last executing test programs: 10m23.065524706s ago: executing program 1 (id=4613): sendmsg$kcm(0xffffffffffffffff, 0x0, 0xff00) r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x11, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x1}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) prctl$PR_SCHED_CORE(0x39, 0x1, 0x0, 0x2, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) r1 = socket$kcm(0xa, 0x2, 0x0) fcntl$setownex(r1, 0xf, &(0x7f0000000240)={0x2, r0}) ioctl$sock_kcm_SIOCKCMCLONE(r1, 0x890b, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) acct(0xfffffffffffffffe) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r3, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10) r4 = dup3(0xffffffffffffffff, r3, 0x0) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001880), 0xffffffffffffffff) r6 = syz_open_dev$loop(&(0x7f0000000100), 0x4, 0x2001) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) write$binfmt_misc(r7, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r6, 0x4c0a, &(0x7f00000002c0)={r7, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x13, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d960001000000000000000000007efff100004000", "2827e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c527d3d458dd4992861ac008000000000000200", "f4bd000000801900", [0x8, 0xffffffff9673e359]}}) sendmsg$NL80211_CMD_GET_WIPHY(r7, &(0x7f0000000400)={&(0x7f00000002c0), 0xc, &(0x7f00000003c0)={&(0x7f0000000300)={0x14, r5, 0x200, 0x70bd2a, 0x25dfdbfb, {{}, {@void, @void, @void}}, [""]}, 0x14}, 0x1, 0x0, 0x0, 0x24000001}, 0x80c1) sendmsg$NL80211_CMD_DISCONNECT(r4, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0x44, r5, 0x200, 0x70bd26, 0x25dfdbfc, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x36}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x3}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x4}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x24}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x25}]}, 0x44}, 0x1, 0x0, 0x0, 0x64824ad153c072b7}, 0x8000000) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000000)={0x42, 0x1, 0x3}, 0x10) bind$tipc(r3, 0x0, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@deltaction={0x38, 0x18, 0x1, 0x70bd2c, 0x25dfdc00, {0xa, 0x0, 0xfd}, [@TCA_ACT_TAB={0x20, 0x1, [{0xc, 0x8d, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x7}}, {0x10, 0x2, 0x0, 0x0, @TCA_ACT_KIND={0xfffffffffffffe9a, 0x1, 'csum\x00'}}]}, @TCA_ACT_TAB={0x4}]}, 0x38}, 0x1, 0x0, 0x0, 0x44000}, 0x20040844) 10m22.556359738s ago: executing program 1 (id=4618): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_route(0x10, 0x3, 0x0) socket(0x27, 0x4, 0x20) r1 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x25dfdbfe, 0x2ffffffff}, 0xc) r2 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r2, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000300), 0x4) r3 = syz_open_dev$video(&(0x7f0000000240), 0x0, 0x0) ioctl$VIDIOC_S_FMT(r3, 0xc0d05605, &(0x7f0000000080)={0x9, @pix_mp={0xfffffff7, 0x0, 0x33565348, 0x2, 0x9, [{0x3, 0x4}, {0x5, 0x4}, {0x7f, 0x8}, {0x9, 0x6}, {0x4, 0x30000000}, {0x1, 0x38}, {0xe, 0x2}, {0x80000001, 0x15}], 0x9, 0x6, 0x1, 0x0, 0x4}}) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r2, 0x10e, 0x4, &(0x7f0000000640)=0xce0, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0xd, &(0x7f0000000000)=@req3={0x10000, 0x3, 0x100, 0x100, 0x100, 0x2000000, 0x4}, 0x1c) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x2000, 0x0) ioctl$TUNGETDEVNETNS(r4, 0x54e3, 0x0) r5 = syz_open_dev$usbfs(&(0x7f00000001c0), 0x0, 0xb0f7765ec1a35ae9) ioctl$USBDEVFS_RELEASE_PORT(r5, 0x80045519, &(0x7f0000000200)=0x5) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xb, &(0x7f0000000880)=0x800, 0x4) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="5c00000002060108000000000000000000000101050005000a000000050001000700000005000400000000000900020073797a310000000016000300686173683a6e65742c706f72742c6e65"], 0x5c}}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x31, &(0x7f0000000240)={&(0x7f0000000780)=ANY=[@ANYBLOB="74000000090601020000000000000000030000000900020073797a310000000005000100070000004c0007801800018014000240fe8000000000000000000300000000aa1800148014000240fc000000000000000000000000000000060004404e1f0000050007008400000006000540"], 0x74}, 0x1, 0x0, 0x0, 0x10040003}, 0x20000040) r7 = socket$netlink(0x10, 0x3, 0xc) sendmmsg(r7, &(0x7f00000002c0), 0x40000000000009f, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c00000007060500000000000000000061f6fee4056b9dc0cc640200"], 0x1c}, 0x1, 0x0, 0x0, 0x20004080}, 0x48810) syz_usb_connect(0x0, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r2) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPSET_CMD_LIST(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="1c000000070601080000000000000000000000000500010006"], 0x1c}}, 0x0) 10m21.854521383s ago: executing program 1 (id=4620): r0 = syz_open_dev$loop(&(0x7f0000000240), 0x75f, 0xa8182) r1 = memfd_create(&(0x7f0000000880)='C\x13\xfc2\x95WD\xaa\xba^\x90\xfd\x8d\xc2\xb1[\x81\xda\xda\xd6\x8c\xc99\xec\x0e*||\xe4\xb3\xc4\xb6\v\xaa\x15\x86,\xac\x8d\x89cu\x10\xdc\x93\x9b\xb4\x93\xafE*:\xe4\xdd\xa5\xa75\xb8\x1e;7\xb7.V\xdcrw[\r\x98\x93j\x9c\xf6\xf8\x99\xefF_\xcd\xdf!b\xc5\xec\ntb\xff\b\xaaF?!\x9f\a\x1a\x03\f\xe94\x1deU\x06zS\xc90\xb9voI\xa5/\xb4\xa7@\xa1\\B\xc2@\r_b\x9a\xeb\b\x81\x00V\xd6/N\xc5\xc6f\xb1\x95Z\xe5w^\xd8\xe7J\x80\xf7\xae\xafuv\x84\x9eG\xd1\xe7\x9b\xf0_9\xc2\x9b\xfd\xc3\xf3\xe4\x95P\xf1m\xcf\xc2\xe1\xe6\xa6\x8c\x11\xfb\xb8S\x8b\x92\\\asW-Ee\x02\x00\x00\x00\xd0;Q\xc1~\x89\xec\xc8\x9b\x88\a\xf2\x93\x82(\x8b\x00\xd8\xb4T\x80\x95\x93\x9c5\xcf\t\x04\x00\x00\x00\x00\x00\x00v\xef\xee+\xab\x9c\x00^R\xb2n?i=\xbe\x16\x8a\xbf\xe3\xcdB\xed\xe14\xe8\xd0\xb7\xff\xfeQ\x1c\x85n8\x1b\xc1\b\x00\x00\x00\x00\x00\x00\x00\x17\x94\xdfW\x92z\xbe\xb2R)\xf1K\xd7\xaf\x99\xf6d\xe8\xec\xb7\xbd+T3\xa6\xa9\xfaY-1qs\x82\xefn*\x96\xc9\x1e\xf4\xd1\x02Dt\xc0\x19\xf7\x89\x96.D [F\xeeYW\x95\x13\xc7;\x94\x13^\x13\xaf\xf0C\x9c\xabf\x1daCS2\x02\xb0\xef\xc7\x8c\x9e\xed\a\n0x0) ptrace$setregset(0x4205, r4, 0x1, &(0x7f00000007c0)={&(0x7f00000006c0)="627faa62c0cf502af9de245eee0e40eaa634fb698fc2f0ef93a482dd595db189c6f217c869b01b1ff82716e85a23b6fc8493faa2c20d0f40acb073490b98aadca81a47917de0dd29b8da2ca6345f37db7b4cefba42b2f9c454bf29eb176a91b09caf736d5caf33fb3627b312d0cfb86243e32724ddf8f2f2eaff815aad012a1eba8f5a19ee85bde0d687391d6dba018459a5961f2c1c5286de135d60cf6b730c0ac42266af7319e74664602cd3de4542788ba331a3bce3dd8fc1e2756e9510b17dcad732171645b2bc8b85624c67f803ede48d7861441dc1cf27bfc23fb429fde55855ba27a4", 0xe6}) recvmsg$can_bcm(r2, &(0x7f0000000980)={&(0x7f0000000800)=@phonet, 0x80, &(0x7f00000008c0)=[{&(0x7f0000000880)=""/28, 0x1c}], 0x1, &(0x7f0000000900)=""/97, 0x61}, 0x10) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r5, 0x84, 0x8, &(0x7f00000009c0), &(0x7f0000000a00)=0x4) ioctl$PPPIOCNEWUNIT(r2, 0xc004743e, &(0x7f0000000a40)) fcntl$setlease(r2, 0x400, 0x0) setsockopt$pppl2tp_PPPOL2TP_SO_SENDSEQ(r3, 0x111, 0x3, 0x1, 0x4) ioctl$USBDEVFS_CLAIMINTERFACE(r2, 0x8004550f, &(0x7f0000000a80)=0x9) ioctl$MEMWRITEOOB(0xffffffffffffffff, 0xc0104d03, &(0x7f0000000b40)={0x10, 0x4d, &(0x7f0000000ac0)="e136a79872b5df1356f9c17173bd8d4fabffc45f6c6c57045d079fa2659f2b11afe81493054aeba9da3f3ed899d3aefb05ce49b66d8e1613fb27a04c21e9b570894e62314f2e1b72567a9e1eeb"}) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f0000000c40)={0x0, 0x80}, &(0x7f0000000c80)=0x8) sendmsg$inet_sctp(r2, &(0x7f0000000d40)={&(0x7f0000000b80)=@in={0x2, 0x4e21, @remote}, 0x10, &(0x7f0000000c00)=[{&(0x7f0000000bc0)="d1b6fda048e9b3ed08e31f1bb7b9266ce9df87821d03d2a2c72e00d2ad58039e63286c8e3dc4719f5d31aab16429a34057e964fd2d07b58a75c3d9e9c2923e3f", 0x40}], 0x1, &(0x7f0000000cc0)=[@sndrcv={0x30, 0x84, 0x1, {0x8001, 0x9, 0xa, 0xa, 0x92d, 0x6, 0x7, 0x7, r6}}, @dstaddrv4={0x18, 0x84, 0x7, @local}, @prinfo={0x18, 0x84, 0x5, {0x10, 0x1}}], 0x60, 0x4801}, 0x4c840) socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x30) socket$inet6_sctp(0xa, 0x1, 0x84) r7 = getpgid(r4) sendmsg$nl_generic(r2, &(0x7f0000002e80)={&(0x7f0000000d80)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000002e40)={&(0x7f0000000dc0)={0x2068, 0x24, 0x0, 0x70bd2a, 0x25dfdbfc, {0xa}, [@typed={0x4, 0x131}, @generic="770f1190fc81869a61f0a15eaa716e52539acc3801d44f37c413328e0a15daf7134b9009c48274df79503a2e3206999913c579d2740c32a8f296cf798aedb3dc7bde5ed6", @generic="a66fbe8778e8f855855cb0b0e14a8d148fe258db802f4123a9ba26fcf3cb2a9037c1fde60bd7ac935a4553bbfc9721840809eeb72cd1a6f2f27cb28876443fb34af8b7b51cde071c38a275b7f050f5e329499d8213ac7c37fd33fc1c86cd3d1957b5abee337b43692e64ade16cabb0472a1bf4bcbaa65ad5badd6521aeff4b327f0b48ea0ed2eb6995fe8b640cd5a60454d189a87aa3aca4d48eacc67fec4cbb04c31e88003021ef1976d0ba50fdc72d9057ee9ca38b9121447d28878688c68dfd6099fb0b9a0be2f0403345a4c7cc9b393df8aaba3bfb488b75a6fcae78d28a4dd70dfce67c13f8f913cb05b675ae62fb6296540dd1f9359a6cc01d7d70d7349e36305b4118e71f5d8ddf070117646e4da39cc53c035dbb2f6e1f42ee21cfd35dea3f4bda167498e3b5619f186fa7b6fce477cea987aff1311455871204422ec282c8510070d75608d6e5e19464fe2e8be06f408141d547a280295e53d55bc52bf80bfac8e049c8e7a9b5604f28ccac2245fb37e91a0737e5907b4b692dd903d929b68b985ecdf101d115228e63aa966be4e19fa36aeecec22981cac38d93422b4c6b587c379b00e48b4de17bf1d6673cb8de5f02e7db945d62328d02ab5c44f4ff305f4fdfd3b8a653d52f114794144898c36c2115c49d164ff0004b06b6fef9d007b342cb0a3e0aa81a530b90e3c1fadad36fd41f28fbb2a068a02b97e41d9b287bd383fcc64843af9dce45ec824867cfe7d4d026d12c976c9f7004839effd03d45fb6fae71b00fc93a5743c2710698701dce56eff06cac2f456a639ae4862f4d1fa500b0214905f78e27fb1f36ea21595141dbee24b3d1e735bcee194da59d4967e7287a965ba452310ba8e0e9eaa884d48c2a0a04f2830ea6a92b79b8046e1f2c060e95ae627c384b77e28bb2e10cc7e0e25d3f51bf6db3598c67ce16f58f229afd7eab87267137e0711bb970bc8bc8ce7f04f86f9833e0a7d3aeb90b2e1ce7a612da455009f80b449e38b3f2865fe9bbeb05aab58d950c75842f5d7914209183d23f0c7f5a9ca1b3fcd6f20a0ad083788257ee70dfcdb66e9a3f574ce7841963d39ff50f4272835bb99df3c574758ac51e5e151d0bc56c3623560b7a80a800caf26fdb09c16dcbb24337d11fd73dc8e8ff366af7fd26b5c6e9d0164dbedea56d034a69e7ea7f7834fce012fce0e9c5a12c76fae6bcb5c6140c97d353d52151b5925ac30e8141b1ef37d353879b49390fa4eb8636c5c9c395202c78b447d4e7d0aea29ea2e8a7e4adbe19d32fb5e8e5eed58ebe87e076d1c05e7c25ba7464d519e053349559955395eef165fca2d5fe631c3e53f229a79b963347777e9cb597c3975f4dc15642e941f7fb7b652e73171e8f2de27d369a7456adcc11b6ccaf16755449d29bb65fab2e03e7d9f3e5f90130273c2ddb41831e6c7789693436573cdbf4b9f2ee556a1a97ea8c15be88a0637865bb7a896ca5a4105e64f937ba73a6e915fe31cec45f9a9b476aeb20c2186b6dec0734791f105dcbfd4aeed018a8457b2acb41a901a64108d17ab3d74898b114412373659a8be8186094c42f9808649825283c42296b53945af81a1bbba4082685b92bf0a5eee121f4ba715357d88e347f535d36458f041ad8e39d7f4cb8f1b6279d930b4f17ed4e1158fd5a5f02088aee86b0078cd705f9bc7db30fdbceb616f4cf77e86741cb0f84073e0a99ec3de68c96d5ae977cd8a63f14316127208923eda164404465e8926d71b47fd44ea01e2d25db44f96ee6ec39387ef3c39490f8d2939a92096ab83895d1fece830793ffafd2c4544c7964908830fa26bffe25bbe0ed288b223612ed46a39743db70467553ab0b848278e9434811578097a42f91efbfb3bf63d0d41fcaa4e40040549c3dadf9868f16c1c459a2ef54f8a09c20c7d3183b2176b714db4829c69b5c61fb85b33733b6d71de6a1b6535939a422cd83f73a46480895a276eb65739ac4bc6ffb9561c2ed5d70a02559c5d949901fc18d6be94a5a5cfa56edeaef305c5ef225f50191857e8bc84bea2f2355de4324a43401e96c6cbd52ec11918fd188312d834971b8ddf92a193002e2d78ed953d3fbe1d112cc9b785a11f8d3b7c878350ff038c68c444ce82813a6ab40a16a68b93c75adecacbcbbcb2f44685ef3f35898ad714c0729f3285cffa629fbcea0a4826ab03d02c5eefbe80f98d7ffaf96db57c2bd1b2dae7fcd0b770ae9c109c5b7f38fd6a33628411ef7ce970f5ac72430ad1983dac25a6a1e0fffd807a498c9f94285c37adbd4c812342d3ce30b248b4fdc771581c507908c914ffe675ee74f3bc0da61402ec1a05b7c2d4506b08b14ac4a0ce28229080aa7a331e9e1d78536b330295b03cadbe2feba3c9e6f4796f2f1d59beb58ad934b019e0327679ec678f41007671974f61f0973e0ab7ef352eee6a8bdc95d3e2b95d810e6460aabab8d2c3a5309029ca883e70c3a24bc542ae6b2e1087a342f48122b7d75eadc7137153127c517d559979463d67724ffa89a006d70442afc5df33993c1c4ebc21c6ecec20eafa240c3f09134f36c83ae6706678ce168f74612b15c6ad48e4eac0860d6b7657bb05f7f6ef2e5b69de57b9e40dd135712bdfc7f7a22b004e308cf8e4e8bb9c0a6eb16745463d4d74894aa05731cd18d4134963f2f214177c4b56cde32e48a75985702aa502ac79f7e95a2ffa1c3bf82362e0c4cb2441844bf76565e3023b8dcdcfba235e96cdb7bc2fb8ec6d7c68a506ed6548a59f1a3c214de8dc440368f119d6e0493ce0a0315794b502e3923daf096ba9f4c2ace3df01596ffd82cf710b42cb503a386332b7a87d2ab7e466f499c35e96bc58906f3883194ea969dbb06736f74647f8aa50d816b60d90ccd9608561dc6a85bd7225cafc0a6475587de2411a4451468c9b18b7fd2567b94a49ffb4657205b1dbc1aaa65f54e5b3d41593b87c33a0913ae2ab77bcd6106758196e6a79d413ca3cc571bf85d49251c08a89650cdbfa9a93b36eddf494c66c282a6236731f2f340687cc0d47e718f78a5179e3c3d7e375b2d2b09510f9bb51c750e3b4c33b385b12a1e363fa96856abc559b64f58d964358ed03be6dbcfd11e8260d1d15fb6bdfca0087cda54c9a02790d0081013e8b129526c25d0fff8eab24f901306271e340c245b9b5314e1aa387d75e4b551d6e861ec864a6b351b478becd9421d97aede0bad2dd65c6468a931b4f99f73f739b346a788c13026a1dc80898f91a25fc721f7cb8b4310a8d3fea085c1a60fbe363b9e7be1963d5b3e9a9a446d86e2db01843ffea1c272c6dd012621d1d94f4f59bd03a0a427e589b2a38623f33b4302f8695225d9a82d65a9d23d8ab2beacbe739bd438302d921c5df2c01c7619db7bc91c9de2cff7b2cb0c68d49144b4d20971b6e3d19d702c582cd996e031f907338491e9b898ff989fbba415f32c73b7fc9233f4a40fd4d42424079788d8b1c80c5558df573ed51feeab5d1fa93c2077bd762b126074dfc46efece1343615e4a44aa28e14a94e3e9866cd61c96da06ac5e2ac88437ecfa1ae9b6e04cfb3df71be35e239ba504ca09e18c7a77aea5b51e1839e4c77889a89958f22f81f83f4a0d4a4cc30d374a4ad60fb4661db718a12e11645bf002cfa0bd5cf90138c35fb23cca5e82666db8d2abd45a17c6925422b397dea40a73291c4945725b48966b6d0f39ba1f470a942c5979734841412967abb86677f4f7325a138d3eb69fd39309db7267ce73f694dfed3964b2799f4187bd218f32e64e6e4fca0846a00d748d8a0bf3648f73fe7c02657bb46a1aef1cb8bc423d9740137013ccfaa53125acd9d311f83936ff4bbf07311d4a4010401f297e87b5fe9415441e1f6b556ee0c5cda3526ab0b6938e21495e35fe77732be29e9bc97b05550c54e5f2853b884c2ad226395fe4dbf2a36d2ba3834061a5a5b28c50f44893b16ce0eba6d8b2aafcd87f7615d5d63684d0f463fd62f81abf52014f5df6fc7516795d1b4acefa66b6adcb1fc84c4570804b9d22b59e06317eada8150413b2bf6fecb72308c71be603a0d472ba6175ea52374a8580b2eea3104236df6548ed01c6cfcbc553fa56f4d2d0d3cbc772d95e427f3b4303e68cde3b617aa2c812ae0649558dd23b2cd3fff6e7262362bfa5cf308711e015a80a6dc2df4eddda65b068301725618c171e3a8d0e2b60bab5ac8fbd19bc9d7976cde3bcd86b859284940d6f2f7852248e0f0b5d8659faa448a452e0630df7e92bd42a00257aa0acc320948831fe4da18b0e9458a525e9d21f5a65beed0ced85ae29517b789e8923cc92d98002774150c78ad7ea7e567b99a54d27eaf04100da5236d25439f8f7348b00e897f9b0b8d2fc310c5e21b04b94071eddc0aa5c46a2b6a517fd90b3777ef215caa76c46b80c6b7e522dbca5c3f863374e6473b7c00494419294a856f38af4453d62dce0e4de73e1709c4f8c4429b10cfa38111aa1d4076073abea7101dc2bceca601220f99ffde8c4a29b14b76c26951473012739a695439a914b09d9ba4164af4259a45b25870352032e4d5e169585f773c4447edb00605f7cb775d618212ca087ef74cf2ab82d6cb74fe146f8fa530704040f668b894188aa9e0d161c337a8aa14eb2d7002fcbe29e8eb0869311539492043364c955f52984745ee12b0fb79a792e01d8e72bdf4ffe554caf825c0392244009a85f9a089a1709a7d5034fa3e13c2f0e616c2fc1169821dc4a62e4429477b9420eeed173a53740bf4b140f0d74ea14904fccdd3ef141cfb6edd662ce086d1598e93b4ccd23f8df48f5b840f6e8ba455f5d99b73f3e6b141f6bc8612bca0d573fdd47d68da0c29d9ee93b26272274962d6470cf6e17207609394e229b4e16fd35d597a62f66724bb018cb1fe504002a253000c17c473a66bec43b2f2bb7e78ddf240d142b14943a0db2a604964cc63e8a977931f432304f833c49f27f6f1fc33278b6b79768ce31f1aa58a6009c5d91d64a935f88386fd1c170d6c202aa12b22fc87f0a9c8ec1ed6b8aec447a83abb866c07ce8908337b0d41996d79e74b435cc7b4fb40e9b2769dade33166972c29d922e376fa6652070044b1da7a184454926f88c4059c13c13c2890e8379cac57606e49afd66cb4a5c29916b6f75cc61f60115fef52fba6ae058daba693b4e0ae457e8b1c524b7a24e5be29a0667e1d9fc4539b0d08a9377630c53f6c94ac2c3bd1012d978e2ebc172e932f15903e7ccd1dccf1a16e66ba7d4ee872c63ec43bb5cb6414016f85c23180ea97b026d4978b7eb2ac4425410f0905949b8806d8e93c771bd97ef84c763207e3764b2ffcf5de1e05e9fdaa59f1da150606817bce0813fbcd2759e7c3a04e2e95dd0eebb739e84ca7ce0d6f9198479aa7bb13a724504b60d544f835da0bc0e4b821f713bed48f03742c0dd480c3aad87ec3ac37825632804f7347c21c6ea09b0d2d8871e6d76d2041eb779f751032e87207f983143d3f82127275823f84fec99559a62170bcff8dbd0398f27eb40a83e55a0220aeefb63cfe940dd452d0fb68fda36bdfc608e138db682b95f3cc049235e313ee8a411e75db16871e722b454ae6f38395dc17b06ccfee34d1e1a2b81befe42ffcdeefc5d20a9ac5907283a5ec2c5eafa6c5a585346f18e0e3af03c6c0dc7ea72eb278fd71584e10381bf250ffc22aae34b7be6d3a5b89424904765020ab95d8bd573658a45512e0df1c51627db9f820366d3ddb6145378a405ef85b5fbb47cb5f2bb9dc3b4cb3e5c1e3380423de5", @generic="59d3e4da1b697b97f2dac9c1f286b6bd022cd287b074b410785cbdead1deba3397e896a1bbaecce5eff7dcb30879d9237bff4c1c977e3fb16722c49e5de3824343f602c0a131c4e6e4e5bb76869915e5c3c436b857b8c9135e9b14c1d52d3f96bf23c7de1e9d4f796c96e995c3f0a030befd2142c525281f80adc5954105d3c22dee38e0e9f2c233233577ddbdf2b103223882ea66fc4a1869765513296db7cc2fe4fe721e9fdc13720892387d2e2649763faf3bf7b6b3c5dc3f984ea8cd5254c423d410c5556c96f9233263f2ecf4a60e39f6e57e31761052b94e35fc136172a144425960671479989a04af08036f47213094f8556971012807945f77b6eaff6a7389ed790d936d0ec4da8bf666186c852144a1710aee43fb12590125a585851be30d31278b19542d1aac1d52e89b9ab5d7a46816592a06e9d2e03983f6344cc200c9c9fd6e775935e1cd40509855c747f904570f258f65a3f2303d96f7d5032db3fb78793400d64d0c2301fc99a564fae828be139bbe15647646bc6e4a0f0ea6900240f93e1d7922ae35e615d936169625105f084215bb820fcfcc781f0abdd31b135323f623355812b5abb34c78a5c793b3e7b3fce4092328986d6f3b2b86d78acc66beb116ef862563f67fe6b5f765ac818679373c8f4b4dd2a19b2c49b6221405f5c9cb4f903cd3784d77fce14f6efe65eb06ba6f3cb3f75dc99a026fc99f7477858663a4623e94145b49e9a1118e41890ecf7d8f52931ec0fc35dab1945258c6fd35969b35a8fd1d135eb07af8eba6295e5f357cdf6b55f64ca0564f6f786cebf8e1bb5f198c9fce95b639e9f0ea86b594075a8cabd9781fb3eb2d8aaf9a2bd41fc18bbd81406db322c34cb5d730ff3bacec2e4579320bf7f4e0b6cc3c4d9089e36ddf80ae0d40294f36476e8a0df3ad99be39ef859ce74c93c9971c790d99e5b190cc28faa03e8655668d05cd8209d46b0bed0982d16dd48ad8f2e237c98e72d284027551a00cbd5b5e0f6be984f9cc928ce7d0969d4bbba5fb53a9e3e59d8c6a783c6a5fc5c22a90934d2f6ceea5fe6cf113e4b80791e6a1ba2fc811336c71838ae3cde145462fdaf8c04be5084fb06e3c392980a1d6e3bd299c3d663563524e633c148976c581b3e92a80c0cd493d442eaca6edeff7321a26bf231c3d2d0089c573ae157a7004fe4f0f9d70a00c64416252bd882120fe454ba039536473742ea29ac89a6fb3031519049a0fd0dfcd462aafceb894996ed9c749d2d1bb3d31633706827293df2949dd7c518113f2f99f3d97e56a81ee79ad466a94318bd7bdab083592256669289c2b1e5f647311f0f5d62032cbecd17b1c4d3b9132817e814da00cc3578ef46ed0237d57dc1ff14d856e4318d9c7e7c92ba66d1e127a8639c6d0a961f345d231d07e326a3f09f5fc94ac8ef7ed6f948fa3af9e0b028701f8226215483dcabc3c9aed33d58fa4e75424806eecf009ddb39f152346236fd5b56e205229b0a605cc63a3de93a212b6e9cb869fcb60d748661ddf32e0a3d5d33e06107d3ce2c16744aa16070f911aa219074334b0610cd73a9e00bed83de51791eba506b4fc1c367c482eedb2c895ed8143ac32ed5cb830b039efcb98ed6796dc03dcc5e477b6b1adcc894142bd77e49b9098b4e5eec8892bc9a02cebc9edffeada5b9cb1720a4f8330e7305b7eb7406bc50594e16c9d851c13cab5cef9904731b18194a17238a0f43f690313c132bc2a6e7be586f66385e94e87f0baa46da8d4ba64eef12519f137ff7315f72c062720f7ffc02efdda9165fa679bac77d8eea78d61d588982bf5eaf630b46b8d0b5c6c04106c9719aa9e47148dd06b9e1e16bad827f6c08dfdc73911af810dcb1c3c674256f0e9c6fb61aac8b64cc2783f9f216208f0ff902301d8fa6b0f9fce48d43f301af4364474a708ffdade1843fe8c26a3ea1115f5a83bb1325f4ca3e18d9586cd25cf8656d200f3a5e46c54e82be73ce57fc0bb63213ae499636f8c6636a5db0aaf83b3d36fe9cbd38cac5e7feb776e600446c95f5ecc887ad93e9d8bd552414d2d1924d3920894cfd12084bff22b6f0e5fce2f501fa19a361865c49ed95d8e5c614f4c360ca77abc883bd4cefe631f6274fe581ad58ccfc6cad871ce96664811524a597214939e7e6a07468203c3d2282d91e59567022e9119c6001f89c9e47dad93a1756aa6113731c2e7ec0b8daa0c11d4c4260e196f6b92e4ad8a906c9c281b40cf8775c7f3e07ecd938752560238ebb7e32e992d3229fa208ccb6d3c33cef100dd6e25b2a58899761226d040f7a24563310101b142f632b06ebd2a52b1a712d7021ed35bdac756a67013b64204a6204e7f2c5c9f639684770e669e15b3c2854b2092ac8858c3cc4413623975acec88ec66743ab493e2db9b3e7922047eb295b4a8d537986b8938b27b82a3673de753e21541090f50c3bd84e919ac746f1b414d2ae781d0da8a02b1522c35b5616a2245c703e7b97303fecaf94bb39af3b7175aec20a4015670f3b6a25fce8141a4ae04bc64c297c486aec586fdc36f88d8bc0efe831a8316f946e7c09067ba7b65124f06da165fe57b3b458319a936fb26f297ca27abf867f65b4c891a33652700170d65e978acc666f576f999af724e01f81ab5bec0fe279ac5a79765ba14c995a4799809640fa8d63d04041d833d45070edd7ddca048c6cfc69d4f8dd3e52bd99dd26400e60c6d8a4864718c4f1e855a960a157a8e066819e346ef4e06c078bcb285db43948583c3d36b135b3678a5c6e0bf31db1c43b46ec1f4de3d0548a769c3aaaa5011e9cbcbd5dc930818293562b6da39e841fcb4352f116c1401e859efdbfcb14b2265693efa8e1789d111c010eed51936ecb38dffb05c4ae4c321fbf8fee0ba4bed2c7c30ae904178b10fce6ebdd2d74f6c576796a732847829327de8a6eb5f1e24b5ba2f5e0b869aeef517dcb55f851381901b6eb60f14827dc99970244ab1a0b47bbe32cfcc1b20817c777a4b71807a7d172b306e3bf9fc5d829b7b93deb01cc1ef8f4161c5c6212e9e92772945ef03af7647da9825f110ab2d4a56dbd2038bf50fb358b47328dffa6f0d47196d5ad9c7d9ecec57dcecc3e3515670127a38aea8c030633970115d8a398e69bc90f400f6390e1c3ae592e39c2d1aeb2912c1328c5e3ae71e30b10990b7efba40c6c97dacecb0217146ef4a4b1ccf55b135079588a59339ac3e770b2ab5aadf3afc8f5dd47a2936820df051fe7efd49fd554954ea7f96689befd56ce842d390ada6b6f1e359b5b5e22a12e5dfeff62250d314e15fbd1b241a904c30ed994ebe36d0d3e1eefe40bce0b138bc504f6039227c626dccf5941938b05bc71d7181b0ca116a55a10aebb2e8712ce9a2c221257e08d54211429dd9f6f439bc6be65a588a9161cba0d8e8d62921552edbaa04a5c62f20056295f1821f1c3f9b47a6533ceda6faaf835d060ea53e8e5c44217024547f56d2868e3fe16350769b3631524e8bc739f9accf5af50ad1d5cb7254cf32e3559958109e0f4c213e031521e13529c8a6ef617a522d00856dbd85eebc908d8da4c6af8a1a76f986e2d33f68d0776660c6b0959bf1be777f9b8d7dcca2715d64163f23e3583dfca1956827c9a444de092e3066989fee575c792cdab590ab973b57f7c7daae248b9176322a0e1452adfc89bb55dd14f24b3587a54d19478829bbe71cf646583c3a4bf83a0acd11604f0e3cb34e215af5447583951fe918698091845c58811d3b9a422ae9ddf97031def85658429978d8450c7a6c63efe9ce0144eaaf86805a0747e1b0bc4424f387b9044b42a1967d04a892339ebc64e11678869e47ae2b428fd5dbc05e0fd8bb9bbc96d4f9d4eab1bfad1d5c4dd31ed2ade62c3be3fbe83c11bbbad1f2046a05cbf878d35849ce5879a871134fae436b3711fccc32e4702eaae274ad4db7f4fb03a9fae77e8e887606ced572a6b690be4189e099755856cb54f8e791f918b75a0b2ded5817355df17478e133790455e4906ef1ca60bcc4d2860c870e82bc91a54beb5e04d5a4b48bd095d181c17e47dd6a03e2031f44fa714d9f89ac93cf02c426c3254a45f1706f8ebf483b493988ca5b5da458909eceb7c290334bf07e61bda8162647753fb136d31dc4550fc9cdf09382b20c37b700b59cf3d558ab5afc3da804d218cb9d85c116e7f91a6c0c93842ca93666b90f972a973c58edfbbb2de691e089f1f4e9b916f5774707aa01d2fae11ac46b170b16888bb5a25719b9ba792a38778e0684d3d1123bdd10ffceaf6faa922799d8badfbfdb99c4b0ae965496a824b8f67bb642773d5020030a92d96520582951ba051cc858691e4c0edce7e30dcd511a922228b1c15fcabd5d6c6c868def8287b028d46d3d96b6e4499ae68a0e5915e02bdb0ef2d30b7a459371782232d89025b45fbe2b845677a4c0294fbf43caca9399ba35b9e8cd3b172a5f7174218ad9656e2849ae6b2f54b06313decda8648cd4be283dbc0e1f0a6026a50f0d55e36e1e0f50eed5c26494f7801dde1f9d8f0b6e6215cbf200d17a7aa6c4a1846764ecee0e11f6c1fb61df3424391df3d33be6e9b5da698c6f0dc0ed0ce4d497662365e5497507f4b137a131e5a47203d9d9701cadb183efcd97300fba09a3897a6e22261487dedb18f4eb9a5424c13628aedd6a3a6f38e3676dcd636d13776b0f2fc3ffa5a6f9d14c18117f12e34d7421b62d2225a4b7db7676c66c1f2cae94c9390934157b5e3a6d7b30bdc2c871387f06c2dbd07f804d15afa906928c061d9c0a2548c59c09b9d447b8c7fc886c7ccc2dc00fb33dd6c4f95ac91d5a51e89048246340ecf0868ab2d05f342fe2ba7da10fe3f09acb1abe264c63ceb5b8f86f3b9a2fec9083fac3c8952d8d1db84b5af9b3e843c2c4dbbf6a93e65575c7fb482380932ab25d861992897e0d49a989c7478dae31e07f818481439d296eac0479517894768783912c1da258b06b6ea27dae8d6adb25faacda12758db1fab39405858be6a8d4ad6620e2a3f0db69b6464c8e4d87eec49948f5c2120e58a6e7a8eee05f159779d299cf20c05bc81f9bf9094c9820b7e85ebdee489420bb80e4dd2f8fe621442d3c2d429118cddf25daa6d9cc41c80fb8e94c71754a8b308c71371ccaa69f9b95b03e5be7d960579de723af425401a1fe07134609f44ac359d6ed8dd4f57e7a15d0052f2d18a6d7fa4234f55e9a3ff66214a147e97c8dbca09b69486c249693186f385854dd31ac699b4306c8517a5bc79f75cdce43dbc1fe96da7e338ad89ca380ef6016e237a67fc5863e13ee142de5e8176ee6cda0a96cbb1daa5221f21d59292decb3d5f4003c4c79addddd4c529fc43f9f4c27037e567a7bf7601cab7a2c14d06e3ea76c0dced8d2329591f948bd9fa066f25c1e96a00a3baeb07a3b9500ba5b4457a2463392c4db7c29c648ca71e35f08dde0ad68adf333602cb17e6a2def536e26eac5065ff2e8b608ff03cff5b12cfad9c12788e8c9632147ef68dd9797c4656660e4df544da760caa811da0ace93a6c9b43ccd6b155232de0654a648f8d8605f1a745da6a74b0f430117a41fccac7ba6f384c604a8d7fe2f67ce5471c14f0ec3193a508512d3e84e2fff671399bd4e07fee3c3386fb9df10ee993ff7d1584915870ad7496b12a6abf39a8bd97944e8bbdf0092f76856cf63772e001d6c72c93f4502d08c2738bfba35128de973e8543917a4aab934bcb5470ccaddd69a8708357ab52036a1d575aa495f6d3e07d33a0124fce2d4c9", @typed={0x8, 0x157, 0x0, 0x0, @pid=r7}, @typed={0x4, 0x159}]}, 0x2068}, 0x1, 0x0, 0x0, 0x800}, 0x4018094) r8 = socket$rds(0x15, 0x5, 0x0) sendmsg$rds(r8, &(0x7f0000003380)={&(0x7f0000002ec0)={0x2, 0x4e23, @remote}, 0x10, &(0x7f0000003080)=[{&(0x7f0000002f00)=""/101, 0x65}, {&(0x7f0000002f80)=""/203, 0xcb}], 0x2, &(0x7f0000003240)=[@mask_fadd={0x58, 0x114, 0x8, {{0x9, 0x80000000}, &(0x7f00000030c0)=0x3, &(0x7f0000003100), 0x8, 0x1, 0x0, 0x7, 0x0, 0x9}}, @zcopy_cookie={0x18, 0x114, 0xc, 0xfffffffb}, @mask_fadd={0x58, 0x114, 0x8, {{0x4, 0x7}, &(0x7f0000003140)=0x3, &(0x7f0000003180)=0x6, 0x10, 0x8, 0x2f0, 0x2, 0x71, 0x8}}, @fadd={0x58, 0x114, 0x6, {{0x3bd5, 0x10001}, &(0x7f00000031c0)=0x3, &(0x7f0000003200)=0x7fffffff, 0x5, 0x6, 0x1, 0x1, 0x8, 0x8}}], 0x120, 0x4000}, 0x4000a) r9 = add_key$fscrypt_provisioning(&(0x7f00000033c0), &(0x7f0000003400)={'syz', 0x2}, &(0x7f0000003440)={0x1, 0x0, @a}, 0x48, 0xfffffffffffffffb) ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r2, 0xc0506617, &(0x7f00000034c0)={@id={0x2, 0x0, @a}, 0x21, r9, '\x00', @c}) r10 = openat$uinput(0xffffffffffffff9c, &(0x7f0000003540), 0x2, 0x0) ioctl$UI_SET_KEYBIT(r10, 0x40045565, 0x2e2) 28.059899586s ago: executing program 3 (id=6745): r0 = socket$inet6_sctp(0xa, 0x801, 0x84) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r1, &(0x7f000098d000/0x18000)=nil, &(0x7f0000000440)=[@text16={0x10, 0x0}], 0x1, 0x6d, 0x0, 0x0) r2 = socket$inet6_sctp(0xa, 0x801, 0x84) setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x83, 0x0, 0x0) ioctl$KVM_XEN_HVM_CONFIG(0xffffffffffffffff, 0x4038ae7a, &(0x7f0000000080)={0x3, 0xbde, 0x0, &(0x7f0000000180)="a1984ec3aec3fc2e025f90eda6dbc903939aac644fd36f1e65174cae030c42cbacc392851a695f247112e91f059460a2c031929dc0515ac7cd20775ff9da9c2b6cb48968dcd6d8d982c492932c572f084d3af58650d207eec0794b3e47c5678c36b99eed61e1dbac68ce8a79aa21a51202018bdc4a51489844f785887083841d65c129992bbe5a51c71b95a9847d2bdede66c6e3184c386faf938fd6db888e73a5c0dcc69c3de7458e68ed33226a8d1c8e17", 0x0, 0xb2}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x1, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x41000, 0x42}, 0x94) ioctl$KVM_SET_MSRS(r1, 0x4008ae89, &(0x7f00000002c0)={0x1, 0x0, [{0x40000073, 0x0, 0x81}]}) ioctl$KVM_SET_REGS(r1, 0x4090ae82, &(0x7f0000000040)={[0x7, 0xc, 0x6, 0xfffffffffffffffd, 0x8, 0x5, 0x4, 0x2, 0x8, 0x4, 0x3, 0x3, 0x1932be21, 0x100000000, 0x4, 0x4], 0xeeee0000, 0x40600}) ioctl$KVM_SET_VCPU_EVENTS(r1, 0x4400ae8f, &(0x7f0000000140)=@x86={0x40, 0x1, 0x10, 0x0, 0x8, 0x0, 0x10, 0x0, 0x0, 0x80, 0x9, 0x1, 0x0, 0x0, 0xfffffff8, 0x0, 0xff, 0xff, 0x1}) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1, 0x200000005c832, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000100)={0x101ff, 0x5, 0x80a0000, 0x1000, &(0x7f0000ffd000/0x1000)=nil}) ioctl$KVM_RUN(r1, 0xae80, 0x0) sendmmsg$inet6(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)={0xa, 0x4e22, 0x57, @private1, 0xffffffff}, 0x1c, &(0x7f0000000300)=[{&(0x7f0000000040)="18", 0x1}], 0x1}}], 0x1, 0x0) shutdown(r0, 0x1) keyctl$dh_compute(0x17, &(0x7f0000000400), 0x0, 0x0, &(0x7f00000003c0)={0x0, &(0x7f0000000280)="708803449262dd9da315bcc77984faa6f32831aa941ab5bda92158536f78c390609a10de442bc310c95d22f08c5945f8be8a2b852c85a693afd7d8e5ff1b3aebbd", 0x41}) r3 = openat$mice(0xffffffffffffff9c, &(0x7f0000000080), 0x101) pipe2(&(0x7f0000000040), 0x0) fanotify_init(0x200, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x24, 0x10, 0x701, 0x0, 0x0, {0xa}, [@typed={0x6, 0x1, 0x0, 0x0, @str='\x14\x00'}, @typed={0x8, 0xa, 0x0, 0x0, @fd=r4}]}, 0x24}}, 0x0) sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000140)={&(0x7f00000002c0)=@getneightbl={0x14, 0x42, 0x400, 0x70bd28, 0x25dfdbfd, {}, ["", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x44041}, 0x40) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(r0, 0x84, 0x70, &(0x7f00000001c0)={0x0, @in={{0x2, 0x4e24, @local}}, [0xaa, 0x0, 0x8, 0xffffffff, 0x3, 0x7e, 0x9e, 0x8, 0x0, 0xa, 0x45, 0x100, 0x2, 0xb, 0x80]}, &(0x7f0000000040)=0x100) 27.775900333s ago: executing program 3 (id=6747): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f0000000000), 0x4) bind$inet6(r0, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x5, @loopback, 0x3}, 0x64) sendto$inet6(r0, &(0x7f0000847fff)='X', 0x340f5, 0xe0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) 27.44806625s ago: executing program 3 (id=6748): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000003200)=@newsa={0x140, 0x10, 0x1, 0xfffffffe, 0x100, {{@in=@loopback, @in=@rand_addr=0x64010100, 0x1, 0x7fff, 0x4a23, 0x25, 0x0, 0x0, 0x0, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in6=@mcast1, {0x0, 0x192, 0x6, 0xffff, 0x8251c, 0x2, 0xfffffffffffffff9}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xe73c}, 0x70bd2a, 0x40003504, 0x2, 0x1, 0xa, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}, @sa_dir={0x5, 0x21, 0x1}]}, 0x140}, 0x1, 0x0, 0x0, 0x20048041}, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0], 0x0, 0x0, 0x0) r3 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r3, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0xc) setsockopt$inet_msfilter(r3, 0x0, 0x29, &(0x7f0000000140)=ANY=[@ANYBLOB="e00000027fa80a010100000004"], 0x57) r4 = socket$netlink(0x10, 0x3, 0x0) writev(r4, &(0x7f00000003c0)=[{&(0x7f0000000180)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r4, &(0x7f0000000100)=[{&(0x7f0000000400)="390000001300034700bb5be1c3e4feff06000000010000004500000025000000190004000400ad000200000000000006040000000000f93132", 0x39}], 0x1) setsockopt$inet_mreqsrc(r3, 0x0, 0x28, &(0x7f0000000440)={@multicast2, @loopback, @empty}, 0xc) mount$fuse(0x0, &(0x7f0000000280)='./file0\x00', 0x0, 0x100000, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[]) r5 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r5, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x84000, 0x0) r6 = syz_open_procfs(0x0, &(0x7f00000000c0)='mountinfo\x00') sendfile(r6, r6, &(0x7f0000000000)=0x2eb4, 0x2000007ff) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000580)=@newsa={0x138, 0x18, 0x1, 0xfffffffe, 0x100, {{@in=@dev={0xac, 0x14, 0x14, 0x2d}, @in6=@ipv4={'\x00', '\xff\xff', @broadcast}, 0x1, 0x717, 0x4e23, 0x5, 0xa, 0x0, 0x20, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in6=@private1, {0x0, 0x1000000000000192, 0x1000000000000190, 0xffff, 0x8251c, 0x5, 0xfffffffffffffff9}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0xfffffffe, 0x7}, 0x8070bd2d, 0x3500, 0x2, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x81}, 0x40012) 26.337444505s ago: executing program 3 (id=6749): ioctl$TUNGETFEATURES(0xffffffffffffffff, 0x800454cf, &(0x7f0000000180)) landlock_restrict_self(0xffffffffffffffff, 0x0) process_vm_readv(0x0, &(0x7f0000000900)=[{&(0x7f0000000200)=""/80, 0x50}], 0x1, &(0x7f0000000c80)=[{&(0x7f0000000980)=""/133, 0x85}], 0x1, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/cgroup.procs\x00', 0x2, 0x0) read$FUSE(r0, &(0x7f0000005bc0)={0x2020}, 0x56d) write$cgroup_pid(r0, &(0x7f00000000c0), 0x12) r1 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r1, 0x6, 0x0, 0x0, 0x0) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x30000, 0x0, 0x11, 0xffffffffffffffff, 0x0) openat$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000100), 0x2, 0x0) read(0xffffffffffffffff, &(0x7f0000000340)=""/101, 0x65) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) r2 = syz_open_dev$usbfs(&(0x7f0000000180), 0x205, 0x2581) ioctl$USBDEVFS_GETDRIVER(r2, 0x41045508, &(0x7f00000005c0)={0x0, "bcc7d19c6ce8fe27824d88c090e7663d6cf10d2f599ed622394882c8f51faf6b451a283a5e3d7a8f41776c8886be40f8fb54723c7a4719600992dd87c5e159039170279784bf09a69d54236ab1152f1acdcf02d2bfb72d3365c406c2948fa958907812c863413f0659d96ea5e01bd6b8abd72b73e519c2efe21dfdca5ad71dc6c2c44ec51d1648498e35a6d782f75b6930201ccb022b1d6584b983e6eb133634c03938945173b50feca881ec44c588bc5c026d28915e67c9d7fa998b700eafc57f4fab7daf3fee4f8d1223257af3ee5c31dbaba319b57759e36ffcc825dc232d478fa5c4da1ddae74a5c4a279c0d0d61981c45eeb453e2176768e7a02f1cc3f5"}) r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x89901) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000040)={0x60, 0x2, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:net,net\x00'}, @IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_BUCKETSIZE={0x5}, @IPSET_ATTR_CADT_FLAGS={0x8, 0x11, 0x1, 0x0, 0xc}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x60}, 0x1, 0x0, 0x0, 0x40010}, 0x0) lsetxattr$security_capability(&(0x7f0000000080)='./cgroup/cgroup.procs\x00', &(0x7f0000000700), &(0x7f00000002c0)=@v2={0x2000000, [{0x2, 0x5}, {0x4, 0x1ff}]}, 0x14, 0x0) creat(&(0x7f0000000180)='./cgroup/cgroup.procs\x00', 0x10) move_mount(r3, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) chroot(&(0x7f0000000300)='./file0\x00') syz_clone(0x648e7000, 0x0, 0x0, 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f0000003b80)={0x2020}, 0x2020) 25.759239528s ago: executing program 3 (id=6751): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x3, &(0x7f0000000000)=0x1, 0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x1, 0x2, &(0x7f0000000300)=ANY=[@ANYBLOB="cb", @ANYRES32], &(0x7f0000000040)='GPL\x00', 0x7, 0xa, &(0x7f0000000000)=""/10, 0x41100, 0xa, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x2, 0x8, @loopback, 0x7}, 0x1c) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x20000) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)=ANY=[], 0x48) r2 = openat$ttyS3(0xffffffffffffff9c, 0x0, 0x43, 0x0) ioctl$TIOCGRS485(r2, 0x542e, &(0x7f00000000c0)) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x3, &(0x7f0000000300)=@framed={{0x18, 0x8, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x7}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) mknod$loop(0x0, 0x10, 0x1) rename(&(0x7f0000000600)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000000f40)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') mmap(&(0x7f0000ffc000/0x2000)=nil, 0xc000, 0x1000007, 0x12, r1, 0x0) r3 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000406d04f00800000102030109021b0001010080fa0904"], 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000400)=@bloom_filter={0x1e, 0xffffff4f, 0x6, 0x8, 0x204, 0x1, 0x8, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x5, 0x2, 0x5}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x1, 0x3, &(0x7f0000000200)=@framed, &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_usb_control_io(r3, 0x0, 0x0) r4 = openat$kvm(0xffffffffffffff9c, 0x0, 0x101100, 0x0) ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl(0xffffffffffffffff, 0xc138fd03, &(0x7f0000000000)="0400000000000000000000003801000000000000000000000000000000000000000000000000000000000000000000006d") openat$vimc1(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000016000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, 0x0}], 0x1, 0x4e, 0x0, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) 24.554586297s ago: executing program 33 (id=6751): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x3, &(0x7f0000000000)=0x1, 0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x1, 0x2, &(0x7f0000000300)=ANY=[@ANYBLOB="cb", @ANYRES32], &(0x7f0000000040)='GPL\x00', 0x7, 0xa, &(0x7f0000000000)=""/10, 0x41100, 0xa, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x2, 0x8, @loopback, 0x7}, 0x1c) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x20000) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)=ANY=[], 0x48) r2 = openat$ttyS3(0xffffffffffffff9c, 0x0, 0x43, 0x0) ioctl$TIOCGRS485(r2, 0x542e, &(0x7f00000000c0)) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x3, &(0x7f0000000300)=@framed={{0x18, 0x8, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x7}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) mknod$loop(0x0, 0x10, 0x1) rename(&(0x7f0000000600)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000000f40)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') mmap(&(0x7f0000ffc000/0x2000)=nil, 0xc000, 0x1000007, 0x12, r1, 0x0) r3 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000406d04f00800000102030109021b0001010080fa0904"], 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000400)=@bloom_filter={0x1e, 0xffffff4f, 0x6, 0x8, 0x204, 0x1, 0x8, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x5, 0x2, 0x5}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x1, 0x3, &(0x7f0000000200)=@framed, &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_usb_control_io(r3, 0x0, 0x0) r4 = openat$kvm(0xffffffffffffff9c, 0x0, 0x101100, 0x0) ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl(0xffffffffffffffff, 0xc138fd03, &(0x7f0000000000)="0400000000000000000000003801000000000000000000000000000000000000000000000000000000000000000000006d") openat$vimc1(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000016000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, 0x0}], 0x1, 0x4e, 0x0, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) 15.49816835s ago: executing program 5 (id=6776): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0x8, 0x2, 0x8, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x6, 0x2dcd, 0x1, 0xb4, 0x8, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0xfffffff7, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8002, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x5, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x709, 0xf9a2, 0xa9, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x5, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x8, 0x4], [0x401, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0xd50, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffff7, 0x9, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x40000004, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3fe, 0x1ff, 0x1, 0x7fff, 0x67b2, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfdfffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0x10, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x1, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x4000006, 0x7ffe, 0x28, 0x5, 0xd500, 0x1, 0x77, 0x5, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x4, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x4, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0x200d8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x8, 0x274, 0x6, 0xfffffff9, 0x7, 0x9, 0x9, 0x4, 0x463f, 0xf, 0xdab, 0x5, 0x8, 0x13fff, 0x8, 0x9]}, 0x45c) r0 = socket$unix(0x1, 0x1, 0x0) syz_io_uring_setup(0xd3a, &(0x7f0000000080)={0x0, 0x2, 0x3010, 0x3, 0x3}, 0x0, 0x0, 0x0) setsockopt$sock_int(r0, 0x1, 0x2e, &(0x7f0000000040)=0x10009, 0x4) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz1\x00', {0x3, 0x3, 0x6, 0xfffa}, 0x3a, [0x20008000, 0x1, 0xf, 0x8, 0x7c, 0xfffffffe, 0xb5d, 0x7f, 0x20000006, 0x4d, 0x6, 0x5f, 0x9, 0x5, 0xffff2d37, 0xffffff01, 0x3, 0x5, 0x0, 0x3, 0x400, 0x0, 0x7, 0x40, 0x1, 0x24, 0xd, 0x3fffffe, 0x0, 0xffffffff, 0xe665, 0x204, 0x7, 0x3, 0x8, 0x4c74, 0x80000000, 0x242, 0x400003, 0xe, 0x4, 0x80008071, 0xffffb8f3, 0x17, 0x1, 0x7, 0x5, 0x3e, 0x8f, 0x6, 0x6, 0x0, 0x7, 0x81, 0x4, 0x3ff, 0x8, 0x0, 0x7, 0x9, 0x8, 0x4, 0x0, 0xfffffffc], [0xc0, 0x9, 0x8000012f, 0x8004, 0x5, 0x8, 0x129432e7, 0xc8, 0xf9, 0xe, 0x2bf, 0x6c7, 0x9, 0xfffffffc, 0x6, 0x2, 0x0, 0x45, 0x2f, 0x1782000, 0x313, 0x78, 0xea4, 0x5fa, 0x4, 0x7, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0x1, 0xff, 0x3d, 0x1000005, 0x5bea93c3, 0xd, 0x4e0, 0x2, 0x4, 0x81b, 0x4, 0x9, 0x8, 0x9, 0x6, 0x47, 0x8000, 0x4, 0xfe000000, 0xffff, 0x2, 0x4, 0x10009, 0x3, 0x9, 0x9, 0x9, 0x20003, 0xffffffff, 0x100bc45, 0x48c93690, 0x80, 0x3], [0x7, 0xc08, 0x4, 0x5, 0xfffffffd, 0x40, 0x31d, 0x9, 0x5, 0x7fff, 0x9, 0x10001, 0xb, 0x4, 0x5, 0x5, 0x3, 0x1ef, 0x0, 0x8, 0x86, 0x3, 0x1, 0x3e7, 0xb, 0x5, 0x0, 0x2, 0x3, 0x20000008, 0x4, 0x6d01, 0x6, 0x38, 0x800003, 0x200, 0x80, 0x3, 0x4, 0x2950bfb1, 0x1000, 0xa2, 0x7, 0x2000a9, 0x5, 0x7, 0xac8, 0xbf, 0x1, 0x3, 0x7ff, 0x12b, 0x6, 0x1, 0xa, 0x20, 0x2, 0x1c, 0x8867, 0x3, 0x2006, 0x80a2ed, 0x40000005, 0x25], [0x9, 0xbb33, 0x7, 0x8, 0x5, 0x938, 0x6, 0x6, 0x0, 0xb9, 0xcea, 0x6, 0x2, 0x57, 0x7, 0x3, 0x0, 0x10000, 0x4, 0x37f3, 0xffff, 0xa622, 0x1, 0x80000005, 0x1, 0x2, 0x14c, 0x60a7, 0x6, 0x7f, 0xffffffff, 0x80000000, 0x5, 0x4, 0x4c8, 0x1, 0xfffff000, 0x10000, 0x3, 0x7e, 0x100, 0xfc, 0x40000047, 0xb2, 0x8, 0x6, 0x226, 0x5, 0x5, 0x8, 0x30b1d693, 0x8a1f, 0xf40, 0x7, 0x1, 0x6c1b, 0x0, 0x8, 0x5, 0xb1e, 0x6, 0x200, 0xffff3441, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {0xffffffffffffffff, 0x400}], 0x20000000000000dc, 0x0, 0x0, 0xfffffffffffffcdd) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r5 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000000c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0}, 0x50) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0xa, 0x11, r5, 0xe309b000) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r3, 0x4020aed2, &(0x7f00000001c0)={0x60000, 0x18000, 0x9fef19c9430e26b8}) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0x8], 0x25000, 0x304}) r6 = syz_open_dev$vcsa(0x0, 0x7b95b611, 0x802) writev(r6, &(0x7f0000000b00)=[{&(0x7f00000001c0)}], 0x1) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=@getlink={0x28, 0x12, 0x1, 0x0, 0x0, {}, [@IFLA_EXT_MASK={0x8, 0x1d, 0x3ff}]}, 0x28}, 0x1, 0x0, 0x0, 0x2000}, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) r7 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r8 = dup(r7) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r9 = socket(0x15, 0x5, 0x0) getsockopt(r9, 0x200000000114, 0x2710, &(0x7f000001eec0)=""/102389, &(0x7f0000000000)=0xc74) r10 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r10, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r7, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r10, 0xae80, 0x0) 14.228279304s ago: executing program 5 (id=6780): signalfd(0xffffffffffffffff, &(0x7f0000000000)={[0x3]}, 0x54) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000140), 0x40000000040201, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000500)={0xa00, 0x18, 0xfa00, {0x100000000000000, 0x0}}, 0xfc36) ioctl$SNDCTL_DSP_SPEED(r0, 0xc0045002, &(0x7f0000000240)=0x6f3) write(0xffffffffffffffff, 0x0, 0x0) syz_usb_connect$cdc_ncm(0x4, 0xd1, &(0x7f0000000040)=ANY=[], 0x0) syz_open_dev$sg(&(0x7f00000008c0), 0x0, 0x1) syz_io_uring_setup(0xf08, &(0x7f0000000300)={0x0, 0xfefffffe, 0x800, 0x3, 0x800000c5}, &(0x7f0000000580)=0x0, &(0x7f0000000540)=0x0, &(0x7f0000000f40)=0x0) syz_io_uring_submit(r1, r2, r3, &(0x7f00000001c0)=@IORING_OP_POLL_ADD={0x6, 0x69, 0x0, @fd_index=0x3, 0x0, 0x0, 0x1, {0x54}}) epoll_create1(0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'rose0\x00', 0x112}) preadv(r4, &(0x7f0000000700)=[{&(0x7f0000000080)=""/111, 0x6f}], 0x1, 0x7, 0x4) socket$netlink(0x10, 0x3, 0x14) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0x8001, 0x2}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r5, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x3a8bc000) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) prctl$PR_SET_NAME(0x4, 0x0) 12.676737211s ago: executing program 4 (id=6785): r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f0000000000)={0x3, &(0x7f0000000480)=[{0x21, '\x00', @data=0x9, 0x400}, {0x26, '\x00', @buffer={"bb7e4cfbdea68dbad6cddd0844053830c3ae372d86a18072cadb1e0baeb493b0", 0x20}, 0x8000005}, {0x8, '\x00', @st={0x4, [{0x1, @uvalue=0x7}, {0x70fc8a754da600a0, @uvalue=0xfffffffffffffff5}, {0x3, @svalue=0xc2c}, {0x3, @svalue=0x406}]}, 0x4000801}]}) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = socket(0x10, 0x3, 0x0) r3 = socket$nl_audit(0x10, 0x3, 0x9) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000180)={'batadv_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=@newqdisc={0x58, 0x24, 0xd0f, 0x470bd30, 0x25dfdbff, {0x60, 0x0, 0x0, r4, {0x0, 0xfff2}, {0xfff1, 0xffff}, {0x0, 0xfff3}}, [@qdisc_kind_options=@q_ingress={0xc}, @TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x1, 0x1c, 0x0, 0x5, 0x0, 0x2b, 0x3, 0x1}}, {0x6, 0x2, [0x6]}}]}]}, 0x58}, 0x1, 0x0, 0x0, 0x4000}, 0x44080) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) sendmsg$nl_route_sched(r2, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x4000) r5 = socket$kcm(0x21, 0x2, 0xa) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) madvise(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x16) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x19) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000746000/0x4000)=nil, 0x4000, 0x0) sendmsg$kcm(r5, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000500)=[{0x10, 0x110, 0xd}], 0x10}, 0x0) r6 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) unshare(0x28000600) r8 = socket$inet6_mptcp(0xa, 0x1, 0x106) fcntl$getflags(r8, 0x1) syz_kvm_setup_cpu$x86(r6, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000001c0)=[@text16={0x10, 0x0, 0x4b}], 0x1, 0x0, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000240)="0f20e035000200000f22e02e660ff85f0066b886008ed066cf0fc735e7ff966af3450fc7327d47bdcaca852743c7f897600000b9400101c00f32", 0x3a}], 0x1, 0x41, 0x0, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) 11.617983713s ago: executing program 4 (id=6787): r0 = syz_open_dev$loop(&(0x7f0000000240), 0x75f, 0xa8182) r1 = memfd_create(&(0x7f0000000880)='C\x13\xfc2\x95WD\xaa\xba^\x90\xfd\x8d\xc2\xb1[\x81\xda\xda\xd6\x8c\xc99\xec\x0e*||\xe4\xb3\xc4\xb6\v\xaa\x15\x86,\xac\x8d\x89cu\x10\xdc\x93\x9b\xb4\x93\xafE*:\xe4\xdd\xa5\xa75\xb8\x1e;7\xb7.V\xdcrw[\r\x98\x93j\x9c\xf6\xf8\x99\xefF_\xcd\xdf!b\xc5\xec\ntb\xff\b\xaaF?!\x9f\a\x1a\x03\f\xe94\x1deU\x06zS\xc90\xb9voI\xa5/\xb4\xa7@\xa1\\B\xc2@\r_b\x9a\xeb\b\x81\x00V\xd6/N\xc5\xc6f\xb1\x95Z\xe5w^\xd8\xe7J\x80\xf7\xae\xafuv\x84\x9eG\xd1\xe7\x9b\xf0_9\xc2\x9b\xfd\xc3\xf3\xe4\x95P\xf1m\xcf\xc2\xe1\xe6\xa6\x8c\x11\xfb\xb8S\x8b\x92\\\asW-Ee\x02\x00\x00\x00\xd0;Q\xc1~\x89\xec\xc8\x9b\x88\a\xf2\x93\x82(\x8b\x00\xd8\xb4T\x80\x95\x93\x9c5\xcf\t\x04\x00\x00\x00\x00\x00\x00v\xef\xee+\xab\x9c\x00^R\xb2n?i=\xbe\x16\x8a\xbf\xe3\xcdB\xed\xe14\xe8\xd0\xb7\xff\xfeQ\x1c\x85n8\x1b\xc1\b\x00\x00\x00\x00\x00\x00\x00\x17\x94\xdfW\x92z\xbe\xb2R)\xf1K\xd7\xaf\x99\xf6d\xe8\xec\xb7\xbd+T3\xa6\xa9\xfaY-1qs\x82\xefn*\x96\xc9\x1e\xf4\xd1\x02Dt\xc0\x19\xf7\x89\x96.D [F\xeeYW\x95\x13\xc7;\x94\x13^\x13\xaf\xf0C\x9c\xabf\x1daCS2\x02\xb0\xef\xc7\x8c\x9e\xed\a\n0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x4}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) futex(&(0x7f000000cffc), 0x80000000000b, 0x0, 0x0, &(0x7f0000048000), 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) mremap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x1000, 0x7, &(0x7f0000481000/0x1000)=nil) r1 = userfaultfd(0x80001) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x1}) ioctl$UFFDIO_COPY(r1, 0xc028aa05, &(0x7f0000000040)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, 0x3000}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000140)={'syzkaller1\x00', 0xc201}) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)={0x14, 0x27, 0x301, 0x270bda7, 0x25dfdbfa, {0x13}}, 0x14}}, 0x10) r4 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r2, &(0x7f00000016c0)=ANY=[@ANYBLOB="110086dd0000110000000000000060ec970000382c00fe8000000000000000000000000000aaff02000000000000000000000000000104"], 0xfdef) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="6fe5d6b89c5b0200000004000000030000000900", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) fcntl$F_GET_RW_HINT(r5, 0x40b, &(0x7f0000000000)) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000140)=[{{&(0x7f0000000100)={0xa, 0x4e20, 0x2, @empty, 0xfffffffe}, 0x1c, 0x0}}], 0x1, 0x20080058) 9.468014241s ago: executing program 5 (id=6791): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_SET_TSC_KHZ_vm(r1, 0xaea2, 0x8000000000000001) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newsa={0x154, 0x10, 0x633, 0x0, 0x0, {{@in=@local, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x2}, {@in=@local, 0x1234, 0x32}, @in=@local, {}, {}, {}, 0x0, 0x0, 0x2}, [@algo_crypt={0x48, 0x2, {{'ecb(cipher_null)\x00'}}}, @encap={0x1c, 0x4, {0x7, 0x4e22, 0x4e21, @in=@local}}]}, 0x154}}, 0x0) r3 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) syz_kvm_add_vcpu$x86(r3, &(0x7f0000000080)={0x0, 0x0}) pipe(&(0x7f0000000000)={0xffffffffffffffff}) r5 = socket(0xa, 0x3, 0xff) splice(r4, 0x0, r5, 0x0, 0x800, 0x0) r6 = memfd_create(&(0x7f00000004c0)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x02Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\xff\xec\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92\xf3H\xf9\x7f\x102\x83\x9b\xdaR\a\xfeU\xc8\xc3\xa76\xe7%\x0eyx\x15\n\xe3l\x98\xcf\xbaU6\xf9\xb5S21Bk\xad\xe60P\xa2c)\xca\xc4`_\x15\xc4\t\xaa\xc4e\x12\x103\xf9\xc4\xba\x86[N\xb27BD\xab`\xae\x1c&\xdb\ns\x8c\x92\xe0\xa52\b\x8bj\x01X\xfa\xf2\x8b\xe1\xf9\n\xc4Ux\xa9\x1b\xc6\xad\xb4\xf0\xba+\x91/&\x81\xba\xa5\x8em0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_open_dev$sndmidi(0x0, 0x2, 0x161d02) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) ioctl$SNDRV_TIMER_IOCTL_GSTATUS(0xffffffffffffffff, 0xc0505405, &(0x7f0000000500)={{0xfffffffffffffffc, 0x3, 0x95b3, 0x0, 0x1}, 0x8, 0x48, 0x8001}) syz_ublk_add_dev(r9, r10, r11, r12, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff}}}, &(0x7f0000000480)=0x0) r14 = socket$inet6_tcp(0xa, 0x1, 0x0) r15 = dup(r14) syz_ublk_setup_queues(r15, r13, &(0x7f0000000180)={0x0, 0x1, 0x0, 0x3, 0x255}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x400, 0x2100, 0x10000004, 0x0, r15}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x11e0, 0x1, 0xfffffffe, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf910, 0x0, 0x0, 0x1f0, 0x0, r15}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x587e, 0x8200, 0x2, 0x367, 0x0, r9}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x0, 0x0, 0x0}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x6, 0x0, &(0x7f0000000000)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x94) close(0xffffffffffffffff) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x334}, 0x1, 0x0, 0x0, 0x20000080}, 0x0) 8.412612043s ago: executing program 0 (id=6795): socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) fsopen(&(0x7f00000005c0)='aufs\x00', 0x0) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) pipe2$watch_queue(&(0x7f0000000300), 0x80) socket$kcm(0x10, 0x2, 0x4) socketpair$unix(0x1, 0x5, 0x0, 0x0) r2 = socket(0x10, 0x3, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$DEVLINK_CMD_RATE_GET(r3, &(0x7f0000001780)={0x0, 0x0, &(0x7f0000001740)={&(0x7f0000000140)={0x14, 0x0, 0xf1aad47e89fb43b5}, 0x14}}, 0x0) r4 = getpgid(0x0) timer_create(0x7, &(0x7f00000000c0)={0x0, 0x25, 0x0, @tid=r4}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) preadv2(0xffffffffffffffff, &(0x7f0000000200)=[{0x0}], 0x1, 0x40, 0x4, 0x0) syz_open_dev$usbfs(&(0x7f0000000100), 0x75, 0x4cf40) r5 = syz_open_dev$sndctrl(&(0x7f0000000180), 0xad85, 0x16b002) unshare(0x20000400) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r5, 0xc0405519, 0x0) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0xc, &(0x7f0000000140)={0x6}, 0x10) write(r2, &(0x7f0000000000)="1c0000001a005f0214f9f407000904001f000000ff02000200000000", 0x1c) 8.073345482s ago: executing program 2 (id=6796): mmap$IORING_OFF_SQ_RING(0x110c230000, 0x4, 0x2000007, 0x80010, 0xffffffffffffffff, 0x0) unshare(0x22020600) setsockopt$inet_opts(0xffffffffffffffff, 0x0, 0x4, 0x0, 0x0) r0 = gettid() r1 = signalfd4(0xffffffffffffffff, &(0x7f0000000080)={[0x1003ffffffc]}, 0x8, 0x80800) poll(&(0x7f0000000000)=[{r1, 0x5}], 0x1, 0x90) timer_create(0x3, &(0x7f0000000040)={0x0, 0x11, 0x4, @tid=r0}, &(0x7f0000044000)) syz_usb_connect$uac2(0x3, 0x9f, &(0x7f00000002c0)=ANY=[], &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0}) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ff0000/0x4000)=nil, &(0x7f0000ff8000/0x2000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000fec000/0x1000)=nil, &(0x7f0000ff9000/0x4000)=nil, 0x0}, 0x68) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, 0x0, 0x0) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) getsockopt$inet_sctp_SCTP_CONTEXT(0xffffffffffffffff, 0x84, 0x11, &(0x7f0000000040)={0x0, 0x8}, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000000080)={0x81, 0x6, 0xf, 0x4e98, 0x200000, 0x3, 0x1, 0x1fe, r4}, 0x0) ioctl(r2, 0xbc, &(0x7f0000000400)="15e01ef1fb6ebdf12d4b028a155cfcff28227964d1eaa45a6eced66ff98316d98f0e4b8022a4de8e9ba296cc72f4203c4ce56f286a0da80a9db545d596dbcf833062da0cca3a8141384501e812a52cddfd0bd6302ce058e13d87287360dea3a1baafbce885c0d8832785ac6eb41cbd0e003afde6633968c0d74dac") r5 = openat$kvm(0xffffff9c, &(0x7f0000000140), 0x40300, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000340)={0x1fe, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r7, 0x4090ae82, &(0x7f0000000200)={[0x2, 0x9, 0xfffffffffffffffd, 0x85, 0x2, 0x0, 0x4002004c8, 0x1004, 0x45c5, 0xc595, 0x7, 0x2, 0x4, 0x0, 0x80000003fffffe, 0x200000000c], 0x100000, 0x2810d3}) ioctl$KVM_RUN(r7, 0xae80, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) timer_settime(0x0, 0x236bd4336e4642df, &(0x7f0000000300)={{0x0, 0x1}, {0x0, 0xe4c}}, 0x0) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2a, &(0x7f0000000100)=0x2000ea, 0x4) ioctl$sock_SIOCSIFVLAN_GET_VLAN_INGRESS_PRIORITY_CMD(r1, 0x8983, &(0x7f00000001c0)) sendmsg$TCPDIAG_GETSOCK(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, 0x0}, 0x0) shmget$private(0x0, 0x13000, 0x78000b10, &(0x7f0000feb000/0x13000)=nil) getpeername(0xffffffffffffffff, 0x0, &(0x7f0000002000)=0x18) 6.512564758s ago: executing program 6 (id=6797): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000000000010f3044d0700000000000109022400010000200009040103020300020009210000401322180009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0) r1 = memfd_create(&(0x7f0000000100)='test\x00', 0x2) ftruncate(r1, 0x1000) r2 = landlock_create_ruleset(&(0x7f00000000c0)={0xa019, 0x2, 0x3}, 0x18, 0x0) landlock_restrict_self(r2, 0x0) r3 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) ioctl$UI_SET_EVBIT(r3, 0x5460, 0x3) fcntl$addseals(r1, 0x409, 0x2) r4 = ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f0000000200)={r1, 0x0, 0x0, 0x1000}) mmap(&(0x7f0000800000/0x1000)=nil, 0x1000, 0x3, 0x11, r4, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000300)={0x1, 0x3, 0x1000, 0x2000, &(0x7f0000800000/0x2000)=nil}) ioctl$KVM_PRE_FAULT_MEMORY(0xffffffffffffffff, 0xc040aed5, &(0x7f0000000400)={0x1000, 0x1000}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000cc0)={0x2c, 0x0, 0x0, 0x0, &(0x7f0000000b80), 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000240)={0x2c, &(0x7f00000000c0)={0x0, 0x22, 0x3c, {0x3c, 0x22, "e1539f83423ce05a676d83937cab16b929095fdcd970add421d107f364d9de459e258e3f810d3f4d770abd4093fc2553b8b187d62f34fa88a99d"}}, &(0x7f0000000140)={0x0, 0x3, 0x12, @string={0x12, 0x3, "53a4804ca03672e4f0b995938721eb31"}}, &(0x7f0000000180)={0x0, 0xf, 0x8, {0x5, 0xf, 0x8, 0x1, [@ptm_cap={0x3}]}}, &(0x7f00000001c0)={0x20, 0x29, 0xf, {0xf, 0x29, 0x60, 0x0, 0xb, 0x5, "4ffe705c", "9eb3184d"}}, &(0x7f0000000200)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x4, 0x1d, 0x6, 0x8, 0x1, 0x5}}}, &(0x7f0000000700)={0x84, &(0x7f0000000280)=ANY=[@ANYBLOB="200b8a200000501051ee62cf01fb4482bb51586f9e3d8edf11877fdec8bb9f6de179151b2b9f12d08f882f694ceeff41170d89a4bbd09ec60d28a114c0024be947de9ec8a5a2be9db7f9d51d0fa482c90a63c2bbe4446cc802ee3900da127821186f2ed3efb962b85b9a2c6eb2def068710f616571a90699867e67851895e4741ac3a7a1f595d5c8d3e313aa64ee0c26"], &(0x7f0000000340)={0x0, 0xa, 0x1, 0x5}, &(0x7f0000000380)={0x0, 0x8, 0x1}, &(0x7f00000003c0)={0x20, 0x0, 0x4, {0x2, 0x2}}, &(0x7f0000000400)={0x20, 0x0, 0x4, {0xc0, 0x20}}, &(0x7f0000000440)={0x40, 0x7, 0x2, 0x7}, &(0x7f0000000480)={0x40, 0x9, 0x1, 0x1}, &(0x7f00000004c0)={0x40, 0xb, 0x2, "0f56"}, &(0x7f0000000500)={0x40, 0xf, 0x2}, &(0x7f0000000540)={0x40, 0x13, 0x6, @local}, &(0x7f0000000580)={0x40, 0x17, 0x6, @broadcast}, 0x0, &(0x7f0000000600)={0x40, 0x1a, 0x2, 0x9}, &(0x7f0000000640)={0x40, 0x1c, 0x1, 0xff}, &(0x7f0000000680)={0x40, 0x1e, 0x1, 0x2}, &(0x7f00000006c0)={0x40, 0x21, 0x1, 0x3}}) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r8, 0xae60) r9 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r8, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000080)=[@text32={0x20, 0x0}], 0x1, 0x5f, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r9, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000200)="f7790066baa00066b86b4266ef66ba420066b8e20066ef0f29902cbb0000c4e2b1ba8c88d9000000666666440f38826b410f7842280f07b8010000000f01d9c4033921820f47a753fd", 0x49}], 0x1, 0x43, 0x0, 0x0) ioctl$KVM_SET_VAPIC_ADDR(r9, 0x4008ae93, &(0x7f0000000040)=0x1000) ioctl$KVM_SET_MSRS(r9, 0x4008ae89, &(0x7f00000000c0)={0x10000053}) 5.69554374s ago: executing program 0 (id=6798): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="54000000020601080000000000000000000000000c00078008000640000000000500010006000000050005000a00000005000400000000000900020073797a31000000000d000300686173683a6e6574"], 0x54}, 0x1, 0x0, 0x0, 0x48000}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[@ANYBLOB="44000000090601020000000000000000000000000900020073797a310000000005000100070000001c0007801800018014000240"], 0x44}, 0x1, 0x0, 0x0, 0x10000047}, 0x4000084) sendmsg$IPSET_CMD_DESTROY(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)={0x1c, 0x3, 0x6, 0x401, 0x0, 0x0, {0x2, 0x0, 0x5}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x20000080) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0xc080) r3 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x800) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="4c0000001000010400"/18, @ANYRES32=0x0, @ANYBLOB="00000000000000002c00128009000100626f6e64000000001c0002800500"], 0x4c}}, 0x0) bind$alg(0xffffffffffffffff, 0x0, 0x0) r5 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r5, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) connect$inet(r5, &(0x7f0000000080)={0x2, 0xe26, @local}, 0x10) ioctl$KVM_GET_STATS_FD_vm(0xffffffffffffffff, 0xaece) capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000280)={0x0, 0x9, 0x4, 0x81, 0xffffffff, 0xffffffff}) connect$inet(r5, &(0x7f0000000180)={0x2, 0x4e22, @local}, 0x10) setsockopt$IP_VS_SO_SET_TIMEOUT(r5, 0x0, 0x48a, 0x0, 0x0) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) ioctl$TUNATTACHFILTER(r0, 0x401054d5, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6}]}) socket$kcm(0x29, 0x5, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0xc, &(0x7f0000000100)=@assoc_value, &(0x7f0000000000)=0x8) openat$binfmt_format(0xffffffffffffff9c, &(0x7f0000000140)='/proc/sys/fs/binfmt_misc/syz1\x00', 0x2, 0x0) 5.580896392s ago: executing program 4 (id=6799): socket$inet6(0xa, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r2, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000400)={@in6={{0xa, 0x4e23, 0x9, @local, 0x6}}, 0x0, 0x0, 0x2f, 0x0, "03c2769bf71d7836323485466b1ab4062438333b0365838e9d56324587db0009466206f9bd19e028710cd7a9a0524637e9cc8f9dc099fc3aecf50f4d209cb4733d2af1e022a74f0d66fba11caeef38f8"}, 0xd8) setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f00000012c0)={@in6={{0xa, 0x4e24, 0x5, @ipv4={'\x00', '\xff\xff', @local}, 0x19}}, 0x0, 0x0, 0x34, 0x0, "0c9e089c1b4a04000bde79f04103c458187eb46c2d996aff287154e786455261c425a7519cc275d04e6205abd307a0c4fa3838bf399ad5bd35f21907c7988d1300"}, 0xd8) r3 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r3, &(0x7f0000000140)=[{&(0x7f0000000180)="580000001400192340834b80040d8c560a067f0200ff000000000000000058000b4824ca945f64009400ff0325010ebc000000000000008000f0fffeffe809005300fff5dd00000010000100080c10000000000000000000", 0x58}], 0x1) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) close(0xffffffffffffffff) socket$inet6_sctp(0xa, 0x1, 0x84) close(0x3) mmap(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x0, 0x8031, 0xffffffffffffffff, 0xc2233000) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r4 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x20040, 0x0) ioctl$TUNSETOFFLOAD(r4, 0xc004743e, 0x110c230007) r5 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r5, 0x4004743d, 0x110e22fff6) r6 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r6, 0x0) close(0x3) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r6, 0x84, 0x7a, &(0x7f0000000340)={0x0, @in6={{0xa, 0x3, 0x4, @mcast1}}}, &(0x7f0000000040)=0x84) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000500)=ANY=[@ANYBLOB], 0x28}, 0x1, 0x0, 0x0, 0x42014}, 0x4080040) sendmmsg$inet_sctp(0xffffffffffffffff, 0x0, 0x0, 0x44) 5.476066262s ago: executing program 0 (id=6800): quotactl$Q_SYNC(0x7fffffffc0000082, 0x0, 0x0, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) close(r0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r0, &(0x7f0000001140)={0x0, 0x0, &(0x7f0000001100)=[{&(0x7f0000000300)="ff", 0x1}], 0x1, 0x0, 0x0, 0x10}, 0x300480d4) bind$unix(r0, &(0x7f0000000340)=@file={0x1, './file0\x00'}, 0x6e) recvmsg(r1, &(0x7f00000001c0)={0x0, 0x80000001, 0x0}, 0x2002) r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/wakeup_count', 0xa0042, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_group_source_req(r3, 0x0, 0x2e, &(0x7f0000000340)={0x3, {{0x2, 0x0, @multicast1}}, {{0x2, 0x400, @initdev={0xac, 0x1e, 0x3, 0x0}}}}, 0x108) setsockopt$inet_group_source_req(r3, 0x0, 0x2e, &(0x7f0000000700)={0x5, {{0x2, 0x0, @multicast2}}, {{0x2, 0x3, @multicast2}}}, 0x108) setsockopt$inet_group_source_req(0xffffffffffffffff, 0x0, 0x2e, &(0x7f00000002c0)={0x1, {{0x2, 0x4e24, @multicast2}}, {{0x2, 0x4e23, @multicast2}}}, 0x108) getsockopt$inet_buf(r3, 0x0, 0x30, &(0x7f0000000340)=""/224, &(0x7f00000001c0)=0xe0) write$RDMA_USER_CM_CMD_REJECT(r2, &(0x7f0000000080)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x5, "2d0523", "3fac0cc1b8d231f3b6714b5c9d168a34df8c9470103bb32d5f7a4149b741d1be723cdba392eb53512233bfb78c3b9b75d92421ce8d7ac7b28c12db33faf7c49548028a037ce93e4b1fbc2e936ab24faa4efc7f46570cc8b07a552f463debb0c8ecf1b4c8f86d34938d7f9d9502f17903724a66c993e59a7390d8c28d4244c91ca9ae8937b79297d354778a079a911bf47eba8b2342ce4b2e5cd5f188d0c9f6ceee10ede60d6b2c7a98e65eba2a465983e087a31f06a0031cf45a78bdb30c0cb6b9d454419cbe74120d5a5646a0b4a7829d7d7e788f433d52dc7a6e658fc053e87b01fbcf2eb6fa7fd9fb98bf894d3d2494dfe48371f131c1e6a3e8005e587675"}}, 0x110) r4 = socket$nl_generic(0x10, 0x3, 0x10) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000640)={0x7, &(0x7f0000000040)=[{0x9, 0x9, 0x7, 0x3}, {0x0, 0x56, 0x1}, {0x7, 0xc3, 0x3, 0x3}, {0x0, 0x5, 0xff}, {0x147, 0x8, 0x7, 0x2}, {0xd900, 0xf8, 0x9a, 0x1}, {0x5, 0x7, 0x7f, 0x1}]}) r5 = syz_genetlink_get_family_id$devlink(&(0x7f0000000680), 0xffffffffffffffff) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r7 = syz_usb_connect(0x3, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010800d972a440b72040155ab7010203010902120001000000000904000000ff"], 0x0) syz_usb_control_io$cdc_ncm(r7, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r7, 0x0, 0x0) syz_usb_control_io$hid(r7, 0x0, &(0x7f00000008c0)={0x2c, &(0x7f0000000500)=ANY=[@ANYBLOB="200c03000000a5add592144710500fd31d4da31a312adb2a88aa2e7eee4db28357ac4ddd5d07a25c0c7af5b138370dd1827bf6bf22adbd51c1fc2db10416311499c42c8186883a696e6d6008ceedfd4545746b9d2a4da440ac55624b8e6c0166c15b35b9c276f7c4afd80d448dc8486fe71ffc0689d365527c82730d08ee9c56d6e765a280cf8aa692f9953d022818fa6740da267d803b213115dd2d60ce9daceb35fe793e046548aae48b2d0e69ac0795eac1b44b14797de3ee2904a5fc9b38b00400e9197e31d41e0f24c8244309ed33204c3ddf1588e172bc444cc570a1b9a4ccc6df85f234f525732e6e3ff4100c5da7218fe43d6f93fbcb1d68cd580c609a480fd8367e03a0025cf8f996dc9e8a65696bd660f867589734"], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r7, 0x0, 0x0) syz_usb_control_io$uac3(r7, 0x0, &(0x7f0000000f80)={0x44, &(0x7f0000000d80)={0x0, 0x14}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$netlink(r6, 0x10e, 0x4, 0x0, &(0x7f0000000180)) sendmsg$DEVLINK_CMD_TRAP_GET(r4, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f00000006c0)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="01002700ffdbdf253d0000000e0001006e657464657673696d0000000f0002006e657464657673696d3000001c008200736f757263655f6d61635f69735f7d756c74696361737400"], 0x50}, 0x1, 0x0, 0x0, 0x81}, 0x4c094) sendmsg$DEVLINK_CMD_RATE_NEW(r2, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB='@\x00\x00', @ANYRES16=r5, @ANYBLOB="00042dbd70000000002000a800db7bef3239f395f05b9f37b0d20914028393d68c23d9d46a683c0c00a7000400000000000000a6a104b1cedea0adfaec13366e60f1b71f680b52816a31618b94bffdf122927770568fc8887de5aab654880100faf31a378a0d49e4f8b745c8ce779d3efd40bddbf631c99739db1c708c56f2d916305006ceae98d85f1c36506051767343f9f854187b6ed53a0d5d0f551bd0f444de4bec0119c7e6df9243807110cc4271862400595ddc138cf378fa4d69b77ba77b029b18bb6fef0d34ff9916e9ea564390f6b3bab4c464f4997ee20bd0779542a839a30b7c68523a063c4d5ef2c971"], 0x40}, 0x1, 0x0, 0x0, 0x4010}, 0x8804) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000001180)=@mangle={'mangle\x00', 0x1f, 0x6, 0x5c0, 0x420, 0x238, 0x420, 0x420, 0x238, 0x4f0, 0x4f0, 0x4f0, 0x4f0, 0x4f0, 0x6, &(0x7f0000000480), {[{{@uncond, 0x0, 0xd0, 0x118, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x5}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@loopback, 'ip6gretap0\x00', {0x2}}}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@common=@inet=@set3={{0x50}, {{0xffffffffffffffff, 0x1, 0x2}, {0xa, 0x2}, {0x5, 0x10943bb5}, 0x4}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00', 0x0, {0x3}}}, {{@uncond, 0x0, 0xd0, 0x118, 0x0, {}, [@common=@mh={{0x28}, {"a8c5", 0x1}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@multicast1, 'veth1_to_hsr\x00', {0x6}}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00', 0x0, {0x1, 0xa}}}, {{@ipv6={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @private0, [0xff000000, 0x0, 0xffffff00], [0xff, 0xff000000, 0xffffff00, 0xff000000], 'ip6tnl0\x00', 'pimreg1\x00', {0xff}, {}, 0x0, 0x9, 0x2, 0x8}, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x620) quotactl$Q_SYNC(0xffffffff80000100, 0x0, 0x0, 0x0) 4.87560639s ago: executing program 2 (id=6801): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000600), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000640)={'wlan0\x00', 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_KEY(r3, &(0x7f0000000c80)={0x0, 0x4000, &(0x7f0000000c40)={&(0x7f0000000bc0)={0x28, r1, 0x1, 0x70bd2d, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x28}, 0x1, 0x0, 0x0, 0xc00}, 0x0) 4.660244736s ago: executing program 2 (id=6802): syz_open_dev$ttys(0xc, 0x2, 0x0) r0 = syz_open_dev$ptys(0xc, 0x3, 0x0) r1 = syz_usb_connect(0x5, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="120100004898b610c2154100201f0102030109021b0001000500ea09040002018c78fd00090582f3c6"], 0x0) syz_usb_control_io$cdc_ncm(r1, &(0x7f0000000080)={0x14, 0x0, &(0x7f0000000a40)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_ep_write$ath9k_ep1(r1, 0x82, 0xfffffffffffffdd5, &(0x7f0000000280)=ANY=[@ANYRES64]) r2 = openat$vnet(0xffffffffffffff9c, &(0x7f00000003c0), 0x2, 0x0) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/keys\x00', 0x0, 0x0) r4 = add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000100)={'fscrypt:', @desc2}, &(0x7f0000000140)={0x0, "7af9c2add30c3b0d788d9a94b0731ab8d4a8502c36822594c41a3a588f9ea10f4ea91dff6ece7b715bd30d75c5da8c5c4dada466bf73ee60295d1d133135d5c7", 0x14}, 0x48, 0xfffffffffffffffe) keyctl$set_timeout(0xf, r4, 0x10001) read$FUSE(r3, &(0x7f0000001580)={0x2020}, 0x2020) ioctl$int_in(r2, 0x40000000af01, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x2}) ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f0000000600)) r6 = dup(r5) r7 = openat$full(0xffffffffffffff9c, &(0x7f0000000300), 0x222200, 0x0) r8 = fcntl$dupfd(r2, 0x0, r7) ioctl$VHOST_SET_VRING_ADDR(r8, 0x4028af11, &(0x7f0000000340)={0x0, 0x0, 0x0, &(0x7f0000000180)=""/251, 0x0, 0xe000}) ioctl$VHOST_NET_SET_BACKEND(r8, 0x4008af30, &(0x7f0000000080)={0x0, r6}) r9 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r9, &(0x7f00000000c0)='asymmetric\x00', &(0x7f0000000280)) add_key(&(0x7f0000000000)='asymmetric\x00', 0x0, &(0x7f0000000400)="308201d43082017ba00302010202142eea648d7f17e62e9e5869c887c68e1bd0f86fde300a06082a8648ce3d040302303a3138303606035594030c2f436572746966696361746520766572696669636174696f6e2045434453412073656c662d74657374696e67206b65793020170d3234303431333232313632365a180f32313234303332303232313632365a303a3138303606035504030c2f436572746966696361746520766572696669636174696f6e2045434453412073656c662d74657374696e67206b65793059301306072a8648ce3d020106082a8648ce3d0301070342000407e56b51affc19412c88926b775771039ee2fe6e6a714ec7299f90e177189fc2e70a82d08ae181a9717c5a73fb25b95b1e248c739ff838f848b4ad1619c022c6a35d305b301d0603551d0e041604142900bcea1deb7bc8479a84a23d758efdfdd2b2d3301f0603751d230418301680142900bcea1deb7bc8479a84a23d758efdfdd2b2d3300c0603551d130101ff04023000300b0603551d0f040403020780300a06082a8648ce3d040302034700304402201ad7ac07c89738f489437ec7666ea5007c121db409760c996b8c265de9705cb4022073b7c77a5adb670a96d1132b27cff2b57d6a317bc44219cf4f674f356aee2925", 0x1d8, r9) ioctl$VHOST_NET_SET_BACKEND(r8, 0x4008af30, &(0x7f00000002c0)) ioctl$TIOCSWINSZ(r0, 0x5414, &(0x7f0000000000)) r10 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r10, &(0x7f0000000080)={0x0, 0xffffffffffffff51, &(0x7f0000000000)=[{&(0x7f0000000440)="d80000001c0081044e81f782db44b904021d080201000000120000a1180002000000000000000e1208000f0100810401a80016002000014003000008035fecfab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef075c11503c6bbace8017cb090000001fb791643a5ee4001b146218a07445d6d930dfe1d9d322fe7c9fd68775730d16a4683f5aeb4edbb57a50a5ccca9e00360db70100000040fad95667e0060000000000000080bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd68adbef3d93452a00"/216, 0xd8}], 0x1, 0x0, 0x0, 0x7400}, 0x0) 3.831083438s ago: executing program 6 (id=6803): signalfd(0xffffffffffffffff, &(0x7f0000000000)={[0x3]}, 0x54) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000140), 0x40000000040201, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000500)={0xa00, 0x18, 0xfa00, {0x100000000000000, 0x0}}, 0xfc36) ioctl$SNDCTL_DSP_SPEED(r0, 0xc0045002, &(0x7f0000000240)=0x6f3) write(0xffffffffffffffff, 0x0, 0x0) syz_usb_connect$cdc_ncm(0x4, 0xd1, &(0x7f0000000040)=ANY=[], 0x0) syz_open_dev$sg(&(0x7f00000008c0), 0x0, 0x1) syz_io_uring_setup(0xf08, &(0x7f0000000300)={0x0, 0xfefffffe, 0x800, 0x3, 0x800000c5}, &(0x7f0000000580)=0x0, &(0x7f0000000540)=0x0, &(0x7f0000000f40)=0x0) syz_io_uring_submit(r1, r2, r3, &(0x7f00000001c0)=@IORING_OP_POLL_ADD={0x6, 0x69, 0x0, @fd_index=0x3, 0x0, 0x0, 0x1, {0x54}}) epoll_create1(0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'rose0\x00', 0x112}) preadv(r4, &(0x7f0000000700)=[{&(0x7f0000000080)=""/111, 0x6f}], 0x1, 0x7, 0x4) socket$netlink(0x10, 0x3, 0x14) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0x8001, 0x2}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r5, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x3a8bc000) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) prctl$PR_SET_NAME(0x4, 0x0) 3.77538296s ago: executing program 4 (id=6804): openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) sendmsg$MPTCP_PM_CMD_GET_LIMITS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x41}, 0x809d) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="000002f0d31209000000bc2e79e995"], 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)=@newlink={0x20, 0x10, 0x1, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x40810, 0x1}}, 0x20}, 0x1, 0x0, 0x0, 0x24040051}, 0x4c840) write$binfmt_script(r2, &(0x7f0000000100), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x3e, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000499000/0x18000)=nil, &(0x7f0000000040)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="14000000"], 0x14}, 0x1, 0x0, 0x0, 0x4015}, 0x24040004) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10008000}, 0x40095) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000240)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) sendmsg$inet6(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0xa, 0x4e21, 0x80000, @loopback, 0x3}, 0x1c, 0x0}, 0x44060) ioctl$KVM_RUN(r3, 0xae80, 0x0) 3.2757905s ago: executing program 5 (id=6805): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x24, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) r2 = syz_usb_connect$uac2(0x3, 0x87, &(0x7f0000000080)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x20, 0xdba, 0x1000, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x75, 0x3, 0x1, 0x6, 0x10, 0x2, {0x8, 0xb, 0x1, 0x0, 0x1, 0xc}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0xff80, 0x7, 0x15, 0x4}, [@output_terminal={0xc, 0x24, 0x3, 0x2, 0x304, 0x5, 0x4, 0x0, 0x1ff, 0x1c}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x10, 0xc, 0x2, 0x9, {0x8, 0x25, 0x1, 0x80, 0x30, 0xad, 0x100}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x20, 0x2, 0xfa, 0xbc, {0x8, 0x25, 0x1, 0x2, 0xfa4024f26d164786, 0x81, 0x9}}}}}}}}]}}, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac2(r2, &(0x7f0000000000)={0x14, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0003560000005603"]}, 0x0) 2.688550434s ago: executing program 4 (id=6806): r0 = socket$l2tp(0x2, 0x2, 0x73) setsockopt$inet_mreqsrc(r0, 0x0, 0x25, &(0x7f0000000000)={@remote, @dev={0xac, 0x14, 0x14, 0x1d}, @multicast2}, 0xc) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000240)={&(0x7f0000000380)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x0, 0x0, 0x2}}, 0x0, 0x1a, 0x0, 0x1, 0x4}, 0x28) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r2) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x8000003, 0x6361, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc04, {0x0, 0x0, 0x0, r4, {0x0, 0xd}, {0xffff, 0xb}, {0x4, 0xffe0}}, [@qdisc_kind_options=@q_cake={{0x9}, {0xc, 0x2, [@TCA_CAKE_TARGET={0x8, 0x8, 0x3}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x240040a1}, 0x4890) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r7 = socket$kcm(0x11, 0x3, 0x0) sendmsg$kcm(r7, &(0x7f0000002900)={&(0x7f0000000500)=@xdp={0x2c, 0x8, r6, 0x109}, 0x80, &(0x7f0000000600)=[{&(0x7f0000000380)="da", 0x14}], 0x1}, 0x20000885) r8 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000200), 0x140, 0x0) ioctl$RTC_UIE_ON(r8, 0x7003) close(0x3) 2.413247303s ago: executing program 2 (id=6807): socket$nl_netfilter(0x10, 0x3, 0xc) mq_open(0x0, 0x8c2, 0x30, 0x0) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, 0x0) sendmsg$NL80211_CMD_DEAUTHENTICATE(0xffffffffffffffff, 0x0, 0x20040014) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) r1 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = syz_open_procfs$pagemap(0x0, &(0x7f0000001080)) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x1, 0x0, 0x0, 0x0, 0x5}, 0x94) ioctl$PAGEMAP_SCAN(r2, 0xc0606610, &(0x7f00000001c0)={0x60, 0x0, &(0x7f0000e67000/0x3000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, &(0x7f0000000000)=[{0x7, 0x0, 0x83}, {0x9, 0x0, 0xb187}], 0x2, 0x1, 0x0, 0x0, 0x42, 0x5c}) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) openat$ttyprintk(0xffffffffffffff9c, 0x0, 0x21041, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000006c0)) ptrace(0x10, r1) ptrace$poke(0x5, r1, &(0x7f0000000200), 0x0) getpid() mprotect(&(0x7f000099f000/0x4000)=nil, 0x4000, 0x1000006) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0xffffffffffffffff}}, './file0\x00'}) socket$nl_xfrm(0x10, 0x3, 0x6) mmap(&(0x7f00003ef000/0xc00000)=nil, 0xc00000, 0x300000a, 0x40010, r3, 0x8a803000) r4 = socket$netlink(0x10, 0x3, 0x15) getsockopt(r4, 0x5, 0xc64, &(0x7f0000000440)=""/156, &(0x7f0000000040)=0x9c) syz_emit_vhci(&(0x7f0000000400)=ANY=[@ANYBLOB="043e130100ca0001"], 0x16) socket$l2tp(0x2, 0x2, 0x73) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x240000, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x4c02}) readv(r5, &(0x7f0000000080)=[{&(0x7f0000003140)=""/4107, 0x100b}], 0x1) socket$kcm(0x2, 0xa, 0x2) 1.901644297s ago: executing program 0 (id=6808): prctl$PR_SET_NO_NEW_PRIVS(0x43, 0x1) r0 = memfd_create(&(0x7f0000000640)='\xa3\xac\xce\xe1\x88\x9d[\x10\x00\xd7\xce\x1f 9I\x7f\x15\x1d\x93=\xb5\xe7\\\'L\xe6\xd2\x8e\xbc)JtTDq\x81\xcf\x81\xba\xe51\xf5 \xc8\x10>\xc9\\\x85\x17L\xbf\xcf\x91\xdfM\xf3\x02^T*\x00\x02\xb9~B\x9f\xacl\x1d3\x06o\xf8\x16H\xaa*\x02\xf7\xfb\x06\xf1\x83\x92\xa8\xc2\xcb\xae\xb0\xb4\x93\xb8\x04\xf1\x99\xc2yY+\xd9\x95\x8a\xd5b\xe8\"q\x1b0)\xccm\xacz\xc1\xadd\x9b6a\xf3\xdds\xbb\x88\xff\b\x85\xb3s\x00\x0e\xbcfvi\x85\xfc.|\xd4h\xec\x82o\x8e\x93\x11\xc1\xd4\xae\x05\x17=\xd9R\xd0\xd4\x90\xcf\x9b\xdc\xaeV\x88\x94\x9f\xe3\xefqi\xed\xa8w\xbe\xd0\xd0-tBl\x9e+\xd3\xed\xce\x9f\x83\x86\xf9\x12\x16Ts\x80\x13]C\xfb`\xc2`\xf7\x1a\x00\x00\x00\x00\x00\x00\x00k\xae\xcb\x1a.\xc2\x8f\xd184]PZ\x9e\xd5Y\xf0L\xa4\xbc\x84\xf6\x04L\xff0\x8b\\*\xf9,\xb6\r\x97\xedy\xe0\x8a\xf3\x8ck\xc6S\xc3g\xb9\x1a\xf8\x8f \x9d\x00u7\xd8\'\xf1E\xa4(Q\x80Fy\xb5\xe4q\xc9\xff \xd8\x9d\xad\x11\xf8m\xd3\xbc\x9e\x10D\x7f!\xca\x0ev\x15h$\x01\xdd\xe5\xce\xf8*\xb3\x01\x85\a\xe4qv&\x9c\xac\x9aN~o\xe5\x89\xd5\a\x9f\f\x1f\xc2e/\x8d\x1e\n\xd0_\xbd!^\xa46\xb8j\xc0x\n\xdb\xe1\xa3\xd6\xae;\r\x92@\xa5I\x88Z1F\xf0\x1at\t\xd0\x8a\x04m\x06\xf3BL\xffS\x9eY\xf4\xb0U \xf8\xd00\x88y\xebX\x92\xd5\xbb\xa1h7\xf3\xe0\x0f\xbd\x02\xe4%\xf9\xb1\x87\x8aM\xfeG\xb2L\xbd\x92-\xcd\x1f\xf4\xe1,\xb7G|\xec&\xa2\xab\xf6\x84\xe0\xcf1\x9a\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0x0) execveat(r0, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x240640, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, &(0x7f0000000200)) r3 = accept4$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @dev}, &(0x7f0000000080)=0x10, 0x800) openat$vnet(0xffffffffffffff9c, 0x0, 0x2, 0x0) prctl$PR_MCE_KILL(0x4e, 0x1, 0x0) prctl$PR_MCE_KILL(0x4e, 0x1, 0x4000) setsockopt$inet_msfilter(r3, 0x0, 0x29, &(0x7f00000000c0)={@multicast2, @empty, 0x0, 0x7, [@initdev={0xac, 0x1e, 0x0, 0x0}, @remote, @private=0xa010101, @dev={0xac, 0x14, 0x14, 0x41}, @rand_addr=0x64010101, @multicast1, @broadcast]}, 0x2c) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@dev={0xfe, 0x80, '\x00', 0x1b}, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x4, 0x0, 0xfffffffffffffffc, 0x0, 0x6}, {0xa6, 0x0, 0x400000000, 0x8}, 0x0, 0x0, 0x1, 0x0, 0x0, 0x3}, {{@in6=@ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0xa}}, 0x0, 0x32}, 0x0, @in=@private=0xa010101, 0x0, 0x5, 0x0, 0xb7, 0xffff, 0xfffffffe}}, 0xe8) execve(&(0x7f0000000240)='./file0\x00', &(0x7f0000000300)={[&(0x7f0000000280)='\x00', &(0x7f00000002c0)='/}']}, &(0x7f00000004c0)={[&(0x7f0000000340)='/dev/dlm-control\x00', &(0x7f0000000380)='/dev/net/tun\x00', &(0x7f00000003c0)='([\x00', &(0x7f0000000400)='{)*%\'-\'\x00', &(0x7f0000000440)='/dev/dlm-control\x00', &(0x7f0000000480)='/dev/net/tun\x00']}) r5 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000), 0x8502, 0x0) write$sndseq(r5, &(0x7f00000005c0)=[{0x6, 0x0, 0x0, 0x0, @time, {0x4}, {}, @ext={0x0, 0x0}}, {0x0, 0x0, 0x0, 0x1, @tick, {}, {}, @raw32}, {0x0, 0x0, 0x0, 0x0, @time, {}, {}, @raw8={"272be5806cd46d7b9ff797a0"}}, {0x0, 0x0, 0x0, 0x0, @time={0x8000, 0x1}, {}, {}, @result={0xbac, 0x28}}], 0x70) preadv(r1, 0x0, 0x0, 0x4, 0x4) 1.855722902s ago: executing program 4 (id=6809): r0 = syz_open_dev$loop(&(0x7f0000000240), 0x75f, 0xa8182) r1 = memfd_create(&(0x7f0000000880)='C\x13\xfc2\x95WD\xaa\xba^\x90\xfd\x8d\xc2\xb1[\x81\xda\xda\xd6\x8c\xc99\xec\x0e*||\xe4\xb3\xc4\xb6\v\xaa\x15\x86,\xac\x8d\x89cu\x10\xdc\x93\x9b\xb4\x93\xafE*:\xe4\xdd\xa5\xa75\xb8\x1e;7\xb7.V\xdcrw[\r\x98\x93j\x9c\xf6\xf8\x99\xefF_\xcd\xdf!b\xc5\xec\ntb\xff\b\xaaF?!\x9f\a\x1a\x03\f\xe94\x1deU\x06zS\xc90\xb9voI\xa5/\xb4\xa7@\xa1\\B\xc2@\r_b\x9a\xeb\b\x81\x00V\xd6/N\xc5\xc6f\xb1\x95Z\xe5w^\xd8\xe7J\x80\xf7\xae\xafuv\x84\x9eG\xd1\xe7\x9b\xf0_9\xc2\x9b\xfd\xc3\xf3\xe4\x95P\xf1m\xcf\xc2\xe1\xe6\xa6\x8c\x11\xfb\xb8S\x8b\x92\\\asW-Ee\x02\x00\x00\x00\xd0;Q\xc1~\x89\xec\xc8\x9b\x88\a\xf2\x93\x82(\x8b\x00\xd8\xb4T\x80\x95\x93\x9c5\xcf\t\x04\x00\x00\x00\x00\x00\x00v\xef\xee+\xab\x9c\x00^R\xb2n?i=\xbe\x16\x8a\xbf\xe3\xcdB\xed\xe14\xe8\xd0\xb7\xff\xfeQ\x1c\x85n8\x1b\xc1\b\x00\x00\x00\x00\x00\x00\x00\x17\x94\xdfW\x92z\xbe\xb2R)\xf1K\xd7\xaf\x99\xf6d\xe8\xec\xb7\xbd+T3\xa6\xa9\xfaY-1qs\x82\xefn*\x96\xc9\x1e\xf4\xd1\x02Dt\xc0\x19\xf7\x89\x96.D [F\xeeYW\x95\x13\xc7;\x94\x13^\x13\xaf\xf0C\x9c\xabf\x1daCS2\x02\xb0\xef\xc7\x8c\x9e\xed\a\n0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) (async) timer_settime(r6, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) (async) r7 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) r9 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r9, 0x4048aecb, &(0x7f0000000780)={0x6, 0x0, [{0x4, 0xffffffff, 0x1, 0x7, 0x6, 0x6, 0x2}, {0x40000000, 0x4, 0x0, 0x8001, 0x27, 0x7, 0x5}, {0x7, 0x8, 0x0, 0x2, 0x5, 0x5, 0xffff}, {0xb, 0x2, 0x0, 0x7, 0x1, 0x6, 0x80000001}, {0xd, 0x4, 0x1, 0xd, 0x3, 0x7ff, 0x400}, {0x1, 0x8d3d, 0x6, 0x9, 0x3ff, 0x1, 0x3}]}) (async) bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e22, 0x77c, @empty, 0x1}, 0x1c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'lo\x00'}) 1.315874971s ago: executing program 6 (id=6814): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000200)={0x0, 0x7}, 0x8) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000180)={0x2, 0x3, 0x0, 0x3, 0x12, 0x0, 0x70bd2c, 0x25dfdbfc, [@sadb_key={0x3, 0x9, 0x80, 0x0, "1cdc0dca1d9f68846960e56de42944af"}, @sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @loopback, 0x2}}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x7, 0xc}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @loopback, 0x7}}, @sadb_x_nat_t_type={0x1, 0x14, 0x7}]}, 0x90}, 0x1, 0x7}, 0x0) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000000)={0x0, 0xcc}, 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000280)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) sendmmsg$inet6(r0, &(0x7f00000003c0)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0x4, @loopback, 0x280020}, 0x1c, &(0x7f00000000c0)=[{&(0x7f0000000140)='\x00', 0x1}], 0x1}}], 0x1, 0x20008050) setsockopt$inet_sctp6_SCTP_RESET_ASSOC(r0, 0x84, 0x78, &(0x7f0000000100), 0x4) 1.129683157s ago: executing program 5 (id=6815): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={0x0}}, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x8}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x4d, 0xfffffffb, 0x7fffffff}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) sendmsg$nl_route_sched(r1, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000001f80)=@newqdisc={0x838, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdf8, {0x0, 0x0, 0x0, r3, {0x10}, {}, {0xa, 0x3}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x80c, 0x2, [@TCA_TBF_RTAB={0x404, 0x2, [0x1, 0xfffffffe, 0x0, 0x8000, 0x3, 0x5, 0x5, 0xb762, 0x6, 0x7, 0x8, 0xf, 0x2, 0x80000001, 0x400, 0x7fc, 0xffff8000, 0x6, 0x401, 0x9, 0xb89, 0xffffe4f5, 0xd6, 0x4, 0xffff, 0x7, 0x0, 0x2, 0x101, 0x6, 0xfffffffc, 0x4, 0x1, 0x1, 0x9, 0xc, 0x20001000, 0x4, 0x2, 0x7, 0x4, 0x99, 0x9, 0x2, 0x6, 0x7, 0xfffffff7, 0x1, 0x2, 0x9, 0x9, 0x44, 0x8, 0x8, 0x1, 0x4, 0x7ff, 0x8, 0x7, 0x80000001, 0x400, 0x8, 0xfffffa72, 0xcd, 0xffffff80, 0x80000000, 0xc, 0x4, 0x65, 0x91, 0x659, 0x9, 0xf, 0x9, 0xc28, 0x9, 0x7, 0x3, 0x401, 0x3, 0x2, 0xfffffffa, 0x1, 0x3, 0x3, 0x1, 0x9, 0x8, 0x8, 0x7, 0x1, 0x1, 0xffffffff, 0x7, 0x40, 0x2, 0x12, 0x8000, 0x1, 0x4dc, 0x80, 0x3, 0x0, 0xff, 0x9, 0xa7, 0x12, 0x2, 0x0, 0x3, 0x1000, 0x4, 0x401, 0x7, 0x80000000, 0xffff, 0x6, 0x5, 0x4, 0xffffffff, 0x80000000, 0x1966f9ab, 0x200, 0x20200, 0x3, 0xfffffc00, 0x6, 0x4, 0x800008, 0x485e, 0xa85, 0x80000040, 0x2, 0x7, 0x7, 0x102, 0x2d5421e8, 0x7, 0x10000, 0xffffffff, 0x6, 0x3ff, 0xf04, 0x0, 0x2, 0x5, 0xfffffc01, 0x5, 0x8d, 0x4, 0x401, 0x4, 0x9, 0x3, 0xfffffffb, 0x1, 0x0, 0x0, 0x2, 0x5, 0x9, 0x3, 0x0, 0x800, 0x2, 0x800008, 0x7ff, 0x1, 0x80000009, 0x6, 0x5, 0x5, 0x4d15, 0x1ff, 0xfffff060, 0x3, 0x469, 0x3, 0x0, 0x200, 0x10000005, 0x7, 0x1, 0x8, 0x42ba, 0x4, 0x9, 0x3, 0x8, 0x8, 0x53, 0x6, 0x4, 0x400, 0x8000, 0x0, 0x2c310b18, 0xfff, 0x0, 0x3, 0x7, 0x9, 0x81, 0xdf3, 0x2, 0x7, 0x8, 0xfff, 0x1ff, 0x8000, 0x3, 0x8, 0x3, 0x9, 0x9a6, 0xe4cb, 0x402, 0x1, 0x1ff, 0x3e, 0x9b4, 0x1, 0x8, 0x2, 0x8, 0x0, 0x9, 0x0, 0x4, 0x10, 0x901, 0x5, 0x2, 0x7b, 0xfffffeff, 0x6, 0x6, 0xc, 0x1000, 0x9, 0x9, 0xe6, 0xab, 0x400, 0x7fffffff, 0xed, 0x7ff, 0xd83, 0x68, 0x80000001, 0x4, 0x1, 0x6, 0x1fd, 0x2]}, @TCA_TBF_PTAB={0x404, 0x3, [0x8, 0x7200, 0xd, 0x400, 0x0, 0x3, 0x5, 0x10000, 0x7, 0x4, 0x81, 0x0, 0x8, 0x0, 0x9, 0x5, 0xc0000, 0x8001, 0x1, 0x2000, 0x1, 0x8da5, 0x1, 0x4, 0x2, 0x6, 0x58, 0x7, 0x6f, 0x8, 0x3, 0x4, 0x9, 0x1000, 0x4, 0x80000000, 0x6, 0x80000001, 0x3, 0x1, 0x9bc, 0x100, 0xa, 0xfff, 0x8, 0x9, 0x7, 0x7fffffff, 0xf4b3, 0x1, 0x0, 0x8, 0x8, 0x6, 0xd815, 0xfffffff9, 0x2, 0x401, 0x9, 0x36, 0xf, 0x74, 0xbbc, 0x9, 0xfffffffe, 0x6, 0x8, 0x5, 0x6, 0x40000b, 0x5, 0x5, 0x4e3, 0x200, 0x0, 0x8, 0x8001, 0x2, 0x1000, 0x7fffffff, 0x46a3, 0x6, 0x2, 0x1dd50645, 0x401, 0x5, 0x101, 0x4bf, 0x0, 0x9, 0x3, 0x65, 0xffffff13, 0x2, 0x30, 0x1a3f, 0x2, 0x389c, 0x4, 0x3, 0x3ff, 0x4, 0x4, 0x6, 0xf3bb, 0x1ff, 0x8, 0xf, 0xb, 0x401, 0x8600, 0x1000, 0x1, 0x8, 0x1, 0x7ff, 0x7fff, 0x8, 0x408, 0x3ff, 0x4, 0x1, 0xffff, 0x7fff, 0x2, 0x40, 0x1, 0xfff, 0x0, 0xfffffffe, 0x4, 0x0, 0x101, 0x78f0, 0xf, 0x7, 0x0, 0x3, 0xf1c7, 0x100, 0x3, 0x4, 0xfffffffe, 0xffffff7f, 0x3, 0x0, 0x6, 0xd, 0x4831, 0xa, 0x8, 0x200, 0x0, 0x400, 0x9, 0x6, 0x132f, 0xaba3, 0x1, 0x3, 0x1, 0x5, 0x6f788000, 0xc, 0x1ff, 0x40, 0x8, 0x3, 0x2, 0x1, 0x0, 0x71, 0xb13, 0x4, 0xbc5, 0x0, 0x7, 0xffff, 0x100, 0x7b58, 0x0, 0x807, 0x1ff, 0x3, 0x400, 0xffffffff, 0x1040, 0x3, 0xfffffffa, 0x9a6, 0x8, 0x5, 0x1, 0x9, 0x3, 0x9, 0x7, 0x3, 0x1, 0x101, 0x2, 0x6, 0x598f, 0x5, 0x8e, 0x0, 0xa, 0x9, 0x1000, 0x8, 0xd00f, 0x2, 0x1, 0x6, 0x2a, 0x7, 0x100, 0x24e, 0xbd, 0x2, 0x2800000, 0x807, 0x0, 0x401, 0x6, 0x2, 0x9, 0x7039, 0x4, 0x1, 0x9, 0x1, 0xb18, 0x2, 0xfffffffe, 0x26e, 0x6, 0x5c, 0x8, 0x100, 0x3ff, 0x1, 0x0, 0xb, 0x10000, 0x8, 0x6, 0x2, 0x6, 0x7, 0x2, 0x7ff, 0x0, 0x4, 0x8001, 0x3]}]}}]}, 0x838}, 0x1, 0x0, 0x0, 0x40098}, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r4) r5 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000380)=ANY=[@ANYBLOB="12013f00000000407f04ffff00000000000109022d000100000000090400001503000000092140000001220f000905", @ANYRES32], 0x0) syz_usb_control_io$hid(r5, 0x0, 0x0) syz_usb_control_io(r5, &(0x7f0000000b00)={0x2c, &(0x7f0000000040)=ANY=[@ANYBLOB="00000f"], 0x0, 0x0, 0x0, 0x0}, 0x0) r6 = syz_open_dev$hiddev(&(0x7f0000000080), 0x0, 0x40200) ioctl$HIDIOCGUSAGE(r6, 0x501c4814, 0x0) ioctl$HIDIOCGPHYS(r6, 0x80404812, &(0x7f0000000000)) socket$inet6_tcp(0xa, 0x1, 0x0) openat$binfmt_format(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/sys/fs/binfmt_misc/syz2\x00', 0x2, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r7 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r7, &(0x7f00000002c0), 0x40000000000009f, 0x0) 1.015115779s ago: executing program 6 (id=6816): openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) sendmsg$MPTCP_PM_CMD_GET_LIMITS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x41}, 0x809d) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="000002f0d31209000000bc2e79e995"], 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)=@newlink={0x20, 0x10, 0x1, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x40810, 0x1}}, 0x20}, 0x1, 0x0, 0x0, 0x24040051}, 0x4c840) write$binfmt_script(r2, &(0x7f0000000100), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x3e, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000499000/0x18000)=nil, &(0x7f0000000040)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="14000000"], 0x14}, 0x1, 0x0, 0x0, 0x4015}, 0x24040004) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10008000}, 0x40095) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000240)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) sendmsg$inet6(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0xa, 0x4e21, 0x80000, @loopback, 0x3}, 0x1c, 0x0}, 0x44060) ioctl$KVM_RUN(r3, 0xae80, 0x0) 409.014058ms ago: executing program 2 (id=6817): r0 = syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x10, 0x4e7, 0x9, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x80, 0x1, "", [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x1, 0x0, {0x9, 0x21, 0x8000, 0xfa, 0x1, {0x22, 0x28}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff, 0x7, 0x7d, 0xc4}}}}}]}}]}}, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0xa0302, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(aes)\x00'}, 0x58) accept4(r1, 0x0, 0x0, 0x800) select(0x40, &(0x7f0000000140)={0x4, 0x401, 0x2, 0x7, 0xe, 0x5, 0xfffffffffffffffe, 0x7fffffff}, 0x0, &(0x7f00000001c0)={0x6f, 0xffffffffffff8000, 0x68, 0x7f, 0xba, 0x8000000000000000, 0x7, 0x4}, &(0x7f0000000280)) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f00000003c0)={0x2c, &(0x7f00000000c0)={0x0, 0xb908d6bc4aadd2a4, 0x28, {0x28, 0x8, "a6b5301f000000f0478f46b71ea9e43d35a33174c7da444a78c531664a4f1ec645eaf56c402b"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) 0s ago: executing program 6 (id=6818): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000080)={0x0, 0x2}, 0x8) bind$inet6(r0, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback, 0x3}, 0x1e) setsockopt$inet_sctp6_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f0000000100)=@assoc_value, 0x8) sendto$inet6(r0, &(0x7f0000000000)='d', 0x1, 0x60, &(0x7f00000000c0)={0xa, 0x4e23, 0x8d, @loopback, 0xfffffff9}, 0x1c) (fail_nth: 10) kernel console output (not intermixed with test programs): should_fail_ex+0x410/0x560 [ 2198.167703][T29234] _copy_from_user+0x2d/0xb0 [ 2198.167733][T29234] ___sys_sendmsg+0x1c6/0x360 [ 2198.167766][T29234] ? __lock_acquire+0x747/0x2de0 [ 2198.167795][T29234] ? __pfx____sys_sendmsg+0x10/0x10 [ 2198.167863][T29234] ? __fget_files+0x2a/0x420 [ 2198.167898][T29234] ? __fget_files+0x3a2/0x420 [ 2198.167938][T29234] __x64_sys_sendmsg+0x1b1/0x290 [ 2198.167972][T29234] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 2198.168025][T29234] do_syscall_64+0x166/0x520 [ 2198.168055][T29234] ? trace_irq_disable+0x3b/0x140 [ 2198.168078][T29234] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2198.168100][T29234] ? clear_bhb_loop+0x70/0xc0 [ 2198.168127][T29234] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2198.168149][T29234] RIP: 0033:0x7fce5ad9e159 [ 2198.168171][T29234] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2198.168190][T29234] RSP: 002b:00007fce5bd28028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2198.168215][T29234] RAX: ffffffffffffffda RBX: 00007fce5b025fa0 RCX: 00007fce5ad9e159 [ 2198.168233][T29234] RDX: 0000000000000000 RSI: 0000200000000580 RDI: 0000000000000003 [ 2198.168248][T29234] RBP: 00007fce5bd28090 R08: 0000000000000000 R09: 0000000000000000 [ 2198.168261][T29234] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2198.168275][T29234] R13: 00007fce5b026038 R14: 00007fce5b025fa0 R15: 00007fce5b14fa48 [ 2198.168310][T29234] [ 2198.460568][T29242] syzkaller0: entered promiscuous mode [ 2198.460595][T29242] syzkaller0: entered allmulticast mode [ 2198.844373][T19473] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 2198.995016][T19473] usb 3-1: New USB device found, idVendor=0846, idProduct=1001, bcdDevice= 1.00 [ 2198.996533][T19473] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 2198.996566][T19473] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 2199.001971][T19473] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2199.002000][T19473] usb 3-1: Product: syz [ 2199.002015][T19473] usb 3-1: Manufacturer: syz [ 2199.002031][T19473] usb 3-1: SerialNumber: syz [ 2199.097139][ T1220] usb 6-1: new high-speed USB device number 35 using dummy_hcd [ 2199.144399][T16894] usb 5-1: new high-speed USB device number 56 using dummy_hcd [ 2199.244439][ T1220] usb 6-1: Using ep0 maxpacket: 16 [ 2199.245367][ T1220] usb 6-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 2199.246866][ T1220] usb 6-1: config index 0 descriptor too short (expected 51443, got 18) [ 2199.249118][ T1220] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2199.249142][ T1220] usb 6-1: Product: syz [ 2199.249157][ T1220] usb 6-1: Manufacturer: syz [ 2199.249172][ T1220] usb 6-1: SerialNumber: syz [ 2199.277471][ T1220] r8152-cfgselector 6-1: Unknown version 0x0000 [ 2199.277498][ T1220] r8152-cfgselector 6-1: config 0 descriptor?? [ 2199.280273][T19473] kaweth 3-1:1.0: Firmware present in device. [ 2199.335168][T16894] usb 5-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 2199.336606][T16894] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2199.340510][T16894] usb 5-1: config 0 descriptor?? [ 2199.344269][ T9] usb 4-1: new high-speed USB device number 56 using dummy_hcd [ 2199.467926][T19473] kaweth 3-1:1.0: Statistics collection: 0 [ 2199.467952][T19473] kaweth 3-1:1.0: Multicast filter limit: 0 [ 2199.467966][T19473] kaweth 3-1:1.0: MTU: 0 [ 2199.467978][T19473] kaweth 3-1:1.0: Read MAC address 00:00:00:00:00:00 [ 2199.501938][ T1220] r8152-cfgselector 6-1: Unknown version 0x0000 [ 2199.502487][ T1220] r8152-cfgselector 6-1: No union descriptors [ 2199.519979][ T9] usb 4-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 2199.523106][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2199.544909][T16894] udl 5-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 2199.555353][ T1220] r8152-cfgselector 6-1: USB disconnect, device number 35 [ 2199.557043][ T9] usb 4-1: config 0 descriptor?? [ 2199.760411][T16894] [drm] Initialized udl 0.0.1 for 5-1:0.0 on minor 1 [ 2199.760440][T16894] [drm] Initialized udl on minor 1 [ 2199.776979][ T9] udl 4-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 2199.880604][T19473] kaweth 3-1:1.0: Error setting SOFS wait [ 2199.880853][T19473] kaweth 3-1:1.0: probe with driver kaweth failed with error -5 [ 2199.892538][T19473] usb 3-1: USB disconnect, device number 24 [ 2199.947828][T16894] udl 5-1:0.0: [drm] *ERROR* Read EDID byte 0 failed [ 2199.948484][T16894] udl 5-1:0.0: [drm] Cannot find any crtc or sizes [ 2199.984005][ T9] [drm] Initialized udl 0.0.1 for 4-1:0.0 on minor 2 [ 2199.984033][ T9] [drm] Initialized udl on minor 2 [ 2200.061924][T29271] syzkaller1: entered promiscuous mode [ 2200.061942][T29271] syzkaller1: entered allmulticast mode [ 2200.173758][ T9] udl 4-1:0.0: [drm] *ERROR* Read EDID byte 0 failed [ 2200.174104][ T9] udl 4-1:0.0: [drm] Cannot find any crtc or sizes [ 2200.324974][ T1220] usb 6-1: new high-speed USB device number 36 using dummy_hcd [ 2200.409569][ T9] udl 4-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 2200.409979][T14158] usb 4-1: USB disconnect, device number 56 [ 2200.410201][ T9] udl 4-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffed [ 2200.410487][ T9] udl 4-1:0.0: [drm] Cannot find any crtc or sizes [ 2200.485941][ T1220] usb 6-1: Using ep0 maxpacket: 32 [ 2200.490266][ T1220] usb 6-1: unable to get BOS descriptor or descriptor too short [ 2200.490323][ T1220] usb 6-1: New USB device found, idVendor=0dba, idProduct=1000, bcdDevice= 0.40 [ 2200.521240][ T1220] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2200.521299][ T1220] usb 6-1: Product: syz [ 2200.521314][ T1220] usb 6-1: Manufacturer: syz [ 2200.521328][ T1220] usb 6-1: SerialNumber: syz [ 2200.612171][ T9] usb 5-1: USB disconnect, device number 56 [ 2200.613624][T16894] udl 5-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 2200.614215][T16894] udl 5-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffed [ 2200.638281][T16894] udl 5-1:0.0: [drm] Cannot find any crtc or sizes [ 2200.766029][ T1220] usb 6-1: unit 4 not found! [ 2200.766057][ T1220] usb 6-1: unit 0 not found! [ 2201.013665][ T1220] snd-usb-audio 6-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 2201.038837][ T1220] usb 6-1: unit 4 not found! [ 2201.038865][ T1220] usb 6-1: unit 0 not found! [ 2201.082385][ T1220] snd-usb-audio 6-1:1.1: probe with driver snd-usb-audio failed with error -22 [ 2201.100110][ T1220] usb 6-1: unit 4 not found! [ 2201.100134][ T1220] usb 6-1: unit 0 not found! [ 2201.689727][ T1220] snd-usb-audio 6-1:1.2: probe with driver snd-usb-audio failed with error -22 [ 2201.710902][ T1220] usb 6-1: USB disconnect, device number 36 [ 2201.789777][T25525] udevd[25525]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.2/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 2203.044293][T19473] usb 6-1: new high-speed USB device number 37 using dummy_hcd [ 2203.195116][T19473] usb 6-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 2203.196539][T19473] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2203.198749][T19473] usb 6-1: config 0 descriptor?? [ 2203.224215][T10490] usb 5-1: new high-speed USB device number 57 using dummy_hcd [ 2203.374293][ T5348] usb 3-1: new full-speed USB device number 25 using dummy_hcd [ 2203.374445][T10490] usb 5-1: Using ep0 maxpacket: 16 [ 2203.375470][T10490] usb 5-1: New USB device found, idVendor=04f3, idProduct=074d, bcdDevice= 0.00 [ 2203.376461][T10490] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 2203.376487][T10490] usb 5-1: config 0 has no interface number 0 [ 2203.376567][T10490] usb 5-1: config 0 interface 1 altsetting 3 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2203.376595][T10490] usb 5-1: config 0 interface 1 altsetting 3 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2203.376617][T10490] usb 5-1: config 0 interface 1 altsetting 3 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 2203.376637][T10490] usb 5-1: config 0 interface 1 has no altsetting 0 [ 2203.376659][T10490] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2203.379029][T10490] usb 5-1: config 0 descriptor?? [ 2203.389339][T10490] usbhid 5-1:0.1: fixing wrong optional hid class descriptors count [ 2203.413484][T19473] udl 6-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 2203.528637][ T5348] usb 3-1: unable to get BOS descriptor or descriptor too short [ 2203.529548][ T5348] usb 3-1: not running at top speed; connect to a high speed hub [ 2203.529576][ T5348] usb 3-1: New USB device found, idVendor=17ef, idProduct=304f, bcdDevice=ed.2e [ 2203.530747][ T5348] usb 3-1: config 6 has an invalid interface number: 196 but max is 0 [ 2203.530769][ T5348] usb 3-1: config 6 has no interface number 0 [ 2203.530788][ T5348] usb 3-1: config 6 interface 196 has no altsetting 0 [ 2203.532873][ T5348] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2203.532888][ T5348] usb 3-1: Product: syz [ 2203.532898][ T5348] usb 3-1: Manufacturer: syz [ 2203.532907][ T5348] usb 3-1: SerialNumber: syz [ 2203.610721][ T5348] r8152-cfgselector 3-1: Unknown version 0x0000 [ 2203.659044][T19473] [drm] Initialized udl 0.0.1 for 6-1:0.0 on minor 1 [ 2203.659073][T19473] [drm] Initialized udl on minor 1 [ 2203.824420][T19473] udl 6-1:0.0: [drm] *ERROR* Read EDID byte 0 failed [ 2203.824758][T19473] udl 6-1:0.0: [drm] Cannot find any crtc or sizes [ 2203.838899][T10490] elan 0003:04F3:074D.00FA: failed to start in urb: -90 [ 2204.230289][T10490] elan 0003:04F3:074D.00FA: Get report error for parm 6: 0 [ 2204.393796][ T5348] hub 3-1:6.196: bad descriptor, ignoring hub [ 2204.393832][ T5348] hub 3-1:6.196: probe with driver hub failed with error -5 [ 2204.472708][ T5348] r8152-cfgselector 3-1: USB disconnect, device number 25 [ 2204.641628][T10490] elan 0003:04F3:074D.00FA: Get report error for parm 7: -71 [ 2204.675866][T10490] elan 0003:04F3:074D.00FA: hidraw0: USB HID v0.00 Joystick [HID 04f3:074d] on usb-dummy_hcd.4-1/input1 [ 2204.675931][T10490] elan 0003:04F3:074D.00FA: Input device is not registered [ 2204.699304][T10490] elan 0003:04F3:074D.00FA: probe with driver elan failed with error -119 [ 2204.731846][T10490] usb 5-1: USB disconnect, device number 57 [ 2204.851047][T29309] fido_id[29309]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.4/usb5/report_descriptor': No such file or directory [ 2205.017360][T14158] usb 6-1: USB disconnect, device number 37 [ 2205.027631][T19473] udl 6-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 2205.028132][T19473] udl 6-1:0.0: [drm] Cannot find any crtc or sizes [ 2205.055194][ T5348] usb 3-1: new high-speed USB device number 26 using dummy_hcd [ 2205.226627][ T5348] usb 3-1: New USB device found, idVendor=0846, idProduct=1001, bcdDevice= 1.00 [ 2205.234440][ T5348] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 2205.234473][ T5348] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 2205.269676][ T5348] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2205.269711][ T5348] usb 3-1: Product: syz [ 2205.269727][ T5348] usb 3-1: Manufacturer: syz [ 2205.269744][ T5348] usb 3-1: SerialNumber: syz [ 2205.519436][ T5348] kaweth 3-1:1.0: Firmware present in device. [ 2205.617445][T29313] FAULT_INJECTION: forcing a failure. [ 2205.617445][T29313] name failslab, interval 1, probability 0, space 0, times 0 [ 2205.617494][T29313] CPU: 1 UID: 0 PID: 29313 Comm: syz.4.6645 Tainted: G L syzkaller #0 PREEMPT(full) [ 2205.617524][T29313] Tainted: [L]=SOFTLOCKUP [ 2205.617537][T29313] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 2205.617550][T29313] Call Trace: [ 2205.617559][T29313] [ 2205.617569][T29313] dump_stack_lvl+0xe8/0x150 [ 2205.617608][T29313] should_fail_ex+0x410/0x560 [ 2205.617642][T29313] should_failslab+0xa8/0x100 [ 2205.617672][T29313] __kmalloc_noprof+0xfe/0x720 [ 2205.617695][T29313] ? rcu_is_watching+0x16/0xb0 [ 2205.617722][T29313] ? tomoyo_realpath_from_path+0xef/0x640 [ 2205.617752][T29313] ? tomoyo_realpath_from_path+0xef/0x640 [ 2205.617790][T29313] tomoyo_realpath_from_path+0xef/0x640 [ 2205.617831][T29313] ? tomoyo_path_number_perm+0x219/0x5f0 [ 2205.617858][T29313] tomoyo_path_number_perm+0x246/0x5f0 [ 2205.617888][T29313] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 2205.617913][T29313] ? __lock_acquire+0x747/0x2de0 [ 2205.617953][T29313] ? hook_file_ioctl+0x1f2/0x600 [ 2205.618001][T29313] ? __fget_files+0x2a/0x420 [ 2205.618036][T29313] ? __fget_files+0x2a/0x420 [ 2205.618064][T29313] ? __fget_files+0x3a2/0x420 [ 2205.618093][T29313] ? __fget_files+0x2a/0x420 [ 2205.618128][T29313] security_file_ioctl+0xc3/0x2a0 [ 2205.618156][T29313] __se_sys_ioctl+0x47/0x170 [ 2205.618185][T29313] do_syscall_64+0x166/0x520 [ 2205.618216][T29313] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2205.618238][T29313] ? clear_bhb_loop+0x70/0xc0 [ 2205.618265][T29313] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2205.618287][T29313] RIP: 0033:0x7f9104d9e159 [ 2205.618308][T29313] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2205.618327][T29313] RSP: 002b:00007f9105d2a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2205.618352][T29313] RAX: ffffffffffffffda RBX: 00007f9105025fa0 RCX: 00007f9104d9e159 [ 2205.618368][T29313] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000007 [ 2205.618383][T29313] RBP: 00007f9105d2a090 R08: 0000000000000000 R09: 0000000000000000 [ 2205.618397][T29313] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2205.618410][T29313] R13: 00007f9105026038 R14: 00007f9105025fa0 R15: 00007f910514fa48 [ 2205.618446][T29313] [ 2205.621353][T29313] ERROR: Out of memory at tomoyo_realpath_from_path. [ 2205.838125][ T5348] kaweth 3-1:1.0: Statistics collection: 0 [ 2205.838150][ T5348] kaweth 3-1:1.0: Multicast filter limit: 0 [ 2205.838165][ T5348] kaweth 3-1:1.0: MTU: 0 [ 2205.838179][ T5348] kaweth 3-1:1.0: Read MAC address 00:00:00:00:00:00 [ 2206.282537][ T5348] kaweth 3-1:1.0: Error setting SOFS wait [ 2206.282835][ T5348] kaweth 3-1:1.0: probe with driver kaweth failed with error -5 [ 2206.331659][ T5348] usb 3-1: USB disconnect, device number 26 [ 2207.295166][T14158] usb 5-1: new high-speed USB device number 58 using dummy_hcd [ 2207.445917][T14158] usb 5-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 2207.448019][T14158] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2207.448073][T14158] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2207.484591][T14158] usb 5-1: config 0 descriptor?? [ 2207.575235][T14158] pwc: Askey VC010 type 2 USB webcam detected. [ 2207.614495][ T5348] usb 4-1: new high-speed USB device number 57 using dummy_hcd [ 2207.764972][ T5348] usb 4-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 2207.768083][ T5348] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2207.768100][ T5348] usb 4-1: Product: syz [ 2207.768110][ T5348] usb 4-1: Manufacturer: syz [ 2207.768119][ T5348] usb 4-1: SerialNumber: syz [ 2207.773163][ T5348] usb 4-1: config 0 descriptor?? [ 2207.899174][T29336] netlink: 260 bytes leftover after parsing attributes in process `syz.2.6652'. [ 2207.915503][T14158] pwc: recv_control_msg error -32 req 02 val 2b00 [ 2207.916098][T14158] pwc: recv_control_msg error -32 req 02 val 2700 [ 2207.916940][T14158] pwc: recv_control_msg error -32 req 02 val 2c00 [ 2207.917833][T14158] pwc: recv_control_msg error -32 req 04 val 1000 [ 2207.945009][T14158] pwc: recv_control_msg error -32 req 04 val 1300 [ 2208.001687][T29336] syzkaller1: entered promiscuous mode [ 2208.001716][T29336] syzkaller1: entered allmulticast mode [ 2208.188503][ T5348] usb 4-1: Firmware: major: 165, minor: 173, hardware type: UNKNOWN (213) [ 2208.324369][T16894] usb 6-1: new full-speed USB device number 38 using dummy_hcd [ 2208.362511][T14158] pwc: recv_control_msg error -71 req 02 val 2100 [ 2208.363858][T14158] pwc: recv_control_msg error -71 req 04 val 1500 [ 2208.382356][T14158] pwc: recv_control_msg error -71 req 02 val 2500 [ 2208.390077][T14158] pwc: recv_control_msg error -71 req 02 val 2400 [ 2208.399516][T14158] pwc: recv_control_msg error -71 req 02 val 2600 [ 2208.400298][T14158] pwc: recv_control_msg error -71 req 02 val 2900 [ 2208.401614][ T5348] usb 4-1: failed to fetch extended address, random address set [ 2208.401719][ T5348] usb 4-1: atusb_probe: initialization failed, error = -524 [ 2208.401914][ T5348] atusb 4-1:0.0: probe with driver atusb failed with error -524 [ 2208.402939][T14158] pwc: recv_control_msg error -71 req 02 val 2800 [ 2208.403373][T14158] pwc: recv_control_msg error -71 req 04 val 1100 [ 2208.403731][T14158] pwc: recv_control_msg error -71 req 04 val 1200 [ 2208.468794][T14158] pwc: Registered as video103. [ 2208.470334][T14158] input: PWC snapshot button as /devices/platform/dummy_hcd.4/usb5/5-1/input/input206 [ 2208.492618][T14158] usb 5-1: USB disconnect, device number 58 [ 2208.512065][T16894] usb 6-1: unable to get BOS descriptor or descriptor too short [ 2208.513032][T16894] usb 6-1: not running at top speed; connect to a high speed hub [ 2208.513058][T16894] usb 6-1: New USB device found, idVendor=17ef, idProduct=304f, bcdDevice=ed.2e [ 2208.524578][T16894] usb 6-1: config 6 has an invalid interface number: 196 but max is 0 [ 2208.524623][T16894] usb 6-1: config 6 has no interface number 0 [ 2208.524653][T16894] usb 6-1: config 6 interface 196 has no altsetting 0 [ 2208.540678][T16894] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2208.540697][T16894] usb 6-1: Product: syz [ 2208.540706][T16894] usb 6-1: Manufacturer: syz [ 2208.540715][T16894] usb 6-1: SerialNumber: syz [ 2208.563857][T16894] r8152-cfgselector 6-1: Unknown version 0x0000 [ 2208.659289][ T1220] usb 4-1: USB disconnect, device number 57 [ 2209.245139][T29343] FAULT_INJECTION: forcing a failure. [ 2209.245139][T29343] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2209.245182][T29343] CPU: 0 UID: 0 PID: 29343 Comm: syz.4.6655 Tainted: G L syzkaller #0 PREEMPT(full) [ 2209.245211][T29343] Tainted: [L]=SOFTLOCKUP [ 2209.245220][T29343] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 2209.245233][T29343] Call Trace: [ 2209.245241][T29343] [ 2209.245251][T29343] dump_stack_lvl+0xe8/0x150 [ 2209.245288][T29343] should_fail_ex+0x410/0x560 [ 2209.245319][T29343] _copy_from_iter+0x1d3/0x1660 [ 2209.245346][T29343] ? __alloc_skb+0x27a/0x7a0 [ 2209.245377][T29343] ? __alloc_skb+0x27a/0x7a0 [ 2209.245406][T29343] ? __alloc_skb+0x27a/0x7a0 [ 2209.245433][T29343] ? __pfx__copy_from_iter+0x10/0x10 [ 2209.245457][T29343] ? kmem_cache_alloc_node_noprof+0x1f9/0x610 [ 2209.245479][T29343] ? __alloc_skb+0x27a/0x7a0 [ 2209.245504][T29343] ? __alloc_skb+0x27a/0x7a0 [ 2209.245536][T29343] ? netlink_sendmsg+0x650/0xb40 [ 2209.245558][T29343] ? skb_put+0x112/0x210 [ 2209.245590][T29343] netlink_sendmsg+0x6c0/0xb40 [ 2209.245622][T29343] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2209.245652][T29343] ? apparmor_socket_sendmsg+0x18b/0x360 [ 2209.245681][T29343] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2209.245702][T29343] sock_sendmsg_nosec+0x13a/0x180 [ 2209.245740][T29343] ____sys_sendmsg+0x54e/0x850 [ 2209.245776][T29343] ? __pfx_____sys_sendmsg+0x10/0x10 [ 2209.245816][T29343] ? import_iovec+0x73/0xa0 [ 2209.245848][T29343] ___sys_sendmsg+0x2a5/0x360 [ 2209.245876][T29343] ? __lock_acquire+0x747/0x2de0 [ 2209.245903][T29343] ? __pfx____sys_sendmsg+0x10/0x10 [ 2209.245978][T29343] ? __fget_files+0x2a/0x420 [ 2209.246008][T29343] ? __fget_files+0x3a2/0x420 [ 2209.246048][T29343] __x64_sys_sendmsg+0x1b1/0x290 [ 2209.246082][T29343] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 2209.246132][T29343] do_syscall_64+0x166/0x520 [ 2209.246162][T29343] ? trace_irq_disable+0x3b/0x140 [ 2209.246184][T29343] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2209.246206][T29343] ? clear_bhb_loop+0x70/0xc0 [ 2209.246232][T29343] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2209.246253][T29343] RIP: 0033:0x7f9104d9e159 [ 2209.246273][T29343] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2209.246292][T29343] RSP: 002b:00007f9105d2a028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2209.246317][T29343] RAX: ffffffffffffffda RBX: 00007f9105025fa0 RCX: 00007f9104d9e159 [ 2209.246333][T29343] RDX: 000000002002889c RSI: 0000200000000040 RDI: 0000000000000003 [ 2209.246348][T29343] RBP: 00007f9105d2a090 R08: 0000000000000000 R09: 0000000000000000 [ 2209.246361][T29343] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2209.246374][T29343] R13: 00007f9105026038 R14: 00007f9105025fa0 R15: 00007f910514fa48 [ 2209.246409][T29343] [ 2209.505634][T16894] hub 6-1:6.196: bad descriptor, ignoring hub [ 2209.505663][T16894] hub 6-1:6.196: probe with driver hub failed with error -5 [ 2209.570198][T16894] r8152-cfgselector 6-1: USB disconnect, device number 38 [ 2209.778921][T29354] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 2209.778949][T29354] block device autoloading is deprecated and will be removed. [ 2209.924539][ T1220] usb 4-1: new high-speed USB device number 58 using dummy_hcd [ 2210.074297][ T1220] usb 4-1: Using ep0 maxpacket: 32 [ 2210.075162][ T1220] usb 4-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 2210.076609][ T1220] usb 4-1: config index 0 descriptor too short (expected 292, got 36) [ 2210.076637][ T1220] usb 4-1: config 0 has an invalid interface number: 184 but max is 0 [ 2210.076660][ T1220] usb 4-1: config 0 has no interface number 0 [ 2210.076706][ T1220] usb 4-1: config 0 interface 184 has no altsetting 0 [ 2210.079263][ T1220] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2210.079288][ T1220] usb 4-1: Product: syz [ 2210.079303][ T1220] usb 4-1: Manufacturer: syz [ 2210.079319][ T1220] usb 4-1: SerialNumber: syz [ 2210.087104][ T1220] usb 4-1: config 0 descriptor?? [ 2210.298975][ T1220] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): usbnet_get_endpoints failed: -71 [ 2210.300469][ T1220] smsc75xx 4-1:0.184: probe with driver smsc75xx failed with error -71 [ 2210.320019][ T1220] usb 4-1: USB disconnect, device number 58 [ 2211.026840][ T1220] usb 4-1: new high-speed USB device number 59 using dummy_hcd [ 2211.165325][ T1220] usb 4-1: device descriptor read/64, error -71 [ 2211.404537][ T1220] usb 4-1: new high-speed USB device number 60 using dummy_hcd [ 2211.514437][T29384] tipc: Started in network mode [ 2211.514473][T29384] tipc: Node identity eabe296e266a, cluster identity 4711 [ 2211.514655][T29384] tipc: Enabled bearer , priority 0 [ 2211.534333][ T1220] usb 4-1: device descriptor read/64, error -71 [ 2211.550738][T29384] tipc: Resetting bearer [ 2211.566835][T29383] tipc: Disabling bearer [ 2211.646162][ T1220] usb usb4-port1: attempt power cycle [ 2211.995974][ T1220] usb 4-1: new high-speed USB device number 61 using dummy_hcd [ 2212.018650][ T1220] usb 4-1: device descriptor read/8, error -71 [ 2212.064328][T19473] usb 3-1: new high-speed USB device number 27 using dummy_hcd [ 2212.225908][T19473] usb 3-1: Using ep0 maxpacket: 8 [ 2212.226600][T19473] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 2212.228853][T19473] usb 3-1: config index 0 descriptor too short (expected 301, got 45) [ 2212.228910][T19473] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 2212.228935][T19473] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 2212.228959][T19473] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 2212.228982][T19473] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 2212.229026][T19473] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2212.255933][ T1220] usb 4-1: new high-speed USB device number 62 using dummy_hcd [ 2212.274963][ T1220] usb 4-1: device descriptor read/8, error -71 [ 2212.384703][ T1220] usb usb4-port1: unable to enumerate USB device [ 2212.424382][T16894] usb 5-1: new high-speed USB device number 59 using dummy_hcd [ 2212.481042][T19473] usb 3-1: usb_control_msg returned -32 [ 2212.481078][T19473] usbtmc 3-1:16.0: can't read capabilities [ 2212.492052][ T5348] usb 6-1: new full-speed USB device number 39 using dummy_hcd [ 2212.584798][T16894] usb 5-1: Using ep0 maxpacket: 8 [ 2212.585500][T16894] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 2212.586796][T16894] usb 5-1: config index 0 descriptor too short (expected 301, got 45) [ 2212.586851][T16894] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 2212.586866][T16894] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 2212.586882][T16894] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 2212.586896][T16894] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 2212.586923][T16894] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2212.658712][ T5348] usb 6-1: unable to get BOS descriptor or descriptor too short [ 2212.659199][ T5348] usb 6-1: not running at top speed; connect to a high speed hub [ 2212.659228][ T5348] usb 6-1: New USB device found, idVendor=17ef, idProduct=304f, bcdDevice=ed.2e [ 2212.660170][ T5348] usb 6-1: config 6 has an invalid interface number: 196 but max is 0 [ 2212.660192][ T5348] usb 6-1: config 6 has no interface number 0 [ 2212.660220][ T5348] usb 6-1: config 6 interface 196 has no altsetting 0 [ 2212.662975][ T5348] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2212.662998][ T5348] usb 6-1: Product: syz [ 2212.663013][ T5348] usb 6-1: Manufacturer: syz [ 2212.663027][ T5348] usb 6-1: SerialNumber: syz [ 2212.692176][ T5348] r8152-cfgselector 6-1: Unknown version 0x0000 [ 2212.792952][T29389] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2212.793890][T29389] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2212.810959][T16894] usb 5-1: usb_control_msg returned -32 [ 2212.811008][T16894] usbtmc 5-1:16.0: can't read capabilities [ 2212.833580][T29394] FAULT_INJECTION: forcing a failure. [ 2212.833580][T29394] name failslab, interval 1, probability 0, space 0, times 0 [ 2212.833618][T29394] CPU: 0 UID: 0 PID: 29394 Comm: syz.2.6667 Tainted: G L syzkaller #0 PREEMPT(full) [ 2212.833648][T29394] Tainted: [L]=SOFTLOCKUP [ 2212.833657][T29394] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 2212.833670][T29394] Call Trace: [ 2212.833679][T29394] [ 2212.833689][T29394] dump_stack_lvl+0xe8/0x150 [ 2212.833727][T29394] should_fail_ex+0x410/0x560 [ 2212.833760][T29394] should_failslab+0xa8/0x100 [ 2212.833790][T29394] __kmalloc_noprof+0xfe/0x720 [ 2212.833812][T29394] ? rcu_is_watching+0x16/0xb0 [ 2212.833840][T29394] ? tomoyo_realpath_from_path+0xef/0x640 [ 2212.833869][T29394] ? tomoyo_realpath_from_path+0xef/0x640 [ 2212.833906][T29394] tomoyo_realpath_from_path+0xef/0x640 [ 2212.833946][T29394] ? tomoyo_path_number_perm+0x219/0x5f0 [ 2212.833973][T29394] tomoyo_path_number_perm+0x246/0x5f0 [ 2212.834003][T29394] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 2212.834028][T29394] ? __lock_acquire+0x747/0x2de0 [ 2212.834078][T29394] ? hook_file_ioctl+0x1f2/0x600 [ 2212.834132][T29394] ? __fget_files+0x2a/0x420 [ 2212.834168][T29394] ? __fget_files+0x2a/0x420 [ 2212.834196][T29394] ? __fget_files+0x3a2/0x420 [ 2212.834224][T29394] ? __fget_files+0x2a/0x420 [ 2212.834258][T29394] security_file_ioctl+0xc3/0x2a0 [ 2212.834287][T29394] __se_sys_ioctl+0x47/0x170 [ 2212.834315][T29394] do_syscall_64+0x166/0x520 [ 2212.834344][T29394] ? trace_irq_disable+0x3b/0x140 [ 2212.834367][T29394] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2212.834389][T29394] ? clear_bhb_loop+0x70/0xc0 [ 2212.834416][T29394] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2212.834437][T29394] RIP: 0033:0x7f04ad79e159 [ 2212.834458][T29394] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2212.834476][T29394] RSP: 002b:00007f04ae5d4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2212.834501][T29394] RAX: ffffffffffffffda RBX: 00007f04ada26090 RCX: 00007f04ad79e159 [ 2212.834518][T29394] RDX: 0000000000000000 RSI: 0000000040015b19 RDI: 0000000000000004 [ 2212.834533][T29394] RBP: 00007f04ae5d4090 R08: 0000000000000000 R09: 0000000000000000 [ 2212.834547][T29394] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2212.834560][T29394] R13: 00007f04ada26128 R14: 00007f04ada26090 R15: 00007f04adb4fa48 [ 2212.834595][T29394] [ 2212.865119][T14158] usb 4-1: new high-speed USB device number 63 using dummy_hcd [ 2212.876663][T29394] ERROR: Out of memory at tomoyo_realpath_from_path. [ 2213.015692][T14158] usb 4-1: Using ep0 maxpacket: 8 [ 2213.017077][T14158] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 2213.018603][T14158] usb 4-1: config index 0 descriptor too short (expected 301, got 45) [ 2213.018651][T14158] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 2213.018673][T14158] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 2213.018697][T14158] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 2213.018740][T14158] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 2213.018780][T14158] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2213.242392][T14158] usb 4-1: usb_control_msg returned -32 [ 2213.242451][T14158] usbtmc 4-1:16.0: can't read capabilities [ 2213.414034][ T5348] hub 6-1:6.196: bad descriptor, ignoring hub [ 2213.414068][ T5348] hub 6-1:6.196: probe with driver hub failed with error -5 [ 2213.436332][ T5348] r8152-cfgselector 6-1: USB disconnect, device number 39 [ 2213.528484][T29401] netlink: 24 bytes leftover after parsing attributes in process `syz.5.6673'. [ 2213.545197][T29403] netlink: 24 bytes leftover after parsing attributes in process `syz.5.6673'. [ 2213.787678][T16894] usb 4-1: USB disconnect, device number 63 [ 2213.904445][ T5348] usb 6-1: new high-speed USB device number 40 using dummy_hcd [ 2214.054846][ T5348] usb 6-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 2214.056023][ T5348] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2214.058144][ T5348] usb 6-1: config 0 descriptor?? [ 2214.254305][T16894] usb 4-1: new high-speed USB device number 64 using dummy_hcd [ 2214.260344][ T5348] udl 6-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 2214.404236][T16894] usb 4-1: Using ep0 maxpacket: 16 [ 2214.405138][T16894] usb 4-1: New USB device found, idVendor=04f3, idProduct=074d, bcdDevice= 0.00 [ 2214.406462][T16894] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 2214.406479][T16894] usb 4-1: config 0 has no interface number 0 [ 2214.406529][T16894] usb 4-1: config 0 interface 1 altsetting 3 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2214.406555][T16894] usb 4-1: config 0 interface 1 altsetting 3 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2214.406588][T16894] usb 4-1: config 0 interface 1 altsetting 3 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 2214.406607][T16894] usb 4-1: config 0 interface 1 has no altsetting 0 [ 2214.406629][T16894] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2214.409427][T16894] usb 4-1: config 0 descriptor?? [ 2214.416496][T16894] usbhid 4-1:0.1: fixing wrong optional hid class descriptors count [ 2214.530053][ T5348] [drm] Initialized udl 0.0.1 for 6-1:0.0 on minor 1 [ 2214.530076][ T5348] [drm] Initialized udl on minor 1 [ 2214.667883][ T5348] udl 6-1:0.0: [drm] *ERROR* Read EDID byte 0 failed [ 2214.668293][ T5348] udl 6-1:0.0: [drm] Cannot find any crtc or sizes [ 2214.821665][ T5348] usb 3-1: USB disconnect, device number 27 [ 2214.849472][T16894] elan 0003:04F3:074D.00FB: failed to start in urb: -90 [ 2215.185709][ T5348] usb 5-1: USB disconnect, device number 59 [ 2215.239081][T16894] elan 0003:04F3:074D.00FB: Get report error for parm 6: -32 [ 2215.276064][T16894] elan 0003:04F3:074D.00FB: hidraw0: USB HID v0.00 Joystick [HID 04f3:074d] on usb-dummy_hcd.3-1/input1 [ 2215.276090][T16894] elan 0003:04F3:074D.00FB: Input device is not registered [ 2215.303370][T16894] elan 0003:04F3:074D.00FB: probe with driver elan failed with error -119 [ 2215.724332][ T5348] usb 5-1: new full-speed USB device number 60 using dummy_hcd [ 2215.873732][T10490] udl 6-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 2215.882872][T10490] udl 6-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 2215.883113][T10490] udl 6-1:0.0: [drm] Cannot find any crtc or sizes [ 2215.900012][ T5348] usb 5-1: New USB device found, idVendor=174f, idProduct=6a31, bcdDevice=26.3f [ 2215.903935][T10490] usb 6-1: USB disconnect, device number 40 [ 2215.943412][ T5348] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2215.943445][ T5348] usb 5-1: Product: syz [ 2215.943455][ T5348] usb 5-1: Manufacturer: syz [ 2215.943464][ T5348] usb 5-1: SerialNumber: syz [ 2215.989256][ T5348] usb 5-1: config 0 descriptor?? [ 2216.006134][ T5348] gspca_main: stk1135-2.14.0 probing 174f:6a31 [ 2217.295918][T16894] usb 4-1: USB disconnect, device number 64 [ 2218.363809][ T5348] gspca_stk1135: reg_w 0x2ff err -71 [ 2218.364856][ T5348] gspca_stk1135: serial bus timeout: status=0x00 [ 2218.364871][ T5348] gspca_stk1135: Sensor write failed [ 2218.364901][ T5348] gspca_stk1135: serial bus timeout: status=0x00 [ 2218.364912][ T5348] gspca_stk1135: Sensor write failed [ 2218.364951][ T5348] gspca_stk1135: serial bus timeout: status=0x00 [ 2218.364962][ T5348] gspca_stk1135: Sensor read failed [ 2218.364991][ T5348] gspca_stk1135: serial bus timeout: status=0x00 [ 2218.365002][ T5348] gspca_stk1135: Sensor read failed [ 2218.365011][ T5348] gspca_stk1135: Detected sensor type unknown (0x0) [ 2218.365046][ T5348] gspca_stk1135: serial bus timeout: status=0x00 [ 2218.365057][ T5348] gspca_stk1135: Sensor read failed [ 2218.365086][ T5348] gspca_stk1135: serial bus timeout: status=0x00 [ 2218.365096][ T5348] gspca_stk1135: Sensor read failed [ 2218.365125][ T5348] gspca_stk1135: serial bus timeout: status=0x00 [ 2218.365136][ T5348] gspca_stk1135: Sensor write failed [ 2218.365165][ T5348] gspca_stk1135: serial bus timeout: status=0x00 [ 2218.365175][ T5348] gspca_stk1135: Sensor write failed [ 2218.365261][ T5348] stk1135 5-1:0.0: probe with driver stk1135 failed with error -71 [ 2218.497994][ T5348] usb 5-1: USB disconnect, device number 60 [ 2219.439089][T29452] syzkaller1: entered promiscuous mode [ 2219.439108][T29452] syzkaller1: entered allmulticast mode [ 2219.441961][T29452] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6686'. [ 2219.441987][T29452] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 2219.654255][T16894] usb 3-1: new high-speed USB device number 28 using dummy_hcd [ 2219.805077][T16894] usb 3-1: Using ep0 maxpacket: 32 [ 2219.808739][T16894] usb 3-1: unable to get BOS descriptor or descriptor too short [ 2219.808787][T16894] usb 3-1: New USB device found, idVendor=07fd, idProduct=0001, bcdDevice= 0.40 [ 2219.812906][T16894] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2219.812935][T16894] usb 3-1: Product: syz [ 2219.812952][T16894] usb 3-1: Manufacturer: syz [ 2219.812967][T16894] usb 3-1: SerialNumber: syz [ 2219.844320][ T5348] usb 4-1: new high-speed USB device number 65 using dummy_hcd [ 2219.888547][T16894] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 2220.007341][ T5348] usb 4-1: New USB device found, idVendor=046d, idProduct=08f0, bcdDevice= 0.00 [ 2220.008567][ T5348] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 2220.011828][ T5348] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2220.011853][ T5348] usb 4-1: Product: syz [ 2220.011869][ T5348] usb 4-1: Manufacturer: syz [ 2220.011885][ T5348] usb 4-1: SerialNumber: syz [ 2220.065021][ T5348] gspca_main: STV06xx-2.14.0 probing 046d:08f0 [ 2220.067633][ T5348] gspca_stv06xx: st6422 sensor detected [ 2220.090266][T16894] snd-usb-audio 3-1:1.0: probe with driver snd-usb-audio failed with error -2 [ 2220.107486][T29463] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2220.110884][T29463] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2220.138991][T16894] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 2220.141148][T16894] snd-usb-audio 3-1:1.1: probe with driver snd-usb-audio failed with error -2 [ 2220.165680][T16894] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 2220.505601][ T1220] usb 6-1: new high-speed USB device number 41 using dummy_hcd [ 2220.522829][T16894] snd-usb-audio 3-1:1.2: probe with driver snd-usb-audio failed with error -2 [ 2220.540336][T16894] usb 3-1: USB disconnect, device number 28 [ 2220.606950][T25341] udevd[25341]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.2/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 2220.649370][ T5348] STV06xx 4-1:1.0: probe with driver STV06xx failed with error -71 [ 2220.660534][ T5348] usb 4-1: USB disconnect, device number 65 [ 2220.670926][ T1220] usb 6-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 2220.687116][ T1220] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2220.693874][ T1220] usb 6-1: config 0 descriptor?? [ 2220.912287][ T1220] udl 6-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 2221.130903][ T1220] [drm] Initialized udl 0.0.1 for 6-1:0.0 on minor 1 [ 2221.130933][ T1220] [drm] Initialized udl on minor 1 [ 2221.174353][ T5697] usb 5-1: new high-speed USB device number 61 using dummy_hcd [ 2221.322180][ T1220] udl 6-1:0.0: [drm] *ERROR* Read EDID byte 0 failed [ 2221.322687][ T1220] udl 6-1:0.0: [drm] Cannot find any crtc or sizes [ 2221.341104][ T5697] usb 5-1: New USB device found, idVendor=054c, idProduct=09cc, bcdDevice= 0.00 [ 2221.342517][ T5697] usb 5-1: config 0 interface 0 altsetting 1 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2221.342551][ T5697] usb 5-1: config 0 interface 0 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 2221.342578][ T5697] usb 5-1: config 0 interface 0 has no altsetting 0 [ 2221.342615][ T5697] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2221.401644][ T5697] usb 5-1: config 0 descriptor?? [ 2221.527152][T16894] usb 4-1: new high-speed USB device number 66 using dummy_hcd [ 2221.678396][T16894] usb 4-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 2221.682926][T16894] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2221.705906][T16894] usb 4-1: config 0 descriptor?? [ 2221.863671][ T5697] playstation 0003:054C:09CC.00FC: hidraw0: USB HID v36.2c Joystick [HID 054c:09cc] on usb-dummy_hcd.4-1/input0 [ 2221.938988][T16894] udl 4-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 2221.967592][ T1310] ieee802154 phy0 wpan0: encryption failed: -22 [ 2221.967698][ T1310] ieee802154 phy1 wpan1: encryption failed: -22 [ 2222.015345][ T5697] playstation 0003:054C:09CC.00FC: Failed to retrieve feature with reportID 18: -32 [ 2222.015376][ T5697] playstation 0003:054C:09CC.00FC: Failed to retrieve DualShock4 pairing info: -32 [ 2222.015467][ T5697] playstation 0003:054C:09CC.00FC: Failed to get MAC address from DualShock4 [ 2222.015484][ T5697] playstation 0003:054C:09CC.00FC: Failed to create dualshock4. [ 2222.039491][ T5697] playstation 0003:054C:09CC.00FC: probe with driver playstation failed with error -32 [ 2222.243720][T16894] [drm] Initialized udl 0.0.1 for 4-1:0.0 on minor 2 [ 2222.243750][T16894] [drm] Initialized udl on minor 2 [ 2222.347055][T16894] udl 4-1:0.0: [drm] *ERROR* Read EDID byte 0 failed [ 2222.347562][T16894] udl 4-1:0.0: [drm] Cannot find any crtc or sizes [ 2222.523277][ T1220] udl 6-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 2222.523379][T10490] usb 6-1: USB disconnect, device number 41 [ 2222.523966][ T1220] udl 6-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffed [ 2222.527052][ T1220] udl 6-1:0.0: [drm] Cannot find any crtc or sizes [ 2222.583291][ T1220] usb 4-1: USB disconnect, device number 66 [ 2222.583885][ T5697] udl 4-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 2222.585233][ T5697] udl 4-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffed [ 2222.585440][ T5697] udl 4-1:0.0: [drm] Cannot find any crtc or sizes [ 2222.710804][T29490] FAULT_INJECTION: forcing a failure. [ 2222.710804][T29490] name failslab, interval 1, probability 0, space 0, times 0 [ 2222.710844][T29490] CPU: 1 UID: 0 PID: 29490 Comm: syz.2.6699 Tainted: G L syzkaller #0 PREEMPT(full) [ 2222.710874][T29490] Tainted: [L]=SOFTLOCKUP [ 2222.710882][T29490] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 2222.710896][T29490] Call Trace: [ 2222.710904][T29490] [ 2222.710915][T29490] dump_stack_lvl+0xe8/0x150 [ 2222.710952][T29490] should_fail_ex+0x410/0x560 [ 2222.710986][T29490] should_failslab+0xa8/0x100 [ 2222.711017][T29490] __kmalloc_cache_noprof+0xa3/0x600 [ 2222.711043][T29490] ? sctp_auth_asoc_copy_shkeys+0x14e/0x5a0 [ 2222.711068][T29490] ? sctp_auth_asoc_copy_shkeys+0x14e/0x5a0 [ 2222.711099][T29490] sctp_auth_asoc_copy_shkeys+0x14e/0x5a0 [ 2222.711126][T29490] ? sctp_stream_interleave_init+0x55/0x90 [ 2222.711225][T29490] sctp_association_new+0x15be/0x25d0 [ 2222.711267][T29490] sctp_connect_new_asoc+0x2e4/0x6b0 [ 2222.711300][T29490] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 2222.711336][T29490] ? __local_bh_enable_ip+0xd6/0x140 [ 2222.711363][T29490] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 2222.711394][T29490] ? security_sctp_bind_connect+0x7e/0x2c0 [ 2222.711432][T29490] sctp_sendmsg+0x159b/0x2d00 [ 2222.711472][T29490] ? kstrtouint+0x6e/0xe0 [ 2222.711496][T29490] ? __pfx_sctp_sendmsg+0x10/0x10 [ 2222.711521][T29490] ? lock_acquire+0x115/0x350 [ 2222.711546][T29490] ? get_pid_task+0x20/0x1f0 [ 2222.711588][T29490] ? aa_sock_msg_perm+0xf5/0x210 [ 2222.711615][T29490] ? sock_rps_record_flow+0x19/0x350 [ 2222.711646][T29490] ? inet_sendmsg+0x298/0x320 [ 2222.711674][T29490] ? __pfx_inet_sendmsg+0x10/0x10 [ 2222.711696][T29490] sock_sendmsg_nosec+0x10e/0x180 [ 2222.711725][T29490] __sys_sendto+0x408/0x5a0 [ 2222.711754][T29490] ? ksys_write+0x1e6/0x270 [ 2222.711780][T29490] ? __pfx___sys_sendto+0x10/0x10 [ 2222.711806][T29490] ? __mutex_unlock_slowpath+0x731/0x900 [ 2222.711869][T29490] ? __pfx_ksys_write+0x10/0x10 [ 2222.711897][T29490] __x64_sys_sendto+0xde/0x100 [ 2222.711929][T29490] do_syscall_64+0x166/0x520 [ 2222.711957][T29490] ? trace_irq_disable+0x3b/0x140 [ 2222.711980][T29490] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2222.712002][T29490] ? clear_bhb_loop+0x70/0xc0 [ 2222.712029][T29490] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2222.712050][T29490] RIP: 0033:0x7f04ad79e159 [ 2222.712070][T29490] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2222.712088][T29490] RSP: 002b:00007f04ae5f5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 2222.712111][T29490] RAX: ffffffffffffffda RBX: 00007f04ada25fa0 RCX: 00007f04ad79e159 [ 2222.712126][T29490] RDX: 0000000000000001 RSI: 0000200000000240 RDI: 0000000000000003 [ 2222.712139][T29490] RBP: 00007f04ae5f5090 R08: 0000200000000080 R09: 000000000000001c [ 2222.712153][T29490] R10: 0000000000000051 R11: 0000000000000246 R12: 0000000000000001 [ 2222.712165][T29490] R13: 00007f04ada26038 R14: 00007f04ada25fa0 R15: 00007f04adb4fa48 [ 2222.712199][T29490] [ 2222.743945][ T5697] usb 5-1: USB disconnect, device number 61 [ 2223.744869][ T5697] usb 4-1: new high-speed USB device number 67 using dummy_hcd [ 2223.904319][ T5697] usb 4-1: Using ep0 maxpacket: 32 [ 2223.911954][ T5697] usb 4-1: unable to get BOS descriptor or descriptor too short [ 2223.912010][ T5697] usb 4-1: New USB device found, idVendor=0dba, idProduct=1000, bcdDevice= 0.40 [ 2223.922207][ T5697] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2223.922234][ T5697] usb 4-1: Product: syz [ 2223.922248][ T5697] usb 4-1: Manufacturer: syz [ 2223.922262][ T5697] usb 4-1: SerialNumber: syz [ 2224.290322][ T5697] usb 4-1: unit 4 not found! [ 2224.290350][ T5697] usb 4-1: unit 0 not found! [ 2224.703076][ T5697] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 2224.768448][ T5697] usb 4-1: unit 4 not found! [ 2224.768475][ T5697] usb 4-1: unit 0 not found! [ 2224.809563][ T5697] snd-usb-audio 4-1:1.1: probe with driver snd-usb-audio failed with error -22 [ 2224.838163][ T5697] usb 4-1: unit 4 not found! [ 2224.838190][ T5697] usb 4-1: unit 0 not found! [ 2225.038318][T29510] FAULT_INJECTION: forcing a failure. [ 2225.038318][T29510] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2225.038366][T29510] CPU: 0 UID: 0 PID: 29510 Comm: syz.2.6707 Tainted: G L syzkaller #0 PREEMPT(full) [ 2225.038395][T29510] Tainted: [L]=SOFTLOCKUP [ 2225.038404][T29510] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 2225.038416][T29510] Call Trace: [ 2225.038425][T29510] [ 2225.038435][T29510] dump_stack_lvl+0xe8/0x150 [ 2225.038472][T29510] should_fail_ex+0x410/0x560 [ 2225.038507][T29510] _copy_from_user+0x2d/0xb0 [ 2225.038538][T29510] kstrtouint_from_user+0xd6/0x180 [ 2225.038567][T29510] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 2225.038602][T29510] ? lock_acquire+0x115/0x350 [ 2225.038632][T29510] proc_fail_nth_write+0x8e/0x210 [ 2225.038658][T29510] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 2225.038692][T29510] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 2225.038714][T29510] vfs_write+0x296/0xba0 [ 2225.038747][T29510] ? __pfx_vfs_write+0x10/0x10 [ 2225.038772][T29510] ? __fget_files+0x2a/0x420 [ 2225.038807][T29510] ? __fget_files+0x3a2/0x420 [ 2225.038835][T29510] ? __fget_files+0x2a/0x420 [ 2225.038876][T29510] ksys_write+0x150/0x270 [ 2225.038901][T29510] ? __pfx_ksys_write+0x10/0x10 [ 2225.038941][T29510] do_syscall_64+0x166/0x520 [ 2225.038981][T29510] ? trace_irq_disable+0x3b/0x140 [ 2225.039003][T29510] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2225.039025][T29510] ? clear_bhb_loop+0x70/0xc0 [ 2225.039052][T29510] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2225.039073][T29510] RIP: 0033:0x7f04ad75e98e [ 2225.039093][T29510] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 2225.039110][T29510] RSP: 002b:00007f04ae5f4fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 2225.039133][T29510] RAX: ffffffffffffffda RBX: 00007f04ae5f56c0 RCX: 00007f04ad75e98e [ 2225.039149][T29510] RDX: 0000000000000001 RSI: 00007f04ae5f50a0 RDI: 0000000000000004 [ 2225.039163][T29510] RBP: 00007f04ae5f5090 R08: 0000000000000000 R09: 0000000000000000 [ 2225.039177][T29510] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2225.039190][T29510] R13: 00007f04ada26038 R14: 00007f04ada25fa0 R15: 00007f04adb4fa48 [ 2225.039223][T29510] [ 2225.305113][ T5697] snd-usb-audio 4-1:1.2: probe with driver snd-usb-audio failed with error -22 [ 2225.331209][ T5697] usb 4-1: USB disconnect, device number 67 [ 2225.339594][T29512] fuse: Unknown parameter 'user_id00000000000000000000' [ 2225.382679][T25525] udevd[25525]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.2/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 2225.413159][T29515] : renamed from bond_slave_0 (while UP) [ 2225.594384][T19473] usb 3-1: new high-speed USB device number 29 using dummy_hcd [ 2225.745065][T19473] usb 3-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice=f6.00 [ 2225.748492][T19473] usb 3-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3 [ 2225.748519][T19473] usb 3-1: Product: syz [ 2225.748534][T19473] usb 3-1: SerialNumber: syz [ 2225.751712][T19473] usb 3-1: config 0 descriptor?? [ 2225.972356][T19473] hso 3-1:0.0: Failed to find INT IN ep [ 2226.200302][T29514] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2226.206589][T29514] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2226.229085][ T5697] usb 3-1: USB disconnect, device number 29 [ 2226.694266][T19473] usb 4-1: new high-speed USB device number 68 using dummy_hcd [ 2226.838163][T19473] usb 4-1: device descriptor read/64, error -71 [ 2226.995931][ T5697] usb 5-1: new high-speed USB device number 62 using dummy_hcd [ 2227.086704][T19473] usb 4-1: new high-speed USB device number 69 using dummy_hcd [ 2227.144962][ T5697] usb 5-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.00 [ 2227.150118][ T5697] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2227.150137][ T5697] usb 5-1: Product: syz [ 2227.150147][ T5697] usb 5-1: Manufacturer: syz [ 2227.150156][ T5697] usb 5-1: SerialNumber: syz [ 2227.235084][T19473] usb 4-1: device descriptor read/64, error -71 [ 2227.346541][T19473] usb usb4-port1: attempt power cycle [ 2227.601696][T14657] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2227.696602][T19473] usb 4-1: new high-speed USB device number 70 using dummy_hcd [ 2227.715342][T19473] usb 4-1: device descriptor read/8, error -71 [ 2227.842473][T14657] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2227.954248][T19473] usb 4-1: new high-speed USB device number 71 using dummy_hcd [ 2227.974930][T19473] usb 4-1: device descriptor read/8, error -71 [ 2228.059005][T24063] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 2228.062555][T24063] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 2228.081060][T14657] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2228.084215][T24063] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 2228.084712][T19473] usb usb4-port1: unable to enumerate USB device [ 2228.111838][T24063] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 2228.119875][T24063] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 2228.276964][T14657] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2228.310564][ T5697] rtl8150 5-1:1.0: couldn't reset the device [ 2228.310781][ T5697] rtl8150 5-1:1.0: probe with driver rtl8150 failed with error -5 [ 2228.932537][T14657] bridge_slave_1: left allmulticast mode [ 2228.932569][T14657] bridge_slave_1: left promiscuous mode [ 2228.932821][T14657] bridge0: port 2(bridge_slave_1) entered disabled state [ 2228.973451][T14657] bridge_slave_0: left allmulticast mode [ 2228.973481][T14657] bridge_slave_0: left promiscuous mode [ 2228.973713][T14657] bridge0: port 1(bridge_slave_0) entered disabled state [ 2229.316018][T14657] bond1 (unregistering): (slave bridge1): Releasing backup interface [ 2229.316047][T14657] bond1 (unregistering): (slave bridge1): the permanent HWaddr of slave - 8a:97:d1:74:72:04 - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts [ 2229.316081][T14657] bond1 (unregistering): (slave bridge2): making interface the new active one [ 2229.316284][T14657] bond1 (unregistering): (slave bridge2): Error 16 setting MAC of new active slave [ 2229.410878][T14657] bond1 (unregistering): (slave bridge2): Releasing backup interface [ 2229.457507][T14657] bond0 (unregistering): (slave ): Releasing backup interface [ 2229.512354][T14657] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 2229.526490][T14657] bond0 (unregistering): Released all slaves [ 2229.587410][T14657] bond1 (unregistering): Released all slaves [ 2229.619542][T14657] bond2 (unregistering): Released all slaves [ 2229.681147][T16894] usb 5-1: USB disconnect, device number 62 [ 2229.771692][T14657] tipc: Left network mode [ 2230.222074][ T5620] Bluetooth: hci1: command tx timeout [ 2230.504299][ T5348] usb 4-1: new high-speed USB device number 72 using dummy_hcd [ 2230.626619][T29573] syzkaller1: entered promiscuous mode [ 2230.626648][T29573] syzkaller1: entered allmulticast mode [ 2230.664201][ T5348] usb 4-1: Using ep0 maxpacket: 32 [ 2230.667429][ T5348] usb 4-1: unable to get BOS descriptor or descriptor too short [ 2230.667475][ T5348] usb 4-1: New USB device found, idVendor=0dba, idProduct=1000, bcdDevice= 0.40 [ 2230.699816][ T5348] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2230.699849][ T5348] usb 4-1: Product: syz [ 2230.699864][ T5348] usb 4-1: Manufacturer: syz [ 2230.699879][ T5348] usb 4-1: SerialNumber: syz [ 2230.969021][T29544] bridge0: port 1(bridge_slave_0) entered blocking state [ 2230.969139][T29544] bridge0: port 1(bridge_slave_0) entered disabled state [ 2230.975779][T29544] bridge_slave_0: entered allmulticast mode [ 2230.989458][T29544] bridge_slave_0: entered promiscuous mode [ 2231.040451][ T5348] usb 4-1: unit 4 not found! [ 2231.040479][ T5348] usb 4-1: unit 0 not found! [ 2231.162769][T29544] bridge0: port 2(bridge_slave_1) entered blocking state [ 2231.162994][T29544] bridge0: port 2(bridge_slave_1) entered disabled state [ 2231.163168][T29544] bridge_slave_1: entered allmulticast mode [ 2231.190166][T29544] bridge_slave_1: entered promiscuous mode [ 2231.463555][ T5348] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 2231.464392][T14657] hsr_slave_0: left promiscuous mode [ 2231.483299][T14657] hsr_slave_1: left promiscuous mode [ 2231.487341][T14657] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 2231.487366][T14657] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 2231.509478][T14657] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 2231.509502][T14657] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 2231.537542][ T5348] usb 4-1: unit 4 not found! [ 2231.537559][ T5348] usb 4-1: unit 0 not found! [ 2231.558141][T14657] veth1_macvtap: left promiscuous mode [ 2231.558184][T14657] veth0_macvtap: left promiscuous mode [ 2231.558300][T14657] veth1_vlan: left promiscuous mode [ 2231.558374][T14657] veth0_vlan: left promiscuous mode [ 2231.560614][ T5348] snd-usb-audio 4-1:1.1: probe with driver snd-usb-audio failed with error -22 [ 2231.602080][ T5348] usb 4-1: unit 4 not found! [ 2231.602108][ T5348] usb 4-1: unit 0 not found! [ 2231.732301][ T5348] snd-usb-audio 4-1:1.2: probe with driver snd-usb-audio failed with error -22 [ 2231.745953][ T5348] usb 4-1: USB disconnect, device number 72 [ 2231.820487][T26078] udevd[26078]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.2/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 2232.283009][T29593] FAULT_INJECTION: forcing a failure. [ 2232.283009][T29593] name failslab, interval 1, probability 0, space 0, times 0 [ 2232.283057][T29593] CPU: 1 UID: 0 PID: 29593 Comm: syz.0.6728 Tainted: G L syzkaller #0 PREEMPT(full) [ 2232.283087][T29593] Tainted: [L]=SOFTLOCKUP [ 2232.283096][T29593] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 2232.283110][T29593] Call Trace: [ 2232.283119][T29593] [ 2232.283129][T29593] dump_stack_lvl+0xe8/0x150 [ 2232.283172][T29593] should_fail_ex+0x410/0x560 [ 2232.283205][T29593] should_failslab+0xa8/0x100 [ 2232.283236][T29593] __kmalloc_cache_noprof+0xa3/0x600 [ 2232.283260][T29593] ? stack_trace_save+0xa9/0x100 [ 2232.283283][T29593] ? rtnl_newlink+0x143/0x1c30 [ 2232.283311][T29593] ? rtnl_newlink+0x143/0x1c30 [ 2232.283347][T29593] rtnl_newlink+0x143/0x1c30 [ 2232.283376][T29593] ? kasan_save_track+0x4f/0x80 [ 2232.283399][T29593] ? kasan_save_track+0x3e/0x80 [ 2232.283422][T29593] ? __kasan_slab_free+0x5c/0x80 [ 2232.283446][T29593] ? kmem_cache_free+0x182/0x650 [ 2232.283468][T29593] ? nlmon_xmit+0xb0/0x100 [ 2232.283493][T29593] ? dev_hard_start_xmit+0x2cd/0x830 [ 2232.283523][T29593] ? __dev_queue_xmit+0x14c0/0x3820 [ 2232.283542][T29593] ? __netlink_deliver_tap+0x5b4/0x860 [ 2232.283565][T29593] ? netlink_deliver_tap+0x19c/0x1b0 [ 2232.283585][T29593] ? netlink_unicast+0x781/0x940 [ 2232.283615][T29593] ? netlink_sendmsg+0x813/0xb40 [ 2232.283647][T29593] ? __pfx_rtnl_newlink+0x10/0x10 [ 2232.283674][T29593] ? do_syscall_64+0x166/0x520 [ 2232.283704][T29593] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2232.283765][T29593] ? kasan_quarantine_put+0xbb/0x1f0 [ 2232.283789][T29593] ? lockdep_hardirqs_on+0x7b/0x110 [ 2232.283823][T29593] ? nlmon_xmit+0xb0/0x100 [ 2232.283847][T29593] ? kmem_cache_free+0x182/0x650 [ 2232.283883][T29593] ? __lock_acquire+0x747/0x2de0 [ 2232.283918][T29593] ? __local_bh_enable_ip+0xd6/0x140 [ 2232.283956][T29593] ? lockdep_hardirqs_on+0x7b/0x110 [ 2232.283984][T29593] ? __dev_queue_xmit+0x29b/0x3820 [ 2232.284004][T29593] ? __local_bh_enable_ip+0xd6/0x140 [ 2232.284029][T29593] ? __dev_queue_xmit+0x29b/0x3820 [ 2232.284060][T29593] ? lock_acquire+0x115/0x350 [ 2232.284085][T29593] ? __pfx_rtnl_newlink+0x10/0x10 [ 2232.284125][T29593] ? __pfx_rtnl_newlink+0x10/0x10 [ 2232.284153][T29593] rtnetlink_rcv_msg+0x802/0xc00 [ 2232.284185][T29593] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 2232.284212][T29593] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 2232.284239][T29593] ? ref_tracker_free+0x689/0x830 [ 2232.284269][T29593] ? __pfx_ref_tracker_free+0x10/0x10 [ 2232.284296][T29593] ? __asan_memcpy+0x40/0x70 [ 2232.284316][T29593] ? __skb_clone+0x5c/0x6c0 [ 2232.284353][T29593] netlink_rcv_skb+0x226/0x4a0 [ 2232.284376][T29593] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 2232.284404][T29593] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 2232.284436][T29593] ? netlink_deliver_tap+0x2e/0x1b0 [ 2232.284456][T29593] ? netlink_deliver_tap+0x2e/0x1b0 [ 2232.284482][T29593] netlink_unicast+0x7bd/0x940 [ 2232.284539][T29593] netlink_sendmsg+0x813/0xb40 [ 2232.284569][T29593] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2232.284600][T29593] ? apparmor_socket_sendmsg+0x98/0x360 [ 2232.284629][T29593] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2232.284651][T29593] sock_sendmsg_nosec+0x13a/0x180 [ 2232.284680][T29593] ____sys_sendmsg+0x54e/0x850 [ 2232.284716][T29593] ? __pfx_____sys_sendmsg+0x10/0x10 [ 2232.284757][T29593] ? import_iovec+0x73/0xa0 [ 2232.284789][T29593] ___sys_sendmsg+0x2a5/0x360 [ 2232.284818][T29593] ? __lock_acquire+0x747/0x2de0 [ 2232.284844][T29593] ? __pfx____sys_sendmsg+0x10/0x10 [ 2232.284909][T29593] ? __fget_files+0x2a/0x420 [ 2232.284935][T29593] ? __fget_files+0x3a2/0x420 [ 2232.284982][T29593] __x64_sys_sendmsg+0x1b1/0x290 [ 2232.285013][T29593] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 2232.285063][T29593] do_syscall_64+0x166/0x520 [ 2232.285092][T29593] ? trace_irq_disable+0x3b/0x140 [ 2232.285115][T29593] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2232.285138][T29593] ? clear_bhb_loop+0x70/0xc0 [ 2232.285165][T29593] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2232.285188][T29593] RIP: 0033:0x7fce5ad9e159 [ 2232.285210][T29593] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2232.285229][T29593] RSP: 002b:00007fce5bd28028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2232.285254][T29593] RAX: ffffffffffffffda RBX: 00007fce5b025fa0 RCX: 00007fce5ad9e159 [ 2232.285271][T29593] RDX: 0000000000000000 RSI: 0000200000000100 RDI: 0000000000000006 [ 2232.285286][T29593] RBP: 00007fce5bd28090 R08: 0000000000000000 R09: 0000000000000000 [ 2232.285299][T29593] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2232.285313][T29593] R13: 00007fce5b026038 R14: 00007fce5b025fa0 R15: 00007fce5b14fa48 [ 2232.285348][T29593] [ 2232.285996][ T5620] Bluetooth: hci1: command tx timeout [ 2233.278331][T14657] team0 (unregistering): Port device team_slave_1 removed [ 2233.314853][T14657] team0 (unregistering): Port device team_slave_0 removed [ 2233.584015][T29544] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 2233.753599][ T5277] 8021q: adding VLAN 0 to HW filter on device eth5 [ 2233.823279][T29544] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 2233.992913][T29544] team0: Port device team_slave_0 added [ 2234.023985][T29544] team0: Port device team_slave_1 added [ 2234.153628][T29544] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 2234.153647][T29544] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2234.153664][T29544] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 2234.163699][T29544] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 2234.163718][T29544] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2234.163742][T29544] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 2234.165819][ T1220] usb 4-1: new full-speed USB device number 73 using dummy_hcd [ 2234.343010][ T1220] usb 4-1: not running at top speed; connect to a high speed hub [ 2234.343037][ T1220] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 2234.370087][ T5620] Bluetooth: hci1: command tx timeout [ 2234.371595][ T1220] usb 4-1: config 1 interface 0 altsetting 17 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 2234.371629][ T1220] usb 4-1: config 1 interface 0 has no altsetting 0 [ 2234.388165][ T1220] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2234.388193][ T1220] usb 4-1: Product: ъ [ 2234.388207][ T1220] usb 4-1: Manufacturer: ဇ [ 2234.388221][ T1220] usb 4-1: SerialNumber: 곣鲕污ツ睔얅⟌疾쩶貴勎鈄尔曭䃮뼹଍誱憁勇ျ⁅꾗዗ӊ⚦ᷖꈸᗘꏯꭣ禞ᄼ遑괶谼ꯣ✠嗡궭垔௱嚉큂鞁ᩞ梦᧽킂䖞녠㌊힅䒍㥨舗棌廭Ꮡᯬ㔾蔠ﶣ㸢ￒ㜠㬯⠅焫 [ 2234.403026][T29602] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 2234.494811][T29544] hsr_slave_0: entered promiscuous mode [ 2234.495606][T29544] hsr_slave_1: entered promiscuous mode [ 2234.496701][T14657] IPVS: stop unused estimator thread 0... [ 2234.775666][ T1220] cdc_ether 4-1:1.0: probe with driver cdc_ether failed with error -71 [ 2234.789822][ T1220] usb 4-1: USB disconnect, device number 73 [ 2235.004638][ T5697] usb 5-1: new high-speed USB device number 63 using dummy_hcd [ 2235.155160][ T5697] usb 5-1: New USB device found, idVendor=046d, idProduct=08f0, bcdDevice= 0.00 [ 2235.156715][ T5697] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 2235.160746][ T5697] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2235.160774][ T5697] usb 5-1: Product: syz [ 2235.160791][ T5697] usb 5-1: Manufacturer: syz [ 2235.160816][ T5697] usb 5-1: SerialNumber: syz [ 2235.187065][ T5697] gspca_main: STV06xx-2.14.0 probing 046d:08f0 [ 2235.187159][ T5697] gspca_stv06xx: st6422 sensor detected [ 2235.641029][ T5277] 8021q: adding VLAN 0 to HW filter on device eth6 [ 2235.653655][ T5697] STV06xx 5-1:1.0: probe with driver STV06xx failed with error -71 [ 2235.671859][ T5697] usb 5-1: USB disconnect, device number 63 [ 2235.845226][T19473] usb 4-1: new high-speed USB device number 74 using dummy_hcd [ 2235.974244][T19473] usb 4-1: device descriptor read/64, error -71 [ 2236.214469][T19473] usb 4-1: new high-speed USB device number 75 using dummy_hcd [ 2236.345120][T19473] usb 4-1: device descriptor read/64, error -71 [ 2236.444728][ T5620] Bluetooth: hci1: command tx timeout [ 2236.460541][T19473] usb usb4-port1: attempt power cycle [ 2236.610210][T29643] ip_tables: iptables: counters copy to user failed while replacing table [ 2236.814292][T19473] usb 4-1: new high-speed USB device number 76 using dummy_hcd [ 2236.837916][T19473] usb 4-1: device descriptor read/8, error -71 [ 2237.086035][T19473] usb 4-1: new high-speed USB device number 77 using dummy_hcd [ 2237.105002][T19473] usb 4-1: device descriptor read/8, error -71 [ 2237.214758][T19473] usb usb4-port1: unable to enumerate USB device [ 2237.593820][T29544] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 2237.618183][T29544] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 2237.621136][T29544] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 2237.632043][T29544] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 2237.651153][T29544] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 2237.679625][T29544] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 2237.692697][T29544] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 2237.719272][T29544] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 2238.049693][T29544] 8021q: adding VLAN 0 to HW filter on device bond0 [ 2238.115095][T29544] 8021q: adding VLAN 0 to HW filter on device team0 [ 2238.142552][T27215] bridge0: port 1(bridge_slave_0) entered blocking state [ 2238.142620][T27215] bridge0: port 1(bridge_slave_0) entered forwarding state [ 2238.182758][T27215] bridge0: port 2(bridge_slave_1) entered blocking state [ 2238.182883][T27215] bridge0: port 2(bridge_slave_1) entered forwarding state [ 2238.493996][T29544] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 2238.634504][T29544] veth0_vlan: entered promiscuous mode [ 2238.662552][T29544] veth1_vlan: entered promiscuous mode [ 2238.730161][T29544] veth0_macvtap: entered promiscuous mode [ 2238.751108][T29544] veth1_macvtap: entered promiscuous mode [ 2238.782760][T29544] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 2238.837855][T29544] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 2238.960034][ T168] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 2238.960416][T27215] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 2238.987643][T27215] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 2238.987698][T27215] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 2239.304572][T14657] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2239.304593][T14657] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2239.482195][T27215] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2239.482220][T27215] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2240.901854][T29726] sctp: [Deprecated]: syz.3.6747 (pid 29726) Use of int in max_burst socket option deprecated. [ 2240.901854][T29726] Use struct sctp_assoc_value instead [ 2241.334882][ T31] kauditd_printk_skb: 4 callbacks suppressed [ 2241.334898][ T31] audit: type=1800 audit(1790540567.231:4519): pid=29731 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.6744" name="SYSV00000000" dev="tmpfs" ino=1 res=0 errno=0 [ 2241.409231][T29732] netlink: 'syz.3.6748': attribute type 4 has an invalid length. [ 2241.466339][T29732] netlink: 'syz.3.6748': attribute type 4 has an invalid length. [ 2241.620453][T29732] netlink: 64 bytes leftover after parsing attributes in process `syz.3.6748'. [ 2244.152572][T27215] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2244.324948][T14158] usb 5-1: new high-speed USB device number 64 using dummy_hcd [ 2244.409115][T29758] syzkaller1: entered promiscuous mode [ 2244.409143][T29758] syzkaller1: entered allmulticast mode [ 2244.514881][T14158] usb 5-1: Using ep0 maxpacket: 32 [ 2244.516102][T14158] usb 5-1: New USB device found, idVendor=0ac8, idProduct=0321, bcdDevice=6f.be [ 2244.517622][T14158] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2244.522674][T29765] FAULT_INJECTION: forcing a failure. [ 2244.522674][T29765] name failslab, interval 1, probability 0, space 0, times 0 [ 2244.522709][T29765] CPU: 1 UID: 0 PID: 29765 Comm: syz.2.6755 Tainted: G L syzkaller #0 PREEMPT(full) [ 2244.522738][T29765] Tainted: [L]=SOFTLOCKUP [ 2244.522746][T29765] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 2244.522757][T29765] Call Trace: [ 2244.522765][T29765] [ 2244.522774][T29765] dump_stack_lvl+0xe8/0x150 [ 2244.522813][T29765] should_fail_ex+0x410/0x560 [ 2244.522841][T29765] should_failslab+0xa8/0x100 [ 2244.522868][T29765] __kmalloc_noprof+0xfe/0x720 [ 2244.522889][T29765] ? __pfx___mutex_trylock_common+0x10/0x10 [ 2244.522914][T29765] ? bm_init+0x74/0xf50 [ 2244.522931][T29765] ? bm_init+0x74/0xf50 [ 2244.522955][T29765] bm_init+0x74/0xf50 [ 2244.522979][T29765] ? lookup_ts_algo+0x1e/0x260 [ 2244.522997][T29765] ? lookup_ts_algo+0x1e/0x260 [ 2244.523012][T29765] ? lookup_ts_algo+0x1e/0x260 [ 2244.523031][T29765] ? lookup_ts_algo+0x24d/0x260 [ 2244.523052][T29765] textsearch_prepare+0x84/0x170 [ 2244.523074][T29765] string_mt_check+0x183/0x260 [ 2244.523195][T29765] xt_check_match+0x602/0xce0 [ 2244.523269][T29765] ? __pfx_xt_check_match+0x10/0x10 [ 2244.523305][T29765] ? pcpu_alloc_noprof+0x1036/0x1900 [ 2244.523345][T29765] ? xt_find_match+0x213/0x260 [ 2244.523376][T29765] translate_table+0x160e/0x2110 [ 2244.523400][T29765] ? __lock_acquire+0x747/0x2de0 [ 2244.523442][T29765] ? __pfx_translate_table+0x10/0x10 [ 2244.523463][T29765] ? lock_acquire+0x115/0x350 [ 2244.523503][T29765] ? _copy_from_user+0x94/0xb0 [ 2244.523532][T29765] do_ip6t_set_ctl+0xa5c/0xe30 [ 2244.523564][T29765] ? rcu_is_watching+0x16/0xb0 [ 2244.523589][T29765] ? __pfx_do_ip6t_set_ctl+0x10/0x10 [ 2244.523628][T29765] ? __mutex_unlock_slowpath+0x731/0x900 [ 2244.523661][T29765] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 2244.523699][T29765] nf_setsockopt+0x26f/0x290 [ 2244.523727][T29765] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 2244.523751][T29765] do_sock_setsockopt+0x17c/0x1b0 [ 2244.523781][T29765] __x64_sys_setsockopt+0x13d/0x1b0 [ 2244.523812][T29765] do_syscall_64+0x166/0x520 [ 2244.523836][T29765] ? trace_irq_disable+0x3b/0x140 [ 2244.523855][T29765] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2244.523873][T29765] ? clear_bhb_loop+0x70/0xc0 [ 2244.523895][T29765] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2244.523912][T29765] RIP: 0033:0x7f1afa19e159 [ 2244.523931][T29765] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2244.523947][T29765] RSP: 002b:00007f1afb0ce028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 2244.523969][T29765] RAX: ffffffffffffffda RBX: 00007f1afa425fa0 RCX: 00007f1afa19e159 [ 2244.523983][T29765] RDX: 0000000000000040 RSI: 0000000000000029 RDI: 0000000000000003 [ 2244.523994][T29765] RBP: 00007f1afb0ce090 R08: 00000000000013c0 R09: 0000000000000000 [ 2244.524007][T29765] R10: 0000200000000bc0 R11: 0000000000000246 R12: 0000000000000001 [ 2244.524019][T29765] R13: 00007f1afa426038 R14: 00007f1afa425fa0 R15: 00007f1afa54fa48 [ 2244.524050][T29765] [ 2244.543745][T27215] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2244.579232][T24063] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 2244.588713][T24063] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 2244.594893][T24063] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 2244.597330][T24063] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 2244.597961][T24063] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 2244.715218][T14158] usb 5-1: config 0 descriptor?? [ 2244.949830][T14158] gspca_main: vc032x-2.14.0 probing 0ac8:0321 [ 2245.111215][T27215] bond0: (slave netdevsim1): Releasing backup interface [ 2245.152508][T29754] netlink: 16 bytes leftover after parsing attributes in process `syz.4.6754'. [ 2245.167283][T27215] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2245.294301][T16894] usb 6-1: new high-speed USB device number 42 using dummy_hcd [ 2245.442934][T27215] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2245.445391][T16894] usb 6-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 2245.446643][T16894] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2245.446674][T16894] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2245.446698][T16894] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 2245.446744][T16894] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2245.475726][T16894] usb 6-1: config 0 descriptor?? [ 2246.037559][T16894] hid_parser_main: 170 callbacks suppressed [ 2246.037587][T16894] plantronics 0003:047F:FFFF.00FD: unknown main item tag 0x0 [ 2246.037619][T16894] plantronics 0003:047F:FFFF.00FD: unknown main item tag 0x0 [ 2246.037647][T16894] plantronics 0003:047F:FFFF.00FD: unknown main item tag 0x0 [ 2246.037674][T16894] plantronics 0003:047F:FFFF.00FD: unknown main item tag 0x0 [ 2246.037701][T16894] plantronics 0003:047F:FFFF.00FD: unknown main item tag 0x0 [ 2246.037726][T16894] plantronics 0003:047F:FFFF.00FD: unknown main item tag 0x0 [ 2246.037751][T16894] plantronics 0003:047F:FFFF.00FD: unknown main item tag 0x0 [ 2246.037776][T16894] plantronics 0003:047F:FFFF.00FD: unknown main item tag 0x0 [ 2246.037802][T16894] plantronics 0003:047F:FFFF.00FD: unknown main item tag 0x0 [ 2246.037830][T16894] plantronics 0003:047F:FFFF.00FD: unknown main item tag 0x0 [ 2246.063641][T16894] plantronics 0003:047F:FFFF.00FD: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.5-1/input0 [ 2246.465763][T14158] gspca_vc032x: reg_w err -71 [ 2246.465785][T14158] gspca_vc032x: I2c Bus Busy Wait 00 [ 2246.465798][T14158] gspca_vc032x: I2c Bus Busy Wait 00 [ 2246.465807][T14158] gspca_vc032x: I2c Bus Busy Wait 00 [ 2246.465818][T14158] gspca_vc032x: I2c Bus Busy Wait 00 [ 2246.465828][T14158] gspca_vc032x: I2c Bus Busy Wait 00 [ 2246.465839][T14158] gspca_vc032x: I2c Bus Busy Wait 00 [ 2246.465848][T14158] gspca_vc032x: I2c Bus Busy Wait 00 [ 2246.465858][T14158] gspca_vc032x: I2c Bus Busy Wait 00 [ 2246.465868][T14158] gspca_vc032x: I2c Bus Busy Wait 00 [ 2246.465876][T14158] gspca_vc032x: I2c Bus Busy Wait 00 [ 2246.465886][T14158] gspca_vc032x: I2c Bus Busy Wait 00 [ 2246.465895][T14158] gspca_vc032x: I2c Bus Busy Wait 00 [ 2246.465904][T14158] gspca_vc032x: I2c Bus Busy Wait 00 [ 2246.465913][T14158] gspca_vc032x: I2c Bus Busy Wait 00 [ 2246.465923][T14158] gspca_vc032x: I2c Bus Busy Wait 00 [ 2246.465932][T14158] gspca_vc032x: I2c Bus Busy Wait 00 [ 2246.465942][T14158] gspca_vc032x: I2c Bus Busy Wait 00 [ 2246.465950][T14158] gspca_vc032x: I2c Bus Busy Wait 00 [ 2246.465960][T14158] gspca_vc032x: Unknown sensor... [ 2246.466044][T14158] vc032x 5-1:0.0: probe with driver vc032x failed with error -22 [ 2246.566230][T14158] usb 5-1: USB disconnect, device number 64 [ 2246.742843][T29775] usb 6-1: language id specifier not provided by device, defaulting to English [ 2246.774020][ T5620] Bluetooth: hci0: command tx timeout [ 2246.808836][T27215] bridge_slave_1: left allmulticast mode [ 2246.808877][T27215] bridge_slave_1: left promiscuous mode [ 2246.809057][T27215] bridge0: port 2(bridge_slave_1) entered disabled state [ 2246.854968][T27215] bridge_slave_0: left allmulticast mode [ 2246.855001][T27215] bridge_slave_0: left promiscuous mode [ 2246.855285][T27215] bridge0: port 1(bridge_slave_0) entered disabled state [ 2247.745406][T14158] usb 5-1: new full-speed USB device number 65 using dummy_hcd [ 2247.811901][T27215] bond0 (unregistering): (slave ): Releasing backup interface [ 2247.829766][T27215] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 2247.830929][T27215] bond0 (unregistering): Released all slaves [ 2247.858595][T27215] bond1 (unregistering): Released all slaves [ 2247.919584][T14158] usb 5-1: unable to get BOS descriptor or descriptor too short [ 2247.920438][T14158] usb 5-1: not running at top speed; connect to a high speed hub [ 2247.920460][T14158] usb 5-1: New USB device found, idVendor=17ef, idProduct=304f, bcdDevice=ed.2e [ 2247.921767][T14158] usb 5-1: config 6 has an invalid interface number: 196 but max is 0 [ 2247.921784][T14158] usb 5-1: config 6 has no interface number 0 [ 2247.921802][T14158] usb 5-1: config 6 interface 196 has no altsetting 0 [ 2247.941725][T14158] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2247.941756][T14158] usb 5-1: Product: syz [ 2247.941772][T14158] usb 5-1: Manufacturer: syz [ 2247.941788][T14158] usb 5-1: SerialNumber: syz [ 2247.999392][T14158] r8152-cfgselector 5-1: Unknown version 0x0000 [ 2248.110755][ T5277] 8021q: adding VLAN 0 to HW filter on device eth5 [ 2248.511942][T19473] usb 6-1: USB disconnect, device number 42 [ 2248.517161][T29836] FAULT_INJECTION: forcing a failure. [ 2248.517161][T29836] name failslab, interval 1, probability 0, space 0, times 0 [ 2248.517194][T29836] CPU: 0 UID: 0 PID: 29836 Comm: syz.5.6763 Tainted: G L syzkaller #0 PREEMPT(full) [ 2248.517222][T29836] Tainted: [L]=SOFTLOCKUP [ 2248.517229][T29836] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 2248.517241][T29836] Call Trace: [ 2248.517250][T29836] [ 2248.517259][T29836] dump_stack_lvl+0xe8/0x150 [ 2248.517294][T29836] should_fail_ex+0x410/0x560 [ 2248.517324][T29836] should_failslab+0xa8/0x100 [ 2248.517352][T29836] __kmalloc_noprof+0xfe/0x720 [ 2248.517372][T29836] ? rcu_is_watching+0x16/0xb0 [ 2248.517397][T29836] ? tomoyo_realpath_from_path+0xef/0x640 [ 2248.517423][T29836] ? tomoyo_realpath_from_path+0xef/0x640 [ 2248.517458][T29836] tomoyo_realpath_from_path+0xef/0x640 [ 2248.517498][T29836] ? tomoyo_path_number_perm+0x219/0x5f0 [ 2248.517523][T29836] tomoyo_path_number_perm+0x246/0x5f0 [ 2248.517549][T29836] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 2248.517572][T29836] ? __lock_acquire+0x747/0x2de0 [ 2248.517609][T29836] ? hook_file_ioctl+0x1f2/0x600 [ 2248.517653][T29836] ? __fget_files+0x2a/0x420 [ 2248.517685][T29836] ? __fget_files+0x2a/0x420 [ 2248.517711][T29836] ? __fget_files+0x3a2/0x420 [ 2248.517737][T29836] ? __fget_files+0x2a/0x420 [ 2248.517769][T29836] security_file_ioctl+0xc3/0x2a0 [ 2248.517794][T29836] __se_sys_ioctl+0x47/0x170 [ 2248.517819][T29836] do_syscall_64+0x166/0x520 [ 2248.517853][T29836] ? trace_irq_disable+0x3b/0x140 [ 2248.517874][T29836] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2248.517895][T29836] ? clear_bhb_loop+0x70/0xc0 [ 2248.517919][T29836] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2248.517939][T29836] RIP: 0033:0x7f218819e159 [ 2248.517958][T29836] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2248.517975][T29836] RSP: 002b:00007f2189107028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2248.517997][T29836] RAX: ffffffffffffffda RBX: 00007f2188425fa0 RCX: 00007f218819e159 [ 2248.518012][T29836] RDX: 0000000000000000 RSI: 00000000000054a1 RDI: 0000000000000003 [ 2248.518025][T29836] RBP: 00007f2189107090 R08: 0000000000000000 R09: 0000000000000000 [ 2248.518038][T29836] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2248.518051][T29836] R13: 00007f2188426038 R14: 00007f2188425fa0 R15: 00007f218854fa48 [ 2248.518083][T29836] [ 2248.518506][T29836] ERROR: Out of memory at tomoyo_realpath_from_path. [ 2248.801561][T14158] hub 5-1:6.196: bad descriptor, ignoring hub [ 2248.801594][T14158] hub 5-1:6.196: probe with driver hub failed with error -5 [ 2248.806967][T29768] bridge0: port 1(bridge_slave_0) entered blocking state [ 2248.817476][T29768] bridge0: port 1(bridge_slave_0) entered disabled state [ 2248.817646][T29768] bridge_slave_0: entered allmulticast mode [ 2248.826399][T29768] bridge_slave_0: entered promiscuous mode [ 2248.844456][ T5620] Bluetooth: hci0: command tx timeout [ 2248.874932][T14158] r8152-cfgselector 5-1: USB disconnect, device number 65 [ 2248.968012][T29768] bridge0: port 2(bridge_slave_1) entered blocking state [ 2248.968083][T29768] bridge0: port 2(bridge_slave_1) entered disabled state [ 2248.968198][T29768] bridge_slave_1: entered allmulticast mode [ 2248.973264][T29768] bridge_slave_1: entered promiscuous mode [ 2249.452970][T29768] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 2249.503600][T27215] hsr_slave_0: left promiscuous mode [ 2249.510503][T27215] hsr_slave_1: left promiscuous mode [ 2249.511290][T27215] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 2249.511306][T27215] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 2249.512024][T27215] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 2249.512038][T27215] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 2249.540499][T14158] usb 5-1: new high-speed USB device number 66 using dummy_hcd [ 2249.598656][T27215] veth1_macvtap: left promiscuous mode [ 2249.598686][T27215] veth0_macvtap: left promiscuous mode [ 2249.598879][T27215] veth1_vlan: left promiscuous mode [ 2249.598925][T27215] veth0_vlan: left promiscuous mode [ 2249.715073][T14158] usb 5-1: New USB device found, idVendor=046d, idProduct=0990, bcdDevice= 0.40 [ 2249.716400][T14158] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 64, changing to 7 [ 2249.716435][T14158] usb 5-1: too many endpoints for config 1 interface 2 altsetting 1: 46, using maximum allowed: 30 [ 2249.716471][T14158] usb 5-1: config 1 interface 2 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 46 [ 2249.718884][T14158] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2249.718910][T14158] usb 5-1: Product: syz [ 2249.718926][T14158] usb 5-1: Manufacturer: syz [ 2249.718942][T14158] usb 5-1: SerialNumber: syz [ 2250.699551][T27215] team0 (unregistering): Port device team_slave_1 removed [ 2250.714939][T29869] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2250.728012][T29869] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 2250.757713][T27215] team0 (unregistering): Port device team_slave_0 removed [ 2250.924202][ T5620] Bluetooth: hci0: command tx timeout [ 2250.954539][T27215] team0 (unregistering): Port device dummy0 removed [ 2250.983660][T29768] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 2251.007499][T29846] batman_adv: batadv0: Adding interface: syzkaller0 [ 2251.007521][T29846] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2251.007556][T29846] batman_adv: batadv0: Interface activated: syzkaller0 [ 2251.030141][ T5277] 8021q: adding VLAN 0 to HW filter on device eth6 [ 2251.062719][T29874] syzkaller1: entered promiscuous mode [ 2251.062744][T29874] syzkaller1: entered allmulticast mode [ 2251.074229][T10490] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 2251.150188][T29844] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 2251.157445][T29877] FAULT_INJECTION: forcing a failure. [ 2251.157445][T29877] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2251.157507][T29877] CPU: 1 UID: 0 PID: 29877 Comm: syz.0.6772 Tainted: G L syzkaller #0 PREEMPT(full) [ 2251.157535][T29877] Tainted: [L]=SOFTLOCKUP [ 2251.157543][T29877] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 2251.157554][T29877] Call Trace: [ 2251.157563][T29877] [ 2251.157572][T29877] dump_stack_lvl+0xe8/0x150 [ 2251.157606][T29877] should_fail_ex+0x410/0x560 [ 2251.157640][T29877] _copy_to_user+0x31/0xb0 [ 2251.157670][T29877] simple_read_from_buffer+0xe1/0x170 [ 2251.157704][T29877] proc_fail_nth_read+0x1bb/0x230 [ 2251.157724][T29877] ? common_file_perm+0x20e/0x2b0 [ 2251.157753][T29877] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 2251.157777][T29877] ? rw_verify_area+0x24a/0x4c0 [ 2251.157808][T29877] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 2251.157828][T29877] vfs_read+0x213/0xa80 [ 2251.157863][T29877] ? __pfx___mutex_lock+0x10/0x10 [ 2251.157892][T29877] ? __pfx_vfs_read+0x10/0x10 [ 2251.157924][T29877] ? __fget_files+0x2a/0x420 [ 2251.157956][T29877] ? __fget_files+0x3a2/0x420 [ 2251.157982][T29877] ? __fget_files+0x2a/0x420 [ 2251.158019][T29877] ksys_read+0x150/0x270 [ 2251.158041][T29877] ? __pfx_ksys_read+0x10/0x10 [ 2251.158059][T29877] ? __pfx_v4l2_ioctl+0x10/0x10 [ 2251.158169][T29877] do_syscall_64+0x166/0x520 [ 2251.158195][T29877] ? trace_irq_disable+0x3b/0x140 [ 2251.158216][T29877] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2251.158236][T29877] ? clear_bhb_loop+0x70/0xc0 [ 2251.158260][T29877] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2251.158289][T29877] RIP: 0033:0x7fce5ad5e98e [ 2251.158309][T29877] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 2251.158326][T29877] RSP: 002b:00007fce5bd27fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 2251.158349][T29877] RAX: ffffffffffffffda RBX: 00007fce5bd286c0 RCX: 00007fce5ad5e98e [ 2251.158364][T29877] RDX: 000000000000000f RSI: 00007fce5bd280a0 RDI: 0000000000000004 [ 2251.158377][T29877] RBP: 00007fce5bd28090 R08: 0000000000000000 R09: 0000000000000000 [ 2251.158389][T29877] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2251.158402][T29877] R13: 00007fce5b026038 R14: 00007fce5b025fa0 R15: 00007fce5b14fa48 [ 2251.158436][T29877] [ 2251.265179][ T9] usb 6-1: new high-speed USB device number 43 using dummy_hcd [ 2251.286786][T29844] batman_adv: batadv0: Removing interface: syzkaller0 [ 2251.290654][T10490] usb 3-1: New USB device found, idVendor=054c, idProduct=09cc, bcdDevice= 0.00 [ 2251.338563][T10490] usb 3-1: config 0 interface 0 altsetting 1 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2251.338602][T10490] usb 3-1: config 0 interface 0 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 2251.338630][T10490] usb 3-1: config 0 interface 0 has no altsetting 0 [ 2251.338668][T10490] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2251.434247][ T9] usb 6-1: Using ep0 maxpacket: 32 [ 2251.436364][ T9] usb 6-1: unable to get BOS descriptor or descriptor too short [ 2251.436414][ T9] usb 6-1: New USB device found, idVendor=0dba, idProduct=1000, bcdDevice= 0.40 [ 2251.439543][ T9] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2251.439566][ T9] usb 6-1: Product: syz [ 2251.439580][ T9] usb 6-1: Manufacturer: syz [ 2251.439594][ T9] usb 6-1: SerialNumber: syz [ 2251.480160][T29768] team0: Port device team_slave_0 added [ 2251.498425][T29768] team0: Port device team_slave_1 added [ 2251.522378][T29879] syzkaller0: entered promiscuous mode [ 2251.522403][T29879] syzkaller0: entered allmulticast mode [ 2251.567406][T10490] usb 3-1: config 0 descriptor?? [ 2251.698696][T29768] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 2251.698716][T29768] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2251.698743][T29768] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 2251.750151][T29768] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 2251.750171][T29768] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2251.750229][T29768] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 2251.803320][T14158] usb 5-1: USB disconnect, device number 66 [ 2251.840123][ T9] usb 6-1: unit 4 not found! [ 2251.840152][ T9] usb 6-1: unit 0 not found! [ 2251.991160][T25358] udevd[25358]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 2252.026611][T10490] playstation 0003:054C:09CC.00FE: hidraw0: USB HID v36.2c Joystick [HID 054c:09cc] on usb-dummy_hcd.2-1/input0 [ 2252.056851][ T9] snd-usb-audio 6-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 2252.060576][ T9] usb 6-1: unit 4 not found! [ 2252.060593][ T9] usb 6-1: unit 0 not found! [ 2252.111959][ T9] snd-usb-audio 6-1:1.1: probe with driver snd-usb-audio failed with error -22 [ 2252.138534][ T9] usb 6-1: unit 4 not found! [ 2252.138563][ T9] usb 6-1: unit 0 not found! [ 2252.195649][T10490] playstation 0003:054C:09CC.00FE: Invalid byte count transferred, expected 16 got 4 [ 2252.195682][T10490] playstation 0003:054C:09CC.00FE: Failed to retrieve DualShock4 pairing info: -22 [ 2252.195739][T10490] playstation 0003:054C:09CC.00FE: Failed to get MAC address from DualShock4 [ 2252.195792][T10490] playstation 0003:054C:09CC.00FE: Failed to create dualshock4. [ 2252.239044][T10490] playstation 0003:054C:09CC.00FE: probe with driver playstation failed with error -22 [ 2252.362470][T29768] hsr_slave_0: entered promiscuous mode [ 2252.373506][T29768] hsr_slave_1: entered promiscuous mode [ 2252.380831][T29768] debugfs: 'hsr0' already exists in 'hsr' [ 2252.380855][T29768] Cannot create hsr debugfs directory [ 2252.458640][ T9] snd-usb-audio 6-1:1.2: probe with driver snd-usb-audio failed with error -22 [ 2252.472177][ T9] usb 6-1: USB disconnect, device number 43 [ 2252.529110][T25525] udevd[25525]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.2/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 2252.604697][ T5704] usb 5-1: new high-speed USB device number 67 using dummy_hcd [ 2252.784539][ T5704] usb 5-1: Using ep0 maxpacket: 8 [ 2252.791895][ T5704] usb 5-1: New USB device found, idVendor=1199, idProduct=0018, bcdDevice=9a.00 [ 2252.795193][ T5704] usb 5-1: config 255 has an invalid interface number: 106 but max is 0 [ 2252.795220][ T5704] usb 5-1: config 255 has no interface number 0 [ 2252.795263][ T5704] usb 5-1: config 255 interface 106 altsetting 15 endpoint 0xE has invalid maxpacket 1024, setting to 64 [ 2252.795290][ T5704] usb 5-1: config 255 interface 106 altsetting 15 endpoint 0x6 has invalid maxpacket 512, setting to 64 [ 2252.795316][ T5704] usb 5-1: config 255 interface 106 altsetting 15 endpoint 0xA has invalid maxpacket 951, setting to 64 [ 2252.795341][ T5704] usb 5-1: config 255 interface 106 altsetting 15 endpoint 0x7 has invalid wMaxPacketSize 0 [ 2252.795362][ T5704] usb 5-1: config 255 interface 106 has no altsetting 0 [ 2252.802842][ T5704] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2252.802868][ T5704] usb 5-1: Product: syz [ 2252.802883][ T5704] usb 5-1: Manufacturer: syz [ 2252.802897][ T5704] usb 5-1: SerialNumber: syz [ 2252.939498][T10490] usb 3-1: USB disconnect, device number 30 [ 2253.004637][ T5620] Bluetooth: hci0: command tx timeout [ 2253.078851][ T5704] sierra 5-1:255.106: Sierra USB modem converter detected [ 2253.100989][ T5704] usb 5-1: Sierra USB modem converter now attached to ttyUSB0 [ 2253.129852][ T5704] usb 5-1: Sierra USB modem converter now attached to ttyUSB1 [ 2253.146420][ T5704] usb 5-1: Sierra USB modem converter now attached to ttyUSB2 [ 2253.191368][ T5704] usb 5-1: USB disconnect, device number 67 [ 2253.216347][T29905] FAULT_INJECTION: forcing a failure. [ 2253.216347][T29905] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2253.216387][T29905] CPU: 1 UID: 0 PID: 29905 Comm: syz.2.6777 Tainted: G L syzkaller #0 PREEMPT(full) [ 2253.216417][T29905] Tainted: [L]=SOFTLOCKUP [ 2253.216425][T29905] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 2253.216439][T29905] Call Trace: [ 2253.216448][T29905] [ 2253.216459][T29905] dump_stack_lvl+0xe8/0x150 [ 2253.216496][T29905] should_fail_ex+0x410/0x560 [ 2253.216529][T29905] _copy_from_user+0x2d/0xb0 [ 2253.216560][T29905] input_event_from_user+0xb1/0x290 [ 2253.216591][T29905] ? __pfx_input_event_from_user+0x10/0x10 [ 2253.216629][T29905] evdev_write+0x2c7/0x4c0 [ 2253.216652][T29905] ? __lock_acquire+0x747/0x2de0 [ 2253.216681][T29905] ? __pfx_evdev_write+0x10/0x10 [ 2253.216707][T29905] ? bpf_lsm_file_permission+0x9/0x20 [ 2253.216736][T29905] ? security_file_permission+0x75/0x260 [ 2253.216763][T29905] ? rw_verify_area+0x203/0x4c0 [ 2253.216798][T29905] ? __pfx_evdev_write+0x10/0x10 [ 2253.216821][T29905] vfs_write+0x296/0xba0 [ 2253.216852][T29905] ? __pfx_vfs_write+0x10/0x10 [ 2253.216876][T29905] ? __fget_files+0x2a/0x420 [ 2253.216919][T29905] ? __fget_files+0x2a/0x420 [ 2253.216947][T29905] ? __fget_files+0x3a2/0x420 [ 2253.216976][T29905] ? __fget_files+0x2a/0x420 [ 2253.217015][T29905] ksys_write+0x150/0x270 [ 2253.217040][T29905] ? __pfx_ksys_write+0x10/0x10 [ 2253.217074][T29905] do_syscall_64+0x166/0x520 [ 2253.217103][T29905] ? trace_irq_disable+0x3b/0x140 [ 2253.217125][T29905] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2253.217148][T29905] ? clear_bhb_loop+0x70/0xc0 [ 2253.217175][T29905] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2253.217197][T29905] RIP: 0033:0x7f1afa19e159 [ 2253.217218][T29905] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2253.217236][T29905] RSP: 002b:00007f1afb0ce028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 2253.217261][T29905] RAX: ffffffffffffffda RBX: 00007f1afa425fa0 RCX: 00007f1afa19e159 [ 2253.217283][T29905] RDX: 0000000000002250 RSI: 0000200000000040 RDI: 0000000000000003 [ 2253.217297][T29905] RBP: 00007f1afb0ce090 R08: 0000000000000000 R09: 0000000000000000 [ 2253.217311][T29905] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 2253.217324][T29905] R13: 00007f1afa426038 R14: 00007f1afa425fa0 R15: 00007f1afa54fa48 [ 2253.217357][T29905] [ 2253.257895][ T5704] sierra ttyUSB0: Sierra USB modem converter now disconnected from ttyUSB0 [ 2253.279576][ T5704] sierra ttyUSB1: Sierra USB modem converter now disconnected from ttyUSB1 [ 2253.306312][ T5704] sierra ttyUSB2: Sierra USB modem converter now disconnected from ttyUSB2 [ 2253.320300][ T5704] sierra 5-1:255.106: device disconnected [ 2254.033115][ T5277] 8021q: adding VLAN 0 to HW filter on device eth7 [ 2254.472235][T29768] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 2254.495191][T29768] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 2254.500964][T29768] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 2254.535184][T29768] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 2254.541566][T29768] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 2254.578802][T29768] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 2254.583310][T29768] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 2254.613308][T29768] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 2254.940972][T29768] 8021q: adding VLAN 0 to HW filter on device bond0 [ 2255.042607][T29768] 8021q: adding VLAN 0 to HW filter on device team0 [ 2255.058167][T29935] netlink: 'syz.4.6781': attribute type 39 has an invalid length. [ 2255.161531][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 2255.161619][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 2255.222277][T14657] bridge0: port 2(bridge_slave_1) entered blocking state [ 2255.222384][T14657] bridge0: port 2(bridge_slave_1) entered forwarding state [ 2255.314886][ T31] audit: type=1326 audit(1790540581.221:4520): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29938 comm="syz.0.6782" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fce5ad9e159 code=0x7ffc0000 [ 2255.316671][ T31] audit: type=1326 audit(1790540581.221:4521): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29938 comm="syz.0.6782" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fce5ad9e159 code=0x7ffc0000 [ 2255.317245][ T31] audit: type=1326 audit(1790540581.221:4522): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29938 comm="syz.0.6782" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fce5ad9e159 code=0x7ffc0000 [ 2255.320719][ T31] audit: type=1326 audit(1790540581.221:4523): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29938 comm="syz.0.6782" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fce5ad9e159 code=0x7ffc0000 [ 2255.320908][ T31] audit: type=1326 audit(1790540581.221:4524): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29938 comm="syz.0.6782" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=130 compat=0 ip=0x7fce5ad9e159 code=0x7ffc0000 [ 2255.348853][ T31] audit: type=1326 audit(1790540581.231:4525): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29938 comm="syz.0.6782" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fce5ad9e159 code=0x7ffc0000 [ 2255.348913][ T31] audit: type=1326 audit(1790540581.231:4526): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29938 comm="syz.0.6782" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fce5ad9e159 code=0x7ffc0000 [ 2255.451022][ T31] audit: type=1326 audit(1790540581.331:4527): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29938 comm="syz.0.6782" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fce5ad9e159 code=0x7ffc0000 [ 2255.451082][ T31] audit: type=1326 audit(1790540581.331:4528): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29938 comm="syz.0.6782" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fce5ad9e159 code=0x7ffc0000 [ 2255.451127][ T31] audit: type=1326 audit(1790540581.341:4529): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29938 comm="syz.0.6782" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fce5ad9e159 code=0x7ffc0000 [ 2255.708603][T29945] ip_tables: iptables: counters copy to user failed while replacing table [ 2255.753217][T29768] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 2256.022948][T29768] veth0_vlan: entered promiscuous mode [ 2256.054558][T29768] veth1_vlan: entered promiscuous mode [ 2256.109939][T29768] veth0_macvtap: entered promiscuous mode [ 2256.121775][T29768] veth1_macvtap: entered promiscuous mode [ 2256.197100][T29768] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 2256.217954][T29768] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 2256.255069][ T5348] usb 3-1: new high-speed USB device number 31 using dummy_hcd [ 2256.305612][T27215] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 2256.305668][T27215] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 2256.305709][T27215] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 2256.305746][T27215] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 2256.474557][ T5348] usb 3-1: New USB device found, idVendor=054c, idProduct=09cc, bcdDevice= 0.00 [ 2256.481784][ T5348] usb 3-1: config 0 interface 0 altsetting 1 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2256.481820][ T5348] usb 3-1: config 0 interface 0 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 2256.481847][ T5348] usb 3-1: config 0 interface 0 has no altsetting 0 [ 2256.481894][ T5348] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2256.547721][ T5348] usb 3-1: config 0 descriptor?? [ 2256.629834][ T43] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2256.629868][ T43] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2256.921475][T29961] syzkaller1: entered promiscuous mode [ 2256.921505][T29961] syzkaller1: entered allmulticast mode [ 2256.929913][T27220] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2256.929935][T27220] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2257.009549][ T5348] playstation 0003:054C:09CC.00FF: hidraw0: USB HID v36.2c Joystick [HID 054c:09cc] on usb-dummy_hcd.2-1/input0 [ 2257.172612][ T5277] 8021q: adding VLAN 0 to HW filter on device eth8 [ 2257.181048][ T5348] playstation 0003:054C:09CC.00FF: Invalid byte count transferred, expected 16 got 0 [ 2257.181077][ T5348] playstation 0003:054C:09CC.00FF: Failed to retrieve DualShock4 pairing info: -22 [ 2257.181134][ T5348] playstation 0003:054C:09CC.00FF: Failed to get MAC address from DualShock4 [ 2257.181150][ T5348] playstation 0003:054C:09CC.00FF: Failed to create dualshock4. [ 2257.222238][ T5348] playstation 0003:054C:09CC.00FF: probe with driver playstation failed with error -22 [ 2257.274356][T19473] usb 5-1: new high-speed USB device number 68 using dummy_hcd [ 2257.425811][T19473] usb 5-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 2257.440894][T19473] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2257.464096][T19473] usb 5-1: config 0 descriptor?? [ 2257.670557][T19473] udl 5-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 2257.687025][T29970] syzkaller0: entered promiscuous mode [ 2257.687052][T29970] syzkaller0: entered allmulticast mode [ 2257.888515][T19473] [drm] Initialized udl 0.0.1 for 5-1:0.0 on minor 1 [ 2257.888544][T19473] [drm] Initialized udl on minor 1 [ 2258.066334][ T5348] usb 3-1: USB disconnect, device number 31 [ 2258.085717][T19473] udl 5-1:0.0: [drm] *ERROR* Read EDID byte 0 failed [ 2258.086218][T19473] udl 5-1:0.0: [drm] Cannot find any crtc or sizes [ 2259.236220][T29987] fuse: Unknown parameter '184467440737095516150x000000000000000a' [ 2259.281772][T29992] FAULT_INJECTION: forcing a failure. [ 2259.281772][T29992] name failslab, interval 1, probability 0, space 0, times 0 [ 2259.281811][T29992] CPU: 0 UID: 0 PID: 29992 Comm: syz.2.6792 Tainted: G L syzkaller #0 PREEMPT(full) [ 2259.281840][T29992] Tainted: [L]=SOFTLOCKUP [ 2259.281848][T29992] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 2259.281861][T29992] Call Trace: [ 2259.281871][T29992] [ 2259.281881][T29992] dump_stack_lvl+0xe8/0x150 [ 2259.281919][T29992] should_fail_ex+0x410/0x560 [ 2259.281950][T29992] should_failslab+0xa8/0x100 [ 2259.281978][T29992] ? audit_log_start+0x103/0xa10 [ 2259.282008][T29992] kmem_cache_alloc_noprof+0xa1/0x600 [ 2259.282030][T29992] ? auditd_test_task+0x22/0x280 [ 2259.282057][T29992] ? auditd_test_task+0x22/0x280 [ 2259.282083][T29992] ? audit_log_start+0x103/0xa10 [ 2259.282117][T29992] audit_log_start+0x103/0xa10 [ 2259.282154][T29992] ? __pfx_audit_log_start+0x10/0x10 [ 2259.282186][T29992] ? get_pid_task+0x20/0x1f0 [ 2259.282208][T29992] ? get_pid_task+0x20/0x1f0 [ 2259.282228][T29992] ? get_pid_task+0x20/0x1f0 [ 2259.282261][T29992] audit_seccomp+0x63/0x190 [ 2259.282288][T29992] ? clear_bhb_loop+0x70/0xc0 [ 2259.282309][T29992] ? clear_bhb_loop+0xe/0xc0 [ 2259.282336][T29992] __seccomp_filter+0xd14/0x1de0 [ 2259.282376][T29992] ? __pfx___seccomp_filter+0x10/0x10 [ 2259.282410][T29992] ? __mutex_unlock_slowpath+0x731/0x900 [ 2259.282443][T29992] ? __fget_files+0x2a/0x420 [ 2259.282476][T29992] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 2259.282506][T29992] ? __fget_files+0x3a2/0x420 [ 2259.282543][T29992] ? fput+0xa0/0xd0 [ 2259.282576][T29992] ? __pfx_ksys_write+0x10/0x10 [ 2259.282603][T29992] ? __seccomp_permit_syscall+0xe7/0x2b0 [ 2259.282635][T29992] do_syscall_64+0x11f/0x520 [ 2259.282662][T29992] ? trace_irq_disable+0x3b/0x140 [ 2259.282684][T29992] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2259.282706][T29992] ? clear_bhb_loop+0x70/0xc0 [ 2259.282733][T29992] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2259.282754][T29992] RIP: 0033:0x7f1afa19e159 [ 2259.282776][T29992] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2259.282794][T29992] RSP: 002b:00007f1afb0ce028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 2259.282818][T29992] RAX: ffffffffffffffda RBX: 00007f1afa425fa0 RCX: 00007f1afa19e159 [ 2259.282835][T29992] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000000000a [ 2259.282848][T29992] RBP: 00007f1afb0ce090 R08: 0000000000000000 R09: 0000000000000000 [ 2259.282862][T29992] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2259.282875][T29992] R13: 00007f1afa426038 R14: 00007f1afa425fa0 R15: 00007f1afa54fa48 [ 2259.282908][T29992] [ 2259.527693][ T9] usb 5-1: USB disconnect, device number 68 [ 2259.527999][T14158] udl 5-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 2260.286100][ T9] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 2260.446419][ T9] usb 7-1: Using ep0 maxpacket: 32 [ 2260.449376][ T9] usb 7-1: unable to get BOS descriptor or descriptor too short [ 2260.449434][ T9] usb 7-1: New USB device found, idVendor=0dba, idProduct=1000, bcdDevice= 0.40 [ 2260.462896][ T9] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2260.462923][ T9] usb 7-1: Product: syz [ 2260.462937][ T9] usb 7-1: Manufacturer: syz [ 2260.462952][ T9] usb 7-1: SerialNumber: syz [ 2260.833461][ T9] usb 7-1: unit 4 not found! [ 2260.833483][ T9] usb 7-1: unit 0 not found! [ 2260.974825][T23899] usb 3-1: new high-speed USB device number 32 using dummy_hcd [ 2261.137253][T23899] usb 3-1: device descriptor read/64, error -71 [ 2261.226033][ T9] snd-usb-audio 7-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 2261.332292][ T9] usb 7-1: unit 4 not found! [ 2261.332322][ T9] usb 7-1: unit 0 not found! [ 2261.357947][ T9] snd-usb-audio 7-1:1.1: probe with driver snd-usb-audio failed with error -22 [ 2261.378563][ T9] usb 7-1: unit 4 not found! [ 2261.378590][ T9] usb 7-1: unit 0 not found! [ 2261.450126][T23899] usb 3-1: new high-speed USB device number 33 using dummy_hcd [ 2261.584624][T23899] usb 3-1: device descriptor read/64, error -71 [ 2261.696060][T23899] usb usb3-port1: attempt power cycle [ 2261.883142][ T9] snd-usb-audio 7-1:1.2: probe with driver snd-usb-audio failed with error -22 [ 2261.885234][ T9] usb 7-1: USB disconnect, device number 2 [ 2262.140928][T26078] udevd[26078]: error opening ATTR{/sys/devices/platform/dummy_hcd.6/usb7/7-1/7-1:1.2/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 2262.185324][T23899] usb 3-1: new high-speed USB device number 34 using dummy_hcd [ 2262.210442][T23899] usb 3-1: device descriptor read/8, error -71 [ 2262.426384][ T9] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 2262.454526][T23899] usb 3-1: new high-speed USB device number 35 using dummy_hcd [ 2262.476111][T23899] usb 3-1: device descriptor read/8, error -71 [ 2262.574220][ T9] usb 7-1: Using ep0 maxpacket: 16 [ 2262.574804][ T9] usb 7-1: New USB device found, idVendor=04f3, idProduct=074d, bcdDevice= 0.00 [ 2262.575912][ T9] usb 7-1: config 0 has an invalid interface number: 1 but max is 0 [ 2262.575938][ T9] usb 7-1: config 0 has no interface number 0 [ 2262.575966][ T9] usb 7-1: config 0 interface 1 altsetting 3 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2262.575982][ T9] usb 7-1: config 0 interface 1 altsetting 3 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2262.575996][ T9] usb 7-1: config 0 interface 1 altsetting 3 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 2262.576011][ T9] usb 7-1: config 0 interface 1 has no altsetting 0 [ 2262.576033][ T9] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2262.581719][ T9] usb 7-1: config 0 descriptor?? [ 2262.585373][T23899] usb usb3-port1: unable to enumerate USB device [ 2262.686733][ T9] usbhid 7-1:0.1: fixing wrong optional hid class descriptors count [ 2262.898525][T30015] netlink: 44 bytes leftover after parsing attributes in process `syz.0.6798'. [ 2263.022375][ T9] elan 0003:04F3:074D.0100: failed to start in urb: -90 [ 2263.414888][ T9] elan 0003:04F3:074D.0100: Get report error for parm 6: 0 [ 2263.823193][ T9] elan 0003:04F3:074D.0100: Get report error for parm 7: 0 [ 2264.027771][ T9] elan 0003:04F3:074D.0100: Set report error for parm 8: -71 [ 2264.042023][ T9] elan 0003:04F3:074D.0100: hidraw0: USB HID v0.00 Joystick [HID 04f3:074d] on usb-dummy_hcd.6-1/input1 [ 2264.042061][ T9] elan 0003:04F3:074D.0100: Input device is not registered [ 2264.071490][ T9] elan 0003:04F3:074D.0100: probe with driver elan failed with error -119 [ 2264.092500][ T9] usb 7-1: USB disconnect, device number 3 [ 2264.174465][T19473] usb 3-1: new high-speed USB device number 36 using dummy_hcd [ 2264.301156][T30028] fido_id[30028]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.6/usb7/report_descriptor': No such file or directory [ 2264.330579][T19473] usb 3-1: Using ep0 maxpacket: 16 [ 2264.334257][T19473] usb 3-1: New USB device found, idVendor=15c2, idProduct=0041, bcdDevice=1f.20 [ 2264.335300][T19473] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 2264.335329][T19473] usb 3-1: config 0 interface 0 has no altsetting 0 [ 2264.337310][T19473] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2264.337332][T19473] usb 3-1: Product: syz [ 2264.337346][T19473] usb 3-1: Manufacturer: syz [ 2264.337360][T19473] usb 3-1: SerialNumber: syz [ 2264.341419][T19473] usb 3-1: config 0 descriptor?? [ 2264.581141][T19473] input: iMON Panel, Knob and Mouse(15c2:0041) as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/input/input210 [ 2264.916054][T19473] rc_core: IR keymap rc-imon-pad not found [ 2264.916079][T19473] Registered IR keymap rc-empty [ 2264.916282][T19473] imon 3-1:0.0: Looks like you're trying to use an IR protocol this device does not support [ 2264.916305][T19473] imon 3-1:0.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 2264.960818][ C1] imon 3-1:0.0: imon usb_rx_callback_intf0: status(-75): ignored [ 2265.345480][T30026] netlink: 132 bytes leftover after parsing attributes in process `syz.2.6802'. [ 2265.425158][T30043] syzkaller1: entered promiscuous mode [ 2265.425184][T30043] syzkaller1: entered allmulticast mode [ 2265.451564][ C1] imon 3-1:0.0: imon usb_rx_callback_intf0: status(-71) [ 2265.452448][T19473] imon:send_packet: packet tx failed (-71) [ 2265.467742][T19473] imon 3-1:0.0: remote input dev register failed [ 2265.467909][T19473] imon 3-1:0.0: imon_init_intf0: rc device setup failed [ 2265.664482][ T9] usb 6-1: new high-speed USB device number 44 using dummy_hcd [ 2265.720163][T19473] imon 3-1:0.0: unable to initialize intf0, err 0 [ 2265.720182][T19473] imon:imon_probe: failed to initialize context! [ 2265.720190][T19473] imon 3-1:0.0: unable to register, err -19 [ 2265.740267][T19473] usb 3-1: USB disconnect, device number 36 [ 2265.825541][ T9] usb 6-1: Using ep0 maxpacket: 32 [ 2265.829202][ T9] usb 6-1: unable to get BOS descriptor or descriptor too short [ 2265.829258][ T9] usb 6-1: New USB device found, idVendor=0dba, idProduct=1000, bcdDevice= 0.40 [ 2265.862858][ T9] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2265.862891][ T9] usb 6-1: Product: syz [ 2265.862907][ T9] usb 6-1: Manufacturer: syz [ 2265.862924][ T9] usb 6-1: SerialNumber: syz [ 2265.982934][T30045] syzkaller0: entered promiscuous mode [ 2265.982960][T30045] syzkaller0: entered allmulticast mode [ 2266.108662][ T9] usb 6-1: unit 4 not found! [ 2266.108690][ T9] usb 6-1: unit 0 not found! [ 2266.319785][ T9] snd-usb-audio 6-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 2266.336208][ T9] usb 6-1: unit 4 not found! [ 2266.336234][ T9] usb 6-1: unit 0 not found! [ 2266.343008][ T9] snd-usb-audio 6-1:1.1: probe with driver snd-usb-audio failed with error -22 [ 2266.370509][ T9] usb 6-1: unit 4 not found! [ 2266.370535][ T9] usb 6-1: unit 0 not found! [ 2266.494977][ T9] snd-usb-audio 6-1:1.2: probe with driver snd-usb-audio failed with error -22 [ 2266.497740][ T9] usb 6-1: USB disconnect, device number 44 [ 2266.551899][T25525] udevd[25525]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.2/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 2266.944291][T19473] usb 5-1: new high-speed USB device number 69 using dummy_hcd [ 2267.094341][T23899] usb 3-1: new full-speed USB device number 37 using dummy_hcd [ 2267.094940][T19473] usb 5-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 2267.098013][T19473] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2267.101214][T19473] usb 5-1: config 0 descriptor?? [ 2267.249377][T23899] usb 3-1: unable to get BOS descriptor or descriptor too short [ 2267.250079][T23899] usb 3-1: not running at top speed; connect to a high speed hub [ 2267.250116][T23899] usb 3-1: New USB device found, idVendor=17ef, idProduct=304f, bcdDevice=ed.2e [ 2267.251711][T23899] usb 3-1: config 6 has an invalid interface number: 196 but max is 0 [ 2267.251741][T23899] usb 3-1: config 6 has no interface number 0 [ 2267.251812][T23899] usb 3-1: config 6 interface 196 has no altsetting 0 [ 2267.257478][T23899] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2267.257531][T23899] usb 3-1: Product: syz [ 2267.257547][T23899] usb 3-1: Manufacturer: syz [ 2267.257561][T23899] usb 3-1: SerialNumber: syz [ 2267.296313][T23899] r8152-cfgselector 3-1: Unknown version 0x0000 [ 2267.312737][T19473] udl 5-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 2267.566343][T19473] [drm] Initialized udl 0.0.1 for 5-1:0.0 on minor 1 [ 2267.566373][T19473] [drm] Initialized udl on minor 1 [ 2267.684237][ T5348] usb 6-1: new high-speed USB device number 45 using dummy_hcd [ 2267.725998][T19473] udl 5-1:0.0: [drm] *ERROR* Read EDID byte 0 failed [ 2267.726560][T19473] udl 5-1:0.0: [drm] Cannot find any crtc or sizes [ 2267.838241][ T5348] usb 6-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 2267.839833][ T5348] usb 6-1: config index 0 descriptor too short (expected 45, got 36) [ 2267.839879][ T5348] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 2267.839902][ T5348] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 2267.839951][ T5348] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 2267.839975][ T5348] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 2267.840011][ T5348] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2267.843720][ T5348] usb 6-1: config 0 descriptor?? [ 2267.848505][T30074] raw-gadget.3 gadget.5: fail, usb_ep_enable returned -22 [ 2268.074727][T23899] hub 3-1:6.196: bad descriptor, ignoring hub [ 2268.074760][T23899] hub 3-1:6.196: probe with driver hub failed with error -5 [ 2268.120767][T23899] r8152-cfgselector 3-1: USB disconnect, device number 37 [ 2268.484297][T23899] usb 3-1: new high-speed USB device number 38 using dummy_hcd [ 2268.508784][ T5348] usbhid 6-1:0.0: can't add hid device: -71 [ 2268.508933][ T5348] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 2268.545490][ T5348] usb 6-1: USB disconnect, device number 45 [ 2268.618150][T19473] usb 5-1: USB disconnect, device number 69 [ 2268.623345][T14158] udl 5-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 2268.624699][T14158] udl 5-1:0.0: [drm] Cannot find any crtc or sizes [ 2268.658273][T23899] usb 3-1: Using ep0 maxpacket: 16 [ 2268.661303][T23899] usb 3-1: New USB device found, idVendor=04e7, idProduct=0009, bcdDevice= 0.00 [ 2268.666935][T23899] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2268.673733][T23899] usb 3-1: config 0 descriptor?? [ 2268.761100][T30086] FAULT_INJECTION: forcing a failure. [ 2268.761100][T30086] name failslab, interval 1, probability 0, space 0, times 0 [ 2268.761139][T30086] CPU: 1 UID: 0 PID: 30086 Comm: syz.6.6818 Tainted: G L syzkaller #0 PREEMPT(full) [ 2268.761169][T30086] Tainted: [L]=SOFTLOCKUP [ 2268.761178][T30086] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 2268.761195][T30086] Call Trace: [ 2268.761204][T30086] [ 2268.761216][T30086] dump_stack_lvl+0xe8/0x150 [ 2268.761263][T30086] should_fail_ex+0x410/0x560 [ 2268.761306][T30086] should_failslab+0xa8/0x100 [ 2268.761335][T30086] ? sctp_chunkify+0x5a/0x260 [ 2268.761377][T30086] kmem_cache_alloc_noprof+0xa1/0x600 [ 2268.761399][T30086] ? kmem_cache_alloc_node_noprof+0x1f9/0x610 [ 2268.761420][T30086] ? __alloc_skb+0x27a/0x7a0 [ 2268.761450][T30086] ? sctp_chunkify+0x5a/0x260 [ 2268.761481][T30086] sctp_chunkify+0x5a/0x260 [ 2268.761510][T30086] _sctp_make_chunk+0x122/0x290 [ 2268.761538][T30086] sctp_make_init+0x5e9/0xe20 [ 2268.761560][T30086] ? is_bpf_text_address+0x292/0x2b0 [ 2268.761601][T30086] ? __pfx_sctp_make_init+0x10/0x10 [ 2268.761639][T30086] ? stack_trace_save+0xa9/0x100 [ 2268.761662][T30086] ? __pfx_stack_trace_save+0x10/0x10 [ 2268.761689][T30086] sctp_sf_do_prm_asoc+0xcf/0x3f0 [ 2268.761724][T30086] sctp_do_sm+0x239/0x5dd0 [ 2268.761754][T30086] ? kasan_save_track+0x3e/0x80 [ 2268.761778][T30086] ? __pfx_sctp_pname+0x10/0x10 [ 2268.761807][T30086] ? __kmalloc_cache_noprof+0x321/0x600 [ 2268.761829][T30086] ? sctp_stream_init_ext+0x57/0x180 [ 2268.761861][T30086] ? sctp_sendmsg+0x1bb5/0x2d00 [ 2268.761886][T30086] ? __x64_sys_sendto+0xde/0x100 [ 2268.761914][T30086] ? do_syscall_64+0x166/0x520 [ 2268.761952][T30086] ? __pfx_sctp_do_sm+0x10/0x10 [ 2268.762029][T30086] ? __sk_mem_raise_allocated+0x292/0x1250 [ 2268.762051][T30086] ? __genradix_ptr+0x1e1/0x220 [ 2268.762090][T30086] sctp_primitive_ASSOCIATE+0x95/0xc0 [ 2268.762125][T30086] sctp_sendmsg_to_asoc+0x13fb/0x1880 [ 2268.762161][T30086] ? sctp_assoc_add_peer+0xd57/0x1430 [ 2268.762207][T30086] ? __pfx_sctp_sendmsg_to_asoc+0x10/0x10 [ 2268.762235][T30086] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 2268.762266][T30086] ? sctp_endpoint_lookup_assoc+0x7b/0x260 [ 2268.762294][T30086] ? sctp_endpoint_lookup_assoc+0x7b/0x260 [ 2268.762321][T30086] ? sctp_endpoint_lookup_assoc+0x7b/0x260 [ 2268.762350][T30086] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 2268.762389][T30086] ? security_sctp_bind_connect+0x7e/0x2c0 [ 2268.762418][T30086] sctp_sendmsg+0x1bb5/0x2d00 [ 2268.762463][T30086] ? __pfx_sctp_sendmsg+0x10/0x10 [ 2268.762488][T30086] ? lockdep_hardirqs_on+0x7b/0x110 [ 2268.762517][T30086] ? irqentry_exit+0x218/0x910 [ 2268.762544][T30086] ? trace_irq_disable+0x3b/0x140 [ 2268.762590][T30086] ? aa_sock_msg_perm+0xf5/0x210 [ 2268.762618][T30086] ? sock_rps_record_flow+0x19/0x350 [ 2268.762647][T30086] ? inet_sendmsg+0x298/0x320 [ 2268.762669][T30086] ? apparmor_socket_sendmsg+0x98/0x360 [ 2268.762698][T30086] ? __pfx_inet_sendmsg+0x10/0x10 [ 2268.762721][T30086] sock_sendmsg_nosec+0x10e/0x180 [ 2268.762750][T30086] __sys_sendto+0x408/0x5a0 [ 2268.762778][T30086] ? ksys_write+0x1e6/0x270 [ 2268.762805][T30086] ? __pfx___sys_sendto+0x10/0x10 [ 2268.762831][T30086] ? __mutex_unlock_slowpath+0x731/0x900 [ 2268.762893][T30086] ? __pfx_ksys_write+0x10/0x10 [ 2268.762921][T30086] __x64_sys_sendto+0xde/0x100 [ 2268.762955][T30086] do_syscall_64+0x166/0x520 [ 2268.762984][T30086] ? trace_irq_disable+0x3b/0x140 [ 2268.763007][T30086] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2268.763030][T30086] ? clear_bhb_loop+0x70/0xc0 [ 2268.763058][T30086] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2268.763080][T30086] RIP: 0033:0x7f791199e159 [ 2268.763101][T30086] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2268.763120][T30086] RSP: 002b:00007f79127b8028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 2268.763146][T30086] RAX: ffffffffffffffda RBX: 00007f7911c25fa0 RCX: 00007f791199e159 [ 2268.763163][T30086] RDX: 0000000000000001 RSI: 0000200000000000 RDI: 0000000000000003 [ 2268.763177][T30086] RBP: 00007f79127b8090 R08: 00002000000000c0 R09: 000000000000001c [ 2268.763192][T30086] R10: 0000000000000060 R11: 0000000000000246 R12: 0000000000000002 [ 2268.763206][T30086] R13: 00007f7911c26038 R14: 00007f7911c25fa0 R15: 00007f7911d4fa48 [ 2268.763242][T30086] [ 2269.192468][T23899] hid_parser_main: 5 callbacks suppressed [ 2269.192494][T23899] elo 0003:04E7:0009.0101: unknown main item tag 0x3 [ 2269.192521][T23899] elo 0003:04E7:0009.0101: unknown global tag 0xc [ 2269.192536][T23899] elo 0003:04E7:0009.0101: item 0 2 1 12 parsing failed [ 2269.198766][T23899] elo 0003:04E7:0009.0101: parse failed [ 2269.198978][T23899] elo 0003:04E7:0009.0101: probe with driver elo failed with error -22 [ 2270.009203][T30105] loop4: detected capacity change from 0 to 2640 [ 2270.272404][ T1220] usb 3-1: USB disconnect, device number 38 [ 2271.413908][T30130] [U]  [ 2271.413925][T30130] [U] K{ [ 2271.413941][T30130] [U] t 1ŠFfˊ`GJgo/mC [ 2271.413986][T30130] [U] tؖ/,~Ĝj}8'o1"7-JQKWq5c%"H12YX``+(!(z'tXlnIgjݭp~7!" (5Ob̓J [ 2271.414037][T30130] [U] k\&}66XHX .`a$40|϶9ި U4Vbz}wMTQΦr 4 [ 2271.414106][T30130] [U] ".h6"k[J4In[Z(C|T]z{3c=x4w)\TXJSH{q;칢t+gd.˂>ywUhfNhl]S2\g%O&z)'pul_< ذ`ұT;_"(u{7j2X /'cIHcճV=Ai%wEs RjgrhIa6-DV i"n Asc~48c*OO5/J~wvK+3Y)Mvyq潀DTrOtpem%fejA5T_-X~^aaۂq [ 2271.414290][T30130] [U] +wG?]'a: )' B>tf/<'U'hi.+]e.-ɿ%>2`^U8F.63+A«g3p6:^0tv'EtYCnrϩnPj ;Z8!\Aʖ2$­wi.#/Bai`4jdy@zgW5˿B ٜNy"vI2 [ 2271.414330][T30130] [U] T_K5tYJ9c$brLNul 9w|G"ʃ%C؝q 3qN^HP*$ .7yӱ2 [ 2271.414351][T30130] [U] ? h*37鍾^#Q"0~ (oX Lb,'v=CSGS0ւ`ه=1(p#2DO*Ƀ [ 2271.414409][T30130] [U] sgGud-{|&2Lc_!`oz֥B%>rwSsH"yA4O.Y䏄RTԶB[+/<>{q_՝LX8U{Z)7?rR;crhײڣ1>)Măt(aϝ}9ڥJ*Mќġ'Lq DW=|q ÆW;5Ž!dBx`/E`ƦMX"\ [ 2271.582829][T30130] [U] {; ٘_o2)o.2W2yx_ HPϱSD:]{ [ 2271.582870][T30130] [U] I,> 51^1N4oǶ'0?֒i9w._.WaV`)Zc6GiӹaXL[F*OW)+'\n[K@2Ǭp"^` [ 2271.582887][T30130] [U] 22Ʃx?0;3u [ 2271.582945][T30130] [U] ޜsObx8W4(~/KUԖoQe+G-ygY_>v3.hә]̈́2)D, D~d+w; A\FPȘ|$)KؐIɿkYT^R癵A=#ܜ aet1ݯ4K.e"RS|s:>p r"z#P!KY"}FN84hޱosߙ̫%Dlwm [ 2271.582980][T30130] [U] [['xn' ,mr/1D=!Dx91BwRlfKZ#` l؛˜b~m [ 2271.583006][T30130] [U] L>d+d"5h3<iR=F^fnvDOIO:U>Y [ 2271.583022][T30130] [U] 'B6v20瞥׌"t8{9FW]쩍 [ 2271.583050][T30130] [U] 72uC6τI]8ctۨQSkYI |V'TV/g$[ 9kh`"}[^=0]%̂TF_v4C [ 2271.583088][T30130] [U] ec [ 2271.583102][T30130] [U] |<:^3$7nK~-@?/mtl۾Iw@g~t{P+$jp| IRipm Y 8tV,l, [ 2271.922078][T30130] ALSA: mixer_oss: invalid OSS volume 'tunl0' [ 2271.952517][T30129] [U] K)0~ʪiP'fzr @B]5{ʼ'8ƥFUTqUdǩK;70c[yYCذmL8T͚5rxW xoQhVi'8L [ 2283.409117][ T1310] ieee802154 phy0 wpan0: encryption failed: -22 [ 2283.409182][ T1310] ieee802154 phy1 wpan1: encryption failed: -22 [ 2344.846459][ T1310] ieee802154 phy0 wpan0: encryption failed: -22 [ 2344.846526][ T1310] ieee802154 phy1 wpan1: encryption failed: -22 [ 2352.048782][T24063] Bluetooth: hci1: command 0x0406 tx timeout [ 2367.408785][T24063] Bluetooth: hci0: command 0x0406 tx timeout [ 2391.162659][T27220] bond1 (unregistering): (slave bridge1): Releasing backup interface [ 2391.162688][T27220] bond1 (unregistering): (slave bridge1): the permanent HWaddr of slave - 92:9d:8f:be:1c:76 - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts [ 2391.162714][T27220] bond1 (unregistering): (slave bridge2): making interface the new active one [ 2391.162811][T27220] bond1 (unregistering): (slave bridge2): Error 16 setting MAC of new active slave [ 2391.222920][T27220] bond1 (unregistering): (slave bridge2): Releasing backup interface [ 2391.242457][T27220] bond3 (unregistering): (slave bridge3): Releasing backup interface [ 2391.256180][T27220] bond1 (unregistering): Released all slaves [ 2391.270325][T27220] bond2 (unregistering): Released all slaves [ 2391.286359][T27220] bond3 (unregistering): Released all slaves [ 2391.315043][T27220] bond4 (unregistering): Released all slaves [ 2391.393608][T27220] tipc: Left network mode [ 2391.718570][T27220] hsr_slave_0: left promiscuous mode [ 2391.720215][T27220] hsr_slave_1: left promiscuous mode [ 2391.736222][T27220] veth1_macvtap: left promiscuous mode [ 2391.736262][T27220] veth0_macvtap: left promiscuous mode [ 2391.736453][T27220] veth1_vlan: left promiscuous mode [ 2406.286819][ T1310] ieee802154 phy0 wpan0: encryption failed: -22 [ 2406.286887][ T1310] ieee802154 phy1 wpan1: encryption failed: -22 [ 2426.765598][ T32] INFO: task kworker/0:2:27513 blocked for more than 143 seconds. [ 2426.765632][ T32] Tainted: G L syzkaller #0 [ 2426.765645][ T32] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 2426.765656][ T32] task:kworker/0:2 state:D stack:22600 pid:27513 tgid:27513 ppid:2 task_flags:0x4208060 flags:0x00080000 [ 2426.765719][ T32] Workqueue: usb_hub_wq hub_event [ 2426.765830][ T32] Call Trace: [ 2426.765838][ T32] [ 2426.765854][ T32] __schedule+0x17db/0x58f0 [ 2426.765919][ T32] ? __pfx___schedule+0x10/0x10 [ 2426.765959][ T32] ? schedule+0x90/0x2b0 [ 2426.765991][ T32] schedule+0x164/0x2b0 [ 2426.766021][ T32] usb_kill_urb+0x1cf/0x2f0 [ 2426.766080][ T32] ? __pfx_usb_kill_urb+0x10/0x10 [ 2426.766105][ T32] ? __pfx_autoremove_wake_function+0x10/0x10 [ 2426.766155][ T32] usb_start_wait_urb+0x22a/0x5b0 [ 2426.766185][ T32] ? rcu_is_watching+0x16/0xb0 [ 2426.766214][ T32] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 2426.766265][ T32] usb_control_msg+0x234/0x3e0 [ 2426.766298][ T32] hub_port_init+0xb0b/0x28c0 [ 2426.766351][ T32] hub_event+0x24e8/0x4d30 [ 2426.766379][ T32] ? do_raw_spin_unlock+0xf5/0x200 [ 2426.766454][ T32] ? __pfx_hub_event+0x10/0x10 [ 2426.766478][ T32] ? rcu_is_watching+0x16/0xb0 [ 2426.766496][ T32] ? process_scheduled_works+0x97a/0x1630 [ 2426.766515][ T32] process_scheduled_works+0xc3d/0x1630 [ 2426.766550][ T32] ? __pfx_process_scheduled_works+0x10/0x10 [ 2426.766572][ T32] ? assign_work+0x3cf/0x5d0 [ 2426.766592][ T32] worker_thread+0xa47/0xfb0 [ 2426.766618][ T32] ? __kthread_parkme+0x71/0x1f0 [ 2426.766644][ T32] kthread+0x38b/0x480 [ 2426.766657][ T32] ? __pfx_worker_thread+0x10/0x10 [ 2426.766688][ T32] ? __pfx_kthread+0x10/0x10 [ 2426.766703][ T32] ret_from_fork+0x514/0xb70 [ 2426.766719][ T32] ? __pfx_ret_from_fork+0x10/0x10 [ 2426.766733][ T32] ? __switch_to+0xc89/0x1420 [ 2426.766756][ T32] ? __pfx_kthread+0x10/0x10 [ 2426.766780][ T32] ret_from_fork_asm+0x1a/0x30 [ 2426.766813][ T32] [ 2426.766833][ T32] [ 2426.766833][ T32] Showing all locks held in the system: [ 2426.766841][ T32] locks held by khungtaskd/32: 1, last CPU#1: [ 2426.766888][ T32] #0: ffffffff8ed5c8a0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 2426.767036][ T32] locks held by getty/5374: 2, on CPU#0: [ 2426.767047][ T32] #0: ffff8880330e80a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 2426.767114][ T32] #1: ffffc9000322b2e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45a/0x1360 [ 2426.767170][ T32] locks held by kworker/0:2/27513: 5, on CPU#0: [ 2426.767180][ T32] #0: ffff8880212b5940 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 2426.767218][ T32] #1: ffffc900043d7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 2426.767254][ T32] #2: ffff88802b1181d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 [ 2426.767291][ T32] #3: ffff88802b11d568 (&port_dev->status_lock){+.+.}-{4:4}, at: hub_event+0x20a1/0x4d30 [ 2426.767326][ T32] #4: ffff88802b0b5860 (hcd->address0_mutex){+.+.}-{4:4}, at: hub_event+0x20c9/0x4d30 [ 2426.767363][ T32] [ 2426.767367][ T32] ============================================= [ 2426.767367][ T32] [ 2426.767373][ T32] NMI backtrace for cpu 1 [ 2426.767386][ T32] CPU: 1 UID: 0 PID: 32 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 2426.767403][ T32] Tainted: [L]=SOFTLOCKUP [ 2426.767409][ T32] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 2426.767417][ T32] Call Trace: [ 2426.767423][ T32] [ 2426.767428][ T32] dump_stack_lvl+0xe8/0x150 [ 2426.767448][ T32] nmi_cpu_backtrace+0x274/0x2d0 [ 2426.767464][ T32] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 2426.767485][ T32] nmi_trigger_cpumask_backtrace+0x17d/0x390 [ 2426.767502][ T32] sys_info+0x135/0x170 [ 2426.767515][ T32] watchdog+0xfd7/0x1030 [ 2426.767534][ T32] ? watchdog+0x1c7/0x1030 [ 2426.767550][ T32] kthread+0x38b/0x480 [ 2426.767563][ T32] ? __pfx_watchdog+0x10/0x10 [ 2426.767576][ T32] ? __pfx_kthread+0x10/0x10 [ 2426.767589][ T32] ret_from_fork+0x514/0xb70 [ 2426.767603][ T32] ? __pfx_ret_from_fork+0x10/0x10 [ 2426.767615][ T32] ? __switch_to+0xc89/0x1420 [ 2426.767634][ T32] ? __pfx_kthread+0x10/0x10 [ 2426.767648][ T32] ret_from_fork_asm+0x1a/0x30 [ 2426.767674][ T32] [ 2426.767680][ T32] Sending NMI from CPU 1 to CPUs 0: [ 2426.767724][ C0] NMI backtrace for cpu 0 [ 2426.767748][ C0] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Tainted: G L syzkaller #0 PREEMPT(full) [ 2426.767772][ C0] Tainted: [L]=SOFTLOCKUP [ 2426.767779][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 2426.767790][ C0] RIP: 0010:pv_native_safe_halt+0xf/0x20 [ 2426.767817][ C0] Code: fb 87 02 c3 cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d d3 e1 22 00 fb f4 8c 08 03 00 cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90 [ 2426.767833][ C0] RSP: 0018:ffffffff8ea07ca0 EFLAGS: 00000242 [ 2426.767851][ C0] RAX: 0000000005072f4f RBX: ffffffff819bcc30 RCX: 8000000000000001 [ 2426.767865][ C0] RDX: 0000000000000001 RSI: ffffffff8e415ec4 RDI: ffffffff8c6dad80 [ 2426.767878][ C0] RBP: ffffffff8ea07d78 R08: ffff8880b8633a1b R09: 1ffff110170c6743 [ 2426.767892][ C0] R10: dffffc0000000000 R11: ffffed10170c6744 R12: 0000000000000000 [ 2426.767905][ C0] R13: 1ffffffff1d51e00 R14: 1ffffffff1d40f9c R15: dffffc0000000000 [ 2426.767918][ C0] FS: 0000000000000000(0000) GS:ffff888124cc8000(0000) knlGS:0000000000000000 [ 2426.767934][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 2426.767948][ C0] CR2: 00005627b008e660 CR3: 000000000eb48000 CR4: 00000000003526f0 [ 2426.767966][ C0] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000063235cd5 [ 2426.767978][ C0] DR3: 0000000000007000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 2426.767990][ C0] Call Trace: [ 2426.767998][ C0] [ 2426.768004][ C0] default_idle+0x9/0x20 [ 2426.768030][ C0] default_idle_call+0x72/0xb0 [ 2426.768055][ C0] do_idle+0x2e0/0x540 [ 2426.768074][ C0] ? __pfx_do_idle+0x10/0x10 [ 2426.768096][ C0] cpu_startup_entry+0x43/0x60 [ 2426.768114][ C0] rest_init+0x378/0x3a0 [ 2426.768132][ C0] ? __pfx_rest_init+0x10/0x10 [ 2426.768152][ C0] ? __pfx_kernel_init+0x10/0x10 [ 2426.768171][ C0] ? __pfx_acpi_hw_get_mode+0x10/0x10 [ 2426.768232][ C0] ? acpi_ut_status_exit+0x120/0x1f0 [ 2426.768292][ C0] ? acpi_ut_status_exit+0x120/0x1f0 [ 2426.768315][ C0] ? acpi_enable_subsystem+0x286/0x3c0 [ 2426.768403][ C0] start_kernel+0x392/0x3e0 [ 2426.768460][ C0] x86_64_start_reservations+0x24/0x30 [ 2426.768502][ C0] x86_64_start_kernel+0x137/0x1b0 [ 2426.768526][ C0] common_startup_64+0x13e/0x157 [ 2426.768555][ C0] [ 2426.768704][ T32] Kernel panic - not syncing: hung_task: blocked tasks [ 2427.429262][ T32] CPU: 1 UID: 0 PID: 32 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 2427.439953][ T32] Tainted: [L]=SOFTLOCKUP [ 2427.444275][ T32] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 2427.454337][ T32] Call Trace: [ 2427.457631][ T32] [ 2427.460577][ T32] vpanic+0x56d/0xa60 [ 2427.464575][ T32] ? __pfx___schedule+0x10/0x10 [ 2427.469439][ T32] ? __pfx_vpanic+0x10/0x10 [ 2427.473961][ T32] panic+0xc5/0xd0 [ 2427.477696][ T32] ? __pfx_panic+0x10/0x10 [ 2427.482127][ T32] ? preempt_schedule_common+0x7f/0xd0 [ 2427.487600][ T32] ? preempt_schedule_thunk+0x16/0x40 [ 2427.492979][ T32] ? nmi_trigger_cpumask_backtrace+0x31a/0x390 [ 2427.499141][ T32] ? nmi_trigger_cpumask_backtrace+0x31f/0x390 [ 2427.505306][ T32] watchdog+0x1030/0x1030 [ 2427.509649][ T32] ? watchdog+0x1c7/0x1030 [ 2427.514076][ T32] kthread+0x38b/0x480 [ 2427.518150][ T32] ? __pfx_watchdog+0x10/0x10 [ 2427.522831][ T32] ? __pfx_kthread+0x10/0x10 [ 2427.527439][ T32] ret_from_fork+0x514/0xb70 [ 2427.532045][ T32] ? __pfx_ret_from_fork+0x10/0x10 [ 2427.537166][ T32] ? __switch_to+0xc89/0x1420 [ 2427.541862][ T32] ? __pfx_kthread+0x10/0x10 [ 2427.546459][ T32] ret_from_fork_asm+0x1a/0x30 [ 2427.551252][ T32] [ 2427.554561][ T32] Kernel Offset: disabled [ 2427.558911][ T32] Rebooting in 86400 seconds..