x9, 0x8, 0x2, 0x3}, 0x0) (async, rerun: 32) mkdir(0x0, 0x22) (async, rerun: 32) r3 = syz_open_procfs(0x0, &(0x7f0000000040)='syscall\x00') pread64(r3, &(0x7f0000000500)=""/31, 0x1f, 0x40000000009) (async) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8) (async) r4 = socket(0x10, 0x803, 0x0) (async, rerun: 64) r5 = socket(0x10, 0x803, 0x0) (rerun: 64) ioctl$sock_SIOCETHTOOL(r5, 0x8946, &(0x7f00000002c0)={'veth0_to_team\x00', &(0x7f0000000140)=@ethtool_dump={0x1f, 0x8000, 0xd4, 0x6b, "d5ff6cbffc831567b58322b3e6da75f8ee576fb0a5867defbd505eadb38de6664e6a0a45a466c1674f62b00d42dbc6a7c16546e68821c189596cc72659a23e21a64a031a92bde64b8770925d504aece987a8c978ef7f9e4bf4f1f76bb53ce58487f00327ff8e485129b5a7"}}) ioctl$sock_SIOCETHTOOL(r4, 0x8946, &(0x7f00000002c0)={'veth0_to_team\x00', &(0x7f0000000000)=@ethtool_channels={0x3d, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1}}) (async) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000100)={0xaa, 0x28b}) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000001880)=ANY=[@ANYBLOB="b700000012edfffebfa30000000000000703000028feffff620af0fff8ffffff61a4f0ff000000003e040000000000003f000000000000005504000001ed0a002500000017ffffff460400007fffffff7b0a00fe000000006e04000000000000c6000000000000009500000000000000023bc065b7a379d17cf9333379fc9e84af69912435f1b6a693002e7f3be3619184e50b91f32050e436fe275daf51efd601b6482a0800000098efd2a102ee010400006e7a1de4a21f379dbf01de00b1b564fef3bef70548aed0d600c095199fe3ff3128e599b0eaebbdbd7359a48f5b0afc532ef58de3c1b7646cb7798b3e6440c2fbdb00a3e35208b0bbf12cd8dff095edc710e4000000000000009fbe4b61a615c6c57a2b649dc74a1a610643b08d9e104d4d91af25b8123deda8a3658d42ecbf28bf6d8e8afcb913466aaa7f6df70252e79166d8582755a314d31a76e42f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0800000000000000d5f728d236619074d6ebdf098bc908f50ae728a40f9411fe7226a4040b96e37c4f46010400000000c3da29faf75ddd1aa96960bca97af133824b881cc1f62c0f8f8f0e8d76b86f9c45636614786f5a2cb77230a874640dcbe0b20bb77c022d4cab080078fce8c5c81b7037181fc2f18f781aaa6e2957d7e39cc1baddcb7ec6667e699f24e41697ee7ea23e4b29a8b6cc9a1f5a7b3caae05f1300010000949b3aab06b1e042ff2164d80c8ab1c156b97e5889685a96949e4cb40df77b8bb84b0e733a63784ccc214d930cbb7e090df9a2867b3acec439c163fc8706869ada11390d4dbcf840fa68e7d7071b53ac29df826f8ae6d6e18c1e0600bf870768d5217e9bb5a05d9e224e67f1231bd236ed200073824d93c4e1a0f50a74bb4850486727d970acc546087acbf30f2f8165b47ba56dfadd14b306e98931485747292c6fe6e188750cf4f87cce2aa7d67c7133a9f05954cde298a35ea6d715ba80aee6330000000000000000000000000000000000004000000000000000038600008fb854adb4f8080064e8407c6bdb37114c80fbaa4a0ec5aaf4b0ac6f2128668279eb6fc144344e2d461c9a1be8fa0061ea9d55ee4716bea8e1cebf9ed39325ab4c5530dd6ee9fffc00000000000000d7c5af73c683625aaad5eda5004a76c9f8975ed4c5e4eb3e77e9885f69754932609f19e2f615a01cb6d17fbf5cb539403cb0572534f054d5514ad8264f7b029b2bdf2ca4958a62a6e744f9a4c1e646e1dd2ca19583f0f8b0dc53debd7d44f334e6ed7445a9580f970e483b307c4b3c018bc194b23d37e6a2e52d8265e5aab6fec586d52386e8c07a88c88e8faec5f1b16b2014f6952ce7d6be12c6bdb9651ca6fc907061be311d1354e6295698594a73136237bee068d3819400e43544830a3f74b7942f22336953978a5b2032da4238cc61162c04c1297395b73e18c9387615a2bc87d9e2445f3d323d3fac347926a4bac694c55fe9d145906d410f58f1951405d10504efe402cae085afef5dbd617e87ddbd239e4a50d7eb8e327fb5db12cbd6a9efe8e671c4f251cafffe3400a670d14b9b3cd8d86e492997a0168c022ef3536bd1dc731f4f9f8cb66701f4578ba4cb9b706e605a88c3857fb8aaaa95024f8da775f72950212b84fc6133ae14d1429cd4905dabb52e43af7e65acf97b4951fa1e967d16a5ed642efc855a4a46b85cd079934ad3188276efae9387eaa232697526e24b5d4fded86c3811ccd00520150b16000080122965558074956da5e4c3bbefcb64aa8be4456ed2caf0f467b6bbf3aa4371f5e76ab3f6a20278a3c779e03afd9a6af6fd518e5dce030f88ec5a5cb7601a161da0f80893220800c523040d13e1f1300c2c6555bce60d95dd3288e53435713f03add23f14c8db5555c62de4f626483632a2ab547f88dd6efec73a0271a19ca3aa860aa4dcaeeb9bd91a0cb429efae2a5fcc08b3a572969bbe917d1767e38ba49e3e57fafea83e495a6a1d1a4ebf83434986091dd66ffe3ffed0c39552a312e2db596d9c827e02f6fc13c8ddbb50bfd7dd8aa2f35f259fc83e007fe79d2d25e30830b92fca00a292dd3b856faa4b7e66e1b64505f65900839df71a97d4d07d37f7ecf8ed9a22da26ae674bba16c204f6b2f8f74fc56b7126d7c11ece6e88ec41192aaee75415c58d264a2b6adae02c821b62428902aad499825ab85a348638384cd12e61dbde5c47056f0a20b4e2a2328d5db5cf026657a129e6be231acf5f57995c60d9fca5f63a0dfd18054717120bda466d04774b53208ad8b022719ca77a4e0a66b4708f791d849a5e2aaa0074a9560ede2600df5a5c41392fe9460080fcb1e65233fb8dbeec4c86dbcf6a0673e38d2d3615e5bfbde44afe0fa7564231fff7e7f1f3ad68492dd2cccb15b5d7d3e37e8b7d28921c4b9280979521173f322df408d9818b6cc400090300000021911480a876fbba698801937e8b4264eb6f5137bdaa075f1488d22230592a79000000000000000000000000000000000000000000110000000000000000000000000000000000000000000000000000000000000000002f316aa0886c174b73decb46c1c85edf50d8fcbac5ff76b365611666da86a8e65b308706bd7c000000000000003f7cd4d5cb9076b81b7741ec03877afb5237ea1694addebc14c3ae49f88c462ea2050acf2d9a97d3be29a5614d1eba2c98cf0236401e02d7c445e50f76419ab4f78f67a09e63dd4faa2e7b59399f055f2fa278783f26d0a52aefb0a5ef0b41e14a6fe6ba306206670b84894e901a523fcbadfeff535f2514bc834e876810d9a6a78e70a9e22860c36a724770b4185de44db6bf21fef32a8d5b36d9014f38fee012365f963b2a85e7d8075c333475b9f0284405e3127dde7e41285fbe0bdd370c06c6a41744c3d24eab511317f97b7b4a1c2ec33fedc46e9bf0fa640eebd3d58f0ebdb7cb8ccffd6d6ab7e0e843591d2618e2d2cdc7081c8fafffe9c3500800000087de4ee7aac6478d99de7dd82bef044a6d33c789d566c90c46ad581aa22f910547a77d55e26bf19f1d4661550b177ef53933a305e69b8a95119dcf5bda599d625054776151b2cd1fcde238bdc527594a6c17aa9728af24e2bb7a3830e7092b01b119ea4e7e7f0e21527d622cc29c9f0c8720195368f8374337ab4d130619d93c5ef37e7ddd0b2da147e6e513455b88753452de959a6cbfa1ffbc7ad5d8c3b48017fd31dcf72f337b639253f44cb27a12174bc4c191e21015d0c431a71906eb9c6a14c8a060459ef26787ce3d1cbfd5cc459f0048b5d06f6cbd3e9b34c89f3fb2f951ae81d7fcc8bc0000000000000000000000000000000000000000009231feef3117197c796369f776c8b2ea3970f358107945d9e74e9bdfa58e68b65a8f01bc4b73cc31df5aa29f363917f90e3fa1eaf553db1c761dd9b634a9c4d7c21c24fe6d953ed9438cad0f8dfe03e5e2f73019352f1fb682a5a6ebbf24ebc49e3d7058e696eb3f4b642f36c9006c0067e24a64aa8c53dd824a3c08bfda74a143c855030ae004ac797c575c202d8091eb77565212548ead770d68000000000099347593f67da85d1c962bfb320d1553a74ec3bf003ba62b1784dbf0168a7e85f28b77bdebce96bf386a6dd5df162a16f2b7e8a4de0ffc464a87f91f81866d2ef0af71ebb07a739c3cb1b7000000000000"], &(0x7f00000001c0)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x43}, 0x48) (async) sendmsg$nl_xfrm(r6, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000600)=ANY=[@ANYBLOB="940100001a001307fdffffff00000000fe8000000000000000000000000000aafc010000000000000000000000000000fffc00"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="6401010000000000000000000000000000000000330000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003000000000000000000000000006b2e0507cd51b00d250000000000000030bde6a3d2492e652df74700000007000000000000000000000000000000000000000000000000000000060000000200000000000000000000000a0002006000000000000000a200010073686131000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d00200008ad957b65964f40189fd88c98a3b09ecbd5b9eeb6c9c618b4cfc97232d64fae3be67da1d16afe4a1fc4af5146c45100e40d9473088fa9693f7e6da8737ef7346f025cb9d2b4f6669"], 0x194}}, 0x8000) (async) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) r7 = socket$inet6_sctp(0xa, 0x5, 0x84) socket(0x10, 0x803, 0x800) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0xc001) (async) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(0xffffffffffffffff, 0xc018937d, &(0x7f0000000480)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x1}}, './file0\x00'}) setsockopt$IP_VS_SO_SET_FLUSH(r7, 0x0, 0x485, 0x0, 0x0) socket$kcm(0xa, 0x7, 0x0) 2.038702713s ago: executing program 1 (id=2722): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@deltaction={0x50, 0x18, 0x1, 0x70bd2c, 0x25dfdc00, {0xa}, [@TCA_ACT_TAB={0x3c, 0x1, [{0xc, 0x8d, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x7}}, {0x14, 0x5, 0x0, 0x0, @TCA_ACT_KIND={0xf, 0x1, 'tunnel_key\x00'}}, {0xc, 0x9, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x6}}, {0xc, 0x6, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x2}}]}]}, 0x50}}, 0x20040846) mlock2(&(0x7f0000514000/0x3000)=nil, 0x3000, 0x9c60e3bbf432b41f) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="54000000100001042cbd7000fedbdf2700000000", @ANYRES32=0x0, @ANYBLOB="58010500000000001400350073797a5f74756e00000400000000000005002100050000001800168014"], 0x54}, 0x1, 0x0, 0x0, 0x5}, 0x40080) 2.001704488s ago: executing program 5 (id=2723): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) r1 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000880)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8, 0x6a3, 0x621, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x40, 0x0, "", [{{0x9, 0x4, 0x0, 0x6, 0x1, 0x3, 0x0, 0x1, 0x0, {0x9, 0x21, 0x4, 0xc, 0x1, {0x22, 0x28}}, {{{0x9, 0x5, 0x81, 0x3, 0x400, 0xf7, 0x8, 0xfe}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_connect$hid(0x4, 0x0, 0x0, 0x0) r2 = socket(0x2, 0x3, 0x9) sendto$unix(r2, 0x0, 0x0, 0x20000, 0x0, 0x0) syz_usb_control_io(r1, &(0x7f0000000040)={0x2c, &(0x7f0000000180)={0x20, 0x8, 0x28, {0x28, 0x31, "f70ba381030000000000000000cb4fdca0560f920d54f365c5b1d43ee44fbf6fc93f0808251f"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x8, 0x0, 0x0) 1.835173734s ago: executing program 1 (id=2724): sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000440)=[{{0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000800)="21ae1baf930b4569b9ddef9797ffd935c7d80e6466b3e4e62dc9603583f5d4b61fbc65b6ac744d7319535e75bf552062e4cfde1ba7ce29263322e18ea9740aa82ca692f123993e57cda00d2b1f4e799bd41e3f76258180fa91a42aaa8b1ebc4e0ea8fb12f2c71e6e5bc57a8e91f254005514721d93c13c5606ae1fea7f31f558d562bd5a8dfb0b9fed873efa221fccffa847cd374c92e6cbb03e6a9de890ce323f000000abcc6c01326d588495b7c1a7db31ec4129e6336f26bb9e0b7552af3cd2d5dda1632799bbc98425c433384d8a8e4071ff39a36dfdfdf05af35a4ddd340cfecd7ec935f4ce7d3e851583ba1cf53a90a7f7bce5703de57ce93ddef7849b30a01de0637e6d5e507b801d32e582e0c2d564539ebfc84c098a23e765552767b122885fb1629e9c180be47da7931bd125b80de15aab0c56a2edf2e0483b87f5ab299dc046076203dea10ccbfc631d5bf4a87ce67004519f248f086346ce6a8a9d181789a59f81d9b7f6781daac3e229914b8b8998c15c3b6302a519331cb05995bc60b7cb872dd3b5b43331c77c5d72e21f7bd2b1a915ff3204e3f20d3a20b22d6a58155b5a4ebf6d1d1cd90c656ecada531c07ff91deb3efa91762cdecfbcc43553750f22ac5c18cc5e8b6f790c2f4e6373af9f98d10e6df49ff8e5cbcbd68e11ed0b967add11410dc2e34f08dbfaf8eb95d4d1153b4c6093192a340eb30fcc71619888c6486746a049585d249efb96b9cace83320b8f96b40ebe3a9a788d05a053380d1026b9434df87a3a387549bcabe88684c4dbf0da9a5212f3dbc8d1dff240856691243b203d7edd4d3cc89a38a6c80fdb1229a01044af7aaecb20d5570ebf24b30bbc6dfc3f70d85cd9f0d60ebd8fedd161d199d9997a0e2d18d1c99bc7158", 0x283}, {&(0x7f00000005c0)="05437c98b91b1455046f57b5fc913814bde2bbeac2104eaea9c9d01a7838d859007067c10aa7352abbdf98e9bf033a4784a11e84639d3b9164d9c5d729f3dd", 0x3f}, {&(0x7f0000000140)="f610e61ac81cc3edc86f0500194d27a5a443f10dfd1ecda0fd0ed9a444b7fb76afe3a0002f0a5eafcd3555a6cad574af080de74a37f54ee5f10fe3f42b445293ca980200000000000000ecfd6cc1b3a9a9263506e88c5557069d0ca055991454", 0x60}], 0x3, 0x0, 0x0, 0x900}}], 0x1, 0x0) r0 = socket(0x10, 0x803, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000001ec0)=[{{0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000180)=""/215, 0xd7}], 0x1}, 0xffff}], 0x1, 0x0, 0x0) sendto(r0, &(0x7f00000000c0)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000000)=""/102, 0x66}, {&(0x7f0000000280)=""/76, 0x4c}, {&(0x7f0000000fc0)=""/4096, 0x1000}, {&(0x7f0000000400)=""/92, 0x5c}, {&(0x7f0000000980)=""/73, 0x49}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x9a}, {&(0x7f00000001c0)=""/17, 0x11}], 0x8, &(0x7f0000000600)=""/191, 0xbf}}], 0x1, 0x0, 0x0) 1.800811325s ago: executing program 1 (id=2725): sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000001c00010a00000000fbc298"], 0x14}}, 0x20008000) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) nanosleep(&(0x7f0000000080), 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_open_dev$dvb_dvr(&(0x7f0000000000), 0x3, 0x101000) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000003c0)={[0x0, 0x8, 0x5, 0x41, 0x4, 0x0, 0x2004cb, 0x0, 0x40000000000a1d, 0x68ff, 0x5, 0x3, 0x3, 0x2], 0x10000, 0x6342}) ioctl$KVM_RUN(r2, 0xae80, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x0, 0x4, &(0x7f00000000c0)=ANY=[@ANYBLOB="18006d88785dd000000000000000000028"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x17, 0x0, 0x0, 0x10, 0x800}, 0x94) r3 = socket$kcm(0x10, 0x2, 0x4) sendmsg$inet(r3, &(0x7f0000000540)={0x0, 0xc027, &(0x7f0000000340)=[{&(0x7f00000000c0)="98eb000014006bcd9e", 0xeb98}], 0x1, 0x0, 0x0, 0x1f000000}, 0x600) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = dup3(0xffffffffffffffff, r4, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000016c0)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x400}], 0x1, 0x4000, &(0x7f00000006c0)="02"}) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, 0xffffffffffffffff) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1.692635203s ago: executing program 1 (id=2726): bind$inet6(0xffffffffffffffff, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) syz_emit_ethernet(0x66, &(0x7f0000000340)=ANY=[], 0x0) r0 = syz_open_dev$usbfs(&(0x7f0000000100), 0x7, 0x100) preadv(r0, &(0x7f0000000b40)=[{&(0x7f0000000880)=""/235, 0xeb}, {&(0x7f0000000980)=""/22, 0x16}, {&(0x7f00000009c0)=""/72, 0x48}, {&(0x7f0000000a40)=""/36, 0x24}, {&(0x7f0000000a80)=""/77, 0x4d}, {&(0x7f0000000b00)}], 0x6, 0xfffffff8, 0x7fffffff) syz_open_dev$I2C(&(0x7f0000000200), 0x0, 0x2) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x4, 0x0, 0x9, 0x2, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) openat$vimc2(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000040)={'#! ', '', [{0x20, '\t\xbb\x9b\x81\xa61\xdd\xd6\xe6\xb3R\xb9\xdb?\xbe\xd3&n\xe2\xb6\xf5%\xb2\xdf\xf5\x83\xba\xeb\x93~\x88\xdc\xec[6=\x01p\xcd\x8ay\x0ez\\U\xae\x9fj@5q\xb2\x89\x00\x17\xe3\x82\x81\xbeS\xd8\x00\x1c\x10\xf8\xf3\xd4\xddI<%\xbb\xa6\xab\x9a\xe5\xec\x19\xfa\xcb\x94\x90u\x9b\x13W\xbd\x9f\xfa\x032-{\x96{\x12\xddy\xb8\x0e%\xabx/\x9cb\xfe\xccO\x00\xf0\xf2\x9dZ\x19_\xc7\xf2\vI'}]}, 0x7d) execveat(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1000) r3 = add_key$user(&(0x7f0000000040), &(0x7f0000000180)={'syz', 0x0}, &(0x7f0000000080)='\x00', 0x1, 0xfffffffffffffffb) pipe2$watch_queue(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$IOC_WATCH_QUEUE_SET_SIZE(r5, 0x5760, 0x1f) keyctl$KEYCTL_WATCH_KEY(0x20, r3, r5, 0x5b) read$watch_queue(r4, &(0x7f0000000000)=""/1, 0x1) keyctl$revoke(0x3, r3) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) syz_io_uring_setup(0x49a, &(0x7f0000000140)={0x0, 0x79b2, 0x3180, 0x1, 0x283}, 0x0, 0x0, &(0x7f0000000000)) r7 = syz_usb_connect$printer(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000402505a8a4410001020b0109021b00010100c000090400000207010100090501020002"], 0x0) syz_usb_control_io$printer(r7, 0x0, &(0x7f00000011c0)={0x34, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000001180)={0x20, 0x0, 0x1}}) r8 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) pwritev2(r8, &(0x7f00000015c0)=[{&(0x7f0000000080)="ec", 0x1}], 0x1, 0xfffff, 0x0, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0xb, 0x6, 0xff}, 0x40, [0x7ffd, 0xc95a, 0xf, 0x8, 0x80, 0x2, 0x3, 0x10007f, 0x20000006, 0x4d, 0x6, 0x3, 0x9, 0x2, 0xffff2d34, 0xffffff01, 0x6, 0x3, 0xfffffffc, 0x5, 0x4, 0x2, 0x7, 0x3c5b, 0x80000001, 0x24, 0xd, 0x1, 0x0, 0x2, 0xe661, 0x4, 0x7, 0x3, 0x8, 0x4c74, 0x80000000, 0x0, 0x3, 0xe, 0x8, 0x8000806e, 0x7, 0x200, 0x1, 0x7, 0x200, 0x3e, 0x2, 0x6, 0x6, 0xc, 0x5, 0x4, 0x8, 0x400, 0x80, 0x1, 0x5, 0x6, 0x8, 0x4, 0x1, 0x40], [0x10000009, 0x9, 0x8000012f, 0x8004, 0x1, 0xfffffff3, 0x129432e6, 0x88, 0xf9, 0xe, 0x8, 0x6c7, 0x9, 0xfffffffc, 0x8, 0x0, 0x0, 0x5, 0x2f, 0xe, 0x30e, 0x78, 0xea4, 0x0, 0x4, 0x7, 0x7fff, 0x6, 0x400, 0x6, 0x6, 0x1, 0xff, 0x5, 0x1000005, 0x5f34, 0xd, 0x100004e0, 0x2, 0x4, 0xb, 0x8001, 0x9, 0x8, 0x9, 0x6, 0x47, 0x8020, 0x1, 0xfe000000, 0xffff, 0x2, 0x4, 0x9, 0x3, 0x3, 0x9, 0x1, 0x3, 0xffffffff, 0xbc45, 0x48c93690, 0x43, 0x103], [0x7, 0xa, 0x4, 0x5, 0x7f, 0x100, 0x8d2, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0x9, 0x4, 0x6, 0x5, 0x0, 0x6, 0x5, 0x1, 0x86, 0x3, 0x303c, 0xbe7, 0xb, 0x5, 0x2, 0x2, 0x3, 0x20000008, 0x2, 0x6d03, 0x6, 0x38, 0x800003, 0x200, 0x0, 0x3, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x7, 0x6, 0x5, 0x6, 0xac8, 0xc2, 0x2, 0x3, 0x7ff, 0x12b, 0xfffffff9, 0x1, 0x1000000a, 0x0, 0x5, 0x1c, 0x120000, 0x3, 0x2006, 0x80a2ed, 0x4, 0x25], [0x80009, 0xbb33, 0x80000000, 0xb, 0x5, 0x93a, 0x6, 0x1000006, 0xfffffffe, 0xb9, 0xce7, 0x1ff, 0x2, 0x57, 0x4, 0x3, 0x101, 0x10000, 0x4, 0x7fff, 0x10000, 0x7ff, 0x2, 0x5, 0x1, 0x2, 0x14d, 0x60a7, 0x16, 0x96, 0xfffffffe, 0x80000000, 0x0, 0x4, 0xc8, 0x1, 0xfffff000, 0x10080, 0x3, 0x7e, 0x100, 0x1000, 0x7, 0xaf, 0x8, 0x6, 0x226, 0x5, 0x5, 0x1, 0x30b1d693, 0xa1f, 0xf40, 0x7, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0xb1e, 0xd7, 0x200, 0xffff3441, 0x1]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) close_range(r6, 0xffffffffffffffff, 0x3f00000000000000) socket$nl_generic(0x10, 0x3, 0x10) 827.399873ms ago: executing program 0 (id=2727): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e20, @empty}], 0x10) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f00000002c0)=[@in={0x2, 0x4e20, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f0000000100)=0x10) 703.769718ms ago: executing program 2 (id=2728): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x1d, 0x0) fremovexattr(r0, &(0x7f0000000100)=@known='system.posix_acl_default\x00') 664.643062ms ago: executing program 2 (id=2729): mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$tipc(r1, &(0x7f0000000240)={0x0, 0xfffffff5, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0xfffffdef}], 0x1}, 0x0) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x1, 0x2, 0x7fff7ffc}]}) close_range(r2, 0xffffffffffffffff, 0x200000000000000) r3 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000480)=@bpf_tracing={0x1a, 0x4, &(0x7f0000000180)=ANY=[@ANYBLOB="d71af4fff8ffffff478248ff14000000183900000300000000000000000000001fc1cee534aeed02424c50e2a1b92a338d7dcf078dedc3a7f1745b095e4eebe200acb0f9d31cb184060dae"], &(0x7f0000000100)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000280)=""/145, 0x41100, 0x22, '\x00', 0x0, 0x1c, 0xffffffffffffffff, 0x8, &(0x7f0000000340)={0x6, 0x2}, 0x8, 0x10, &(0x7f0000000380)={0x2, 0x7, 0x8, 0x1}, 0x10, 0x1e9ab, 0xffffffffffffffff, 0x7, &(0x7f00000003c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff], &(0x7f0000000400)=[{0x0, 0x4, 0xf, 0x7}, {0x3, 0x2, 0x1, 0x6}, {0x5, 0x1, 0xc, 0x6}, {0x4, 0x4, 0x1, 0x2}, {0x4, 0x5, 0xe, 0x7}, {0x3, 0x3, 0xf}, {0x2, 0x4, 0x6, 0x7}], 0x10, 0x7}, 0x94) bpf$OBJ_PIN_PROG(0x6, &(0x7f0000000540)=@o_path={&(0x7f0000000080)='./file0\x00', r3, 0x4000, r0}, 0x18) 573.647507ms ago: executing program 2 (id=2730): r0 = socket$xdp(0x2c, 0x3, 0x0) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000100)=ANY=[@ANYRES8=r0, @ANYRES64=r0, @ANYBLOB="00082dbd7000fb010025010000000400030004000280"], 0x1c}, 0x1, 0x0, 0x0, 0x8004}, 0xa4) (async) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x8000, 0x0) (async) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a32000000001400000011"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) openat$nullb(0xffffffffffffff9c, &(0x7f00000000c0), 0x185042, 0x0) (async) openat$audio(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ff9000/0x1000)=nil, &(0x7f00006ee000/0x1000)=nil, &(0x7f0000459000/0x3000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f00005e2000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0, 0x0, r1}, 0x68) (async) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x4004005) (async) r3 = io_uring_setup(0x1, &(0x7f0000000040)={0x0, 0x88359, 0xc000, 0x20000a, 0x33c}) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000093c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@deltfilter={0x24, 0x2d, 0x8, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x1}, {0x3, 0x4}, {0xe, 0xd}}}, 0x24}, 0x1, 0x0, 0x0, 0x40005}, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x3, &(0x7f0000000000)=0x6, 0x4) r4 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r4, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000040)=0x8) (async) io_uring_enter(r3, 0x2219, 0x7721, 0x16, 0x0, 0x0) (async) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000380)=ANY=[@ANYRES64=r3], 0xa8}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) (async) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x1000, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r7, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x6, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0x7, 0x4, 0x5, 0x4, 0x8], 0x25000, 0x304}) (async) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$KVM_RUN(r7, 0xae80, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x40) r10 = dup(r9) ioctl$KVM_SET_USER_MEMORY_REGION(r9, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) (async) r11 = ioctl$KVM_CREATE_VCPU(r10, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r11, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) 499.836377ms ago: executing program 2 (id=2731): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_BEACON(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000380)={0x24, r1, 0x1, 0x70bd26, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_IE_ASSOC_RESP={0xf, 0xe, [@dsss={0x3, 0x1}, @gcr_ga={0xbd, 0x6, @broadcast}]}]}, 0x24}, 0x1, 0x0, 0x0, 0x40010}, 0x24000891) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000003c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_PROBE_MESH_LINK(0xffffffffffffffff, &(0x7f0000001200)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000011c0)={&(0x7f00000004c0)={0xccc, r1, 0x200, 0x70bd2d, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_FRAME={0xcc, 0x33, @data_frame={@a_msdu=@type10={{0x0, 0x2, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1}, {0x2}, @random="368c3e1b2fd1", @device_a, @initial, {0xd, 0x3aa}}, @random="f0d01d56a64a3fd1c7e384eb93697f3529674cd2a86e149fcaa3ac59e0640bf8d7153072404e1661943835b179aceed7c6206d164b7edabd6e2194bc4277ae4e959dab4dc2775ec23bd3783ab408aa35a1b5c335985232f08864e92b9d8d6e81f7c16d5c8f5e3e45d990c7dc1ddfc782220c7034008bf1586a4fb9fd10cbb7da3995b85d489fae17b21d65e9825d8ba308f2f6bd112e9b92af102f3d84b88e1ea319aeb90859e07dbe109d4dc7e37262"}}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_FRAME={0x363, 0x33, @data_frame={@a_msdu=@type11={{0x0, 0x2, 0x6, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1}, {0xc14}, @broadcast, @device_a, @initial, {0xf, 0x2}}, @random="83b8e29d13a8f4736ca6943cda3738c3b92f0f15d388435cccd2965de91ba1d397f164f9ef0fed09ae6a553355ec9ad563ea10a63db77cd8cfec4dd79656e36c9c2eca71ee1e1264ac8acb99c45ea43468515f03e27b3fe73d92a757d87d37ff7c73cc717625a88e0d34629497a7aecaeb52dfa5ee54f8e255b45dd479b0ca0a5672a0391dc993a6f7c8158a8495bc60a9d8842a68b1ec61bd724ed339c99ea5e3bc4946604e2f2e226abeed40bc9b89254bea547cd0ea9f8d051da91763766d00aa816091425d9d9ee81fe876f2b36e473aefe35b422f5c6dc2d284cc69b4fcfe6325dd3ec3f3ef3e38bc880a1567a6c47bf4b6624e9391eebff479fb95b929b4f7dcfd78d4ed8b55696284b5f7778ab50c757caead12b37a6fabe29d5d54e681a12885223802aceaa23a152d33a67af64d2bb1bd0fbe5f0d3aaa8bedd0a2455af88f1fdcac671793ba23d916b186b5a689125ad2ec2acca8825027be72f91db12a951aa168e4aed80eaffdfd23bd09c760f7b705e0a4deb77481343d05bb4e958efe38865360f0ba6be4cf14c7c72c9e8ea851b3c9b86b6c17362bd6037079cfca6d406ce05f3af75b1d9b96b12861e1b63483fa69f964cfd82df38692ef8c118a3416f20a3e6c964f727a3975a2bb4791715d7d7109e0c0aa5954e801e40cd996f3ecf427fa0a95037b2fcc6b18cbaf1bc80e5f9b4f97f8302f7a9939b1f956d5aa313b1bddb235076ead81557537e7c4952ac55c464f5fba04ea19a23fa9fe4445d10b4ee99479b0d0d94f971ef4d8fff2d252f1e05ac208d3e75a73a35c5ff97d0b49451537290222fcee88a68e3deb5a6786b05f090ff5eb3bfb1d84096d88272503c65f97723dbf2b5ef636b24cc14069a2e4c4b0806e6b99199ff654fa2b59e6c7f2e953490da8d621d7db1f39a5343bf0022c2fdd07427a26f734645b6900966fc62d64f637b0fa8a7a38d8cb2ece4fbcacc89dcd9eb2f519ceb0a5d4ad28aba9a3f70699316dc59a345ddadef02f236beaed9420f323ec2a047ff82ee7ca8f27111701a9d635dee9a5628de55dc15c9de088b77ce4d6b5f96b11fb88f862295d8fca7102b61e6f3634c2d745402a270225ba6ab752b18611f7c376e16924266c23fae4387fa27adccd1186e4ed27a1143baa57574b349c4303941d58"}}, @NL80211_ATTR_FRAME={0x52, 0x33, @ctrl_frame=@ba={{}, {0x1}, @device_b, @device_b, @multi={{0x1, 0x1, 0x1, 0x0, 0x4}, [{0x0, 0x2, {0x0, 0x4}, "73a73a15e305d5d3"}, {0x0, 0xa, {0x5, 0x9}, "a591af52bb8499cd"}, {0x0, 0xa, {0x6, 0xbe3}, "c8c410e8571abfea"}, {0x0, 0x5, {0x4, 0xf1}, "8497ea03614870b7"}], {0x0, 0x0, {0x9, 0x5}, "7b1a66aacb5682f2"}}}}, @NL80211_ATTR_FRAME={0x814, 0x33, @data_frame={@a_msdu=@type11={{0x0, 0x2, 0x9, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {0x8be}, @device_a, @device_b, @initial, {0x6, 0xa}, @device_b, @value={0xc, 0x0, 0x0, 0x1, 0xa5}, @value=@ver_80211n={0x0, 0x6, 0x2, 0x2, 0x0, 0x1, 0x1}}, @random="79571c32409251ba2acceafbb3b30a0753c6a2987603ba8f91d38b7bc0daea1dd8da1bc80e45405ad27b01075bce4339210d3ccde4ded94fc1f92a17aebc703d8385eafb37900c0b65cbfe7307df9a1f1c44ae2f82c39c6e765b9343721da67e5bb41124bcaaf38ad7f76ef4a7a7b5b74748995481ff54b825a2de0c701c78e61f32275c0bbd7af9afef871e4d525a2171304bc1476129b5d53cdc76b0b61a631493c799e1310513a772bd65a437e4ab43caeb557b50db0f1716b54f0f2bd2a35eb32c1f75a1cbbc23f18781a675bb989d1719b8a3fab9ae427fe92fe7558b87866da944864472bcc9da8c861a32ea6026a15ada059be81ec68f993a17c7a2a0db6826ff8a5e8dcbb7f545d960009ec4919dc2071fd5b244dd16f7ee7babe2f2d2e2eeb3b077ad90c570bc30de4dbf48df3478fc51c6c2243087756d1857563c9b4a6acb9755e0906d31305eda8601b167ab8710b6a2485ebcebdcf6367dc0034343b0d12967fc1b11f1386155f90193a6fcc94cce13013fbe733a7188c5ffb49378dde035a092d349039fa126d8f4cc96008c043310b49875cd8130d0a7d9750a446cbffefbd39a2e766f501eeaccfd69ea66dd13bb38233204fa71425b8c5af2a66b90e62ba39693b0e47569fccdf88175a9b2716c2ebe54b8984a9edc8c845daeff71d263e4ba8f9cab96dcc243f94b5aef44d75c2cb91b3947111e05354ba99658fb34a64765bb76a86f128fcc6f0608f4748139d9a73161c09c5b53697aee47148de3c6d4b70814cae91e9a32b82c503bce3034908c92d152164f10a612e60d717517d1d95ba39dee973a0b0913b8f8ddc2bf31a0103a1234561eaee87b0883ddc8a2085c722ba7e790a9418413cae6db26d5e3f78eee9c6cf83b4017d96dc2c5d7920f6dd4bac07b9640ccfe20c1d046c1bf0eef53cd731b4e5d9616785281fcc4943f1b19637341880f6bc6f5b9b873ef839a6a4af6c2bae16dc46827b27a0f238807450f1ba1f9a218f812d3a28cfbed903ae3c83872bd5491e2e3ed2aa8d1b56fec65deaedcd6e69df9fdfeb5a86f47d2fb18baf66c125b4df625588d13f3d176dc70d32cd99eec4802b0791694ecd44c10b55e7c70c5b89be4332a2232286a164cf5fd98b8e2671117eb06920700b7889c741736f244b23faa22b925d695c213a3f059671f576d493970cdb341e77710fff0a0eb3dd8055eddabe57cdef767204cfc570680eb9457bc737918ca8afc9d554d3a892395633b8c3457f6b99a8b9e8274bcfeabcd4b46fb88f60ee5be169e54339e5b302d94ed97089a6b2c9cdd179f9e5c85fed1f5d45f477d23d992b266dc9ed80440697806d06e0a386a8a9d567fb57c3b2e2310db6e580f247bc7de37894604835513816718aca64c7f6d308d220e2cccd813e32d86ae79edb7ac04c52384dbac300ca78d766e074321676e43a696473165bc314519f48e43f4f1078dae00a2d8264ae147d45da3208225d2ffefa6480f60e62eb468dcb49fcce599d6450b4ab6310381439e9c49b49279d31b6d5604b3e189207482a46d13151a6c1f3f5d0c93af3076727e8519640c3d1c1d5765ab1694acea942a4cb1ed715379a1f9f42db8c61c46e7c03761c12c586dc2720d554f540cb4fd6e4461a73187cac02e0f078d51c21c5bec0d6f03805bd5e878b0d73c4ac767a0f7abc19248ee5c0eb7b0d96eb954f0a4bcda500100a235bbc34fc980ebd013ba8be439f113915f814d0da419a8275e50f248c6d1e95359eda55e01c4ffec544d66396d7792412c3f7d76db9fe826717a43fe00fbe97b4143e13ce84eedb91b12546b27bfb711ea08aef08d09ec4729f6ae41a6095217790ed2be1b44d1c963da5aa800301b6fb50ce2b8dfbbccb577109756075c718154853c23ba268c17a17a409c51f124d94bcf33274d70c63dd6179ada328007e690488f1389e5319b797922f89bae50e0892cd3b6e21cdc4d47cec8556ee415db69c597f78de69b2d2d5ed3c7c968c2e4e10a3789444893064b5f1f276a373cf49a6eb1887726e5be0b56cbb9c0b0ebf76cd5d9189c14144f26444bdc28a08ab00ea80b0eb6595a4dabad1736f21b8bfc408b08fdd9ec154f0c9feee2daf28b9f2fe2f50a0c4fe6f36e59d9e957ac9000f1ad2043ba31f194d9ec5600a49a137058ccdedafbd970ddfbd0c2c022da8d9ce21ee1ba4129b866bfec815fa4914954686abe2a2cbc2dfc22984ebd6522d0304e0354d742715753307b8701f4809d4cfdd71b0f84b7cfafe2febf1144be097547780a17d0ea3334a417e847df7359921cf1667b59b32df782f00c291d26720e733f4832ebb03013e34ed6c6181dd422e079d21cc542020b01b0ab7cf53bcaafb1aed1e1adbeea1c71ccfa1c7b5be195ff4e613b3c26d1b47bcd048d3a7f52a813dacbbd1b26575b308adce51dcdee0715c43b842e30c1fee45190fdc999f30351089d39c77d75a0356ce478f81f73f9bfb2985e4c2df9ca4c7ae44f890c7a56605ef2fc985d12024f5a6648ecd70766e9695ef77f04f95934d0971792ed886f7f107cb748b52e6082b7aa12c1227dc358a66dab3a2df9cc204ad0ba50b822a9d5b5786344d4e48b4d15e1148f4f752a1df361559b425daca196b5f57887c1c98b7b4ef7ae6cdd402a26fcc00d2e3a4bb828b5f266bea44e46f98310079684439acbe2f48545fa57ee3132b3336f3eeb1d46fd6376bd7993ee3df6d7f6338d892fc331b1d792f8791c9907b2d966bc1e34edd28c083ad58b96b1694b0da0352d653376aeac0363a7cc16a8360e4166e2f1a2ee55a34dc1d1d4538277946dae7833e97a1da00b7d08cdaca6ffe2df745dc9e9ff2a1f62aba3ff"}}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}]}, 0xccc}, 0x1, 0x0, 0x0, 0x4000013}, 0x4800) setsockopt$inet_sctp6_SCTP_INITMSG(r2, 0x84, 0x2, &(0x7f00000000c0)={0xfffc, 0xc}, 0x8) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01040000000000000000010000000900010073797a310000000054000000030a01020000000000000000010000000900030073797a320000040028000480080002400000000008000140000000051400030076"], 0xe8}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a58000000160a0302000200000000000002000000090002"], 0x80}}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a30000000406c000000160a01000000000000000100010000000900010073797a30000000000900020073797a3000000000400003800800014000000000080002400000fbff2b0003801400010067656e6576653000000000000000000014000100776732000000000000000000c6e49c0f5c000000180a0101000b000000000000010000000900020073797a30000000000900010073797a3000000000300003802c000380140001"], 0x110}}, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_TDLS_MGMT(r5, 0x0, 0x40080) r6 = openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND_IP(r6, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f0000000280)=[@in={0x2, 0x4e23, @initdev={0xac, 0x1e, 0x2, 0x0}}]}, &(0x7f0000000140)=0x10) ioctl$sock_SIOCSIFVLAN_GET_VLAN_VID_CMD(r5, 0x8983, &(0x7f0000000240)) 231.942867ms ago: executing program 5 (id=2732): r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x2002, 0x0) ioctl$SNDCTL_DSP_SETFMT(r0, 0xc0045005, &(0x7f0000001180)=0x2000000) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000600)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000580), &(0x7f00000005c0)}, 0x20) r2 = socket$packet(0x11, 0x3, 0x300) r3 = socket(0x10, 0x2, 0x0) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000005c0)=0x56) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = dup(r6) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000840)={0x1ff, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r8, &(0x7f0000000000/0x18000)=nil, &(0x7f0000001080)=[@text64={0x40, &(0x7f0000000080)="c4417d290ddada01ca48b8a9884315c2c245040f23c00f21f835000002000f23f8c4a2e0f3db0f07d2c74424001e09000000442402e4000000654c0fc72ef3410fc777d365420fc7700066b8502466ef", 0x50}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r7, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text16={0x10, 0x0}], 0x1, 0x54, 0x0, 0x0) ioctl$KVM_RUN(r8, 0xae80, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000001c0)=ANY=[@ANYBLOB="4000000010003904000000000000000080040000", @ANYRES32=r4, @ANYBLOB="01980000000000002000128008000100736974001400028006000e000600000008000100", @ANYRES64=r3], 0x40}, 0x1, 0x0, 0x0, 0x80}, 0x0) sendto$packet(r2, &(0x7f0000000600)="05d936277c6f54220002097844ffcf8bd1846f7f83477ca1b278e3e4018a34844b9d62cbd7cd2a62", 0x28, 0x8c1, &(0x7f00000000c0)={0x11, 0x86dd, r4, 0x1, 0x4, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}, 0x14) r9 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x4) fcntl$setstatus(r9, 0x4, 0x42000) write$P9_RREADDIR(r9, &(0x7f00000002c0)={0xb, 0x29, 0x2, {0x7fff}}, 0xb) r10 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000400)={0x6, 0x1b, &(0x7f0000000640)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xffff, 0x0, 0x0, 0x0, 0xfffffffe}, {}, {}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r1}}, @alu={0x4, 0x0, 0x3, 0xa, 0x2, 0xc, 0x1}, @map_val={0x18, 0x2, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r9}}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000140)='GPL\x00', 0x640000, 0xe3, &(0x7f0000000740)=""/227, 0x40f00, 0x28, '\x00', r4, 0x25, 0xffffffffffffffff, 0x8, &(0x7f0000000300)={0xa, 0x2}, 0x8, 0x10, &(0x7f0000000040)={0x5, 0x9, 0x3, 0x8}, 0x10, 0x0, 0x0, 0x1, &(0x7f0000000380)=[0xffffffffffffffff, 0xffffffffffffffff], &(0x7f00000003c0)=[{0x5, 0x1, 0xe, 0x4b3e12886062cb06}], 0x10, 0x2}, 0x94) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000004c0)={0x1b, 0x0, 0x0, 0x7f, 0x0, 0xffffffffffffffff, 0x3, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0xece5955, 0x1}, 0x50) bpf$PROG_BIND_MAP(0x23, &(0x7f0000000540)={r10, r11}, 0xc) mmap$dsp(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x3, 0x12, r0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000280)=ANY=[@ANYBLOB="b702000000000000260000000000000085000000c4000000950017000000000099b540d922f0b21eead8eecedfc8c63ba4743235c432559a7c36147649571f829cfdfef2630b0d7560c75b559d3b3f8c7122a816630e0d087ebc"], &(0x7f0000003ff6)='GPL\x00', 0x8, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback=0x24}, 0x94) syz_clone(0x800000, 0x0, 0x0, 0x0, 0x0, 0x0) 83.521047ms ago: executing program 5 (id=2733): r0 = inotify_init1(0x80000) inotify_add_watch(r0, &(0x7f0000000400)='.\x00', 0xa4000021) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) (async) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000780)={'netdevsim0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}, {0x0, 0x9}}, [@qdisc_kind_options=@q_clsact={0xb}, @TCA_RATE={0x6, 0x5, {0xff, 0x7}}]}, 0x38}}, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='blkio.throttle.io_service_bytes_recursive\x00', 0x275a, 0x0) (async) r4 = syz_open_dev$vbi(&(0x7f0000000000), 0x3, 0x2) (async) r5 = syz_io_uring_setup(0xfba, &(0x7f0000000400)={0x0, 0xfffffffd, 0x100, 0x0, 0x40055}, &(0x7f0000000100)=0x0, &(0x7f0000000040)=0x0, &(0x7f0000000000)=0x0) r9 = io_uring_register$IORING_REGISTER_PERSONALITY(r5, 0x9, 0x0, 0x0) syz_io_uring_submit(r6, r7, r8, &(0x7f00000001c0)=@IORING_OP_POLL_REMOVE={0x7, 0x48, 0x0, 0x0, 0x0, 0x12345, 0x0, 0x0, 0x0, {0x0, r9}}) (async) mknodat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x1000, 0x103) (async, rerun: 64) r10 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x80800, 0x0) (rerun: 64) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x101, &(0x7f00000002c0)) (async) chmod(&(0x7f0000000000)='./cgroup.cpu/cgroup.procs\x00', 0x22) (async) poll(&(0x7f0000000300)=[{r10, 0x9001}, {r10, 0x2400}], 0x2, 0x76) open(&(0x7f0000000040)='./file1\x00', 0x80242, 0x0) (async) io_uring_enter(r5, 0x1, 0xfffffffd, 0x9, 0x0, 0x0) (async) ioctl$VIDIOC_QUERYBUF_DMABUF(r4, 0xc0585609, &(0x7f00000000c0)={0xfffffffd, 0x1, 0x4, 0x1000, 0x3, {0x0, 0xea60}, {0x2, 0x1, 0x8f, 0x5, 0x3, 0x84, "5f0ca00e"}, 0x2, 0x4, {}, 0x8}) 486.328µs ago: executing program 5 (id=2734): r0 = socket$inet6(0xa, 0x2, 0x0) r1 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r1, &(0x7f0000000180)=@name={0x1e, 0x2, 0x47b8f505e53035ec, {{0x43, 0x2}, 0x3}}, 0x10) setsockopt$inet6_buf(r0, 0x29, 0x22, &(0x7f00002cef88)='\x00', 0x1) 0s ago: executing program 5 (id=2735): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000100)={0x3, 0x1000}, 0x4) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = landlock_create_ruleset(&(0x7f00000001c0)={0xa019, 0x1, 0x3}, 0x18, 0x0) landlock_restrict_self(r1, 0xd) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="380000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="80420000000000001000128008000100687372000400028008003a00f8ff07"], 0x38}}, 0x0) setsockopt$inet_int(r2, 0x0, 0x22, &(0x7f0000000000), 0x2) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) write$tun(r4, &(0x7f0000000580)={@val={0x0, 0x800}, @val={0x3, 0x5, 0xfa, 0x3, 0x83, 0x6}, @ipv6=@generic={0x4, 0x6, "84e437", 0x1e4, 0x0, 0x1, @rand_addr=' \x01\x00', @private2, {[@srh={0x88, 0x8, 0x4, 0x4, 0x1, 0x68, 0x3, [@mcast2, @private0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}]}, @dstopts={0x21}, @dstopts={0x67, 0x6, '\x00', [@pad1, @enc_lim={0x4, 0x1, 0x8}, @padn={0x1, 0x5, [0x0, 0x0, 0x0, 0x0, 0x0]}, @generic={0xba, 0x22, "ed4ef63a13ddd68bf6a88205d353fb968e4a2bb9c9b7ff6f27d2f3adba48f8e01147"}]}, @hopopts={0x87, 0x1c, '\x00', [@padn={0x1, 0x8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @padn={0x1, 0xa, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @calipso={0x7, 0x30, {0x0, 0xa, 0x3, 0x3311, [0x0, 0xfa4, 0x7, 0x7ff, 0x4]}}, @calipso={0x7, 0x10, {0x0, 0x2, 0x0, 0xfffc, [0x1af7]}}, @hao={0xc9, 0x10, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @jumbo={0xc2, 0x4, 0x9}, @ra={0x5, 0x2, 0x2}, @generic={0x6, 0x5d, "5a868a361534ebd6104ec9bac8ecbdfb4d38c7483165140a6f6bb31729625d779bf8a67577afee2ee8a3f93312ad30de906628c6030f73fe2510a1cb3860dd0ee210f3e9e7c0d8dc0105bc9cf3a0a519e0eae6e506e832bbffd77bd8e2"}, @generic={0x4, 0xa, "276b9fef0c30a3d1b072"}]}], "f0db043c0bdd5fa862ab40e05a5dd2c234dc7773e3831178a890b2a83c13e6f5d1ec7ad9739f588cc88c83a9f836eb8045335fd06dd485c2446015e93dfbfe2d67d567703ef49b27e9e4936532e95fc00244b2e3f5d127b50a7c3001ae37c96c0439a96a"}}}, 0x21a) landlock_restrict_self(r1, 0x4) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = getpgrp(0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x15) fcntl$setownex(r6, 0xf, &(0x7f0000000100)={0x2, r7}) sendmsg$unix(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000200)="b5", 0x1}], 0x1}, 0x240408c1) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0xf) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000000)={0x0, 0x6}, 0x4) syz_usb_connect(0x0, 0x2d, &(0x7f00000002c0)=ANY=[@ANYBLOB="120100001ddf8208c007121522300080000109021b0001000000010904080001faf40d000905", @ANYRES64], 0x0) kernel console output (not intermixed with test programs): 481.577437][ T56] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 481.595340][ T56] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 481.831279][ T5685] usb 5-1: new high-speed USB device number 127 using dummy_hcd [ 481.863082][ T56] team0 (unregistering): Port device team_slave_1 removed [ 481.885347][ T56] team0 (unregistering): Port device team_slave_0 removed [ 481.967864][ T5685] usb 5-1: device descriptor read/64, error -71 [ 482.231882][ T5685] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 482.366463][ T5685] usb 5-1: device descriptor read/64, error -71 [ 482.476685][ T5685] usb usb5-port1: attempt power cycle [ 482.816584][ T5685] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 482.851199][ T5685] usb 5-1: device descriptor read/8, error -71 [ 483.103293][ T5685] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 483.142251][ T5685] usb 5-1: device descriptor read/8, error -71 [ 483.269600][ T5685] usb usb5-port1: unable to enumerate USB device [ 484.210730][ T5292] 8021q: adding VLAN 0 to HW filter on device eth3 [ 484.375021][ T29] audit: type=1326 audit(1781026479.090:1732): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13422 comm="syz.0.2264" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f10ddd9ce59 code=0x7ffc0000 [ 484.421245][T13423] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 484.447595][ T29] audit: type=1326 audit(1781026479.090:1733): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13422 comm="syz.0.2264" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f10ddd9ce59 code=0x7ffc0000 [ 484.545182][ T29] audit: type=1326 audit(1781026479.090:1734): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13422 comm="syz.0.2264" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f10ddd9ce59 code=0x7ffc0000 [ 484.638177][ T29] audit: type=1326 audit(1781026479.090:1735): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13422 comm="syz.0.2264" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f10ddd9ce59 code=0x7ffc0000 [ 484.712710][ T29] audit: type=1326 audit(1781026479.120:1736): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13422 comm="syz.0.2264" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=40 compat=0 ip=0x7f10ddd9ce59 code=0x7ffc0000 [ 484.721662][T13249] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 484.853577][ T29] audit: type=1326 audit(1781026479.120:1737): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13422 comm="syz.0.2264" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f10ddd9ce59 code=0x7ffc0000 [ 484.878365][T13249] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 484.929152][T13443] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 484.940128][T13249] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 484.946169][ T29] audit: type=1326 audit(1781026479.120:1738): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13422 comm="syz.0.2264" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f10ddd9ce59 code=0x7ffc0000 [ 485.023918][T13443] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 485.036077][T13249] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 485.052109][ T29] audit: type=1326 audit(1781026479.120:1739): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13422 comm="syz.0.2264" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f10ddd9ce59 code=0x7ffc0000 [ 485.114694][T13249] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 485.129976][ T29] audit: type=1326 audit(1781026479.120:1740): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13422 comm="syz.0.2264" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f10ddd9ce59 code=0x7ffc0000 [ 485.131863][T13249] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 485.223866][ T29] audit: type=1326 audit(1781026479.120:1741): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13422 comm="syz.0.2264" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f10ddd9ce59 code=0x7ffc0000 [ 485.270849][T13249] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 485.332951][T13249] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 485.652693][T13249] 8021q: adding VLAN 0 to HW filter on device bond0 [ 485.840194][T13249] 8021q: adding VLAN 0 to HW filter on device team0 [ 485.856447][T13204] bridge0: port 1(bridge_slave_0) entered blocking state [ 485.856650][ T5685] usb 1-1: new high-speed USB device number 37 using dummy_hcd [ 485.863736][T13204] bridge0: port 1(bridge_slave_0) entered forwarding state [ 485.899198][T13204] bridge0: port 2(bridge_slave_1) entered blocking state [ 485.906525][T13204] bridge0: port 2(bridge_slave_1) entered forwarding state [ 486.035131][ T5685] usb 1-1: Using ep0 maxpacket: 32 [ 486.063500][ T5685] usb 1-1: config 151 has too many interfaces: 37, using maximum allowed: 32 [ 486.088342][ T5685] usb 1-1: config 151 has 1 interface, different from the descriptor's value: 37 [ 486.098432][ T5685] usb 1-1: config 151 interface 0 altsetting 16 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 486.127192][ T5292] 8021q: adding VLAN 0 to HW filter on device eth4 [ 486.144305][ T5685] usb 1-1: config 151 interface 0 altsetting 16 endpoint 0x81 has invalid wMaxPacketSize 0 [ 486.171804][ T5685] usb 1-1: config 151 interface 0 has no altsetting 0 [ 486.181554][ T5685] usb 1-1: New USB device found, idVendor=320f, idProduct=5041, bcdDevice= 0.00 [ 486.191575][ T5685] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 486.195243][T13249] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 486.220697][ T5685] usbhid 1-1:151.0: fixing wrong optional hid class descriptors count [ 486.402506][ T5636] Bluetooth: hci1: unexpected event for opcode 0x2007 [ 486.433531][T13477] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 486.460697][T13477] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 486.555411][T13249] veth0_vlan: entered promiscuous mode [ 486.681340][ T5685] evision 0003:320F:5041.001C: unknown main item tag 0x0 [ 486.693061][ T5685] evision 0003:320F:5041.001C: unknown main item tag 0x0 [ 486.698859][T13249] veth1_vlan: entered promiscuous mode [ 486.710158][ T5685] evision 0003:320F:5041.001C: unknown main item tag 0x0 [ 486.722527][ T5685] evision 0003:320F:5041.001C: unknown main item tag 0x0 [ 486.740717][ T5685] evision 0003:320F:5041.001C: unknown main item tag 0x0 [ 486.748500][ T5685] evision 0003:320F:5041.001C: unknown main item tag 0x0 [ 486.757141][ T5685] evision 0003:320F:5041.001C: unknown main item tag 0x0 [ 486.766104][ T5685] evision 0003:320F:5041.001C: unknown main item tag 0x0 [ 486.788641][ T5685] evision 0003:320F:5041.001C: unknown main item tag 0x0 [ 486.805249][ T5685] evision 0003:320F:5041.001C: unknown main item tag 0x0 [ 486.825144][ T5685] evision 0003:320F:5041.001C: reserved main item tag 0xe [ 486.869124][T13249] veth0_macvtap: entered promiscuous mode [ 486.907082][T13249] veth1_macvtap: entered promiscuous mode [ 486.914138][ T5685] evision 0003:320F:5041.001C: hidraw0: USB HID v0.81 Device [HID 320f:5041] on usb-dummy_hcd.0-1/input0 [ 486.964083][ T5685] usb 1-1: USB disconnect, device number 37 [ 486.974328][T13495] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 486.981816][T13249] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 487.013707][T13495] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 487.052085][T13495] loop5: detected capacity change from 0 to 7 [ 487.077338][T13249] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 487.094754][T13495] Dev loop5: unable to read RDB block 7 [ 487.119086][T13495] loop5: unable to read partition table [ 487.137110][T13495] loop5: partition table beyond EOD, truncated [ 487.137635][T13494] fido_id[13494]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.0/usb1/report_descriptor': No such file or directory [ 487.148969][T13495] loop_reread_partitions: partition scan of loop5 (被x ) failed (rc=-5) [ 487.185306][T13498] program syz.2.2279 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 487.199578][T13207] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 487.209830][T13207] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 487.235002][T13207] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 487.251022][T13207] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 487.552837][ T139] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 487.576449][ T139] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 487.660033][T13206] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 487.691203][T13206] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 488.247538][T13520] netlink: 'syz.2.2283': attribute type 1 has an invalid length. [ 488.330630][T13525] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 488.764548][T13537] netlink: 16 bytes leftover after parsing attributes in process `syz.5.2287'. [ 489.019008][ T5685] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 489.208094][ T5685] usb 5-1: config 0 has an invalid interface number: 199 but max is 1 [ 489.231825][ T5685] usb 5-1: config 0 has no interface number 1 [ 489.250549][ T5685] usb 5-1: config 0 interface 199 altsetting 2 endpoint 0xA has invalid wMaxPacketSize 0 [ 489.271649][ T5685] usb 5-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 489.296821][ T5685] usb 5-1: config 0 interface 199 has no altsetting 0 [ 489.312852][ T5685] usb 5-1: New USB device found, idVendor=0002, idProduct=0000, bcdDevice= 0.00 [ 489.328357][ T5685] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 489.337524][ T5685] usb 5-1: SerialNumber: syz [ 489.350083][ T5685] usb 5-1: config 0 descriptor?? [ 489.533721][T13556] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 489.546585][T13556] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 489.568653][T13525] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 489.589556][ T5685] uvcvideo 5-1:0.199: Found UVC 0.00 device (0002:0000) [ 489.611924][ T5685] uvcvideo 5-1:0.199: No valid video chain found. [ 489.662097][ T5685] usb 5-1: USB disconnect, device number 5 [ 490.056477][ T5631] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 490.105307][T13567] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 490.114509][T13567] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 490.238008][ T5631] usb 6-1: Using ep0 maxpacket: 32 [ 490.251363][ T5631] usb 6-1: config 0 has an invalid interface number: 1 but max is 0 [ 490.261583][ T5631] usb 6-1: config 0 has no interface number 0 [ 490.270578][ T5631] usb 6-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=93.d8 [ 490.279897][ T5631] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 490.288520][ T5631] usb 6-1: Product: syz [ 490.292777][ T5631] usb 6-1: Manufacturer: syz [ 490.297685][ T5631] usb 6-1: SerialNumber: syz [ 490.305873][ T5631] usb 6-1: config 0 descriptor?? [ 490.324050][ T5631] usb 6-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 490.343024][ T5631] usb 6-1: selecting invalid altsetting 1 [ 490.353380][ T5631] usb 6-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 490.395407][ T5631] usb 6-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 490.420106][ T5631] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 490.438605][ T5631] usb 6-1: media controller created [ 490.479253][ T5631] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 490.549833][T13561] binder_alloc: 13560: pid 13560 spamming oneway? 1 buffers allocated for a total size of 4096 [ 490.695134][T13577] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 490.708256][T13577] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 490.757574][T13581] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 490.769679][T13581] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 491.119547][T13585] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 491.129358][T13585] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 491.144525][T13585] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 491.155400][T13585] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 491.249777][T13590] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 491.269874][T13590] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 491.381913][T13594] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 491.393770][T13594] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 491.625006][ T5631] usb 6-1: dvb_usb_ce6230: usb_control_msg() failed=-110 [ 491.637648][ T5631] zl10353_read_register: readreg error (reg=127, ret==-110) [ 491.659302][T13561] usb 6-1: dvb_usb_ce6230: usb_control_msg() failed=-32 [ 491.773063][ T5631] usb 6-1: USB disconnect, device number 2 [ 492.053259][T13613] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 492.079046][T13613] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 492.550730][T13621] qrtr: Invalid version 255 [ 493.124559][T13635] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 493.161080][T13635] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 493.194020][ T29] kauditd_printk_skb: 142 callbacks suppressed [ 493.194037][ T29] audit: type=1800 audit(1781026487.910:1884): pid=13645 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.2321" name="bus" dev="tmpfs" ino=2493 res=0 errno=0 [ 493.289395][T13635] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 493.298481][T13635] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 493.686518][ T5667] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 493.791415][T13660] netlink: 'syz.5.2323': attribute type 10 has an invalid length. [ 493.818026][T13660] team0: Port device geneve0 added [ 493.856753][ T5667] usb 5-1: Using ep0 maxpacket: 16 [ 493.872510][ T5667] usb 5-1: too many configurations: 98, using maximum allowed: 8 [ 493.898642][ T5667] usb 5-1: config 6 has no interfaces? [ 493.911229][ T5667] usb 5-1: config 6 has no interfaces? [ 493.930852][ T5667] usb 5-1: config 6 has no interfaces? [ 493.944290][ T5667] usb 5-1: config 6 has no interfaces? [ 493.955962][ T5667] usb 5-1: config 6 has no interfaces? [ 493.962696][ T5667] usb 5-1: config 6 has no interfaces? [ 493.969125][ T5667] usb 5-1: config 6 has no interfaces? [ 493.975545][ T5667] usb 5-1: config 6 has no interfaces? [ 493.983398][ T5667] usb 5-1: string descriptor 0 read error: -71 [ 493.992602][ T5667] usb 5-1: New USB device found, idVendor=09c0, idProduct=0200, bcdDevice=58.3c [ 494.001885][ T5667] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=154 [ 494.016146][ T5667] usb 5-1: rejected 8 configurations due to insufficient available bus power [ 494.027807][ T5667] usb 5-1: no configuration chosen from 8 choices [ 494.039904][ T5667] usb 5-1: USB disconnect, device number 6 [ 494.927207][T13685] netlink: 24 bytes leftover after parsing attributes in process `syz.5.2332'. [ 495.207587][ T5685] usb 1-1: new high-speed USB device number 38 using dummy_hcd [ 495.276685][ T5631] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 495.336455][ T5667] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 495.357920][ T5685] usb 1-1: config 36 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 495.369398][ T5685] usb 1-1: New USB device found, idVendor=6993, idProduct=b001, bcdDevice=3d.29 [ 495.378835][ T5685] usb 1-1: New USB device strings: Mfr=244, Product=0, SerialNumber=16 [ 495.387258][ T5685] usb 1-1: Manufacturer: syz [ 495.392039][ T5685] usb 1-1: SerialNumber: syz [ 495.426386][ T5631] usb 5-1: Using ep0 maxpacket: 16 [ 495.433822][ T5631] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 495.444759][ T5631] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 495.456382][ T5631] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 495.465518][ T5631] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 495.473668][ T5631] usb 5-1: Product: syz [ 495.477968][ T5631] usb 5-1: Manufacturer: syz [ 495.482612][ T5631] usb 5-1: SerialNumber: syz [ 495.486353][ T5667] usb 6-1: Using ep0 maxpacket: 16 [ 495.496389][ T5667] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 495.499861][ T5631] usb 5-1: 0:2 : does not exist [ 495.512690][ T5667] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid wMaxPacketSize 0 [ 495.522949][ T5667] usb 6-1: config 0 interface 0 has no altsetting 0 [ 495.535246][ T5667] usb 6-1: New USB device found, idVendor=060b, idProduct=500a, bcdDevice= 0.00 [ 495.550230][ T5667] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 495.568227][ T5667] usb 6-1: config 0 descriptor?? [ 495.606604][ T5685] usbhid 1-1:36.0: couldn't find an input interrupt endpoint [ 495.618207][ T5685] usb 1-1: USB disconnect, device number 38 [ 495.715087][ T5631] usb 5-1: 5:0: failed to get current value for ch 0 (-22) [ 495.781509][ T5631] usb 5-1: USB disconnect, device number 7 [ 495.795148][T13696] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2336'. [ 495.815132][T13703] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 495.838977][T13703] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 495.860859][T13703] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 495.862174][T13337] udevd[13337]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 495.874209][T13703] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 496.037262][ T5667] hid (null): unknown global tag 0xd [ 496.050527][ T5667] hid (null): unknown global tag 0xe [ 496.121215][ T5667] hid_parser_main: 436 callbacks suppressed [ 496.121238][ T5667] cougar 0003:060B:500A.001D: unknown main item tag 0x0 [ 496.138795][ T5667] cougar 0003:060B:500A.001D: unknown main item tag 0x0 [ 496.145882][ T5667] cougar 0003:060B:500A.001D: unknown main item tag 0x0 [ 496.153789][ T5667] cougar 0003:060B:500A.001D: unknown main item tag 0x0 [ 496.162122][ T5667] cougar 0003:060B:500A.001D: unknown main item tag 0x0 [ 496.171225][ T5667] cougar 0003:060B:500A.001D: unknown main item tag 0x0 [ 496.199973][ T5667] cougar 0003:060B:500A.001D: unknown main item tag 0x0 [ 496.209884][ T5667] cougar 0003:060B:500A.001D: unknown main item tag 0x0 [ 496.218705][ T5667] cougar 0003:060B:500A.001D: unknown main item tag 0x0 [ 496.225787][ T5667] cougar 0003:060B:500A.001D: unknown main item tag 0x0 [ 496.244240][ T5667] cougar 0003:060B:500A.001D: unknown global tag 0xd [ 496.273251][ T5667] cougar 0003:060B:500A.001D: item 0 1 1 13 parsing failed [ 496.317067][ T5667] cougar 0003:060B:500A.001D: parse failed [ 496.350531][ T5667] cougar 0003:060B:500A.001D: probe with driver cougar failed with error -22 [ 496.474514][T13715] sg_write: data in/out 808464396/116 bytes for SCSI command 0x30-- guessing data in; [ 496.474514][T13715] program syz.5.2336 not setting count and/or reply_len properly [ 496.686392][ T5667] usb 1-1: new high-speed USB device number 39 using dummy_hcd [ 496.799896][T13730] netdevsim netdevsim4 netdevsim0: IPsec offload requires 128 bit authentication [ 496.847874][ T5667] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 496.866583][ T5667] usb 1-1: New USB device found, idVendor=0c72, idProduct=000c, bcdDevice=22.4e [ 496.898263][ T5667] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 496.912599][ T5667] usb 1-1: Product: syz [ 496.917285][ T5667] usb 1-1: Manufacturer: syz [ 496.922040][ T5667] usb 1-1: SerialNumber: syz [ 496.939745][ T5667] usb 1-1: config 0 descriptor?? [ 496.972175][ T5667] peak_usb 1-1:0.0 can0: sending cmd f=0x6 n=0x1 failure: -22 [ 496.981947][ T5667] peak_usb 1-1:0.0: unable to read PCAN-USB serial number (err -22) [ 497.047263][ T5667] peak_usb 1-1:0.0: probe with driver peak_usb failed with error -22 [ 497.628522][T13738] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2349'. [ 498.131961][ T9488] usb 6-1: USB disconnect, device number 3 [ 498.664766][T13783] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 498.675788][T13783] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 498.695273][T13783] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2357'. [ 498.818547][ T9488] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 498.977010][ T9488] usb 6-1: Using ep0 maxpacket: 8 [ 498.992338][ T9488] usb 6-1: New USB device found, idVendor=047d, idProduct=5003, bcdDevice=2f.8c [ 499.013947][ T9488] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 499.030930][ T9488] usb 6-1: Product: syz [ 499.042655][ T9488] usb 6-1: Manufacturer: syz [ 499.052010][ T9488] usb 6-1: SerialNumber: syz [ 499.058991][T13793] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 499.071553][ T9488] usb 6-1: config 0 descriptor?? [ 499.087167][T13793] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 499.095273][ T9488] gspca_main: se401-2.14.0 probing 047d:5003 [ 499.218187][ T5685] usb 5-1: new full-speed USB device number 8 using dummy_hcd [ 499.389726][ T5685] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 175, changing to 4 [ 499.421684][ T5685] usb 5-1: language id specifier not provided by device, defaulting to English [ 499.454275][ T5685] usb 5-1: New USB device found, idVendor=04b4, idProduct=931f, bcdDevice= 0.40 [ 499.478630][ T5685] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 499.494929][ T9488] gspca_se401: Bayer format not supported! [ 499.507996][ T5685] usb 5-1: Product: syz [ 499.516543][ T808] usb 1-1: USB disconnect, device number 39 [ 499.542123][ T5685] usb 5-1: Manufacturer: ఉ [ 499.570758][ T5685] usb 5-1: SerialNumber: syz [ 499.831543][ T5685] usb 5-1: Audio class v2/v3 interfaces need an interface association [ 499.963630][ T5685] snd-usb-audio 5-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 500.015040][ T5685] usb 5-1: can't set first interface for hiFace device. [ 500.037354][ T5685] snd-usb-hiface 5-1:1.0: probe with driver snd-usb-hiface failed with error -5 [ 500.055065][ T5685] usb 5-1: can't set first interface for hiFace device. [ 500.063786][ T5685] snd-usb-hiface 5-1:1.1: probe with driver snd-usb-hiface failed with error -5 [ 500.077601][ T5685] usb 5-1: can't set first interface for hiFace device. [ 500.087311][ T5685] snd-usb-hiface 5-1:1.2: probe with driver snd-usb-hiface failed with error -5 [ 500.098212][T13828] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2367'. [ 500.111926][ T5727] usb 6-1: USB disconnect, device number 4 [ 500.136068][ T5685] usb 5-1: USB disconnect, device number 8 [ 500.234912][T13337] udevd[13337]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 500.457603][T13852] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 500.458292][ T9488] usb 1-1: new high-speed USB device number 40 using dummy_hcd [ 500.469922][T13852] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 500.611425][T13859] : renamed from vlan0 (while UP) [ 500.676910][ T9488] usb 1-1: Using ep0 maxpacket: 8 [ 500.700393][ T9488] usb 1-1: unable to get BOS descriptor or descriptor too short [ 500.727344][ T9488] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 500.766316][ T9488] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 500.784891][ T9488] usb 1-1: New USB device found, idVendor=0763, idProduct=1002, bcdDevice=5f.84 [ 500.795672][ T9488] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 500.828935][ T9488] usb 1-1: Product: syz [ 500.842790][ T9488] usb 1-1: Manufacturer: syz [ 500.861213][ T9488] usb 1-1: SerialNumber: syz [ 500.885223][ T9488] usb 1-1: config 0 descriptor?? [ 500.898136][T13873] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 500.920955][T13874] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 500.932752][T13873] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 500.954846][T13874] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 501.068627][ T5727] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 501.208422][ T5631] usb 1-1: USB disconnect, device number 40 [ 501.234423][T13883] loop6: detected capacity change from 0 to 2640 [ 501.242338][ T5727] usb 6-1: Using ep0 maxpacket: 16 [ 501.255656][ T5727] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 501.268942][T13883] buffer_io_error: 4949 callbacks suppressed [ 501.268958][T13883] Buffer I/O error on dev loop6, logical block 0, async page read [ 501.288392][ T5727] usb 6-1: config 0 has no interfaces? [ 501.294078][T13883] Buffer I/O error on dev loop6, logical block 0, async page read [ 501.306040][ T5727] usb 6-1: New USB device found, idVendor=056a, idProduct=0315, bcdDevice= 0.00 [ 501.318086][ T1315] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.324543][ T1315] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.332600][T13883] Buffer I/O error on dev loop6, logical block 0, async page read [ 501.340714][ T5727] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 501.349085][T13883] Buffer I/O error on dev loop6, logical block 0, async page read [ 501.358938][T13883] Buffer I/O error on dev loop6, logical block 0, async page read [ 501.367892][ T5727] usb 6-1: config 0 descriptor?? [ 501.386625][T13883] Buffer I/O error on dev loop6, logical block 0, async page read [ 501.395725][T13883] Buffer I/O error on dev loop6, logical block 0, async page read [ 501.433661][T13883] Buffer I/O error on dev loop6, logical block 0, async page read [ 501.441863][T13883] ldm_validate_partition_table(): Disk read failed. [ 501.448678][T13883] Buffer I/O error on dev loop6, logical block 0, async page read [ 501.456818][T13883] Buffer I/O error on dev loop6, logical block 0, async page read [ 501.464953][T13883] Dev loop6: unable to read RDB block 0 [ 501.471356][T13883] loop6: unable to read partition table [ 501.503871][T13883] loop_reread_partitions: partition scan of loop6 (3 ) failed (rc=-5) [ 501.858534][T13871] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 501.912085][T13871] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 502.021370][ T5631] usb 6-1: USB disconnect, device number 5 [ 502.423644][T13902] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2385'. [ 503.082020][T13914] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 503.114239][T13914] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 503.366379][ T5631] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 503.442762][T13936] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2397'. [ 503.540950][ T5631] usb 6-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 503.573683][ T5631] usb 6-1: New USB device found, idVendor=041e, idProduct=4007, bcdDevice=5d.18 [ 503.610344][ T5631] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 503.670295][ T5631] gspca_main: stv0680-2.14.0 probing 041e:4007 [ 504.136402][ T5727] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 504.296404][ T5727] usb 5-1: Using ep0 maxpacket: 8 [ 504.303196][ T5727] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 504.313744][ T5727] usb 5-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 504.322895][ T5727] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 504.334635][ T5727] usb 5-1: New USB device found, idVendor=0582, idProduct=0025, bcdDevice= 0.40 [ 504.344069][ T5727] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 504.352282][ T5727] usb 5-1: Product: syz [ 504.356678][ T5727] usb 5-1: Manufacturer: syz [ 504.361392][ T5727] usb 5-1: SerialNumber: syz [ 504.577070][T13960] FAULT_INJECTION: forcing a failure. [ 504.577070][T13960] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 504.614871][T13960] CPU: 0 UID: 0 PID: 13960 Comm: syz.4.2406 Tainted: G L syzkaller #0 PREEMPT(full) [ 504.614899][T13960] Tainted: [L]=SOFTLOCKUP [ 504.614906][T13960] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 504.614916][T13960] Call Trace: [ 504.614924][T13960] [ 504.614933][T13960] dump_stack_lvl+0xe8/0x150 [ 504.614959][T13960] should_fail_ex+0x412/0x560 [ 504.614982][T13960] _copy_from_user+0x2d/0xb0 [ 504.615002][T13960] __se_sys_prlimit64+0x12f/0xbc0 [ 504.615028][T13960] ? __pfx___se_sys_prlimit64+0x10/0x10 [ 504.615048][T13960] ? ksys_write+0x242/0x270 [ 504.615073][T13960] ? __pfx_ksys_write+0x10/0x10 [ 504.615102][T13960] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 504.615120][T13960] do_syscall_64+0x174/0x580 [ 504.615140][T13960] ? clear_bhb_loop+0x40/0x90 [ 504.615160][T13960] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 504.615176][T13960] RIP: 0033:0x7f996979ce59 [ 504.615193][T13960] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 504.615207][T13960] RSP: 002b:00007f996a717028 EFLAGS: 00000246 ORIG_RAX: 000000000000012e [ 504.615226][T13960] RAX: ffffffffffffffda RBX: 00007f9969a15fa0 RCX: 00007f996979ce59 [ 504.615237][T13960] RDX: 0000200000000340 RSI: 0000000000000000 RDI: 000000000000057e [ 504.615248][T13960] RBP: 00007f996a717090 R08: 0000000000000000 R09: 0000000000000000 [ 504.615259][T13960] R10: 0000200000000380 R11: 0000000000000246 R12: 0000000000000001 [ 504.615270][T13960] R13: 00007f9969a16038 R14: 00007f9969a15fa0 R15: 00007f9969b3fa48 [ 504.615297][T13960] [ 504.668562][T13966] fuse: Bad value for 'fd' [ 504.860833][T13970] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 504.889083][T13970] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 504.892752][T13974] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 504.932350][T13974] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 505.002733][ T5631] gspca_stv0680: usb_control_msg error 0, request = 0x80, error = -71 [ 505.027625][ T5631] stv0680 6-1:4.0: last error: 86, command = 0x78 [ 505.049574][ T5727] usb 5-1: USB disconnect, device number 9 [ 505.073763][ T5631] usb 6-1: USB disconnect, device number 6 [ 505.137927][ T9488] usb 1-1: new high-speed USB device number 41 using dummy_hcd [ 505.149782][T13985] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 505.161167][T13983] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2411'. [ 505.194960][T13985] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 505.210095][T13983] bridge4: port 1(veth0_to_bond) entered blocking state [ 505.218823][T13983] bridge4: port 1(veth0_to_bond) entered disabled state [ 505.229005][T13983] veth0_to_bond: entered allmulticast mode [ 505.239817][T13983] veth0_to_bond: entered promiscuous mode [ 505.263045][T13985] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 505.283249][T13985] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 505.297878][T13985] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 505.309242][ T9488] usb 1-1: config 0 has no interfaces? [ 505.319594][ T9488] usb 1-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 505.329689][ T9488] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 505.338043][T13985] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 505.346353][ T9488] usb 1-1: Product: syz [ 505.350597][ T9488] usb 1-1: Manufacturer: syz [ 505.361340][ T9488] usb 1-1: SerialNumber: syz [ 505.377573][ T9488] usb 1-1: config 0 descriptor?? [ 505.718630][ T5727] usb 1-1: USB disconnect, device number 41 [ 505.726210][T13994] netlink: 68 bytes leftover after parsing attributes in process `syz.5.2415'. [ 505.746714][ T9488] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 505.918660][ T9488] usb 5-1: Using ep0 maxpacket: 16 [ 505.950374][ T9488] usb 5-1: too many configurations: 98, using maximum allowed: 8 [ 505.996387][ T9488] usb 5-1: config 6 has no interfaces? [ 506.019634][ T9488] usb 5-1: config 6 has no interfaces? [ 506.028363][ T9488] usb 5-1: config 6 has no interfaces? [ 506.035530][ T9488] usb 5-1: config 6 has no interfaces? [ 506.043624][ T9488] usb 5-1: config 6 has no interfaces? [ 506.050537][ T9488] usb 5-1: config 6 has no interfaces? [ 506.061208][ T9488] usb 5-1: config 6 has no interfaces? [ 506.068058][ T9488] usb 5-1: config 6 has no interfaces? [ 506.073801][T14003] netlink: 28 bytes leftover after parsing attributes in process `syz.5.2418'. [ 506.085383][ T9488] usb 5-1: string descriptor 0 read error: -71 [ 506.109391][ T9488] usb 5-1: New USB device found, idVendor=09c0, idProduct=0200, bcdDevice=58.3c [ 506.127886][ T9488] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=154 [ 506.144216][ T9488] usb 5-1: rejected 8 configurations due to insufficient available bus power [ 506.173476][ T9488] usb 5-1: no configuration chosen from 8 choices [ 506.194278][ T9488] usb 5-1: USB disconnect, device number 10 [ 506.244209][T14007] netlink: 'syz.5.2420': attribute type 1 has an invalid length. [ 506.717508][ T5667] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 506.896770][ T5667] usb 6-1: Using ep0 maxpacket: 8 [ 506.904085][ T5667] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 506.916667][ T5667] usb 6-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 506.925738][ T5667] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 506.953495][ T5667] usb 6-1: New USB device found, idVendor=0582, idProduct=0025, bcdDevice= 0.40 [ 506.963391][ T5667] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 506.971499][ T5667] usb 6-1: Product: syz [ 506.975781][ T5667] usb 6-1: Manufacturer: syz [ 506.997014][ T808] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 507.005201][ T5667] usb 6-1: SerialNumber: syz [ 507.130322][ T29] audit: type=1800 audit(1781026501.850:1885): pid=14022 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.2425" name="SYSV00000000" dev="hugetlbfs" ino=2 res=0 errno=0 [ 507.181556][ T808] usb 5-1: Using ep0 maxpacket: 32 [ 507.203190][ T808] usb 5-1: New USB device found, idVendor=0c72, idProduct=000d, bcdDevice=27.9b [ 507.228047][ T808] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 507.256309][ T808] usb 5-1: Product: syz [ 507.262192][ T808] usb 5-1: Manufacturer: syz [ 507.277391][ T808] usb 5-1: SerialNumber: syz [ 507.300397][ T808] usb 5-1: config 0 descriptor?? [ 507.502686][ T5667] usb 6-1: USB disconnect, device number 7 [ 507.548996][T14014] netlink: 'syz.4.2423': attribute type 19 has an invalid length. [ 507.560816][T14035] 8021q: VLANs not supported on ip6_vti0 [ 507.587384][T14014] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2423'. [ 507.612989][T14038] bridge0: entered allmulticast mode [ 507.643540][ T6221] udevd[6221]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 507.657759][ T808] peak_usb 5-1:0.0 can0: unable to request usb[type=0 value=1] err=-71 [ 507.689539][ T808] peak_usb 5-1:0.0: unable to read PCAN-USB Pro firmware info (err -71) [ 507.774124][T13982] Set syz1 is full, maxelem 65536 reached [ 507.817608][ T808] peak_usb 5-1:0.0: probe with driver peak_usb failed with error -71 [ 507.892793][ T808] usb 5-1: USB disconnect, device number 11 [ 508.595528][T14064] netlink: 'syz.1.2438': attribute type 10 has an invalid length. [ 508.650667][T14064] geneve1: entered promiscuous mode [ 508.688606][T14064] bond0: (slave geneve1): Enslaving as an active interface with an up link [ 508.722487][ T139] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 508.751836][ T139] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 508.765540][T14064] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 508.866578][ T139] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 508.893434][ T139] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 509.726348][ T808] usb 5-1: new full-speed USB device number 12 using dummy_hcd [ 509.888961][ T808] usb 5-1: unable to get BOS descriptor or descriptor too short [ 509.898636][ T808] usb 5-1: not running at top speed; connect to a high speed hub [ 509.927287][ T808] usb 5-1: New USB device found, idVendor=04b4, idProduct=9320, bcdDevice= 0.40 [ 509.949107][ T808] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 509.969607][ T808] usb 5-1: Product: syz [ 509.977738][ T808] usb 5-1: Manufacturer: syz [ 509.988484][ T808] usb 5-1: SerialNumber: syz [ 510.149330][T14079] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1958477870 (3916955740 ns) > initial count (2199611658 ns). Using initial count to start timer. [ 510.222636][T14080] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 510.231663][T14080] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 510.244440][T14080] kvm: kvm [14078]: vcpu0, guest rIP: 0x9114 Unhandled WRMSR(0xc2) = 0x9d00 [ 510.253626][T14080] kvm: kvm [14078]: vcpu0, guest rIP: 0x9114 Unhandled WRMSR(0xc1) = 0x9d00 [ 511.191389][T14086] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 511.203939][T14086] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 511.596543][ T5631] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 511.721578][T14090] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2444'. [ 511.746396][ T5631] usb 6-1: device descriptor read/64, error -71 [ 512.026353][ T5631] usb 6-1: new high-speed USB device number 9 using dummy_hcd [ 512.186360][ T5631] usb 6-1: device descriptor read/64, error -71 [ 512.306693][ T5631] usb usb6-port1: attempt power cycle [ 512.392364][ T808] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 512.420776][ T808] usb 5-1: MIDIStreaming interface descriptor not found [ 512.590753][ T808] usb 5-1: USB disconnect, device number 12 [ 512.649741][ T5767] udevd[5767]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 512.668931][ T5631] usb 6-1: new high-speed USB device number 10 using dummy_hcd [ 512.708375][ T5631] usb 6-1: device descriptor read/8, error -71 [ 512.868639][T14105] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 512.878514][T14105] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 512.887550][T14105] FAULT_INJECTION: forcing a failure. [ 512.887550][T14105] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 512.901451][T14105] CPU: 1 UID: 0 PID: 14105 Comm: syz.2.2448 Tainted: G L syzkaller #0 PREEMPT(full) [ 512.901477][T14105] Tainted: [L]=SOFTLOCKUP [ 512.901484][T14105] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 512.901494][T14105] Call Trace: [ 512.901501][T14105] [ 512.901508][T14105] dump_stack_lvl+0xe8/0x150 [ 512.901532][T14105] should_fail_ex+0x412/0x560 [ 512.901554][T14105] _copy_to_user+0x31/0xb0 [ 512.901575][T14105] simple_read_from_buffer+0xe1/0x170 [ 512.901600][T14105] proc_fail_nth_read+0x1bb/0x230 [ 512.901622][T14105] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 512.901644][T14105] ? rw_verify_area+0x2a6/0x4d0 [ 512.901665][T14105] ? __might_fault+0xaf/0x130 [ 512.901682][T14105] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 512.901703][T14105] vfs_read+0x20c/0xa70 [ 512.901728][T14105] ? __pfx___mutex_lock+0x10/0x10 [ 512.901747][T14105] ? __pfx_vfs_read+0x10/0x10 [ 512.901768][T14105] ? __fget_files+0x2a/0x420 [ 512.901786][T14105] ? __fget_files+0x3a0/0x420 [ 512.901800][T14105] ? __fget_files+0x2a/0x420 [ 512.901820][T14105] ksys_read+0x150/0x270 [ 512.901838][T14105] ? __pfx_ksys_read+0x10/0x10 [ 512.901861][T14105] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 512.901875][T14105] do_syscall_64+0x174/0x580 [ 512.901888][T14105] ? trace_irq_disable+0x3b/0x140 [ 512.901907][T14105] ? clear_bhb_loop+0x40/0x90 [ 512.901923][T14105] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 512.901935][T14105] RIP: 0033:0x7f915815d68e [ 512.901948][T14105] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 512.901960][T14105] RSP: 002b:00007f9159042fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 512.901974][T14105] RAX: ffffffffffffffda RBX: 00007f91590436c0 RCX: 00007f915815d68e [ 512.901984][T14105] RDX: 000000000000000f RSI: 00007f91590430a0 RDI: 0000000000000007 [ 512.901992][T14105] RBP: 00007f9159043090 R08: 0000000000000000 R09: 0000000000000000 [ 512.902000][T14105] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 512.902008][T14105] R13: 00007f9158416038 R14: 00007f9158415fa0 R15: 00007f915853fa48 [ 512.902029][T14105] [ 513.120403][ T5631] usb 6-1: new high-speed USB device number 11 using dummy_hcd [ 513.158123][ T5631] usb 6-1: device descriptor read/8, error -71 [ 513.234958][T14108] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 513.252851][T14108] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 513.286875][ T5631] usb usb6-port1: unable to enumerate USB device [ 513.479772][T14120] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2454'. [ 513.516545][ T5667] usb 1-1: new high-speed USB device number 42 using dummy_hcd [ 513.676518][ T5667] usb 1-1: Using ep0 maxpacket: 16 [ 513.686065][ T5667] usb 1-1: config 244 has an invalid interface number: 220 but max is 0 [ 513.696493][ T5667] usb 1-1: config 244 has no interface number 0 [ 513.706418][ T5667] usb 1-1: config 244 interface 220 has no altsetting 0 [ 513.725893][ T5667] usb 1-1: New USB device found, idVendor=0af0, idProduct=7001, bcdDevice=bc.ac [ 513.737090][ T5667] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 513.745299][ T5667] usb 1-1: Product: syz [ 513.749735][ T5667] usb 1-1: Manufacturer: syz [ 513.756343][ T5667] usb 1-1: SerialNumber: syz [ 514.244743][T14138] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 514.527856][T14145] loop8: detected capacity change from 0 to 7 [ 514.538860][T14145] Dev loop8: unable to read RDB block 7 [ 514.545785][T14145] loop8: unable to read partition table [ 514.552104][T14145] loop8: partition table beyond EOD, truncated [ 514.559054][T14145] loop_reread_partitions: partition scan of loop8 (被x^> ) failed (rc=-5) [ 514.891551][T14150] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 514.905581][T14150] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 515.209001][T14156] binder: 14155:14156 ioctl 7a4 200000000200 returned -22 [ 515.217586][T14157] binder: 14155:14157 ioctl c0306201 200000000180 returned -14 [ 515.736522][ T5631] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 515.804080][T14173] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2468'. [ 515.813649][T14173] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2468'. [ 515.823749][T14172] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2468'. [ 515.833305][T14172] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2468'. [ 515.843641][T14173] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 515.859305][T14173] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 515.860085][T14174] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 515.910116][T14174] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 515.928612][ T5631] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 515.940491][ T5631] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 515.951182][ T5631] usb 5-1: New USB device found, idVendor=044f, idProduct=b65d, bcdDevice= 0.00 [ 515.962039][ T5631] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 515.991090][ T5631] usb 5-1: config 0 descriptor?? [ 516.391846][ T5667] option 1-1:244.220: GSM modem (1-port) converter detected [ 516.433918][ T5631] hid_parser_main: 136 callbacks suppressed [ 516.433939][ T5631] hid-thrustmaster 0003:044F:B65D.001E: unknown main item tag 0x0 [ 516.472341][ T5667] usb 1-1: USB disconnect, device number 42 [ 516.518176][ T5631] hid-thrustmaster 0003:044F:B65D.001E: unknown main item tag 0x0 [ 516.530486][ T5667] option 1-1:244.220: device disconnected [ 516.559989][ T5631] hid-thrustmaster 0003:044F:B65D.001E: unknown main item tag 0x0 [ 516.609334][ T5631] hid-thrustmaster 0003:044F:B65D.001E: unknown main item tag 0x0 [ 516.642077][ T5631] hid-thrustmaster 0003:044F:B65D.001E: unknown main item tag 0x0 [ 516.679315][ T5631] hid-thrustmaster 0003:044F:B65D.001E: unknown main item tag 0x0 [ 516.712905][ T5631] hid-thrustmaster 0003:044F:B65D.001E: unknown main item tag 0x0 [ 516.767754][T14179] pim6reg0: tun_chr_ioctl cmd 1074025676 [ 516.789567][T14179] pim6reg0: owner set to 0 [ 516.812879][ T5631] hid-thrustmaster 0003:044F:B65D.001E: hidraw0: USB HID v0.00 Device [HID 044f:b65d] on usb-dummy_hcd.4-1/input0 [ 516.834359][ T5631] hid-thrustmaster 0003:044F:B65D.001E: Wrong number of endpoints? [ 516.881274][ C0] hid-thrustmaster 0003:044F:B65D.001E: Unknown wheel's model id 0x0, unable to proceed further with wheel init [ 516.887595][ T5667] usb 1-1: new high-speed USB device number 43 using dummy_hcd [ 517.006351][ T808] usb 6-1: new high-speed USB device number 12 using dummy_hcd [ 517.038383][T14186] syzkaller0: entered promiscuous mode [ 517.050433][T14186] syzkaller0: entered allmulticast mode [ 517.058694][T14183] tipc: Enabled bearer , priority 0 [ 517.069669][ T5667] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 517.107013][ T5667] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid maxpacket 59357, setting to 1024 [ 517.122027][T14183] tipc: Resetting bearer [ 517.157878][ T5631] usb 5-1: USB disconnect, device number 13 [ 517.163695][ T5667] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 517.175229][ T5667] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 517.183520][ T808] usb 6-1: Using ep0 maxpacket: 32 [ 517.190868][T14183] tipc: Disabling bearer [ 517.197224][ T5667] usb 1-1: Product: syz [ 517.201910][ T5667] usb 1-1: Manufacturer: syz [ 517.209257][ T808] usb 6-1: config 1 interface 0 altsetting 211 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 517.229359][ T808] usb 6-1: config 1 interface 0 altsetting 211 endpoint 0x81 has invalid wMaxPacketSize 0 [ 517.239588][ T5667] usb 1-1: SerialNumber: syz [ 517.258934][ T808] usb 6-1: config 1 interface 0 has no altsetting 0 [ 517.280524][ T808] usb 6-1: New USB device found, idVendor=05ac, idProduct=0240, bcdDevice= 0.40 [ 517.290096][ T808] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 517.302158][ T808] usb 6-1: Product: syz [ 517.307873][ T808] usb 6-1: Manufacturer: syz [ 517.313047][ T808] usb 6-1: SerialNumber: syz [ 517.497734][T14193] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 517.519352][T14193] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 517.541349][T14193] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 517.567810][T14193] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 517.720199][ T29] audit: type=1326 audit(1781026512.440:1886): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14196 comm="syz.1.2475" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4a0159ce59 code=0x7ffc0000 [ 517.729627][ T808] input: bcm5974 as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/input/input32 [ 517.791719][T14198] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 517.819373][T14198] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 517.844364][ T29] audit: type=1326 audit(1781026512.460:1887): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14196 comm="syz.1.2475" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4a0159ce59 code=0x7ffc0000 [ 517.879924][ T4982] bcm5974 6-1:1.0: could not read from device [ 517.917973][ T29] audit: type=1326 audit(1781026512.490:1888): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14196 comm="syz.1.2475" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f4a0159ce59 code=0x7ffc0000 [ 517.937487][ T808] usb 6-1: USB disconnect, device number 12 [ 517.943664][ T4982] bcm5974 6-1:1.0: could not read from device [ 518.005061][ T4982] bcm5974 6-1:1.0: could not read from device [ 518.027574][ T29] audit: type=1326 audit(1781026512.490:1889): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14196 comm="syz.1.2475" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4a0159ce59 code=0x7ffc0000 [ 518.128830][ T29] audit: type=1326 audit(1781026512.490:1890): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14196 comm="syz.1.2475" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4a0159ce59 code=0x7ffc0000 [ 518.222163][ T29] audit: type=1326 audit(1781026512.490:1891): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14196 comm="syz.1.2475" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7f4a0159ce59 code=0x7ffc0000 [ 518.300734][T14210] netlink: ct family unspecified [ 518.309874][ T29] audit: type=1326 audit(1781026512.490:1892): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14196 comm="syz.1.2475" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4a0159ce59 code=0x7ffc0000 [ 518.316891][T14210] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 518.372275][ T29] audit: type=1326 audit(1781026512.490:1893): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14196 comm="syz.1.2475" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4a0159ce59 code=0x7ffc0000 [ 518.453647][T14216] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2481'. [ 518.484694][ T29] audit: type=1326 audit(1781026512.490:1894): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14196 comm="syz.1.2475" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=206 compat=0 ip=0x7f4a0159ce59 code=0x7ffc0000 [ 518.573133][ T29] audit: type=1326 audit(1781026512.490:1895): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14196 comm="syz.1.2475" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4a0159ce59 code=0x7ffc0000 [ 518.701696][T14224] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 518.729491][T14224] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 518.814156][T14222] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 518.864965][T14224] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 518.875725][T14222] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 518.910556][T14224] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 519.085651][T14234] netlink: 'syz.1.2485': attribute type 1 has an invalid length. [ 519.353723][T14234] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2485'. [ 519.391635][T14234] ipvlan2: entered allmulticast mode [ 519.413378][T14240] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 519.450342][T14240] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 519.496707][ T808] usb 6-1: new full-speed USB device number 13 using dummy_hcd [ 519.562401][ T5667] cdc_ncm 1-1:1.0: bind() failure [ 519.590701][ T5667] cdc_ncm 1-1:1.1: probe with driver cdc_ncm failed with error -71 [ 519.614112][ T5667] cdc_mbim 1-1:1.1: probe with driver cdc_mbim failed with error -71 [ 519.629785][ T5667] usbtest 1-1:1.1: probe with driver usbtest failed with error -71 [ 519.660322][ T5667] usb 1-1: USB disconnect, device number 43 [ 519.673155][ T808] usb 6-1: not running at top speed; connect to a high speed hub [ 519.705574][ T808] usb 6-1: New USB device found, idVendor=04b4, idProduct=9320, bcdDevice= 0.40 [ 519.733061][ T808] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 519.748568][ T808] usb 6-1: Product: syz [ 519.754147][ T808] usb 6-1: Manufacturer: syz [ 519.773840][ T808] usb 6-1: SerialNumber: syz [ 522.220865][T14296] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 522.231243][T14296] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 522.286896][ T808] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 522.298495][ T808] usb 6-1: MIDIStreaming interface descriptor not found [ 522.504010][ T808] usb 6-1: USB disconnect, device number 13 [ 522.586448][ T6221] udevd[6221]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 522.679913][T14308] netlink: 384 bytes leftover after parsing attributes in process `syz.5.2507'. [ 522.706892][T14308] netlink: 384 bytes leftover after parsing attributes in process `syz.5.2507'. [ 522.726390][T14308] netlink: 28 bytes leftover after parsing attributes in process `syz.5.2507'. [ 522.756376][ T5685] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 522.927750][ T5685] usb 5-1: Using ep0 maxpacket: 16 [ 522.941597][ T5685] usb 5-1: too many configurations: 98, using maximum allowed: 8 [ 522.958480][ T5685] usb 5-1: config 6 has no interfaces? [ 522.959515][T14327] netlink: 'syz.1.2513': attribute type 10 has an invalid length. [ 522.974645][ T5685] usb 5-1: config 6 has no interfaces? [ 522.985048][ T5685] usb 5-1: config 6 has no interfaces? [ 522.991905][ T5685] usb 5-1: config 6 has no interfaces? [ 522.999306][ T5685] usb 5-1: config 6 has no interfaces? [ 523.004572][T14327] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 523.005896][ T5685] usb 5-1: config 6 has no interfaces? [ 523.019779][ T5685] usb 5-1: config 6 has no interfaces? [ 523.021687][T14327] bond0: (slave netdevsim1): Enslaving as an active interface with an up link [ 523.027231][ T5685] usb 5-1: config 6 has no interfaces? [ 523.051310][T14328] syzkaller0: entered promiscuous mode [ 523.058476][T14328] syzkaller0: entered allmulticast mode [ 523.071336][ T9] usb 1-1: new high-speed USB device number 44 using dummy_hcd [ 523.086923][ T5685] usb 5-1: string descriptor 0 read error: -71 [ 523.105153][ T5685] usb 5-1: New USB device found, idVendor=09c0, idProduct=0200, bcdDevice=58.3c [ 523.115770][ T5685] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=154 [ 523.128177][ T5685] usb 5-1: rejected 8 configurations due to insufficient available bus power [ 523.138088][T14330] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 523.144269][ T5685] usb 5-1: no configuration chosen from 8 choices [ 523.145451][T14330] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 523.158058][T14330] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 523.166481][T14330] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 523.172738][T14330] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 523.173630][ T5685] usb 5-1: USB disconnect, device number 14 [ 523.179440][T14330] Bluetooth: hci5: Opcode 0x0406 failed: -4 [ 523.235963][T14330] Bluetooth: hci5: Opcode 0x0406 failed: -4 [ 523.242119][ T9] usb 1-1: Using ep0 maxpacket: 16 [ 523.252711][ T9] usb 1-1: unable to get BOS descriptor or descriptor too short [ 523.272017][ T9] usb 1-1: config 9 has an invalid interface number: 57 but max is 0 [ 523.292395][ T9] usb 1-1: config 9 has no interface number 0 [ 523.301977][ T9] usb 1-1: config 9 interface 57 has no altsetting 0 [ 523.313199][ T9] usb 1-1: string descriptor 0 read error: -22 [ 523.361803][ T9] usb 1-1: New USB device found, idVendor=046d, idProduct=0a0e, bcdDevice=61.f7 [ 523.371248][T14338] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 523.377295][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 523.385657][T14338] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 523.632650][ T9] video4linux radio48: keene_cmd_main failed (-71) [ 523.649803][ T9] radio-keene 1-1:9.57: V4L2 device registered as radio48 [ 523.683940][ T9] usb 1-1: USB disconnect, device number 44 [ 523.762108][ T5631] usb 6-1: new high-speed USB device number 14 using dummy_hcd [ 523.790337][T14357] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 523.832001][T14357] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 523.840975][T14359] tipc: Can't bind to reserved service type 2 [ 523.860144][ T29] kauditd_printk_skb: 4 callbacks suppressed [ 523.860158][ T29] audit: type=1326 audit(1781026518.580:1900): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14358 comm="syz.0.2523" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f10ddd9ce59 code=0x7ffc0000 [ 523.912665][ T29] audit: type=1326 audit(1781026518.580:1901): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14358 comm="syz.0.2523" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f10ddd9ce59 code=0x7ffc0000 [ 523.958136][T14364] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2524'. [ 523.967406][ T5631] usb 6-1: Using ep0 maxpacket: 8 [ 523.979656][ T5631] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 523.995579][ T5631] usb 6-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 524.005114][ T5631] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 524.016503][ T5685] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 524.031306][ T5631] usb 6-1: New USB device found, idVendor=0582, idProduct=0025, bcdDevice= 0.40 [ 524.044899][ T5631] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 524.053275][ T5631] usb 6-1: Product: syz [ 524.058435][ T5631] usb 6-1: Manufacturer: syz [ 524.063104][ T5631] usb 6-1: SerialNumber: syz [ 524.177221][ T5685] usb 5-1: Using ep0 maxpacket: 8 [ 524.184073][ T5685] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 524.194339][ T5685] usb 5-1: New USB device found, idVendor=046d, idProduct=0892, bcdDevice=6d.2a [ 524.203525][ T5685] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 524.214627][ T5685] usb 5-1: config 0 descriptor?? [ 524.230081][ T5685] gspca_main: vc032x-2.14.0 probing 046d:0892 [ 524.386451][ T9] usb 1-1: new high-speed USB device number 45 using dummy_hcd [ 524.546384][ T9] usb 1-1: Using ep0 maxpacket: 16 [ 524.559698][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 524.592022][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 524.621375][ T9] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 524.643345][ T9] usb 1-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 524.653113][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 524.667838][ T9] usb 1-1: config 0 descriptor?? [ 524.921164][T14388] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 524.940554][T14388] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 525.045424][ T5685] gspca_vc032x: reg_w err -71 [ 525.056771][ T5685] vc032x 5-1:0.0: probe with driver vc032x failed with error -71 [ 525.084263][ T5685] usb 5-1: USB disconnect, device number 15 [ 525.189571][ T9] microsoft 0003:045E:07DA.001F: unknown main item tag 0x0 [ 525.216407][ T5640] Bluetooth: hci3: command 0x0406 tx timeout [ 525.223422][ T5640] Bluetooth: hci2: command 0x0406 tx timeout [ 525.227841][ T9] input: HID 045e:07da as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:045E:07DA.001F/input/input33 [ 525.229975][ T5640] Bluetooth: hci1: command 0x0406 tx timeout [ 525.248667][ T5636] Bluetooth: hci5: command 0x0c1a tx timeout [ 525.255044][ T5636] Bluetooth: hci0: command 0x0406 tx timeout [ 525.385778][ T9] microsoft 0003:045E:07DA.001F: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.0-1/input0 [ 525.544399][ T9] usb 1-1: USB disconnect, device number 45 [ 525.645181][T14400] netlink: 'syz.5.2533': attribute type 4 has an invalid length. [ 525.691666][T14398] fido_id[14398]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.0/usb1/1-1/report_descriptor': No such file or directory [ 525.991408][T14412] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2537'. [ 526.020503][T14412] hsr_slave_0 (unregistering): left promiscuous mode [ 526.189526][T14425] FAULT_INJECTION: forcing a failure. [ 526.189526][T14425] name failslab, interval 1, probability 0, space 0, times 0 [ 526.242111][T14425] CPU: 0 UID: 0 PID: 14425 Comm: syz.2.2541 Tainted: G L syzkaller #0 PREEMPT(full) [ 526.242140][T14425] Tainted: [L]=SOFTLOCKUP [ 526.242146][T14425] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 526.242155][T14425] Call Trace: [ 526.242162][T14425] [ 526.242169][T14425] dump_stack_lvl+0xe8/0x150 [ 526.242193][T14425] should_fail_ex+0x412/0x560 [ 526.242217][T14425] should_failslab+0xa8/0x100 [ 526.242236][T14425] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 526.242260][T14425] ? dup_task_struct+0x52/0x840 [ 526.242282][T14425] dup_task_struct+0x52/0x840 [ 526.242297][T14425] ? _raw_spin_unlock_irq+0x23/0x50 [ 526.242324][T14425] copy_process+0x89b/0x4440 [ 526.242354][T14425] ? kasan_save_track+0x4f/0x80 [ 526.242373][T14425] ? kasan_save_track+0x3e/0x80 [ 526.242392][T14425] ? __kmalloc_cache_noprof+0x31c/0x660 [ 526.242411][T14425] ? create_io_worker+0xab/0x5c0 [ 526.242431][T14425] ? io_wq_enqueue+0x675/0x8a0 [ 526.242449][T14425] ? __se_sys_io_uring_enter+0x341/0x1c40 [ 526.242466][T14425] ? do_syscall_64+0x174/0x580 [ 526.242482][T14425] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 526.242507][T14425] ? __pfx_copy_process+0x10/0x10 [ 526.242530][T14425] ? __pfx_io_wq_worker+0x10/0x10 [ 526.242551][T14425] ? __pfx_io_wq_worker+0x10/0x10 [ 526.242571][T14425] create_io_thread+0xfc/0x170 [ 526.242592][T14425] ? __pfx_create_io_thread+0x10/0x10 [ 526.242618][T14425] ? __pfx_io_wq_worker+0x10/0x10 [ 526.242644][T14425] ? __raw_spin_lock_init+0x45/0x100 [ 526.242667][T14425] ? __init_swait_queue_head+0xa9/0x150 [ 526.242690][T14425] ? create_io_worker+0x27/0x5c0 [ 526.242710][T14425] create_io_worker+0x181/0x5c0 [ 526.242734][T14425] io_wq_enqueue+0x675/0x8a0 [ 526.242753][T14425] ? io_wq_enqueue+0x332/0x8a0 [ 526.242771][T14425] ? __pfx_io_wq_work_match_item+0x10/0x10 [ 526.242796][T14425] io_submit_sqes+0x110f/0x22e0 [ 526.242843][T14425] __se_sys_io_uring_enter+0x341/0x1c40 [ 526.242865][T14425] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 526.242887][T14425] ? __fget_files+0x3a0/0x420 [ 526.242910][T14425] ? __pfx___se_sys_io_uring_enter+0x10/0x10 [ 526.242929][T14425] ? fput+0xa0/0xd0 [ 526.242948][T14425] ? ksys_write+0x242/0x270 [ 526.242971][T14425] ? __pfx_ksys_write+0x10/0x10 [ 526.243004][T14425] ? __x64_sys_io_uring_enter+0x21/0xf0 [ 526.243022][T14425] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 526.243039][T14425] do_syscall_64+0x174/0x580 [ 526.243054][T14425] ? trace_irq_disable+0x3b/0x140 [ 526.243074][T14425] ? clear_bhb_loop+0x40/0x90 [ 526.243094][T14425] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 526.243109][T14425] RIP: 0033:0x7f915819ce59 [ 526.243125][T14425] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 526.243137][T14425] RSP: 002b:00007f9159043028 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 526.243154][T14425] RAX: ffffffffffffffda RBX: 00007f9158415fa0 RCX: 00007f915819ce59 [ 526.243165][T14425] RDX: 0000000000007721 RSI: 0000000000002219 RDI: 0000000000000000 [ 526.243175][T14425] RBP: 00007f9159043090 R08: 0000000000000000 R09: 0000000000000000 [ 526.243184][T14425] R10: 0000000000000016 R11: 0000000000000246 R12: 0000000000000001 [ 526.243193][T14425] R13: 00007f9158416038 R14: 00007f9158415fa0 R15: 00007f915853fa48 [ 526.243217][T14425] [ 526.289914][T14430] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 526.495337][ T5685] usb 2-1: USB disconnect, device number 57 [ 526.513702][T14437] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 526.520746][T14437] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 526.756789][ T5634] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 526.767127][ T5634] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 526.771495][ T5634] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 526.773033][ T5634] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 526.773681][ T5634] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 527.207175][ T5631] usb 6-1: USB disconnect, device number 14 [ 527.312944][ T5634] Bluetooth: hci5: command 0x0c1a tx timeout [ 527.425212][ T6221] udevd[6221]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 528.196977][T13204] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 528.417584][T14471] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 528.417834][T14471] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 528.518721][T13204] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 528.709594][T13204] bond0: (slave netdevsim1): Releasing backup interface [ 528.724077][T13204] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 528.823457][ T5634] Bluetooth: hci4: command tx timeout [ 528.837433][T13204] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 528.849840][T14479] FAULT_INJECTION: forcing a failure. [ 528.849840][T14479] name failslab, interval 1, probability 0, space 0, times 0 [ 528.863876][T14479] CPU: 0 UID: 0 PID: 14479 Comm: syz.0.2553 Tainted: G L syzkaller #0 PREEMPT(full) [ 528.863893][T14479] Tainted: [L]=SOFTLOCKUP [ 528.863897][T14479] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 528.863903][T14479] Call Trace: [ 528.863908][T14479] [ 528.863912][T14479] dump_stack_lvl+0xe8/0x150 [ 528.863929][T14479] should_fail_ex+0x412/0x560 [ 528.863943][T14479] should_failslab+0xa8/0x100 [ 528.863954][T14479] __kmalloc_noprof+0xe8/0x760 [ 528.863970][T14479] ? security_task_alloc+0x4d/0x330 [ 528.863986][T14479] security_task_alloc+0x4d/0x330 [ 528.864000][T14479] copy_process+0x1d12/0x4440 [ 528.864019][T14479] ? copy_process+0xd87/0x4440 [ 528.864034][T14479] ? __pfx_copy_process+0x10/0x10 [ 528.864047][T14479] ? __pfx_io_wq_worker+0x10/0x10 [ 528.864061][T14479] ? __pfx_io_wq_worker+0x10/0x10 [ 528.864074][T14479] create_io_thread+0xfc/0x170 [ 528.864086][T14479] ? __pfx_create_io_thread+0x10/0x10 [ 528.864101][T14479] ? __pfx_io_wq_worker+0x10/0x10 [ 528.864117][T14479] ? __raw_spin_lock_init+0x45/0x100 [ 528.864132][T14479] ? __init_swait_queue_head+0xa9/0x150 [ 528.864145][T14479] ? create_io_worker+0x27/0x5c0 [ 528.864158][T14479] create_io_worker+0x181/0x5c0 [ 528.864175][T14479] io_wq_enqueue+0x675/0x8a0 [ 528.864186][T14479] ? io_wq_enqueue+0x332/0x8a0 [ 528.864197][T14479] ? __pfx_io_wq_work_match_item+0x10/0x10 [ 528.864212][T14479] io_submit_sqes+0x110f/0x22e0 [ 528.864238][T14479] __se_sys_io_uring_enter+0x341/0x1c40 [ 528.864254][T14479] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 528.864267][T14479] ? __fget_files+0x3a0/0x420 [ 528.864282][T14479] ? __pfx___se_sys_io_uring_enter+0x10/0x10 [ 528.864293][T14479] ? fput+0xa0/0xd0 [ 528.864305][T14479] ? ksys_write+0x242/0x270 [ 528.864320][T14479] ? __pfx_ksys_write+0x10/0x10 [ 528.864336][T14479] ? __x64_sys_io_uring_enter+0x21/0xf0 [ 528.864347][T14479] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 528.864357][T14479] do_syscall_64+0x174/0x580 [ 528.864367][T14479] ? trace_irq_disable+0x3b/0x140 [ 528.864381][T14479] ? clear_bhb_loop+0x40/0x90 [ 528.864393][T14479] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 528.864403][T14479] RIP: 0033:0x7f10ddd9ce59 [ 528.864413][T14479] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 528.864421][T14479] RSP: 002b:00007f10ded17028 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 528.864432][T14479] RAX: ffffffffffffffda RBX: 00007f10de015fa0 RCX: 00007f10ddd9ce59 [ 528.864439][T14479] RDX: 0000000000007721 RSI: 0000000000002219 RDI: 0000000000000000 [ 528.864446][T14479] RBP: 00007f10ded17090 R08: 0000000000000000 R09: 0000000000000000 [ 528.864452][T14479] R10: 0000000000000016 R11: 0000000000000246 R12: 0000000000000001 [ 528.864457][T14479] R13: 00007f10de016038 R14: 00007f10de015fa0 R15: 00007f10de13fa48 [ 528.864472][T14479] [ 529.315172][T14444] bridge0: port 1(bridge_slave_0) entered blocking state [ 529.322639][T14444] bridge0: port 1(bridge_slave_0) entered disabled state [ 529.330014][T14444] bridge_slave_0: entered allmulticast mode [ 529.339146][T14444] bridge_slave_0: entered promiscuous mode [ 529.347648][T14444] bridge0: port 2(bridge_slave_1) entered blocking state [ 529.354835][T14444] bridge0: port 2(bridge_slave_1) entered disabled state [ 529.362281][T14444] bridge_slave_1: entered allmulticast mode [ 529.370564][T14444] bridge_slave_1: entered promiscuous mode [ 529.376726][ T5634] Bluetooth: hci5: command 0x0c1a tx timeout [ 529.415492][T14444] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 529.427127][T14444] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 529.553631][T14444] team0: Port device team_slave_0 added [ 529.597344][T14444] team0: Port device team_slave_1 added [ 529.787141][T14444] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 529.794282][T14444] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 529.823381][T14444] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 529.873212][T14444] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 529.882634][T14444] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 529.912564][T14444] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 530.082294][T13204] vlan2: left allmulticast mode [ 530.093098][T13204] geneve0: left allmulticast mode [ 530.137071][T13204] vlan2: left promiscuous mode [ 530.142052][T13204] geneve0: left promiscuous mode [ 530.148437][T13204] bridge0: port 3(vlan2) entered disabled state [ 530.285798][T13204] dvmrp0: left allmulticast mode [ 530.740987][T13204] bond0 (unregistering): (slave geneve1): Releasing backup interface [ 530.896508][ T5634] Bluetooth: hci4: command tx timeout [ 531.349888][T13204] bond0 (unregistering): Released all slaves [ 531.390217][T13204] bond1 (unregistering): Released all slaves [ 531.411280][T13204] bond2 (unregistering): Released all slaves [ 531.434680][T13204] bond3 (unregistering): Released all slaves [ 531.491544][T14444] hsr_slave_0: entered promiscuous mode [ 531.508023][T14444] hsr_slave_1: entered promiscuous mode [ 531.525570][T14444] debugfs: 'hsr0' already exists in 'hsr' [ 531.539808][T14444] Cannot create hsr debugfs directory [ 531.576510][T14531] syzkaller0: entered promiscuous mode [ 531.585506][T14531] syzkaller0: entered allmulticast mode [ 531.596894][T14532] netlink: 132 bytes leftover after parsing attributes in process `syz.5.2567'. [ 531.690082][T13204] tipc: Left network mode [ 532.124781][T14544] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 532.178761][T14544] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 532.326967][T13204] hsr_slave_0: left promiscuous mode [ 532.364233][T13204] hsr_slave_1: left promiscuous mode [ 532.821635][ T29] audit: type=1326 audit(1781026527.540:1902): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14565 comm="syz.4.2574" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f996979ce59 code=0x7ffc0000 [ 532.859652][ T29] audit: type=1326 audit(1781026527.540:1903): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14565 comm="syz.4.2574" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f996979ce59 code=0x7ffc0000 [ 532.885657][ T5685] usb 1-1: new full-speed USB device number 46 using dummy_hcd [ 532.903690][ T29] audit: type=1326 audit(1781026527.540:1904): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14565 comm="syz.4.2574" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f996979ce59 code=0x7ffc0000 [ 532.935028][ T29] audit: type=1326 audit(1781026527.540:1905): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14565 comm="syz.4.2574" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f996979ce59 code=0x7ffc0000 [ 532.963663][ T29] audit: type=1326 audit(1781026527.570:1906): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14565 comm="syz.4.2574" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=141 compat=0 ip=0x7f996979ce59 code=0x7ffc0000 [ 532.990451][ T5634] Bluetooth: hci4: command tx timeout [ 533.006721][ T29] audit: type=1326 audit(1781026527.570:1907): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14565 comm="syz.4.2574" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f996979ce59 code=0x7ffc0000 [ 533.034569][ T29] audit: type=1326 audit(1781026527.570:1908): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14565 comm="syz.4.2574" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f996979ce59 code=0x7ffc0000 [ 533.061560][ T29] audit: type=1326 audit(1781026527.570:1909): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14565 comm="syz.4.2574" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f996979ce59 code=0x7ffc0000 [ 533.093444][ T5685] usb 1-1: not running at top speed; connect to a high speed hub [ 533.112869][ T5685] usb 1-1: New USB device found, idVendor=04b4, idProduct=9320, bcdDevice= 0.40 [ 533.136759][ T5685] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 533.166159][ T5685] usb 1-1: Product: syz [ 533.171456][ T29] audit: type=1326 audit(1781026527.570:1910): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14565 comm="syz.4.2574" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f996979ce59 code=0x7ffc0000 [ 533.171504][ T29] audit: type=1326 audit(1781026527.570:1911): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14565 comm="syz.4.2574" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f996979ce59 code=0x7ffc0000 [ 533.220828][ T5667] usb 6-1: new full-speed USB device number 15 using dummy_hcd [ 533.255053][ T5685] usb 1-1: Manufacturer: syz [ 533.268226][ T5685] usb 1-1: SerialNumber: syz [ 533.398788][ T5667] usb 6-1: unable to get BOS descriptor or descriptor too short [ 533.407405][ T5667] usb 6-1: not running at top speed; connect to a high speed hub [ 533.418736][ T5667] usb 6-1: unable to read config index 0 descriptor/start: -61 [ 533.429681][ T5667] usb 6-1: can't read configurations, error -61 [ 533.566448][ T5667] usb 6-1: new full-speed USB device number 16 using dummy_hcd [ 533.601835][ T5292] 8021q: adding VLAN 0 to HW filter on device eth5 [ 533.820546][ T5667] usb 6-1: unable to get BOS descriptor or descriptor too short [ 533.930328][ T5667] usb 6-1: not running at top speed; connect to a high speed hub [ 534.035351][ T5667] usb 6-1: unable to read config index 0 descriptor/start: -61 [ 534.092717][ T5667] usb 6-1: can't read configurations, error -61 [ 534.163684][ T5667] usb usb6-port1: attempt power cycle [ 534.570034][ T5667] usb 6-1: new full-speed USB device number 17 using dummy_hcd [ 534.610004][ T5667] usb 6-1: unable to get BOS descriptor or descriptor too short [ 534.644767][ T5667] usb 6-1: not running at top speed; connect to a high speed hub [ 534.692602][ T5667] usb 6-1: unable to read config index 0 descriptor/start: -61 [ 534.709547][ T5667] usb 6-1: can't read configurations, error -61 [ 534.847385][ T5667] usb 6-1: new full-speed USB device number 18 using dummy_hcd [ 534.872574][T13204] IPVS: stop unused estimator thread 0... [ 534.890902][ T5667] usb 6-1: unable to get BOS descriptor or descriptor too short [ 534.931004][ T5667] usb 6-1: not running at top speed; connect to a high speed hub [ 534.959374][ T5667] usb 6-1: unable to read config index 0 descriptor/start: -61 [ 534.987327][ T9] usb 5-1: new high-speed USB device number 16 using dummy_hcd [ 535.007415][ T5667] usb 6-1: can't read configurations, error -61 [ 535.035100][ T5667] usb usb6-port1: unable to enumerate USB device [ 535.056388][ T5634] Bluetooth: hci4: command tx timeout [ 535.136423][ T9] usb 5-1: device descriptor read/64, error -71 [ 535.329722][T14599] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 535.350447][T14599] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 535.417598][ T9] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 535.566336][ T9] usb 5-1: device descriptor read/64, error -71 [ 535.648226][T14444] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 535.663042][T14444] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 535.671819][T14444] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 535.688575][ T9] usb usb5-port1: attempt power cycle [ 535.701800][T14444] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 535.715727][T14444] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 535.732311][T14444] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 535.742556][T14444] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 535.762418][T14444] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 535.931473][T14444] 8021q: adding VLAN 0 to HW filter on device bond0 [ 535.987850][T14444] 8021q: adding VLAN 0 to HW filter on device team0 [ 536.003381][T13204] bridge0: port 1(bridge_slave_0) entered blocking state [ 536.010648][T13204] bridge0: port 1(bridge_slave_0) entered forwarding state [ 536.036370][ T9] usb 5-1: new high-speed USB device number 18 using dummy_hcd [ 536.060083][T13204] bridge0: port 2(bridge_slave_1) entered blocking state [ 536.067333][T13204] bridge0: port 2(bridge_slave_1) entered forwarding state [ 536.075951][ T9] usb 5-1: device descriptor read/8, error -71 [ 536.244051][ T5685] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 536.288597][ T5685] usb 1-1: MIDIStreaming interface descriptor not found [ 536.326868][ T9] usb 5-1: new high-speed USB device number 19 using dummy_hcd [ 536.347465][T14628] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 536.378115][ T9] usb 5-1: device descriptor read/8, error -71 [ 536.384186][T14444] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 536.395791][T14628] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 536.434422][T14628] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 536.480140][T14628] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 536.517929][ T5685] usb 1-1: USB disconnect, device number 46 [ 536.526912][ T9] usb usb5-port1: unable to enumerate USB device [ 536.631219][T14444] veth0_vlan: entered promiscuous mode [ 536.669737][T14444] veth1_vlan: entered promiscuous mode [ 536.738932][T14444] veth0_macvtap: entered promiscuous mode [ 536.762644][T14444] veth1_macvtap: entered promiscuous mode [ 536.813766][T14444] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 536.860338][T14444] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 536.900966][T13207] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 536.923440][T13207] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 536.936806][ T5685] usb 1-1: new high-speed USB device number 47 using dummy_hcd [ 536.950466][T13207] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 536.969679][T13207] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 537.096322][ T5685] usb 1-1: Using ep0 maxpacket: 16 [ 537.136098][ T5685] usb 1-1: config 127 has an invalid interface number: 124 but max is 0 [ 537.159482][ T5685] usb 1-1: config 127 has no interface number 0 [ 537.173375][ T5685] usb 1-1: config 127 interface 124 has no altsetting 0 [ 537.192764][ T5685] usb 1-1: New USB device found, idVendor=0cf3, idProduct=1010, bcdDevice=36.87 [ 537.202138][ T139] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 537.212336][ T5685] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 537.224974][ T139] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 537.238673][ T5685] usb 1-1: Product: syz [ 537.253084][ T5685] usb 1-1: Manufacturer: syz [ 537.267102][ T5685] usb 1-1: SerialNumber: syz [ 537.330659][T13206] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 537.351643][T13206] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 537.598092][T14651] netlink: 'syz.1.2543': attribute type 3 has an invalid length. [ 537.853959][T14660] nvme_fabrics: unknown parameter or missing value ']z' in ctrl creation request [ 537.899444][T14660] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2586'. [ 538.189876][ T5685] usb 1-1: reset high-speed USB device number 47 using dummy_hcd [ 538.216452][ T5685] usb 1-1: device reset changed ep0 maxpacket size! [ 538.239122][ T5685] usb 1-1: USB disconnect, device number 47 [ 538.386367][ T5685] usb 1-1: new high-speed USB device number 48 using dummy_hcd [ 538.556401][ T5685] usb 1-1: Using ep0 maxpacket: 8 [ 538.561719][T14667] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 538.585409][ T5685] usb 1-1: New USB device found, idVendor=0582, idProduct=0582, bcdDevice= 0.40 [ 538.623457][ T5685] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 538.648339][ T5685] usb 1-1: Product: 膃锱᪚웷ꭺ最櫃⴫쐢阧嗫页घ汒樎靡޼랐Ⴇ쎡じꐍ푶入囁ퟏ뫗쪞댊즫벍ڞ腱䪶㮴㲾龎඀ȍ沭ﻑ폤㪗⬈뉎怇许烛칖س锣ై蚑ཱི拊閰⚥ [ 538.709419][ T5685] usb 1-1: Manufacturer: ᰉ [ 538.727212][ T5685] usb 1-1: SerialNumber: syz [ 538.884420][T14681] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 538.896974][T14681] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 538.930385][T14681] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2588'. [ 538.955323][T14632] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 539.018691][T14632] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 539.027423][T14681] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 539.066817][ T5726] usb 5-1: new high-speed USB device number 20 using dummy_hcd [ 539.087307][T14681] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 539.105755][T14681] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 539.115379][T14681] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 539.131219][ T5685] usb 1-1: Audio class v2/v3 interfaces need an interface association [ 539.233656][ T5685] snd-usb-audio 1-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 539.257114][ T5726] usb 5-1: Using ep0 maxpacket: 16 [ 539.277442][ T5726] usb 5-1: config 0 interface 0 altsetting 10 has 1 endpoint descriptor, different from the interface descriptor's value: 12 [ 539.295388][ T5685] usb 1-1: USB disconnect, device number 48 [ 539.340398][ T5726] usb 5-1: config 0 interface 0 has no altsetting 0 [ 539.371569][ T5726] usb 5-1: New USB device found, idVendor=17ef, idProduct=6009, bcdDevice= 0.00 [ 539.401041][ T5726] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 539.409749][T13337] udevd[13337]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 539.444771][ T5726] usb 5-1: config 0 descriptor?? [ 539.876997][ T5726] lenovo 0003:17EF:6009.0020: unknown main item tag 0x0 [ 539.894427][ T5726] lenovo 0003:17EF:6009.0020: unknown main item tag 0x0 [ 539.911103][ T5726] lenovo 0003:17EF:6009.0020: unknown main item tag 0x0 [ 539.925908][ T5726] lenovo 0003:17EF:6009.0020: unknown main item tag 0x0 [ 539.937104][ T5726] lenovo 0003:17EF:6009.0020: unknown main item tag 0x0 [ 539.956072][ T5726] lenovo 0003:17EF:6009.0020: unknown main item tag 0x0 [ 539.974589][ T5726] lenovo 0003:17EF:6009.0020: unknown main item tag 0x0 [ 539.996387][ T5726] lenovo 0003:17EF:6009.0020: unknown main item tag 0x0 [ 540.004448][ T5726] lenovo 0003:17EF:6009.0020: unknown main item tag 0x0 [ 540.019377][ T5726] lenovo 0003:17EF:6009.0020: unknown main item tag 0x0 [ 540.030339][ T5726] lenovo 0003:17EF:6009.0020: hidraw0: USB HID v0.0b Device [HID 17ef:6009] on usb-dummy_hcd.4-1/input0 [ 540.097806][ T5726] usb 5-1: USB disconnect, device number 20 [ 540.151641][T14699] fido_id[14699]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.4/usb5/report_descriptor': No such file or directory [ 541.106385][ T5631] usb 1-1: new low-speed USB device number 49 using dummy_hcd [ 541.123257][T14726] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2604'. [ 541.135610][T14726] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2604'. [ 541.290773][ T5631] usb 1-1: config 0 has an invalid interface number: 55 but max is 0 [ 541.304958][ T5631] usb 1-1: config 0 has no interface number 0 [ 541.321619][ T5631] usb 1-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 541.348054][ T5631] usb 1-1: config 0 interface 55 altsetting 0 endpoint 0xE has invalid maxpacket 32, setting to 8 [ 541.381711][ T5631] usb 1-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 541.405945][ T5631] usb 1-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 541.419652][ T5631] usb 1-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid maxpacket 120, setting to 8 [ 541.432971][ T5631] usb 1-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 541.446186][ T5631] usb 1-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 541.456380][ T5631] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 541.471403][ T5631] usb 1-1: config 0 descriptor?? [ 541.479137][T14721] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 541.493485][T14721] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 541.513988][ T5631] ldusb 1-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 541.516332][ T5726] usb 6-1: new high-speed USB device number 19 using dummy_hcd [ 541.676472][ T5726] usb 6-1: Using ep0 maxpacket: 8 [ 541.683409][ T5726] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 541.693632][ T5726] usb 6-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 541.704384][ T5726] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 541.720122][ T5726] usb 6-1: New USB device found, idVendor=0582, idProduct=0025, bcdDevice= 0.40 [ 541.720190][ T5631] usb 1-1: USB disconnect, device number 49 [ 541.737307][ T5726] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 541.743738][ T5631] ldusb 1-1:0.55: LD USB Device #0 now disconnected [ 541.748098][ T5726] usb 6-1: Product: syz [ 541.757416][ T5726] usb 6-1: Manufacturer: syz [ 541.763868][ T5726] usb 6-1: SerialNumber: syz [ 541.856449][ T5685] usb 5-1: new high-speed USB device number 21 using dummy_hcd [ 542.009075][ T5685] usb 5-1: config 0 has no interfaces? [ 542.027742][ T5726] usb 6-1: USB disconnect, device number 19 [ 542.034882][ T5685] usb 5-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 542.045078][ T5685] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 542.055943][ T5685] usb 5-1: Product: syz [ 542.060628][ T5685] usb 5-1: Manufacturer: syz [ 542.065370][ T5685] usb 5-1: SerialNumber: syz [ 542.084878][ T5685] usb 5-1: config 0 descriptor?? [ 542.380855][T14749] macsec3: entered promiscuous mode [ 542.395672][T14749] batadv0: entered promiscuous mode [ 542.411625][T14749] 8021q: adding VLAN 0 to HW filter on device macsec3 [ 542.428906][T14749] batadv0: left promiscuous mode [ 542.509910][ T5726] usb 5-1: USB disconnect, device number 21 [ 542.698505][T14761] netlink: zone id is out of range [ 542.710306][T14761] netlink: zone id is out of range [ 542.722833][T14761] netlink: zone id is out of range [ 542.733864][T14761] netlink: zone id is out of range [ 542.749332][T14762] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 542.760399][T14761] netlink: zone id is out of range [ 542.774378][T14761] netlink: zone id is out of range [ 542.788786][T14762] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 542.800528][T14761] netlink: zone id is out of range [ 542.817958][T14761] netlink: zone id is out of range [ 542.834627][T14761] netlink: zone id is out of range [ 542.842461][T14761] netlink: zone id is out of range [ 543.209544][T14772] program syz.4.2618 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 543.300488][T14778] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2619'. [ 543.395042][T14780] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2620'. [ 543.404836][T14780] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2620'. [ 543.876599][ T5685] usb 5-1: new full-speed USB device number 22 using dummy_hcd [ 543.886725][T14797] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 543.900218][T14797] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 543.919692][T14797] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 543.930744][T14797] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 544.049205][ T5685] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 544.076801][ T5685] usb 5-1: New USB device found, idVendor=06f8, idProduct=301b, bcdDevice=bb.39 [ 544.092938][ T5685] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 544.104724][ T5685] usb 5-1: Product: syz [ 544.110170][ T5685] usb 5-1: Manufacturer: syz [ 544.114901][ T5685] usb 5-1: SerialNumber: syz [ 544.125909][ T5685] usb 5-1: config 0 descriptor?? [ 544.139369][ T5685] gspca_main: gspca_pac7302-2.14.0 probing 06f8:301b [ 544.732505][T14816] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2632'. [ 545.244099][T14790] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 545.260148][T14790] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 545.337942][ T5685] gspca_pac7302: reg_w() failed i: 78 v: 40 error -110 [ 545.362435][ T5685] gspca_pac7302 5-1:0.0: probe with driver gspca_pac7302 failed with error -110 [ 545.761174][T14856] netlink: 152 bytes leftover after parsing attributes in process `syz.1.2640'. [ 545.887457][ T9] usb 1-1: new high-speed USB device number 50 using dummy_hcd [ 545.916045][T14858] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2641'. [ 545.928738][T14858] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2641'. [ 546.051290][T14862] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 546.060212][ T9] usb 1-1: Using ep0 maxpacket: 32 [ 546.066854][T14862] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 546.080077][ T9] usb 1-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 546.088037][T14862] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 546.114115][ T9] usb 1-1: New USB device found, idVendor=07fd, idProduct=0001, bcdDevice= 0.40 [ 546.119662][T14862] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 546.135026][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 546.146358][ T9] usb 1-1: Product: syz [ 546.150737][ T9] usb 1-1: Manufacturer: syz [ 546.155685][ T9] usb 1-1: SerialNumber: syz [ 546.392372][T14854] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 546.414635][T14854] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 546.816185][ T5631] usb 5-1: USB disconnect, device number 22 [ 546.874967][T14868] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 546.906811][T14868] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 547.143779][T14876] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2646'. [ 547.186190][T14876] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2646'. [ 547.217838][T14880] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 547.252008][T14880] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 547.332174][T14882] binder: 14881:14882 unknown command 0 [ 547.346441][T14882] binder: 14881:14882 ioctl c0306201 200000000080 returned -22 [ 547.930514][T14902] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2653'. [ 547.991825][T14905] input: syz1 as /devices/virtual/input/input34 [ 548.407968][ T5685] usb 6-1: new high-speed USB device number 20 using dummy_hcd [ 548.594883][T14898] ip6gretap0: entered promiscuous mode [ 548.619341][ T5685] usb 6-1: New USB device found, idVendor=1604, idProduct=8001, bcdDevice=44.1f [ 548.629119][T14898] macsec1: entered promiscuous mode [ 548.643250][T14898] macsec1: entered allmulticast mode [ 548.649668][ T5685] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 548.674658][T14898] ip6gretap0: entered allmulticast mode [ 548.691336][ T5685] usb 6-1: Product: syz [ 548.712881][ T5685] usb 6-1: Manufacturer: syz [ 548.738265][ T5685] usb 6-1: SerialNumber: syz [ 548.784291][ T5685] usb 6-1: config 0 descriptor?? [ 548.927567][T14917] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2657'. [ 548.974218][T14917] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2657'. [ 549.459243][T14923] loop9: detected capacity change from 0 to 7 [ 549.492635][ C1] I/O error, dev loop9, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 549.501877][ C1] buffer_io_error: 11 callbacks suppressed [ 549.501894][ C1] Buffer I/O error on dev loop9, logical block 0, async page read [ 549.506985][T14925] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2660'. [ 549.529912][ C1] I/O error, dev loop9, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 549.539149][ C1] Buffer I/O error on dev loop9, logical block 0, async page read [ 549.561978][ C0] I/O error, dev loop9, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 549.571253][ T5685] usb 6-1: USB disconnect, device number 20 [ 549.577257][ C0] Buffer I/O error on dev loop9, logical block 0, async page read [ 549.593951][T14927] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 549.594269][ C0] I/O error, dev loop9, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 549.611721][ C0] Buffer I/O error on dev loop9, logical block 0, async page read [ 549.624890][ C0] I/O error, dev loop9, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 549.634675][ C0] I/O error, dev loop9, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 549.643950][ C0] Buffer I/O error on dev loop9, logical block 0, async page read [ 549.654276][ C1] I/O error, dev loop9, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 549.663507][ C1] Buffer I/O error on dev loop9, logical block 0, async page read [ 549.672884][ T9] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 549.675416][ C1] I/O error, dev loop9, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 549.689082][ C1] Buffer I/O error on dev loop9, logical block 0, async page read [ 549.698323][T14923] ldm_validate_partition_table(): Disk read failed. [ 549.708927][T14927] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 549.751737][ C1] I/O error, dev loop9, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 549.760964][ C1] Buffer I/O error on dev loop9, logical block 0, async page read [ 549.770869][ C1] I/O error, dev loop9, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 549.780071][ C1] Buffer I/O error on dev loop9, logical block 0, async page read [ 549.789027][ C0] Buffer I/O error on dev loop9, logical block 0, async page read [ 549.801474][T14923] Dev loop9: unable to read RDB block 0 [ 549.832478][T14923] loop9: unable to read partition table [ 549.864422][T14923] loop9: partition table beyond EOD, truncated [ 549.920582][T14923] loop_reread_partitions: partition scan of loop9 (Cj̖P=ý?}X %`ր{֐ȵ4FLQk݊) failed (rc=-5) [ 550.086629][ T9] usb 1-1: USB disconnect, device number 50 [ 550.102896][ T5767] udevd[5767]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 550.229140][ T5635] udevd[5635]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card4/controlC4/../uevent} for writing: No such file or directory [ 550.316328][ T5685] usb 6-1: new high-speed USB device number 21 using dummy_hcd [ 550.488262][ T5685] usb 6-1: Using ep0 maxpacket: 16 [ 550.518545][ T5685] usb 6-1: unable to get BOS descriptor or descriptor too short [ 550.532460][ T5685] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 550.565631][ T5685] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 550.614916][ T5685] usb 6-1: New USB device found, idVendor=1235, idProduct=8212, bcdDevice= 0.40 [ 550.662036][ T5685] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 550.700901][ T5685] usb 6-1: Product: syz [ 550.714774][ T5685] usb 6-1: Manufacturer: syz [ 550.725420][ T5685] usb 6-1: SerialNumber: syz [ 550.735224][T14962] netlink: 'syz.4.2671': attribute type 1 has an invalid length. [ 550.814797][T14965] trusted_key: encrypted_key: master key parameter 'user' is invalid [ 550.863987][T14962] 8021q: adding VLAN 0 to HW filter on device bond6 [ 550.922964][T14962] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2671'. [ 550.944970][T14966] vlan6: entered promiscuous mode [ 550.970148][T14966] bond6: entered promiscuous mode [ 550.979088][ T5685] usb 6-1: Focusrite Scarlett Gen 3 Mixer Driver enabled (pid=0x8212); report any issues to https://github.com/geoffreybennett/scarlett-gen2/issues [ 550.997296][T14962] netlink: 'syz.4.2671': attribute type 30 has an invalid length. [ 551.015525][T14962] netlink: 'syz.4.2671': attribute type 29 has an invalid length. [ 551.031698][T14966] vlan6: entered allmulticast mode [ 551.031957][ T5685] usb 6-1: Error initialising Scarlett Gen 3 Mixer Driver: -22 [ 551.050116][T14962] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2671'. [ 551.083642][T14966] bond6: entered allmulticast mode [ 551.093948][T14968] netlink: 44 bytes leftover after parsing attributes in process `syz.4.2671'. [ 551.185794][ T5685] snd-usb-audio 6-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 551.202154][ T5685] usb 6-1: USB disconnect, device number 21 [ 551.255816][T13337] udevd[13337]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 551.329076][ T29] kauditd_printk_skb: 201 callbacks suppressed [ 551.329091][ T29] audit: type=1326 audit(1781026546.050:2113): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14970 comm="syz.4.2672" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f996979ce59 code=0x7ffc0000 [ 551.370781][T14971] hsr0: entered promiscuous mode [ 551.378928][T14971] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2672'. [ 551.388709][ T29] audit: type=1326 audit(1781026546.080:2114): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14970 comm="syz.4.2672" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f996979ce59 code=0x7ffc0000 [ 551.419140][ T29] audit: type=1326 audit(1781026546.080:2115): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14970 comm="syz.4.2672" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f996979e6c7 code=0x7ffc0000 [ 551.449276][T14970] hsr0: left promiscuous mode [ 551.554780][ T29] audit: type=1326 audit(1781026546.080:2116): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14970 comm="syz.4.2672" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=44 compat=0 ip=0x7f996975d68e code=0x7ffc0000 [ 551.634811][ T29] audit: type=1326 audit(1781026546.080:2117): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14970 comm="syz.4.2672" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=45 compat=0 ip=0x7f996975d68e code=0x7ffc0000 [ 551.742100][ T29] audit: type=1326 audit(1781026546.080:2118): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14970 comm="syz.4.2672" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=45 compat=0 ip=0x7f996975d68e code=0x7ffc0000 [ 551.800925][ T29] audit: type=1326 audit(1781026546.080:2119): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14970 comm="syz.4.2672" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=3 compat=0 ip=0x7f996975d68e code=0x7ffc0000 [ 551.876730][ T9] usb 6-1: new high-speed USB device number 22 using dummy_hcd [ 551.892563][ T29] audit: type=1326 audit(1781026546.080:2120): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14970 comm="syz.4.2672" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f996979ce59 code=0x7ffc0000 [ 551.917696][ T5631] usb 5-1: new full-speed USB device number 23 using dummy_hcd [ 551.946335][ T5685] usb 2-1: new high-speed USB device number 58 using dummy_hcd [ 551.951062][ T29] audit: type=1326 audit(1781026546.080:2121): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14970 comm="syz.4.2672" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f996979ce59 code=0x7ffc0000 [ 551.980720][ T29] audit: type=1326 audit(1781026546.080:2122): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14970 comm="syz.4.2672" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f996979ce59 code=0x7ffc0000 [ 552.056347][ T9] usb 6-1: Using ep0 maxpacket: 16 [ 552.064297][ T9] usb 6-1: config index 0 descriptor too short (expected 51443, got 18) [ 552.081229][ T9] usb 6-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 552.093608][ T5631] usb 5-1: unable to get BOS descriptor or descriptor too short [ 552.104200][ T9] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 552.112839][ T5631] usb 5-1: not running at top speed; connect to a high speed hub [ 552.130337][ T5631] usb 5-1: config 2 has an invalid interface number: 108 but max is 0 [ 552.148046][ T9] usb 6-1: Product: syz [ 552.148208][ T5685] usb 2-1: config 0 has no interfaces? [ 552.161736][ T5631] usb 5-1: config 2 has no interface number 0 [ 552.174151][ T5685] usb 2-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 552.188630][ T9] usb 6-1: Manufacturer: syz [ 552.193985][ T5685] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 552.198659][ T5631] usb 5-1: config 2 interface 108 has no altsetting 0 [ 552.211174][ T9] usb 6-1: SerialNumber: syz [ 552.225369][ T5685] usb 2-1: Product: syz [ 552.239853][ T9] r8152-cfgselector 6-1: Unknown version 0x0000 [ 552.248078][ T9] r8152-cfgselector 6-1: config 0 descriptor?? [ 552.253000][ T5685] usb 2-1: Manufacturer: syz [ 552.256209][ T5631] usb 5-1: string descriptor 0 read error: -22 [ 552.288112][ T5631] usb 5-1: New USB device found, idVendor=0572, idProduct=1329, bcdDevice=dc.52 [ 552.299529][ T5685] usb 2-1: SerialNumber: syz [ 552.309740][ T5631] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 552.331162][ T5685] usb 2-1: config 0 descriptor?? [ 552.484080][ T9] r8152-cfgselector 6-1: Unknown version 0x0000 [ 552.492190][ T9] r8152-cfgselector 6-1: No union descriptors [ 552.593892][T14980] veth0_macvtap: left promiscuous mode [ 552.672953][T14976] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 552.684196][T14976] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 552.702731][T14980] veth0_macvtap: entered promiscuous mode [ 552.713736][ T9] r8152-cfgselector 6-1: USB disconnect, device number 22 [ 552.716093][ T5685] usb 2-1: USB disconnect, device number 58 [ 553.106431][ T5726] usb 1-1: new high-speed USB device number 51 using dummy_hcd [ 553.260589][ T5726] usb 1-1: config 220 has an invalid interface number: 76 but max is 2 [ 553.295607][ T5726] usb 1-1: config 220 contains an unexpected descriptor of type 0x2, skipping [ 553.328687][ T5726] usb 1-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 553.351102][ T5726] usb 1-1: config 220 has no interface number 2 [ 553.367588][ T5726] usb 1-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 553.381384][ T5726] usb 1-1: config 220 interface 0 has no altsetting 0 [ 553.383710][T14994] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 553.392078][ T5726] usb 1-1: config 220 interface 76 has no altsetting 0 [ 553.407312][ T5726] usb 1-1: config 220 interface 1 has no altsetting 0 [ 553.420684][ T5726] usb 1-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 553.443935][ T5726] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 553.458874][ T5726] usb 1-1: Product: syz [ 553.463178][ T5726] usb 1-1: Manufacturer: syz [ 553.468244][ T5726] usb 1-1: SerialNumber: syz [ 553.497731][T14830] veth0_macvtap: left promiscuous mode [ 553.531067][T14994] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 553.711530][ T5726] usb 1-1: selecting invalid altsetting 0 [ 553.718024][ T5726] uvcvideo 1-1:220.0: Found UVC 7.01 device syz (8086:0b07) [ 553.725391][ T5726] uvcvideo 1-1:220.0: No valid video chain found. [ 553.737146][ T5726] usb 1-1: selecting invalid altsetting 0 [ 553.742915][ T5726] usbtest 1-1:220.1: probe with driver usbtest failed with error -22 [ 553.754764][ T5726] usb 1-1: USB disconnect, device number 51 [ 554.578524][ T5685] usb 6-1: new high-speed USB device number 23 using dummy_hcd [ 554.586508][ T5726] usb 1-1: new full-speed USB device number 52 using dummy_hcd [ 554.640204][ T9488] usb 5-1: USB disconnect, device number 23 [ 554.767636][ T5685] usb 6-1: Using ep0 maxpacket: 16 [ 554.779519][ T5726] usb 1-1: too many endpoints for config 0 interface 0 altsetting 254: 223, using maximum allowed: 30 [ 554.808179][ T5685] usb 6-1: too many configurations: 98, using maximum allowed: 8 [ 554.834926][ T5726] usb 1-1: config 0 interface 0 altsetting 254 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 554.860425][ T5685] usb 6-1: config 6 has no interfaces? [ 554.866770][ T9] usb 2-1: new high-speed USB device number 59 using dummy_hcd [ 554.870401][ T5726] usb 1-1: config 0 interface 0 altsetting 254 endpoint 0x81 has invalid wMaxPacketSize 0 [ 554.890184][ T5685] usb 6-1: config 6 has no interfaces? [ 554.907849][ T5685] usb 6-1: config 6 has no interfaces? [ 554.917362][ T5685] usb 6-1: config 6 has no interfaces? [ 554.923975][ T5726] usb 1-1: config 0 interface 0 altsetting 254 has 1 endpoint descriptor, different from the interface descriptor's value: 223 [ 554.956922][ T5726] usb 1-1: config 0 interface 0 has no altsetting 0 [ 554.964132][ T5685] usb 6-1: config 6 has no interfaces? [ 554.972506][ T5685] usb 6-1: config 6 has no interfaces? [ 554.981913][ T5726] usb 1-1: New USB device found, idVendor=17ef, idProduct=60ee, bcdDevice= 0.00 [ 554.996197][ T5685] usb 6-1: config 6 has no interfaces? [ 555.009263][ T5726] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 555.038291][ T5685] usb 6-1: config 6 has no interfaces? [ 555.051075][ T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 555.072213][ T5726] usb 1-1: config 0 descriptor?? [ 555.099414][T14998] batadv_slave_1: entered promiscuous mode [ 555.102183][ T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 555.143377][ T5685] usb 6-1: string descriptor 0 read error: -71 [ 555.156557][ T9] usb 2-1: New USB device found, idVendor=1e7d, idProduct=2cf6, bcdDevice= 0.00 [ 555.159838][ T5685] usb 6-1: New USB device found, idVendor=09c0, idProduct=0200, bcdDevice=58.3c [ 555.175591][T15018] ksmbd: Daemon and kernel module version mismatch. ksmbd: 0, kernel module: 1. User-space ksmbd should terminate. [ 555.187866][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 555.188767][ T5685] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=154 [ 555.219274][ T9] usb 2-1: config 0 descriptor?? [ 555.265089][ T5685] usb 6-1: rejected 8 configurations due to insufficient available bus power [ 555.298149][ T5685] usb 6-1: no configuration chosen from 8 choices [ 555.316425][ T9488] usb 5-1: new high-speed USB device number 24 using dummy_hcd [ 555.324759][ T5685] usb 6-1: USB disconnect, device number 23 [ 555.414080][T15021] sit1: entered promiscuous mode [ 555.476340][ T9488] usb 5-1: Using ep0 maxpacket: 32 [ 555.483690][ T9488] usb 5-1: config 0 interface 0 altsetting 128 endpoint 0x2 has an invalid bInterval 0, changing to 7 [ 555.502076][ T9488] usb 5-1: config 0 interface 0 has no altsetting 0 [ 555.510427][ T5726] hid_parser_main: 28 callbacks suppressed [ 555.510447][ T5726] lenovo 0003:17EF:60EE.0021: unknown main item tag 0x2 [ 555.524155][ T9488] usb 5-1: New USB device found, idVendor=1b1c, idProduct=0c10, bcdDevice= 0.00 [ 555.533616][ T5726] lenovo 0003:17EF:60EE.0021: unknown main item tag 0x6 [ 555.541847][ T9488] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 555.551963][ T5726] lenovo 0003:17EF:60EE.0021: ignoring exceeding usage max [ 555.565044][ T9488] usb 5-1: config 0 descriptor?? [ 555.580549][ T5726] lenovo 0003:17EF:60EE.0021: hidraw0: USB HID v0.81 Device [HID 17ef:60ee] on usb-dummy_hcd.0-1/input0 [ 555.641940][T15028] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 555.660964][T15028] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 555.669124][ T9] pyra 0003:1E7D:2CF6.0022: unknown main item tag 0x0 [ 555.685342][ T9] pyra 0003:1E7D:2CF6.0022: unknown main item tag 0x0 [ 555.692889][ T9] pyra 0003:1E7D:2CF6.0022: unknown main item tag 0x0 [ 555.710842][ T9] pyra 0003:1E7D:2CF6.0022: unknown main item tag 0x0 [ 555.728806][ T5631] usb 1-1: USB disconnect, device number 52 [ 555.746775][ T9] pyra 0003:1E7D:2CF6.0022: unknown main item tag 0x0 [ 555.788608][ T9] pyra 0003:1E7D:2CF6.0022: unknown main item tag 0x0 [ 555.817530][ T9] pyra 0003:1E7D:2CF6.0022: unknown main item tag 0x0 [ 555.849056][ T9] pyra 0003:1E7D:2CF6.0022: hidraw0: USB HID v0.00 Device [HID 1e7d:2cf6] on usb-dummy_hcd.1-1/input0 [ 555.888226][ T9] pyra 0003:1E7D:2CF6.0022: couldn't init struct pyra_device [ 555.901448][ T9] pyra 0003:1E7D:2CF6.0022: couldn't install mouse [ 555.921193][ T9] pyra 0003:1E7D:2CF6.0022: probe with driver pyra failed with error -5 [ 555.957877][T15041] netlink: 196 bytes leftover after parsing attributes in process `syz.2.2695'. [ 555.967332][T15041] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2695'. [ 556.046500][ T5685] usb 6-1: new high-speed USB device number 24 using dummy_hcd [ 556.206379][ T5685] usb 6-1: Using ep0 maxpacket: 8 [ 556.213109][ T5685] usb 6-1: config 0 has an invalid interface number: 55 but max is 0 [ 556.221657][ T5685] usb 6-1: config 0 has no interface number 0 [ 556.227963][ T5685] usb 6-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 556.238894][ T5685] usb 6-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 556.250557][ T5685] usb 6-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 556.261909][ T5685] usb 6-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 556.275601][ T5685] usb 6-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 556.284742][ T5685] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 556.295143][ T5685] usb 6-1: config 0 descriptor?? [ 556.306996][ T5685] ldusb 6-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 556.353983][ T9488] corsair-cpro 0003:1B1C:0C10.0023: hidraw0: USB HID v4.06 Device [HID 1b1c:0c10] on usb-dummy_hcd.4-1/input0 [ 556.434219][T15049] kvm: user requested TSC rate below hardware speed [ 556.550255][ T9488] corsair-cpro 0003:1B1C:0C10.0023: probe with driver corsair-cpro failed with error -5 [ 556.591951][T15051] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 556.611094][T15051] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 556.712892][T15049] syzkaller0: entered promiscuous mode [ 556.718522][T15049] syzkaller0: entered allmulticast mode [ 556.759401][T15016] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 556.768743][T15016] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 556.790764][T15016] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 556.810662][T15016] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 556.821045][ T9488] usb 5-1: USB disconnect, device number 24 [ 557.131899][T15059] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 557.142815][T15059] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 557.158278][T15059] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 557.168855][T15059] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 558.673350][ T9488] usb 2-1: USB disconnect, device number 59 [ 558.902996][ T9488] usb 6-1: USB disconnect, device number 24 [ 558.947267][ T9488] ldusb 6-1:0.55: LD USB Device #0 now disconnected [ 559.444851][T15078] kAFS: unable to lookup cell '(' [ 560.873670][T15092] net_ratelimit: 371 callbacks suppressed [ 560.873688][T15092] openvswitch: netlink: Unexpected mask (mask=400240, allowed=410048) [ 561.039774][T15095] netlink: 'syz.1.2707': attribute type 1 has an invalid length. [ 561.094062][T15100] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2707'. [ 561.118687][T15109] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 561.129579][T15109] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 561.142162][T15109] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 561.164261][T15109] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 561.197889][T15111] input: syz0 as /devices/virtual/input/input35 [ 561.319581][T15117] FAULT_INJECTION: forcing a failure. [ 561.319581][T15117] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 561.333055][T15117] CPU: 0 UID: 0 PID: 15117 Comm: syz.5.2716 Tainted: G L syzkaller #0 PREEMPT(full) [ 561.333081][T15117] Tainted: [L]=SOFTLOCKUP [ 561.333087][T15117] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 561.333096][T15117] Call Trace: [ 561.333104][T15117] [ 561.333111][T15117] dump_stack_lvl+0xe8/0x150 [ 561.333135][T15117] should_fail_ex+0x412/0x560 [ 561.333158][T15117] _copy_from_user+0x2d/0xb0 [ 561.333179][T15117] __sys_bpf+0x229/0x950 [ 561.333205][T15117] ? __pfx___sys_bpf+0x10/0x10 [ 561.333243][T15117] ? ksys_write+0x242/0x270 [ 561.333269][T15117] ? __pfx_ksys_write+0x10/0x10 [ 561.333294][T15117] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 561.333311][T15117] __x64_sys_bpf+0x7c/0x90 [ 561.333333][T15117] do_syscall_64+0x174/0x580 [ 561.333350][T15117] ? trace_irq_disable+0x3b/0x140 [ 561.333370][T15117] ? clear_bhb_loop+0x40/0x90 [ 561.333390][T15117] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 561.333405][T15117] RIP: 0033:0x7f0a3139ce59 [ 561.333420][T15117] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 561.333433][T15117] RSP: 002b:00007f0a322b4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 561.333450][T15117] RAX: ffffffffffffffda RBX: 00007f0a31615fa0 RCX: 00007f0a3139ce59 [ 561.333461][T15117] RDX: 0000000000000010 RSI: 0000200000000680 RDI: 000000000000000f [ 561.333472][T15117] RBP: 00007f0a322b4090 R08: 0000000000000000 R09: 0000000000000000 [ 561.333482][T15117] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 561.333492][T15117] R13: 00007f0a31616038 R14: 00007f0a31615fa0 R15: 00007f0a3173fa48 [ 561.333518][T15117] [ 561.508117][ T5685] usb 2-1: new high-speed USB device number 60 using dummy_hcd [ 561.569972][T15109] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 561.579544][T15109] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 561.659826][T15119] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 561.730125][ T5685] usb 2-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 561.749452][ T5685] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 561.756361][ T9] usb 6-1: new high-speed USB device number 25 using dummy_hcd [ 561.795691][ T5685] usb 2-1: Product: syz [ 561.807554][ T5685] usb 2-1: Manufacturer: syz [ 561.821190][ T5685] usb 2-1: SerialNumber: syz [ 561.839330][ T5685] usb 2-1: config 0 descriptor?? [ 561.916443][ T9] usb 6-1: Using ep0 maxpacket: 16 [ 561.922652][ T9] usb 6-1: too many configurations: 98, using maximum allowed: 8 [ 561.939644][ T9] usb 6-1: config 6 has no interfaces? [ 561.946362][ T9] usb 6-1: config 6 has no interfaces? [ 561.954312][ T9] usb 6-1: config 6 has no interfaces? [ 561.963323][ T9] usb 6-1: config 6 has no interfaces? [ 561.976042][ T9] usb 6-1: config 6 has no interfaces? [ 561.986043][ T29] kauditd_printk_skb: 44 callbacks suppressed [ 561.986058][ T29] audit: type=1326 audit(1781026556.700:2167): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15113 comm="syz.0.2715" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f10ddd9ce59 code=0x0 [ 562.048679][ T9] usb 6-1: config 6 has no interfaces? [ 562.061680][ T9] usb 6-1: config 6 has no interfaces? [ 562.074258][ T9] usb 6-1: config 6 has no interfaces? [ 562.185130][ T9] usb 6-1: string descriptor 0 read error: -71 [ 562.201126][ T9] usb 6-1: New USB device found, idVendor=09c0, idProduct=0200, bcdDevice=58.3c [ 562.222515][ T9] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=154 [ 562.246723][ T9] usb 6-1: rejected 8 configurations due to insufficient available bus power [ 562.269143][ T9] usb 6-1: no configuration chosen from 8 choices [ 562.273743][T15095] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2707'. [ 562.294375][ T5685] usb 2-1: Firmware version (0.0) predates our first public release. [ 562.320316][ T5685] usb 2-1: Please update to version 0.2 or newer [ 562.343628][ T9] usb 6-1: USB disconnect, device number 25 [ 562.390772][ T5685] usb 2-1: USB disconnect, device number 60 [ 562.739416][ T1315] ieee802154 phy0 wpan0: encryption failed: -22 [ 562.745850][ T1315] ieee802154 phy1 wpan1: encryption failed: -22 [ 562.950172][T15146] netlink: 'syz.1.2722': attribute type 6 has an invalid length. [ 562.975076][T15146] IPv6: NLM_F_CREATE should be specified when creating new route [ 562.999028][T15146] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 563.008305][T15146] IPv6: NLM_F_CREATE should be set when creating new route [ 563.017022][T15149] syz_tun: entered promiscuous mode [ 563.026525][ T9488] usb 5-1: new low-speed USB device number 25 using dummy_hcd [ 563.038592][T15149] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 563.186396][ T9488] usb 5-1: Invalid ep0 maxpacket: 64 [ 563.286318][ T5685] usb 6-1: new full-speed USB device number 26 using dummy_hcd [ 563.316329][ T9488] usb 5-1: new low-speed USB device number 26 using dummy_hcd [ 563.438694][ T5685] usb 6-1: config 0 interface 0 altsetting 6 endpoint 0x81 has invalid maxpacket 1024, setting to 64 [ 563.449897][ T5685] usb 6-1: config 0 interface 0 has no altsetting 0 [ 563.457751][ T5685] usb 6-1: New USB device found, idVendor=06a3, idProduct=0621, bcdDevice= 0.00 [ 563.468208][ T5685] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 563.486323][ T9488] usb 5-1: Invalid ep0 maxpacket: 64 [ 563.493908][ T5685] usb 6-1: config 0 descriptor?? [ 563.503848][ T9488] usb usb5-port1: attempt power cycle [ 563.512482][T15148] raw-gadget.4 gadget.5: fail, usb_ep_enable returned -22 [ 563.656358][ T9] usb 2-1: new high-speed USB device number 61 using dummy_hcd [ 563.821207][ T9] usb 2-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 563.853736][ T9] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 563.875754][ T9488] usb 5-1: new low-speed USB device number 27 using dummy_hcd [ 563.886426][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 563.899835][ T9488] usb 5-1: Invalid ep0 maxpacket: 64 [ 563.905316][ T9] usb 2-1: Product: syz [ 563.912465][ T9] usb 2-1: Manufacturer: syz [ 563.922883][ T9] usb 2-1: SerialNumber: syz [ 563.953049][ T5685] saitek 0003:06A3:0621.0024: unknown main item tag 0x3 [ 563.962547][ T5685] saitek 0003:06A3:0621.0024: unknown main item tag 0x0 [ 563.971171][ T5685] saitek 0003:06A3:0621.0024: unknown main item tag 0x0 [ 563.981426][ T5685] saitek 0003:06A3:0621.0024: unknown main item tag 0x0 [ 563.988911][ T5685] saitek 0003:06A3:0621.0024: unknown main item tag 0x0 [ 563.996870][ T5685] saitek 0003:06A3:0621.0024: unknown main item tag 0x0 [ 564.007065][ T5685] saitek 0003:06A3:0621.0024: unknown main item tag 0x0 [ 564.014336][ T5685] saitek 0003:06A3:0621.0024: unknown main item tag 0x0 [ 564.028741][ T5685] saitek 0003:06A3:0621.0024: hidraw0: USB HID v0.04 Device [HID 06a3:0621] on usb-dummy_hcd.5-1/input0 [ 564.040991][ T9488] usb 5-1: new low-speed USB device number 28 using dummy_hcd [ 564.067941][ T9488] usb 5-1: Invalid ep0 maxpacket: 64 [ 564.077399][ T9488] usb usb5-port1: unable to enumerate USB device [ 564.158720][ T9488] usb 6-1: USB disconnect, device number 26 [ 564.203524][ T9] usblp 2-1:1.0: usblp0: USB Unidirectional printer dev 61 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 564.443394][ C0] usblp0: nonzero write bulk status received: -71 [ 564.467214][ T9] usb 2-1: USB disconnect, device number 61 [ 564.476200][ T9] usblp0: removed [ 564.961387][T15188] [ 564.963739][T15188] ===================================================== [ 564.970661][T15188] WARNING: SOFTIRQ-safe -> SOFTIRQ-unsafe lock order detected [ 564.978103][T15188] syzkaller #0 Tainted: G L [ 564.984060][T15188] ----------------------------------------------------- [ 564.990977][T15188] syz.5.2735/15188 [HC0[0]:SC0[0]:HE0:SE1] is trying to acquire: [ 564.998673][T15188] ffffffff8e60a058 (tasklist_lock){.+.+}-{3:3}, at: send_sigurg+0x12b/0x420 [ 565.007350][T15188] [ 565.007350][T15188] and this task is already holding: [ 565.014691][T15188] ffff8880298a3320 (&f_owner->lock){....}-{3:3}, at: send_sigurg+0x55/0x420 [ 565.023364][T15188] which would create a new lock dependency: [ 565.029229][T15188] (&f_owner->lock){....}-{3:3} -> (tasklist_lock){.+.+}-{3:3} [ 565.036787][T15188] [ 565.036787][T15188] but this new dependency connects a SOFTIRQ-irq-safe lock: [ 565.046212][T15188] (&dev->event_lock#2){..-.}-{3:3} [ 565.046245][T15188] [ 565.046245][T15188] ... which became SOFTIRQ-irq-safe at: [ 565.059117][T15188] lock_acquire+0x106/0x350 [ 565.063688][T15188] _raw_spin_lock_irqsave+0x40/0x60 [ 565.068956][T15188] input_inject_event+0xa4/0x330 [ 565.073961][T15188] led_trigger_event+0x138/0x210 [ 565.078966][T15188] kbd_bh+0x1c6/0x2e0 [ 565.083016][T15188] tasklet_action_common+0x2da/0x4b0 [ 565.088367][T15188] handle_softirqs+0x22a/0x840 [ 565.093198][T15188] __irq_exit_rcu+0xca/0x220 [ 565.097849][T15188] irq_exit_rcu+0x9/0x30 [ 565.102156][T15188] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 565.107850][T15188] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 565.113897][T15188] _raw_spin_unlock_irq+0x29/0x50 [ 565.118991][T15188] n_tty_ioctl_helper+0x38a/0x4d0 [ 565.124080][T15188] tty_ioctl+0x9c5/0xde0 [ 565.128394][T15188] __se_sys_ioctl+0xfc/0x170 [ 565.133050][T15188] do_syscall_64+0x174/0x580 [ 565.137706][T15188] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 565.143667][T15188] [ 565.143667][T15188] to a SOFTIRQ-irq-unsafe lock: [ 565.150661][T15188] (tasklist_lock){.+.+}-{3:3} [ 565.150680][T15188] [ 565.150680][T15188] ... which became SOFTIRQ-irq-unsafe at: [ 565.163276][T15188] ... [ 565.163283][T15188] lock_acquire+0x106/0x350 [ 565.170418][T15188] _raw_read_lock+0x36/0x50 [ 565.174996][T15188] __do_wait+0xde/0x740 [ 565.179221][T15188] do_wait+0x1e7/0x510 [ 565.183372][T15188] kernel_wait+0xd6/0x1c0 [ 565.187781][T15188] call_usermodehelper_exec_work+0xbe/0x230 [ 565.193745][T15188] process_scheduled_works+0xb5d/0x1860 [ 565.199353][T15188] worker_thread+0xa53/0xfc0 [ 565.204009][T15188] kthread+0x389/0x470 [ 565.208159][T15188] ret_from_fork+0x514/0xb70 [ 565.212818][T15188] ret_from_fork_asm+0x1a/0x30 [ 565.217649][T15188] [ 565.217649][T15188] other info that might help us debug this: [ 565.217649][T15188] [ 565.227860][T15188] Chain exists of: [ 565.227860][T15188] &dev->event_lock#2 --> &f_owner->lock --> tasklist_lock [ 565.227860][T15188] [ 565.240882][T15188] Possible interrupt unsafe locking scenario: [ 565.240882][T15188] [ 565.249180][T15188] CPU0 CPU1 [ 565.254530][T15188] ---- ---- [ 565.259882][T15188] lock(tasklist_lock); [ 565.264108][T15188] local_irq_disable(); [ 565.270844][T15188] lock(&dev->event_lock#2); [ 565.278060][T15188] lock(&f_owner->lock); [ 565.284895][T15188] [ 565.288327][T15188] lock(&dev->event_lock#2); [ 565.293160][T15188] [ 565.293160][T15188] *** DEADLOCK *** [ 565.293160][T15188] [ 565.301284][T15188] 2 locks held by syz.5.2735/15188: [ 565.306468][T15188] #0: ffff88807c756cd0 (&u->lock){+.+.}-{3:3}, at: queue_oob+0x1b6/0x4f0 [ 565.314973][T15188] #1: ffff8880298a3320 (&f_owner->lock){....}-{3:3}, at: send_sigurg+0x55/0x420 [ 565.324090][T15188] [ 565.324090][T15188] the dependencies between SOFTIRQ-irq-safe lock and the holding lock: [ 565.334481][T15188] -> (&dev->event_lock#2){..-.}-{3:3} { [ 565.340279][T15188] IN-SOFTIRQ-W at: [ 565.344500][T15188] lock_acquire+0x106/0x350 [ 565.351155][T15188] _raw_spin_lock_irqsave+0x40/0x60 [ 565.358506][T15188] input_inject_event+0xa4/0x330 [ 565.365596][T15188] led_trigger_event+0x138/0x210 [ 565.372699][T15188] kbd_bh+0x1c6/0x2e0 [ 565.378843][T15188] tasklet_action_common+0x2da/0x4b0 [ 565.386293][T15188] handle_softirqs+0x22a/0x840 [ 565.393218][T15188] __irq_exit_rcu+0xca/0x220 [ 565.399971][T15188] irq_exit_rcu+0x9/0x30 [ 565.406377][T15188] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 565.414168][T15188] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 565.422300][T15188] _raw_spin_unlock_irq+0x29/0x50 [ 565.429491][T15188] n_tty_ioctl_helper+0x38a/0x4d0 [ 565.436673][T15188] tty_ioctl+0x9c5/0xde0 [ 565.443070][T15188] __se_sys_ioctl+0xfc/0x170 [ 565.449815][T15188] do_syscall_64+0x174/0x580 [ 565.456557][T15188] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 565.464601][T15188] INITIAL USE at: [ 565.468753][T15188] lock_acquire+0x106/0x350 [ 565.475319][T15188] _raw_spin_lock_irqsave+0x40/0x60 [ 565.482593][T15188] input_inject_event+0xa4/0x330 [ 565.489601][T15188] kbd_led_trigger_activate+0xbc/0x100 [ 565.497125][T15188] led_trigger_set+0x535/0x960 [ 565.504041][T15188] led_trigger_set_default+0x260/0x2a0 [ 565.511564][T15188] led_classdev_register_ext+0x787/0x9c0 [ 565.519265][T15188] input_leds_connect+0x517/0x790 [ 565.526384][T15188] input_register_device+0xce0/0x1140 [ 565.533830][T15188] atkbd_connect+0x71e/0xa10 [ 565.540488][T15188] serio_driver_probe+0x82/0xb0 [ 565.547413][T15188] really_probe+0x267/0xaf0 [ 565.553988][T15188] __driver_probe_device+0x1ef/0x380 [ 565.561343][T15188] driver_probe_device+0x4f/0x240 [ 565.568439][T15188] __driver_attach+0x34c/0x640 [ 565.575273][T15188] bus_for_each_dev+0x23b/0x2c0 [ 565.582282][T15188] serio_handle_event+0x1af/0xf80 [ 565.589390][T15188] process_scheduled_works+0xb5d/0x1860 [ 565.597013][T15188] worker_thread+0xa53/0xfc0 [ 565.603688][T15188] kthread+0x389/0x470 [ 565.609838][T15188] ret_from_fork+0x514/0xb70 [ 565.616507][T15188] ret_from_fork_asm+0x1a/0x30 [ 565.623352][T15188] } [ 565.626102][T15188] ... key at: [] input_allocate_device.__key.7+0x0/0x20 [ 565.635384][T15188] -> (&client->buffer_lock){....}-{3:3} { [ 565.641281][T15188] INITIAL USE at: [ 565.645336][T15188] lock_acquire+0x106/0x350 [ 565.651734][T15188] _raw_spin_lock+0x2e/0x40 [ 565.658141][T15188] evdev_pass_values+0xb9/0xbd0 [ 565.664923][T15188] evdev_events+0x1aa/0x340 [ 565.671331][T15188] input_pass_values+0x1c2/0x890 [ 565.678169][T15188] input_event_dispose+0x330/0x6b0 [ 565.685184][T15188] input_inject_event+0x1dc/0x330 [ 565.692118][T15188] evdev_write+0x325/0x4c0 [ 565.698435][T15188] vfs_write+0x29a/0xb90 [ 565.704579][T15188] ksys_write+0x150/0x270 [ 565.710806][T15188] do_syscall_64+0x174/0x580 [ 565.717295][T15188] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 565.725093][T15188] } [ 565.727749][T15188] ... key at: [] evdev_open.__key.27+0x0/0x20 [ 565.736080][T15188] ... acquired at: [ 565.740050][T15188] _raw_spin_lock+0x2e/0x40 [ 565.744721][T15188] evdev_pass_values+0xb9/0xbd0 [ 565.749735][T15188] evdev_events+0x1aa/0x340 [ 565.754397][T15188] input_pass_values+0x1c2/0x890 [ 565.759498][T15188] input_event_dispose+0x330/0x6b0 [ 565.764778][T15188] input_inject_event+0x1dc/0x330 [ 565.769962][T15188] evdev_write+0x325/0x4c0 [ 565.774536][T15188] vfs_write+0x29a/0xb90 [ 565.778941][T15188] ksys_write+0x150/0x270 [ 565.783434][T15188] do_syscall_64+0x174/0x580 [ 565.788184][T15188] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 565.794238][T15188] [ 565.796548][T15188] -> (&new->fa_lock){....}-{3:3} { [ 565.801744][T15188] INITIAL USE at: [ 565.805706][T15188] lock_acquire+0x106/0x350 [ 565.811927][T15188] _raw_write_lock_irq+0x3d/0x50 [ 565.818583][T15188] fasync_remove_entry+0xf1/0x1c0 [ 565.825333][T15188] lease_modify+0x4f7/0x6c0 [ 565.831559][T15188] locks_remove_file+0x5f0/0xf70 [ 565.838218][T15188] __fput+0x3ae/0xa60 [ 565.843923][T15188] task_work_run+0x1d9/0x270 [ 565.850234][T15188] get_signal+0x11eb/0x1330 [ 565.856459][T15188] arch_do_signal_or_restart+0xbc/0x840 [ 565.863734][T15188] exit_to_user_mode_loop+0xa9/0x680 [ 565.870736][T15188] do_syscall_64+0x353/0x580 [ 565.877049][T15188] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 565.884661][T15188] INITIAL READ USE at: [ 565.889061][T15188] lock_acquire+0x106/0x350 [ 565.895717][T15188] _raw_read_lock_irqsave+0x48/0x60 [ 565.903253][T15188] kill_fasync+0x199/0x4d0 [ 565.909831][T15188] sock_wake_async+0x137/0x160 [ 565.916750][T15188] sk_wake_async+0x184/0x280 [ 565.923530][T15188] unix_release_sock+0x74f/0xc80 [ 565.930628][T15188] unix_release+0x92/0xd0 [ 565.937114][T15188] sock_close+0xc3/0x240 [ 565.943521][T15188] __fput+0x44f/0xa60 [ 565.949661][T15188] task_work_run+0x1d9/0x270 [ 565.956411][T15188] exit_to_user_mode_loop+0x193/0x680 [ 565.963936][T15188] do_syscall_64+0x353/0x580 [ 565.970678][T15188] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 565.978723][T15188] } [ 565.981296][T15188] ... key at: [] fasync_insert_entry.__key+0x0/0x20 [ 565.990046][T15188] ... acquired at: [ 565.993932][T15188] _raw_read_lock_irqsave+0x48/0x60 [ 565.999300][T15188] kill_fasync+0x199/0x4d0 [ 566.003878][T15188] evdev_pass_values+0x627/0xbd0 [ 566.008976][T15188] evdev_events+0x1e6/0x340 [ 566.013635][T15188] input_pass_values+0x288/0x890 [ 566.018724][T15188] input_event_dispose+0x330/0x6b0 [ 566.023994][T15188] input_inject_event+0x1dc/0x330 [ 566.029204][T15188] evdev_write+0x325/0x4c0 [ 566.033781][T15188] vfs_write+0x29a/0xb90 [ 566.038185][T15188] ksys_write+0x150/0x270 [ 566.042676][T15188] do_syscall_64+0x174/0x580 [ 566.047434][T15188] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 566.053487][T15188] [ 566.055791][T15188] -> (&f_owner->lock){....}-{3:3} { [ 566.060988][T15188] INITIAL USE at: [ 566.064876][T15188] lock_acquire+0x106/0x350 [ 566.070928][T15188] _raw_write_lock_irq+0x3d/0x50 [ 566.077410][T15188] __f_setown+0x67/0x370 [ 566.083206][T15188] fcntl_dirnotify+0x3f9/0x6a0 [ 566.089517][T15188] do_fcntl+0x77e/0x1a20 [ 566.095311][T15188] __se_sys_fcntl+0xc8/0x150 [ 566.101457][T15188] do_syscall_64+0x174/0x580 [ 566.107593][T15188] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 566.115034][T15188] INITIAL READ USE at: [ 566.119441][T15188] lock_acquire+0x106/0x350 [ 566.125926][T15188] _raw_read_lock_irqsave+0x48/0x60 [ 566.133110][T15188] send_sigio+0x38/0x370 [ 566.139341][T15188] kill_fasync+0x24d/0x4d0 [ 566.145743][T15188] sock_wake_async+0x137/0x160 [ 566.152488][T15188] sk_wake_async+0x184/0x280 [ 566.159059][T15188] unix_release_sock+0x74f/0xc80 [ 566.165978][T15188] unix_release+0x92/0xd0 [ 566.172316][T15188] sock_close+0xc3/0x240 [ 566.178536][T15188] __fput+0x44f/0xa60 [ 566.184500][T15188] task_work_run+0x1d9/0x270 [ 566.191075][T15188] exit_to_user_mode_loop+0x193/0x680 [ 566.198512][T15188] do_syscall_64+0x353/0x580 [ 566.205094][T15188] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 566.212969][T15188] } [ 566.215452][T15188] ... key at: [] file_f_owner_allocate.__key+0x0/0x20 [ 566.224292][T15188] ... acquired at: [ 566.228075][T15188] _raw_read_lock_irqsave+0x48/0x60 [ 566.233453][T15188] send_sigio+0x38/0x370 [ 566.237854][T15188] kill_fasync+0x24d/0x4d0 [ 566.242437][T15188] sock_wake_async+0x137/0x160 [ 566.247359][T15188] sk_wake_async+0x184/0x280 [ 566.252111][T15188] unix_release_sock+0x74f/0xc80 [ 566.257204][T15188] unix_release+0x92/0xd0 [ 566.261697][T15188] sock_close+0xc3/0x240 [ 566.266094][T15188] __fput+0x44f/0xa60 [ 566.270231][T15188] task_work_run+0x1d9/0x270 [ 566.274984][T15188] exit_to_user_mode_loop+0x193/0x680 [ 566.280512][T15188] do_syscall_64+0x353/0x580 [ 566.285267][T15188] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 566.291313][T15188] [ 566.293618][T15188] [ 566.293618][T15188] the dependencies between the lock to be acquired [ 566.293627][T15188] and SOFTIRQ-irq-unsafe lock: [ 566.307106][T15188] -> (tasklist_lock){.+.+}-{3:3} { [ 566.312217][T15188] HARDIRQ-ON-R at: [ 566.316181][T15188] lock_acquire+0x106/0x350 [ 566.322322][T15188] _raw_read_lock+0x36/0x50 [ 566.328466][T15188] __do_wait+0xde/0x740 [ 566.334260][T15188] do_wait+0x1e7/0x510 [ 566.339963][T15188] kernel_wait+0xd6/0x1c0 [ 566.345927][T15188] call_usermodehelper_exec_work+0xbe/0x230 [ 566.353455][T15188] process_scheduled_works+0xb5d/0x1860 [ 566.360633][T15188] worker_thread+0xa53/0xfc0 [ 566.366852][T15188] kthread+0x389/0x470 [ 566.372561][T15188] ret_from_fork+0x514/0xb70 [ 566.378781][T15188] ret_from_fork_asm+0x1a/0x30 [ 566.385183][T15188] SOFTIRQ-ON-R at: [ 566.389148][T15188] lock_acquire+0x106/0x350 [ 566.395280][T15188] _raw_read_lock+0x36/0x50 [ 566.401421][T15188] __do_wait+0xde/0x740 [ 566.407212][T15188] do_wait+0x1e7/0x510 [ 566.412919][T15188] kernel_wait+0xd6/0x1c0 [ 566.418881][T15188] call_usermodehelper_exec_work+0xbe/0x230 [ 566.426417][T15188] process_scheduled_works+0xb5d/0x1860 [ 566.433593][T15188] worker_thread+0xa53/0xfc0 [ 566.439814][T15188] kthread+0x389/0x470 [ 566.445517][T15188] ret_from_fork+0x514/0xb70 [ 566.451738][T15188] ret_from_fork_asm+0x1a/0x30 [ 566.458135][T15188] INITIAL USE at: [ 566.462036][T15188] lock_acquire+0x106/0x350 [ 566.468084][T15188] _raw_write_lock_irq+0x3d/0x50 [ 566.474564][T15188] copy_process+0x2b4c/0x4440 [ 566.480782][T15188] kernel_clone+0x2d7/0x940 [ 566.486833][T15188] user_mode_thread+0x110/0x180 [ 566.493239][T15188] rest_init+0x23/0x300 [ 566.498964][T15188] start_kernel+0x38a/0x3e0 [ 566.505026][T15188] x86_64_start_reservations+0x24/0x30 [ 566.512051][T15188] x86_64_start_kernel+0x143/0x1c0 [ 566.518722][T15188] common_startup_64+0x13e/0x147 [ 566.525394][T15188] INITIAL READ USE at: [ 566.529715][T15188] lock_acquire+0x106/0x350 [ 566.536211][T15188] _raw_read_lock+0x36/0x50 [ 566.542713][T15188] __do_wait+0xde/0x740 [ 566.548854][T15188] do_wait+0x1e7/0x510 [ 566.554918][T15188] kernel_wait+0xd6/0x1c0 [ 566.561264][T15188] call_usermodehelper_exec_work+0xbe/0x230 [ 566.569156][T15188] process_scheduled_works+0xb5d/0x1860 [ 566.576698][T15188] worker_thread+0xa53/0xfc0 [ 566.583293][T15188] kthread+0x389/0x470 [ 566.589370][T15188] ret_from_fork+0x514/0xb70 [ 566.595940][T15188] ret_from_fork_asm+0x1a/0x30 [ 566.602690][T15188] } [ 566.605174][T15188] ... key at: [] tasklist_lock+0x18/0x40 [ 566.612883][T15188] ... acquired at: [ 566.616674][T15188] _raw_read_lock+0x36/0x50 [ 566.621355][T15188] send_sigurg+0x12b/0x420 [ 566.625950][T15188] sk_send_sigurg+0x6c/0x2e0 [ 566.630705][T15188] queue_oob+0x42c/0x4f0 [ 566.635113][T15188] unix_stream_sendmsg+0xcb1/0xe80 [ 566.640386][T15188] ____sys_sendmsg+0x972/0x9f0 [ 566.645314][T15188] ___sys_sendmsg+0x2a5/0x360 [ 566.650151][T15188] __x64_sys_sendmsg+0x1bd/0x2a0 [ 566.655245][T15188] do_syscall_64+0x174/0x580 [ 566.659994][T15188] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 566.666043][T15188] [ 566.668349][T15188] [ 566.668349][T15188] stack backtrace: [ 566.674231][T15188] CPU: 1 UID: 0 PID: 15188 Comm: syz.5.2735 Tainted: G L syzkaller #0 PREEMPT(full) [ 566.674252][T15188] Tainted: [L]=SOFTLOCKUP [ 566.674258][T15188] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 566.674266][T15188] Call Trace: [ 566.674274][T15188] [ 566.674282][T15188] dump_stack_lvl+0xe8/0x150 [ 566.674298][T15188] __lock_acquire+0x2a94/0x2cf0 [ 566.674319][T15188] ? send_sigurg+0x12b/0x420 [ 566.674336][T15188] lock_acquire+0x106/0x350 [ 566.674348][T15188] ? send_sigurg+0x12b/0x420 [ 566.674368][T15188] _raw_read_lock+0x36/0x50 [ 566.674386][T15188] ? send_sigurg+0x12b/0x420 [ 566.674401][T15188] send_sigurg+0x12b/0x420 [ 566.674418][T15188] sk_send_sigurg+0x6c/0x2e0 [ 566.674434][T15188] queue_oob+0x42c/0x4f0 [ 566.674450][T15188] ? __pfx_queue_oob+0x10/0x10 [ 566.674465][T15188] ? __schedule+0x1837/0x5740 [ 566.674484][T15188] ? bpf_lsm_socket_getpeersec_dgram+0x9/0x20 [ 566.674503][T15188] unix_stream_sendmsg+0xcb1/0xe80 [ 566.674521][T15188] ? __lock_acquire+0x6b5/0x2cf0 [ 566.674534][T15188] ? __pfx_unix_stream_sendmsg+0x10/0x10 [ 566.674551][T15188] ? aa_sock_msg_perm+0xda/0x1b0 [ 566.674569][T15188] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 566.674585][T15188] ____sys_sendmsg+0x972/0x9f0 [ 566.674598][T15188] ? __might_fault+0xaf/0x130 [ 566.674615][T15188] ? __pfx_____sys_sendmsg+0x10/0x10 [ 566.674629][T15188] ? import_iovec+0x73/0xa0 [ 566.674644][T15188] ___sys_sendmsg+0x2a5/0x360 [ 566.674656][T15188] ? __lock_acquire+0x6b5/0x2cf0 [ 566.674670][T15188] ? __pfx____sys_sendmsg+0x10/0x10 [ 566.674683][T15188] ? futex_wait+0x2a2/0x390 [ 566.674706][T15188] ? __fget_files+0x2a/0x420 [ 566.674722][T15188] ? __fget_files+0x3a0/0x420 [ 566.674738][T15188] __x64_sys_sendmsg+0x1bd/0x2a0 [ 566.674751][T15188] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 566.674769][T15188] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 566.674782][T15188] do_syscall_64+0x174/0x580 [ 566.674794][T15188] ? trace_irq_disable+0x3b/0x140 [ 566.674812][T15188] ? clear_bhb_loop+0x40/0x90 [ 566.674826][T15188] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 566.674840][T15188] RIP: 0033:0x7f0a3139ce59 [ 566.674853][T15188] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 566.674863][T15188] RSP: 002b:00007f0a322b4028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 566.674877][T15188] RAX: ffffffffffffffda RBX: 00007f0a31615fa0 RCX: 00007f0a3139ce59 [ 566.674886][T15188] RDX: 00000000240408c1 RSI: 0000200000000080 RDI: 0000000000000008 [ 566.674895][T15188] RBP: 00007f0a31432d6f R08: 0000000000000000 R09: 0000000000000000 [ 566.674904][T15188] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 566.674912][T15188] R13: 00007f0a31616038 R14: 00007f0a31615fa0 R15: 00007f0a3173fa48 [ 566.674925][T15188]