last executing test programs: 7.536018479s ago: executing program 4 (id=1557): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000600)=@newsa={0x1a0, 0x10, 0x1, 0x0, 0x0, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x64}, {@in, 0x0, 0x32}, @in=@local, {}, {0xfffffffffffffffd, 0x0, 0x8000000, 0x200}, {0x0, 0x0, 0x2}, 0x0, 0x0, 0x2, 0x0, 0x0, 0xcd}, [@algo_crypt={0x48, 0x2, {{'cbc(aes)\x00'}}}, @replay_esn_val={0x1c, 0x17, {0x0, 0x0, 0x0, 0x0, 0x70bd28}}, @algo_auth_trunc={0x4c, 0x14, {{'cmac(aes)\x00'}, 0x0, 0x18}}]}, 0x1a0}}, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) set_mempolicy(0x3, &(0x7f0000000000)=0x4000000ffb, 0x8) r2 = syz_open_dev$dri(&(0x7f0000000080), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000000)={0x80, 0x4, 0xd8f9}) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x4, 0x11, r2, 0x100000) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x3000003, 0x4031, 0xffffffffffffffff, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) getsockname$packet(r3, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) r5 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r5, 0x107, 0xf, &(0x7f0000000040)=0x56c, 0x4) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000040)={'bridge0\x00', 0x0}) sendto$packet(r5, &(0x7f0000000080)="09000000e700140000007e7bfbf788a83baa9900d6f18f8e950088a800dd8600", 0x20, 0x24040011, &(0x7f0000000300)={0x11, 0x8100, r7, 0x1, 0x8, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1c}}, 0x14) sendmsg$nl_route(r3, &(0x7f0000000940)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000900)={&(0x7f0000000c00)=ANY=[@ANYBLOB="60020000110000012bbd7000fcdbdf2507000000bbfee1aa73a6ed3131fbc7e3254d0cee328d870e46899c2dac5270f7c35c1160ffe798fe7cde62976972b2e583f525ecc6c5fd7ffeba7c361671a208719c1f42b850eaef878e24a795e00305b496b67310a2d10a98b80f5929272311133e5b5f7b659142fc34c02e6045f3534420c8471ee576fa77e593f4a71190e30704658c1bda32ec2c2d96078c577721275fcced4688", @ANYRES32=r7, @ANYBLOB="0080000002000000380216803c00018018000c8014000100413abf3c8f0e00000800000088a8000010000a00000000000600000000000000100006000300000007000000060000000c0101801000020003000000080a0000090000002800010001000080ffffffffffff00000000000000000000000000000000000000000000000000002c000c801400010008000000300800000500000088a8000014000100100000005b0f000004000000c180000040000c8014000100030000005d0d00000300000088a80000140001000600000069090000690700008100000014000100090000001b04000000000000810000000c00070001000000ffffffff10000a00f884000001000000000000002800010008000000aaaaaaaaaaaa000000000000000000000000000000000000000000000000000010000b00af0200000600000000000000100006000600000000000000790f00009000018028000100e50d00000180c200000200000000000000000000000000000000000000000000000000000c00090003000000ffffff7f0c00040001800000070000000c000700200000000d0000000c00040007000000020000000c000500000000000600000010000b0008000000f8ffffffffffffff0c00070000fc1f008cb973050c000500020000007f000000480001800c00070000000000ffffff7f10000b008906000001000000000000000c0005000e280000f7ffffff100006000600000051030000050000000c00070008000000020000001400018010000a0040000000080000000000000008001f0007000000"], 0x260}, 0x1, 0x0, 0x0, 0x4040}, 0x4001) ioctl$XFS_IOC_PATH_TO_FSHANDLE(r5, 0xc01c5868, &(0x7f0000000440)={r6, &(0x7f0000000340)='\xaa\xaa\xaa\xaa\xaa', 0x1240, &(0x7f0000000380)={@align=0x4, {0x8001, 0x5, 0x1ff, 0x28}}, 0x1be9, &(0x7f00000003c0)={@_ha_fsid}, &(0x7f0000000400)=0xa7}) execveat(r8, &(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)={[&(0x7f00000004c0)='\x00', &(0x7f0000000500)='\xaa\xaa\xaa\xaa\xaa']}, &(0x7f0000000b80)={[&(0x7f0000000980)='\x00', &(0x7f00000009c0)='-)]:\x00', &(0x7f0000000a00)='!-(*$\x00', &(0x7f0000000a40)='\x00', &(0x7f0000000a80)='{\x00', &(0x7f0000000ac0)='/dev/iommu\x00', &(0x7f0000000b00)='\\\x00', &(0x7f0000000b40)='\xff\xff\xff\xff\xff\xff']}, 0x400) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r4, @ANYRES16=r1], 0x3c}}, 0x40000) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="500000001000030500000000fcffffff00000000", @ANYRES32=0x0, @ANYBLOB="0815010021100000280012800b00010069703667726500001800028014000700fc010000007194abdce3000000000000000000000108000a00", @ANYRES32=r4, @ANYBLOB], 0x50}, 0x1, 0x0, 0x0, 0x800}, 0x4000) openat$iommufd(0xffffff9c, &(0x7f0000000100), 0x10c00, 0x0) ioctl$TUNSETIFINDEX(r8, 0x400454da, &(0x7f0000000bc0)) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000140)={0xc}) openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) r9 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000200), 0xc00) preadv(r9, &(0x7f0000001c00)=[{&(0x7f0000001740)=""/165, 0xa5}], 0x1, 0x0, 0x1) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r10, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r10, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x50, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x10}, @NFTA_SET_DESC={0xc, 0x9, 0x0, 0x1, [@NFTA_SET_DESC_SIZE={0x8, 0x1, 0x1, 0x0, 0x81}]}]}, @NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x3}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, "d103"}]}]}]}]}, @NFT_MSG_NEWTABLE={0x14, 0x0, 0xa, 0x5, 0x0, 0x0, {0xa, 0x0, 0x4}}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xcc}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) 7.316585906s ago: executing program 0 (id=1558): bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x94) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_buf(r0, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000002000000000000210d0000aaa8fa017242ba9380d440fe0000000000002900000002000000", 0xfe60) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001680)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x40003}, 0x4040850) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000700000a4c000000030a0fdb00000000000000000a0020050900030073797a30000000000900010073797a31000000001400048008000240e7b140bb08000140000000030a000700726f75746500000014000000110001"], 0x74}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000854) r2 = socket(0xa, 0x3, 0x87) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000380)={'ipvlan0\x00', 0x0}) ioctl$sock_inet6_SIOCSIFADDR(r2, 0x8916, &(0x7f0000000000)={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x78, r3}) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='net\x00') r5 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) r6 = fcntl$dupfd(r5, 0x0, r5) write$tun(r6, &(0x7f00000000c0)=ANY=[@ANYBLOB="635a0b4200a4060000000000000000000000000000000000ff0100000000000000000000000000018706040302100200ff020000000000000000000000000001fc0200000000000000000000000000000000000000000000000000000000000033010000000000000502f055c20400000eac0000000000003300000d000000002b02000000000000c204000000080502000201050000000000000000000000000000000000000000000000000000000a00004e2200004e240000000000000004000000010000000400000001"], 0xcc) fchdir(r4) r7 = userfaultfd(0x801) ioctl$UFFDIO_API(r7, 0xc018aa3f, &(0x7f0000000100)) ioctl$UFFDIO_REGISTER(r7, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x5}) exit(0xffff) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) madvise(&(0x7f0000664000/0x1000)=nil, 0x1000, 0x9) pivot_root(&(0x7f0000000340)='.\x00', &(0x7f0000000180)='.\x00') ioctl$sock_inet6_tcp_SIOCINQ(r2, 0x8936, &(0x7f0000000000)) r8 = socket(0x2, 0x6, 0xfd) sendmsg$inet6(r8, &(0x7f0000001c00)={&(0x7f0000000000)={0xa, 0xa, 0x7, @mcast2}, 0x1c, &(0x7f00000004c0)=[{&(0x7f0000000040)="671723d7c6012c", 0x7}, {&(0x7f0000000140)="9e91d93a92dc7c8fff658bb539e2a1485d4c9223a7dfe538a2e2fea2", 0x1c}, {&(0x7f0000000200)='\x00\x00\x00\x00\x00', 0x5}, {&(0x7f00000001c0)='+', 0x1}, {&(0x7f0000000180)="41add6", 0x3}], 0x5}, 0x20008b88) 7.10198978s ago: executing program 4 (id=1559): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000680)=ANY=[@ANYBLOB="12010000cf8bed20d90f21004029000000010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000580)={0x44, &(0x7f0000000380)=ANY=[@ANYBLOB="201101"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000007c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(sm4)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000340)="b7f2288a911993f08d3aaea2bc0000de", 0x10) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000280)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb09587", 0x4b}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819", 0x15}], 0x2}], 0x1, 0x40800) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r3 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) ioctl$I2C_RDWR(r3, 0x707, &(0x7f0000000200)={&(0x7f0000000180)=[{0x8a, 0x1000, 0x0, 0x0}], 0x1}) syz_usb_control_io(r0, 0x0, 0x0) 6.365640634s ago: executing program 4 (id=1562): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2c000}, 0x895) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002000), 0x2, 0x0) close(0x3) syz_open_dev$sg(&(0x7f0000000080), 0xf9ba, 0x14b082) read$FUSE(r0, 0x0, 0x300) write$FUSE_DIRENT(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="30007b25ca6600007b41a3a4df4fda0ae70b65878eb970cc467b0a942edf42450a312895d560"], 0x30) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) syz_emit_ethernet(0x5e, &(0x7f0000000140)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x10}, @val={@val={0x88a8, 0x6, 0x1}, {0x8100, 0x4, 0x1, 0x3}}, {@canfd={0xd, {{0x2, 0x0, 0x1, 0x1}, 0x2f, 0x2, 0x0, 0x0, "b56faf36fe307957b3d2872562c30761bb246541c8195079ca04f74667d65c27bdeb76188ab942e580fca127e663e21198244e2ea18791860c841caffbcc9b9f"}}}}, &(0x7f0000000200)={0x1, 0x4, [0xa1, 0x3d9, 0x1eb, 0xd1b]}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f0000001340)=[{{&(0x7f0000000240)=@l2={0x1f, 0x0, @fixed}, 0x80, 0x0, 0x0, &(0x7f0000000680)=""/10, 0xa}, 0x53}, {{&(0x7f00000006c0)=@caif=@util, 0x80, &(0x7f0000000a00)=[{&(0x7f0000000740)=""/1, 0x1}, {&(0x7f0000000780)=""/201, 0xc9}, {&(0x7f0000000880)=""/79, 0x4f}, {&(0x7f0000000ac0)=""/219, 0xdb}], 0x4}, 0x7}, {{&(0x7f0000000a40)=@pptp={0x18, 0x2, {0x0, @multicast1}}, 0x80, &(0x7f0000001200), 0x0, &(0x7f0000001280)=""/137, 0x89}, 0x3}], 0x3, 0x2122, 0x0) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/timer_list\x00', 0x0, 0x0) sendfile(r1, r3, 0x0, 0x800) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r4 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) ioctl$SCSI_IOCTL_GET_PCI(r4, 0x5393, &(0x7f0000000000)) io_setup(0x9, &(0x7f00000000c0)=0x0) r6 = socket$unix(0x1, 0x5, 0x0) io_submit(r5, 0x1, &(0x7f0000000040)=[&(0x7f0000001500)={0x0, 0x0, 0x0, 0x1, 0x0, r6, 0x0}]) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x9, 0x0, 0x0, 0xfffffffffffffffe, 0x7ffd, 0xffffffff}, 0x0) r7 = syz_open_dev$tty1(0xc, 0x4, 0x1) r8 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r8) ptrace$pokeuser(0x6, r8, 0xd0, 0x6) sched_getattr(r8, &(0x7f0000000080)={0x38}, 0x38, 0x0) r9 = dup(r7) write$UHID_INPUT(r9, &(0x7f0000004000)={0xf, {"a2e3ad21ed0d09f91b50090987f70906d038e7ff7fc6e5539b0d3d0e8b089b33396d63060890e0878f0e1ac6e7049b334a959b669a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5d31070b07580936cd3b78130daa61d8e8040000005802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383701d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce7cd9f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d4ac01b75d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b6080000007a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40427db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb06ffc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afa2d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02daee67918e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7340002000000000000f288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4108b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb15da202d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c6b00000000000000f96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f9000", 0xfffffffffffffe59}}, 0xfa) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) sync() 6.158652069s ago: executing program 0 (id=1563): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="1900000004000000040001000000000000000000", @ANYRES32=0x1, @ANYBLOB="f1ffffff00"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000180), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000100)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}}, 0x0, 0x0, 0x0) umount2(&(0x7f0000000080)='./file0\x00', 0xc) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000180)={r0, &(0x7f0000000100), &(0x7f0000000000)=""/8, 0x2}, 0x20) openat$tun(0xffffff9c, &(0x7f00000000c0), 0x208000, 0x0) socket$inet(0x2, 0x1, 0x0) mq_open(&(0x7f0000000080)='eth0\x00#~\x02\x00\x00\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfd\x05\x00\x00\x00\x00\x00\x80\x00\t/\x8dv\xb8\x93\xc3C\xae\x9dc\xd1T\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94uu_\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88\x9e0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc7\x8avs\xb2\a\xfe\xb3j*\xad\x18A\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x05\x00\x00\x000\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\x9b}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xce\x00\x00\x00\xe8\vq+\xbb\xc7\xaf\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1J\xec\x926\xb5a0\xa0B\xae|', 0x40, 0x120, 0x0) r2 = socket(0x10, 0x70730f31850c93d2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001180)={&(0x7f0000000240)=@newqdisc={0x3c, 0x24, 0x3fe3aa0262d8c583, 0x70bd2b, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}, {0x6, 0x10}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0xc, 0x8002, [@TCA_FQ_PIE_FLOWS={0x8, 0x2, 0x5}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24000000}, 0x4000040) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000002880), 0xffffffffffffffff) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r4, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r5 = socket(0x10, 0x80002, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[], 0x64}, 0x1, 0x0, 0x0, 0x4004001}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=ANY=[], 0x3c}, 0x1, 0x0, 0x0, 0x10}, 0x4c851) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) sendmmsg$alg(r5, &(0x7f00000000c0), 0x492492492492627, 0x0) r6 = socket$inet6(0xa, 0x3, 0x7) connect$inet6(r6, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r6, 0x29, 0x23, &(0x7f0000000340)={{{@in6=@dev={0xfe, 0x80, '\x00', 0x1e}, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x20}, {0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x4, 0x2}, {0x0, 0x0, 0xfffffffffffffff7, 0x4}, 0x0, 0x6e6bb9, 0x1}, {{@in=@broadcast, 0xfffffffc, 0x6c}, 0x0, @in=@empty, 0x0, 0x0, 0x2, 0x7, 0x200}}, 0xe8) sendmsg$nl_xfrm(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000600)=ANY=[@ANYBLOB="fc000000160033060000000000000080ff0100000000000000000000000000017f00000100000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ffffffff0000e7ffffffffffffff0000000004d23200000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000500000000000000ffffffffffffffff0000000000000000050000000000000004000000020000000000000006000000020000000a000418190000000c0015005c07350001000000"], 0xfc}}, 0x0) 5.38851241s ago: executing program 4 (id=1566): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r2, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xd, 0xf}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r5 = openat$tun(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) close(r5) socket$unix(0x1, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) r6 = socket$kcm(0x11, 0x3, 0x0) r7 = socket(0x400000000010, 0x3, 0x0) r8 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000009b40)=@newtfilter={0xe8c, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r9, {0x1, 0x4}, {}, {0x8}}, [@filter_kind_options=@f_matchall={{0xd}, {0xe58, 0x2, [@TCA_MATCHALL_ACT={0xe54, 0x2, [@m_pedit={0xe50, 0x1, 0x0, 0x0, {{0xa}, {0xe24, 0x2, 0x0, 0x1, [@TCA_PEDIT_PARMS={0xe20, 0x2, {{{0x2, 0x9, 0x2, 0x6}, 0x1, 0xfb}, [{0x2, 0x9c, 0x81, 0x6, 0x2, 0x7}, {0x1, 0x6, 0x4, 0x3, 0xfffffffd, 0x81}, {0x1, 0x80000001, 0x8, 0x101, 0x3}, {0x3, 0x9, 0x0, 0x7, 0x5, 0x4}, {0xf, 0x7, 0x9, 0x51, 0x8}, {0x3, 0x4, 0xc, 0x101, 0x3, 0x84b5}, {0x9c, 0x4, 0x9, 0x2, 0x487, 0x8}, {0x1, 0x10000, 0x5, 0x4, 0x3, 0x8000}, {0x7, 0x9, 0x1ff, 0x8, 0x2, 0x7fff}, {0x439356e7, 0x609, 0x16, 0x0, 0x10000, 0x6}, {0x5, 0x3, 0x8, 0x3, 0x0, 0xffffffff}, {0x5, 0x0, 0x7, 0x7, 0x8, 0x5}, {0x5, 0x8, 0x9, 0x5, 0xfffff000, 0x7}, {0x768d, 0xcd, 0x8, 0x7, 0x5, 0x9}, {0x1, 0xfffffffb, 0x6, 0x5, 0x7ff, 0x6}, {0xfffffffb, 0x3, 0xfffffffe, 0x6, 0x2}, {0xfffff9fd, 0x9, 0xa5f, 0xa, 0x5, 0x2}, {0xffff997c, 0x9, 0x167, 0x2, 0x71, 0xa2}, {0x5, 0x2, 0xc, 0x8, 0x9, 0x60}, {0x5, 0xa, 0x2, 0x4, 0x3, 0x2000}, {0x32d, 0x8, 0x7fff, 0x4, 0x8, 0x9}, {0x8, 0x200, 0x58fe, 0x7ff, 0x4, 0x3}, {0x101, 0xd, 0x101, 0x1, 0x3, 0x8}, {0x0, 0x3, 0x1ff, 0x7437ec78, 0x2, 0x9}, {0xffffffff, 0x1, 0x9, 0x0, 0x1, 0x4}, {0xc, 0xe, 0x0, 0x3, 0x8, 0x81}, {0x3, 0x3, 0x6, 0xe, 0x0, 0x80}, {0xd, 0x0, 0x7ff, 0x0, 0x80000000, 0x2}, {0x4, 0xb, 0x6c5f1878, 0x57c4, 0x8, 0x25ff}, {0x4, 0xd, 0x1fadd976, 0x3071, 0x0, 0x1}, {0x5, 0x800, 0x3, 0x3, 0x3, 0x9}, {0x9, 0x1ff, 0x81, 0x9c, 0x1, 0x5}, {0x9, 0xd76, 0x6, 0xdc2, 0xa16a, 0x2}, {0x1ff, 0x5, 0x7, 0x2, 0x2, 0x1}, {0x1, 0x32158140, 0x0, 0x8, 0x6, 0x7}, {0xe, 0x4, 0x9000, 0x5, 0x2, 0x7f}, {0x3, 0x2ec74d53, 0x0, 0x0, 0x8, 0x2}, {0x5, 0xfff, 0xffffff13, 0x6, 0x2, 0x6}, {0x1, 0x6, 0x3, 0x4, 0xffb, 0x9}, {0x6, 0x6, 0x1ff, 0x8, 0x7ff, 0x8001}, {0x4, 0xffffffff, 0x0, 0xfffff740, 0x4, 0x4}, {0xffff, 0x5, 0x7, 0xac, 0xf}, {0x5, 0x3, 0x6, 0x1000, 0xd8fe, 0x8001}, {0xd, 0x3, 0x80000000, 0x0, 0xffffff81, 0x7ff}, {0xfffffffb, 0x2, 0x1ff, 0xf9, 0xffff8001}, {0x0, 0x6, 0x8000, 0x9, 0x500, 0x7}, {0x1, 0xffffffff, 0x834, 0x7, 0x0, 0x3}, {0x7fff, 0x6, 0x0, 0x2, 0x2, 0x8}, {0xf61, 0x101, 0x9, 0x2, 0x80000000, 0x7fff}, {0xc7, 0x1, 0xad, 0x2, 0xffff, 0x20000000}, {0x0, 0x5, 0x1, 0xffff, 0x3, 0x3}, {0x8, 0x10001, 0x9f98, 0x1, 0x8, 0x66a}, {0xfff, 0x6, 0x8, 0x80000001, 0x0, 0x7f}, {0x8, 0x6, 0x7f, 0x5, 0x3, 0xb}, {0x4, 0x4b, 0x0, 0x1, 0x7f, 0x7fffffff}, {0xfff, 0x47e4, 0x1, 0x0, 0x80000001, 0x9}, {0x3, 0x9, 0x7, 0x6, 0x3e6b7592, 0xe5}, {0x9, 0x9, 0x1, 0x9, 0x0, 0x2}, {0x8, 0x80000001, 0x7fff, 0xb2d9, 0xfffffffe, 0x8}, {0x80000001, 0x9, 0x5202, 0x2, 0x53ce, 0x3}, {0xffffff81, 0x7, 0x8, 0x8, 0x7f, 0x80000000}, {0xfffffff9, 0x9, 0x6, 0x6, 0x9, 0x3}, {0xfffffffd, 0x8, 0x6, 0x5, 0x3, 0x8f}, {0x741, 0x0, 0x9, 0x7fffffff, 0x2, 0x200}, {0x401, 0x2, 0x8, 0x6, 0x4, 0xc6e9}, {0x1, 0x2d73, 0x3ff, 0x5, 0x9f17, 0xffffff7f}, {0x2, 0x401, 0x2b00, 0xfffff57b, 0xfffffc00, 0xd}, {0x3, 0x4, 0xc52b, 0x9, 0x5, 0xff}, {0x0, 0x4, 0x401, 0x0, 0x1, 0x9}, {0x8, 0x4, 0x1, 0x2, 0x10, 0x1}, {0xff, 0x8, 0x6, 0x5, 0xff, 0x5}, {0x2, 0xb15ce2d, 0x80000001, 0xbeab, 0x8, 0x5}, {0x3, 0x8, 0x3, 0x7, 0x8, 0x4}, {0xfff, 0x9, 0x6, 0x3, 0x100, 0x57}, {0x9, 0x5, 0x4, 0x3, 0xa, 0x2}, {0xb3, 0xe, 0x3, 0x8000, 0x7, 0x9}, {0xff, 0x7, 0x5, 0x10001, 0x6, 0x6}, {0x2, 0x8f, 0x9, 0xffffff46, 0x4, 0x80000000}, {0x9, 0x2, 0xfffffffc, 0x1, 0xd50, 0x3}, {0xd203, 0x7, 0x1, 0x10000, 0x43, 0x1ff}, {0x4, 0x3ff, 0xffffffff, 0x1, 0x5, 0x100}, {0x1ff, 0x3, 0x7ff, 0xfffffff8, 0x1ff, 0xfffffffc}, {0x7, 0x9, 0x3ff, 0x1, 0x7, 0x4}, {0x0, 0x6, 0x0, 0x9, 0xffff0001, 0xcca}, {0x7, 0x1, 0xfffffff1, 0x3ff, 0x100, 0x4}, {0x3, 0x9, 0x0, 0xed4, 0x4, 0x6}, {0x9, 0x7, 0x8001, 0x7, 0x7, 0x2}, {0x3, 0xfff, 0x9, 0x5, 0xb5, 0x3}, {0x0, 0x1, 0x1, 0x5, 0xffffff01, 0xfff}, {0x7, 0x5, 0x2, 0x2, 0x0, 0xfffff9de}, {0x5, 0xffffffff, 0xe6b, 0xb, 0xb, 0x4}, {0x1d, 0xffffff10, 0x1, 0x2, 0xff, 0x52e2}, {0x0, 0x9, 0x0, 0x7, 0xdb, 0x5}, {0x7, 0x2, 0x9, 0x8, 0xa, 0x100}, {0x81, 0x4, 0x988, 0x0, 0x0, 0x7}, {0xdc03, 0x7, 0x402c, 0xffff, 0xfffffff9, 0x4}, {0xa, 0xfffffffe, 0x1, 0x1ff, 0x1ff, 0xc1b5}, {0xa24b, 0x947d, 0x40, 0x4, 0x80000000, 0x2}, {0x9, 0x401, 0xa89, 0x5ef, 0x9, 0x8}, {0x4, 0x7fff, 0x0, 0x4, 0x7fffffff}, {0x3, 0xb8c, 0x6, 0x21761f6a, 0x1, 0x6}, {0xfff, 0xda, 0x1f, 0x4, 0x8, 0x2}, {0x8, 0x10, 0x0, 0x0, 0xfffffff7, 0x43}, {0xfffff000, 0x8, 0xe96, 0x9, 0x9, 0x34b0}, {0x4, 0x8, 0x8, 0x3, 0x6cf4, 0x1}, {0x3, 0x3, 0x7, 0x4, 0xbe, 0x81}, {0x4, 0x800, 0x0, 0x5, 0x8, 0xfa2f}, {0x3, 0x8d, 0x81, 0x2, 0x8, 0x6}, {0x9, 0x2, 0x6, 0x4, 0xf, 0x5}, {0x100, 0x1, 0x2, 0xffffffff, 0x9, 0x74}, {0x4, 0x4, 0x8, 0x1, 0x0, 0x3}, {0xfffffff8, 0x7, 0xffffffff, 0x62f, 0x401, 0x30564e0}, {0x9a2f, 0x800, 0x8, 0x7, 0x7}, {0x20000006, 0x2, 0x800, 0x200, 0x9, 0x3}, {0x7, 0x6, 0x8936, 0xdcb, 0x0, 0x2}, {0x6, 0x80000000, 0x8, 0xe, 0xfffffffa, 0x8de3}, {0x0, 0x9, 0x8, 0xfff, 0x6, 0x1ff}, {0x8195, 0x2, 0x1000}, {0x1, 0x5, 0xff, 0x9e0f, 0x5, 0x6}, {0x7fff, 0x6, 0x0, 0x5, 0x8000, 0x3}, {0x7ff, 0x9, 0xa, 0x6, 0x7, 0xe77}, {0x1, 0x5e12, 0x3, 0xfffffffa, 0x2, 0x80000001}, {0xffffff8c, 0x2, 0x1, 0x1, 0x10, 0x5}, {0x4, 0x7, 0x4, 0x78d, 0xffffcff9, 0x9}, {0x1, 0xe, 0x7, 0x2, 0x2, 0x207f}, {0x10, 0x5, 0xfffffffa, 0xff, 0x80000, 0xfff}, {0x1, 0x7ff, 0x696e, 0xa, 0x49d, 0xb}, {0x9bf4, 0x0, 0x5, 0x3, 0x3, 0x1000}], [{0x1, 0x1}, {0x2}, {0x5}, {0x2}, {0x2, 0x745e81639ff0f356}, {0x4}, {0x5}, {0x3, 0x1}, {0x3}, {0x2}, {0x3}, {0x4, 0x1}, {0x0, 0x1}, {0x2}, {0x2}, {}, {0x3, 0x1}, {0x0, 0x1}, {0x0, 0x1}, {0x5, 0x1}, {0x3, 0x1}, {0x1}, {0x2, 0x1}, {0x2}, {0x3, 0x1}, {0x2}, {0x5}, {0x2}, {0x1, 0x1}, {0x1}, {0x1, 0x1}, {0x5}, {0x4}, {0x5, 0x1}, {0x5, 0x1}, {}, {0x4, 0x1}, {0x3}, {0x4, 0x1}, {0x1, 0x1}, {0x5}, {0xa}, {0x3}, {0x3}, {0x2, 0x1}, {0x3}, {0x4, 0x1}, {0x2, 0x1}, {0x0, 0x1}, {0x0, 0x1}, {}, {0x4}, {0x4, 0x1}, {0x4}, {0x4}, {0x2, 0x1}, {0x2, 0x1}, {0x5, 0x3}, {0x4, 0x1}, {0x1}, {0x4}, {0x0, 0x1}, {0x2}, {0x1, 0x1}, {0x3, 0x1}, {0x5}, {0x3, 0x1}, {0x1, 0x1}, {0x5, 0x1}, {0x0, 0x1}, {0x4, 0x1}, {0x3, 0x1}, {0x0, 0x1}, {0x0, 0x1}, {0x3}, {0x6}, {0xa}, {0x3, 0x1}, {}, {0x2, 0x1}, {0x1}, {0x4}, {0x5}, {0x3}, {0x3, 0x1}, {0x4}, {0x0, 0x1}, {0x5, 0x1}, {0x6}, {0x2}, {0xb82e57098c7a44ef}, {0x3, 0x1}, {0x1}, {0x0, 0x1}, {0x5}, {0x1, 0x1}, {0x5}, {0x0, 0x1}, {0x4}, {0x4}, {0x0, 0x1}, {0x2}, {0x4, 0x1}, {0x1, 0x1}, {0x1, 0x1}, {0x2}, {0x3}, {0x1, 0x1}, {}, {0x4}, {0x3}, {0x3}, {0x1}, {0x5}, {0x3, 0x1}, {0x4}, {0x3, 0x1}, {0x0, 0x1}, {0x1}, {0x4, 0x1}, {0x1}, {0x5, 0x1}, {0x4}, {0x0, 0x1}, {0x3}, {0x1}, {0x0, 0x1}, {0x4}], 0x1}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}]}]}}]}, 0xe8c}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$kcm(r6, &(0x7f0000002900)={&(0x7f0000000500)=@xdp={0x2c, 0x8, r4, 0x10c}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000380)="da", 0x1}], 0x1}, 0x4000880) 5.21302913s ago: executing program 3 (id=1568): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x30, 0x40, 0x1, 0x7fffc, 0x25dfdbfe, {0x1}, [@nested={0x4, 0x47}, @nested={0x10, 0x1, 0x0, 0x1, [@nested={0xc, 0x10, 0x0, 0x1, [@typed={0x8, 0x2, 0x0, 0x0, @pid}]}]}, @typed={0x8, 0x2, 0x0, 0x0, @fd}]}, 0x30}, 0x1, 0x0, 0x0, 0x400c801}, 0x4008094) 5.192784912s ago: executing program 0 (id=1569): keyctl$clear(0x3, 0xfffffffffffffffd) add_key$keyring(&(0x7f0000000040), 0x0, 0x0, 0x0, 0xfffffffffffffffb) 5.120546257s ago: executing program 4 (id=1570): r0 = open(&(0x7f0000000280)='.\x00', 0x80, 0x122) fcntl$notify(r0, 0x402, 0x8000003d) ioctl$VIDIOC_UNSUBSCRIBE_EVENT(r0, 0x4020565b, &(0x7f0000000000)={0x3, 0x7, 0x1}) r1 = inotify_init1(0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x1, 0x0, 0x0, 0x4ee59ce4, 0xfffffffffffffffe, 0xfffffffc}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_STATS_CPU(r4, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000140)={&(0x7f0000000040)={0x14, 0x4, 0x1, 0x801, 0x0, 0x0, {0x3, 0x0, 0x6}, ["", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x20000081}, 0x2004c800) r5 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) r6 = fsmount(r5, 0x1, 0x0) fchdir(r6) r7 = open(&(0x7f0000000040)='./file1\x00', 0x80242, 0x0) write$FUSE_CREATE_OPEN(r7, &(0x7f0000000180)={0xa0, 0xfffffffffffffff5, 0x0, {{0x4, 0x1, 0x5, 0x6, 0x3, 0x1, {0x1, 0x180, 0xff, 0x5, 0x100, 0x7cf4, 0x9, 0x7ffffffd, 0xfffffffe, 0x8000, 0x0, 0xee00, 0x0, 0x3ff, 0x1}}, {0x0, 0x11}}}, 0xa0) sendfile(r7, r7, &(0x7f0000000080)=0x2, 0x7f03) inotify_add_watch(r1, &(0x7f00000001c0)='./file0\x00', 0x4000064f) open(&(0x7f00000000c0)='./file0\x00', 0x400000, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0xc000, 0x103) r8 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001180), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000080), 0x0, &(0x7f00000010c0)={{'fd', 0x3d, r8}, 0x2c, {'rootmode', 0x3d, 0x8000}}) syz_fuse_handle_req(r8, &(0x7f00000062c0)="23db5037805f177d136115e6a1a5903469af39c1fb9cb38215fe64cff9f2f0444a57e22b0cc5cb4f74c9792365400d9e1c68539ea5eff0a5ed0864814d39251bee8dfea69aa052d900bc0c792e1c9752b7d3a3222f6a1ad3e44c1f65617b128aea51911861ca36ba7c96b96b2fba0fdaa49ffb2612f3e81fe565327dd9965a60046442c9dcd0d552c6a00388be3b438a08883c7349761531880294ad9887db97d8c2f74921c57910cf1f5cc528e17bd5c3746b6202f26d621535aac5f7872c2cb3295e42524b5acb249b2d1ac1b53a4e31271decfca3fad2e2f740768adf00875c18cb7d115150f83ceb73f77a1f61f1666c2bb9f6bd9f0fb55b3a619446e32bae2a1d99aa49e5f3822e048f8be44b707f2db10d7916ec9a10a695d573d871cf24959c3d15e61344a68309d186956537c6ea8532fc2e1c7649f8409d8dcde4c8ee1530470ac9c870f9f1837574e444ba6addf5ddb2dec67c0e76df79f265b403818dddb4efc27c90985ed69a48b12056e548f9c99edf80d2b195d26acb1127661727a0600257f4b2546513d03930a0638a71bd3223e51fbb75c832ef737907f2f4d3f0505f431ea02783c798b5c4579c99961fb73dc623a0d99c1b306435464d413b537d42c6444851b36482597140b22fbc0ebc7e795b2f96739bf139f5823bc869ede547da4f394fa1b1787836095e1013264042e53d5006ea059d0488cb2f5ccd44b30d25ea53c2dda71d112d7d441dbfc9f8462c99c098b1958c80b237d83c32f2759c9a9c081d7d7666a477cfda59354309b09f2a8b9f6c3077b0df1e8d0c71ac07232de4f437107cb0eb9b47b2267efe31938a337cf11cadad72ced56895bb14763cca5bdadd245d801e829a1eb3bb4ed851a345918efd2dcf8d38f66badc773068e6a2ef59b2bb838abd8b043cf6ac54550f3fde1bbb9e761095e4b8ef1891757d376be1f778142610c0acbbfc697f51fbb7a1602ed46e82813c74f41ee2bae818174809f3692084bea7310ebec3d6166702ae62aad84313e19b4d145167185ea8d53cb21d099fb592d7d7f8bc305dd375b5c0cd73be44f49ff53cee220085d4706bbf50c6f63b02e7e805e8fa4c73046a57a8700886da29ea53e5a316e7b011c44a0f7be5cc5cb5641ba0069ff591eee18966c7f005ef40046a5fe2bf325b2545b009867761264aa9611d184fa372ba3c5c33d9a50717210f7cec7f6dc4418a87a797eb6aaf6ab3892bd3f559547c88d8c29646c8173fad1588f52beb34ff863be65e7ec1598cfb465f270bd5532fa7035aae077eedbc846058fa19f58ffb1cf0f1863f6d33f2e5c454d18b66be766ca369af2cc9656fa34c6c10e4d4da44ce5e2370aaf60c4e130da331d3489e8f44c600246323409fdd35d11da27128c9d64be65dd3a90c1546a6eb9185cb6d3a4a9cfad0e41ea03896fd2346f745eb3563d7a79fd345b037c040e56f0677840bf9b0d295bcfa98b931464c5ce9fcaf745720deac2d8b4edeffc0fe6f089ed7c3880959fcf8e31f7b7054bc4f5c9d3ed3f66c968d0bc20b2d66c374f030f3f1965f43a98519e527caf693362412d523eeb38c8b016ff77f78f833d7513e4b5a53d5ed5143916673f822ceac9967b8788bc6428283181eaf8d99e48286aacf4f658a903e9f08659450f7f9483807c2e013a1d9d199f18886a8cb4e14d41c71e5731455a4394551281eca12a1bb6ae717f5da2949175d0f1f3d718b761dfc1099c7d9d8928c899ac8e936e69d19fcbfcfdee83b68ef8e15eed41a8ac0d54aa92d7d2ee58bb4799f378225ec9ba4709e5ce2b77208ecc85c22c64967a9ef3360c54d311b8917ceb7b432c90cc5e98de9327c1400f8ec89261b1d77d8874b0bbdd2c5eb59df415705de52b08b0e12c07fb7367c6d461c19f282d51e482cb4fb9ceb0249ac2d6400ca170fbd6c0063224179c616bb030a5c10102aa2eea92f1e6f5828590b250b09e6d1a9535c298a68160b7c281fecdd295dc3396c4e6eb3395d5a677d5fa95a732dfdef81f4346545dd1a74bb3aa9b516699bdf0a59165077ab459a5ffe0dbb3ef8afa7a8382a8441e0c36ffabbed8f93f4bbeb97e5f6a704bf63a0de9ccf8fef643ebc530a80920931002003b027014de317c42f861d98ef4fef66d232d9706e6bd263347384dadadaa43a7e106bbb21bd822d468ace171b3f04b996112135b63dcbd612b5888ec40da583ab549c340ddaf5d7406c3e99322c68874214356c1fd9b5f84348e629cc3487a901d1b7a2fa531b1509ac1c93de3da9f1c3773e3a2aba2b29d2419f240ae6d24ed9f14bf0b9b0f1e740a2db06dab64d6386f950bff4e4c94160ef4b832bbde3af4937b7528658b5c16a51cb22193fe99385721ce5b048d9338e289dcb40683140c413eca52c8e4b64b306f47569477379c864cfb3aa3e349262407d3935ab9a0916eb0f6db2be71a7eb8f9968dfac44995d5bff8ef617fceeaa448f5e5f8d4b39e3512fe7ae9ee1d8a0d5912b6148969ab0325f3f76e2340fbd67ce156bdf638140b3ccdb08e5049db15957915cb05db8901249b10c59cc5c3ff836290e3334eee2df387e44c57b4d6198c3749f5dc57f6c3de115ced6b43cbddd762b58f1fb40b2baf3b381febdc073142e30d2e9a1a69e8d86314221e540f195509d223b206173dc5406865d8064817c30c284c034035a63190ab86df3bae4168c58e01d2251748fd5d9d610024129e83a5730fe83cf0918790e6854ab765c78649b91c06655f0cb9e26d8432df78bbadd99583b6a8afcf177ed6f339e08c0b36a16c6d31d8a24cb6f2bc3ba58d7711b6f8b988dc3e3144be619548457d4f40509f17eeb186cb93a2928ecb951593d1907c8bbb9f4c8999caba3059c8e73dce54ad6f87bcd51d559f7759902b14e68d3b845c0b179b38f4e6f0bd3a89cbcd5ebed9972102048647da1eda5c8456442369f4ae871d4037ba26f27d27371ce57e23adca5af8dc93f934f2ef8d69ad3b2db66657b3868dd839c2b522f5461f24407ef091b77242fc70a48b7eec45f3bcbcfbc6bdc36e4b67295020a345233a32a0a0af4d03a53ef67e69716d5ae35342722afbe7558946475a9ebf5b39c18558a0011f68bc8a78590b0cb63618379a512790c42d94bb239dd3ef5b8d1036cf0391aded8802a7a447c38f231ae611aeeab9bba44cd14369473758b64108d0bc9b6bc9e9b497c2d1d2acbae7c620a55c226cf371331688eaddec61fe961c5fcef71dad45820ed0ac8dc7641d82150f1318ac15aa41e7be585b6a50da1b3cd95239ee61cfde15aba80ae8ebc21ba4540883c6f44cd35b6b97da4640c97f5a2b6efa8d184fec823abc754ab8a0db6c45c2293e90d9c154c4a3e0b9ec2b6113ce6583b80f0d234dec9a9815067244733e2134b9ba93bb9692fb44200bb5501bb109f2401e8baaf0115d795bb0346dfafaf953bed8e9a52a5b9b02d490c55fd89daf311ad5e08b070a9571f696d6df4715c8b69b840e4e03d6f361326e20d9546c47b3a63163e7df9bd260621358c166177ee7c69ed63a8c43dd4a78543aa9f922c0ef527f4aa61ff65bb14595f518412ce25a1e103df89cd4b363593da16c11d80a23a9b5ad8e3a7be8f697cecf82c8fbd889a4f743c839b67f7ba5453b10bbf59b1e4f4e821872c061a4125c0c15c1ca5164efe61a58bb54dcedc849800a6021a448d4660c3b85e2362b7cd8ce95156fbf408a09a30a8ccfc3554004e9f9a35382907eec00617e2ae1f8803146bc8c28b4f3bf3c6b183ae9248e7f05c4adce3e0b7ff29252b5be9b19431e3fe612d471f52c5c34cc12c83049189f4d2e5ca516df78766ba3449d07ef9436c68052c986d9dde8802c931194e2ce34acb8cc26663a09348b15c6c145d26306bded0d1f482803ae6dee26562b03fcb183b69ee4a0491e8776ecdadfca395cb4eac2948d4d64321a4e669f2f663eb54f05f12ed9c685835c3e79f982152dbe701073b9a4ab2932b46ee2424a5e18bbe5f25ce0b898ff6937927f4670defe430ac86021226ae055daf39b535cdc0899fcc99d15e67d66bd2dd89bb21b8d2689a8af10a1b0bd44103c469922c36fc0228d7b6febf5e366dceecf8bb1db385c8ab95d86ff09b76c2fa6282de81fd6864c495a4c8295df61a2548e1b81c3e3f30d7a41216801d6c2d1743f66ae2055756083e8bf403d436b8244ac214f4d84a693d13f299ba267401d094f2df70840e8a980622794212f0992ecf5a47980ab2cf7d5a6f12b0a489af3c3c847ac59bc89f36fbb0e08bf283b68213a17de38b3a45eade6f0b198def408f7711c16367bcc0ded794a9a323c7e7f07fad96ea9c4d7344c26e43844a27c21076b8d7cd07677602d91eac825eb5fd0631755c2dd1dbf7bce3eb3c3f7377fc6080ecd0b894e29769845725943e25932d4249abb4ab78d4e2ff2e2df42c8d884cd6bd13886cef080c6491c217abae0eec6e9d4d49eab6657f15cfd38e6cd6d0bd33198c4685ab302d0f46e42f4a5d5bb7d2840a0a8817b98a856700d4de74351896fe7d7d5a0d1bc57fb4c828aa51f9637807aeb905780f239527ed4affd83f68be8b7ad1e10d9e797ba39cdee24f7be0a0ab0ac22ea3968dac61eb4bdd522c9ce570edf63a439abfd9954bf6a16c88d86157d05477200a83255cde279b454979cee4de00e81cb44acdc4295c877566a749ab5b91d250f03d46ecc14210c196700338eea028c930ce104f20a9e7fabb0ad1d314ec1a2d97d1d1b9e09114dee0e3e513eacede01971ff85dc98634156073df4e8acd6c3aadd615adaffa7a81573813bc4ca21886ddd532021bba5c84b34c34665534db48d61903a03c1cca4ed955ca92c1e33b7664b494e3db6d1e637a49e537808a2669ebeca301691acd4fab0af197b9c7db01b7862466b568ab3a4712a25210264fb297a6b679dfc3fceb65bddd1a23d5b507a0d6da83d73b716d971c5179a92e57b9b93451eb943845a549de737f2d082a83682c32649b4941e787758ead9d2c256b2b4ed1e0255952ce83cccecc39e5bbdd38490f1960b26e5379943be3d9a64b5149c84d577e5fd099560baa292befa06ce9065fb03ed432a9e055ca4ad0e952f8368b3d230fd5239726f79f4c98a0b4a9648382b245d324cb61049562f765f923fc657ef36747658494d78590a1e27a2d09856acf50c3b26271c6d5aa96e8ff9bdb9043859665e21ea53a050c335cac414bbf27b0328ac2c7450acb26b093bf232358afd1135ee50ac3fb26b5f0256ccdd37033c8a59740607cfd549d4c6540afe4a6b4425ae1f633872dcfb5da8d0547cf0c4888817b71fbc7c45b2a641e9c1a76b6a6be124402422ada35edc02ed997d6b87b361aee95a16d2c528d89a52fe40dfd83434969bd86f02e63fc1ae72941209af39a08cfbb4c320bc47d853f5dbaf0cd60ec54608aadbc382fa6b5cab3e9cac57bea26609f4c79f6a6b4eb4a9336fa95783b0c0c366f36d5d6b8310b3cfdb800207919a131bc7f984f7fa11fd0bf2c89e060e9d1286e453fe97363ef72bd6eba29a85ffeccdc3bee72e12284333a5a40622c01619558d2750fc45abfa22059ebdf743f8e50ad29770d19f84d8a34232d6918514769b3bb2a1ea5e59e9556332ba669675764458e9349a1835c501a93e91dd3b31018979880a9913f54ec1e8526b8cffcb776b97fbb9424faa5c5eb60d2ac74955bba4b5182571d0d9f84f0df1baa722b20a78c9c0011c667f688b58489c9e450d83e40ac5eb41c5564b6d76a226448abe4a3f499927074125aa9c0e7e704c36df5bb110a0f15f8433a470e81db414827d5ce21ca1da1c8d51d746d1e1ca110127c15e92afd75d3cd05ce0b632cfa03745de3cdd4b57373d46676583c89f045c26c6fc5793e5489555ced08f83ba351135834a2028113c319af30cc85bc01a7f8208822d7d607aed0d2e12c80aa009100441b75beaccfe0adbda7e8bb870edf4963158794c8c3a5baacf6eec7b5efaefb7602dab8409d161beeb281cba21f1da0ccdc092d0433fb940d79699ffeb87ea775829a6e7e3b308a2ee0b7aec8ac5f35eed61be374c7c77196f7119a8882deff68230f461cb917b0ccb2b8597efcbdd1003b7b77b2c601ebd4b45c35b8426f7b9138ab3df0ec00819604ab8e1e64cf2aa2282b1269585af127a268cd207f964edff172e555398a16df44bdc52889538c3a27f8fbfffb61f7aeb55b259952bbfea81d73058d8b0f78ece9dc08e660437d21d4e3ec38b19e5afda7a6e33023f9158db8a1c14dabd9b8b307ddc66927f7b19df5e0da2237d98ddd890b81f1963808977d02198e8ae2e97419dbb1f8e51cad36a3424b955500fbdaab6ff8dbf028708b1f951fe43864b59b6c2368b816c98023d4480a91b3f1059e9c214bf55a7f8c7da907f79ff5568fd787d3aa022ab9d03cde551f7e3295f02c4f3aa37e4cebdd968c0f82f09eb004fbdb1a4ef3a0d426691bde3964c29ea65622f5d3ffd854053545ba1ec164495e4bef4845439c058f9438d13be7922b656db499c246ee6176a15b97e6a68e42f0c703033b699504e1f92b43054c7237199bd013d96faab47433b6b3f91dc66368706439d4ef7da3942ce8b9c1c9a9d0643fc4540e7d3f1c3821267e866cacd3e904be9f9df80381eec09eb2b0d745ff03ffb199b917a14fdd8fbfbffe8bfb0cf7023aa7183301a8a41e7097ff9f5247f8b78f7d08bbfc596a81047807cf0929677222e7e9e921b294e04088c3746d8dc19294645f1c093a21b4c5e6d92e54dd90465b11dd5d9d42af849070edff4ec63970f4088daaa33afdebb28d01df5ee043a8150ab1b25d864ef31e20c84696596cfbea92d02ea29c4a3933c41ec68aee7d68d7eea7f30d8920e14e62be42bcf856d7a58f46fdb2438b023e974f77281c5a462553627e9614504cbd3f1cae6e0fd9f7e89d9bce48946d0508616fbe542303dc542982c61d7bb4afbf3e76bf1fb2381cdc99f2175ef944dcd826aabdca2b7678db5262733c69ce504c38e7deb7adfb9b6d8bb00d8e4251e0438417ea615cde58bd76c2427b3d7a0578bbbff9fde2abbc5d60307aff0050b18176158aaedb34e283886378ff798b4f74e0a0c95d64271f1916280dd247304d9201c67f5e2640d9706add8703cac81795a0190107e2bb2941ed13738595da1c86ba0f68e2283a435cb5f162c74071a13dfe2266d05abaef080dd6b1dade115e883e04f0bb4be4d91f535ae6f822b02e814e65d2b7807d199a23d3f26209f6c9f93602a3a93ccfdebb5f8161b7928059674e15820d1848a980c8d1af5a73aadc5c402fbb6e730ba51227913ca27f0d78d331d6325d0a7926c238296b2a22b10a69cdffeb087dfe175511ed8e2cde8d7dae140e4ce92f892b129d9940e4a30b19f822ef7611b8750eaea8e55502604b7d2358c09a217af8be6c86d67cf6ff6130c971c9765d56631fe6224fbe1e833d497b534fbf6b030af93691f59295279aa1bdfb5d5d9d4668d5aea70e2b8fc117df0042e91c7e6225f27329727ed6e14a87c7943c040dfee4e5c06a20251c39a45ab4865951b0daefb9c05571fdcc21d1761945bd2b8047ccedd6f1e708646fbe61e75bb2728e8cee893d7e6f642119e786155a6cbab057d6d83b77716145119e974ad7355179d2adc3d748fa249cb58e32e6791d646240c05da4427b2f359976c8fd1486c604cb7ee647e24633d8fca8314cf1f85110ca6351156a2b26e44b040f7d2810acd36f45a3969c1fafd1a7e0bc14fd9b26593375be8e750c3f6534ffb85904d15d75fba05dac4a673de97f7543ee931724cd35474cd7ff5cf3e8abaf206f3030e92895633fa9d8499ea763601560260109dad18bd64b990531fc5377e6eaa5da050b98e1c6515ea48c7de1a15b63283d4a694cbad379356bfdac50e6c343879e29f6b9ab425600d51f257ceb35d0ca00f83cf5bd734223de716747614666ba1f1a8fa756e5f3ff0fc94fa4bd4073bddb0098cf565ee40af5732ee9218d262e5b64ad6b8118c54eeaf7072f2e15514a401779b425fa89d8abb1750e56cc3108dffdcf2d3fd86b8af4560d56f7ff0702154211f9949e3992d93e66892b297fa2d4bfe18de3fd74e96c9d30eb14fd458fdbc9e9a34e00f3280dd732520147fa2a8fa83e91dd0687501466a300015bf888c03fc08190c2753d7719acf6f84885c4c5642f466c1984f15a7716a9b608ee5f1b395726bcc8519766667d24d11e396e62ea39640c9e73e4e9e9e5076d7019ca1bebbd7097807f46b3b6fcb96ed4b433b25ec551fb176a5fa252ed1d81b0350cfdfb8069c9916495bef3a262b6668910896c0b37eee40547c663a901e92f41b417ac50e88d058d021a8f9a5783bd936cca4962bec1c9886689cc547970f9215232596392515182e563f720bb79d29baaabf0e2697de6500bc677e346847011ee3450358c0b16ca528368b5cbb8df5ab974a3cef072d20c9906fa585e0f3083ec6d8507b8561f64e65aa1aecf825fc47ad1459c87771549fd5c9a9cc094e7b1179ee1e90eff7158f28f59f029d90e708f4ec50b4f67d8b4bb7140065528354a7e25d63e92977183a0284ec22aa923210f0bfea89cca53547137381e5de0f60bc484bc2daf129b0380244f1ed4bfb674eb2791e76dce33cae684ad36620d5d67cb587f840caed316b7439b0e8c3de0e065e62680f3997369be3466670278168c9a1a644d870e3a8d0a79b2b720e8c3c51bb9133532beee64319e98714bb2e6d5c0b723962d923b0ef454361d4b3cb470bf8c39031ed4a75267f499741be15aacac92d8e6afdcb01a2e7d2dbf549ceb2a2108c4079c620f05ca1bd31d631c2c8d35ca0d73155f56ed020c25e389db356edf510ae088d11b5e4fed51d0dce4d3aa04924b09c28200ede5bec1a8f38cc5f081055e0f28d75afc4d588ca0e828d00085d150beafdda17b8df9e7d9218ea7d81f2e076412901c5ae04d6929d717fea2fcc8e5a1e69dbd7b5258799a2fa5eb108b6cc35dfab599fb27e6d75f1030b83f452af8137830337141f031942eba83123d3f87b5f01623d4613e5a44b4952c300baf3d4d3dbbfb0ad024a19b3810a174ef8453d85a25822f66e45eba2490f29de1077683ccc32e3517f88b51e010672a982f7c8591450c9ab1573143aefb61c17ebb0c92dcb0494d116b970c2a827a6b3608ae10d583d1f7d092263fa873de9f31cd59bc9491ff012059b63a9120af89477f2ccc34eee7bd66de60af64730c879128b49d31da6400c2471e0d5abf707e560574b477b8e20ca45d92182d639eb434e14aea1a3f91ad8fb60e4859b77389753990513181ea3a82884235e8520294359435cfba220502b591fc28ac36ec697442657d290bd7aad7fce53a3f1766f2bf7d55c24d7c0e9c7a71d6f1282ea1478e0a36378b50e4fee281f686bc53f50138036e2a5d6199d40caff084fde7b63b3c0a47da0791107c3218330f7c2e2c7609aba202fae5290243b6033379eb15edc572eee452008e04c9b53efd5f3d88327317b38934745bc3de4c55bd818febc7a7953bf03c4029f77177c2a974310f0485aa46252f1000dc71934947287c38ea5854f29c7b82f630afb8caf1fd880670307b155a6e7feddc019cfbbbdc18f3bc03da3bd371d93ccbf56bcb39eea55c2d113efc148127c30089d21ce6a5088dbfbcf8f8d75c19456bc962c371548634a95382acb5a0886efc46a87bdc111dc0d1e54084cea0d58054f00762c91d7fe0f0fbcf4c280f29f9cd5999a5e8c6f507f8080d7c7ea9a8685be50722cf1a082f3728dec8d6152cdc72f8da6b1805643c042f4f6780ba79cc8a2165d9d7acec8ab2f421bc3e77b51c62c4bbb262b5674ea7d2dcf9acb894d050e91b052364322a5b08bd9667249571c004fb495da7e24fc5620adda3af6848ccf238911a52bdbff766e4e279ac274afa2c2302faba25b5fe98d972a04aa13f77c0c05d7dd82b0a19f1ded8cf5f99c80e392b0aab1264a29e9fbcf0b69f6b0a9f2332e09ab74dea7277106d0883bb264e279c67e5bc69009225bf4fd1a8532f9392a011b55a73a7cf8d16a59d695b2a65b57fad64a2041f8c28804ee1a48845c5dab757d04f1d95520aa9ddb69904d6529c0e14bd789dfe37067073b3e0e136ae2aebb1c34c55b94ce942f786be4b45f801f35f7c768d91a460b92ffa57ff675f0b4b00437a07f871a8650f21b2bf7c722c1d9e860e8955fef5699ee53a5f6fe46fb9e5e17a1c69fe2538af4718b7215ad2c00c3d420589a8653ee511b809945451fb8205b19ce377c8d0253b05493c557cf2bd8ef208e8fc01beceea1acca38d025f328f28d69bcfaa3adc6d9573a3832dc3f3c758fe08cf9cd0c32acfddae81b3682869e8aa9725b64336252aeb2ee8eb78f0721aa3158217a3009948adb297c5ea45ec26cb6d963c7be47ee1b93fa136ebe73a21936df0148fa311206f8bca2e80719aeca8745ff74ddaad5182644762c66333f942d9a93c467d5f9fd5d0dbbe57480362d4bb0f760294f4eba3e1b08047d256dbda157635d21a43aff3a71f6ad574b402bb36e5270d7ed082c6fbae07771721513ae9ddb22d23b00733046c898ee6ac05ef8a51ce41919e1f241cb98e0592ace68214620ba1a748ef81131661f58f1635713ca2873e150a3e848c8d2ebd039769fda112b73050efa4d1c35dbb46ca5a7b7ccbed1dcded36af272f6838b4c1e7e6778e7e9ca3d794f275d49c9e32e768097349118d2337e7c031ada38d0cc5c04c286ff93083f6d58d73a821118c93432fda9a8c76fa2cbcc093a7decac8e4f001ecc9f67faf1c2f102120f0618469cf653bbd5fcefd4ef2bae86dc4f5393b840f9f47140cf7f46a186c21878a43612a71d3b540b9994f010ab623f878264cf46c7366d0bec5d43d481b47846091fd3cda73a9a28ceb7f839eca695c9f084a16c812475f6575ef2368c88cc6655f47663ef69ce4779fe3ccc4dd85a07a9e4c6f39f42690d231f5727f45c247a53fd8df029fcefda4f328658435892519c17205a3c715ad6bb7387d09a5e387c83f008daf626f5977c66203af1143ef7b59ccd8e3c17bb156bca317861f0b9f222ea63c044075a3a74beaf05c23d0a75caa60397d831bbe507234fff154960faf0f02776d3f9038c955bf0c1ec9c92523cf0b855c18d6ac3b35d437796420ba3dfd581dc6adac64315c1cb1a2c3a45ec4655bb2bd6e0b4a3082281ed0697a213d1d93142e96b4fd57431d2f4547451d008ab58bcd9765ccf3ca3297becd5de9e2be0263cfca09935c9334b5e687bc7e7057dc2ed03873be22200c9fe32a9497dd00a336cf4c723ead302340b5cd1fef8cd88330a9089fc93af4ef739295b94407b291bf33f4f39c936736e1166106428f8796a4b92805f4dfcf46d8692b54e40a9e8584c0eaac4caada87bb33f553eafeef5051b889402176ab766936a38ddd7e5205d2c87e133a02e84ab24ba2d889a4c4db8cbe18b271455e84da716f4a32acdbc0a5aaba25a2ec757c73847dd1c4ccb2967c651e5257692a4553dde227846bfe2977021805f46a287c835ea8dc5", 0x2000, &(0x7f00000015c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={0x10, 0xffffffffffffffda, 0x3ff, {0x0, 0xb}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) write$FUSE_INIT(r8, &(0x7f0000000180)={0x50, 0x0, 0x0, {0x7, 0x2b, 0xffffffde, 0x3000400c, 0x0, 0xfffe, 0x2, 0xfffffffe, 0x0, 0x0, 0x100, 0x100}}, 0x50) rename(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00') bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="0300000004000000040000000a00000000000000", @ANYRES32, @ANYBLOB="00000000000000000089241f0000000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x50) 5.037140722s ago: executing program 0 (id=1571): socket$kcm(0xa, 0x3, 0x3a) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000a00000a98000000060a0b040000000000000000020000006c000480680001800a000100696e6e65720000005800028008000240000000840800034000000007080004400000000f0800014000000000340005800c0001007061626c6f61640024000280080004400000005608000340000000b9080001400000000a08000240000000000900010073797a3000000000090002"], 0xc0}, 0x1, 0x0, 0x0, 0x4}, 0x0) r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030010000b05d25a806c8c6394f90324fc60100003000a000200053582c137153e3704020180fc5409000c00", 0x33fe0}], 0x1}, 0x0) socket$kcm(0x29, 0x7, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f00000002c0)={0x0, 0x4a, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYRES32=r1], 0x24}, 0x1, 0x0, 0x0, 0x48000}, 0x0) r4 = socket$inet6(0xa, 0x1, 0x84) setsockopt$sock_linger(r4, 0x1, 0xd, &(0x7f0000000180)={0x1, 0xffffffff}, 0x8) close(r4) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000001e40)=[{{&(0x7f0000000100)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @private1}}}, 0x80, &(0x7f00000008c0)=[{&(0x7f0000001e80)=""/108, 0x6c}, {&(0x7f0000000380)=""/109, 0x6d}, {&(0x7f0000000400)=""/105, 0x69}, {&(0x7f0000000580)=""/132, 0x84}, {&(0x7f0000000640)=""/90, 0x5a}, {&(0x7f00000006c0)=""/126, 0x7e}, {&(0x7f0000000740)=""/4, 0x4}, {&(0x7f0000000780)=""/8, 0x8}, {&(0x7f00000007c0)=""/83, 0x53}, {&(0x7f0000000880)=""/63, 0x3f}], 0xa, &(0x7f0000000940)=""/213, 0xd5}, 0x81}, {{&(0x7f0000000a40)=@sco, 0x80, &(0x7f0000001d80)=[{0xfffffffffffffffe}, {&(0x7f0000000ac0)=""/102, 0x66}, {&(0x7f0000000b40)=""/87, 0x57}, {&(0x7f0000000bc0)=""/252, 0xfc}, {&(0x7f0000000cc0)=""/32, 0x20}, {&(0x7f0000000d00)=""/28, 0x1c}, {&(0x7f0000000d40)}, {&(0x7f0000000d80)=""/4096, 0x1000}], 0x8, &(0x7f0000001dc0)=""/97, 0x61}, 0x8}], 0x2, 0x10125, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x8, 0x8001, 0x0, 0x9, 0x9, 0xfffffe0000000001, 0x892, 0xffffffff}, 0x0) ioctl$sock_SIOCGIFVLAN_SET_VLAN_NAME_TYPE_CMD(r1, 0x8982, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) r6 = syz_open_dev$vbi(&(0x7f0000000040), 0x0, 0x2) ioctl$VIDIOC_CREATE_BUFS(r6, 0xc100565c, &(0x7f0000000480)={0x1ff, 0x1ff, 0x2, {0xe, @meta={0x48505356, 0x4fb40133, 0xc83e, 0x1843, 0x2f2b835d}}, 0x9}) getpgrp(0x0) socket$igmp(0x2, 0x3, 0x2) syz_genetlink_get_family_id$wireguard(&(0x7f0000000840), r5) ioctl$VIDIOC_SUBDEV_ENUM_DV_TIMINGS(r6, 0xc0945662, &(0x7f00000001c0)={0x10001, 0x0, '\x00', {0x0, @bt={0xfffffffb, 0x1, 0x1, 0x1, 0xa, 0x3, 0x1ff, 0x80, 0x9, 0x1, 0x8001, 0xa68bc933, 0x10, 0x5, 0x7, 0x0, {0x43, 0x5}, 0x7, 0x4}}}) sendmsg$WG_CMD_GET_DEVICE(0xffffffffffffffff, 0x0, 0x0) set_mempolicy(0xc005, 0x0, 0x5) mkdirat(0xffffffffffffffff, 0x0, 0x3f6) read$FUSE(0xffffffffffffffff, 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x1d, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x4, 0x43, 0x7fff0000}]}) 5.022103655s ago: executing program 3 (id=1572): keyctl$clear(0x3, 0xfffffffffffffffd) r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f00000e1000/0x800000)=nil, 0x800000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x40000000) openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_clone3(&(0x7f0000000380)={0xb030d000, &(0x7f0000000000), &(0x7f0000000080), &(0x7f00000000c0)=0x0, {0x2d}, &(0x7f00000001c0)=""/159, 0x9f, &(0x7f0000000280)=""/173, &(0x7f0000000340)=[r0], 0x1}, 0x58) r2 = syz_pidfd_open(r1, 0x0) wait4(r0, 0x0, 0x2, 0x0) ioctl$FS_IOC_GETVERSION(r2, 0xc040ff0b, &(0x7f0000000180)) add_key$keyring(&(0x7f0000000040), 0x0, 0x0, 0x0, 0xfffffffffffffffb) ioctl$XFS_IOC_FSBULKSTAT(r2, 0xc0105865, &(0x7f00000005c0)={&(0x7f0000000100), 0x7, &(0x7f0000000400)=[{}, {}], &(0x7f0000000580)}) 4.295143199s ago: executing program 2 (id=1573): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) bind$netlink(r1, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfd, 0x400}, 0xc) getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r0, 0x0, 0x80) sendmsg$nl_route(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x200e3}, [@IFLA_MASTER={0x8, 0xa, r2}, @IFLA_GROUP={0x8}]}, 0x30}}, 0x0) (fail_nth: 2) 3.751889567s ago: executing program 3 (id=1574): madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000140), 0x802, 0x0) ioctl$SNDCTL_DSP_SETTRIGGER(r0, 0x40045010, &(0x7f0000000000)) (async) ioctl$SNDCTL_DSP_SETFRAGMENT(r0, 0xc004500a, &(0x7f0000001400)) (async) openat$rdma_cm(0xffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) writev(r0, &(0x7f0000000640)=[{&(0x7f00000006c0)="2e31b69c9bd4beb2ce56518bf0aea548722f054677edd0cb67e2afb987c3e16e3b65bfe50c4d55086a56832bebeb32802ecd8e61032995b891d24c782afea345ed2f0a87bc1bfc6101fa7d1d2c2e57f889dbb28fe7b7e2fc562acebfd86566be11c267f5c5c5e1707a44f2795400fb26cd4170d76c6807d8270435f365d737751f", 0x81}], 0x1) (async) ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0) (async) r1 = shmget$private(0x0, 0x800000, 0x200, &(0x7f0000800000/0x800000)=nil) shmat(r1, &(0x7f0000000000/0x4000)=nil, 0xbbdccba4532b503b) syz_clone(0x668c7400, 0x0, 0x0, 0x0, 0x0, 0x0) munmap(&(0x7f0000c32000/0x3000)=nil, 0x3000) 3.751472421s ago: executing program 2 (id=1575): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000600)=@newsa={0x1a0, 0x10, 0x1, 0x0, 0x0, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x64}, {@in, 0x0, 0x32}, @in=@local, {}, {0xfffffffffffffffd, 0x0, 0x8000000, 0x200}, {0x0, 0x0, 0x2}, 0x0, 0x0, 0x2, 0x0, 0x0, 0xcd}, [@algo_crypt={0x48, 0x2, {{'cbc(aes)\x00'}}}, @replay_esn_val={0x1c, 0x17, {0x0, 0x0, 0x0, 0x0, 0x70bd28}}, @algo_auth_trunc={0x4c, 0x14, {{'cmac(aes)\x00'}, 0x0, 0x18}}]}, 0x1a0}}, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) set_mempolicy(0x3, &(0x7f0000000000)=0x4000000ffb, 0x8) r2 = syz_open_dev$dri(&(0x7f0000000080), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000000)={0x80, 0x4, 0xd8f9}) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x4, 0x11, r2, 0x100000) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x3000003, 0x4031, 0xffffffffffffffff, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) getsockname$packet(r3, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) r5 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r5, 0x107, 0xf, 0x0, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000040)={'bridge0\x00', 0x0}) sendto$packet(r5, &(0x7f0000000080)="09000000e700140000007e7bfbf788a83baa9900d6f18f8e950088a800dd8600", 0x20, 0x24040011, &(0x7f0000000300)={0x11, 0x8100, r7, 0x1, 0x8, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1c}}, 0x14) sendmsg$nl_route(r3, &(0x7f0000000940)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000900)={&(0x7f0000000c00)=ANY=[@ANYBLOB="60020000110000012bbd7000fcdbdf2507000000bbfee1aa73a6ed3131fbc7e3254d0cee328d870e46899c2dac5270f7c35c1160ffe798fe7cde62976972b2e583f525ecc6c5fd7ffeba7c361671a208719c1f42b850eaef878e24a795e00305b496b67310a2d10a98b80f5929272311133e5b5f7b659142fc34c02e6045f3534420c8471ee576fa77e593f4a71190e30704658c1bda32ec2c2d96078c577721275fcced4688", @ANYRES32=r7, @ANYBLOB="0080000002000000380216803c00018018000c8014000100413abf3c8f0e00000800000088a8000010000a00000000000600000000000000100006000300000007000000060000000c0101801000020003000000080a0000090000002800010001000080ffffffffffff00000000000000000000000000000000000000000000000000002c000c801400010008000000300800000500000088a8000014000100100000005b0f000004000000c180000040000c8014000100030000005d0d00000300000088a80000140001000600000069090000690700008100000014000100090000001b04000000000000810000000c00070001000000ffffffff10000a00f884000001000000000000002800010008000000aaaaaaaaaaaa000000000000000000000000000000000000000000000000000010000b00af0200000600000000000000100006000600000000000000790f00009000018028000100e50d00000180c200000200000000000000000000000000000000000000000000000000000c00090003000000ffffff7f0c00040001800000070000000c000700200000000d0000000c00040007000000020000000c000500000000000600000010000b0008000000f8ffffffffffffff0c00070000fc1f008cb973050c000500020000007f000000480001800c00070000000000ffffff7f10000b008906000001000000000000000c0005000e280000f7ffffff100006000600000051030000050000000c00070008000000020000001400018010000a0040000000080000000000000008001f0007000000"], 0x260}, 0x1, 0x0, 0x0, 0x4040}, 0x4001) ioctl$XFS_IOC_PATH_TO_FSHANDLE(r5, 0xc01c5868, &(0x7f0000000440)={r6, &(0x7f0000000340)='\xaa\xaa\xaa\xaa\xaa', 0x1240, &(0x7f0000000380)={@align=0x4, {0x8001, 0x5, 0x1ff, 0x28}}, 0x1be9, &(0x7f00000003c0)={@_ha_fsid}, &(0x7f0000000400)=0xa7}) execveat(r8, &(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)={[&(0x7f00000004c0)='\x00', &(0x7f0000000500)='\xaa\xaa\xaa\xaa\xaa']}, &(0x7f0000000b80)={[&(0x7f0000000980)='\x00', &(0x7f00000009c0)='-)]:\x00', &(0x7f0000000a00)='!-(*$\x00', &(0x7f0000000a40)='\x00', &(0x7f0000000a80)='{\x00', &(0x7f0000000ac0)='/dev/iommu\x00', &(0x7f0000000b00)='\\\x00', &(0x7f0000000b40)='\xff\xff\xff\xff\xff\xff']}, 0x400) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r4, @ANYRES16=r1], 0x3c}}, 0x40000) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="500000001000030500000000fcffffff00000000", @ANYRES32=0x0, @ANYBLOB="0815010021100000280012800b00010069703667726500001800028014000700fc010000007194abdce3000000000000000000000108000a00", @ANYRES32=r4, @ANYBLOB], 0x50}, 0x1, 0x0, 0x0, 0x800}, 0x4000) openat$iommufd(0xffffff9c, &(0x7f0000000100), 0x10c00, 0x0) ioctl$TUNSETIFINDEX(r8, 0x400454da, &(0x7f0000000bc0)) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000140)={0xc}) openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) r9 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000200), 0xc00) preadv(r9, &(0x7f0000001c00)=[{&(0x7f0000001740)=""/165, 0xa5}], 0x1, 0x0, 0x1) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r10, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r10, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x50, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x10}, @NFTA_SET_DESC={0xc, 0x9, 0x0, 0x1, [@NFTA_SET_DESC_SIZE={0x8, 0x1, 0x1, 0x0, 0x81}]}]}, @NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x3}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, "d103"}]}]}]}]}, @NFT_MSG_NEWTABLE={0x14, 0x0, 0xa, 0x5, 0x0, 0x0, {0xa, 0x0, 0x4}}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xcc}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) 3.654157145s ago: executing program 0 (id=1576): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b000000000000000000000000800000000008"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x1, 0x13, &(0x7f0000000140)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x10}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x21, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r1, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b800000500000000", &(0x7f0000000300)=""/8, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r3) getsockname$packet(r3, &(0x7f0000000240)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x40) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000300)=@newlink={0x44, 0x10, 0x501, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, r4, 0x6001, 0x110}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @ipip={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_IPTUN_TOS={0x5, 0x5, 0x3}, @IFLA_IPTUN_REMOTE={0x8, 0x3, @dev={0xac, 0x14, 0x14, 0x36}}]}}}]}, 0x44}}, 0x84000) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x25dfdbfe, {0x0, 0x0, 0x0, r4, 0x12e1b, 0x1a001}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipip={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_REMOTE={0x8, 0x3, @multicast2}]}}}]}, 0x3c}}, 0x20004000) 3.495660175s ago: executing program 0 (id=1577): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) r2 = syz_usb_connect(0x2, 0x3f, &(0x7f00000001c0)=ANY=[@ANYBLOB="1201000016038308c5109a8146e40102230109022d0001000000000904000003030000000905be3b"], 0x0) syz_usb_control_io(r2, 0x0, &(0x7f0000000bc0)={0x84, &(0x7f0000000600)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r2, 0x0, &(0x7f0000000680)={0x84, &(0x7f0000000280)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac3(r2, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r2, 0x0, 0x0) syz_usb_control_io$lan78xx(r2, 0x0, 0x0) syz_usb_control_io$printer(r2, 0x0, 0x0) syz_usb_control_io$uac1(r2, 0x0, &(0x7f0000000980)={0x24, &(0x7f0000000700)=ANY=[@ANYBLOB="000b05000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r2, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_EVENTS(0xffffffffffffffff, 0x84, 0xb, &(0x7f0000000040), &(0x7f0000000080)=0x3) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xd, 0xf}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r6 = openat$tun(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) close(r6) socket$unix(0x1, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) r7 = socket$kcm(0x11, 0x3, 0x0) r8 = socket(0x400000000010, 0x3, 0x0) r9 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000009b40)=@newtfilter={0xe8c, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r10, {0x1, 0x4}, {}, {0x8}}, [@filter_kind_options=@f_matchall={{0xd}, {0xe58, 0x2, [@TCA_MATCHALL_ACT={0xe54, 0x2, [@m_pedit={0xe50, 0x1, 0x0, 0x0, {{0xa}, {0xe24, 0x2, 0x0, 0x1, [@TCA_PEDIT_PARMS={0xe20, 0x2, {{{0x2, 0x9, 0x2, 0x6}, 0x1, 0xfb}, [{0x2, 0x9c, 0x81, 0x6, 0x2, 0x7}, {0x1, 0x6, 0x4, 0x3, 0xfffffffd, 0x81}, {0x1, 0x80000001, 0x8, 0x101, 0x3}, {0x3, 0x9, 0x0, 0x7, 0x5, 0x4}, {0xf, 0x7, 0x9, 0x51, 0x8}, {0x3, 0x4, 0xc, 0x101, 0x3, 0x84b5}, {0x9c, 0x4, 0x9, 0x2, 0x487, 0x8}, {0x1, 0x10000, 0x5, 0x4, 0x3, 0x8000}, {0x7, 0x9, 0x1ff, 0x8, 0x2, 0x7fff}, {0x439356e7, 0x609, 0x16, 0x0, 0x10000, 0x6}, {0x5, 0x3, 0x8, 0x3, 0x0, 0xffffffff}, {0x5, 0x0, 0x7, 0x7, 0x8, 0x5}, {0x5, 0x8, 0x9, 0x5, 0xfffff000, 0x7}, {0x768d, 0xcd, 0x8, 0x7, 0x5, 0x9}, {0x1, 0xfffffffb, 0x6, 0x5, 0x7ff, 0x6}, {0xfffffffb, 0x3, 0xfffffffe, 0x6, 0x2}, {0xfffff9fd, 0x9, 0xa5f, 0xa, 0x5, 0x2}, {0xffff997c, 0x9, 0x167, 0x2, 0x71, 0xa2}, {0x5, 0x2, 0xc, 0x8, 0x9, 0x60}, {0x5, 0xa, 0x2, 0x4, 0x3, 0x2000}, {0x32d, 0x8, 0x7fff, 0x4, 0x8, 0x9}, {0x8, 0x200, 0x58fe, 0x7ff, 0x4, 0x3}, {0x101, 0xd, 0x101, 0x1, 0x3, 0x8}, {0x0, 0x3, 0x1ff, 0x7437ec78, 0x2, 0x9}, {0xffffffff, 0x1, 0x9, 0x0, 0x1, 0x4}, {0xc, 0xe, 0x0, 0x3, 0x8, 0x81}, {0x3, 0x3, 0x6, 0xe, 0x0, 0x80}, {0xd, 0x0, 0x7ff, 0x0, 0x80000000, 0x2}, {0x4, 0xb, 0x6c5f1878, 0x57c4, 0x8, 0x25ff}, {0x4, 0xd, 0x1fadd976, 0x3071, 0x0, 0x1}, {0x5, 0x800, 0x3, 0x3, 0x3, 0x9}, {0x9, 0x1ff, 0x81, 0x9c, 0x1, 0x5}, {0x9, 0xd76, 0x6, 0xdc2, 0xa16a, 0x2}, {0x1ff, 0x5, 0x7, 0x2, 0x2, 0x1}, {0x1, 0x32158140, 0x0, 0x8, 0x6, 0x7}, {0xe, 0x4, 0x9000, 0x5, 0x2, 0x7f}, {0x3, 0x2ec74d53, 0x0, 0x0, 0x8, 0x2}, {0x5, 0xfff, 0xffffff13, 0x6, 0x2, 0x6}, {0x1, 0x6, 0x3, 0x4, 0xffb, 0x9}, {0x6, 0x6, 0x1ff, 0x8, 0x7ff, 0x8001}, {0x4, 0xffffffff, 0x0, 0xfffff740, 0x4, 0x4}, {0xffff, 0x5, 0x7, 0xac, 0xf}, {0x5, 0x3, 0x6, 0x1000, 0xd8fe, 0x8001}, {0xd, 0x3, 0x80000000, 0x0, 0xffffff81, 0x7ff}, {0xfffffffb, 0x2, 0x1ff, 0xf9, 0xffff8001}, {0x0, 0x6, 0x8000, 0x9, 0x500, 0x7}, {0x1, 0xffffffff, 0x834, 0x7, 0x0, 0x3}, {0x7fff, 0x6, 0x0, 0x2, 0x2, 0x8}, {0xf61, 0x101, 0x9, 0x2, 0x80000000, 0x7fff}, {0xc7, 0x1, 0xad, 0x2, 0xffff, 0x20000000}, {0x0, 0x5, 0x1, 0xffff, 0x3, 0x3}, {0x8, 0x10001, 0x9f98, 0x1, 0x8, 0x66a}, {0xfff, 0x6, 0x8, 0x80000001, 0x0, 0x7f}, {0x8, 0x6, 0x7f, 0x5, 0x3, 0xb}, {0x4, 0x4b, 0x0, 0x1, 0x7f, 0x7fffffff}, {0xfff, 0x47e4, 0x1, 0x0, 0x80000001, 0x9}, {0x3, 0x9, 0x7, 0x6, 0x3e6b7592, 0xe5}, {0x9, 0x9, 0x1, 0x9, 0x0, 0x2}, {0x8, 0x80000001, 0x7fff, 0xb2d9, 0xfffffffe, 0x8}, {0x80000001, 0x9, 0x5202, 0x2, 0x53ce, 0x3}, {0xffffff81, 0x7, 0x8, 0x8, 0x7f, 0x80000000}, {0xfffffff9, 0x9, 0x6, 0x6, 0x9, 0x3}, {0xfffffffd, 0x8, 0x6, 0x5, 0x3, 0x8f}, {0x741, 0x0, 0x9, 0x7fffffff, 0x2, 0x200}, {0x401, 0x2, 0x8, 0x6, 0x4, 0xc6e9}, {0x1, 0x2d73, 0x3ff, 0x5, 0x9f17, 0xffffff7f}, {0x2, 0x401, 0x2b00, 0xfffff57b, 0xfffffc00, 0xd}, {0x3, 0x4, 0xc52b, 0x9, 0x5, 0xff}, {0x0, 0x4, 0x401, 0x0, 0x1, 0x9}, {0x8, 0x4, 0x1, 0x2, 0x10, 0x1}, {0xff, 0x8, 0x6, 0x5, 0xff, 0x5}, {0x2, 0xb15ce2d, 0x80000001, 0xbeab, 0x8, 0x5}, {0x3, 0x8, 0x3, 0x7, 0x8, 0x4}, {0xfff, 0x9, 0x6, 0x3, 0x100, 0x57}, {0x9, 0x5, 0x4, 0x3, 0xa, 0x2}, {0xb3, 0xe, 0x3, 0x8000, 0x7, 0x9}, {0xff, 0x7, 0x5, 0x10001, 0x6, 0x6}, {0x2, 0x8f, 0x9, 0xffffff46, 0x4, 0x80000000}, {0x9, 0x2, 0xfffffffc, 0x1, 0xd50, 0x3}, {0xd203, 0x7, 0x1, 0x10000, 0x43, 0x1ff}, {0x4, 0x3ff, 0xffffffff, 0x1, 0x5, 0x100}, {0x1ff, 0x3, 0x7ff, 0xfffffff8, 0x1ff, 0xfffffffc}, {0x7, 0x9, 0x3ff, 0x1, 0x7, 0x4}, {0x0, 0x6, 0x0, 0x9, 0xffff0001, 0xcca}, {0x7, 0x1, 0xfffffff1, 0x3ff, 0x100, 0x4}, {0x3, 0x9, 0x0, 0xed4, 0x4, 0x6}, {0x9, 0x7, 0x8001, 0x7, 0x7, 0x2}, {0x3, 0xfff, 0x9, 0x5, 0xb5, 0x3}, {0x0, 0x1, 0x1, 0x5, 0xffffff01, 0xfff}, {0x7, 0x5, 0x2, 0x2, 0x0, 0xfffff9de}, {0x5, 0xffffffff, 0xe6b, 0xb, 0xb, 0x4}, {0x1d, 0xffffff10, 0x1, 0x2, 0xff, 0x52e2}, {0x0, 0x9, 0x0, 0x7, 0xdb, 0x5}, {0x7, 0x2, 0x9, 0x8, 0xa, 0x100}, {0x81, 0x4, 0x988, 0x0, 0x0, 0x7}, {0xdc03, 0x7, 0x402c, 0xffff, 0xfffffff9, 0x4}, {0xa, 0xfffffffe, 0x1, 0x1ff, 0x1ff, 0xc1b5}, {0xa24b, 0x947d, 0x40, 0x4, 0x80000000, 0x2}, {0x9, 0x401, 0xa89, 0x5ef, 0x9, 0x8}, {0x4, 0x7fff, 0x0, 0x4, 0x7fffffff}, {0x3, 0xb8c, 0x6, 0x21761f6a, 0x1, 0x6}, {0xfff, 0xda, 0x1f, 0x4, 0x8, 0x2}, {0x8, 0x10, 0x0, 0x0, 0xfffffff7, 0x43}, {0xfffff000, 0x8, 0xe96, 0x9, 0x9, 0x34b0}, {0x4, 0x8, 0x8, 0x3, 0x6cf4, 0x1}, {0x3, 0x3, 0x7, 0x4, 0xbe, 0x81}, {0x4, 0x800, 0x0, 0x5, 0x8, 0xfa2f}, {0x3, 0x8d, 0x81, 0x2, 0x8, 0x6}, {0x9, 0x2, 0x6, 0x4, 0xf, 0x5}, {0x100, 0x1, 0x2, 0xffffffff, 0x9, 0x74}, {0x4, 0x4, 0x8, 0x1, 0x0, 0x3}, {0xfffffff8, 0x7, 0xffffffff, 0x62f, 0x401, 0x30564e0}, {0x9a2f, 0x800, 0x8, 0x7, 0x7}, {0x20000006, 0x2, 0x800, 0x200, 0x9, 0x3}, {0x7, 0x6, 0x8936, 0xdcb, 0x0, 0x2}, {0x6, 0x80000000, 0x8, 0xe, 0xfffffffa, 0x8de3}, {0x0, 0x9, 0x8, 0xfff, 0x6, 0x1ff}, {0x8195, 0x2, 0x1000}, {0x1, 0x5, 0xff, 0x9e0f, 0x5, 0x6}, {0x7fff, 0x6, 0x0, 0x5, 0x8000, 0x3}, {0x7ff, 0x9, 0xa, 0x6, 0x7, 0xe77}, {0x1, 0x5e12, 0x3, 0xfffffffa, 0x2, 0x80000001}, {0xffffff8c, 0x2, 0x1, 0x1, 0x10, 0x5}, {0x4, 0x7, 0x4, 0x78d, 0xffffcff9, 0x9}, {0x1, 0xe, 0x7, 0x2, 0x2, 0x207f}, {0x10, 0x5, 0xfffffffa, 0xff, 0x80000, 0xfff}, {0x1, 0x7ff, 0x696e, 0xa, 0x49d, 0xb}, {0x9bf4, 0x0, 0x5, 0x3, 0x3, 0x1000}], [{0x1, 0x1}, {0x2}, {0x5}, {0x2}, {0x2, 0x745e81639ff0f356}, {0x4}, {0x5}, {0x3, 0x1}, {0x3}, {0x2}, {0x3}, {0x4, 0x1}, {0x0, 0x1}, {0x2}, {0x2}, {}, {0x3, 0x1}, {0x0, 0x1}, {0x0, 0x1}, {0x5, 0x1}, {0x3, 0x1}, {0x1}, {0x2, 0x1}, {0x2}, {0x3, 0x1}, {0x2}, {0x5}, {0x2}, {0x1, 0x1}, {0x1}, {0x1, 0x1}, {0x5}, {0x4}, {0x5, 0x1}, {0x5, 0x1}, {}, {0x4, 0x1}, {0x3}, {0x4, 0x1}, {0x1, 0x1}, {0x5}, {0xa}, {0x3}, {0x3}, {0x2, 0x1}, {0x3}, {0x4, 0x1}, {0x2, 0x1}, {0x0, 0x1}, {0x0, 0x1}, {}, {0x4}, {0x4, 0x1}, {0x4}, {0x4}, {0x2, 0x1}, {0x2, 0x1}, {0x5, 0x3}, {0x4, 0x1}, {0x1}, {0x4}, {0x0, 0x1}, {0x2}, {0x1, 0x1}, {0x3, 0x1}, {0x5}, {0x3, 0x1}, {0x1, 0x1}, {0x5, 0x1}, {0x0, 0x1}, {0x4, 0x1}, {0x3, 0x1}, {0x0, 0x1}, {0x0, 0x1}, {0x3}, {0x6}, {0xa}, {0x3, 0x1}, {}, {0x2, 0x1}, {0x1}, {0x4}, {0x5}, {0x3}, {0x3, 0x1}, {0x4}, {0x0, 0x1}, {0x5, 0x1}, {0x6}, {0x2}, {0xb82e57098c7a44ef}, {0x3, 0x1}, {0x1}, {0x0, 0x1}, {0x5}, {0x1, 0x1}, {0x5}, {0x0, 0x1}, {0x4}, {0x4}, {0x0, 0x1}, {0x2}, {0x4, 0x1}, {0x1, 0x1}, {0x1, 0x1}, {0x2}, {0x3}, {0x1, 0x1}, {}, {0x4}, {0x3}, {0x3}, {0x1}, {0x5}, {0x3, 0x1}, {0x4}, {0x3, 0x1}, {0x0, 0x1}, {0x1}, {0x4, 0x1}, {0x1}, {0x5, 0x1}, {0x4}, {0x0, 0x1}, {0x3}, {0x1}, {0x0, 0x1}, {0x4}], 0x1}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}]}]}}]}, 0xe8c}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$kcm(r7, &(0x7f0000002900)={&(0x7f0000000500)=@xdp={0x2c, 0x8, r5, 0x10c}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000380)="da", 0x1}], 0x1}, 0x4000880) 3.119358199s ago: executing program 2 (id=1578): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c0000002500090122bd7000fcff7f59975100000800030047"], 0x1c}, 0x1, 0x0, 0x0, 0x449d7}, 0x0) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000003940)=@newtfilter={0x8b8, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r3, {0x5, 0x4}, {}, {0x8}}, [@filter_kind_options=@f_matchall={{0xd}, {0x884, 0x2, [@TCA_MATCHALL_ACT={0x880, 0x2, [@m_police={0x87c, 0x1, 0x0, 0x0, {{0xb}, {0x850, 0x2, 0x0, 0x1, [[@TCA_POLICE_RATE={0x404, 0x2, [0x1ff, 0x3, 0x10000, 0x81, 0x7f, 0x5, 0x4, 0x2, 0x4, 0x5, 0x2234, 0x83, 0x81b, 0x800, 0x8, 0x0, 0x3, 0x7ed53619, 0x1, 0x2, 0x9644, 0x800004, 0x58b, 0x85a, 0x3ff, 0x46, 0x2, 0x1, 0x0, 0x80000000, 0x10001, 0x790, 0x5, 0x1, 0xfffffff9, 0x1a77, 0x9, 0x3, 0x400, 0x63c, 0x4, 0xffffffff, 0x1, 0x3, 0x3, 0x5b1f, 0x7b0, 0x7, 0x100, 0x2, 0xd, 0xff, 0x3, 0x10000, 0x6, 0x6b7, 0x11ff, 0x84, 0x4, 0x7, 0x3, 0xa14, 0x3, 0x2, 0x80000000, 0x81, 0x7, 0x8, 0x5, 0x10001, 0xf7, 0x3, 0xfffffef9, 0x9, 0x4, 0x8, 0xfff, 0x3, 0x3, 0x6, 0x7, 0x8, 0x102, 0xc0000000, 0x6, 0x6, 0x8, 0x8, 0x80000001, 0x8, 0x1d24, 0x2, 0x7, 0x80000000, 0x7f, 0x7, 0x9, 0xff, 0x24, 0x5, 0x7, 0x6, 0x10007a, 0x8, 0x0, 0x7, 0x470, 0x7f, 0x6, 0x0, 0x1, 0x0, 0x4, 0x10009, 0x61, 0x200, 0x6, 0x2, 0x2, 0x6, 0x10003, 0x8, 0x7, 0x11, 0xda56, 0x7ffffffe, 0x80, 0x2f0cb955, 0x7, 0xfed, 0xf, 0x6ae, 0x9, 0xfffffffd, 0x9, 0x8001, 0x0, 0xec000, 0x0, 0x1, 0x2, 0x9, 0x18, 0x8, 0x4, 0x1, 0xffffcf1b, 0x282, 0x5517bc7b, 0x3, 0x4, 0xb6b, 0x5, 0xf7800000, 0xac, 0x8, 0x3, 0x10, 0x9, 0x8, 0x80000001, 0x0, 0x74, 0x2, 0x7fffffff, 0x0, 0xa, 0x6, 0xffffffff, 0x8, 0x2, 0x7, 0x7f, 0x5, 0x3, 0xa, 0x1, 0x0, 0xa, 0x300, 0x5, 0x3, 0x6, 0xffffffff, 0xffb, 0xff, 0x5, 0x8, 0x3, 0xb, 0x5, 0xb, 0x399d, 0x8, 0x8ab6, 0x18000, 0x2, 0xfffffff9, 0x2, 0x2, 0x528c, 0x5, 0x200, 0xac, 0xf, 0xd05, 0x9a2ce73, 0x4, 0x6, 0xe076, 0x6b10, 0x5, 0x1, 0x6, 0xb, 0xa26, 0xaf6, 0x0, 0xec, 0x8, 0xde16, 0xc418, 0xffffffff, 0xffffffff, 0x9, 0x400, 0x80001, 0x5, 0x354d, 0x5, 0x2, 0x1, 0x7, 0x0, 0x177, 0x7, 0x0, 0x80, 0x5, 0x8, 0xfffffffb, 0x4, 0xe7b, 0x0, 0x7, 0x42bf, 0x10000, 0x9, 0x9, 0x6, 0x4b75, 0x80000001, 0x1000, 0x5915, 0x10001, 0x1]}], [@TCA_POLICE_PEAKRATE={0x404, 0x3, [0x107e, 0x4, 0xec2, 0x6, 0x8, 0x400, 0x5, 0x1, 0x7, 0x470, 0x487, 0x100, 0xa99, 0x4, 0x5, 0x37f, 0x8, 0x6, 0x3, 0x3, 0x800, 0xd2f5, 0x40, 0x3, 0x4, 0x5, 0x7, 0x12, 0x2, 0x8, 0x101, 0xfffeffff, 0x2, 0xffff, 0xa6, 0x3, 0x10000, 0x1000, 0x4, 0x0, 0x3, 0x0, 0x2, 0x6, 0x98, 0x8, 0x6, 0x9, 0x1000, 0xb3000, 0xf, 0x3, 0x9, 0xb3, 0x94b, 0x9, 0x8, 0x6, 0x100, 0x2, 0xffff, 0x4, 0x2, 0x3ff, 0x2, 0xb828, 0x0, 0x0, 0x365, 0x8, 0x8, 0xf, 0x1, 0xfffffffe, 0xfffffff6, 0x93, 0x7ffb, 0x92, 0x0, 0x7, 0xfffffffc, 0x7ff, 0x9, 0x2, 0x0, 0x2, 0x8, 0xffffff37, 0x3, 0x9, 0xc, 0xff, 0x3, 0x3, 0x400, 0x100000, 0x7f, 0x2, 0x8, 0x4, 0x7, 0x4, 0x7, 0xfffffffa, 0x101, 0xadd9, 0x1, 0x0, 0x7, 0x7fffffff, 0x40, 0x4, 0x0, 0x5, 0x4, 0x1, 0x8, 0x9, 0x6, 0x6, 0x2, 0xb, 0x3, 0x7f, 0xffff, 0x9, 0x1685, 0xa252, 0x2, 0x200, 0x3, 0x1, 0x400, 0xfffffffc, 0xfffffffc, 0x1000, 0x7ff, 0x1, 0x1f6, 0x751, 0x7, 0x40000000, 0x1, 0x8, 0x50, 0xf, 0xf, 0xe, 0x6, 0x0, 0x81, 0xfff80000, 0x0, 0x1, 0x6, 0x3, 0x7ef8, 0x7, 0x5, 0x2, 0x0, 0x4e8, 0x80, 0x0, 0x8, 0x5, 0x0, 0x5, 0x7fff, 0x7, 0x8, 0x6a4941c5, 0x2ea567b4, 0x8, 0x80000000, 0x6, 0x40, 0x2, 0x4000fff, 0x8, 0x7, 0x1, 0x1, 0x0, 0x0, 0xd3bed341, 0x691f, 0x0, 0x2, 0x9, 0x6, 0x0, 0x1ff, 0x400003, 0x3, 0x6, 0x5fc8462f, 0x0, 0x7, 0xffff, 0xfffffffc, 0x5, 0x0, 0xb9a6, 0x522, 0x2, 0x2, 0x900, 0x8, 0xbb99, 0xb8000000, 0x8, 0xffffff01, 0xc0a1, 0x8, 0x8, 0x7, 0x59, 0x9, 0x2, 0x101, 0x5f502dc7, 0x7, 0x0, 0x4, 0x6, 0x80000001, 0xc000, 0xffffff97, 0x2, 0x40, 0x1, 0x40, 0x8, 0x3, 0x710, 0x8, 0x1, 0xfffff339, 0x3, 0x8001, 0x1, 0x8001, 0x9, 0x8, 0xfffffffa, 0x8, 0x9, 0xfff, 0xe, 0x3, 0x9, 0xa, 0x7, 0xfffffff8]}, @TCA_POLICE_TBF={0x3c, 0x1, {0xfffffe00, 0x20000000, 0x5, 0x1, 0xdbec, {0x8, 0x0, 0xb55, 0x5, 0x7, 0xb}, {0x6, 0x2, 0xd, 0x5, 0x1, 0x5d17}, 0x2, 0x0, 0x6}}, @TCA_POLICE_RESULT={0x8, 0x5, 0x401}]]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}]}]}}]}, 0x8b8}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$key(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)={0x2, 0x6, 0x0, 0x5, 0xc, 0x0, 0x70bd2d, 0x25dfdbfe, [@sadb_ident={0x2, 0xe, 0x136f, 0x0, 0x5eec52}, @sadb_x_nat_t_port={0x1, 0x16, 0x4e24}, @sadb_x_nat_t_type={0x1}, @sadb_x_nat_t_port={0x1, 0x15, 0x4e22}, @sadb_x_filter={0x5, 0x1a, @in=@empty, @in=@loopback, 0x1, 0x10, 0x10}]}, 0x60}}, 0x20008000) 3.099887379s ago: executing program 3 (id=1579): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="1900000004000000040001000000000000000000", @ANYRES32=0x1, @ANYBLOB="f1ffffff00"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000180), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000100)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}}, 0x0, 0x0, 0x0) umount2(&(0x7f0000000080)='./file0\x00', 0xc) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000180)={r0, &(0x7f0000000100), &(0x7f0000000000)=""/8, 0x2}, 0x20) openat$tun(0xffffff9c, &(0x7f00000000c0), 0x208000, 0x0) socket$inet(0x2, 0x1, 0x0) mq_open(&(0x7f0000000080)='eth0\x00#~\x02\x00\x00\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfd\x05\x00\x00\x00\x00\x00\x80\x00\t/\x8dv\xb8\x93\xc3C\xae\x9dc\xd1T\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94uu_\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88\x9e0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc7\x8avs\xb2\a\xfe\xb3j*\xad\x18A\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x05\x00\x00\x000\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\x9b}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xce\x00\x00\x00\xe8\vq+\xbb\xc7\xaf\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1J\xec\x926\xb5a0\xa0B\xae|', 0x40, 0x120, 0x0) r2 = socket(0x10, 0x70730f31850c93d2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001180)={&(0x7f0000000240)=@newqdisc={0x3c, 0x24, 0x3fe3aa0262d8c583, 0x70bd2b, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}, {0x6, 0x10}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0xc, 0x8002, [@TCA_FQ_PIE_FLOWS={0x8, 0x2, 0x5}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24000000}, 0x4000040) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001200010324bd7000dcffffff2e000000"], 0x14}, 0x1, 0x0, 0x0, 0x200448d3}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000002880), 0xffffffffffffffff) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r4, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r5 = socket(0x10, 0x80002, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[], 0x64}, 0x1, 0x0, 0x0, 0x4004001}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=ANY=[], 0x3c}, 0x1, 0x0, 0x0, 0x10}, 0x4c851) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) sendmmsg$alg(r5, &(0x7f00000000c0), 0x492492492492627, 0x0) r6 = socket$inet6(0xa, 0x3, 0x7) connect$inet6(r6, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r6, 0x29, 0x23, &(0x7f0000000340)={{{@in6=@dev={0xfe, 0x80, '\x00', 0x1e}, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x20}, {0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x4, 0x2}, {0x0, 0x0, 0xfffffffffffffff7, 0x4}, 0x0, 0x6e6bb9, 0x1}, {{@in=@broadcast, 0xfffffffc, 0x6c}, 0x0, @in=@empty, 0x0, 0x0, 0x2, 0x7, 0x200}}, 0xe8) sendmsg$nl_xfrm(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000600)=ANY=[@ANYBLOB="fc000000160033060000000000000080ff0100000000000000000000000000017f00000100000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ffffffff0000e7ffffffffffffff0000000004d23200000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000500000000000000ffffffffffffffff0000000000000000050000000000000004000000020000000000000006000000020000000a000418190000000c0015005c07350001000000"], 0xfc}}, 0x0) 3.007755874s ago: executing program 1 (id=1580): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c0000002500010125bd70008600ffa9260000000800030047"], 0x1c}, 0x1, 0x0, 0x0, 0x409d6}, 0x0) (fail_nth: 2) 2.921790273s ago: executing program 2 (id=1581): socket$kcm(0xa, 0x3, 0x3a) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) ioctl$TCSBRKP(0xffffffffffffffff, 0x5425, 0x0) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)={0x2, 0x1, 0x0, 0x2, 0xa, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @private}}, @sadb_spirange={0x2, 0x10, 0x0, 0xffffffff}, @sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x0, @rand_addr=0x64010101}}]}, 0x50}}, 0x0) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x7, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000200)={'rose0\x00', 0x112}) socket$netlink(0x10, 0x3, 0x0) r5 = syz_open_procfs(0x0, &(0x7f0000000180)='net/unix\x00') ioctl$BINDER_SET_CONTEXT_MGR_EXT(r5, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x1000}) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x400}) r8 = socket$unix(0x1, 0x1, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) sched_setscheduler(0x0, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f0000000000)={0x0, 0x1c, &(0x7f00000001c0)={&(0x7f0000000440)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x8000000, {0x0, 0x0, 0x0, 0x0, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x10108, 0x7, 0x6361, 0x8, 0xfffffffd, 0x6}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) sendmsg$nl_route_sched(r9, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2c, 0x80000, {0x0, 0x0, 0x0, r10, {0x0, 0x11}, {0xffe6, 0xb}, {0xfff2, 0xc}}, [@qdisc_kind_options=@q_gred={{0x9}, {0xc, 0x2, [@TCA_GRED_MAX_P={0x8, 0x4, 0x401}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x2000c0e1}, 0x4000804) sendmsg$nl_route(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000008c80)=ANY=[@ANYBLOB="2c00000026000506"], 0x2c}}, 0x800) recvmmsg(r6, &(0x7f0000007700), 0x318, 0xfc0, 0x0) 2.39185075s ago: executing program 1 (id=1582): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=@updpolicy={0xfc, 0x19, 0x1, 0x70bd2d, 0x0, {{@in6=@mcast2, @in=@remote, 0x0, 0x0, 0x0, 0x8, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0x4, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa00, 0x407ffffffffffe, 0x800000000000002}, 0x0, 0x0, 0x1, 0x0, 0x6}, [@tmpl={0x44, 0x5, [{{@in=@rand_addr=0x64010101, 0x0, 0x3c}, 0xa, @in=@local, 0x6, 0x4, 0x3, 0x0, 0x0, 0x2}]}]}, 0xfc}}, 0x8000) r1 = socket$l2tp6(0xa, 0x2, 0x73) sendmsg$inet6(r1, &(0x7f00000027c0)={&(0x7f0000001740)={0xa, 0x4e24, 0xfffffffa, @mcast2}, 0x1c, &(0x7f0000002780)=[{&(0x7f0000001780)='*', 0x1}], 0x1}, 0x810) (fail_nth: 2) 2.347455996s ago: executing program 4 (id=1583): r0 = syz_open_dev$sg(&(0x7f0000000100), 0x0, 0x8040) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000300)={0x53, 0xfffffffffffffffb, 0x6, 0xe1, @scatter={0x0, 0x0, 0x0}, &(0x7f00000006c0)="a270451b6e29", 0x0, 0xd, 0x21, 0x1, 0x0}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x2802, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000600)=@newtfilter={0x6c, 0x2c, 0xf3f, 0x70bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0xb, 0x4}, {}, {0x7, 0x300}}, [@filter_kind_options=@f_bpf={{0x8}, {0x40, 0x2, [@TCA_BPF_FD={0xffffffffffffff36}, @TCA_BPF_ACT={0x34, 0x1, [@m_simple={0x30, 0x1, 0x0, 0x0, {{0xb}, {0x4}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x0, 0x2}}}}]}]}}]}, 0x6c}, 0x1, 0x0, 0x0, 0x20041090}, 0x880) socket$inet6_tcp(0xa, 0x1, 0x0) signalfd(0xffffffffffffffff, &(0x7f0000000340)={[0x4, 0x207ab868]}, 0x8) r4 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000006c0)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f000905", @ANYRES16], 0x0) syz_usb_control_io$hid(r4, 0x0, 0x0) r5 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) ioctl$HIDIOCGUSAGE(r5, 0xc018480b, &(0x7f00000000c0)={0x1, 0xffffffff, 0x40, 0x40080009, 0x7, 0xf}) 2.121741858s ago: executing program 1 (id=1584): r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) (async) syz_usb_connect$midi(0x2, 0x5b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201500200000010"], 0x0) r1 = getpid() syz_pidfd_open(r1, 0x0) (async, rerun: 32) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) (async, rerun: 32) r2 = syz_open_procfs(0x0, &(0x7f0000000040)='fdinfo/4\x00') read$FUSE(r2, &(0x7f0000000a00)={0x2020}, 0x2020) (async, rerun: 32) ioctl$FIONREAD(r0, 0x541b, &(0x7f00000000c0)) (rerun: 32) 1.968469642s ago: executing program 3 (id=1585): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000940)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5", 0x4) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="ebe3", 0x2}], 0x1}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f00000001c0)=""/5, 0x5}], 0x1}, 0x0) 1.892081018s ago: executing program 2 (id=1586): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000940)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5", 0x4) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="ebe3", 0x2}], 0x1}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f00000001c0)=""/5, 0x5}], 0x1}, 0x0) (fail_nth: 1) 1.842985546s ago: executing program 3 (id=1587): capset(&(0x7f0000000040)={0x19980330}, &(0x7f0000000080)={0x6, 0xe, 0x13e, 0x89, 0xffffffff, 0x2}) r0 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000001c0)="48000000140081fb7059ae08060c040002fff903905800000000000000006fabca3b4e7d06a6bd7c00000000030000068a562ad6e74703c48f93bc06020000004603b886a5e54f8f", 0x48}], 0x1}, 0x4000000) r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000d507df08c410448200dc01020301090212000100000000090400000003"], 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$uac1(r1, 0x0, &(0x7f0000000480)={0x44, &(0x7f0000000500)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 1.538299445s ago: executing program 2 (id=1588): r0 = socket$kcm(0x29, 0x5, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_GET_SURVEY(r1, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000100)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="000227bd7000fbdbdf253200000008000300", @ANYRES32=r3, @ANYBLOB="7e23a8a00a1bf7472bd6a7ef0826000fa16160c36e27f3882f5f2a9397b7c0447848e6e94ad93c7f78e1"], 0x1c}, 0x1, 0x0, 0x0, 0x8080}, 0x0) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f00000003c0)={0x0, 0x1c, &(0x7f0000000000)=[@in6={0xa, 0x0, 0xd, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x9}]}, &(0x7f0000000240)=0x10) socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r4, 0x84, 0x1b, &(0x7f0000000140), &(0x7f00000001c0)=0x8) syz_usb_connect(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120100002f0c81087f180002ad6b37ed030109022400010000000009040000023c7f98000905ee000000000000090502"], 0x0) setsockopt$kcm_KCM_RECV_DISABLE(r0, 0x119, 0x1, &(0x7f0000000400)=0x7fffffff, 0x4) setsockopt$kcm_KCM_RECV_DISABLE(r0, 0x119, 0x1, &(0x7f0000000440), 0x4) 629.506805ms ago: executing program 1 (id=1589): r0 = socket$kcm(0x10, 0x400000002, 0x0) sendmsg$inet(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="600000004e007f049e", 0x9}, {&(0x7f0000000180)="78cabf2dfb73fc0a7d0a0080f2dcb9fe06892544001100b8f9e6aaeb1ae2f6e8bcb5ee52dc06249798093c5102a1bca0b646a7ce904f6e6b788b3219c233e60ddc36024a99a63e729f9b06f96137c89d03234f008c5681", 0x57}], 0x2}, 0x0) (fail_nth: 2) 209.949588ms ago: executing program 1 (id=1590): sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f00000002c0)="643751c960", 0x5}], 0x1}], 0x1, 0x40800) sendmsg$ETHTOOL_MSG_LINKINFO_SET(0xffffffffffffffff, 0x0, 0x4001) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r3, 0x89a2, &(0x7f0000000040)={'bridge0\x00', @random="1c1200"}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x2, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000000)={[0x3a, 0xfff, 0x0, 0x180, 0x4, 0xff, 0xf1, 0x0, 0x7fffffffffffe, 0x5, 0x4005, 0x8, 0x0, 0x45, 0xc9f8, 0xbdb], 0x50000, 0x1c4313}) ioctl$KVM_RUN(r2, 0xae80, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000740)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x10000, {{@in=@multicast2, @in=@empty, 0x40, 0x0, 0x0, 0x0, 0xa, 0x20}, {0x8, 0x10, 0x100000002, 0x0, 0xfff, 0xffffffffffffb473, 0xffffffffffffffff}, {0x1000000000, 0x2000000000000000, 0x2, 0xffffffffffffffff}, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x3}}, 0xb8}}, 0x4004) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) r6 = syz_open_dev$vim2m(&(0x7f0000000100), 0x7, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r6, 0xc0cc5605, &(0x7f0000000180)={0x1, @vbi={0x0, 0x0, 0x32314258}}) sendmsg$nl_xfrm(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast1=0xe0000002, @in, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x87}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffb}, {0x0, 0x0, 0x200000000000000}}}, 0xb8}}, 0x2c000010) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)=@updpolicy={0xe0, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast1=0xe0000002, @in, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x87}, {0x0, 0x0, 0x0, 0x2, 0xfffffffffffffffd, 0x0, 0x5, 0xfffffffffffffffb}, {0x0, 0x40000000000000, 0x200000000000000}, 0x2, 0x0, 0x1}, [@XFRMA_SET_MARK_MASK={0x8, 0x1e, 0x8}, @lifetime_val={0x24, 0x9, {0x2, 0x2be, 0x9, 0x7}}]}, 0xe0}, 0x1, 0x0, 0x0, 0x4000015}, 0x2c000010) 0s ago: executing program 1 (id=1591): r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="216400000b529708410e42416ed401020301090224000100000000090400020221f7680009050100000401ff07090502f72fcb1fc08e14820a"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0xffa1, &(0x7f0000000000)={&(0x7f0000000940)=@newtaction={0x48, 0x12, 0xbf68af9d17701211, 0x0, 0x0, {0x7}, [{0x4}, {0x30, 0x1, [@m_ct={0x2c, 0x0, 0x0, 0x0, {{0x7}, {0x4}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x1d, {0x3, 0x2}}}}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x240000d0}, 0x0) syz_usb_connect(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="216400000b529708410e42416ed401020301090224000100000000090400020221f7680009050100000401ff07090502f72fcb1fc08e14820a"], 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) (async) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0xffa1, &(0x7f0000000000)={&(0x7f0000000940)=@newtaction={0x48, 0x12, 0xbf68af9d17701211, 0x0, 0x0, {0x7}, [{0x4}, {0x30, 0x1, [@m_ct={0x2c, 0x0, 0x0, 0x0, {{0x7}, {0x4}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x1d, {0x3, 0x2}}}}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x240000d0}, 0x0) (async) kernel console output (not intermixed with test programs): 8.528908][ T35] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 408.547465][ T5697] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 408.556376][ T1221] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 408.565954][ T47] usb 1-1: config 0 has an invalid interface number: 25 but max is 0 [ 408.574455][ T47] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 408.585354][ T47] usb 1-1: config 0 has no interface number 0 [ 408.591837][ T47] usb 1-1: config 0 interface 25 altsetting 205 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 408.606208][ T47] usb 1-1: config 0 interface 25 has no altsetting 0 [ 408.618408][ T47] usb 1-1: New USB device found, idVendor=1b3b, idProduct=2951, bcdDevice=9e.ee [ 408.628180][ T47] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 408.636496][ T47] usb 1-1: Product: syz [ 408.640714][ T47] usb 1-1: Manufacturer: syz [ 408.645343][ T47] usb 1-1: SerialNumber: syz [ 408.645989][ T9] usb 2-1: new high-speed USB device number 84 using dummy_hcd [ 408.654371][ T47] usb 1-1: config 0 descriptor?? [ 408.669005][ T47] uvcvideo 1-1:0.25: Found Unit with invalid ID 0 [ 408.698073][ T24] usb 4-1: config 0 has an invalid interface number: 147 but max is 0 [ 408.706598][ T24] usb 4-1: config 0 has no interface number 0 [ 408.712768][ T24] usb 4-1: config 0 interface 147 altsetting 0 endpoint 0x2 has invalid maxpacket 512, setting to 64 [ 408.728950][ T24] usb 4-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=51.03 [ 408.738349][ T24] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 408.747212][ T24] usb 4-1: Product: syz [ 408.751898][ T24] usb 4-1: Manufacturer: syz [ 408.756816][ T24] usb 4-1: SerialNumber: syz [ 408.768914][ T24] usb 4-1: config 0 descriptor?? [ 408.775565][T10592] raw-gadget.3 gadget.3: fail, usb_ep_enable returned -22 [ 408.791930][ T24] usb 4-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 408.829000][ T9] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 408.840612][ T9] usb 2-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 408.850369][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 408.862870][ T9] usb 2-1: config 0 descriptor?? [ 408.878606][ T9] pwc: Askey VC010 type 2 USB webcam detected. [ 408.900497][T10584] veth1_to_hsr: entered promiscuous mode [ 408.910564][T10584] macsec2: entered promiscuous mode [ 408.917626][T10584] macsec2: entered allmulticast mode [ 408.923017][T10584] veth1_to_hsr: entered allmulticast mode [ 408.966658][T10584] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 408.977969][T10584] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 409.027144][T10592] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 409.037805][T10592] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 409.044697][T10584] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 409.063467][ T1157] usb 4-1: Failed to submit usb control message: -71 [ 409.071070][ T1157] usb 4-1: unable to send the bmi data to the device: -71 [ 409.074796][ T24] usb 4-1: USB disconnect, device number 97 [ 409.079545][ T1157] usb 4-1: unable to get target info from device [ 409.092552][T10584] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 409.093979][ T1157] usb 4-1: could not get target info (-71) [ 409.106812][ T1157] usb 4-1: could not probe fw (-71) [ 409.170923][ T47] uvcvideo 1-1:0.25: Found UVC 0.00 device syz (1b3b:2951) [ 409.201538][ T47] uvcvideo 1-1:0.25: No valid video chain found. [ 409.248818][ T1157] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 409.258803][ T807] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 409.273190][ T5690] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 409.307394][ T5624] pwc: recv_control_msg error -71 req 02 val 2b00 [ 409.316839][ T47] usb 1-1: USB disconnect, device number 93 [ 409.326272][ T5624] pwc: recv_control_msg error -71 req 02 val 2700 [ 409.345418][ T5624] pwc: recv_control_msg error -71 req 02 val 2c00 [ 409.370719][ T5624] pwc: recv_control_msg error -71 req 04 val 1000 [ 409.410108][ T5624] pwc: recv_control_msg error -71 req 04 val 1300 [ 409.432276][ T5624] pwc: recv_control_msg error -71 req 04 val 1400 [ 409.454451][ T5624] pwc: recv_control_msg error -71 req 02 val 2000 [ 409.475079][ T5624] pwc: recv_control_msg error -71 req 02 val 2100 [ 409.483230][ T5624] pwc: recv_control_msg error -71 req 04 val 1500 [ 409.491144][ T5624] pwc: recv_control_msg error -71 req 02 val 2500 [ 409.536135][ T5624] pwc: recv_control_msg error -71 req 02 val 2400 [ 409.554585][ T5624] pwc: recv_control_msg error -71 req 02 val 2600 [ 409.567494][ T47] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 409.581231][T10608] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 409.587780][ T5624] pwc: recv_control_msg error -71 req 02 val 2900 [ 409.597803][T10608] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 409.609398][ T5624] pwc: recv_control_msg error -71 req 02 val 2800 [ 409.623910][ T5624] pwc: recv_control_msg error -71 req 04 val 1100 [ 409.636601][T10608] loop2: detected capacity change from 0 to 7 [ 409.636913][ T5624] pwc: recv_control_msg error -71 req 04 val 1200 [ 409.660195][T10608] Dev loop2: unable to read RDB block 7 [ 409.669087][ T5624] pwc: Registered as video103. [ 409.678335][T10608] loop2: unable to read partition table [ 409.687237][ T5624] input: PWC snapshot button as /devices/platform/dummy_hcd.2/usb3/3-1/input/input106 [ 409.755775][ T5624] usb 3-1: USB disconnect, device number 91 [ 409.770067][T10608] loop2: partition table beyond EOD, truncated [ 409.820492][T10608] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 409.991829][T10614] netlink: 'syz.3.1379': attribute type 13 has an invalid length. [ 410.166018][ T5624] usb 3-1: new full-speed USB device number 92 using dummy_hcd [ 410.328241][ T5624] usb 3-1: config 0 has an invalid interface number: 147 but max is 0 [ 410.346866][ T5624] usb 3-1: config 0 has no interface number 0 [ 410.360186][ T5624] usb 3-1: config 0 interface 147 altsetting 0 endpoint 0x2 has invalid maxpacket 512, setting to 64 [ 410.385778][ T5624] usb 3-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=51.03 [ 410.404729][ T5624] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 410.425774][ T5624] usb 3-1: Product: syz [ 410.437290][ T5624] usb 3-1: Manufacturer: syz [ 410.461218][ T5624] usb 3-1: SerialNumber: syz [ 410.517197][ T5624] usb 3-1: config 0 descriptor?? [ 410.547593][T10606] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 410.631790][ T5624] usb 3-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 411.015989][ T1221] usb 1-1: new high-speed USB device number 94 using dummy_hcd [ 411.034865][T10606] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 411.054886][T10606] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 411.093015][ T99] usb 3-1: Failed to submit usb control message: -71 [ 411.101147][ T5624] usb 3-1: USB disconnect, device number 92 [ 411.112041][ T99] usb 3-1: unable to send the bmi data to the device: -71 [ 411.123845][ T99] usb 3-1: unable to get target info from device [ 411.141140][ T99] usb 3-1: could not get target info (-71) [ 411.147602][ T99] usb 3-1: could not probe fw (-71) [ 411.208716][ T1221] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 246, changing to 11 [ 411.255280][ T1221] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 411.301574][ T1221] usb 1-1: New USB device found, idVendor=044e, idProduct=120c, bcdDevice= 0.00 [ 411.321868][ T1221] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 411.352431][ T1221] usb 1-1: config 0 descriptor?? [ 411.646169][ T47] net_ratelimit: 4 callbacks suppressed [ 411.646190][ T47] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 411.885668][T10623] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 411.906628][T10623] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 411.980306][ T1221] hid-alps 0003:044E:120C.0062: unknown main item tag 0x0 [ 412.014133][ T1221] hid-alps 0003:044E:120C.0062: unexpected long global item [ 412.056425][ T1221] hid-alps 0003:044E:120C.0062: parse failed [ 412.087098][ T1221] hid-alps 0003:044E:120C.0062: probe with driver hid-alps failed with error -22 [ 412.191680][T10623] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 412.226513][T10623] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 412.286416][ T5624] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 412.612370][ T9] pwc: recv_control_msg error -71 req 02 val 2b00 [ 412.629045][ T9] pwc: recv_control_msg error -71 req 02 val 2700 [ 412.654325][ T9] pwc: recv_control_msg error -71 req 02 val 2c00 [ 412.681184][ T9] pwc: recv_control_msg error -71 req 04 val 1000 [ 412.696264][ T1221] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 412.728369][ T9] pwc: recv_control_msg error -71 req 04 val 1300 [ 412.750257][ T9] pwc: recv_control_msg error -71 req 04 val 1400 [ 412.765282][ T9] pwc: recv_control_msg error -71 req 02 val 2000 [ 412.784278][ T47] usb 3-1: new high-speed USB device number 93 using dummy_hcd [ 412.803469][ T9] pwc: recv_control_msg error -71 req 02 val 2100 [ 412.824752][ T9] pwc: recv_control_msg error -71 req 04 val 1500 [ 412.855544][ T9] pwc: recv_control_msg error -71 req 02 val 2500 [ 412.886049][ T9] pwc: recv_control_msg error -71 req 02 val 2400 [ 412.915075][ T9] pwc: recv_control_msg error -71 req 02 val 2600 [ 412.932300][T10660] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1390'. [ 412.947766][ T9] pwc: recv_control_msg error -71 req 02 val 2900 [ 412.949021][ T47] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 412.974466][ T9] pwc: recv_control_msg error -71 req 02 val 2800 [ 412.983438][ T9] pwc: recv_control_msg error -71 req 04 val 1100 [ 412.983966][ T47] usb 3-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 412.991037][ T9] pwc: recv_control_msg error -71 req 04 val 1200 [ 413.028521][ T47] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 413.049678][ T9] pwc: Registered as video103. [ 413.086211][ T47] usb 3-1: config 0 descriptor?? [ 413.097348][ T9] input: PWC snapshot button as /devices/platform/dummy_hcd.1/usb2/2-1/input/input107 [ 413.141921][ T47] pwc: Askey VC010 type 2 USB webcam detected. [ 413.148160][ T9] usb 2-1: USB disconnect, device number 84 [ 413.160426][T10664] fuse: Bad value for 'fd' [ 413.614294][ T9] usb 2-1: new high-speed USB device number 85 using dummy_hcd [ 413.724869][ T24] usb 1-1: USB disconnect, device number 94 [ 413.747487][ T5705] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 413.795989][ T9] usb 2-1: Using ep0 maxpacket: 16 [ 413.814824][ T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 413.847040][ T9] usb 2-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 413.874443][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 413.896632][ T9] usb 2-1: Product: syz [ 413.905099][ T9] usb 2-1: Manufacturer: syz [ 413.933907][ T9] usb 2-1: SerialNumber: syz [ 413.957439][ T9] usb 2-1: config 0 descriptor?? [ 414.001337][ T9] em28xx 2-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 414.032859][ T9] em28xx 2-1:0.0: DVB interface 0 found: bulk [ 414.446882][ T5705] usb 4-1: new high-speed USB device number 98 using dummy_hcd [ 414.567012][T10679] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1395'. [ 414.581772][T10681] FAULT_INJECTION: forcing a failure. [ 414.581772][T10681] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 414.627480][T10681] CPU: 1 UID: 0 PID: 10681 Comm: syz.4.1396 Tainted: G L syzkaller #0 PREEMPT(full) [ 414.627511][T10681] Tainted: [L]=SOFTLOCKUP [ 414.627519][T10681] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 414.627530][T10681] Call Trace: [ 414.627537][T10681] [ 414.627544][T10681] dump_stack_lvl+0xe8/0x150 [ 414.627568][T10681] should_fail_ex+0x412/0x560 [ 414.627588][T10681] _copy_from_user+0x2d/0xb0 [ 414.627612][T10681] move_addr_to_kernel+0x7e/0x160 [ 414.627642][T10681] get_compat_msghdr+0x3d8/0x4c0 [ 414.627677][T10681] ? __pfx_get_compat_msghdr+0x10/0x10 [ 414.627700][T10681] ? kstrtoull+0x12f/0x1d0 [ 414.627715][T10681] ___sys_sendmsg+0x201/0x360 [ 414.627727][T10681] ? __lock_acquire+0x6b5/0x2cf0 [ 414.627741][T10681] ? __pfx____sys_sendmsg+0x10/0x10 [ 414.627758][T10681] ? get_pid_task+0x20/0x1f0 [ 414.627781][T10681] ? get_pid_task+0x20/0x1f0 [ 414.627801][T10681] ? get_pid_task+0x20/0x1f0 [ 414.627847][T10681] ? __fget_files+0x2a/0x420 [ 414.627860][T10681] ? __fget_files+0x3a0/0x420 [ 414.627876][T10681] __sys_sendmsg+0x183/0x260 [ 414.627890][T10681] ? __pfx___sys_sendmsg+0x10/0x10 [ 414.627919][T10681] __do_fast_syscall_32+0x229/0x6e0 [ 414.627942][T10681] ? do_fast_syscall_32+0x33/0x70 [ 414.627963][T10681] ? lockdep_hardirqs_on+0x7a/0x110 [ 414.627983][T10681] ? asm_int80_emulation+0x1a/0x20 [ 414.628001][T10681] ? do_int80_emulation+0x286/0x530 [ 414.628014][T10681] ? trace_irq_disable+0x3b/0x140 [ 414.628030][T10681] do_fast_syscall_32+0x33/0x70 [ 414.628042][T10681] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 414.628054][T10681] RIP: 0023:0xf7f3801c [ 414.628066][T10681] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 414.628082][T10681] RSP: 002b:00000000f53f650c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 414.628103][T10681] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000c40 [ 414.628115][T10681] RDX: 0000000000000004 RSI: 0000000000000000 RDI: 0000000000000000 [ 414.628126][T10681] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 414.628136][T10681] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 414.628148][T10681] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 414.628166][T10681] [ 414.965895][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 415.131210][ T1157] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 415.135935][ T5705] usb 4-1: Using ep0 maxpacket: 32 [ 415.140285][ T5690] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 415.153984][ T5697] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 415.163252][ T5725] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 415.187090][ T5705] usb 4-1: unable to get BOS descriptor or descriptor too short [ 415.196696][ T5705] usb 4-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config [ 415.241545][ T5705] usb 4-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice=5a.bb [ 415.251069][ T5705] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 415.256229][ T5624] usb 1-1: new high-speed USB device number 95 using dummy_hcd [ 415.261236][ T5705] usb 4-1: Product: syz [ 415.271098][ T5705] usb 4-1: Manufacturer: syz [ 415.275843][ T5705] usb 4-1: SerialNumber: syz [ 415.424780][T10685] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 415.437362][T10685] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 415.453158][ T5624] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 415.489272][ T5624] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 415.522936][ T5624] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 415.546740][ T5624] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 415.574375][ T5624] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 415.592093][ T5624] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 415.608292][ T5705] usb 4-1: Limiting number of CPorts to U8_MAX [ 415.627968][ T5705] usb 4-1: Not enough endpoints found in device, aborting! [ 415.648579][ T5624] usb 1-1: config 0 descriptor?? [ 415.744350][ T9] em28xx 2-1:0.0: unknown em28xx chip ID (0) [ 415.821363][ T5725] usb 4-1: USB disconnect, device number 98 [ 415.837742][ T9] em28xx 2-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 415.853369][ T9] em28xx 2-1:0.0: board has no eeprom [ 415.925983][ T9] em28xx 2-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 415.947152][ T9] em28xx 2-1:0.0: dvb set to bulk mode. [ 415.963799][ T807] em28xx 2-1:0.0: Binding DVB extension [ 416.022391][ T9] usb 2-1: USB disconnect, device number 85 [ 416.067955][ T9] em28xx 2-1:0.0: Disconnecting em28xx [ 416.136802][ T807] em28xx 2-1:0.0: Registering input extension [ 416.146207][ T9] em28xx 2-1:0.0: Closing input extension [ 416.186912][ T9] em28xx 2-1:0.0: Freeing device [ 416.206888][ T5705] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 416.301592][T10685] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 416.339995][T10685] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 416.869750][ T47] pwc: send_video_command error -71 [ 416.875306][ T47] pwc: Failed to set video mode CIF@30 fps; return code = -71 [ 416.885452][ T47] Philips webcam 3-1:0.0: probe with driver Philips webcam failed with error -71 [ 416.901704][ T47] usb 3-1: USB disconnect, device number 93 [ 416.926244][ T9] usb 4-1: new high-speed USB device number 99 using dummy_hcd [ 417.012751][T10699] fuse: Bad value for 'fd' [ 417.108940][ T9] usb 4-1: unable to get BOS descriptor or descriptor too short [ 417.126827][ T9] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 417.141764][ T9] usb 4-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 417.153418][ T9] usb 4-1: config 1 interface 1 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 417.173085][ T9] usb 4-1: string descriptor 0 read error: -22 [ 417.181772][ T9] usb 4-1: New USB device found, idVendor=1235, idProduct=800c, bcdDevice= 0.40 [ 417.191607][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 417.215214][ T9] usb 4-1: unit 4 not found! [ 417.247390][ T47] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 417.266852][ T5725] usb 2-1: new high-speed USB device number 86 using dummy_hcd [ 417.350114][T10704] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 417.426071][ T5725] usb 2-1: device descriptor read/64, error -71 [ 417.502885][ T5624] usbhid 1-1:0.0: can't add hid device: -71 [ 417.514443][ T5624] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 417.546779][ T5624] usb 1-1: USB disconnect, device number 95 [ 417.611886][ T9] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -71 [ 417.633675][ T9] usb 4-1: USB disconnect, device number 99 [ 417.688244][ T5725] usb 2-1: new high-speed USB device number 87 using dummy_hcd [ 417.825985][ T5725] usb 2-1: device descriptor read/64, error -71 [ 417.946276][ T5725] usb usb2-port1: attempt power cycle [ 418.196972][ T29] audit: type=1804 audit(1777530458.497:391): pid=10714 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.3.1408" name="/newroot/282/file0" dev="fuse" ino=1 res=1 errno=0 [ 418.227596][ T5624] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 418.288912][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 418.306198][ T5725] usb 2-1: new high-speed USB device number 88 using dummy_hcd [ 418.339814][ T5725] usb 2-1: device descriptor read/8, error -71 [ 418.376768][ T47] usb 3-1: new high-speed USB device number 94 using dummy_hcd [ 418.486974][ T5624] usb 4-1: new high-speed USB device number 100 using dummy_hcd [ 418.535506][T10732] netlink: 'syz.4.1412': attribute type 1 has an invalid length. [ 418.535506][T10731] netlink: 'syz.4.1412': attribute type 1 has an invalid length. [ 418.554072][ T47] usb 3-1: Using ep0 maxpacket: 32 [ 418.582542][ T47] usb 3-1: unable to get BOS descriptor or descriptor too short [ 418.584299][T10731] 8021q: adding VLAN 0 to HW filter on device bond1 [ 418.597088][ T47] usb 3-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config [ 418.597888][ T5725] usb 2-1: new high-speed USB device number 89 using dummy_hcd [ 418.614826][ T47] usb 3-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice=5a.bb [ 418.626720][ T5725] usb 2-1: device descriptor read/8, error -71 [ 418.626970][ T47] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 418.650146][ T47] usb 3-1: Product: syz [ 418.662166][T10731] vlan2: entered allmulticast mode [ 418.667423][ T47] usb 3-1: Manufacturer: syz [ 418.672134][T10731] bond1: entered allmulticast mode [ 418.677332][ T47] usb 3-1: SerialNumber: syz [ 418.686062][ T5624] usb 4-1: Using ep0 maxpacket: 8 [ 418.698006][ T5624] usb 4-1: unable to get BOS descriptor or descriptor too short [ 418.709716][ T5624] usb 4-1: New USB device found, idVendor=10f5, idProduct=0200, bcdDevice= 0.40 [ 418.719678][ T5624] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 418.728733][T10732] bond1: (slave geneve2): making interface the new active one [ 418.732904][ T5624] usb 4-1: Product: syz [ 418.736711][T10732] geneve2: entered allmulticast mode [ 418.742811][ T5725] usb usb2-port1: unable to enumerate USB device [ 418.754146][T10732] bond1: (slave geneve2): Enslaving as an active interface with an up link [ 418.760903][ T5624] usb 4-1: Manufacturer: syz [ 418.770576][ T5624] usb 4-1: SerialNumber: syz [ 418.778896][T10731] tipc: Started in network mode [ 418.790569][T10731] tipc: Node identity 080211000001, cluster identity 4711 [ 418.798017][T10731] tipc: Enabled bearer , priority 0 [ 418.893349][ T47] usb 3-1: Limiting number of CPorts to U8_MAX [ 418.906973][ T47] usb 3-1: Not enough endpoints found in device, aborting! [ 418.907172][T10706] usb 1-1: new high-speed USB device number 96 using dummy_hcd [ 418.992244][ T5624] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -71 [ 419.028045][ T5624] usb 4-1: USB disconnect, device number 100 [ 419.096388][T10706] usb 1-1: Using ep0 maxpacket: 32 [ 419.104295][T10706] usb 1-1: unable to get BOS descriptor or descriptor too short [ 419.115817][ T47] usb 3-1: USB disconnect, device number 94 [ 419.117429][T10706] usb 1-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config [ 419.135241][T10742] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 419.148211][T10706] usb 1-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice=5a.bb [ 419.157502][T10742] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 419.169216][T10706] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 419.179232][T10706] usb 1-1: Product: syz [ 419.183535][T10706] usb 1-1: Manufacturer: syz [ 419.188917][T10706] usb 1-1: SerialNumber: syz [ 419.326455][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 419.403600][T10706] usb 1-1: Limiting number of CPorts to U8_MAX [ 419.410754][T10706] usb 1-1: Not enough endpoints found in device, aborting! [ 419.496443][T10706] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 419.723167][ T24] usb 1-1: USB disconnect, device number 96 [ 419.917866][ T24] tipc: Node number set to 134418688 [ 420.368362][ T5697] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 420.406775][ T47] usb 2-1: new high-speed USB device number 90 using dummy_hcd [ 420.577558][ T47] usb 2-1: Using ep0 maxpacket: 8 [ 420.599962][ T47] usb 2-1: config 0 has an invalid interface number: 55 but max is 0 [ 420.624249][ T47] usb 2-1: config 0 has no interface number 0 [ 420.651536][T10769] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1424'. [ 420.663982][ T47] usb 2-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 420.687658][ T47] usb 2-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 420.708989][T10769] fuse: Unknown parameter 'f' [ 420.721244][ T47] usb 2-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 420.733082][ T47] usb 2-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 420.746676][ T47] usb 2-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 420.761021][ T47] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 420.776399][ T36] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 420.786780][ T5697] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 420.797044][T10706] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 420.814779][ T47] usb 2-1: config 0 descriptor?? [ 420.849281][ T47] ldusb 2-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 421.109928][ T29] audit: type=1804 audit(1777530461.417:392): pid=10783 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.0.1430" name="bus" dev="ramfs" ino=34356 res=1 errno=0 [ 421.149393][ T5697] usb 4-1: new high-speed USB device number 101 using dummy_hcd [ 421.163040][ T29] audit: type=1804 audit(1777530461.447:393): pid=10783 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.0.1430" name="bus" dev="ramfs" ino=34356 res=1 errno=0 [ 421.266231][ T47] usb 3-1: new high-speed USB device number 95 using dummy_hcd [ 421.338034][ T5697] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 421.348490][ T5697] usb 4-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 421.358030][ T5697] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 421.370499][ T5697] usb 4-1: config 0 descriptor?? [ 421.379473][ T5697] pwc: Askey VC010 type 2 USB webcam detected. [ 421.406737][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 421.416443][ T47] usb 3-1: Using ep0 maxpacket: 32 [ 421.430702][ T47] usb 3-1: unable to get BOS descriptor or descriptor too short [ 421.440627][ T47] usb 3-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config [ 421.454349][ T47] usb 3-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice=5a.bb [ 421.464170][ T47] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 421.472673][ T47] usb 3-1: Product: syz [ 421.477449][ T47] usb 3-1: Manufacturer: syz [ 421.482213][ T47] usb 3-1: SerialNumber: syz [ 421.698599][ T47] usb 3-1: Limiting number of CPorts to U8_MAX [ 421.728789][ T47] usb 3-1: Not enough endpoints found in device, aborting! [ 421.917115][ T47] usb 3-1: USB disconnect, device number 95 [ 422.461259][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 422.900963][T10797] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1433'. [ 422.949035][T10800] netlink: 1752 bytes leftover after parsing attributes in process `syz.0.1434'. [ 423.105914][ T0] NOHZ tick-stop error: local softirq work is pending, handler #202!!! [ 423.122252][ T24] usb 2-1: USB disconnect, device number 90 [ 423.189323][T10802] netlink: 'syz.4.1432': attribute type 10 has an invalid length. [ 423.203248][ T24] ldusb 2-1:0.55: LD USB Device #0 now disconnected [ 423.288672][T10801] netlink: 'syz.4.1432': attribute type 10 has an invalid length. [ 423.398408][T10802] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 423.440597][T10802] team0: Port device netdevsim1 added [ 423.488516][ T47] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 423.506013][ T9] usb 1-1: new high-speed USB device number 97 using dummy_hcd [ 423.520062][T10801] team0: Port device netdevsim1 removed [ 423.544793][T10801] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 423.619447][T10801] bond0: (slave netdevsim1): Enslaving as an active interface with an up link [ 423.664089][ T9] usb 1-1: unable to get BOS descriptor or descriptor too short [ 423.676606][ T9] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 423.689890][ T9] usb 1-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 423.708641][ T9] usb 1-1: config 1 interface 1 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 423.725582][T10809] netlink: 'syz.2.1436': attribute type 10 has an invalid length. [ 423.745843][ T9] usb 1-1: string descriptor 0 read error: -22 [ 423.754982][ T9] usb 1-1: New USB device found, idVendor=1235, idProduct=800c, bcdDevice= 0.40 [ 423.766319][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 423.806280][T10706] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 423.832461][ T9] usb 1-1: unit 4 not found! [ 424.054480][T10813] FAULT_INJECTION: forcing a failure. [ 424.054480][T10813] name failslab, interval 1, probability 0, space 0, times 0 [ 424.141544][T10813] CPU: 1 UID: 0 PID: 10813 Comm: syz.1.1437 Tainted: G L syzkaller #0 PREEMPT(full) [ 424.141575][T10813] Tainted: [L]=SOFTLOCKUP [ 424.141582][T10813] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 424.141601][T10813] Call Trace: [ 424.141612][T10813] [ 424.141620][T10813] dump_stack_lvl+0xe8/0x150 [ 424.141648][T10813] should_fail_ex+0x412/0x560 [ 424.141676][T10813] should_failslab+0xa8/0x100 [ 424.141704][T10813] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 424.141729][T10813] ? __alloc_skb+0x186/0x7d0 [ 424.141748][T10813] ? __alloc_skb+0x1d0/0x7d0 [ 424.141766][T10813] ? __local_bh_enable_ip+0xd0/0x130 [ 424.141789][T10813] __alloc_skb+0x1d0/0x7d0 [ 424.141814][T10813] netlink_sendmsg+0x5d4/0xb40 [ 424.141844][T10813] ? __pfx_netlink_sendmsg+0x10/0x10 [ 424.141870][T10813] ? aa_sock_msg_perm+0xf1/0x1b0 [ 424.141893][T10813] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 424.141919][T10813] ____sys_sendmsg+0x972/0x9f0 [ 424.141950][T10813] ? __pfx_____sys_sendmsg+0x10/0x10 [ 424.141977][T10813] ? kstrtoull+0x12f/0x1d0 [ 424.142004][T10813] ___sys_sendmsg+0x2a5/0x360 [ 424.142025][T10813] ? __lock_acquire+0x6b5/0x2cf0 [ 424.142048][T10813] ? __pfx____sys_sendmsg+0x10/0x10 [ 424.142074][T10813] ? get_pid_task+0x20/0x1f0 [ 424.142095][T10813] ? get_pid_task+0x20/0x1f0 [ 424.142113][T10813] ? get_pid_task+0x20/0x1f0 [ 424.142150][T10813] ? __fget_files+0x2a/0x420 [ 424.142169][T10813] ? __fget_files+0x3a0/0x420 [ 424.142195][T10813] __sys_sendmsg+0x183/0x260 [ 424.142219][T10813] ? __pfx___sys_sendmsg+0x10/0x10 [ 424.142257][T10813] __do_fast_syscall_32+0x229/0x6e0 [ 424.142279][T10813] ? do_fast_syscall_32+0x33/0x70 [ 424.142299][T10813] ? lockdep_hardirqs_on+0x7a/0x110 [ 424.142318][T10813] ? asm_int80_emulation+0x1a/0x20 [ 424.142336][T10813] ? do_int80_emulation+0x286/0x530 [ 424.142357][T10813] ? trace_irq_disable+0x3b/0x140 [ 424.142385][T10813] do_fast_syscall_32+0x33/0x70 [ 424.142408][T10813] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 424.142430][T10813] RIP: 0023:0xf709f01c [ 424.142446][T10813] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 424.142462][T10813] RSP: 002b:00000000f548d50c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 424.142482][T10813] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000240 [ 424.142495][T10813] RDX: 0000000000004000 RSI: 0000000000000000 RDI: 0000000000000000 [ 424.142513][T10813] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 424.142524][T10813] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 424.142535][T10813] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 424.142563][T10813] [ 424.601738][ T47] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 424.830610][ T9] snd-usb-audio 1-1:1.0: probe with driver snd-usb-audio failed with error -71 [ 424.863288][ T5697] pwc: send_video_command error -71 [ 424.892637][ T9] usb 1-1: USB disconnect, device number 97 [ 424.903961][ T5697] pwc: Failed to set video mode CIF@30 fps; return code = -71 [ 424.927331][ T5697] Philips webcam 4-1:0.0: probe with driver Philips webcam failed with error -71 [ 424.980133][ T5697] usb 4-1: USB disconnect, device number 101 [ 425.015131][T10810] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1436'. [ 425.026880][ T47] usb 3-1: new high-speed USB device number 96 using dummy_hcd [ 425.033576][T10811] netlink: 71 bytes leftover after parsing attributes in process `syz.2.1436'. [ 425.184377][T10826] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1442'. [ 425.217965][ T47] usb 3-1: config 0 interface 0 has no altsetting 0 [ 425.227533][ T47] usb 3-1: New USB device found, idVendor=0fc5, idProduct=1227, bcdDevice=da.8e [ 425.238565][ T47] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 425.249378][ T47] usb 3-1: Product: syz [ 425.253591][ T47] usb 3-1: Manufacturer: syz [ 425.258495][ T47] usb 3-1: SerialNumber: syz [ 425.268826][ T47] usb 3-1: config 0 descriptor?? [ 425.316225][ T9] usb 1-1: new high-speed USB device number 98 using dummy_hcd [ 425.338351][T10826] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1442'. [ 425.349193][T10826] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1442'. [ 425.406077][ T5741] usb 2-1: new high-speed USB device number 91 using dummy_hcd [ 425.441809][T10833] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 425.451597][T10833] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 425.462659][T10833] FAULT_INJECTION: forcing a failure. [ 425.462659][T10833] name failslab, interval 1, probability 0, space 0, times 0 [ 425.492170][ T9] usb 1-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 425.505996][T10706] usb 4-1: new high-speed USB device number 102 using dummy_hcd [ 425.514004][T10833] CPU: 0 UID: 0 PID: 10833 Comm: syz.4.1444 Tainted: G L syzkaller #0 PREEMPT(full) [ 425.514034][T10833] Tainted: [L]=SOFTLOCKUP [ 425.514041][T10833] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 425.514052][T10833] Call Trace: [ 425.514063][T10833] [ 425.514072][T10833] dump_stack_lvl+0xe8/0x150 [ 425.514097][T10833] should_fail_ex+0x412/0x560 [ 425.514117][T10833] should_failslab+0xa8/0x100 [ 425.514133][T10833] __kmalloc_noprof+0xe8/0x760 [ 425.514147][T10833] ? tomoyo_encode+0x28b/0x550 [ 425.514167][T10833] tomoyo_encode+0x28b/0x550 [ 425.514196][T10833] tomoyo_realpath_from_path+0x58d/0x5d0 [ 425.514231][T10833] ? tomoyo_path_number_perm+0x219/0x630 [ 425.514251][T10833] tomoyo_path_number_perm+0x246/0x630 [ 425.514267][T10833] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 425.514278][T10833] ? __lock_acquire+0x6b5/0x2cf0 [ 425.514307][T10833] ? __fget_files+0x2a/0x420 [ 425.514325][T10833] ? __fget_files+0x3a0/0x420 [ 425.514345][T10833] ? __fget_files+0x2a/0x420 [ 425.514377][T10833] security_file_ioctl_compat+0xc3/0x2a0 [ 425.514401][T10833] __ia32_compat_sys_ioctl+0x139/0x950 [ 425.514421][T10833] ? __pfx___ia32_compat_sys_ioctl+0x10/0x10 [ 425.514437][T10833] ? __fget_files+0x3a0/0x420 [ 425.514452][T10833] ? fput+0xa0/0xd0 [ 425.514464][T10833] ? ksys_write+0x242/0x270 [ 425.514498][T10833] __do_fast_syscall_32+0x229/0x6e0 [ 425.514522][T10833] ? do_fast_syscall_32+0x33/0x70 [ 425.514542][T10833] ? lockdep_hardirqs_on+0x7a/0x110 [ 425.514561][T10833] ? asm_int80_emulation+0x1a/0x20 [ 425.514571][T10833] ? do_int80_emulation+0x286/0x530 [ 425.514583][T10833] ? trace_irq_disable+0x3b/0x140 [ 425.514599][T10833] do_fast_syscall_32+0x33/0x70 [ 425.514611][T10833] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 425.514628][T10833] RIP: 0023:0xf7f3801c [ 425.514646][T10833] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 425.514663][T10833] RSP: 002b:00000000f53f650c EFLAGS: 00000206 ORIG_RAX: 0000000000000036 [ 425.514683][T10833] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000040085112 [ 425.514696][T10833] RDX: 0000000080000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 425.514707][T10833] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 425.514715][T10833] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 425.514721][T10833] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 425.514735][T10833] [ 425.514753][T10833] ERROR: Out of memory at tomoyo_realpath_from_path. [ 425.579096][ T5741] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 425.587680][ T9] usb 1-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 425.599977][ T5741] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 425.626003][ T9] usb 1-1: config 27 interface 0 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 425.630020][ T5741] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 425.639302][ T9] usb 1-1: config 27 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 425.643776][ T5741] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 425.655961][ T9] usb 1-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 425.659070][ T5697] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 425.664883][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 425.670079][ T5741] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 425.683860][ T9] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 425.697906][ T5741] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 425.723928][ T9] usb 1-1: invalid MIDI out EP 0 [ 425.778397][ T5741] usb 2-1: config 0 descriptor?? [ 425.806855][T10706] usb 4-1: Using ep0 maxpacket: 32 [ 425.906450][ T99] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 425.928006][ T5624] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 425.937547][T10808] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 425.946633][ T5624] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 425.959669][T10808] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 425.980826][T10808] bond0 (unregistering): Released all slaves [ 425.993437][T10706] usb 4-1: unable to get BOS descriptor or descriptor too short [ 426.014050][T10706] usb 4-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config [ 426.043823][T10706] usb 4-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice=5a.bb [ 426.060509][T10706] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 426.073089][T10706] usb 4-1: Product: syz [ 426.077425][T10706] usb 4-1: Manufacturer: syz [ 426.084295][T10706] usb 4-1: SerialNumber: syz [ 426.158284][ T9] snd-usb-audio 1-1:27.0: probe with driver snd-usb-audio failed with error -22 [ 426.180915][ T47] usbsevseg 3-1:0.0: USB 7 Segment device now attached [ 426.189076][ T9] usb 1-1: USB disconnect, device number 98 [ 426.210480][ T47] usb 3-1: USB disconnect, device number 96 [ 426.238913][ T47] usbsevseg 3-1:0.0: USB 7 Segment now disconnected [ 426.311181][T10835] fuse: Bad value for 'fd' [ 426.338811][T10706] usb 4-1: Limiting number of CPorts to U8_MAX [ 426.352578][T10706] usb 4-1: Not enough endpoints found in device, aborting! [ 426.562747][ T47] usb 4-1: USB disconnect, device number 102 [ 426.686283][ T5705] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 426.906019][T10706] usb 1-1: new high-speed USB device number 99 using dummy_hcd [ 427.056055][T10706] usb 1-1: Using ep0 maxpacket: 8 [ 427.063354][T10706] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xEE, changing to 0x8E [ 427.076129][T10706] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 427.086883][T10706] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 427.100048][T10706] usb 1-1: New USB device found, idVendor=187f, idProduct=0200, bcdDevice=6b.ad [ 427.113172][T10706] usb 1-1: New USB device strings: Mfr=55, Product=237, SerialNumber=3 [ 427.126661][T10706] usb 1-1: Product: syz [ 427.135976][T10706] usb 1-1: Manufacturer: syz [ 427.141438][T10706] usb 1-1: SerialNumber: syz [ 427.151412][T10706] usb 1-1: config 0 descriptor?? [ 427.161060][T10706] smsusb:smsusb_probe: board id=2, interface number 0 [ 427.169131][T10706] smsusb:smsusb_probe: Device initialized with return code -19 [ 427.343252][T10854] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1452'. [ 427.479591][T10856] sctp: [Deprecated]: syz.4.1453 (pid 10856) Use of struct sctp_assoc_value in delayed_ack socket option. [ 427.479591][T10856] Use struct sctp_sack_info instead [ 427.506887][T10856] bridge_slave_0: left allmulticast mode [ 427.512594][T10856] bridge_slave_0: left promiscuous mode [ 427.521183][T10856] bridge0: port 1(bridge_slave_0) entered disabled state [ 427.533941][ T47] usb 4-1: new high-speed USB device number 103 using dummy_hcd [ 427.546806][T10856] bridge_slave_1: left allmulticast mode [ 427.552501][T10856] bridge_slave_1: left promiscuous mode [ 427.561041][T10856] bridge0: port 2(bridge_slave_1) entered disabled state [ 427.579415][T10856] bond0: (slave bond_slave_0): Releasing backup interface [ 427.595178][T10856] bond0: (slave bond_slave_1): Releasing backup interface [ 427.608690][T10856] team0: Port device team_slave_0 removed [ 427.622164][T10856] team0: Port device team_slave_1 removed [ 427.629723][T10856] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 427.637718][T10856] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 427.646808][T10856] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 427.654274][T10856] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 427.665449][T10856] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 427.696188][ T47] usb 4-1: Using ep0 maxpacket: 16 [ 427.709106][ T47] usb 4-1: config 0 interface 0 altsetting 64 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 427.722474][ T47] usb 4-1: config 0 interface 0 has no altsetting 0 [ 427.730237][ T5705] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 427.739616][ T47] usb 4-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 427.749914][ T47] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 427.766367][ T47] usb 4-1: config 0 descriptor?? [ 427.838237][T10859] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1454'. [ 427.919457][T10861] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1455'. [ 428.021900][T10859] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1454'. [ 428.032688][T10859] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1454'. [ 428.116616][ T5741] usbhid 2-1:0.0: can't add hid device: -71 [ 428.135413][ T5741] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 428.154339][ T5741] usb 2-1: USB disconnect, device number 91 [ 428.207802][ T47] mcp2221 0003:04D8:00DD.0063: USB HID v0.01 Device [HID 04d8:00dd] on usb-dummy_hcd.3-1/input0 [ 428.220421][T10868] fuse: Bad value for 'fd' [ 428.546182][ T5741] usb 2-1: new full-speed USB device number 92 using dummy_hcd [ 428.628347][ T47] usb 4-1: USB disconnect, device number 103 [ 428.707851][ T5741] usb 2-1: config 0 has an invalid interface number: 147 but max is 0 [ 428.716845][ T5741] usb 2-1: config 0 has no interface number 0 [ 428.723074][ T5741] usb 2-1: config 0 interface 147 altsetting 0 endpoint 0x2 has invalid maxpacket 512, setting to 64 [ 428.737372][ T5741] usb 2-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=51.03 [ 428.750042][ T5741] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 428.758852][ T5741] usb 2-1: Product: syz [ 428.764163][ T5741] usb 2-1: Manufacturer: syz [ 428.767246][ T5697] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 428.782870][ T5741] usb 2-1: SerialNumber: syz [ 428.801871][ T5741] usb 2-1: config 0 descriptor?? [ 428.807838][T10870] raw-gadget.3 gadget.1: fail, usb_ep_enable returned -22 [ 428.835496][ T5741] usb 2-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 429.008501][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 429.045193][T10870] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 429.067760][T10870] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 429.088470][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 429.100877][ T57] usb 2-1: Failed to submit usb control message: -71 [ 429.101311][T10706] usb 2-1: USB disconnect, device number 92 [ 429.132346][ T57] usb 2-1: unable to send the bmi data to the device: -71 [ 429.164966][ T57] usb 2-1: unable to get target info from device [ 429.193039][ T57] usb 2-1: could not get target info (-71) [ 429.203078][ T57] usb 2-1: could not probe fw (-71) [ 429.465976][ T5741] usb 3-1: new high-speed USB device number 97 using dummy_hcd [ 429.616211][T10706] usb 1-1: USB disconnect, device number 99 [ 429.626569][ T5741] usb 3-1: Using ep0 maxpacket: 32 [ 429.643964][ T5741] usb 3-1: unable to get BOS descriptor or descriptor too short [ 429.672996][ T5741] usb 3-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config [ 429.709263][ T5741] usb 3-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice=5a.bb [ 429.729679][ T5741] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 429.749050][ T5741] usb 3-1: Product: syz [ 429.759180][ T5741] usb 3-1: Manufacturer: syz [ 429.769623][ T5741] usb 3-1: SerialNumber: syz [ 429.806465][ T47] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 429.860055][T10896] FAULT_INJECTION: forcing a failure. [ 429.860055][T10896] name failslab, interval 1, probability 0, space 0, times 0 [ 429.903877][T10896] CPU: 0 UID: 0 PID: 10896 Comm: syz.1.1465 Tainted: G L syzkaller #0 PREEMPT(full) [ 429.903908][T10896] Tainted: [L]=SOFTLOCKUP [ 429.903915][T10896] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 429.903926][T10896] Call Trace: [ 429.903942][T10896] [ 429.903951][T10896] dump_stack_lvl+0xe8/0x150 [ 429.903977][T10896] should_fail_ex+0x412/0x560 [ 429.904003][T10896] should_failslab+0xa8/0x100 [ 429.904031][T10896] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 429.904058][T10896] ? __alloc_skb+0x1d0/0x7d0 [ 429.904078][T10896] ? __local_bh_enable_ip+0xd0/0x130 [ 429.904101][T10896] __alloc_skb+0x1d0/0x7d0 [ 429.904127][T10896] netlink_dump+0x1d8/0xe10 [ 429.904160][T10896] ? __pfx_netlink_dump+0x10/0x10 [ 429.904190][T10896] ? netlink_recvmsg+0x5d6/0xa50 [ 429.904210][T10896] ? kmem_cache_free+0x182/0x650 [ 429.904239][T10896] netlink_recvmsg+0x690/0xa50 [ 429.904261][T10896] ? __lock_acquire+0x6b5/0x2cf0 [ 429.904287][T10896] ? __pfx_netlink_recvmsg+0x10/0x10 [ 429.904315][T10896] ? aa_sock_msg_perm+0xf1/0x1b0 [ 429.904340][T10896] ? bpf_lsm_socket_recvmsg+0x9/0x20 [ 429.904362][T10896] ? security_socket_recvmsg+0x7e/0x2c0 [ 429.904389][T10896] ? __pfx_netlink_recvmsg+0x10/0x10 [ 429.904412][T10896] sock_recvmsg+0x172/0x1b0 [ 429.904433][T10896] ____sys_recvmsg+0x1e6/0x4a0 [ 429.904465][T10896] ? __pfx_____sys_recvmsg+0x10/0x10 [ 429.904486][T10896] ? get_compat_msghdr+0x34b/0x4c0 [ 429.904521][T10896] ? __lock_acquire+0x6b5/0x2cf0 [ 429.904548][T10896] ___sys_recvmsg+0x215/0x590 [ 429.904571][T10896] ? __lock_acquire+0x6b5/0x2cf0 [ 429.904594][T10896] ? __pfx____sys_recvmsg+0x10/0x10 [ 429.904622][T10896] ? __fget_files+0x2a/0x420 [ 429.904660][T10896] ? __fget_files+0x3a0/0x420 [ 429.904691][T10896] do_recvmmsg+0x3a5/0x800 [ 429.904723][T10896] ? __pfx_do_recvmmsg+0x10/0x10 [ 429.904773][T10896] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 429.904804][T10896] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 429.904831][T10896] __sys_recvmmsg+0x1a5/0x290 [ 429.904853][T10896] ? __pfx___sys_recvmmsg+0x10/0x10 [ 429.904876][T10896] ? ksys_write+0x242/0x270 [ 429.904910][T10896] __ia32_compat_sys_recvmmsg_time32+0xbf/0xe0 [ 429.904945][T10896] __do_fast_syscall_32+0x229/0x6e0 [ 429.904968][T10896] ? do_fast_syscall_32+0x33/0x70 [ 429.904989][T10896] ? lockdep_hardirqs_on+0x7a/0x110 [ 429.905009][T10896] ? asm_int80_emulation+0x1a/0x20 [ 429.905027][T10896] ? do_int80_emulation+0x286/0x530 [ 429.905047][T10896] ? trace_irq_disable+0x3b/0x140 [ 429.905076][T10896] do_fast_syscall_32+0x33/0x70 [ 429.905099][T10896] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 429.905118][T10896] RIP: 0023:0xf709f01c [ 429.905136][T10896] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 429.905150][T10896] RSP: 002b:00000000f548d50c EFLAGS: 00000206 ORIG_RAX: 0000000000000151 [ 429.905168][T10896] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080003840 [ 429.905179][T10896] RDX: 0000000000000001 RSI: 0000000000000020 RDI: 0000000000000000 [ 429.905189][T10896] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 429.905198][T10896] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 429.905209][T10896] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 429.905236][T10896] [ 430.278905][ T5741] usb 3-1: Limiting number of CPorts to U8_MAX [ 430.296283][ T5741] usb 3-1: Not enough endpoints found in device, aborting! [ 430.376079][ T47] usb 1-1: new high-speed USB device number 100 using dummy_hcd [ 430.450053][T10904] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 430.458972][T10904] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 430.493508][ T5741] usb 3-1: USB disconnect, device number 97 [ 430.538979][ T47] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 430.555972][ T47] usb 1-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 430.583844][ T47] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 430.601250][ T47] usb 1-1: config 0 descriptor?? [ 430.619018][ T47] pwc: Askey VC010 type 2 USB webcam detected. [ 430.826076][ T5705] usb 4-1: new high-speed USB device number 104 using dummy_hcd [ 430.847022][ T5741] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 430.896365][T10706] usb 2-1: new high-speed USB device number 93 using dummy_hcd [ 430.989503][ T5705] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 431.005049][ T5705] usb 4-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 431.017316][ T99] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 431.029282][ T5741] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 431.046119][ T5705] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 431.061102][ T5705] usb 4-1: config 0 descriptor?? [ 431.077497][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 431.104966][T10706] usb 2-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 431.126044][ T5705] pwc: Askey VC010 type 2 USB webcam detected. [ 431.135697][T10706] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 431.163751][T10706] usb 2-1: Product: syz [ 431.179944][T10706] usb 2-1: Manufacturer: syz [ 431.193920][T10706] usb 2-1: SerialNumber: syz [ 431.219065][T10706] usb 2-1: config 0 descriptor?? [ 431.536882][T10921] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1473'. [ 431.842915][T10706] usb 2-1: Firmware: major: 24, minor: 33, hardware type: ATUSB (2) [ 432.317068][T10926] vimc link validate: Sensor B:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 1:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 432.895340][T10932] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 432.928767][ T5741] net_ratelimit: 2 callbacks suppressed [ 432.928797][ T5741] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 432.934084][T10932] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 432.958096][T10706] usb 2-1: failed to fetch extended address, random address set [ 433.288454][ T5741] usb 2-1: USB disconnect, device number 93 [ 433.440089][ T47] pwc: send_video_command error -71 [ 433.490124][ T47] pwc: Failed to set video mode CIF@30 fps; return code = -71 [ 433.544103][ T47] Philips webcam 1-1:0.0: probe with driver Philips webcam failed with error -71 [ 433.584794][ T47] usb 1-1: USB disconnect, device number 100 [ 433.967238][ T5697] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 433.996326][ T47] usb 1-1: new high-speed USB device number 101 using dummy_hcd [ 434.042030][ T5705] pwc: recv_control_msg error -71 req 02 val 2b00 [ 434.064630][ T5705] pwc: recv_control_msg error -71 req 02 val 2700 [ 434.079557][ T5705] pwc: recv_control_msg error -71 req 02 val 2c00 [ 434.097740][ T5705] pwc: recv_control_msg error -71 req 04 val 1000 [ 434.108318][ T5705] pwc: recv_control_msg error -71 req 04 val 1300 [ 434.123815][ T5705] pwc: recv_control_msg error -71 req 04 val 1400 [ 434.131714][ T5705] pwc: recv_control_msg error -71 req 02 val 2000 [ 434.138898][ T5624] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 434.139520][ T5705] pwc: recv_control_msg error -71 req 02 val 2100 [ 434.154252][ T5705] pwc: recv_control_msg error -71 req 04 val 1500 [ 434.161522][ T47] usb 1-1: Using ep0 maxpacket: 8 [ 434.168999][ T5705] pwc: recv_control_msg error -71 req 02 val 2500 [ 434.176405][ T5705] pwc: recv_control_msg error -71 req 02 val 2400 [ 434.183279][ T47] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xEE, changing to 0x8E [ 434.195744][ T47] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 434.205784][ T5705] pwc: recv_control_msg error -71 req 02 val 2600 [ 434.213423][ T47] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 434.223461][ T5705] pwc: recv_control_msg error -71 req 02 val 2900 [ 434.232341][ T5705] pwc: recv_control_msg error -71 req 02 val 2800 [ 434.240557][ T47] usb 1-1: New USB device found, idVendor=187f, idProduct=0200, bcdDevice=6b.ad [ 434.251843][ T47] usb 1-1: New USB device strings: Mfr=55, Product=237, SerialNumber=3 [ 434.261561][ T5705] pwc: recv_control_msg error -71 req 04 val 1100 [ 434.269974][ T47] usb 1-1: Product: syz [ 434.274964][ T5705] pwc: recv_control_msg error -71 req 04 val 1200 [ 434.282877][ T47] usb 1-1: Manufacturer: syz [ 434.289966][ T5705] pwc: Registered as video103. [ 434.296484][ T47] usb 1-1: SerialNumber: syz [ 434.315238][ T5705] input: PWC snapshot button as /devices/platform/dummy_hcd.3/usb4/4-1/input/input109 [ 434.328714][ T47] usb 1-1: config 0 descriptor?? [ 434.342420][ T47] smsusb:smsusb_probe: board id=2, interface number 0 [ 434.356019][T10706] usb 3-1: new high-speed USB device number 98 using dummy_hcd [ 434.367264][ T47] smsusb:smsusb_probe: Device initialized with return code -19 [ 434.380506][ T5705] usb 4-1: USB disconnect, device number 104 [ 434.539556][T10706] usb 3-1: config 0 has an invalid interface number: 25 but max is 0 [ 434.555689][T10706] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 434.568645][T10706] usb 3-1: config 0 has no interface number 0 [ 434.575236][T10706] usb 3-1: config 0 interface 25 altsetting 205 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 434.590945][T10706] usb 3-1: config 0 interface 25 has no altsetting 0 [ 434.660812][T10706] usb 3-1: New USB device found, idVendor=1b3b, idProduct=2951, bcdDevice=9e.ee [ 434.675547][T10706] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 434.696169][T10706] usb 3-1: Product: syz [ 434.716111][T10706] usb 3-1: Manufacturer: syz [ 434.721936][T10706] usb 3-1: SerialNumber: syz [ 434.734925][T10706] usb 3-1: config 0 descriptor?? [ 434.747398][T10706] uvcvideo 3-1:0.25: Found Unit with invalid ID 0 [ 434.796459][ T5624] usb 2-1: new high-speed USB device number 94 using dummy_hcd [ 434.978495][ T5624] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 434.979347][T10948] veth1_to_hsr: entered promiscuous mode [ 434.991425][ T5624] usb 2-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 435.014966][ T5624] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 435.017221][ T5705] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 435.037164][T10948] macsec0: entered promiscuous mode [ 435.054613][T10948] macsec0: entered allmulticast mode [ 435.066579][ T5624] usb 2-1: config 0 descriptor?? [ 435.087420][T10948] veth1_to_hsr: entered allmulticast mode [ 435.097810][ T5624] pwc: Askey VC010 type 2 USB webcam detected. [ 435.155484][T10972] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 435.181848][T10972] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 435.219346][T10948] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 435.232646][T10948] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 435.242886][T10974] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1486'. [ 435.258724][T10706] uvcvideo 3-1:0.25: Found UVC 0.00 device syz (1b3b:2951) [ 435.267582][T10706] uvcvideo 3-1:0.25: No valid video chain found. [ 435.280184][T10974] fuse: Unknown parameter 'f' [ 435.283512][T10706] usb 3-1: USB disconnect, device number 98 [ 436.046481][ T5705] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 436.066953][T10984] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1487'. [ 436.088006][T10984] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1487'. [ 436.115119][T10984] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1487'. [ 436.606888][T10706] usb 1-1: USB disconnect, device number 101 [ 436.766519][ T13] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 436.775516][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 436.784326][ T5725] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 437.087912][ T5697] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 437.315987][T10706] usb 4-1: new high-speed USB device number 105 using dummy_hcd [ 437.336608][ T9] usb 1-1: new high-speed USB device number 102 using dummy_hcd [ 437.468538][T10706] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 437.479108][T10706] usb 4-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 437.489052][T10706] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 437.501149][ T9] usb 1-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 437.511155][T10706] usb 4-1: config 0 descriptor?? [ 437.521803][T10706] pwc: Askey VC010 type 2 USB webcam detected. [ 437.531203][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 437.541735][ T9] usb 1-1: Product: syz [ 437.548845][ T9] usb 1-1: Manufacturer: syz [ 437.553751][ T9] usb 1-1: SerialNumber: syz [ 437.564436][ T9] usb 1-1: config 0 descriptor?? [ 437.666669][ T5624] pwc: send_video_command error -71 [ 437.672763][ T5624] pwc: Failed to set video mode CIF@30 fps; return code = -71 [ 437.683476][ T5624] Philips webcam 2-1:0.0: probe with driver Philips webcam failed with error -71 [ 437.713494][ T5624] usb 2-1: USB disconnect, device number 94 [ 438.128888][ T5697] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 438.177437][ T9] usb 1-1: Firmware: major: 24, minor: 33, hardware type: ATUSB (2) [ 438.489460][T11005] vimc link validate: Sensor B:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 1:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 438.688323][ T5725] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 439.169480][ T5697] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 439.263423][ T9] usb 1-1: failed to fetch extended address, random address set [ 439.476549][ T5725] usb 3-1: new high-speed USB device number 99 using dummy_hcd [ 439.656890][ T5725] usb 3-1: Using ep0 maxpacket: 32 [ 439.677332][ T5725] usb 3-1: config 0 has an invalid interface number: 101 but max is 0 [ 439.697745][ T5725] usb 3-1: config 0 has no interface number 0 [ 439.716668][ T5725] usb 3-1: config 0 interface 101 has no altsetting 0 [ 439.759604][ T5725] usb 3-1: New USB device found, idVendor=0fe9, idProduct=d501, bcdDevice=23.50 [ 439.781353][ T5725] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 439.806384][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 439.818759][ T5725] usb 3-1: Product: syz [ 439.832143][ T5725] usb 3-1: Manufacturer: syz [ 439.857220][ T5725] usb 3-1: SerialNumber: syz [ 439.884189][ T5725] usb 3-1: config 0 descriptor?? [ 439.930557][ T5725] dvb-usb: found a 'DViCO FusionHDTV5 USB Gold' in warm state. [ 439.945147][ T5697] usb 1-1: USB disconnect, device number 102 [ 439.950262][ T5725] dvb-usb: bulk message failed: -22 (2/0) [ 439.968729][ T1314] ieee802154 phy0 wpan0: encryption failed: -22 [ 439.975087][ T1314] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.032456][ T5725] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 440.084835][ T5725] dvbdev: DVB: registering new adapter (DViCO FusionHDTV5 USB Gold) [ 440.120484][ T5725] usb 3-1: media controller created [ 440.151998][T11032] loop2: detected capacity change from 0 to 7 [ 440.207168][ T5705] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 440.220378][ T5725] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 440.231634][T11032] Dev loop2: unable to read RDB block 7 [ 440.248189][T11032] loop2: unable to read partition table [ 440.256772][T11032] loop2: partition table beyond EOD, truncated [ 440.302333][T11032] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 440.335504][ T5725] cxusb: set interface failed [ 440.350750][ T5725] dvb-usb: bulk message failed: -22 (1/0) [ 440.402148][T11044] input: syz0 as /devices/virtual/input/input110 [ 440.574073][ T5725] DVB: Unable to find symbol lgdt330x_attach() [ 440.595279][ T5725] dvb-usb: no frontend was attached by 'DViCO FusionHDTV5 USB Gold' [ 440.746178][ T5725] rc_core: IR keymap rc-dvico-portable not found [ 440.758053][ T5725] Registered IR keymap rc-empty [ 440.810130][ T5725] rc rc0: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.2/usb3/3-1/rc/rc0 [ 440.824659][T10706] pwc: send_video_command error -71 [ 440.839284][T10706] pwc: Failed to set video mode CIF@30 fps; return code = -71 [ 440.853343][ T5725] input: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.2/usb3/3-1/rc/rc0/input111 [ 440.864073][T11051] hsr0: entered promiscuous mode [ 440.864643][T10706] Philips webcam 4-1:0.0: probe with driver Philips webcam failed with error -71 [ 440.912534][ T5725] dvb-usb: schedule remote query interval to 100 msecs. [ 440.929247][T10706] usb 4-1: USB disconnect, device number 105 [ 440.948588][ T5725] dvb-usb: DViCO FusionHDTV5 USB Gold successfully initialized and connected. [ 440.969420][T11054] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1506'. [ 441.023231][ T5725] usb 3-1: USB disconnect, device number 99 [ 441.214234][ T5725] dvb-usb: DViCO FusionHDTV5 USB Gold successfully deinitialized and disconnected. [ 441.247493][ T5697] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 441.313449][T11054] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1506'. [ 441.325754][T11054] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1506'. [ 441.350061][T11060] netlink: 1752 bytes leftover after parsing attributes in process `syz.4.1508'. [ 441.554334][T11063] FAULT_INJECTION: forcing a failure. [ 441.554334][T11063] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 441.596058][T11063] CPU: 0 UID: 0 PID: 11063 Comm: syz.3.1509 Tainted: G L syzkaller #0 PREEMPT(full) [ 441.596088][T11063] Tainted: [L]=SOFTLOCKUP [ 441.596095][T11063] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 441.596107][T11063] Call Trace: [ 441.596115][T11063] [ 441.596123][T11063] dump_stack_lvl+0xe8/0x150 [ 441.596149][T11063] should_fail_ex+0x412/0x560 [ 441.596176][T11063] _copy_from_user+0x2d/0xb0 [ 441.596202][T11063] sctp_setsockopt+0x1c4/0x12c0 [ 441.596227][T11063] ? sock_common_setsockopt+0x36/0xc0 [ 441.596246][T11063] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 441.596266][T11063] do_sock_setsockopt+0x17c/0x1b0 [ 441.596293][T11063] __ia32_sys_setsockopt+0x13d/0x1b0 [ 441.596319][T11063] __do_fast_syscall_32+0x229/0x6e0 [ 441.596342][T11063] ? do_fast_syscall_32+0x33/0x70 [ 441.596362][T11063] ? lockdep_hardirqs_on+0x7a/0x110 [ 441.596382][T11063] ? asm_int80_emulation+0x1a/0x20 [ 441.596400][T11063] ? do_int80_emulation+0x286/0x530 [ 441.596421][T11063] ? trace_irq_disable+0x3b/0x140 [ 441.596452][T11063] do_fast_syscall_32+0x33/0x70 [ 441.596474][T11063] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 441.596496][T11063] RIP: 0023:0xf707f01c [ 441.596513][T11063] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 441.596529][T11063] RSP: 002b:00000000f546d50c EFLAGS: 00000206 ORIG_RAX: 000000000000016e [ 441.596549][T11063] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000000084 [ 441.596561][T11063] RDX: 0000000000000064 RSI: 0000000080000440 RDI: 000000000000001c [ 441.596573][T11063] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 441.596584][T11063] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 441.596595][T11063] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 441.596622][T11063] [ 441.881922][T11065] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(8) [ 441.888472][T11065] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 441.989042][T11065] vhci_hcd vhci_hcd.0: Device attached [ 442.051262][T11066] vhci_hcd: connection closed [ 442.054639][ T13] vhci_hcd vhci_hcd.4: stop threads [ 442.065685][ T13] vhci_hcd vhci_hcd.4: release socket [ 442.081788][ T13] vhci_hcd vhci_hcd.4: disconnect device [ 442.288274][ T5705] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 442.475991][ T5725] usb 4-1: new high-speed USB device number 106 using dummy_hcd [ 442.527476][T11093] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1519'. [ 442.536359][ T99] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 442.546199][ T5697] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 442.554833][ T24] usb 2-1: new high-speed USB device number 95 using dummy_hcd [ 442.556874][T10706] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 442.646984][ T5705] usb 3-1: new high-speed USB device number 100 using dummy_hcd [ 442.655945][ T5725] usb 4-1: Using ep0 maxpacket: 32 [ 442.668835][ T5725] usb 4-1: New USB device found, idVendor=0fd9, idProduct=0021, bcdDevice=29.40 [ 442.678327][ T5725] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 442.690914][ T5725] usb 4-1: config 0 descriptor?? [ 442.706013][ T24] usb 2-1: Using ep0 maxpacket: 32 [ 442.711739][T11093] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1519'. [ 442.713171][ T24] usb 2-1: config 0 has an invalid interface number: 101 but max is 0 [ 442.731431][ T24] usb 2-1: config 0 has no interface number 0 [ 442.731432][T11093] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1519'. [ 442.749331][ T24] usb 2-1: config 0 interface 101 has no altsetting 0 [ 442.759778][ T24] usb 2-1: New USB device found, idVendor=0fe9, idProduct=d501, bcdDevice=23.50 [ 442.769956][ T24] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 442.780638][ T24] usb 2-1: Product: syz [ 442.790113][ T24] usb 2-1: Manufacturer: syz [ 442.800229][ T24] usb 2-1: SerialNumber: syz [ 442.817532][ T24] usb 2-1: config 0 descriptor?? [ 442.829646][ T5705] usb 3-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 442.851958][ T24] dvb-usb: found a 'DViCO FusionHDTV5 USB Gold' in warm state. [ 442.865956][ T5705] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 442.876772][ T24] dvb-usb: bulk message failed: -22 (2/0) [ 442.884012][ T5705] usb 3-1: Product: syz [ 442.891542][T11097] netlink: 'syz.4.1520': attribute type 21 has an invalid length. [ 442.896253][ T5705] usb 3-1: Manufacturer: syz [ 442.905275][ T5705] usb 3-1: SerialNumber: syz [ 442.910770][ T5725] dvb-usb: found a 'Elgato EyeTV DTT' in warm state. [ 442.913911][ T24] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 442.934989][T11097] netlink: 132 bytes leftover after parsing attributes in process `syz.4.1520'. [ 442.951081][ T5705] usb 3-1: config 0 descriptor?? [ 442.954134][ T5725] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 442.958395][ T24] dvbdev: DVB: registering new adapter (DViCO FusionHDTV5 USB Gold) [ 442.984542][ T24] usb 2-1: media controller created [ 442.998572][ T5725] dvbdev: DVB: registering new adapter (Elgato EyeTV DTT) [ 443.006768][ T5725] usb 4-1: media controller created [ 443.025216][ T24] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 443.048214][ T24] cxusb: set interface failed [ 443.058230][ T5725] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 443.060465][T11088] loop2: detected capacity change from 0 to 7 [ 443.073388][ T24] dvb-usb: bulk message failed: -22 (1/0) [ 443.090442][T11088] Dev loop2: unable to read RDB block 7 [ 443.109509][T11088] loop2: unable to read partition table [ 443.117104][T11088] loop2: partition table beyond EOD, truncated [ 443.128149][T11088] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 443.151944][ T24] DVB: Unable to find symbol lgdt330x_attach() [ 443.179071][ T4991] Dev loop2: unable to read RDB block 7 [ 443.184783][ T24] dvb-usb: no frontend was attached by 'DViCO FusionHDTV5 USB Gold' [ 443.187213][ T4991] loop2: unable to read partition table [ 443.201307][ T4991] loop2: partition table beyond EOD, truncated [ 443.208149][ T5725] DVB: Unable to find symbol dib7000p_attach() [ 443.219594][ T5725] dvb-usb: no frontend was attached by 'Elgato EyeTV DTT' [ 443.258624][T10706] usb 1-1: new high-speed USB device number 103 using dummy_hcd [ 443.286683][ T24] rc_core: IR keymap rc-dvico-portable not found [ 443.299259][ T24] Registered IR keymap rc-empty [ 443.311215][ T24] rc rc0: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.1/usb2/2-1/rc/rc0 [ 443.323519][ T24] input: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.1/usb2/2-1/rc/rc0/input112 [ 443.335274][ T5697] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 443.345990][ T5725] rc_core: IR keymap rc-dib0700-rc5 not found [ 443.353207][ T5725] Registered IR keymap rc-empty [ 443.354185][ T24] dvb-usb: schedule remote query interval to 100 msecs. [ 443.365563][ T24] dvb-usb: DViCO FusionHDTV5 USB Gold successfully initialized and connected. [ 443.366481][ T5725] dvb-usb: could not initialize remote control. [ 443.379535][ T24] usb 2-1: USB disconnect, device number 95 [ 443.385028][ T5725] dvb-usb: Elgato EyeTV DTT successfully initialized and connected. [ 443.426590][ T5725] usb 4-1: USB disconnect, device number 106 [ 443.441361][T10706] usb 1-1: config 0 has an invalid interface number: 25 but max is 0 [ 443.458860][T10706] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 443.486307][T10706] usb 1-1: config 0 has no interface number 0 [ 443.493541][T10706] usb 1-1: config 0 interface 25 altsetting 205 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 443.527017][T10706] usb 1-1: config 0 interface 25 has no altsetting 0 [ 443.531497][ T24] dvb-usb: DViCO FusionHDTV5 USB Gold successfully deinitialized and disconnected. [ 443.533868][ T5725] dvb-usb: Elgato EyeTV DTT successfully deinitialized and disconnected. [ 443.559757][T10706] usb 1-1: New USB device found, idVendor=1b3b, idProduct=2951, bcdDevice=9e.ee [ 443.569230][T10706] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 443.578111][T10706] usb 1-1: Product: syz [ 443.584612][T10706] usb 1-1: Manufacturer: syz [ 443.589836][T10706] usb 1-1: SerialNumber: syz [ 443.600516][T10706] usb 1-1: config 0 descriptor?? [ 443.603805][ T5705] usb 3-1: Firmware: major: 24, minor: 33, hardware type: ATUSB (2) [ 443.614320][T10706] uvcvideo 1-1:0.25: Found Unit with invalid ID 0 [ 443.723369][T11108] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3303861288 (422894244864 ns) > initial count (241705619456 ns). Using initial count to start timer. [ 443.747291][T11108] kvm: apic: phys broadcast and lowest prio [ 443.954517][T11101] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 443.963709][T11091] vimc link validate: Sensor B:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 1:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 443.987303][T11101] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 444.027593][T10706] uvcvideo 1-1:0.25: Found UVC 0.00 device syz (1b3b:2951) [ 444.039407][T10706] uvcvideo 1-1:0.25: No valid video chain found. [ 444.055847][T10706] usb 1-1: USB disconnect, device number 103 [ 444.069379][T11115] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 444.085742][T11115] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 444.226023][ T24] usb 2-1: new high-speed USB device number 96 using dummy_hcd [ 444.336021][ T5725] usb 4-1: new full-speed USB device number 107 using dummy_hcd [ 444.366666][ T47] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 444.376674][ T24] usb 2-1: Using ep0 maxpacket: 8 [ 444.383355][ T24] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xEE, changing to 0x8E [ 444.395177][ T24] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 444.405201][ T24] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 444.417687][ T24] usb 2-1: New USB device found, idVendor=187f, idProduct=0200, bcdDevice=6b.ad [ 444.427223][ T24] usb 2-1: New USB device strings: Mfr=55, Product=237, SerialNumber=3 [ 444.435583][ T24] usb 2-1: Product: syz [ 444.439876][ T24] usb 2-1: Manufacturer: syz [ 444.444508][ T24] usb 2-1: SerialNumber: syz [ 444.452625][ T24] usb 2-1: config 0 descriptor?? [ 444.463884][ T24] smsusb:smsusb_probe: board id=2, interface number 0 [ 444.471577][ T24] smsusb:smsusb_probe: Device initialized with return code -19 [ 444.507759][ T5725] usb 4-1: config 0 has an invalid interface number: 147 but max is 0 [ 444.516450][ T5725] usb 4-1: config 0 has no interface number 0 [ 444.522679][ T5725] usb 4-1: config 0 interface 147 altsetting 0 endpoint 0x2 has invalid maxpacket 512, setting to 64 [ 444.536725][ T5725] usb 4-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=51.03 [ 444.547053][ T5725] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 444.555110][ T5725] usb 4-1: Product: syz [ 444.560718][ T5725] usb 4-1: Manufacturer: syz [ 444.565350][ T5725] usb 4-1: SerialNumber: syz [ 444.572728][ T5725] usb 4-1: config 0 descriptor?? [ 444.578817][T11117] raw-gadget.4 gadget.3: fail, usb_ep_enable returned -22 [ 444.596097][ T5725] usb 4-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 444.686627][ T5705] usb 3-1: failed to fetch extended address, random address set [ 444.754888][T11125] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1526'. [ 444.819629][T11117] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 444.833866][T11117] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 444.851528][ T1157] usb 4-1: Failed to submit usb control message: -71 [ 444.862756][ T5725] usb 4-1: USB disconnect, device number 107 [ 444.871721][ T1157] usb 4-1: unable to send the bmi data to the device: -71 [ 444.891221][ T1157] usb 4-1: unable to get target info from device [ 444.903674][T11127] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 444.912159][T11127] IPv6: NLM_F_CREATE should be set when creating new route [ 444.915979][ T1157] usb 4-1: could not get target info (-71) [ 444.933577][ T1157] usb 4-1: could not probe fw (-71) [ 445.184261][ T5725] usb 3-1: USB disconnect, device number 100 [ 445.260776][T11135] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1531'. [ 445.338098][ T9] usb 1-1: new high-speed USB device number 104 using dummy_hcd [ 445.408048][ T5705] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 445.508940][ T9] usb 1-1: unable to get BOS descriptor or descriptor too short [ 445.519594][ T9] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 445.540686][ T9] usb 1-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 445.555213][ T9] usb 1-1: config 1 interface 1 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 445.572984][ T9] usb 1-1: string descriptor 0 read error: -22 [ 445.579795][ T9] usb 1-1: New USB device found, idVendor=1235, idProduct=800c, bcdDevice= 0.40 [ 445.589027][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 445.607856][ T9] usb 1-1: unit 4 not found! [ 445.646322][ T5725] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 445.664748][T11142] 8021q: adding VLAN 0 to HW filter on device bond2 [ 445.706594][T11142] ipvlan2: entered allmulticast mode [ 445.712034][T11142] bond2: entered allmulticast mode [ 445.726022][ T5705] usb 4-1: new high-speed USB device number 108 using dummy_hcd [ 445.766025][ T24] usb 3-1: new high-speed USB device number 101 using dummy_hcd [ 445.877793][ T5705] usb 4-1: config 0 has an invalid interface number: 25 but max is 0 [ 445.894968][ T5705] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 445.909434][ T5705] usb 4-1: config 0 has no interface number 0 [ 445.921757][ T5705] usb 4-1: config 0 interface 25 altsetting 205 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 445.935557][ T24] usb 3-1: Using ep0 maxpacket: 32 [ 445.940809][ T5705] usb 4-1: config 0 interface 25 has no altsetting 0 [ 445.949517][ T24] usb 3-1: config 0 has an invalid interface number: 101 but max is 0 [ 445.957999][ T24] usb 3-1: config 0 has no interface number 0 [ 445.964195][ T24] usb 3-1: config 0 interface 101 has no altsetting 0 [ 445.971969][ T5705] usb 4-1: New USB device found, idVendor=1b3b, idProduct=2951, bcdDevice=9e.ee [ 445.978738][T11149] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 445.982605][ T5705] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 445.993904][T11149] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 446.000020][ T5705] usb 4-1: Product: syz [ 446.010432][ T5705] usb 4-1: Manufacturer: syz [ 446.015313][ T5705] usb 4-1: SerialNumber: syz [ 446.021051][ T24] usb 3-1: New USB device found, idVendor=0fe9, idProduct=d501, bcdDevice=23.50 [ 446.030441][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 446.041643][ T24] usb 3-1: Product: syz [ 446.050241][ T5705] usb 4-1: config 0 descriptor?? [ 446.071031][ T5705] uvcvideo 4-1:0.25: Found Unit with invalid ID 0 [ 446.078085][ T24] usb 3-1: Manufacturer: syz [ 446.093100][ T24] usb 3-1: SerialNumber: syz [ 446.103627][ T24] usb 3-1: config 0 descriptor?? [ 446.120963][ T24] dvb-usb: found a 'DViCO FusionHDTV5 USB Gold' in warm state. [ 446.132027][ T47] usb 1-1: USB disconnect, device number 104 [ 446.151700][ T24] dvb-usb: bulk message failed: -22 (2/0) [ 446.154881][T11147] vimc link validate: Sensor B:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 1:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 446.178876][ T24] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 446.212230][ T24] dvbdev: DVB: registering new adapter (DViCO FusionHDTV5 USB Gold) [ 446.232281][ T24] usb 3-1: media controller created [ 446.272595][ T24] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 446.300523][T11138] veth1_to_hsr: entered promiscuous mode [ 446.313340][T11138] macsec2: entered promiscuous mode [ 446.325395][T11140] loop2: detected capacity change from 0 to 7 [ 446.334945][ T24] cxusb: set interface failed [ 446.341832][T11138] macsec2: entered allmulticast mode [ 446.343842][ T24] dvb-usb: bulk message failed: -22 (1/0) [ 446.352214][T11140] Dev loop2: unable to read RDB block 7 [ 446.372082][T11138] veth1_to_hsr: entered allmulticast mode [ 446.385085][T11140] loop2: unable to read partition table [ 446.401025][ T24] DVB: Unable to find symbol lgdt330x_attach() [ 446.407530][ T24] dvb-usb: no frontend was attached by 'DViCO FusionHDTV5 USB Gold' [ 446.410021][T11140] loop2: partition table beyond EOD, [ 446.424075][ T5705] uvcvideo 4-1:0.25: Found UVC 0.00 device syz (1b3b:2951) [ 446.431795][T11140] truncated [ 446.448346][ T5741] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 446.461509][T11140] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 446.466165][ T5705] uvcvideo 4-1:0.25: No valid video chain found. [ 446.501132][ T5705] usb 4-1: USB disconnect, device number 108 [ 446.557386][ T24] rc_core: IR keymap rc-dvico-portable not found [ 446.573598][ T24] Registered IR keymap rc-empty [ 446.579578][ T24] rc rc0: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.2/usb3/3-1/rc/rc0 [ 446.591451][ T24] input: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.2/usb3/3-1/rc/rc0/input114 [ 446.603524][ T24] dvb-usb: schedule remote query interval to 100 msecs. [ 446.611103][ T24] dvb-usb: DViCO FusionHDTV5 USB Gold successfully initialized and connected. [ 446.623176][ T24] usb 3-1: USB disconnect, device number 101 [ 446.709439][ T24] dvb-usb: DViCO FusionHDTV5 USB Gold successfully deinitialized and disconnected. [ 446.914292][ T24] usb 2-1: USB disconnect, device number 96 [ 447.037910][ T9] usb 1-1: new low-speed USB device number 105 using dummy_hcd [ 447.089855][T11162] FAULT_INJECTION: forcing a failure. [ 447.089855][T11162] name failslab, interval 1, probability 0, space 0, times 0 [ 447.133911][T11162] CPU: 1 UID: 0 PID: 11162 Comm: syz.4.1540 Tainted: G L syzkaller #0 PREEMPT(full) [ 447.133942][T11162] Tainted: [L]=SOFTLOCKUP [ 447.133950][T11162] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 447.133961][T11162] Call Trace: [ 447.133969][T11162] [ 447.133977][T11162] dump_stack_lvl+0xe8/0x150 [ 447.134004][T11162] should_fail_ex+0x412/0x560 [ 447.134029][T11162] should_failslab+0xa8/0x100 [ 447.134056][T11162] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 447.134078][T11162] ? __alloc_skb+0x186/0x7d0 [ 447.134096][T11162] ? __alloc_skb+0x1d0/0x7d0 [ 447.134113][T11162] ? __local_bh_enable_ip+0xd0/0x130 [ 447.134137][T11162] __alloc_skb+0x1d0/0x7d0 [ 447.134161][T11162] netlink_sendmsg+0x5d4/0xb40 [ 447.134193][T11162] ? __pfx_netlink_sendmsg+0x10/0x10 [ 447.134218][T11162] ? aa_sock_msg_perm+0xf1/0x1b0 [ 447.134243][T11162] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 447.134271][T11162] ____sys_sendmsg+0x972/0x9f0 [ 447.134302][T11162] ? __pfx_____sys_sendmsg+0x10/0x10 [ 447.134328][T11162] ? kstrtoull+0x12f/0x1d0 [ 447.134356][T11162] ___sys_sendmsg+0x2a5/0x360 [ 447.134378][T11162] ? __lock_acquire+0x6b5/0x2cf0 [ 447.134402][T11162] ? __pfx____sys_sendmsg+0x10/0x10 [ 447.134427][T11162] ? get_pid_task+0x20/0x1f0 [ 447.134448][T11162] ? get_pid_task+0x20/0x1f0 [ 447.134466][T11162] ? get_pid_task+0x20/0x1f0 [ 447.134509][T11162] ? __fget_files+0x2a/0x420 [ 447.134536][T11162] ? __fget_files+0x3a0/0x420 [ 447.134567][T11162] __sys_sendmsg+0x183/0x260 [ 447.134592][T11162] ? __pfx___sys_sendmsg+0x10/0x10 [ 447.134635][T11162] __do_fast_syscall_32+0x229/0x6e0 [ 447.134658][T11162] ? do_fast_syscall_32+0x33/0x70 [ 447.134677][T11162] ? lockdep_hardirqs_on+0x7a/0x110 [ 447.134696][T11162] ? asm_int80_emulation+0x1a/0x20 [ 447.134713][T11162] ? do_int80_emulation+0x286/0x530 [ 447.134732][T11162] ? trace_irq_disable+0x3b/0x140 [ 447.134759][T11162] do_fast_syscall_32+0x33/0x70 [ 447.134780][T11162] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 447.134800][T11162] RIP: 0023:0xf7f3801c [ 447.134816][T11162] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 447.134830][T11162] RSP: 002b:00000000f53f650c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 447.134850][T11162] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000080000200 [ 447.134862][T11162] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 447.134873][T11162] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 447.134883][T11162] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 447.134893][T11162] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 447.134919][T11162] [ 447.196177][ T9] usb 1-1: device descriptor read/64, error -71 [ 447.336232][ T5705] usb 4-1: new high-speed USB device number 109 using dummy_hcd [ 447.425944][ T24] usb 2-1: new high-speed USB device number 97 using dummy_hcd [ 447.486442][T10706] usb 3-1: new high-speed USB device number 102 using dummy_hcd [ 447.494511][ T47] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 447.524661][T11168] binder: 11165:11168 ioctl c0306201 80000040 returned -14 [ 447.596003][ T9] usb 1-1: new low-speed USB device number 106 using dummy_hcd [ 447.605988][ T24] usb 2-1: Using ep0 maxpacket: 16 [ 447.612961][ T5705] usb 4-1: config 0 has an invalid interface number: 25 but max is 0 [ 447.621447][ T5705] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 447.631802][ T5705] usb 4-1: config 0 has no interface number 0 [ 447.638024][ T5705] usb 4-1: config 0 interface 25 altsetting 205 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 447.651733][ T5705] usb 4-1: config 0 interface 25 has no altsetting 0 [ 447.662044][T10706] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 447.662358][ T5705] usb 4-1: New USB device found, idVendor=1b3b, idProduct=2951, bcdDevice=9e.ee [ 447.673248][T10706] usb 3-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 447.691252][ T24] usb 2-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice= 4.00 [ 447.691344][T10706] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 447.700725][ T24] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 447.716836][T10706] usb 3-1: config 0 descriptor?? [ 447.721529][T10706] pwc: Askey VC010 type 2 USB webcam detected. [ 447.722833][ T5705] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 447.729770][ T9] usb 1-1: device descriptor read/64, error -71 [ 447.736374][ T5705] usb 4-1: Product: syz [ 447.746882][ T24] usb 2-1: Product: syz [ 447.751087][ T24] usb 2-1: Manufacturer: syz [ 447.755689][ T24] usb 2-1: SerialNumber: syz [ 447.760433][ T5705] usb 4-1: Manufacturer: syz [ 447.766490][ T5705] usb 4-1: SerialNumber: syz [ 447.772633][ T24] usb 2-1: config 0 descriptor?? [ 447.781584][ T24] ftdi_sio 2-1:0.0: FTDI USB Serial Device converter detected [ 447.793673][ T5705] usb 4-1: config 0 descriptor?? [ 447.802181][ T5705] uvcvideo 4-1:0.25: Found Unit with invalid ID 0 [ 447.810340][ T24] usb 2-1: Detected FT232B [ 447.856485][ T9] usb usb1-port1: attempt power cycle [ 448.096835][T11160] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 448.121251][T11160] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 448.153103][ T24] ftdi_sio ttyUSB0: Unable to read latency timer: -71 [ 448.164936][ T24] ftdi_sio ttyUSB0: Unable to write latency timer: -71 [ 448.176803][ T24] usb 2-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 448.204171][ T24] usb 2-1: USB disconnect, device number 97 [ 448.216344][ T9] usb 1-1: new low-speed USB device number 107 using dummy_hcd [ 448.231467][T11160] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 448.252614][T11160] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 448.264121][ T9] usb 1-1: device descriptor read/8, error -71 [ 448.267695][ T24] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 448.290266][ T5624] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 448.292865][T11166] binder: 11165:11166 ioctl c0306201 80000180 returned -14 [ 448.311863][ T24] ftdi_sio 2-1:0.0: device disconnected [ 448.324188][ T5705] uvcvideo 4-1:0.25: Found UVC 0.00 device syz (1b3b:2951) [ 448.345212][ T5705] uvcvideo 4-1:0.25: No valid video chain found. [ 448.396560][ T5705] usb 4-1: USB disconnect, device number 109 [ 448.461626][T11175] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 448.484162][T11175] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 448.526531][ T47] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 448.535731][T11175] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 448.546057][ T9] usb 1-1: new low-speed USB device number 108 using dummy_hcd [ 448.561786][T11175] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 448.576809][ T9] usb 1-1: device descriptor read/8, error -71 [ 448.686164][ T5624] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 448.694798][ T9] usb usb1-port1: unable to enumerate USB device [ 449.286399][ T5705] usb 2-1: new full-speed USB device number 98 using dummy_hcd [ 449.358401][T11187] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 449.384684][T11187] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 449.442267][T11187] veth1_to_hsr: entered promiscuous mode [ 449.461538][T11187] macsec2: entered promiscuous mode [ 449.480170][T11187] macsec2: entered allmulticast mode [ 449.522795][T11187] veth1_to_hsr: entered allmulticast mode [ 449.561268][ T5705] usb 2-1: config 93 has an invalid interface number: 116 but max is 0 [ 449.586270][ T5705] usb 2-1: config 93 has an invalid descriptor of length 251, skipping remainder of the config [ 449.603954][ T47] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 449.633180][ T5705] usb 2-1: config 93 has no interface number 0 [ 449.646175][ T5705] usb 2-1: config 93 interface 116 has no altsetting 0 [ 449.682910][ T5705] usb 2-1: New USB device found, idVendor=18ec, idProduct=3290, bcdDevice= a.66 [ 449.694554][T11187] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 449.708559][T11187] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 449.725508][ T5705] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 449.775234][ T5705] usb 2-1: Product: syz [ 449.783657][ T5705] usb 2-1: Manufacturer: syz [ 449.808105][ T5705] usb 2-1: SerialNumber: syz [ 449.873892][T11193] __nla_validate_parse: 4 callbacks suppressed [ 449.873905][T11193] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1548'. [ 450.330105][T11193] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1548'. [ 450.356353][T11193] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1548'. [ 450.476427][T11195] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 450.486762][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 450.606988][ T47] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 450.980719][T11205] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 451.011855][T11205] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 451.062942][T11205] loop2: detected capacity change from 0 to 7 [ 451.110213][T11205] Dev loop2: unable to read RDB block 7 [ 451.170528][T11205] loop2: unable to read partition table [ 451.205021][T11205] loop2: partition table beyond EOD, truncated [ 451.232375][T10706] pwc: send_video_command error -71 [ 451.256021][T11205] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 451.283185][T10706] pwc: Failed to set video mode CIF@30 fps; return code = -71 [ 451.309196][T10706] Philips webcam 3-1:0.0: probe with driver Philips webcam failed with error -71 [ 451.361340][ T4991] Dev loop2: unable to read RDB block 7 [ 451.364814][T10706] usb 3-1: USB disconnect, device number 102 [ 451.388727][ T4991] loop2: unable to read partition table [ 451.402382][ T4991] loop2: partition table beyond EOD, truncated [ 451.646619][ T47] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 451.727446][T10706] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 452.044289][T11209] bond2 (unregistering): Released all slaves [ 452.161460][T11221] FAULT_INJECTION: forcing a failure. [ 452.161460][T11221] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 452.222364][T11221] CPU: 0 UID: 0 PID: 11221 Comm: syz.4.1554 Tainted: G L syzkaller #0 PREEMPT(full) [ 452.222389][T11221] Tainted: [L]=SOFTLOCKUP [ 452.222396][T11221] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 452.222407][T11221] Call Trace: [ 452.222415][T11221] [ 452.222424][T11221] dump_stack_lvl+0xe8/0x150 [ 452.222450][T11221] should_fail_ex+0x412/0x560 [ 452.222476][T11221] _copy_from_user+0x2d/0xb0 [ 452.222492][T11221] move_addr_to_kernel+0x7e/0x160 [ 452.222508][T11221] get_compat_msghdr+0x3d8/0x4c0 [ 452.222525][T11221] ? __pfx_get_compat_msghdr+0x10/0x10 [ 452.222543][T11221] ? kstrtoull+0x12f/0x1d0 [ 452.222570][T11221] ___sys_sendmsg+0x201/0x360 [ 452.222593][T11221] ? __lock_acquire+0x6b5/0x2cf0 [ 452.222627][T11221] ? __pfx____sys_sendmsg+0x10/0x10 [ 452.222641][T11221] ? get_pid_task+0x20/0x1f0 [ 452.222654][T11221] ? get_pid_task+0x20/0x1f0 [ 452.222665][T11221] ? get_pid_task+0x20/0x1f0 [ 452.222692][T11221] ? __fget_files+0x2a/0x420 [ 452.222713][T11221] ? __fget_files+0x3a0/0x420 [ 452.222743][T11221] __sys_sendmsg+0x183/0x260 [ 452.222768][T11221] ? __pfx___sys_sendmsg+0x10/0x10 [ 452.222800][T11221] __do_fast_syscall_32+0x229/0x6e0 [ 452.222814][T11221] ? do_fast_syscall_32+0x33/0x70 [ 452.222824][T11221] ? lockdep_hardirqs_on+0x7a/0x110 [ 452.222835][T11221] ? asm_int80_emulation+0x1a/0x20 [ 452.222851][T11221] ? do_int80_emulation+0x286/0x530 [ 452.222872][T11221] ? trace_irq_disable+0x3b/0x140 [ 452.222899][T11221] do_fast_syscall_32+0x33/0x70 [ 452.222922][T11221] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 452.222938][T11221] RIP: 0023:0xf7f3801c [ 452.222949][T11221] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 452.222957][T11221] RSP: 002b:00000000f53f650c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 452.222969][T11221] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000080001c00 [ 452.222976][T11221] RDX: 0000000020008b88 RSI: 0000000000000000 RDI: 0000000000000000 [ 452.222982][T11221] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 452.222987][T11221] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 452.222996][T11221] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 452.223022][T11221] [ 452.515900][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 452.634873][ T5705] usb 2-1: USB disconnect, device number 98 [ 452.706953][ T1221] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 452.837019][T11225] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1557'. [ 453.096060][ T47] usb 3-1: new full-speed USB device number 103 using dummy_hcd [ 453.114677][T11225] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1557'. [ 453.125179][T11225] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1557'. [ 453.166600][ T5705] usb 2-1: new high-speed USB device number 99 using dummy_hcd [ 453.248459][ T47] usb 3-1: config 0 has an invalid interface number: 147 but max is 0 [ 453.259723][ T47] usb 3-1: config 0 has no interface number 0 [ 453.266441][ T47] usb 3-1: config 0 interface 147 altsetting 0 endpoint 0x2 has invalid maxpacket 512, setting to 64 [ 453.279430][T11236] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 453.291468][ T47] usb 3-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=51.03 [ 453.304273][T11236] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 453.318632][ T47] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 453.328136][ T47] usb 3-1: Product: syz [ 453.332979][ T47] usb 3-1: Manufacturer: syz [ 453.338050][ T5705] usb 2-1: config 0 has an invalid interface number: 25 but max is 0 [ 453.347317][ T5705] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 453.359667][ T47] usb 3-1: SerialNumber: syz [ 453.366389][ T5705] usb 2-1: config 0 has no interface number 0 [ 453.373779][ T47] usb 3-1: config 0 descriptor?? [ 453.380081][ T5705] usb 2-1: config 0 interface 25 altsetting 205 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 453.393905][T11228] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 453.402074][ T5705] usb 2-1: config 0 interface 25 has no altsetting 0 [ 453.415186][ T5705] usb 2-1: New USB device found, idVendor=1b3b, idProduct=2951, bcdDevice=9e.ee [ 453.425544][ T5705] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 453.436817][ T47] usb 3-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 453.446567][ T5705] usb 2-1: Product: syz [ 453.452532][ T5705] usb 2-1: Manufacturer: syz [ 453.460338][ T5705] usb 2-1: SerialNumber: syz [ 453.468893][ T5705] usb 2-1: config 0 descriptor?? [ 453.478000][ T5705] uvcvideo 2-1:0.25: Found Unit with invalid ID 0 [ 453.577775][T11244] FAULT_INJECTION: forcing a failure. [ 453.577775][T11244] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 453.593157][T11244] CPU: 0 UID: 0 PID: 11244 Comm: syz.3.1560 Tainted: G L syzkaller #0 PREEMPT(full) [ 453.593186][T11244] Tainted: [L]=SOFTLOCKUP [ 453.593193][T11244] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 453.593202][T11244] Call Trace: [ 453.593210][T11244] [ 453.593217][T11244] dump_stack_lvl+0xe8/0x150 [ 453.593244][T11244] should_fail_ex+0x412/0x560 [ 453.593269][T11244] _copy_from_user+0x2d/0xb0 [ 453.593295][T11244] move_addr_to_kernel+0x7e/0x160 [ 453.593322][T11244] get_compat_msghdr+0x3d8/0x4c0 [ 453.593350][T11244] ? __pfx_get_compat_msghdr+0x10/0x10 [ 453.593375][T11244] ? kstrtoull+0x12f/0x1d0 [ 453.593399][T11244] ___sys_sendmsg+0x201/0x360 [ 453.593420][T11244] ? __lock_acquire+0x6b5/0x2cf0 [ 453.593442][T11244] ? __pfx____sys_sendmsg+0x10/0x10 [ 453.593466][T11244] ? irqentry_exit+0x218/0x730 [ 453.593486][T11244] ? lockdep_hardirqs_on+0x7a/0x110 [ 453.593505][T11244] ? irqentry_exit+0x218/0x730 [ 453.593524][T11244] ? trace_irq_disable+0x3b/0x140 [ 453.593573][T11244] ? __fget_files+0x2a/0x420 [ 453.593588][T11244] ? __fget_files+0x3a0/0x420 [ 453.593604][T11244] __sys_sendmsg+0x183/0x260 [ 453.593618][T11244] ? __pfx___sys_sendmsg+0x10/0x10 [ 453.593652][T11244] __do_fast_syscall_32+0x229/0x6e0 [ 453.593676][T11244] ? do_fast_syscall_32+0x33/0x70 [ 453.593696][T11244] ? lockdep_hardirqs_on+0x7a/0x110 [ 453.593715][T11244] ? asm_int80_emulation+0x1a/0x20 [ 453.593732][T11244] ? do_int80_emulation+0x286/0x530 [ 453.593751][T11244] ? trace_irq_disable+0x3b/0x140 [ 453.593777][T11244] do_fast_syscall_32+0x33/0x70 [ 453.593799][T11244] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 453.593820][T11244] RIP: 0023:0xf707f01c [ 453.593838][T11244] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 453.593853][T11244] RSP: 002b:00000000f546d50c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 453.593872][T11244] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000080000080 [ 453.593883][T11244] RDX: 0000000000000060 RSI: 0000000000000000 RDI: 0000000000000000 [ 453.593889][T11244] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 453.593895][T11244] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 453.593905][T11244] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 453.593919][T11244] [ 453.624575][T11228] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 453.842992][ T47] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 453.851254][T11228] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 453.874503][T11227] veth1_to_hsr: entered promiscuous mode [ 453.882041][T11227] macsec2: entered promiscuous mode [ 453.902816][ T35] usb 3-1: Failed to submit usb control message: -71 [ 453.903201][ T5741] usb 3-1: USB disconnect, device number 103 [ 453.925211][T11227] macsec2: entered allmulticast mode [ 453.932551][ T35] usb 3-1: unable to send the bmi data to the device: -71 [ 453.940974][T11227] veth1_to_hsr: entered allmulticast mode [ 453.968579][ T35] usb 3-1: unable to get target info from device [ 453.983476][ T35] usb 3-1: could not get target info (-71) [ 454.005800][ T35] usb 3-1: could not probe fw (-71) [ 454.098297][T11227] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 454.147627][T11227] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 454.195529][T11253] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1564'. [ 454.229210][T11227] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 454.256781][T11227] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 454.288039][ T5705] uvcvideo 2-1:0.25: Found UVC 0.00 device syz (1b3b:2951) [ 454.321218][ T5705] uvcvideo 2-1:0.25: No valid video chain found. [ 454.330041][T11258] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1563'. [ 454.330057][T11258] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1563'. [ 454.330773][T11258] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1563'. [ 454.336833][ T5705] usb 2-1: USB disconnect, device number 99 [ 454.648856][T11263] loop8: detected capacity change from 0 to 8 [ 454.661521][T11263] Dev loop8: unable to read RDB block 8 [ 454.671876][T11263] loop8: unable to read partition table [ 454.679513][T11263] loop8: partition table beyond EOD, truncated [ 454.691801][T11263] loop_reread_partitions: partition scan of loop8 (þ被xü^>Ñà– ) failed (rc=-5) [ 454.777025][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 454.846198][ T5705] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 455.034328][T11267] mac80211_hwsim hwsim4 syzkaller0: left promiscuous mode [ 455.043003][T11267] mac80211_hwsim hwsim4 syzkaller0: left allmulticast mode [ 455.185194][T11272] openvswitch: netlink: IPv4 tunnel dst address is zero [ 455.317766][ T5741] usb 2-1: new high-speed USB device number 100 using dummy_hcd [ 455.347515][T11278] netlink: 'syz.0.1571': attribute type 1 has an invalid length. [ 455.394056][T11278] netlink: 'syz.0.1571': attribute type 1 has an invalid length. [ 455.431853][T11278] netlink: 212276 bytes leftover after parsing attributes in process `syz.0.1571'. [ 455.539820][ T5741] usb 2-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 455.561568][ T5741] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 455.600023][ T5741] usb 2-1: Product: syz [ 455.614427][ T5741] usb 2-1: Manufacturer: syz [ 455.632642][ T5741] usb 2-1: SerialNumber: syz [ 455.658052][ T5741] usb 2-1: config 0 descriptor?? [ 455.886148][ T47] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 456.131229][T11292] FAULT_INJECTION: forcing a failure. [ 456.131229][T11292] name failslab, interval 1, probability 0, space 0, times 0 [ 456.188975][T11292] CPU: 0 UID: 0 PID: 11292 Comm: syz.2.1573 Tainted: G L syzkaller #0 PREEMPT(full) [ 456.189006][T11292] Tainted: [L]=SOFTLOCKUP [ 456.189013][T11292] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 456.189024][T11292] Call Trace: [ 456.189032][T11292] [ 456.189041][T11292] dump_stack_lvl+0xe8/0x150 [ 456.189068][T11292] should_fail_ex+0x412/0x560 [ 456.189096][T11292] should_failslab+0xa8/0x100 [ 456.189122][T11292] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 456.189145][T11292] ? __alloc_skb+0x186/0x7d0 [ 456.189163][T11292] ? __alloc_skb+0x1d0/0x7d0 [ 456.189180][T11292] ? __local_bh_enable_ip+0xd0/0x130 [ 456.189204][T11292] __alloc_skb+0x1d0/0x7d0 [ 456.189227][T11292] netlink_sendmsg+0x5d4/0xb40 [ 456.189258][T11292] ? __pfx_netlink_sendmsg+0x10/0x10 [ 456.189283][T11292] ? aa_sock_msg_perm+0xf1/0x1b0 [ 456.189308][T11292] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 456.189335][T11292] ____sys_sendmsg+0x972/0x9f0 [ 456.189371][T11292] ? __pfx_____sys_sendmsg+0x10/0x10 [ 456.189399][T11292] ? kstrtoull+0x12f/0x1d0 [ 456.189426][T11292] ___sys_sendmsg+0x2a5/0x360 [ 456.189447][T11292] ? __lock_acquire+0x6b5/0x2cf0 [ 456.189471][T11292] ? __pfx____sys_sendmsg+0x10/0x10 [ 456.189496][T11292] ? get_pid_task+0x20/0x1f0 [ 456.189518][T11292] ? get_pid_task+0x20/0x1f0 [ 456.189537][T11292] ? get_pid_task+0x20/0x1f0 [ 456.189582][T11292] ? __fget_files+0x2a/0x420 [ 456.189603][T11292] ? __fget_files+0x3a0/0x420 [ 456.189633][T11292] __sys_sendmsg+0x183/0x260 [ 456.189657][T11292] ? __pfx___sys_sendmsg+0x10/0x10 [ 456.189699][T11292] __do_fast_syscall_32+0x229/0x6e0 [ 456.189722][T11292] ? do_fast_syscall_32+0x33/0x70 [ 456.189743][T11292] ? lockdep_hardirqs_on+0x7a/0x110 [ 456.189762][T11292] ? asm_int80_emulation+0x1a/0x20 [ 456.189780][T11292] ? do_int80_emulation+0x286/0x530 [ 456.189800][T11292] ? trace_irq_disable+0x3b/0x140 [ 456.189828][T11292] do_fast_syscall_32+0x33/0x70 [ 456.189851][T11292] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 456.189871][T11292] RIP: 0023:0xf709f01c [ 456.189888][T11292] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 456.189904][T11292] RSP: 002b:00000000f548d50c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 456.189923][T11292] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800004c0 [ 456.189935][T11292] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 456.189947][T11292] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 456.189958][T11292] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 456.189969][T11292] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 456.189998][T11292] [ 456.225914][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 456.539451][T11294] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1575'. [ 456.556738][T11269] binder: BINDER_SET_CONTEXT_MGR already set [ 456.578575][T11269] binder: 11268:11269 ioctl 4018620d 80001000 returned -16 [ 456.671867][ T5741] usb 2-1: Firmware version (0.0) predates our first public release. [ 456.694311][ T5741] usb 2-1: Please update to version 0.2 or newer [ 456.789559][ T5741] usb 2-1: USB disconnect, device number 100 [ 456.926314][ T47] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 456.953548][T11294] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1575'. [ 456.987586][T11294] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1575'. [ 457.226261][ T47] usb 1-1: new full-speed USB device number 109 using dummy_hcd [ 457.379440][T11313] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1579'. [ 457.406345][ T47] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 457.435193][T11315] FAULT_INJECTION: forcing a failure. [ 457.435193][T11315] name failslab, interval 1, probability 0, space 0, times 0 [ 457.438126][ T47] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBE, changing to 0x8E [ 457.462086][T11313] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1579'. [ 457.505598][ T47] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 10 [ 457.518337][T11313] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1579'. [ 457.534679][ T47] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 457.534701][T11315] CPU: 0 UID: 0 PID: 11315 Comm: syz.1.1580 Tainted: G L syzkaller #0 PREEMPT(full) [ 457.534727][T11315] Tainted: [L]=SOFTLOCKUP [ 457.534733][T11315] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 457.534744][T11315] Call Trace: [ 457.534752][T11315] [ 457.534760][T11315] dump_stack_lvl+0xe8/0x150 [ 457.534783][T11315] should_fail_ex+0x412/0x560 [ 457.534808][T11315] should_failslab+0xa8/0x100 [ 457.534835][T11315] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 457.534859][T11315] ? __alloc_skb+0x186/0x7d0 [ 457.534878][T11315] ? __alloc_skb+0x1d0/0x7d0 [ 457.534896][T11315] ? __local_bh_enable_ip+0xd0/0x130 [ 457.534917][T11315] __alloc_skb+0x1d0/0x7d0 [ 457.534941][T11315] netlink_sendmsg+0x5d4/0xb40 [ 457.534970][T11315] ? __pfx_netlink_sendmsg+0x10/0x10 [ 457.534994][T11315] ? aa_sock_msg_perm+0xf1/0x1b0 [ 457.535018][T11315] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 457.535043][T11315] ____sys_sendmsg+0x972/0x9f0 [ 457.535073][T11315] ? __pfx_____sys_sendmsg+0x10/0x10 [ 457.535098][T11315] ? kstrtoull+0x12f/0x1d0 [ 457.535125][T11315] ___sys_sendmsg+0x2a5/0x360 [ 457.535145][T11315] ? __lock_acquire+0x6b5/0x2cf0 [ 457.535167][T11315] ? __pfx____sys_sendmsg+0x10/0x10 [ 457.535190][T11315] ? get_pid_task+0x20/0x1f0 [ 457.535211][T11315] ? get_pid_task+0x20/0x1f0 [ 457.535230][T11315] ? get_pid_task+0x20/0x1f0 [ 457.535281][T11315] ? __fget_files+0x2a/0x420 [ 457.535301][T11315] ? __fget_files+0x3a0/0x420 [ 457.535330][T11315] __sys_sendmsg+0x183/0x260 [ 457.535353][T11315] ? __pfx___sys_sendmsg+0x10/0x10 [ 457.535392][T11315] __do_fast_syscall_32+0x229/0x6e0 [ 457.535414][T11315] ? do_fast_syscall_32+0x33/0x70 [ 457.535434][T11315] ? lockdep_hardirqs_on+0x7a/0x110 [ 457.535452][T11315] ? asm_int80_emulation+0x1a/0x20 [ 457.535468][T11315] ? do_int80_emulation+0x286/0x530 [ 457.535487][T11315] ? trace_irq_disable+0x3b/0x140 [ 457.535514][T11315] do_fast_syscall_32+0x33/0x70 [ 457.535535][T11315] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 457.535555][T11315] RIP: 0023:0xf709f01c [ 457.535571][T11315] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 457.535586][T11315] RSP: 002b:00000000f548d50c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 457.535605][T11315] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000180 [ 457.535618][T11315] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 457.535628][T11315] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 457.535639][T11315] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 457.535650][T11315] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 457.535676][T11315] [ 457.836161][T10706] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 457.847589][ T47] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 457.863157][ T47] usb 1-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 457.896850][ T5624] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 457.908995][T11319] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1581'. [ 457.942151][ T47] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 457.953266][T11319] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1581'. [ 457.964585][ T47] usb 1-1: Product: syz [ 457.970817][ T1221] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 457.982633][ T47] usb 1-1: Manufacturer: syz [ 457.990454][T11319] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1581'. [ 457.994429][ T47] usb 1-1: SerialNumber: syz [ 458.006067][T11322] FAULT_INJECTION: forcing a failure. [ 458.006067][T11322] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 458.020098][T11322] CPU: 0 UID: 0 PID: 11322 Comm: syz.1.1582 Tainted: G L syzkaller #0 PREEMPT(full) [ 458.020128][T11322] Tainted: [L]=SOFTLOCKUP [ 458.020136][T11322] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 458.020147][T11322] Call Trace: [ 458.020155][T11322] [ 458.020163][T11322] dump_stack_lvl+0xe8/0x150 [ 458.020190][T11322] should_fail_ex+0x412/0x560 [ 458.020217][T11322] _copy_from_user+0x2d/0xb0 [ 458.020243][T11322] move_addr_to_kernel+0x7e/0x160 [ 458.020273][T11322] get_compat_msghdr+0x3d8/0x4c0 [ 458.020300][T11322] ? __pfx_get_compat_msghdr+0x10/0x10 [ 458.020324][T11322] ? kstrtoull+0x12f/0x1d0 [ 458.020349][T11322] ___sys_sendmsg+0x201/0x360 [ 458.020371][T11322] ? __lock_acquire+0x6b5/0x2cf0 [ 458.020395][T11322] ? __pfx____sys_sendmsg+0x10/0x10 [ 458.020420][T11322] ? get_pid_task+0x20/0x1f0 [ 458.020442][T11322] ? get_pid_task+0x20/0x1f0 [ 458.020470][T11322] ? get_pid_task+0x20/0x1f0 [ 458.020517][T11322] ? __fget_files+0x2a/0x420 [ 458.020538][T11322] ? __fget_files+0x3a0/0x420 [ 458.020568][T11322] __sys_sendmsg+0x183/0x260 [ 458.020596][T11322] ? __pfx___sys_sendmsg+0x10/0x10 [ 458.020634][T11322] __do_fast_syscall_32+0x229/0x6e0 [ 458.020657][T11322] ? do_fast_syscall_32+0x33/0x70 [ 458.020677][T11322] ? lockdep_hardirqs_on+0x7a/0x110 [ 458.020696][T11322] ? asm_int80_emulation+0x1a/0x20 [ 458.020713][T11322] ? do_int80_emulation+0x286/0x530 [ 458.020734][T11322] ? trace_irq_disable+0x3b/0x140 [ 458.020763][T11322] do_fast_syscall_32+0x33/0x70 [ 458.020785][T11322] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 458.020807][T11322] RIP: 0023:0xf709f01c [ 458.020823][T11322] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 458.020838][T11322] RSP: 002b:00000000f548d50c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 458.020857][T11322] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000800027c0 [ 458.020870][T11322] RDX: 0000000000000810 RSI: 0000000000000000 RDI: 0000000000000000 [ 458.020879][T11322] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 458.020889][T11322] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 458.020900][T11322] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 458.020922][T11322] [ 458.025681][ T47] usb 1-1: config 0 descriptor?? [ 458.283148][T11325] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 458.294510][T11325] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 458.444968][T11332] FAULT_INJECTION: forcing a failure. [ 458.444968][T11332] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 458.459147][T11332] CPU: 0 UID: 0 PID: 11332 Comm: syz.2.1586 Tainted: G L syzkaller #0 PREEMPT(full) [ 458.459177][T11332] Tainted: [L]=SOFTLOCKUP [ 458.459184][T11332] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 458.459194][T11332] Call Trace: [ 458.459202][T11332] [ 458.459210][T11332] dump_stack_lvl+0xe8/0x150 [ 458.459235][T11332] should_fail_ex+0x412/0x560 [ 458.459262][T11332] _copy_from_user+0x2d/0xb0 [ 458.459287][T11332] get_compat_msghdr+0xb3/0x4c0 [ 458.459310][T11332] ? kstrtoull+0x12f/0x1d0 [ 458.459333][T11332] ? __pfx_get_compat_msghdr+0x10/0x10 [ 458.459359][T11332] ? __lock_acquire+0x6b5/0x2cf0 [ 458.459386][T11332] ___sys_recvmsg+0x1dd/0x590 [ 458.459408][T11332] ? get_pid_task+0x20/0x1f0 [ 458.459435][T11332] ? __pfx____sys_recvmsg+0x10/0x10 [ 458.459461][T11332] ? __fget_files+0x2a/0x420 [ 458.459511][T11332] ? __fget_files+0x3a0/0x420 [ 458.459541][T11332] __sys_recvmsg+0x180/0x250 [ 458.459567][T11332] ? __pfx___sys_recvmsg+0x10/0x10 [ 458.459610][T11332] __do_fast_syscall_32+0x229/0x6e0 [ 458.459634][T11332] ? do_fast_syscall_32+0x33/0x70 [ 458.459655][T11332] ? lockdep_hardirqs_on+0x7a/0x110 [ 458.459675][T11332] ? asm_int80_emulation+0x1a/0x20 [ 458.459691][T11332] ? do_int80_emulation+0x286/0x530 [ 458.459712][T11332] ? trace_irq_disable+0x3b/0x140 [ 458.459740][T11332] do_fast_syscall_32+0x33/0x70 [ 458.459761][T11332] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 458.459782][T11332] RIP: 0023:0xf709f01c [ 458.459798][T11332] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 458.459813][T11332] RSP: 002b:00000000f548d50c EFLAGS: 00000206 ORIG_RAX: 0000000000000174 [ 458.459833][T11332] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000800005c0 [ 458.459846][T11332] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 458.459856][T11332] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 458.459867][T11332] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 458.459878][T11332] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 458.459904][T11332] [ 458.716554][ T47] radio-si470x 1-1:0.0: DeviceID=0x0000 ChipID=0x0000 [ 458.723477][ T47] radio-si470x 1-1:0.0: This driver is known to work with firmware version 12, but the device has firmware version 0. [ 458.736046][ T5741] usb 2-1: new full-speed USB device number 101 using dummy_hcd [ 458.912235][ T47] radio-si470x 1-1:0.0: software version 0, hardware version 0 [ 458.932849][ T47] radio-si470x 1-1:0.0: This driver is known to work with hardware version 1, but the device has hardware version 0. [ 458.948328][ T47] radio-si470x 1-1:0.0: If you have some trouble using this driver, please report to V4L ML at linux-media@vger.kernel.org [ 459.017284][T10706] usb 4-1: new high-speed USB device number 110 using dummy_hcd [ 459.036138][ T1221] usb 3-1: new high-speed USB device number 104 using dummy_hcd [ 459.108886][ T5741] usb 2-1: unable to get BOS descriptor or descriptor too short [ 459.120311][ T5741] usb 2-1: no configurations [ 459.124967][ T5741] usb 2-1: can't read configurations, error -22 [ 459.131718][ T47] radio-si470x 1-1:0.0: submitting int urb failed (-90) [ 459.185975][T10706] usb 4-1: Using ep0 maxpacket: 8 [ 459.194667][T10706] usb 4-1: New USB device found, idVendor=10c4, idProduct=8244, bcdDevice=dc.00 [ 459.196026][ T1221] usb 3-1: Using ep0 maxpacket: 8 [ 459.205269][T10706] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 459.213158][ T1221] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xEE, changing to 0x8E [ 459.217676][T10706] usb 4-1: Product: syz [ 459.230045][ T1221] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 459.233319][T10706] usb 4-1: Manufacturer: syz [ 459.243589][ T1221] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 459.248570][T10706] usb 4-1: SerialNumber: syz [ 459.260917][ T1221] usb 3-1: New USB device found, idVendor=187f, idProduct=0200, bcdDevice=6b.ad [ 459.272236][ T1221] usb 3-1: New USB device strings: Mfr=55, Product=237, SerialNumber=3 [ 459.281124][ T1221] usb 3-1: Product: syz [ 459.284178][T10706] usb 4-1: config 0 descriptor?? [ 459.285693][ T1221] usb 3-1: Manufacturer: syz [ 459.295355][ T1221] usb 3-1: SerialNumber: syz [ 459.298715][T10706] radio-usb-si4713 4-1:0.0: Si4713 development board discovered: (10C4:8244) [ 459.314841][ T1221] usb 3-1: config 0 descriptor?? [ 459.325100][ T1221] smsusb:smsusb_probe: board id=2, interface number 0 [ 459.334312][ T1221] smsusb:smsusb_probe: Device initialized with return code -19 [ 459.694500][T11341] FAULT_INJECTION: forcing a failure. [ 459.694500][T11341] name failslab, interval 1, probability 0, space 0, times 0 [ 459.709699][T11341] CPU: 0 UID: 0 PID: 11341 Comm: syz.1.1589 Tainted: G L syzkaller #0 PREEMPT(full) [ 459.709730][T11341] Tainted: [L]=SOFTLOCKUP [ 459.709737][T11341] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 459.709748][T11341] Call Trace: [ 459.709759][T11341] [ 459.709767][T11341] dump_stack_lvl+0xe8/0x150 [ 459.709794][T11341] should_fail_ex+0x412/0x560 [ 459.709812][T11341] should_failslab+0xa8/0x100 [ 459.709828][T11341] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 459.709842][T11341] ? __alloc_skb+0x186/0x7d0 [ 459.709853][T11341] ? __alloc_skb+0x1d0/0x7d0 [ 459.709870][T11341] ? __local_bh_enable_ip+0xd0/0x130 [ 459.709893][T11341] __alloc_skb+0x1d0/0x7d0 [ 459.709918][T11341] netlink_sendmsg+0x5d4/0xb40 [ 459.709948][T11341] ? __pfx_netlink_sendmsg+0x10/0x10 [ 459.709962][T11341] ? aa_sock_msg_perm+0xf1/0x1b0 [ 459.709976][T11341] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 459.709991][T11341] ____sys_sendmsg+0x972/0x9f0 [ 459.710010][T11341] ? __pfx_____sys_sendmsg+0x10/0x10 [ 459.710037][T11341] ? kstrtoull+0x12f/0x1d0 [ 459.710065][T11341] ___sys_sendmsg+0x2a5/0x360 [ 459.710086][T11341] ? __lock_acquire+0x6b5/0x2cf0 [ 459.710108][T11341] ? __pfx____sys_sendmsg+0x10/0x10 [ 459.710122][T11341] ? get_pid_task+0x20/0x1f0 [ 459.710134][T11341] ? get_pid_task+0x20/0x1f0 [ 459.710145][T11341] ? get_pid_task+0x20/0x1f0 [ 459.710183][T11341] ? __fget_files+0x2a/0x420 [ 459.710204][T11341] ? __fget_files+0x3a0/0x420 [ 459.710230][T11341] __sys_sendmsg+0x183/0x260 [ 459.710254][T11341] ? __pfx___sys_sendmsg+0x10/0x10 [ 459.710297][T11341] __do_fast_syscall_32+0x229/0x6e0 [ 459.710314][T11341] ? do_fast_syscall_32+0x33/0x70 [ 459.710341][T11341] ? lockdep_hardirqs_on+0x7a/0x110 [ 459.710362][T11341] ? asm_int80_emulation+0x1a/0x20 [ 459.710379][T11341] ? do_int80_emulation+0x286/0x530 [ 459.710399][T11341] ? trace_irq_disable+0x3b/0x140 [ 459.710420][T11341] do_fast_syscall_32+0x33/0x70 [ 459.710433][T11341] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 459.710444][T11341] RIP: 0023:0xf709f01c [ 459.710455][T11341] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 459.710464][T11341] RSP: 002b:00000000f548d50c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 459.710483][T11341] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000100 [ 459.710496][T11341] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 459.710507][T11341] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 459.710517][T11341] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 459.710528][T11341] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 459.710554][T11341] [ 460.020843][T10706] radio-usb-si4713 4-1:0.0: probe with driver radio-usb-si4713 failed with error -71 [ 460.030739][T10706] usbhid 4-1:0.0: couldn't find an input interrupt endpoint [ 460.037613][ T47] radio-si470x 1-1:0.0: si470x_set_report: usb_control_msg returned -110 [ 460.041617][T10706] usb 4-1: USB disconnect, device number 110 [ 460.047128][ T47] radio-si470x 1-1:0.0: probe with driver radio-si470x failed with error -22 [ 460.061701][ T1221] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 460.447333][ T30] INFO: task kworker/0:4:5682 blocked for more than 143 seconds. [ 460.455315][ T30] Tainted: G L syzkaller #0 [ 460.462679][ T30] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 460.471703][ T30] task:kworker/0:4 state:D stack:20664 pid:5682 tgid:5682 ppid:2 task_flags:0x4288060 flags:0x00080000 [ 460.483907][ T30] Workqueue: usb_hub_wq hub_event [ 460.489224][ T30] Call Trace: [ 460.492521][ T30] [ 460.495449][ T30] __schedule+0x17b4/0x5680 [ 460.500371][ T30] ? do_raw_spin_lock+0x12b/0x2f0 [ 460.505539][ T30] ? __pfx___schedule+0x10/0x10 [ 460.510626][T10706] usb 2-1: new high-speed USB device number 103 using dummy_hcd [ 460.526148][ T30] ? schedule+0x90/0x360 [ 460.530478][ T30] schedule+0x164/0x360 [ 460.534649][ T30] schedule_timeout+0xc3/0x2c0 [ 460.542643][ T30] ? __pfx_schedule_timeout+0x10/0x10 [ 460.548192][ T30] ? do_raw_spin_lock+0x12b/0x2f0 [ 460.553416][ T30] ? _raw_spin_unlock_irq+0x23/0x50 [ 460.558960][ T30] ? wait_for_completion+0x274/0x5e0 [ 460.564314][ T30] wait_for_completion+0x2cc/0x5e0 [ 460.570776][ T30] ? __pfx_wait_for_completion+0x10/0x10 [ 460.577514][ T30] i2c_del_adapter+0x5c0/0x790 [ 460.582380][ T30] ? __pfx_i2c_del_adapter+0x10/0x10 [ 460.587796][ T30] ? rcu_is_watching+0x15/0xb0 [ 460.592729][ T30] ? devres_log+0x10e/0x330 [ 460.598386][ T30] ? devres_release_group+0x295/0x370 [ 460.603829][ T30] devres_release_group+0x26f/0x370 [ 460.610059][ T30] ? __pfx_devres_release_group+0x10/0x10 [ 460.616174][ T30] ? lockdep_hardirqs_on+0x7a/0x110 [ 460.621465][ T30] ? enable_work+0x1fd/0x230 [ 460.626154][ T30] ? __pfx_mcp2221_remove+0x10/0x10 [ 460.631369][ T30] hid_device_remove+0x250/0x370 [ 460.636430][ T30] ? __pfx_hid_device_remove+0x10/0x10 [ 460.641952][ T30] device_release_driver_internal+0x46f/0x870 [ 460.648135][ T30] bus_remove_device+0x455/0x570 [ 460.653110][ T30] ? __pfx_bus_remove_device+0x10/0x10 [ 460.658736][ T30] ? kernfs_remove_by_name_ns+0x101/0x140 [ 460.664512][ T30] device_del+0x527/0x8f0 [ 460.669032][T10706] usb 2-1: device descriptor read/64, error -71 [ 460.675373][ T30] ? __pfx_device_del+0x10/0x10 [ 460.680451][ T30] ? do_raw_spin_lock+0x12b/0x2f0 [ 460.685523][ T30] hid_destroy_device+0x6b/0x1b0 [ 460.690544][ T30] usbhid_disconnect+0x9f/0xc0 [ 460.695327][ T30] usb_unbind_interface+0x26e/0x910 [ 460.700692][ T30] ? kernfs_remove_by_name_ns+0x101/0x140 [ 460.706549][ T30] ? __pfx_usb_unbind_interface+0x10/0x10 [ 460.712320][ T30] device_release_driver_internal+0x4d9/0x870 [ 460.718459][ T30] bus_remove_device+0x455/0x570 [ 460.723489][ T30] ? __pfx_bus_remove_device+0x10/0x10 [ 460.729228][ T30] ? kernfs_remove_by_name_ns+0x101/0x140 [ 460.735036][ T30] device_del+0x527/0x8f0 [ 460.739712][ T30] ? __pfx_device_del+0x10/0x10 [ 460.744637][ T30] ? kobject_put+0x51d/0x560 [ 460.749509][ T30] usb_disable_device+0x3d4/0x8d0 [ 460.754605][ T30] usb_disconnect+0x32f/0x990 [ 460.759371][ T30] hub_event+0x1cc9/0x4f30 [ 460.763924][ T30] ? trace_irq_disable+0x3b/0x140 [ 460.769043][ T30] ? __pfx_hub_event+0x10/0x10 [ 460.773856][ T30] ? process_scheduled_works+0xa70/0x1860 [ 460.779718][ T30] ? process_scheduled_works+0xa70/0x1860 [ 460.785480][ T30] ? process_scheduled_works+0xa70/0x1860 [ 460.791995][ T30] process_scheduled_works+0xb5d/0x1860 [ 460.798226][ T30] ? __pfx_process_scheduled_works+0x10/0x10 [ 460.804885][ T30] ? assign_work+0x3d5/0x5e0 [ 460.809589][ T30] worker_thread+0xa53/0xfc0 [ 460.814202][ T30] kthread+0x388/0x470 [ 460.818393][ T30] ? __pfx_worker_thread+0x10/0x10 [ 460.823569][ T30] ? __pfx_kthread+0x10/0x10 [ 460.828230][ T30] ret_from_fork+0x514/0xb70 [ 460.832855][ T30] ? __pfx_ret_from_fork+0x10/0x10 [ 460.838044][ T30] ? __switch_to+0xc79/0x1410 [ 460.842739][ T30] ? __pfx_kthread+0x10/0x10 [ 460.847968][ T5624] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 460.856424][ T30] ret_from_fork_asm+0x1a/0x30 [ 460.861721][ T30] [ 460.864887][ T30] [ 460.864887][ T30] Showing all locks held in the system: [ 460.872766][ T30] 5 locks held by kworker/u8:1/13: [ 460.878010][ T30] 1 lock held by khungtaskd/30: [ 460.882870][ T30] #0: ffffffff8e95cd60 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 460.893155][ T30] 2 locks held by getty/5384: [ 460.898101][ T30] #0: ffff8880363270a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 460.908213][ T30] #1: ffffc9000322b2e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45c/0x13a0 [ 460.918609][T10706] usb 2-1: new high-speed USB device number 104 using dummy_hcd [ 460.926364][ T30] 6 locks held by kworker/0:4/5682: [ 460.931716][ T30] #0: ffff888021eae940 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0xa35/0x1860 [ 460.944618][ T30] #1: ffffc900044a7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0xa70/0x1860 [ 460.956635][ T30] #2: ffff88802a2041d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x17f/0x4f30 [ 460.965539][ T30] #3: ffff88823bede9d8 (&dev->mutex){....}-{4:4}, at: usb_disconnect+0xf8/0x990 [ 460.974756][ T30] #4: ffff88802a2e21a0 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb6/0x870 [ 460.985420][ T30] #5: ffff88807f851a58 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb6/0x870 [ 460.996082][ T30] 6 locks held by kworker/0:1/10706: [ 461.001393][ T30] #0: ffff888021eae940 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0xa35/0x1860 [ 461.017078][ T30] #1: ffffc9000ccbfc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0xa70/0x1860 [ 461.029222][ T30] #2: ffff88802a14a1d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x17f/0x4f30 [ 461.038238][ T30] #3: ffff88802a19b568 (&port_dev->status_lock){+.+.}-{4:4}, at: hub_event+0x217a/0x4f30 [ 461.048472][ T30] #4: ffff888029dd9a60 (hcd->address0_mutex){+.+.}-{4:4}, at: hub_event+0x21a2/0x4f30 [ 461.064893][ T30] #5: ffffffff8f6803a8 (ehci_cf_port_reset_rwsem){.+.+}-{4:4}, at: hub_port_reset+0x14e/0x1840 [ 461.075688][T10706] usb 2-1: device descriptor read/64, error -71 [ 461.082162][ T30] [ 461.084522][ T30] ============================================= [ 461.084522][ T30] [ 461.099583][ T30] NMI backtrace for cpu 0 [ 461.099602][ T30] CPU: 0 UID: 0 PID: 30 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 461.099625][ T30] Tainted: [L]=SOFTLOCKUP [ 461.099632][ T30] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 461.099643][ T30] Call Trace: [ 461.099650][ T30] [ 461.099658][ T30] dump_stack_lvl+0xe8/0x150 [ 461.099682][ T30] nmi_cpu_backtrace+0x274/0x2d0 [ 461.099708][ T30] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 461.099727][ T30] nmi_trigger_cpumask_backtrace+0x17a/0x300 [ 461.099752][ T30] sys_info+0x135/0x170 [ 461.099766][ T5741] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 461.099772][ T30] watchdog+0xfd3/0x1030 [ 461.099801][ T30] ? watchdog+0x1c9/0x1030 [ 461.099827][ T30] kthread+0x388/0x470 [ 461.099850][ T30] ? __pfx_watchdog+0x10/0x10 [ 461.099871][ T30] ? __pfx_kthread+0x10/0x10 [ 461.099894][ T30] ret_from_fork+0x514/0xb70 [ 461.099915][ T30] ? __pfx_ret_from_fork+0x10/0x10 [ 461.099933][ T30] ? __switch_to+0xc79/0x1410 [ 461.099959][ T30] ? __pfx_kthread+0x10/0x10 [ 461.099981][ T30] ret_from_fork_asm+0x1a/0x30 [ 461.100015][ T30] [ 461.100022][ T30] Sending NMI from CPU 0 to CPUs 1: [ 461.225735][ C1] NMI backtrace for cpu 1 [ 461.225756][ C1] CPU: 1 UID: 0 PID: 57 Comm: kworker/u8:4 Tainted: G L syzkaller #0 PREEMPT(full) [ 461.225778][ C1] Tainted: [L]=SOFTLOCKUP [ 461.225784][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 461.225795][ C1] Workqueue: events_unbound toggle_allocation_gate [ 461.225823][ C1] RIP: 0010:enqueue_timer+0x73/0x570 [ 461.225844][ C1] Code: 13 00 48 b8 00 00 00 00 00 fc ff df 4a 8d 1c fb 49 89 dd 49 c1 ed 03 41 80 7c 05 00 00 74 08 48 89 df e8 70 d6 7e 00 4c 8b 33 <4c> 89 e0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df 80 3c 08 00 74 [ 461.225860][ C1] RSP: 0000:ffffc900015e78b0 EFLAGS: 00000046 [ 461.225873][ C1] RAX: dffffc0000000000 RBX: ffff8880b8726260 RCX: ffff88801bfd0000 [ 461.225884][ C1] RDX: 0000000000000000 RSI: 0000000000000018 RDI: 0000000000000201 [ 461.225894][ C1] RBP: 0000000000000018 R08: ffffffff9a6790cb R09: 1ffffffff34cf219 [ 461.225904][ C1] R10: dffffc0000000000 R11: fffffbfff34cf21a R12: ffffffff9a4b06e8 [ 461.225916][ C1] R13: 1ffff110170e4c4c R14: ffff88805d0f5340 R15: 0000000000000018 [ 461.225927][ C1] FS: 0000000000000000(0000) GS:ffff888125393000(0000) knlGS:0000000000000000 [ 461.225940][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 461.225951][ C1] CR2: 00000000f73c7a54 CR3: 000000000e74a000 CR4: 00000000003526f0 [ 461.225965][ C1] Call Trace: [ 461.225972][ C1] [ 461.225982][ C1] __mod_timer+0xb28/0xf30 [ 461.226011][ C1] queue_delayed_work_on+0x11a/0x1e0 [ 461.226032][ C1] toggle_allocation_gate+0x245/0x290 [ 461.226054][ C1] ? __pfx_toggle_allocation_gate+0x10/0x10 [ 461.226075][ C1] ? __pfx_autoremove_wake_function+0x10/0x10 [ 461.226098][ C1] ? preempt_schedule_thunk+0x16/0x30 [ 461.226126][ C1] ? process_scheduled_works+0xa70/0x1860 [ 461.226142][ C1] ? process_scheduled_works+0xa70/0x1860 [ 461.226157][ C1] process_scheduled_works+0xb5d/0x1860 [ 461.226187][ C1] ? __pfx_process_scheduled_works+0x10/0x10 [ 461.226205][ C1] ? assign_work+0x3d5/0x5e0 [ 461.226223][ C1] worker_thread+0xa53/0xfc0 [ 461.226251][ C1] kthread+0x388/0x470 [ 461.226270][ C1] ? __pfx_worker_thread+0x10/0x10 [ 461.226285][ C1] ? __pfx_kthread+0x10/0x10 [ 461.226303][ C1] ret_from_fork+0x514/0xb70 [ 461.226321][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 461.226337][ C1] ? __switch_to+0xc79/0x1410 [ 461.226359][ C1] ? __pfx_kthread+0x10/0x10 [ 461.226378][ C1] ret_from_fork_asm+0x1a/0x30 [ 461.226403][ C1] [ 461.231943][T10706] usb usb2-port1: attempt power cycle [ 461.395950][ T30] Kernel panic - not syncing: hung_task: blocked tasks [ 461.395980][ T30] CPU: 1 UID: 0 PID: 30 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 461.396006][ T30] Tainted: [L]=SOFTLOCKUP [ 461.396014][ T30] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 461.396026][ T30] Call Trace: [ 461.396035][ T30] [ 461.396045][ T30] vpanic+0x56c/0xa60 [ 461.396070][ T30] ? __pfx___schedule+0x10/0x10 [ 461.396091][ T30] ? __pfx_vpanic+0x10/0x10 [ 461.396120][ T30] panic+0xc5/0xd0 [ 461.396139][ T30] ? __pfx_panic+0x10/0x10 [ 461.396159][ T30] ? preempt_schedule_thunk+0x16/0x30 [ 461.396188][ T30] ? nmi_trigger_cpumask_backtrace+0x2bb/0x300 [ 461.396217][ T30] watchdog+0x102c/0x1030 [ 461.396249][ T30] ? watchdog+0x1c9/0x1030 [ 461.396278][ T30] kthread+0x388/0x470 [ 461.396301][ T30] ? __pfx_watchdog+0x10/0x10 [ 461.396324][ T30] ? __pfx_kthread+0x10/0x10 [ 461.396347][ T30] ret_from_fork+0x514/0xb70 [ 461.396369][ T30] ? __pfx_ret_from_fork+0x10/0x10 [ 461.396388][ T30] ? __switch_to+0xc79/0x1410 [ 461.396415][ T30] ? __pfx_kthread+0x10/0x10 [ 461.396438][ T30] ret_from_fork_asm+0x1a/0x30 [ 461.396472][ T30] [ 461.397460][ T30] Kernel Offset: disabled