last executing test programs: 6.619549816s ago: executing program 2 (id=2930): write$RDMA_USER_CM_CMD_SET_OPTION(0xffffffffffffffff, &(0x7f00000002c0)={0xe, 0x18, 0xfa00, @ib_path={0x0}}, 0x20) r0 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) fsmount(r0, 0x0, 0x8) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0) r1 = syz_open_dev$usbmon(&(0x7f0000000000), 0x6, 0x200) r2 = socket$key(0xf, 0x3, 0x2) add_key(&(0x7f0000000100)='big_key\x00', 0x0, &(0x7f0000000180)="6e0c9b6b38d8854d85727d43ce556eb22c5cb5fc81ee9f9941ba0c6c60c1ab528285e82284ed3c1478e8aea7dc02172e3a9755e16789af43f35444c503b905f0f48c295eead1cb90085023fb1d3546e33e6107011b1d3963eff1de242c4d51df88ffa9ef6dded54bd702fc891616a60466b0771476907653531caff22970069d23a621056e995789b2d6982d03f9c70ccf029dbb31868224a803744fe50b1497de47c94a58b49784ac42a2a16cb020fe53504bef26a4bc09df87bd132ff20d29544352f2ccc6ab2fb5ab1bbf820fec0af6b091e26d0f4af751a4cec7c5ec739b29aba620d4854355ad12b4177e4792b90c005f7b4fba056e5211236d95be73f601c5186ac23f672db56762cf54bcb034f8d485103661412189d5919fe63b0179465a5026cac8a590f6b49d35e2bce1876cef5625e99d3d5dbda46431f10a1e772465704e64d919ed70c0f085e74d9a9acb92dd0e85c66d1ef0681205b9b09ebec13b243bc18a0a912f3a511ada1d78030f8437f97674b02f3181b33d43cba3004bf9aa25d02bbbacec283716fd18773e3b75e431f340d11313c8689283501b78087f848ca54a3016ea180443e3e08c7fee7b1222bf36713d9468508086c8f6bef47fab5603321739203565512ff0c4d247673b6b7cb0a6644e13003fad2b8dd5db73676dd6864fe8fedbbe88ce48a52565cf476404238f4798c3464f45107a8ea93bf0c8b29bbe8c9ed55eb98891fadd2eece5c8e604472ea44a578aece6876980f880d431e5783a476ffbcadc4658f4761357333668ff890d8b33a583f61fe774cb05c93bc223742046832ac9de4f7e2f3dec915f1092174c7e1908bd155d08a666fd16e60b14f2906eace05a2763cb1b7638a52a60234c4c3ca6b2dc866ffa89f8a7bce7b3882918e028903f5bfadd98a1da11ae806faf0031ee3bcf02086bca65d3ce02bed0d96437c386c7ca345ad91080a0aadeae1f08c83c319134bf157f986a7f019581493f91f267972ccc5c6f6c9422e679866b56cf278ec2358ee779696caa04d439583be641043874375dd7782e98f359aaf7eb722aa393e3e0846c2f199f189ca83c8a3a64b3ff650fcedef52b366c6fa49e135ce98eac96ba4e2081dfb28e9234fdd9c00ad99ad9f07e1912dbede37cdccade1536c1b64f62321b40648faab1e282a01c342cb879bead9cc1a2b1ec15af2be7d34755834030768643b318e83cd4514448a8aed0c73e477eae4d6dc46e4a56e52c773377282c9dc7210e921b5ca0aa256c9d026ed0f11a00ea72896ebe0ddceae01d915a251045cd7c111a9a5ed31e4309ef3febc86ddf70f1b6d588699cd4fea874599570ddc142773c7c376688f696fd4c412bb570de5959e3174e0938cf99b791e1f4b1c5b3caf3ce36333a2d18561992644da22673938ee524a73974ca5d5d9b5fead6e84d20a479c45454ec40dc5c05d4e3236f950ff0b50d842062cfff7f51d9d68ad93ca5dbbbeb7bf624044d8a4b2e4a83a9c4d378ae187f706802b55ced5c6334f78210daffb70527aeccf1807fb2743264daa59d9e040a5c744851e880395048c15670e311e7c267a45966d89cf9f042cccf4be4fd3ca9e21a033d2a108fb318f5e392d5393a544cd7ca4e6500a819f062740cc3ecead9745116be7c9fd46b6e5afea5348ff5808ea582a8efa958537d99318c50a6dbf9eadd035c309a4f4f7ddfb95e89fa73eae672423bfbbe5b64a9626d30ee5797a49b31a46dcea377a24e02bc1a000bc09ebe03c1c7417379957cdadd93f3830e912d18c6ba302a41e5bc5127a482c9b426afa53f30302b9e1ebbaf4c85e42b418f89afc5515cfcb0b29143785e4c2146424335e16769ff526e57d419ce9742521748539371e1ac32a7d0eeff94fb07704e0d58e26c2206f1309c8d326952de382b3d8485442019730b1e2a504dd04131e7eae0e1776b8799d5f8844c90d596104dd235834e", 0x579, 0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c1) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) r4 = openat$dir(0xffffffffffffff9c, &(0x7f0000004280)='./file0\x00', 0x40000, 0x73) syz_fuse_handle_req(r3, &(0x7f00000042c0)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000006380)={0x20, 0x0, 0x3, {0x0, 0x1c}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_fuse_handle_req(r3, &(0x7f00000083c0)="99529ca7d265e2dba44891e35e7d5dab7921b730436ecd4e999a25bcf86a25f8f029c0dd50373e90b7cf7779b12ecd4423c5b13cfac186975cd723976f3c747612913029d42517c189364bc59d8ebad53ed1b86f8f66c99b1f9b5b40d78cef1f14f81815d53bdca7fef40607358db69eb8c0b1f6b0942ab4b1ee7ca8deb4eddef06381a3d1c52d6147fc5109c7c607591497a6b2477f60cc881d3219c96bffb34aadec3fa97250713cce17cd536721bf9c40a019531ed0bbad139e26a3d4d39b68ab1bf37cb1a4bd197a8789cb1940cd86d9e56713bc36c7cffd07a311f5bc2e91f16d152eb480645e85ec9b3bf09c7fa140dced0afd55d7b99e90a96e7748e2d0dc09672ac199ce529e631efe1783769819c182ca106f6184bcbb387ed246c43562d74c36ac3a7ec2f0e11f70bad0007c03bb9c0d2dacc2148cce4a4aea327c7319016ad146b52bfae0357f9e892e9bec61a13c93551cfa3d4f4bfa7585c93bb0bef01a9114f3dc54179cf9a57fe88f5cff3403e33c9d09e3e9c2e10f1f16894e1b59e3cad47c1f202cf7b756f2851fc96d09459c9a8d34c19e6a3525cd5001aac5181f57286d0e1e88ce5092c7c76b6abdaebf2c499aa47587b48eb12a2b72548c190b0324ebedb81a63333b6edb25550f859c5ccc404a944ff7f61af8800888192fbd4c8e0e417d1d181b4b335a6f52e0a7dae18397e81e3f747cab7be902ed903bdd6a622f178f9b4244718ee1206237257374d2fd1466ab6135ef7ef4a114ae170eafe9cd78cf9ffc36974cbc4b8003072bed78765a0b9f1240f24dec6a9e46db9bb498d40f727c0cbf8f4a6a49539bd0805caf65d80130d7fb60a69dc7ed890874a17530c042cf33a977d331435d68ef33885f638c777ad49564ca77d8b81ddd853a21cd55d95b627310dd633a4f005853a5506cd8f744c367f3cb6998b0fa97de6bb35b166b0c6408c4e0a38ed26235a88520c38ca97ac8a6dc81e6dc6483d383fa09f198997b8eea1c68c9e3320683c9a02dd89ddc34c241e7294ccc88d6b35762892e8746e558bfbc2251949f2ecb763dad5b975eaf36e2864be6a41d3e20514d32f5d4b6350dc7e3cc3a85428ea98efb3b1edc2a2ec1e618452949cc7e2ba1251990168fee342d4f304b7a7af9162bcbe6b09c75d7420d2c547b4e3cee1836df6eddd5dff73a4e308fcd8eaa7a33e6980a6f8ead03257a37d72d3b265d02fa42f57db877654ed513e31c35e1af0bd28511d6b57cfe07b27cbe9767a534b426dfc3dd257d5899444f34cbf4dc74b9eab2e7e3e1e1a8a6ac5e4359d653506b299a5b7c67b92dc462f1216655f952362a3387ad9966b606d98e8d1b544dc27dc6bc78fd18a446736e25c51143db9886b6c09812d5825b5d9e0932f218ff8bea4d9e1c4df9c9d4eb19336d48163a921c4ff1f0beef26b01b7e8c0d23fb59b84e229eaabb791f2cffc9aa4db75162cbfe4c9ae8d76a5b6bc4bff20e3f8f125b9aadb3e728d7f78d61fd55f46b7f59511b876e6563256686e44f25cf38d393a9b762bada272eba8df28e4086c4cd2fe3c9fab97756fb145373e6ca1991bb1ee6589e49c821ff29f047970819f88f724bd077cd3f0ae463d99b3e53078431e3f9bebabc5289a65479359efe3909186aac60a29f561de8c590988c913c9e693ab8106e8287f6565eee6735f7c88cad7124d1c8d9ff347e97912824088ee954de01c6d8a06447f06899607eadbfd078bc3df506252005749378dbd7399c9eca60b81dc0d88dedec31e5cf6e7b6d6d411958df8f9e0bf4443e8d3bdfe49d05f811d17088024d0629fc8ab8e05e309bf55e8e60d342623765f4e8d2dc4a90291cd4354ff9568c8170e6ea56e028bcf2719595253adb8c84050bb9ce4927a1c1f4560da87d109ceda90bbe45a1717763d8025f1ff40f157185ddf17079da272ae10c4f34162caf4b0d31221a57b3059fd449c87554d968a54b2eebd760dc3263c40d9eedf5905d5699d29706ea6e9e81ff2bf92489a06deffe7e978661f37a88450783e23f107c2bfce000dfc91c5fca49e46d9ea978f215a45984699f0d2503b30a741e13be56b7abe3e5663c0825c3cb04ead44ce97719c4ee6f4cdd3c452775ad7163d5c9034583cc2dbc2b0c04917a3e1aa3d0a8bb6fcf94d7922eb1d543c09185827aeb1b72ae7103ef2c014af2ff4b47fca40fb0e66ddf0264476d7a84e9b8dc551d4c407bdbac6757f7a25bd404b45bec1091696203cc438860131ad5f2fd80e3c45629864dd9f7d302b66fb8fb86735c9a6dcf8b135a273dd2ae9473bc905081be9fcb8f91b1ddba1ac692798dac0b9ccffe0319a779f5e10c65f294b22fe475283b023f9cd890e92c5447b1bc1528255c5af383bc1fb6e72cb9a67215a9e25cde63c89baa8c7125c7e8b748b728d07d9cb66778404f54e6a9e3ae1ae82f3d0ce77199f23f94a01b71b805b476fedbebeb52c83a1b857f23ba438c56a6c4c2a5909f721e6e3d240e4a16455e92220d13022ce7ec0b1365ba4e67aa6ecb324f8826579e12cebdfc0d8af63e83b5e5624d5b791f99093f9a27f7baea9fd10111209c0857a04f07408111063ef34026aee27a3d51b40e53883f9094402534bdd21cc49d7f5593e99cb204cd805bee4add0f82cf4b6dc5da14d6b79fbc68c9ccf7fb5fe774f8879e13079b024a8ad24bf123c420d630837a84ba05abf0ae4dc3fc04f25c7f74ff91d0d609c958642a48551e51b5c0074a56a7da10ce153b08cabea636f8489d8e7b655758a41d7f7474c9d76bf4d54d789bfceaffef139854065de6a94b0275a9626aab99ae838364b1a491e55017e4212b6b01f7a41bc9c215ecd17c49a8610db28c699259c58b81a0e84c45fd8e719c05c48501c49e8a6515044d247f58e4cd0bf22fd6ae31f45339d1f801196d426c52269b1aaffaf18e2a03760bb231cb7cefa6d72f1d7eb6a3bbd65d0914221b8fbf531dbd562eb4a1b28983ac7d83d4813b10b34c9525ba644f61a2c4800d4fe96a7bca63da1041ed73cc57fb9d42f9dfc8ca41d80292bbb311c89b0a0fcee1d88a025a7416863342aea00e6f049cb2ddebd17c5c617ff562a8af0c965cbe8341431a30ea239e4a62aa2b19757a3b0de04229a9907f8610c27b26591405845bf8b5b83706ed18d910c4f68777378366ff565617b19168a04560a32ce5ad64aaef9f4377118c4335b24826cdcde78fb4bdb11498553f56d8dfeb3a482c70cc6580c399b92339cbdb3464fcc7b00e9839fd0d2b8b6db90c56b33593a0048bf7983421f29b1285c81a239045b96a9b0cacd70d6d9853206471f06915efc8d3ec4c50fb13601abc73247a656066fd7b329159b3ce9e3302b4c0d6aec58cb0946a8ee8e7f55f1af604f1edb4d887fa6292dc0ce57705c1a25dc62650c127d11a364b397aefc2fcc3a164bdc53165a461b01de9180c1461b309c75af0911b4cc1b8aa05652b62119c87b4b235c573aa15b1516cddf61efd6a7f8c953fbaaee9c0e800e8f519e1494de850ddb976864088fe0cf90bbc54395078ea2501e8baa84d6807e184105bc2a140b663416496886422643bbf764d406af06e7d086678828defda0b648b25666b7b5ea29e927141740d5be0e61bf25d40b8404ffd3c67bb855b11d4faf82b7b8051615c101c3deb0601a0fa9ecd8b4a95082ccbc8222b0982802dd8430e653d6eea2786dc3a91397135faffdc65a5bae048f5c463b1a6648becce961d39d063d28d1ad6dafcea0b0878379adb16cc0d4cea572abeacd9a168a4fe2e338092b5bc93ecf02ac6ccda03e5b23adf511fdf7a79442093233b79c67d3fdd3c36c96a8f67aa79e4743d99cf963ae6161877f73656eb0314d889f4b8649bbce8a759f90eac6c006197b54b2bbac7c9b237f1e3dc099c62a65481960e6ad697fc66316ac084ba99c60f58bf44ff45f3b2006cbc4196a25f124dfaf247e863a855ef6070deb45219a922dcf2be9bd01c340e1ca5ed7c3ddac9f7a677c5d00610991d21e0751ac8044585b39f3fec5b672a11a9bce32196c2003d01ea50b0f0403e16df188ecbbb74f295f01398363ddfecdb63a49347c912c125670205d7b6be999688df85bb7d5ac12b62b4fdc4eadcc2a9a7897028404f697b007603a0ad588c772952d6670ee870771774ad157c0b9cccd4b2192d835606198ea0c65036ae4e406cdc539ff3aa81fa20b7ab58d6f3abdb69cc1f503d593f7025d2035e7f21db76336efc2843a0dc9bd2eb8794718134ee68fc57d4d2bcc18969d08177f442b87433b48540c661940cf9e2462c53efa310c7e47487deab2ae15b1978ef05aa1e14110943f649d82486f710a39854409e74edcaf06b4a92d3580b9cdabf83c6351657698d3d5af7514f382e75d1c912cded577258603fc9ed002e010747cddf7885d34afc9a84d82696c6660cb5ecafb68b564908fc49c4db6a187d037241a26b1141cf20f2e968a53366db0f60b79cd98cf3c897c50b7b9728e6e7100f99e4d5ed2428dbd285516ca6660777a39b4b2617c1be5b0232d60b9c8099f5daedbf190109439c40b46090985200d6c0501313f3fa4d244864575c275faca47aeff32c7b3e3c59392618562a7c2d4b3af85a37a8847f595352024cb63d3a9085c2a502c6a3248f43c5fc828e636cb634b2d393d853ae2dc9605985cf85c060860a90256c7b574c1e01c320687a2bb0b2d51cc2950c485f2ffa5db0ad7aaf753f543de7f86efb775c6bac2989a33757a28836fd27f9347229a0004bd2e546994c69c678fe5717f613f905d945c072004c3a80e0e54215e19ff9972521890d4e705e429f16fc35fe5a15f2e6b75cd719d38f76b087b62e4b5dcdb35f4baa2bab167150bafb6c69e260ca51004bc826d46b77c3f67eaa08497294868e6d91b7b867e4da62052f4f891677256cfbaf19cf32bad99a7da69d8a66537686f89a58d78c7eeaa99cd38009a1a32582bedc5c718e57b19cd405ae659a89909356a07fcef89384d160fa5ae6683cc379642aea4f0c915f72d679bd521399cb16112f2abdede3001400b4a64d2173e153a68631183679b56b8f389ba889784133453a7e892fd3b092f5040870a3cfd6f982990143e7c0882b4ff4c5d049192d36925a25ae4be441aa30dc7e74398b340c45b52c73ed3b0cd640e3cc9fd4be24e7355f386106f65895f1ee850b2a781d1d1d322ca5a3b0fdb78ce1eda048ece94af25437969c99c58c08f1446ca5541e03987a20fd75283e3e116dc4c9222ab7522e4ccf6da14aef49cac9a6a2cd4aba1c54d49e6da4179a66b84e384cd3da53908579b28c11d525ebdc4dc69074cef8a9ecd3aab98f2858769d656b46141c3a4e69a5ed6c0a732c9ec1fce080eaebf537fa5e17236a44ba9c931f555d193e475ffafd20c53ccbab607c1a15fd06742a64691205eb0d00f7f40e4dd8efb279cf09b2522aac0729a631aacb92d5cfa2ce6bb07385b981890b5916755d5cc3a51c8c36bd2987068cc24fcf73840895ca9bbb9aff1059601f771afedf0a48d5921103920515b27d7e607951982feba197df8c61600feb3622b9eea13a4db4068728cb98cca76cfae197f6258758490bf41673ee29acd91fd296ec863c646e0ca6a0f0e9de146c663ba13d962964d7c32804fd12a14c1ca7212ad48bdfab469c6570dca562220ecbe7b6b163ed4c9361c5c10bed5c92861b8786ada20a99245d282e4454187ec02adfe354e30647cb10661c85168f7958e3ce69ab48c9455214707a63c9b1167f0845a6bfcce2a96cd53eab430f13cd527f1666290719a47c517cfa22fec2e9916af8aa93c78e567993d7fb8ee60fc4b903b8c67a3658302c5e5f35250c30427e4c055b6c54705bc599861f80b7200d361965ff98c88cc698a2615cadeac4bdfd3d613377cea52d2bbcb7e6b78ac31d4b2c33eaf0b2ed40b963e3cb25c7dfea3ebfe7b4aff2aaaaf184dc80ab649a108e2c830ce7eaea58a263392aa9cd13d7f7bd607dc7c804b19dfa41b3e5a5155201a87311e22062c93896e70f3a5c4b03521300b61cc311ebd5beb9838d0ed207c6bfc99e4392508e95804b10b36024f32e1fe1138e9ee7773f797b2bc6be7416f4e9691ef4c2a8d06af6c8b84bd1e6fd1ba3d3183475ef6c139ccf8dcf37671fbb96a2ab5e0e042f7c4728cf30bcc1a0de28a5024276ceaa194b4926e7f6a97b78bac36e47f832d56a96cd266434d37bcf2c2f57877717d91b1854972f832354acc207a2ee8caace7504e0e6197dd7e64a01c4c67bb2de8acc0cccc6c6bff0b0cbfe345542c5a795dfa48cc0990ab5702574d36494bc44c20f5b324f7c984d986cc8cb40cb2550076d96a069b6688d22171beed2dc5b6ff3ede8fff4c4a9de6d3817357a7ca7d24d87300b4545ebbac8cf7f09ec637a4f4d6bd07673709b6c363a75ccef585610c5f15de7851b5ab53e02a757bfc3caeb9a9a8996beffdc0cfd1201b6cd99cb035584e51a6c15a5d2e17d2f8aa6b41e26809392fac6caed1e02a53dcea8a413203608780dab33315a76eba24d540e4c5b9790420834bc8d4e47bc65ae52a54c0ff308427a8d7aff746aa6589d17514e40fee5d0b3533cf4ad2c5f9d96db9f50bd69ed8c92b860e199a35cf268c66ed13516a3b4b024f62d4b2a656067eece95575bdb4907efc488a9821bc3a9c81dd11b2128b7a01aa7a9ce6e73de3b4e9beced70206f91575baddbcbe5722337953c8016a0f4b62120d776c43b7d1a879b692107954f45acdf8967dcaa994aad4922d4fe093e16c2d0090906f5036af99e50bb09b04e9c9b3b5085abf621297ce203010249cede92e9b66b446b86b43eaaae228dfdd3b4408c12b404bb727f7e969e7da04fc59900112bf8d38af0416dc616e75f167aa1352215f07115a6f4eb6bb5fff6f5c2fc9ab906392036b44090e65fdaf017dc53bc94e0807d679d793df18cc44e6c846d414cef1569530f7692daf91eaaf4ae89fe2522f2c9cf33b6ca508ebcd006bc1a61f0c800553aff9dc7d57200b25ecb83e1e0b8cd29520b63aa649d3f71a62570eee56e03223ddf31f0c04fa686b7f6dd054e7a259d9ba335c2c5b2c508897506c0db7f01878dec1411c33f0af61b81dbcf9ff8bdc0c50044963a79f3ee1462150c6bd03a32dbdfef8d72f0b8b3a395ffb0cc85792e7bc867feb5e312cb64e29e193388e9f173c162f4a1320a6f99ea3795fb77d982605959909a1aa11076fcc779ea6b80ec1bf0edfc2569ec04d15a0bdeebccf3c75393dca5e81663532f8ced12d08e4c2ae6e2954d427c7bf053dc4718f56f453bc88d74045bd2f9747aae9b5298a0de927f1d6b1308f4e1483487f083e71ed09298deb52bb10079b13def7453eb432498069edb5ade70c5c54913684d934a3febf78753ac13300a91f467ff3f6e2f00898f015d08f7739047b321b3eaee5ad8aa7adbf7833f014d8c576a491af9fca6843b327ed513821cb3951b2e67a275225d7af6b382e2f955adaacba5d1fdea2223202dee132b91d5cf381b51da94145255f584a70c5e8d11e06a44afa6599bf3ed0cb61703eba254333af53afac60e54cf6397f9f7302249ab644f0b576c713b15007be1f4f9bb213660bca8a70251472b86669d361ef968f542e81ddbe8f4d2e9cabe8d7bf6a31f14a2cc272963553a424c105e7750437ec5bf316e30ce60b4b0c27ccc1eb27e60f6472fef27654da49905ff9c01b28695310ecd8701aedff25a83da4b7c41995f902bdf249769dcb53a3efa894710dd66ba8745ae2253cc6b75a038183a0bee21226d48239320efad6727093e4f94bbc2fdcc216200d903c32bb9f16dd17d5dac423ae0696f3decc576b8f1fdce63d0532370af7d1e2fa2ca5c5d17bd88f5e3abb4792dac8689ca13752f83d753b06b037bf5a80a3748983790352775685b0414c9d74849fd217e388f904278ddb6b0abdda941b61579c796e2bb77a9bc363b18642c401faa502a31011544111b6eedaa369976c814773d83220a75f31026d6ad0b8b4298ea6062234db232bc435e096e84f740e55bb14d46ae04af0500aa5bb218aff6c76aa8a8e3140a1b0d6638538fd7f30fa8d992e53abf8af2fbc16b9e8a668c1aac72cea1a746ee5f7f3392a4ec8f1d19f2f426b6069b1cd347cbc38bceba96ce5da49198083403143c740c04639cd1089abb34fe812d85921c47437604f684bca44a1eaa965c0a6e1c1fd1f70ee932af3455b36184cc15934cdb3f28959d37d8fc10696f8ec1e4b0c3d1b9ff74a01b796d1bb68954a3768c8bcec741b3b69da892f8922142b16b2cabb469a9906b34216243fac80374c10e178c5fd36440f8d7a8588a9c2510d86ffa8cb68ce8c330d2111c94724e522f04573dad43bce252eb505d29ca9379a6b281519d38b7174f3ae8f185544f3003c936a7e6b23ca97a313aac6a061caa45fda73522f3061767bb4e33dbe4bde390eb0f07225a8aef939cb6ab2ada10c02527281abad394cd4ea9f59467a08b72047cdb75d7b2b98e5b4542554a60f953ac7a4b980f42518eec05ff2c044549cab0cf33eef36dfbabcbc0300009d898862d2194cfcdd9a713c30bbe52291105193656ea5eb830873ac956469d31689cc3c69edb5cb9a6e31ce3e6fb50ddd4e52ef9fdeacfc0db21e1e83e0d8d0a64f17cacb4dc208a893e7fd8ffa86cfc554dfba3d9fd281115eccb4b9d909f2fbf3fbb66bedd7b5db3f6d4f076f5d8fb54f8832896f8ef6f624162f1dd589be7a8e87dd5065708a8b0bfb18a5c2299f5605ac8a11c1add55b2018e6099380a70bee3e0727ca6ec58928fe6eb3147b47401e8d822eebade713b58335787669e5e0de5d328a1067df4cd9124665bb02ee8adfd1b3618374ef167df1f0fe79456f78aee3da4c1bf397e4637b0cf41a0f4a2910efd02b17bf5f3c15b0084b36fa7d4e85a53e5be366b428244eeba7499c3e54397227928e2ff6e583f332d6f7e8cf4d058f379b58a7d03a4bfa454bb4b6d543804b8970e6a9fe8886179eb418a8ce9e509e8433571f7d32378f2e983fa418c8c91760ec9fb20968e7fc23b7c4ac71693b2576ac0f8ce2020ff1e7a7ff24301b48b544fb29a1ca4f2502daded865e488a16dd33ec67b2eee3025cdc5ef90f253c4b5e0a61d51e495b675c5a1d55b4ba3812c5f44cd08487e61d36b0c2dc32d27333a5ee8a0906bfbcd388bd9389d1509912c0471c7b706a5aff880569a3fb11ac5f14d780deb4c1b1afe30fb6b8daf87b27a4ceb869d587a97f2f5af8d819aa47bbf207db68a6ecbbefb1e109ed0bfbbf3b54fba9e79de8fad9c3bcd3e74b8b92ccea3ff5c558c6cd72d78a711fc39df603bd4aa1439dd302258edd2204e52d7f435c6f552b612fbc321bea971195cd4d8bb033e2a779e239164d7eea6d8fd233b0b9b776246564cfcf44b31a83031a2413bf98a398c9f93da243cef9ce73d81bade8ad551fb0ffa75bc874c11d23ac9d7752f22a0f54c3870f3314a83e64332db810da1ebb288e10c4eb9be9ec037317b8f813e68160a887da3f5c0389510a0734b69ef275e19973b169d340610cf2112e9964cc0566b9b690c3feb36c8526491d3a563f0bead2abbcf0665e048aa3f929351b2f89876580633a403250ae3b5244c8c0e996bf888938dfc8920348d88e272e6eadc7c0387ca1dae228bd620ce3975d43b58758d9412d304a227245587065f58c4573ba2557f1d8333ba007709b1239d682f03405b22135757178fb701bbde81d2f8faaa7666c025d8a8bb426dc4b8e61aed79b3b3d3a9b01ee9142772d869677ede166e7a8be8ab84cdd6946b1478ce77ba307213971cfb24c86c344310f279e38d22254bf4caf83c02e715cb0550e615dc9f8dd2400fa749e3527493c15fb454c158e4c0603ae6e962b7890058ec7c10f0618ee274a15bca6ca9fe5bc5f9e7797c0950299912be9c58463c07d667d4bffe8aa590ae43db08512b40f3d265026bef2facdd508984e5f6d2ac7ef573397f14ed2e2ccdcbe5796e60ae64d173814906d1da5a5bfe8a2a4c5d6bb0b3315b878b4877d0c045f6e6cfa0dfc1ea4de7abe26f2b2d8c93299ed1d83f1b7853c756bfa346cd53b008fec169883983fe0f2405777dd85e17b2e4e8b23432c0dc4c386d67b6597184d0b4b95877362304638484cc0951400f66ee8391dd44417c58b3d46a8345a8049fcd70f7b5f4a6f912e2b18760947c74ef2b732b342878d7e7cc99902de87db36469555fbbfe76189f108d6ab31f4727fe4e22d075afaf6cc726ab17a5e1b4ab6c8f29a459da3c4266b5ad8ff55906a190f8b19a3bb92a50df49647c03d5d6106ec07e9300038d059a75b54ac31683ef8e5eee946e1c84d016ee1e7800a92c0a3823b62e0417fe86b191951f65abc0c38c1e0e8f1121a04b62a8a720790560f922804b1b7e7eaa497e1bede6e3d0dcf0312dbf221561958fa1e85a8f99e6fc82f919e78c17d1beda16cfef25fb5d00f7c32df9a51eac76000c988ffdf011564aa0e319764b16a5a7c728a470ff70772fb76c9ada26a0ac073fcbfa12501c2454b19e02d928e3939a40bfff76c002533b3849cdf8016728445131e5f1e292b7d3dc06bb3a3cfff6fabae0b7341694a8938c1d2497cd70b76c337c9a312e96c8f736d7625a535e1906eba53d199221ca60202a65be0f7e530aca10e61fa39c7601d65954e5ed4cab94345c6b89c7f8a0de5c61a7945e1564731b6715331d13263b2961a163382f7c4934d847033860e402f3aadb4f3e6cf47a97a2031401da4d2c8de8c80cdad71b97b4deb2075a02282f958ac6772354e67f097ca693778224b80892490015e7d697fb9107f75cea708178ffec93fb1d44e8493bad1d42c918e661219ea819e0200759037a5a585c0fe074fd407536fe58013f42612c41bfc66e16870d7a9c00ee93a3122b253fecbf5de3837641f4a1376af0f053463413c26c29f9a346318565276856b963da30ba6ab8c4c8ef6cfddc432328586d9d9829895835759bcde0851ae0c838a3927ea63fe5ba793fae94da61cab00fc05f3a265a2da1221bb2b66775ed7ba856b41011652d4984991e56249360ddfc997245ac1547a1c16382d42df383a8d1c852643b24895c422712e79c436fdfffece4ed1c50922d4f25296aaf6b204522086d188bee254f8303b60537ead1195ac5dd301286f0042dd68aa05a70e4beb779aa0b61a316f736b72c9ab7ed860a0908a078f4b8a53f2df0abf993f689de4b02b9138ca5047fb0bfc9ba3b92bff033e36fc9553260b008cef3d147c62d1d3944fd1eaff79bc5a922ec2190907bfda1b51c2c7fb867db1f8e13a37b5e3ae0165e93350b958a239ec1f2b78561cff854b975307b5b5dd23b040602a5a36bd79947ee04c7d0e5e30f9c4c79f7b4e6eada98bfc6c357cdf8939213423f1b21ba26cfc2b2756ea3eb992372db0ab8a7c37d8ae96bf3ed6be873c1891550ef741812032e1ae938326c399ee43a3061602dda006f1b6b620bebb6a5752bee77e8acf9921ebf4d4c8af7eb5e937c65697c0664c594e31a62377a25605051996c474ca322ce8e0e6ef8a7988be", 0x2000, &(0x7f0000000b40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000980)={0xd8, 0x0, 0xfffffffffffffff9, [{{0x0, 0x2, 0x2, 0x100, 0x3, 0x8, {0x6, 0x9, 0x4, 0x80000000000000fc, 0x3, 0x0, 0x7fffffff, 0x58, 0x4, 0x9000, 0x9, 0x0, 0x0, 0x1, 0x4}}, {0x20000000000000, 0x537, 0x2b, 0xf3, ':-(\\\xc9\x80\x00\x00\t\xc3\x00\x00\xf39|\xd8mM\x92\x8d\x14\xd3\xa4a\xb6\x02E\x89\x85V\xc2\x06\x00\x00\x00\x00\x00+\x13;\b\x01\x00'}}]}, 0x0, 0x0, 0x0}) getdents64(r4, 0x0, 0x0) sendmsg$key(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=ANY=[@ANYBLOB="020e0000180000000000000000000000030005000000000002000000ac1e0001000000000000000003000600000000000200000000000000000000000000000004000400000000000000000000000000000000000000000000000000000000000800120000000200000000000000000006000000000000000000000000000000ff02000000000000000000000000000100000000000000000000000000000000040003"], 0xc0}}, 0x0) readv(r1, &(0x7f0000000040), 0x2000000000000213) r5 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_udp_encap(r5, 0x11, 0x64, &(0x7f0000000100)=0x2, 0x4) syz_usb_connect$rtl8150(0x4, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xbda, 0x8150, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) bind$inet(r5, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) syz_emit_ethernet(0x2e, &(0x7f0000000140)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x4e21, 0x4e20, 0xc, 0x0, @gue={{0x1, 0x0, 0x0, 0xb, 0x100, @void}}}}}}}, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) 6.407550528s ago: executing program 4 (id=2933): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_CLOCK(r1, 0x4188aec6, &(0x7f0000000040)) r2 = syz_open_dev$video4linux(&(0x7f0000000000), 0x7, 0x841) ioctl$VIDIOC_SUBDEV_ENUM_MBUS_CODE(r2, 0xc0305602, &(0x7f00000003c0)={0x0, 0x6, 0x3004}) r3 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) write$uinput_user_dev(r3, &(0x7f0000000a80)={'syz1\x00', {}, 0x2000, [0x0, 0x0, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0xfffffffc, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0xffffffff, 0x8, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x4, 0x0, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x960, 0x0, 0x0, 0xfffffffa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff, 0x800000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x2, 0x0, 0x4, 0x0, 0xfffffffe, 0x0, 0x4, 0x0, 0x0, 0x800, 0x0, 0x0, 0x0, 0x4], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x9, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x5, 0x3, 0x3, 0x1010001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400, 0x0, 0x8, 0x0, 0x0, 0x0, 0x3, 0x0, 0x1, 0x0, 0x0, 0x0, 0x400000, 0x3, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9388, 0xffffffff], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x9, 0x2, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000]}, 0x45c) syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000140)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a0000080480", @ANYRES64], 0x0) r4 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) pipe2$watch_queue(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r6 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x88000) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r6, 0xc0505350, &(0x7f0000000040)={{}, {0x20, 0xfc}, 0x0, 0x4}) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x1c, r8, 0x1, 0x70bd2b, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4000}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x4080) ioctl$IOC_WATCH_QUEUE_SET_FILTER(r5, 0x5761, &(0x7f00000001c0)=ANY=[]) keyctl$KEYCTL_WATCH_KEY(0x20, 0x0, r5, 0x0) keyctl$chown(0x4, 0x0, 0x0, 0x0) write$char_usb(r4, 0x0, 0xfffffe71) ioctl$UI_DEV_CREATE(r3, 0x5501) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x4) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={0x0, 0x38}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) r10 = socket$nl_xfrm(0x10, 0x3, 0x6) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x1d, &(0x7f00000007c0)={0x1, &(0x7f0000000000)=[{0x6, 0x4, 0x40, 0x7fff0000}]}) prlimit64(0x0, 0x7, 0x0, 0x0) sendmsg$nl_xfrm(r10, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@allocspi={0xf4, 0x16, 0x1, 0x0, 0x0, {{{@in=@dev={0xac, 0x14, 0x14, 0x2d}, @in6=@local, 0x0, 0x0, 0xfffd, 0x0, 0xa, 0x80, 0xa0}, {@in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x0, 0x33}, @in6=@dev={0xfe, 0x80, '\x00', 0xe}, {0x0, 0x101, 0x0, 0x0, 0x1, 0xffffffffffffffec, 0x3}, {0x0, 0x0, 0x2, 0xfffbfffffffffffe}, {0x0, 0x0, 0x796}, 0x0, 0x0, 0x0, 0x0, 0x2, 0xe55286f1921f74ae}, 0x0, 0xffffffff}}, 0xf4}, 0x1, 0x0, 0x0, 0x4c844}, 0x0) ioctl$VIDIOC_DBG_G_REGISTER(r2, 0xc0385650, &(0x7f0000000040)={{0x0, @name="64f03a5523147ffd794d01d2b9766e11c3ba0b7f7e471b6fdf26c9c27a1c6206"}, 0x8, 0x401, 0x200}) r11 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r11, 0xffffffffffffffff, 0x0) 6.058587516s ago: executing program 2 (id=2936): r0 = socket(0xa, 0x3, 0x3a) r1 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000900), 0x2, 0x0) write(r1, &(0x7f00000000c0)='transport=fc,traddr=nn-33333333333333:pn-0x4444444444444444,host_traddr=nn-0x1111111111111111:pn-0x2232222222222222,nqn=n', 0x79) setsockopt$MRT6_INIT(r0, 0x29, 0xc8, &(0x7f0000000000), 0x4) setsockopt$MRT6_DONE(r0, 0x29, 0xc9, 0x0, 0x0) r2 = syz_usb_connect(0x5, 0x58, &(0x7f0000000000)={{0x12, 0x1, 0x310, 0x8e, 0x3a, 0xc6, 0x20, 0x694, 0x1, 0x7813, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x46, 0x2, 0xe, 0x6, 0x10, 0x3, "", [{{0x9, 0x4, 0x39, 0xd8, 0x1, 0x1a, 0xda, 0xa8, 0x8, [], [{{0x9, 0x5, 0x8, 0x10, 0x20, 0x7, 0x9, 0x80}}]}}, {{0x9, 0x4, 0xe4, 0x5, 0x3, 0xb9, 0x56, 0xda, 0x2, [], [{{0x9, 0x5, 0x8, 0x0, 0x400, 0x1, 0x12, 0xfc}}, {{0x9, 0x5, 0xb, 0x0, 0x20, 0x7, 0x3, 0x9a, [@generic={0x7, 0x5, "d15b89f26d"}]}}, {{0x9, 0x5, 0x9, 0x3, 0x40, 0x7a, 0xa, 0x84}}]}}]}}]}}, &(0x7f0000000a40)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r2, &(0x7f0000000bc0)={0x14, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0003040000000403"], 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r2, &(0x7f00000011c0)={0x24, 0x0, &(0x7f0000001040)={0x0, 0x3, 0x2, @string={0x2}}, 0x0, 0x0}, 0x0) r3 = syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0) ioctl$VIDIOC_S_AUDIO(r3, 0x40345622, &(0x7f0000000000)={0x0, "000000000018a32300007600007fdb3eca1c0400b85da53c0d8a00", 0x0, 0x1}) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x1, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="1800000000000000000000000000000061189a000000000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_usb_control_io$hid(r2, &(0x7f0000001600)={0x24, 0x0, &(0x7f0000001540)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x44a}}, 0x0, 0x0}, 0x0) r4 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000000), 0x103902, 0x0) preadv(r4, &(0x7f00000000c0)=[{&(0x7f0000000200)=""/133, 0x85}, {&(0x7f00000002c0)=""/72, 0x48}, {&(0x7f0000000040)=""/51, 0x33}, {&(0x7f0000000340)=""/233, 0xe9}], 0x4, 0x0, 0x96) syz_usb_control_io$hid(r2, 0x0, &(0x7f0000000500)={0x18, &(0x7f0000000300)=ANY=[@ANYBLOB='@\b\b'], 0x0, 0x0, 0x0, 0x0}) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000880)=@newsa={0x15c, 0x10, 0x1, 0x0, 0x0, {{@in=@dev={0xac, 0x14, 0x14, 0x44}, @in=@dev={0xac, 0x14, 0x14, 0x1b}, 0x0, 0xecdf, 0x0, 0x0, 0xa, 0x0, 0x20}, {@in=@broadcast, 0x4d4, 0x32}, @in6=@private1, {0x0, 0x0, 0x0, 0x4, 0x0, 0xfffffffffffffffc}, {0x3bc7, 0x7, 0x80000007}, {0x2, 0x0, 0xffffffff}, 0x70bd2a, 0x800000, 0x2, 0x5, 0x0, 0xe5}, [@replay_esn_val={0x1c, 0x17, {0x0, 0x70bd2a}}, @sa_dir={0x5, 0x21, 0x2}, @algo_auth_trunc={0x4c, 0x14, {{'sha3-256-ce\x00'}}}]}, 0x15c}}, 0x4004004) r6 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r6, &(0x7f0000000100)={0xa, 0x0, 0x0, @mcast2, 0x7}, 0x1c) sendmmsg$inet6(r6, &(0x7f0000002b80)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f00000001c0)="82", 0x1}, {&(0x7f0000000140)="11", 0x1}], 0x2}}, {{0x0, 0x0, &(0x7f00000014c0)=[{&(0x7f0000000280)='i', 0x1}], 0x20}}], 0x2, 0x4404c880) 5.198810083s ago: executing program 3 (id=2941): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="540000001800010400000000000000000a000000fe0300010000000008000400010000000600150007000000280016800800010002000000140005"], 0x54}}, 0x0) r0 = socket(0x10, 0x3, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0xfc) (fail_nth: 9) 5.197432711s ago: executing program 1 (id=2942): r0 = socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(0x0, 0xffffffffffffffff) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040), 0xffffffffffffffff) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x2000, 0x0) ioctl$TIOCSPTLCK(r2, 0x40045431, &(0x7f0000000000)) r3 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x0, 0x10000, 0x0, 0x40055}, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r4, r5, r6, &(0x7f00000001c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x2011}}) io_uring_enter(r3, 0x1000001, 0xfffffffd, 0x4b, 0x0, 0x0) ioctl$TIOCPKT(r2, 0x5420, &(0x7f0000000200)=0x18) r7 = ioctl$TIOCGPTPEER(r2, 0x5441, 0xb3d) ioctl$TCFLSH(r7, 0x540b, 0x2) sendmsg$TIPC_CMD_SET_LINK_WINDOW(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f00000005c0)={0x30, r1, 0x1, 0x70bd27, 0x25dfdbfd, {{}, {}, {0x14, 0x18, {0xfffffffc, @bearer=@udp='udp:syz2\x00'}}}}, 0x30}, 0x1, 0x0, 0x0, 0x4}, 0x6880) 5.023179574s ago: executing program 3 (id=2944): r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1b6) pwrite64(r0, &(0x7f0000000100)="0000010042", 0x5, 0x1be) pwrite64(r0, &(0x7f0000000100)='PRIVHEAD', 0x8, 0xc00) pwrite64(r0, &(0x7f00000005c0)="069c3d157a437dcb3f0dfc4d3180c029301700945ab4281eef000000", 0xffffffffffffffd9, 0x2af2) r1 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x2) ioctl$LOOP_SET_FD(r1, 0x4c00, r0) ioctl$LOOP_SET_STATUS64(r1, 0x4c04, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', '\x00', '\x00', [0x0, 0x3]}) 4.898139122s ago: executing program 1 (id=2945): r0 = syz_usb_connect$uac1(0x5, 0xba, &(0x7f0000000440)={{0x12, 0x1, 0x250, 0x0, 0x0, 0x0, 0x40, 0x763, 0x2003, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xa8, 0x3, 0x1, 0x4, 0xa0, 0xd9, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x4, 0x3b}, [@input_terminal={0xc, 0x24, 0x2, 0x6, 0x202, 0x2, 0x8, 0x100, 0x5, 0x3}, @selector_unit={0x9, 0x24, 0x5, 0x6, 0x4, "747876a0"}, @processing_unit={0xa, 0x24, 0x7, 0x5, 0x3, 0x2, "f3b501"}, @mixer_unit={0xa, 0x24, 0x4, 0x2, 0x5, "723aafdcdf"}, @selector_unit={0x8, 0x24, 0x5, 0x6, 0x8, "9b94a8"}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0x5, 0x7, 0x40, 0xfa}]}, {{0x9, 0x5, 0x1, 0x9, 0x400, 0xe, 0x0, 0x1, {0x7, 0x25, 0x1, 0x8, 0xe, 0xb400}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_continuous={0xd, 0x24, 0x2, 0x1, 0x1, 0x2, 0x4, 0x1, "3bcba8", "f625"}]}, {{0x9, 0x5, 0x82, 0x9, 0x3ff, 0x3, 0x2, 0xff, {0x7, 0x25, 0x1, 0x4c95f9ed15d7e0c5, 0x10, 0x8}}}}}}}}]}}, &(0x7f0000001b80)={0xa, &(0x7f00000005c0)={0x8bf3c07b29715591, 0x6, 0x250, 0x81, 0x1, 0x18, 0x20, 0x8}, 0x19, &(0x7f0000000600)={0x5, 0xf, 0x19, 0x3, [@ss_cap={0xa, 0x10, 0x3, 0x0, 0x0, 0x5, 0x6, 0xfff8}, @ext_cap={0x7, 0x10, 0x2, 0x3, 0x5, 0x0, 0x7}, @ptm_cap={0x3}]}, 0x3}) syz_usb_control_io$uac1(r0, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000002c40)={0x10, 0x17, &(0x7f0000000140)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf09000000000000550901000074f6967d0000000000000018"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmmsg$inet6(0xffffffffffffffff, &(0x7f00000014c0)=[{{0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000200)="71ea44891b54b4710ec5a4ba4192acbec207b96131ec64cc8318f552333c5c47ff9b27f2d40f14de3692ac5ede75ba5ecbb4925cc1e81c2215294381e4510f85e83666ec9fa260c267ce12f274790a49224e75e6944e7bf8e3e44444760832aeb233f061a64f57b99759d600874aa9baf4c85547406c0f44dce24cd9f069146468dbd8ebe0be548822112d1c9972b85ee0e8bdbab7f3741d0f110c97287202ff91240eb59e1b90ab8fe2144610538a21df8c3a7dfbdeb0f7eaabc1bd8ae8fbad2518fa62454efabd08daed4e4ed371bba20a99864a2bc17dac0366def60218083dcd89fb95f6aa1cf211385dbb431310659ddc96644935a45163efbd8d", 0xfd}], 0x1}}], 0x1, 0x80) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a3200"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r2 = syz_open_dev$tty20(0xc, 0x4, 0x0) writev(r2, &(0x7f000000cac0)=[{&(0x7f0000000040)="419591c78b30640ee91c8fc7c6079c0213a13dce386a64f8a51e9b3432", 0xfe8e}], 0x1) r3 = socket$inet(0x2, 0x3, 0x2) ioctl$BTRFS_IOC_ENCODED_WRITE(r2, 0x40789440, &(0x7f0000000540)={&(0x7f0000000500)=[{&(0x7f0000000300)="b1f4f663118168ff7e6b657853470b5241df33838fbdef4013d72fb9f6ffd532081d4845987ebfc94b9245e2e2f303cb5abe291c1bda5ef84ef1b8ffe22d4801ae1e108bfea7ac25d1831cbeddab70e9db64a71d9d84fedadb6a04e5e041e65e004facf75a052c1bfa4581f5d78d21ea372f872c66a1b2c85a33ccf4f70d496c0bc31d7df6e6607edcb2a43e567ae551e68b6906becf7f89b8bac0361aba84508f8cc0da1d58fdf80861ab67cddc1d0212a4c03c752509a6bc89214f379814b19fc34884a47802ec3df68af0ca2865a98d1d2189be8fcbe93a1a22db3247752abe28dcd11976", 0xe6}, {&(0x7f0000000400)="0030c051e8327c", 0x7}], 0x2, 0x8, 0x0, 0x8, 0x5, 0xf3, 0x1, 0x5}) setsockopt$inet_mreqsrc(r3, 0x0, 0x27, &(0x7f0000000040)={@multicast2, @local, @loopback}, 0xc) r4 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000900), 0x2, 0x0) write(r4, &(0x7f0000000a00)='transport=fc,traddr=nn-0x3333333333333333:pn-0x4444444444444444,host_traddr=nn-0x1111111111111111:pn-0x2222222222222222,nqn=nqn.2014-08.org.nvmexpress.discovery,reconnect_delay=', 0xb1) setsockopt$inet_msfilter(r3, 0x0, 0x29, &(0x7f0000000180)=ANY=[@ANYBLOB="e0000002ac1414aa0100000002"], 0x18) r5 = socket$unix(0x1, 0x2, 0x0) bind$unix(r5, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) ioctl$BTRFS_IOC_START_SYNC(r1, 0x80089418, &(0x7f0000000000)) setsockopt$sock_int(r5, 0x1, 0x10, &(0x7f0000000040)=0x80000000, 0x4) sendto$unix(r5, 0x0, 0x0, 0x4000000, &(0x7f0000000240)=@file={0x1, './file0\x00'}, 0x6e) syz_emit_ethernet(0x36, &(0x7f0000001800)=ANY=[@ANYBLOB="0180c2000000aaaaaaaaaa32080045000028006400000402907800000000e000000211009078e0000022000100010000000000000000"], 0x0) 4.334768315s ago: executing program 3 (id=2946): ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'wg0\x00'}) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x400, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$XFS_IOC_INUMBERS(0xffffffffffffffff, 0x80405880, &(0x7f0000000280)={{0x10, 0x3, 0x9, 0x1, 0xf}}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000200)={0x0, 0x1, 0xf000, 0x2000, &(0x7f0000f9a000/0x2000)=nil}) r3 = dup(r2) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f0000000040)=@x86={0x0, 0x9, 0xc, 0x0, 0x6, 0x1, 0x86, 0x2, 0xe7, 0x0, 0x2, 0x4, 0x0, 0x7, 0x4, 0x7, 0x5, 0xff, 0x3b, '\x00', 0x8, 0x7ffffffffffffffe}) ioctl$KVM_SET_VAPIC_ADDR(r3, 0x4008ae93, &(0x7f00000000c0)=0xffff) ioctl$KVM_RUN(r3, 0xae80, 0x0) (fail_nth: 5) 4.017756317s ago: executing program 3 (id=2947): r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000200)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000500)=@newqdisc={0x2c, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0x8001}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000600)=@newtclass={0x38, 0x28, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x1, 0x8001}, {0x0, 0x8001}}, [@tclass_kind_options=@c_drr={{0x8}, {0xc, 0x2, @TCA_DRR_QUANTUM={0x8, 0x1, 0x3e8}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000700)=@newtfilter={0x40, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0x8001}, {0x3, 0x300}}, [@filter_kind_options=@f_matchall={{0xd}, {0xc, 0x2, [@TCA_MATCHALL_CLASSID={0x8, 0x1, {0x1, 0x8001}}]}}]}, 0x40}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)=@delchain={0x2c, 0x65, 0x800, 0x70bd2c, 0x25dfdbfb, {0x0, 0x0, 0x0, r3, {0x0, 0xe}, {0x6}, {0xffff, 0xffff}}, [@TCA_RATE={0x6, 0x5, {0x2f, 0x7}}]}, 0x2c}, 0x1, 0x0, 0x0, 0x50}, 0x40) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r5, 0x29, 0x1a, &(0x7f0000000000)=0x6, 0x4) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)=ANY=[@ANYBLOB="38000020800200"/20, @ANYRES32=0x0, @ANYBLOB="80200100420000001800128008000100677470000c00028008000100", @ANYRES32=r5, @ANYBLOB], 0x38}, 0x1, 0xba01, 0x0, 0x4040000}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000080)={'bridge0\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000140)={'ip6tnl0\x00', &(0x7f00000000c0)={'syztnl2\x00', r7, 0x0, 0x4, 0x13, 0x80000001, 0x2e, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x1, 0x0}}, @mcast1, 0x20, 0x40, 0xfffffe01, 0x1}}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000300)={'syztnl2\x00', &(0x7f0000000040)={'syztnl2\x00', r8, 0x29, 0x84, 0x4, 0x4038a0b, 0x11, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @mcast2={0xff, 0x5}, 0x20, 0x0, 0x0, 0x4}}) sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=ANY=[@ANYRESOCT=r0], 0x14}}, 0x8090) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x2400, 0x0) ioctl$KVM_SET_TSC_KHZ_vm(0xffffffffffffffff, 0xaea2, 0x80009) r9 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) ioctl$KVM_RUN(r9, 0xae80, 0x0) r10 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r10, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) r12 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/mdstat\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r12, 0x84, 0x9, &(0x7f0000000340)={r11, @in6={{0xa, 0x4e23, 0x4, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x100}}, 0xfff, 0x7, 0x6, 0x6, 0x64, 0x800, 0x2}, &(0x7f0000000440)=0x9c) read$FUSE(r12, &(0x7f0000003340)={0x2020}, 0x2020) 3.909348754s ago: executing program 2 (id=2948): r0 = syz_io_uring_setup(0x7463, &(0x7f0000000540)={0x0, 0xd127, 0x8, 0x1, 0x2083, 0x0, 0x0}, &(0x7f0000000180)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000100)=0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000340)=@RTM_NEWNSID={0x4c, 0x58, 0x100, 0x70bd25, 0x25dfdbfd, {}, [@NETNSA_NSID={0x8, 0x1, 0x3}, @NETNSA_PID={0x8}, @NETNSA_PID={0x8}, @NETNSA_NSID={0x8}, @NETNSA_PID={0x8}, @NETNSA_FD={0x8}, @NETNSA_NSID={0x8, 0x1, 0x3}]}, 0x4c}}, 0x4000000) io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000200)=[{&(0x7f00000009c0)=""/89, 0x59}], 0x1) ioctl$FE_GET_PROPERTY(0xffffffffffffffff, 0x80106f53, &(0x7f00000002c0)={0x38, &(0x7f0000000040)=[{0x3d, '\x00', @data, 0x4db6}]}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) syz_io_uring_submit(r1, r2, r3, &(0x7f0000000040)=@IORING_OP_SETXATTR={0x2a, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, {0x0, 0x0, 0x0, 0x0}}) io_uring_enter(r0, 0x1, 0x1, 0x1, 0x0, 0x0) unshare(0x20400) r5 = socket$inet6(0xa, 0x3, 0x7) recvmmsg(r5, &(0x7f0000009400)=[{{0x0, 0x0, 0x0}, 0x7fff}], 0x1, 0x0, 0x0) socket$inet6(0xa, 0x3, 0x3c) socket$packet(0x11, 0x2, 0x300) r6 = socket$nl_generic(0x10, 0x3, 0x10) syz_usb_connect$hid(0x2, 0x36, 0x0, 0x0) r7 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCGIFPFLAGS(r7, 0x8935, &(0x7f0000000640)={'wlan0\x00'}) syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) syz_open_dev$midi(&(0x7f00000001c0), 0x2, 0x40c01) r8 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r8, 0x541b, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="3000000010000100"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=0x0, @ANYBLOB="08001b"], 0x30}}, 0x0) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r10, 0x8933, &(0x7f0000000000)={'team0\x00', 0x0}) fsopen(&(0x7f0000000100)='qnx4\x00', 0x0) sendmsg$nl_route(r10, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=@newlink={0x3c, 0x10, 0x7, 0x0, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0x11184, 0xa01}, [@IFLA_IFNAME={0x14, 0x3, 'xfrm0\x00'}, @IFLA_MASTER={0x8, 0xa, r11}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4040015}, 0x0) syz_genetlink_get_family_id$tipc(0x0, r8) sendmsg$TIPC_CMD_ENABLE_BEARER(r6, 0x0, 0x20042000) sendto$inet6(r5, &(0x7f0000000080)="80ef09e92208a1ce", 0xfdef, 0x0, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast1, 0x9}, 0x18) 3.783581585s ago: executing program 3 (id=2949): r0 = syz_open_dev$loop(&(0x7f0000000140), 0x5, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='blkio.bfq.io_service_time_recursive\x00', 0x275a, 0x0) write$binfmt_misc(r1, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000024c0)={r1, 0x20000, {0x2a00, 0x80010000, 0x0, 0x2, 0x800000000000208, 0x0, 0x3, 0x2, 0x10, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100000000020000ffffffffff00", "2809e8dbe108598948224ad54afac11d875397bd3c5240f45f819e01177d2d458dd4992861ac00", "90be8b1c5500000000004000f0f9ffff0000000000ffff00", [0x80000000009, 0x6]}}) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = syz_open_dev$dvb_demux(&(0x7f0000000440), 0x0, 0x40) ioctl$DVB_DEMUX_DMX_SET_FILTER(r2, 0x403c6f2b, &(0x7f0000000480)={0xcfe5, {"4a21cbfdc27bb22779aef2a885da3dc7", "4a4dc099f22614fee775210e6170bf8b", "dd32be9ce93516763ba2d35a3edb8294"}, 0x8, 0x2}) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000440)={'ip6_vti0\x00', 0x0}) r3 = socket$kcm(0x29, 0x0, 0x0) listen(r3, 0x8) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1, 0x4, &(0x7f0000000580)=@framed={{0x18, 0x5, 0x0, 0x0, 0x40000}, [@call={0x85, 0x0, 0x0, 0x6a}]}, &(0x7f0000000000)='syzkaller\x00', 0x5, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = syz_io_uring_setup(0x42, &(0x7f00000001c0)={0x0, 0x5961, 0x1000, 0x1, 0x4e}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r5, r6, r7, &(0x7f0000000280)=@IORING_OP_SETXATTR={0x2a, 0x40, 0x0, 0x0, 0x0, &(0x7f000000c640)='./file0\x00', 0xff86, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0}}) io_uring_enter(r4, 0x2000, 0xfffffffa, 0x9, 0x0, 0x0) read$FUSE(r1, &(0x7f0000002600)={0x2020, 0x0, 0x0}, 0x2020) r9 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000002100)='numa_maps\x00') write$FUSE_INIT(r9, &(0x7f0000000040)={0x50, 0x0, r8, {0x7, 0x1f, 0x3, 0xffffffffd28f2452, 0x83, 0xffff, 0x0, 0xabe6, 0x0, 0x0, 0x80, 0x208001}}, 0x50) syz_usb_connect$uac2(0x2, 0x9a, &(0x7f0000000000)=ANY=[@ANYBLOB="12010102000000200c201810400001020301090288000301018008080b0001010c200609040000000101200009240103000428000408240a05004000020c24030207030503050303001424060305"], &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0}) r10 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000040)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1, 0x5, &(0x7f0000000580)=@framed={{0x18, 0x5, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x8}, [@map_fd={0x18, 0x4, 0x1, 0x0, r10}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x1, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$F2FS_IOC_RELEASE_VOLATILE_WRITE(r9, 0xf504, 0x0) ioctl$MEMGETREGIONCOUNT(0xffffffffffffffff, 0x80044d07, &(0x7f0000000040)) keyctl$instantiate_iov(0x14, 0x0, &(0x7f0000000300)=[{&(0x7f0000000000)="61cc23d4941575be99b80c562e9872f8", 0x10}], 0x100000000000028f, 0x0) close(0x3) r11 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r11, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000c40)={0x14, 0x3b, 0x301, 0xa70bd1d, 0x25dfdbff, {0x6}}, 0x14}, 0x1, 0x0, 0x0, 0x8010}, 0x0) r12 = openat$random(0xffffffffffffff9c, &(0x7f0000000040), 0x80, 0x0) preadv2(r12, &(0x7f0000000740)=[{0x0}, {&(0x7f0000000280)=""/41, 0x29}], 0x2, 0x3c, 0x163c, 0x7) 3.251040487s ago: executing program 4 (id=2951): openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000180), 0x1, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, 0x0, &(0x7f00000002c0)) r0 = socket(0x2, 0x80805, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)) r1 = socket$inet(0x2, 0x80001, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f0000000240)={0x81, 0xb, 0x4, 0x7, 0x4, 0x7, 0x8, 0x4, r2}, 0x20) 3.162082933s ago: executing program 4 (id=2952): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x2000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYRES16=r0, @ANYRES8=r1, @ANYRES16=r1, @ANYRESHEX=r1], 0x7) r2 = socket$inet6_udp(0xa, 0x2, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r3 = socket$rxrpc(0x21, 0x2, 0xa) bind$rxrpc(r3, &(0x7f0000000140)=@in4={0x21, 0x4, 0x2, 0x10, {0x2, 0x4e23, @rand_addr=0x64010100}}, 0x24) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r5) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000440)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r7, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x48, 0x2, {{0x3, 0xae0, 0x6361, 0x5, 0xffffffff, 0x3}, [@TCA_NETEM_SLOT={0x2c, 0xc, {0x4, 0x7fffffffffffffff, 0x0, 0x1000, 0xc, 0x215}}]}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$tipc(&(0x7f0000000380), r8) sendmsg$TIPC_CMD_ENABLE_BEARER(r8, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x0) close(0xffffffffffffffff) r10 = socket$unix(0x1, 0x5, 0x0) r11 = socket$nl_route(0x10, 0x3, 0x0) r12 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r12, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000006c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r13, {0xf, 0xd}, {0xffff, 0xb}, {0x4, 0xffe0}}, [@qdisc_kind_options=@q_pfifo={{0xa}, {0x8, 0x2, 0x3}}]}, 0x38}}, 0x4890) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r11, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000180)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0x0, {0x0, 0x0, 0x0, r14, {0x0, 0xb}, {0xffff, 0xffff}, {0xffff, 0xfffc}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x48, 0x2, {{0x3, 0x7, 0x8005, 0x5, 0xfffffdff, 0x4006}, [@TCA_NETEM_SLOT={0x2c, 0xc, {0x9, 0x9, 0x5, 0x96, 0xfff, 0xc}}]}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x240080c1}, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) setsockopt$inet6_udp_encap(r2, 0x11, 0x64, &(0x7f0000000040)=0x2, 0x4) socket$kcm(0x10, 0x2, 0x0) 2.8857422s ago: executing program 4 (id=2954): r0 = socket$nl_route(0x10, 0x3, 0x0) seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0) sendmsg$nl_route(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000001200)={&(0x7f0000000c00)=@newlink={0x50, 0x10, 0x40d, 0x70bd2a, 0x0, {0x0, 0x0, 0x0, 0x0, 0x909, 0x40}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0xc, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_BC_QUEUE_LEN={0x8, 0x9, 0x1}]}}}, @IFLA_ALT_IFNAME={0x14, 0x35, 'macvlan0\x00'}]}, 0x50}}, 0x8000) syz_emit_ethernet(0x1de, &(0x7f0000000500)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaa4186dd60bf000001a8000000000000000000000000fffffffffffffe8800000000000000000000000000012234c2d5"], 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="4400000013000500010000000000000007000000", @ANYRES32=r2, @ANYBLOB="000000000000000024001a80200004801c000180080001000100000008000200", @ANYRES32=r2, @ANYBLOB="080003"], 0x44}}, 0x0) syz_emit_ethernet(0x76, &(0x7f0000000000)={@local, @link_local, @void, {@ipv6={0x86dd, @generic={0x0, 0x6, "b81923", 0x40, 0x0, 0x0, @local, @local, {[@dstopts={0x89, 0x7, '\x00', [@generic={0x31, 0x36, "b04faa6f243a113a3fbf8e044fb9f8335c53a9f67412bf5970cb6ec8ce2900ffba087c7de1a271084cad038ef0720635b93832241def"}]}]}}}}}, 0x0) 2.829419602s ago: executing program 1 (id=2956): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000380)={'veth0_to_team\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, r1, {0x0, 0xb}, {0xffff, 0xffff}, {0x5, 0xfff2}}, [@TCA_STAB={0x24, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x5, 0xd, 0x9, 0x3, 0x0, 0x3, 0x7}}, {0x4}}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x20000801}, 0x0) (fail_nth: 4) 2.762498864s ago: executing program 1 (id=2957): r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1b6) pwrite64(r0, &(0x7f0000000100)="55aa", 0x2, 0x1fe) pwrite64(r0, &(0x7f0000000100)='PRIVHEAD', 0x8, 0xc00) pwrite64(r0, &(0x7f00000005c0)="069c3d157a437dcb3f0dfc4d3180c029301700945ab4281eef000000", 0xffffffffffffffd9, 0x2af2) r1 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x2) ioctl$LOOP_SET_FD(r1, 0x4c00, r0) ioctl$LOOP_SET_STATUS64(r1, 0x4c04, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', '\x00', '\x00', [0x0, 0x3]}) 2.456962782s ago: executing program 3 (id=2958): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)={0x30, 0x1, 0x1, 0x101, 0x0, 0x0, {0x2}, [@CTA_FILTER={0xc, 0x19, 0x0, 0x1, [@CTA_FILTER_ORIG_FLAGS={0x6, 0x1, 0x8}]}, @CTA_TUPLE_ORIG={0x10, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x6}}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x2c004805}, 0x44c0) syz_usb_connect(0x5, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000b9a48f10b1134200c9070102030109022400010100100009041302028367160009050402000200fa00090581f340"], 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000cc0)=ANY=[@ANYBLOB="b700000012edfffebfa30000000000000703000028feffff620af0fff8ffffff61a4f0ff000000001d04000000000000bf000000000000005504000001ed0a002500000017ff2000dd40000000000000730a00fe000000007704000000000000e5000000000000009500000000000000023bc065b7a379d17cf9333379fc9e84af69912435f1b6a693002e7f3be361917adef6ee1c8a2b4f8ef1e50b91f32050e436fe275daf51efd601b6482a0800000098efefb202ee010400006e7a1de4a21f379dbf01de00b1b564fef3bef70548aed0d600c095199fe3ff3128e599b0eaebbdbd7359a48f5b0afc646cb7798b3e6440c2fbdb00a3e35208b0bbf12cd8dff0c710e4000000000000009fbe4b61a615c6c57a2b649dc74a1a610643b08d9ec21ead2ed51b104d4d91af25b8123deda8a3658d42ecbf1dbf6d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31a76e42f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0800d9b3a69b37caa964e4b7000000000000d5f728d236619074d6ebdf098bc908f50ae728a40f9411fe7226a4040bef29b66e3858d051c096e37c4f46010400000000c3da29faf75ddd1aa96960bca97af13382cb881cc1f62c0f8f8f0e8d76b86f9c45636614786f5a2cb77230a874640dcbe0b20bb77c022d4cab080078fce8c5c81b7037181fc2f18f781aaa6e2957d7e39cc1baddcb7ec6667e699f24e41697ee7ea23e4b29a8b6cc9a1f5a7b3caae05f13792292cb949b3aab06b1e042ff2164d80c605532b18ab1c156b97e5889685a96949e4cb40df77b8bb84b0e733a63784ccc214d930cbb7e090df9a2867b3acec439c163fcd7071b53ac29df826f8ae6d6e18c1eacf5bf870768d5217e9bb5a05d9e22ce67f1231bd236486727d970acc546087acbf30f2f8165b47ba56dfadd14b306e98931485747292c6fe6e188750cf4f87cce2aa7d67c7133a9f05954cde298a35ea6d715ba80aee63300000000000000000000000000000000000040000000000000000386000000b854adb4f8080064e8407c6bdb37114c80fbaa4a0ec5aaf4b0ac6f2128668279eb6fc144344e2d461c9a1be8fa0061ea9d55ee4716bea8e1cebf9ed39325a904514d8e90131bfc00000000000000d7c5af73c683625aaad5eda5004a76c9f8975ed4c5e4eb3e77e9885769754932609f19e2f615a01cb6d17fbf5cb539403cb0572534f054d5514ad8269b2bdf2ca4958a62a6e744f9a4c1e646e1dd2ca19583f0f8b0dc53debd7d44f334e6ed7445a9580f970e483b307c4b3c018bc194b23d37e6a2e52d8288e5aab6fec586d52386e8c07a88c88e8faec5f1b16b2014f6952ce7d6be12c6bdb9651ca6fc907061be311d1354e6295698594a73136237bee068d3819400e43544830a3f74b7942f22336953978a5b2032da4238cc61162c04c1297395b73e18c9387615a2bc87d9e2445f3d323d3fac347932a4bac694c55fe9d145906d410f58f1951405d10504efe402cae085afef5dbd617e87ddbd23834a50d7eb8e327fb5db12cbd6a9efe8e671c4f251fe3bf440cabdfe3400a670d14b9b3cd8d86e492997a0168c022ef3536bd1dc731f4f9f8cb6c3857fb8aaaa95024f8da775f72950212b84fc6133ae14d1429cd4905dabb52e43af7e65acf97b4951fa1e967d16a5ed642efc855a4a46b85cd079934ad3188276efae9387eaa2c910fb8de24b5d4fded86c3811ccd00520150b16000080122965558074956da5e4c3bbefcb64aa8be4456ed2caf0f49e4dcc1b7af0b51b9cafeda067b6bbf3aa4371f5e76ab3f60afea80bb066aafb7517f787b090f419a20278a3c779e03afd9a6af6fd518e5dce030f88ec5a5cb7601a161da0f8089322d84ac523040d13e1f1300c2c6555bce60d95dd3288e53435713f03add23f14c8db5555c62de4f626483632a2ab547f88dd6efec73a0271a19ca3aa860aa4dcaeeb9bd91a0cb429efae2a5fcc08b3a572969bbe91c921ac1476027772c87d1767e38ba49e3e57fafea83e495a6a1d1a4ebf83434986091dd66ffe3ffed0c39552a312e2db596d9c828c02f6fc13c8ddbb50bfd7dd8aa2f35f259fc83e007f00a292dd3b856faa4b7e66e1b64505f65900839df71a97d4d05d37f7ecf8ed9a22da26ae674bba16c204f6b2f8f74fc56b7126d7c11ece6e88ec41192aaee75415c58d264a2b6adae02c821b62428902aad499825ab85a348638384cd12e61dbde5c47056f0a20b4e2a2328d5db5cfe56557a129e6be231acf5f57995c60d9fca5f63a0dfd18054717120bda466d04774b530500d8b022719ca77a4e0a66b4708f791d849a5e2aaa0074a9560ede2600df5a5c41392fe9460080fcb1e65233fb8dbeec4c86dbcf6a0673e38d2d3615e5bfbde44afe0fa7564231fff7e7f1f3ad68492dd2ccb1decb15b5d7d3e37e8b7d28921c4b9280979521173f322df408d9818b6cc400098abb860600911480a876fbba698801937e8b4264eb6f5137bd9b075f1488d22230592a79000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002f316aa0886c174b73decb46c1c85edf50d8fcbac5ff76b365611666da86a8e65b30e55ac1275e938706bd7c000000000000003f7cd4d5cb9076b81b7741ec03877afb5237ea1694addebc14c3ae49f88c462aa2050acf2d9a97d3be29a5614d1eba2c98cf0236401e02d7c445e50f76419ab4f78f67a09e63dd4faa2e7b59399f055f2fa278783fefb0a5ef0b41e14a6fe6ba306206670b84894e901a523fcbadfeff0492df6b53002514bc834e876810d9a6a78e70a9e22860c36a724770b4185de44db6bf21fef32a8d5b36d9014f38fee012365f963b2a85e7d8075c333475b9f0284405e3127dde7e41285fbe0bdd37220e316f2297743dd4731614a50c16c6a41744c3d24eab511317f97b7b4a1c2ec33fedc46e9bf0fa640eebd3d58f0ebdb7cb8ccffd6d6ab7e0e843591d2618e2d2cdc7081c8fafffe9c350a5c554a387de4ee7aac6478d99de7dd82bef044a6d33c789d566c90c46ad581aa250bc93b233a2291b5b10eebc49b6882f910547a77d55e26bf19f1d4661550b177ef53933a305e69b8a95119dcf5bda599d625054776151b2cd1fcde238bdc527594a6c17aa9728af7a3830e7092b01b119ea4e7e7f0e21527d622cc29c9f0c8720195368f8a9d3374337ab4d130619d93c5ef37e7ddd0b2da147e6e513455b88753446de959a6cbfa1ffbc7ad5d8c3b48017fd31dcf72f337b639253f44cb27a12174bc4c191e21015d0c431a71906eb9c6a14c8a060459ef26787ce3d1cbfd5cc459f0048b5d06f6cbd3e9b34c89f3fb2f951ae81d7fcc8bc0000000000000000000000000000000000010000009231feef3117197c7963c2ba910969f776c8b2ea3970f358107945d9e74e9bdfa58e68b65a9201bc4b73b431df5aa29f363917f90e3fa1eaf553db1c761dd9b634a9c4d7c21d24fe6d953ed9438cad0f8dfe03e5e2f73019352f1fb682a5a6ebbf24ebc49e3d7058e696eb3f4b642f36c9006c0067e24a64aa8c53dd824a4ee271e35ed9eed636338f1835fc957729d63dc1bfc7b772cbe536c2d3aff27c22f9a2f876512616a5bdaf22a16e19d1b5f52abb40b433983d0cf50234de659c1a397ce901000000caae1bcfdce33dae6adc260321702f239c25ab181390e7dc8c1e5b1cf3b4fef1cd5c44a89b5e5d8314e02f4673ded90bce9a4025b0232eec970f7aa17f175a14e8dc8de9bac0006b98a8283eee5665f3aede28228e0468db"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x1e}, 0x48) r3 = openat$cgroup(0xffffffffffffffff, &(0x7f0000000040)='syz1\x00', 0x200002, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000200)={0x0, 0x0}, 0x6) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000300)=r4, 0x4) setsockopt(0xffffffffffffffff, 0x84, 0x81, 0x0, 0x0) r5 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r5, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) r6 = getpgid(0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r6, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r7, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r8, &(0x7f00000bd000), 0x318, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000003c0)=@newlink={0x38, 0x10, 0x437, 0x0, 0x0, {}, [@IFLA_VF_PORTS={0x4}, @IFLA_IFNAME={0x14, 0x3, 'tunl0\x00'}]}, 0x38}}, 0x1020) recvmmsg(r7, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r5, 0x6, 0x14, &(0x7f0000000540)=0x2, 0x4) syz_genetlink_get_family_id$ipvs(&(0x7f0000000240), r1) sendmmsg$inet(r5, &(0x7f0000006740)=[{{0x0, 0x0, &(0x7f0000002740)=[{0x0}, {&(0x7f0000000100)}, {0x0}, {&(0x7f0000000080)="09ebb34c6e6b9bcb890e8fc488c52697590da70578e206547182de9cd141c0012e4926791de3eea4aa103ad545198bf93c390bbdb6f1faf1c0924adb7ebc658f62f9f47ed5f8d851dea2d62af8d6aa9af055c1975558eef4", 0x58}, {&(0x7f0000001580)="5cf0b67aa16bf1dcc2f1ae5aa14e42cb6db77c270b99b1c640ab27453b4a089d9ad367f0f0dd7ab38ddbaeb047ef74d0a1f9aa080b894ea2f067824e2331f63e32eca6dd1196239a33e3ff58a8c40a9c120cca1666ab88492ec25f2ee144dc6b0d2e21651eea22bd79d45e406676df1e1ae9f937ff483c77a3c16a52c736c022b2829500081c0d6159780f114f713eb8364ba6d5b6c9f64f43326bc2219741e92de26f4342bcc6d691ff5f36c990af86750adc5b945e27ee8d6b65cd12841c9b110bad0f2c9a2d2e73410f0cb58d43c433459b820ed4314723626946aa6697e045c1edce001ffe549ae2a44b4377da7d4f3d2857e45c3f25ea44797577256b587f7420a30745a6e373c058200d42edc02b42d028e4cab8d6fe09d677ccd453784f3deb8724be00842dc857e2efe2a752a32b3dcd252d6ccb6ede45cfab2830c0b5947a4b9c9f68705d9e669d8f1e6d60a32812825252a46beadd87ecc1344c9924cffb26c2effcf25244b1f7b717b0e4b3f30b8c136b2385aeb52364d199e97c455117c390d3d3f0524bb4159b15a1803be4d289ee4524a36d70a47f56b1dcb865c40452f9851860601d929a4237c3ff9522ce238fb12761a11b0eeffa5156d5f8f8e8782dd61e291cd691dfebf673c04622ab3d0f41386eaa02f05a9d4f0b83c796ba1a3115ce0132030cd11f4cc797a20e5388ca45936c27282f7c28ae8312654c9f34b28f1c59894449dcc1c993929cff02280f7688100ac4ccba6e534cd44e6cefa6cf2c64fa66f8e3d59b0b851fbbdbbe81d57c44a5eee6a7d96ca176ad33240a703cff52de4fd70ea2d4330f4efc17c55aa688ed5daa1646e50ffc07c95059a2b3ee442f665c9838293b0400b951a1f706bf73b63d9d7a8aed42c0b54bb81be4fc698e1eb0605d656a5446698b76ef5a224cde75c457d49ad7479153d36ce1c2e32011e058866cc94d44604eefc42fdb6bfd82cf4722bf4c73df1ea2d02eb787ec0eb26ea13532a77465da7070bff12fe8c1694ec2eb87285915ab182543db23b45a1ca291e7b9133fccdc0742ce6e6b71e3286412339dc52d696136f47912519545911c246c875ff80dd734f81c41a73493da7da9c4ee125c60dd65a49d490e2fc33ca5fc511ad18148b1177f19eaeffe7a0174875dd03e8e3b32ebcae0a8aabea0d4d1de879332ea50471fc6eb5b7cefcc7b243c22c84d85c73f8c8fc31cbbcd9f4c6b601e02375428fdbd320c2182877da71a2d70330f05fd8e7c50f73c291bc4bff8e306f55c79cfea125876f6e9092ad5598d8fa62d119385061f1ff13bf7c2b44fd363be7229f6b4f2f6fb7f641535c47cca350e598b8290fa73bfc0559e5bfa74228bd4b7048b8f0356c43a439b5731381d575997780e4f57b5c2d6b5bfbb955aa10e9f9cc46eb62b530a156511fa7e0c001f24396af1a9946d07d3c065f7fb88c430c63807652c60cb174735e1466df3bd407a765a4a63ad2cf004bad50ab2049a7f56cdfd53d39eabc749871e70fbab4ffe42756ed05335df15d40420134902a68b69a15dda03c98ed9333174043441f807b70f5a98d35984128a902e7ee8d5ae806ca40e4f5ad2288ec645ca43275c7625eabda5a774d10c9efcc852b4e2a181255308ab1082ad382bb5bdff980865e7caadcec81b4697457d816625097cb4a9659d480145a3d40237e54be17faf12fae9a9a48226fd7e43509e325359642bd8626e37958f83494b15b6c615121238129c15c1fac440dabc71a836ac2976e1987abdc3ecbe78dacda51cf9019e3159b276a877e355c18a9835cdf98522dad7467dcbd97dca4098599ce33ebee7c742ab847d39172608fd8f829e344393b50f29f0e7efdc35bad46c1e20ed7c3f5874f021a8afe3a96cf9e186eafee13b138d92091282414ad896034d8146e849785b364450970abe11f743a12ac977062059ad7f67b01d32cdcc75c6babe2309fc929a9d92c805ecb4ff70719df50807e824ae90f66b0557bff4ebf78dfa43532869ff5164e144defc4d8ee1d6745ed369e7ed7afc981f0f3a0c82a1f97032a12eb8d672b2231040d132971ff2b2ea2eeb0f30fc21fdcd80e32f8a64d325b0fa74919c0b727335230cd340883ed28bd50af63e07f98f91e5d69851b25ab260828303713fa7ce5671c598fabee013bbb6ed04bc70e8d16d9748b885179ae22e4a9ea40d55d6565b0dc5b35719f28199b95ce9ce7f3c81c5a62a5ec1c9c63a8c74cbd26682875ffd2b8c709643d4dfa81199f9828fbe6c1e99d5c003f7ebfbf860fb238f1e427c74eadf459ed60ee73de4d13c8cfc7c58fc371fdd0e8bd70b10e4f9de9928f5c1fa81dffabc7a818fc8d50d9611f06b901bd88a5fc6b9f8bc6503b23822f105653b598c9f0abffbae0d8c56cff568f2c2bc47a88b26c2124a78921462efa4895730f369bf1f0d3227ef1b76dd394317c1726a13f9c15d65bcf6128b61351abac6a54151efcd872d25d9929cf5b7ef141e84b8d145fff6453d6a943af1c0ebd6c2aad77c1cadd21880bcdc362c690e88a914f946c8cfe00ac1936ac8e7ee66156bf76a158b09244aee3c937677067b8d6ce6de5711c80ee00893acf16e86e44037450581e6d06aff72630356644d2345741e76065a15b23cd57ed96a4b702b07a1c2df236ef5d1f0711ed23742a05bf7c047b48338e28115cdce04277cc10936937f0434ae60adbf1a9fc6f422ce8017d1f7b5554c19dc67fdce214afdb8b9a04e3987d16ce5b0b8d9f779914441357347af13f08fec8b05e4f786e88d1346fffd81cd3feb2c518c8a5199ebc2e15754a789febfde86dacb5530ebad117acc0b1cad2669836b5e536dc3df3739f22b85bf1d64353ce65b81707902fc9b471bd159fc80065f26d56aa310d47c276bbd83f5d2e5e4ffbe0e424b21eb940d9e1b3198eae52cdde8c193f4f07e7af9e40f64e2ebdb9aa0f0dc49fae9b024128379eec28ff2b2989907e16bdd9ea22f767f73d21c1c9ed2992b1c5ff5e606c7a3f5f29ce6e30e0118f5c6f88c6bdd27bc58fc74390a97a98590b31fbcbd76449777b253ce0c68da51d402ae862beef5fbfd8afb3aaa62f57826e74c8f6b985aa456e015fd8325eb8fedbc0f0e681bcd8d7626bee70e48d563d1acb03af39d206384b1e8328e588e66fb7243c8c9c2748a8f9efb34a0ab4e76035d9c6e4a7784ead7194f2868f97c580769942b3e81bf02e55c27f43885303d641ab9717618592bf790c119a9033ffce20a8ffcd0d1f1043add8da1a40b2d223920e33625366ccbf515b4e83ba5030df036316798c8cd50b5dca303fddfed3b4d7e89077be0af139ed509243dca68271d02238c85a6dc019897727b6137b18fdf444cff1790631b4c411daa9939b4a4b1abd93b2b1370d62c9e07962cacdde123b75a625553cc8dd2c4f4df4f96a1cdd07fefb232347dbf24e39831251d30e931dc965b789975d93c35d001bb90335f77984b4fe6cfe67eeacbfe8b03dd3b9eccc33ae979b38bf89417e89e0b7c3da65443cb8371353e7b5a44f99db5c73a0f7bc84147ef45847dc0231e00684f0bfb361efc62636c460501a910047db41258c00538b6763b3a79a23395afc6a46be1f53d123202bb598f9e3f40d50939f0cb01c70215e55de53703375e5be090387eaec3717d22e718c31f9d9eb2a81a2bddd846671d14aa42995cd18aca6c804b4b8eba42693eb4d2db995ef26e5a7ab1c4a98d7c268821edf7d2f193f381c15e87fa8355207c3efb209e4214038e99f7c3e7fdcdc4d038b18b08c488edc20a949f7417a7d8dd4e37dbf1b4afcf79ef867d17ca68a0d744b8f6aee7738be4beb737ca9dba34fda810f44c0f51ec9f8e295e7cd78e3256ae73db7186b1e29a04f63065c44fa6c7a16fe4f50851f336b402ce5a73ff88f9b5cdb52ead12060590180f112a4f6c36e5418207bc5dc8635ec831e383ae67fbbe119de517a6932a69440015d014a1d143c8b09f611aa4f79b083c8ea67806cf221ede408771cf2d979feb3e448fcbd859e875d6ff6cff062e073bdb4b32bcf5", 0xb35}], 0x5}}, {{0x0, 0x0, 0x0}}], 0x3fffffffffffe97, 0x2404c845) bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000000c0)={r2, r3, 0x3, 0x0, @val=@target_btf_id=r4}, 0x14) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSETELEM(r10, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001f80)=ANY=[@ANYBLOB="2c000000210a010300000000000000000a0000010900020073797a31000000000900010073797a31"], 0x2c}, 0x1, 0x0, 0x0, 0x40084}, 0x8000) close(0x3) recvmsg(r10, &(0x7f0000001ec0)={0x0, 0x0, 0x0}, 0x40000102) 2.247290012s ago: executing program 1 (id=2959): r0 = socket(0xa, 0x3, 0x3a) r1 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000900), 0x2, 0x0) write(r1, &(0x7f00000000c0)='transport=fc,traddr=nn-33333333333333:pn-0x4444444444444444,host_traddr=nn-0x1111111111111111:pn-0x2232222222222222,nqn=n', 0x79) setsockopt$MRT6_INIT(r0, 0x29, 0xc8, &(0x7f0000000000), 0x4) setsockopt$MRT6_DONE(r0, 0x29, 0xc9, 0x0, 0x0) r2 = syz_usb_connect(0x5, 0x58, &(0x7f0000000000)={{0x12, 0x1, 0x310, 0x8e, 0x3a, 0xc6, 0x20, 0x694, 0x1, 0x7813, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x46, 0x2, 0xe, 0x6, 0x10, 0x3, "", [{{0x9, 0x4, 0x39, 0xd8, 0x1, 0x1a, 0xda, 0xa8, 0x8, [], [{{0x9, 0x5, 0x8, 0x10, 0x20, 0x7, 0x9, 0x80}}]}}, {{0x9, 0x4, 0xe4, 0x5, 0x3, 0xb9, 0x56, 0xda, 0x2, [], [{{0x9, 0x5, 0x8, 0x0, 0x400, 0x1, 0x12, 0xfc}}, {{0x9, 0x5, 0xb, 0x0, 0x20, 0x7, 0x3, 0x9a, [@generic={0x7, 0x5, "d15b89f26d"}]}}, {{0x9, 0x5, 0x9, 0x3, 0x40, 0x7a, 0xa, 0x84}}]}}]}}]}}, &(0x7f0000000a40)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r2, &(0x7f0000000bc0)={0x14, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0003040000000403"], 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r2, &(0x7f00000011c0)={0x24, 0x0, &(0x7f0000001040)={0x0, 0x3, 0x2, @string={0x2}}, 0x0, 0x0}, 0x0) r3 = syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0) ioctl$VIDIOC_S_AUDIO(r3, 0x40345622, &(0x7f0000000000)={0x0, "000000000018a32300007600007fdb3eca1c0400b85da53c0d8a00", 0x0, 0x1}) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x1, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="1800000000000000000000000000000061189a000000000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_usb_control_io$hid(r2, &(0x7f0000001600)={0x24, 0x0, &(0x7f0000001540)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x44a}}, 0x0, 0x0}, 0x0) r4 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000000), 0x103902, 0x0) preadv(r4, &(0x7f00000000c0)=[{&(0x7f0000000200)=""/133, 0x85}, {&(0x7f00000002c0)=""/72, 0x48}, {&(0x7f0000000040)=""/51, 0x33}, {&(0x7f0000000340)=""/233, 0xe9}], 0x4, 0x0, 0x96) syz_usb_control_io$hid(r2, 0x0, &(0x7f0000000500)={0x18, &(0x7f0000000300)=ANY=[@ANYBLOB='@\b\b'], 0x0, 0x0, 0x0, 0x0}) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000880)=@newsa={0x15c, 0x10, 0x1, 0x0, 0x0, {{@in=@dev={0xac, 0x14, 0x14, 0x44}, @in=@dev={0xac, 0x14, 0x14, 0x1b}, 0x0, 0xecdf, 0x0, 0x0, 0xa, 0x0, 0x20}, {@in=@broadcast, 0x4d4, 0x32}, @in6=@private1, {0x0, 0x0, 0x0, 0x4, 0x0, 0xfffffffffffffffc}, {0x3bc7, 0x7, 0x80000007}, {0x2, 0x0, 0xffffffff}, 0x70bd2a, 0x800000, 0x2, 0x5, 0x0, 0xe5}, [@replay_esn_val={0x1c, 0x17, {0x0, 0x70bd2a}}, @sa_dir={0x5, 0x21, 0x2}, @algo_auth_trunc={0x4c, 0x14, {{'sha3-256-ce\x00'}}}]}, 0x15c}}, 0x4004004) r6 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r6, &(0x7f0000000100)={0xa, 0x0, 0x0, @mcast2, 0x7}, 0x1c) sendmmsg$inet6(r6, &(0x7f0000002b80)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f00000001c0)="82", 0x1}, {&(0x7f0000000140)="11", 0x1}], 0x2}}, {{0x0, 0x0, &(0x7f00000014c0)=[{&(0x7f0000000280)='i', 0x1}], 0x20}}], 0x2, 0x4404c880) 2.021791006s ago: executing program 4 (id=2961): r0 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_TTY_GET(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x10, 0x3f8, 0x8, 0x70bd26, 0x25dfdbfd, "", ["", "", "", "", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x8004}, 0x8050) ioctl$NILFS_IOCTL_GET_VINFO(0xffffffffffffffff, 0xc0186e86, &(0x7f0000000240)={&(0x7f0000000100)=[{0x2, 0x2000000000000000, 0x80000000, 0x800}, {0x6, 0x945, 0x2e, 0xc3a3}, {0x9, 0xa1e7, 0x4, 0xfffffffffffffff9}, {0x5, 0x4, 0x8, 0x2}, {0x5, 0x7, 0x9, 0xffffffff}, {0x5d17bdb0, 0x8000000000000001, 0xfff, 0x5}, {0x0, 0x40, 0x3, 0x4}, {0x3, 0x2, 0x3, 0x9}, {0xf29, 0x7, 0x0, 0x1}], 0x9, 0x20, 0xbf54, 0x3c}) r1 = syz_open_dev$radio(&(0x7f0000000280), 0x2, 0x2) ioctl$EXT4_IOC_MOVE_EXT(r1, 0xc028660f, &(0x7f00000002c0)={0x0, r1, 0x7, 0x1, 0x6, 0x2}) ioctl$XFS_IOC_PATH_TO_FSHANDLE(r1, 0xc01c5868, &(0x7f0000000400)={r0, &(0x7f0000000300)='/dev/radio#\x00', 0x101020, &(0x7f0000000340)={@align=0x1, {0x2, 0x6f7, 0x9, 0x101}}, 0x8, &(0x7f0000000380)={@_ha_fsid}, &(0x7f00000003c0)=0x60}) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000440)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x3, '\x00', 0x0, r2, 0x5, 0x3, 0x3}, 0x50) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000004c0)={[0x25, 0x0, 0x3, 0xa0b, 0x200, 0x3, 0x2, 0x8, 0x4, 0x227b, 0xffffffffffffffff, 0x5c, 0xe960, 0x6, 0xaa5, 0x5], 0xeeee8000, 0x140000}) r4 = accept4(r2, 0x0, &(0x7f0000000580), 0x800) fcntl$F_GET_RW_HINT(r2, 0x40b, &(0x7f00000005c0)) ioctl$BINDER_CTL_ADD(r2, 0xc1086201, &(0x7f0000000600)={'custom0\x00'}) r5 = syz_open_dev$cec(&(0x7f0000000740), 0x0, 0x20001) ioctl$CEC_ADAP_S_LOG_ADDRS(r5, 0xc05c6104, &(0x7f0000000780)={"6261bbe3", 0xbc, 0x5, 0x9, 0x4, 0x9, "1b179216b4e66c6665841f0900e626", "5a4a23b4", "0b9d4ba6", "0b74739f", ["52a3cf80e8163f1bf7407e1b", "916537135766ed04f70a1637", "a8d634168e360efcedf4cc62", "e4cd4fa0146be99fed965986"]}) ioctl$NILFS_IOCTL_CLEAN_SEGMENTS(r0, 0x40786e88, &(0x7f0000000ac0)={{&(0x7f0000000800)=[{0x8, 0x1fac, 0x2, {0x3, 0x7}, 0x2, 0x4, 0x9}, {0x9, 0x0, 0x74, {0x81, 0x8}, 0x7, 0x2, 0x6}, {0xf450, 0xfffffffffffffffc, 0xddd, {0x9733, 0x9}, 0xb, 0x8}, {0x8, 0x4, 0x0, {0xffa4, 0x6}, 0x0, 0x10000, 0x80000001}, {0x3ff, 0x5, 0x9, {0x4, 0x1000}, 0x3, 0x9, 0x7f8}], 0x5, 0x40, 0x8, 0xffffffffffffffff}, {&(0x7f0000000940)=[{0x6, 0x9}, {0x560, 0x8}, {0x1, 0x2}, {0x5, 0x5}, {0x7fffffffffffffff, 0x8000000000000001}, {0x729, 0x3}, {0xfffffffffffffff6, 0xad}], 0x7, 0x10, 0x9, 0x4}, {&(0x7f00000009c0)=[0x6, 0x8, 0x7, 0x7ff, 0x5, 0x7, 0x6, 0x7], 0x8, 0x8, 0x800, 0x4}, {&(0x7f0000000a00)=[{0x7, 0xea5, 0x3, 0x1, 0x8}], 0x1, 0x28, 0xe, 0x601}, {&(0x7f0000000a40)=[0xffff, 0x800, 0xfffffffffffffffb, 0x3, 0x2, 0x6, 0x3, 0x0, 0x5], 0x9, 0x8, 0x81, 0xa37}}) write$nbd(r4, &(0x7f0000000b40)={0x67446698, 0x0, 0x4, 0x4, 0x1, "55eeacc5291220f0d49c4d83acd1b2f74167e538d3b49004976792c9489f7d5682c11d644c3c12136907593ab4342371a929654d15e2a29747d1fba5ff772622dcff3641726eb945b87b6908044f8d25cc1e325c23"}, 0x65) ioctl$VIDIOC_ENUMAUDOUT(r2, 0xc0345642, &(0x7f0000000bc0)={0x0, "3e46537c75f94ef097104662580bb8d72d97e2e22d65efc594329b76d7577773", 0x1}) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$KVM_PPC_ALLOCATE_HTAB(r2, 0xc004aea7, &(0x7f0000000c00)=0x486b) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r6, 0x8933, &(0x7f0000001d80)={'batadv_slave_1\x00', 0x0}) bpf$PROG_LOAD(0x5, &(0x7f0000001f00)={0x1d, 0x20, &(0x7f0000000c40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x3}, {{0x18, 0x1, 0x1, 0x0, r2}}, {}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r2}}, @jmp={0x5, 0x1, 0xd, 0x7, 0x6, 0x100, 0xfffffffffffffffc}, @tail_call={{0x18, 0x2, 0x1, 0x0, r2}}, @jmp={0x5, 0x0, 0x7, 0xb, 0x0, 0x0, 0x1}, @map_idx={0x18, 0x5, 0x5, 0x0, 0x6}, @initr0={0x18, 0x0, 0x0, 0x0, 0x401, 0x0, 0x0, 0x0, 0x5}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x1}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000d40)='syzkaller\x00', 0x800, 0x1000, &(0x7f0000000d80)=""/4096, 0x41000, 0x10, '\x00', r7, @lsm=0x1b, r4, 0x8, &(0x7f0000001dc0)={0x4, 0x4}, 0x8, 0x10, &(0x7f0000001e00)={0x4, 0x7, 0x1}, 0x10, 0x0, r2, 0x8, &(0x7f0000001e40)=[r3, 0xffffffffffffffff, r2], &(0x7f0000001e80)=[{0x5, 0x1, 0xa, 0x2}, {0x4, 0x2, 0xc, 0x8}, {0x3, 0x5, 0xe, 0x4b7f6e87a14971c}, {0x4, 0x3, 0xe, 0xa}, {0x0, 0x3, 0x7, 0x4}, {0x2, 0x1, 0x10, 0x6}, {0x2, 0x2, 0xb, 0x9}, {0x1, 0x2, 0x2, 0x7}], 0x10, 0x9}, 0x94) r8 = socket$nl_crypto(0x10, 0x3, 0x15) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r8, 0x10e, 0x4, &(0x7f0000001fc0)=0x400, 0x4) ioctl$EXT4_IOC_MIGRATE(r0, 0x6609) r9 = openat$cgroup_subtree(0xffffffffffffffff, &(0x7f0000002000), 0x2, 0x0) r10 = openat$sndtimer(0xffffff9c, &(0x7f0000002040), 0x2000) ioctl$VIDIOC_QUERYBUF_DMABUF(r2, 0xc04c5609, &(0x7f0000002080)={0xfffffffe, 0x3, 0x4, 0x200, 0x4, {}, {0x5, 0x2, 0x0, 0x9, 0x76, 0x7, "b1206d76"}, 0x3, 0x4, {0xffffffffffffffff}, 0x101, 0x0, r2}) poll(&(0x7f0000002100)=[{r1, 0x1}, {r1, 0x20ae}, {r1, 0x2014}, {r9}, {r1, 0x10}, {r3, 0x40}, {0xffffffffffffffff, 0x481}, {r10, 0x20}, {r11, 0x82}], 0x9, 0x1) ioctl$DRM_IOCTL_SET_VERSION(r2, 0xc0106407, &(0x7f0000002180)={0x0, 0x6, 0x0, 0x80}) read$FUSE(r5, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_LK(r2, &(0x7f0000004200)={0x28, 0xfffffffffffffff5, r12, {{0x1, 0x4, 0x1}}}, 0x28) 1.894695053s ago: executing program 4 (id=2962): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_CLOCK(r1, 0x4188aec6, &(0x7f0000000040)) r2 = syz_open_dev$video4linux(&(0x7f0000000000), 0x7, 0x841) ioctl$VIDIOC_SUBDEV_ENUM_MBUS_CODE(r2, 0xc0305602, &(0x7f00000003c0)={0x0, 0x6, 0x3004}) r3 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) write$uinput_user_dev(r3, &(0x7f0000000a80)={'syz1\x00', {}, 0x2000, [0x0, 0x0, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0xfffffffc, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0xffffffff, 0x8, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x4, 0x0, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x960, 0x0, 0x0, 0xfffffffa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff, 0x800000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x2, 0x0, 0x4, 0x0, 0xfffffffe, 0x0, 0x4, 0x0, 0x0, 0x800, 0x0, 0x0, 0x0, 0x4], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x9, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x5, 0x3, 0x3, 0x1010001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400, 0x0, 0x8, 0x0, 0x0, 0x0, 0x3, 0x0, 0x1, 0x0, 0x0, 0x0, 0x400000, 0x3, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9388, 0xffffffff], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x9, 0x2, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000]}, 0x45c) syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000140)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a0000080480", @ANYRES64], 0x0) r4 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) pipe2$watch_queue(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r6 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x88000) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r6, 0xc0505350, &(0x7f0000000040)={{}, {0x20, 0xfc}, 0x0, 0x4}) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x1c, r8, 0x1, 0x70bd2b, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4000}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x4080) ioctl$IOC_WATCH_QUEUE_SET_FILTER(r5, 0x5761, &(0x7f00000001c0)=ANY=[]) keyctl$KEYCTL_WATCH_KEY(0x20, 0x0, r5, 0x0) keyctl$chown(0x4, 0x0, 0x0, 0x0) write$char_usb(r4, 0x0, 0xfffffe71) ioctl$UI_DEV_CREATE(r3, 0x5501) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x4) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={0x0, 0x38}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) r10 = socket$nl_xfrm(0x10, 0x3, 0x6) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x1d, &(0x7f00000007c0)={0x1, &(0x7f0000000000)=[{0x6, 0x4, 0x40, 0x7fff0000}]}) prlimit64(0x0, 0x7, 0x0, 0x0) sendmsg$nl_xfrm(r10, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@allocspi={0xf4, 0x16, 0x1, 0x0, 0x0, {{{@in=@dev={0xac, 0x14, 0x14, 0x2d}, @in6=@local, 0x0, 0x0, 0xfffd, 0x0, 0xa, 0x80, 0xa0}, {@in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x0, 0x33}, @in6=@dev={0xfe, 0x80, '\x00', 0xe}, {0x0, 0x101, 0x0, 0x0, 0x1, 0xffffffffffffffec, 0x3}, {0x0, 0x0, 0x2, 0xfffbfffffffffffe}, {0x0, 0x0, 0x796}, 0x0, 0x0, 0x0, 0x0, 0x2, 0xe55286f1921f74ae}, 0x0, 0xffffffff}}, 0xf4}, 0x1, 0x0, 0x0, 0x4c844}, 0x0) ioctl$VIDIOC_DBG_G_REGISTER(r2, 0xc0385650, &(0x7f0000000040)={{0x0, @name="64f03a5523147ffd794d01d2b9766e11c3ba0b7f7e471b6fdf26c9c27a1c6206"}, 0x8, 0x401, 0x200}) r11 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r11, 0xffffffffffffffff, 0x0) 1.28723469s ago: executing program 0 (id=2964): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000380)="2e00000010008188e6b62aa73772cc9f1ba1f848110000005e140602000000000e000a0010000000", 0x28}, {&(0x7f0000000000)="11c9064268e9", 0x6}], 0x2}, 0x40) (fail_nth: 10) 1.172576806s ago: executing program 0 (id=2965): mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x7, 0xca352c92cb699c71, 0xffffffffffffffff, 0xd0a55000) r0 = userfaultfd(0x80001) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000002c0)={0xaa, 0x100}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000000000/0x400000)=nil, 0x400000}, 0x1}) mremap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x400000, 0x3, &(0x7f0000c00000/0x400000)=nil) mkdir(&(0x7f0000000000)='./cgroup/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)=@updpolicy={0xb8, 0x19, 0x1, 0x70bd25, 0x25dfdbff, {{@in=@multicast2, @in6=@ipv4={'\x00', '\xff\xff', @remote}, 0x0, 0x0, 0x8, 0x0, 0xa, 0x0, 0x20}, {0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x4000000000000000, 0xfffffffffffffffb}, {0x0, 0x1000, 0x200000000000000}, 0x800, 0x6e6bb0, 0x0, 0x1, 0x0, 0x1}}, 0xb8}, 0x1, 0x0, 0x0, 0x800}, 0x8008010) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000005c0)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast2, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x29}, {0x0, 0x0, 0x7, 0x0, 0x0, 0x2, 0xffffffffffffffff}, {0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x4004) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000340)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast2, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x29}, {0x0, 0x0, 0x9, 0x0, 0x0, 0x2, 0xffffffffffffffff}, {0x0, 0x200000000, 0x0, 0xffffffffffffffff}, 0x7}}, 0xb8}}, 0x10) 1.140931051s ago: executing program 0 (id=2966): r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) read$FUSE(r0, &(0x7f0000006540)={0x2020}, 0xfffffce2) read$FUSE(r0, &(0x7f0000002940)={0x2020}, 0x2020) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x14040080}, 0x20000044) 869.096753ms ago: executing program 0 (id=2967): openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.usage_percpu\x00', 0x275a, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000140)={'netdevsim0\x00', &(0x7f00000000c0)=@ethtool_link_settings={0x15, 0x5b09, 0x7, 0x2, 0x3, 0x5, 0x7, 0x8, 0x5, 0x9, [0xce, 0x5, 0x2005, 0x40, 0x4, 0x3, 0x400e, 0xfb]}}) openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) openat$procfs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sysvipc/msg\x00', 0x0, 0x0) unshare(0x2a060400) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000500)={'veth1\x00', &(0x7f0000000200)=@ethtool_per_queue_op={0x4b, 0xf, [0x1, 0x1, 0x107fff, 0x1, 0x4, 0x89, 0x0, 0xffb, 0x7, 0xb6b, 0x0, 0x4, 0x1, 0x3, 0x9, 0xff, 0x1000, 0xc, 0x3, 0x3, 0x80000001, 0xfffffffa, 0x0, 0x1, 0x9, 0x4, 0x7, 0x5, 0x100000, 0x9, 0x3, 0x63c, 0xe, 0x6, 0x2, 0x6, 0x1bfa, 0xb, 0x40, 0x40bed4, 0x8, 0x8000100, 0x3, 0x0, 0x11000, 0x8, 0x5, 0x79b, 0x3, 0x1, 0x7f, 0x4, 0xa, 0x7, 0xf, 0x101, 0xa, 0x1fa0860a, 0x7, 0x100aa, 0x7f, 0x2, 0x180000, 0x4003, 0x8b, 0x5, 0x2af, 0x3, 0x5, 0x2, 0x1, 0x9, 0x4, 0x7, 0x1, 0x0, 0x4, 0x100002, 0x8, 0x752, 0x0, 0x3, 0x0, 0x10000, 0x3f6, 0xffffffff, 0x6, 0x6, 0x9, 0x80000000, 0xfdffffff, 0x2, 0x0, 0x84, 0x100, 0x5, 0x252, 0x81, 0xb, 0x4, 0x20004, 0xc50, 0x2, 0xb, 0x2, 0xd9a, 0xc8, 0x2a2, 0xfffffffd, 0x3, 0x2, 0x5, 0x8, 0x0, 0x4, 0x2, 0x40, 0x8, 0x4, 0x4, 0x401, 0x66cd, 0x8, 0x8, 0x5, 0x1fc, 0x9, 0xffffffff]}}) poll(&(0x7f0000000000), 0x20000000000000b5, 0x9) syz_usb_connect$uac1(0x0, 0xa4, &(0x7f0000000180)=ANY=[@ANYBLOB="2a01000020000040b708000000000000030109029200030172e5000904000000010100000a24010000000201020c0d2405000005000000000000000c240000e9ffff28bbe044ff092403f3", @ANYRES8=r1, @ANYRES64=r1], 0x0) 698.447456ms ago: executing program 2 (id=2968): r0 = syz_open_dev$loop(&(0x7f0000000140), 0x5, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='blkio.bfq.io_service_time_recursive\x00', 0x275a, 0x0) write$binfmt_misc(r1, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000024c0)={r1, 0x20000, {0x2a00, 0x80010000, 0x0, 0x2, 0x800000000000208, 0x0, 0x3, 0x2, 0x10, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100000000020000ffffffffff00", "2809e8dbe108598948224ad54afac11d875397bd3c5240f45f819e01177d2d458dd4992861ac00", "90be8b1c5500000000004000f0f9ffff0000000000ffff00", [0x80000000009, 0x6]}}) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = syz_open_dev$dvb_demux(&(0x7f0000000440), 0x0, 0x40) ioctl$DVB_DEMUX_DMX_SET_FILTER(r2, 0x403c6f2b, &(0x7f0000000480)={0xcfe5, {"4a21cbfdc27bb22779aef2a885da3dc7", "4a4dc099f22614fee775210e6170bf8b", "dd32be9ce93516763ba2d35a3edb8294"}, 0x8, 0x2}) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000440)={'ip6_vti0\x00', 0x0}) r3 = socket$kcm(0x29, 0x0, 0x0) listen(r3, 0x8) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1, 0x4, &(0x7f0000000580)=@framed={{0x18, 0x5, 0x0, 0x0, 0x40000}, [@call={0x85, 0x0, 0x0, 0x6a}]}, &(0x7f0000000000)='syzkaller\x00', 0x5, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = syz_io_uring_setup(0x42, &(0x7f00000001c0)={0x0, 0x5961, 0x1000, 0x1, 0x4e}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r5, r6, r7, &(0x7f0000000280)=@IORING_OP_SETXATTR={0x2a, 0x40, 0x0, 0x0, 0x0, &(0x7f000000c640)='./file0\x00', 0xff86, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0}}) io_uring_enter(r4, 0x2000, 0xfffffffa, 0x9, 0x0, 0x0) read$FUSE(r1, &(0x7f0000002600)={0x2020, 0x0, 0x0}, 0x2020) r9 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000002100)='numa_maps\x00') write$FUSE_INIT(r9, &(0x7f0000000040)={0x50, 0x0, r8, {0x7, 0x1f, 0x3, 0xffffffffd28f2452, 0x83, 0xffff, 0x0, 0xabe6, 0x0, 0x0, 0x80, 0x208001}}, 0x50) r10 = syz_open_dev$mtd(&(0x7f0000000100), 0x8, 0x10b241) r11 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000040)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1, 0x5, &(0x7f0000000580)=@framed={{0x18, 0x5, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x8}, [@map_fd={0x18, 0x4, 0x1, 0x0, r11}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x1, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$F2FS_IOC_RELEASE_VOLATILE_WRITE(r9, 0xf504, 0x0) ioctl$MEMGETREGIONCOUNT(r10, 0x80044d07, &(0x7f0000000040)) keyctl$instantiate_iov(0x14, 0x0, &(0x7f0000000300)=[{&(0x7f0000000000)="61cc23d4941575be99b80c562e9872f8", 0x10}], 0x100000000000028f, 0x0) close(0x3) r12 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r12, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000c40)={0x14, 0x3b, 0x301, 0xa70bd1d, 0x25dfdbff, {0x6}}, 0x14}, 0x1, 0x0, 0x0, 0x8010}, 0x0) r13 = openat$random(0xffffffffffffff9c, &(0x7f0000000040), 0x80, 0x0) preadv2(r13, &(0x7f0000000740)=[{0x0}, {&(0x7f0000000280)=""/41, 0x29}], 0x2, 0x3c, 0x163c, 0x7) 596.679676ms ago: executing program 2 (id=2969): r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1b6) pwrite64(r0, &(0x7f0000000100)="55aa", 0x2, 0x1fe) pwrite64(r0, &(0x7f0000000100)='PRIVHEAD', 0x8, 0xc00) pwrite64(r0, &(0x7f00000005c0)="069c3d157a437dcb3f0dfc4d3180c029301700945ab4281eef000000", 0xffffffffffffffd9, 0x2af2) r1 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x2) ioctl$LOOP_SET_FD(r1, 0x4c00, r0) ioctl$LOOP_SET_STATUS64(r1, 0x4c04, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', '\x00', '\x00', [0x0, 0x3]}) 307.687579ms ago: executing program 2 (id=2970): r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000180), 0x1, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000040)={0x7fc3, "b9abecfe9100a72ead3b3be3b6795e80561559bf34037168c9eebad8f163d551"}) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x10, &(0x7f0000000000)=[@in={0x2, 0x4e23, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f00000002c0)=0x10) socket(0x2, 0x80805, 0x0) r2 = landlock_create_ruleset(&(0x7f0000000040)={0x2, 0x3, 0x3}, 0x18, 0x0) landlock_restrict_self(r2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000004240)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r3, 0x0, r5, 0x0, 0x3, 0x0) landlock_restrict_self(0xffffffffffffffff, 0xc) write$binfmt_elf64(r4, &(0x7f0000001b40)=ANY=[], 0xfffffe3e) r6 = socket$inet(0x2, 0x80001, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000040)=0x8) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000340), 0x2000011a) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000200)={@map, 0x9, 0x0, 0x3, &(0x7f0000000080)=[0x0, 0x0], 0x2, 0x0, &(0x7f00000000c0)=[0x0], &(0x7f0000000140)=[0x0, 0x0], &(0x7f00000001c0)=[0x0]}, 0x40) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x41, 0x0) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000380)={0xbc9}, 0x8) socket$nl_netfilter(0x10, 0x3, 0xc) 159.452044ms ago: executing program 0 (id=2971): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_ro(r0, &(0x7f0000000080)='freezer.parent_freezing\x00', 0x0, 0x0) preadv2(r1, &(0x7f0000000280)=[{&(0x7f00000008c0)=""/211, 0xd3}], 0x1, 0x0, 0x0, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=@newlink={0x60, 0x10, 0x401, 0x4007fe, 0x7, {0x0, 0x0, 0x0, 0x0, 0xe59bca127d81b0fa, 0xc574450d1af3b5a4}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @bridge_slave={{0x11}, {0x14, 0x5, 0x0, 0x1, [@IFLA_BRPORT_PROXYARP_WIFI={0x5}, @IFLA_BRPORT_PROXYARP={0x5, 0xa, 0x1}]}}}, @IFLA_IFNAME={0x14, 0x3, 'bridge_slave_0\x00'}]}, 0x60}, 0x1, 0x0, 0x0, 0x20044010}, 0x4040) 73.245732ms ago: executing program 1 (id=2972): r0 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt(0xffffffffffffffff, 0x84, 0x80, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r2, 0x10e, 0x2, &(0x7f0000000000)=0x8, 0x4) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) r3 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000140)="5c0000007a006bcd9e3fe3dc6e08000007200000010000204da60864160af36504005425198bc3488bc3a0e69ee517d34460bc24eab556a705251e6182949a3651f668c3664402682fb6e27bbfa83b5cae0300c9f4d193", 0x57}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x401c894) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) syz_open_dev$vim2m(&(0x7f0000000000), 0x0, 0x2) pselect6(0x0, 0x0, &(0x7f0000000000)={0x1f, 0x0, 0x0, 0x7ff0, 0x4, 0x0, 0xc}, 0x0, 0x0, 0x0) fcntl$lock(r3, 0x410, &(0x7f00000000c0)={0x1, 0x1, 0x1, 0xfffe}) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x7a44, 0x1700) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x20004450) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24000840) socket$netlink(0x10, 0x3, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40088a01, &(0x7f0000000000)) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000040)) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_NL_MEDIA_GET(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000200)={0x6c, r4, 0x1, 0x170bd2b, 0x0, {0x3}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x8000000, @dev={0xfe, 0x80, '\x00', 0x10}, 0xf8}}, {0x20, 0x2, @in6={0xa, 0x0, 0x5, @mcast2}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}]}]}, 0x6c}, 0x1, 0x300}, 0x8000) 0s ago: executing program 0 (id=2973): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0xd, 0x0, &(0x7f00000005c0), 0x0, 0x3, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf7fffff9}, 0x94) socket$nl_route(0x10, 0x3, 0x0) setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f00000000c0)={0x8d79, 0xa6, 0x209, 0x7fffffff, 0x32a, 0x4, 0x5, 0x1}, 0x20) connect$can_bcm(0xffffffffffffffff, &(0x7f0000000140), 0x10) pipe2$watch_queue(0x0, 0x80) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/bus/usb/devices/usb2/power/level\x00', 0x302182, 0x0) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000100)={0x40000000, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="021800001c000000000000000000000005000600000000000a00000000000000000000000000000000000000000000000000000000000000020012000000000000000000fcffffff0600ff0000000000000000000000000000000000000000000000000001000000fe8000000000002100000000000000bb050005002b0000000a00000000000000fc01000000020000000200000000000000000000000000000800"], 0xe0}}, 0x0) r3 = socket$can_bcm(0x1d, 0x2, 0x2) r4 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_ERR_FILTER(r4, 0x65, 0x2, &(0x7f0000000040)=0x10001, 0x4) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="300000002100050100000000000000000200000000000000020000000c000c40afb0fd2bc5f896ee1799cf5e3f218a00000000000000070500130001000000a7d4e78fc59f46913f262b5ce1a1fcc5771556a2a8c9d823b7193b9e0f6ca07b717b3b5602dace023c048cccf203abf53314e04446597d229968da052c2ce39806b6b1cd4b141a1b6b76f7fbb921ca50e477f8d33b21d841097d1baae080f7165a7d0fd567a763bd4c8701030054307fc5"], 0x30}}, 0x0) r6 = socket(0x1d, 0x2, 0x6) ioctl$ifreq_SIOCGIFINDEX_vcan(r6, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) bind$can_j1939(0xffffffffffffffff, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000100)={'vxcan0\x00'}) ioctl$MEMGETINFO(r1, 0x80204d01, &(0x7f0000000080)) r8 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_ADD_STREAMS(r8, 0x84, 0x79, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r9 = socket$can_bcm(0x1d, 0x2, 0x2) r10 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r11 = ioctl$KVM_CREATE_VM(r10, 0xae01, 0x12) ioctl$KVM_CREATE_VCPU(r11, 0xae41, 0x0) r12 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r13 = syz_pidfd_open(r12, 0x0) process_madvise(r13, 0x0, 0x0, 0x9, 0x0) ioctl$KVM_CAP_HYPERV_TLBFLUSH(r11, 0x4068aea3, &(0x7f0000000280)) connect$can_bcm(r9, &(0x7f0000000140)={0x1d, r7}, 0x10) kernel console output (not intermixed with test programs): 4549][T13904] nvme_fc: nvme_fc_parse_traddr: bad traddr string [ 467.226171][ T5697] usb 1-1: 3:0: failed to get current value for ch 1 (-71) [ 467.230386][ T5697] usb 1-1: 3:0: failed to get current value for ch 2 (-71) [ 467.237825][ T5697] usb 1-1: 3:0: failed to get current value for ch 0 (-71) [ 467.243681][ T5697] usb 1-1: 3:0: failed to get current value for ch 1 (-71) [ 467.249305][ T5697] usb 1-1: 3:0: failed to get current value for ch 0 (-71) [ 467.250598][ T5697] usb 1-1: 3:0: cannot get min/max values for control 11 (id 3) [ 467.290479][ T5697] usb 1-1: USB disconnect, device number 26 [ 467.309338][ T6619] udevd[6619]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 467.372130][ T5731] usb 4-1: new high-speed USB device number 109 using dummy_hcd [ 467.522107][ T5731] usb 4-1: Using ep0 maxpacket: 32 [ 467.529428][ T5731] usb 4-1: unable to get BOS descriptor or descriptor too short [ 467.529512][ T5731] usb 4-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 467.547241][ T5731] usb 4-1: config 14 has an invalid interface number: 57 but max is 1 [ 467.547299][ T5731] usb 4-1: config 14 has an invalid interface number: 228 but max is 1 [ 467.547336][ T5731] usb 4-1: config 14 has no interface number 0 [ 467.547350][ T5731] usb 4-1: config 14 has no interface number 1 [ 467.547407][ T5731] usb 4-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 467.547429][ T5731] usb 4-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 467.547452][ T5731] usb 4-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 467.547475][ T5731] usb 4-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 467.547498][ T5731] usb 4-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 467.547521][ T5731] usb 4-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 467.547544][ T5731] usb 4-1: config 14 interface 57 has no altsetting 0 [ 467.547560][ T5731] usb 4-1: config 14 interface 228 has no altsetting 0 [ 467.553066][ T5731] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 467.553089][ T5731] usb 4-1: Product: syz [ 467.553102][ T5731] usb 4-1: Manufacturer: syz [ 467.553116][ T5731] usb 4-1: SerialNumber: syz [ 467.969465][ T5731] legousbtower 4-1:14.57: interrupt endpoints not found [ 467.982103][ T5697] usb 2-1: new high-speed USB device number 107 using dummy_hcd [ 468.132839][ T5697] usb 2-1: New USB device found, idVendor=7de0, idProduct=676e, bcdDevice=77.db [ 468.132884][ T5697] usb 2-1: too many configurations: 164, using maximum allowed: 8 [ 468.144820][ T5697] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 468.148786][ T5697] usb 2-1: config 0 descriptor?? [ 468.375646][ T5731] legousbtower 4-1:14.228: get version request failed: -121 [ 468.375811][ T5731] legousbtower 4-1:14.228: probe with driver legousbtower failed with error -121 [ 468.469069][ T5731] usb 2-1: USB disconnect, device number 107 [ 469.172330][ T5731] usb 3-1: new high-speed USB device number 111 using dummy_hcd [ 469.322153][ T5731] usb 3-1: Using ep0 maxpacket: 32 [ 469.328518][ T5731] usb 3-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=93.d8 [ 469.339336][ T5731] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 469.339383][ T5731] usb 3-1: config 0 has no interface number 0 [ 469.355150][ T5731] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 469.355224][ T5731] usb 3-1: Product: syz [ 469.355261][ T5731] usb 3-1: Manufacturer: syz [ 469.355276][ T5731] usb 3-1: SerialNumber: syz [ 469.358196][ T5731] usb 3-1: config 0 descriptor?? [ 469.361834][ T5731] usb 3-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 469.361919][ T5731] usb 3-1: selecting invalid altsetting 1 [ 469.361936][ T5731] usb 3-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 469.368497][ T5731] usb 3-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 469.369024][ T5731] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 469.369151][ T5731] usb 3-1: media controller created [ 469.384802][ T31] usb 1-1: new high-speed USB device number 27 using dummy_hcd [ 469.386892][ T5731] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 469.532085][ T31] usb 1-1: Using ep0 maxpacket: 32 [ 469.532953][ T31] usb 1-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=93.d8 [ 469.534240][ T31] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 469.534262][ T31] usb 1-1: config 0 has no interface number 0 [ 469.538021][ T31] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 469.538044][ T31] usb 1-1: Product: syz [ 469.538058][ T31] usb 1-1: Manufacturer: syz [ 469.538072][ T31] usb 1-1: SerialNumber: syz [ 469.548366][ T31] usb 1-1: config 0 descriptor?? [ 469.559711][ T31] usb 1-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 469.559734][ T31] usb 1-1: selecting invalid altsetting 1 [ 469.559749][ T31] usb 1-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 469.572778][ T31] usb 1-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 469.573157][ T31] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 469.575095][ T31] usb 1-1: media controller created [ 469.599256][ T31] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 469.767318][T13932] i2c i2c-0: DVB: adapter 0 frontend 0 frequency 1 out of range (51000000..2150000000) [ 469.797945][T13932] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 469.798380][T13932] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 470.128844][ T5729] usb 4-1: USB disconnect, device number 109 [ 470.504939][ T5731] usb 3-1: dvb_usb_ce6230: usb_control_msg() failed=-110 [ 470.505411][ T5731] zl10353_read_register: readreg error (reg=127, ret==-110) [ 470.662992][ T31] usb 1-1: dvb_usb_ce6230: usb_control_msg() failed=-110 [ 470.663065][ T31] zl10353_read_register: readreg error (reg=127, ret==-110) [ 470.704747][ T5731] usb 3-1: USB disconnect, device number 111 [ 471.001774][T13945] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 471.016100][T13945] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 471.238955][T13949] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2701'. [ 471.600906][T13962] syzkaller0: entered promiscuous mode [ 471.606688][T13962] syzkaller0: entered allmulticast mode [ 471.810196][T13964] nvme_fc: nvme_fc_parse_traddr: bad traddr string [ 471.874747][T13972] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 471.875175][T13972] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 472.032265][ T5731] usb 2-1: new high-speed USB device number 108 using dummy_hcd [ 472.045447][T13972] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2710'. [ 472.045921][ T30] audit: type=1326 audit(1788665489.353:3245): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13975 comm="syz.3.2711" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6fdf0ec code=0x7ffc0000 [ 472.047713][ T30] audit: type=1326 audit(1788665489.353:3246): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13975 comm="syz.3.2711" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6fdf0ec code=0x7ffc0000 [ 472.061490][ T30] audit: type=1326 audit(1788665489.363:3247): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13975 comm="syz.3.2711" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf6fdf0ec code=0x7ffc0000 [ 472.061538][ T30] audit: type=1326 audit(1788665489.363:3248): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13975 comm="syz.3.2711" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6fdf0ec code=0x7ffc0000 [ 472.077833][ T30] audit: type=1326 audit(1788665489.363:3249): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13975 comm="syz.3.2711" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6fdf0ec code=0x7ffc0000 [ 472.077883][ T30] audit: type=1326 audit(1788665489.363:3250): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13975 comm="syz.3.2711" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf6fdf0ec code=0x7ffc0000 [ 472.077920][ T30] audit: type=1326 audit(1788665489.363:3251): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13975 comm="syz.3.2711" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6fdf0ec code=0x7ffc0000 [ 472.077956][ T30] audit: type=1326 audit(1788665489.363:3252): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13975 comm="syz.3.2711" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6fdf0ec code=0x7ffc0000 [ 472.089115][ T30] audit: type=1326 audit(1788665489.393:3253): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13975 comm="syz.3.2711" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf6fdf0ec code=0x7ffc0000 [ 472.105551][ T30] audit: type=1326 audit(1788665489.423:3254): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13975 comm="syz.3.2711" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6fdf0ec code=0x7ffc0000 [ 472.232623][ T5731] usb 2-1: Using ep0 maxpacket: 32 [ 472.238103][ T5731] usb 2-1: unable to get BOS descriptor or descriptor too short [ 472.238150][ T5731] usb 2-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 472.239563][ T5731] usb 2-1: config 14 has an invalid interface number: 57 but max is 1 [ 472.239585][ T5731] usb 2-1: config 14 has an invalid interface number: 228 but max is 1 [ 472.239604][ T5731] usb 2-1: config 14 has no interface number 0 [ 472.239619][ T5731] usb 2-1: config 14 has no interface number 1 [ 472.239676][ T5731] usb 2-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 472.239697][ T5731] usb 2-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 472.239721][ T5731] usb 2-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 472.239743][ T5731] usb 2-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 472.239766][ T5731] usb 2-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 472.239799][ T5731] usb 2-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 472.239822][ T5731] usb 2-1: config 14 interface 57 has no altsetting 0 [ 472.239838][ T5731] usb 2-1: config 14 interface 228 has no altsetting 0 [ 472.246857][ T5731] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 472.246881][ T5731] usb 2-1: Product: syz [ 472.246894][ T5731] usb 2-1: Manufacturer: syz [ 472.246907][ T5731] usb 2-1: SerialNumber: syz [ 472.393300][ T5729] usb 4-1: new high-speed USB device number 110 using dummy_hcd [ 472.552199][ T5729] usb 4-1: Using ep0 maxpacket: 32 [ 472.553755][ T5729] usb 4-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 472.559907][ T5729] usb 4-1: config 0 has an invalid interface number: 67 but max is 0 [ 472.559935][ T5729] usb 4-1: config 0 has no interface number 0 [ 472.567904][ T5729] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 472.567929][ T5729] usb 4-1: Product: syz [ 472.567942][ T5729] usb 4-1: Manufacturer: syz [ 472.567978][ T5729] usb 4-1: SerialNumber: syz [ 472.572127][ T31] usb 3-1: new high-speed USB device number 112 using dummy_hcd [ 472.575950][ T5729] usb 4-1: config 0 descriptor?? [ 472.674829][ T5731] legousbtower 2-1:14.57: interrupt endpoints not found [ 472.723906][ T31] usb 3-1: New USB device found, idVendor=8086, idProduct=0b5b, bcdDevice=e1.c5 [ 472.726130][ T31] usb 3-1: config 0 has an invalid descriptor of length 32, skipping remainder of the config [ 472.726153][ T31] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 472.726194][ T31] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 472.731575][ T31] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 472.731598][ T31] usb 3-1: Product: syz [ 472.731611][ T31] usb 3-1: Manufacturer: syz [ 472.731624][ T31] usb 3-1: SerialNumber: syz [ 472.738324][ T31] usb 3-1: config 0 descriptor?? [ 472.747691][ T31] uvcvideo 3-1:0.0: Found UVC 34.00 device syz (8086:0b5b) [ 472.747871][ T31] uvcvideo 3-1:0.0: No valid video chain found. [ 472.956756][ T2248] usb 3-1: USB disconnect, device number 112 [ 473.010530][ T5729] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 473.010602][ T5729] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 473.079489][ T5731] legousbtower 2-1:14.228: get version request failed: -121 [ 473.079675][ T5731] legousbtower 2-1:14.228: probe with driver legousbtower failed with error -121 [ 473.126320][T13985] kvm: user requested TSC rate below hardware speed [ 473.378807][T13993] loop0: detected capacity change from 0 to 19834 [ 473.433746][T13993] ldm_parse_privhead(): Expected PRIVHEAD version 2.11 or 2.12, got 0.0. Aborting. [ 473.433799][T13993] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 473.433868][T13993] loop0: [ 473.643991][T13976] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 473.644509][T13976] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 473.693302][T13976] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 473.705464][T13976] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 473.774708][ T5729] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000104: -71 [ 473.774966][ T5729] smsc95xx 4-1:0.67: probe with driver smsc95xx failed with error -71 [ 473.810141][ T5729] usb 4-1: USB disconnect, device number 110 [ 473.916917][T14003] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 473.928820][T14003] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 474.291124][T14006] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2721'. [ 474.564130][T14016] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 474.574407][T14016] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 474.741825][ T5729] usb 2-1: USB disconnect, device number 108 [ 474.821509][T14026] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2729'. [ 475.032109][ T5704] usb 3-1: new full-speed USB device number 113 using dummy_hcd [ 475.185462][ T5704] usb 3-1: unable to get BOS descriptor or descriptor too short [ 475.185979][ T5704] usb 3-1: not running at top speed; connect to a high speed hub [ 475.186008][ T5704] usb 3-1: New USB device found, idVendor=200c, idProduct=1018, bcdDevice= 0.40 [ 475.186933][ T5704] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 475.186954][ T5704] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 475.190264][ T5704] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 475.190287][ T5704] usb 3-1: Product: syz [ 475.190301][ T5704] usb 3-1: Manufacturer: syz [ 475.190314][ T5704] usb 3-1: SerialNumber: syz [ 475.255975][ T5729] usb 2-1: new full-speed USB device number 109 using dummy_hcd [ 475.438174][ T5729] usb 2-1: New USB device found, idVendor=056a, idProduct=0117, bcdDevice= 0.00 [ 475.453296][ T5729] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 475.453352][ T5729] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 475.468861][ T5704] usb 3-1: 3:0: failed to get current value for ch 1 (-71) [ 475.481323][ T5729] usb 2-1: config 0 descriptor?? [ 475.485706][ T5704] usb 3-1: 3:0: failed to get current value for ch 2 (-71) [ 475.508386][ T5704] usb 3-1: 3:0: failed to get current value for ch 0 (-71) [ 475.525832][ T5704] usb 3-1: 3:0: failed to get current value for ch 1 (-71) [ 475.536059][ T5704] usb 3-1: 3:0: failed to get current value for ch 0 (-71) [ 475.538402][ T5704] usb 3-1: 3:0: cannot get min/max values for control 11 (id 3) [ 475.726285][ T5704] usb 3-1: USB disconnect, device number 113 [ 475.797252][ T6619] udevd[6619]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 475.904684][ T2248] usb 4-1: new high-speed USB device number 111 using dummy_hcd [ 475.960010][ T5729] wacom 0003:056A:0117.005A: Unknown device_type for 'HID 056a:0117'. Ignoring. [ 476.055853][ T2248] usb 4-1: New USB device found, idVendor=05c5, idProduct=0002, bcdDevice= 1.00 [ 476.065625][ T2248] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 476.065676][ T2248] usb 4-1: Product: syz [ 476.065707][ T2248] usb 4-1: Manufacturer: syz [ 476.065719][ T2248] usb 4-1: SerialNumber: syz [ 476.100644][ T2248] digi_acceleport 4-1:1.0: Digi 2 port USB adapter converter detected [ 476.184868][ T2248] usb 4-1: Digi 2 port USB adapter converter now attached to ttyUSB0 [ 476.230795][ T5704] usb 2-1: USB disconnect, device number 109 [ 476.239689][ T2248] usb 4-1: Digi 2 port USB adapter converter now attached to ttyUSB1 [ 476.278832][ T2248] usb 4-1: Digi 2 port USB adapter converter now attached to ttyUSB2 [ 476.837134][T14057] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2740'. [ 476.853481][T12250] hid-generic 0000:0000:0000.005B: unknown main item tag 0x0 [ 476.869590][T12250] hid-generic 0000:0000:0000.005B: hidraw0: HID v0.00 Device [syz1] on syz0 [ 476.938724][T14055] nvme_fc: nvme_fc_parse_traddr: bad traddr string [ 476.953082][T14060] kvm: user requested TSC rate below hardware speed [ 477.122140][ T2248] usb 2-1: new high-speed USB device number 110 using dummy_hcd [ 477.272617][ T2248] usb 2-1: Using ep0 maxpacket: 32 [ 477.275261][ T2248] usb 2-1: unable to get BOS descriptor or descriptor too short [ 477.275310][ T2248] usb 2-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 477.279370][ T2248] usb 2-1: config 14 has an invalid interface number: 57 but max is 1 [ 477.279393][ T2248] usb 2-1: config 14 has an invalid interface number: 228 but max is 1 [ 477.279412][ T2248] usb 2-1: config 14 has no interface number 0 [ 477.279427][ T2248] usb 2-1: config 14 has no interface number 1 [ 477.279483][ T2248] usb 2-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 477.279505][ T2248] usb 2-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 477.279527][ T2248] usb 2-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 477.279550][ T2248] usb 2-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 477.279573][ T2248] usb 2-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 477.279597][ T2248] usb 2-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 477.279621][ T2248] usb 2-1: config 14 interface 57 has no altsetting 0 [ 477.279637][ T2248] usb 2-1: config 14 interface 228 has no altsetting 0 [ 477.287047][ T2248] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 477.287071][ T2248] usb 2-1: Product: syz [ 477.287084][ T2248] usb 2-1: Manufacturer: syz [ 477.287098][ T2248] usb 2-1: SerialNumber: syz [ 477.425695][T14069] loop0: detected capacity change from 0 to 7656 [ 477.466489][T14069] ldm_parse_privhead(): Expected PRIVHEAD version 2.11 or 2.12, got 0.0. Aborting. [ 477.466544][T14069] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 477.466627][T14069] loop0: [ 477.724221][ T2248] legousbtower 2-1:14.57: interrupt endpoints not found [ 478.121091][ T4985] ldm_parse_privhead(): Expected PRIVHEAD version 2.11 or 2.12, got 0.0. Aborting. [ 478.121141][ T4985] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 478.121537][ T4985] loop0: [ 478.140713][ T2248] legousbtower 2-1:14.228: get version request failed: -121 [ 478.140883][ T2248] legousbtower 2-1:14.228: probe with driver legousbtower failed with error -121 [ 478.388829][ T189] usb 4-1: USB disconnect, device number 111 [ 478.463521][ T189] digi_2 ttyUSB0: Digi 2 port USB adapter converter now disconnected from ttyUSB0 [ 478.499026][ T189] digi_2 ttyUSB1: Digi 2 port USB adapter converter now disconnected from ttyUSB1 [ 478.520660][ T189] digi_2 ttyUSB2: Digi 2 port USB adapter converter now disconnected from ttyUSB2 [ 478.545939][ T189] digi_acceleport 4-1:1.0: device disconnected [ 478.656259][ T4985] ldm_parse_privhead(): Expected PRIVHEAD version 2.11 or 2.12, got 0.0. Aborting. [ 478.656303][ T4985] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 478.656368][ T4985] loop0: [ 479.152653][ T189] usb 3-1: new high-speed USB device number 114 using dummy_hcd [ 479.186283][T14090] macvlan0: entered promiscuous mode [ 479.200905][T14090] ======================================================= [ 479.200905][T14090] WARNING: The mand mount option has been deprecated and [ 479.200905][T14090] and is ignored by this kernel. Remove the mand [ 479.200905][T14090] option from the mount to silence this warning. [ 479.200905][T14090] ======================================================= [ 479.302252][ T189] usb 3-1: Using ep0 maxpacket: 8 [ 479.304210][ T189] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 479.305474][ T189] usb 3-1: config index 0 descriptor too short (expected 301, got 45) [ 479.305521][ T189] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 479.305541][ T189] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 479.305563][ T189] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 479.305584][ T189] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 479.305628][ T189] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 479.387280][ T30] kauditd_printk_skb: 187 callbacks suppressed [ 479.387333][ T30] audit: type=1400 audit(1788665496.693:3442): apparmor="DENIED" operation="setprocattr" info="invalid" error=-22 profile="unconfined" pid=14093 comm="syz.4.2751" [ 479.483541][ T5704] usb 4-1: new full-speed USB device number 112 using dummy_hcd [ 479.536106][T14084] netlink: 64 bytes leftover after parsing attributes in process `syz.2.2749'. [ 479.555649][T14084] syzkaller1: entered promiscuous mode [ 479.555695][T14084] syzkaller1: entered allmulticast mode [ 479.608257][T14086] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2748'. [ 479.627890][ T189] usb 3-1: GET_CAPABILITIES returned 0 [ 479.627961][ T189] usbtmc 3-1:16.0: can't read capabilities [ 479.639170][ T5704] usb 4-1: unable to get BOS descriptor or descriptor too short [ 479.641355][ T5704] usb 4-1: not running at top speed; connect to a high speed hub [ 479.641385][ T5704] usb 4-1: New USB device found, idVendor=200c, idProduct=1018, bcdDevice= 0.40 [ 479.646632][ T5704] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 479.646654][ T5704] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 479.651191][ T5704] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 479.651214][ T5704] usb 4-1: Product: syz [ 479.651228][ T5704] usb 4-1: Manufacturer: syz [ 479.651241][ T5704] usb 4-1: SerialNumber: syz [ 479.845782][ T5729] usb 2-1: USB disconnect, device number 110 [ 479.897909][T14105] batadv_slave_1: entered promiscuous mode [ 479.937321][ T5704] usb 4-1: 3:0: failed to get current value for ch 1 (-71) [ 479.960796][T14104] batadv_slave_1: left promiscuous mode [ 479.969208][ T5704] usb 4-1: 3:0: failed to get current value for ch 2 (-71) [ 479.991344][ T5704] usb 4-1: 3:0: failed to get current value for ch 0 (-71) [ 479.996503][T14109] FAULT_INJECTION: forcing a failure. [ 479.996503][T14109] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 479.996539][T14109] CPU: 0 UID: 0 PID: 14109 Comm: syz.1.2756 Tainted: G L syzkaller #0 PREEMPT(full) [ 479.996563][T14109] Tainted: [L]=SOFTLOCKUP [ 479.996570][T14109] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 479.996589][T14109] Call Trace: [ 479.996596][T14109] [ 479.996605][T14109] dump_stack_lvl+0xe8/0x150 [ 479.996636][T14109] should_fail_ex+0x410/0x560 [ 479.996769][T14109] _copy_to_iter+0x1e4/0x1810 [ 479.996858][T14109] ? _copy_to_iter+0x255/0x1810 [ 479.996883][T14109] ? __pfx__copy_to_iter+0x10/0x10 [ 479.996909][T14109] ? __skb_recv_udp+0x497/0x930 [ 479.997003][T14109] ? __skb_recv_udp+0x497/0x930 [ 479.997029][T14109] ? lockdep_hardirqs_on+0x7b/0x110 [ 479.997110][T14109] ? __skb_recv_udp+0x497/0x930 [ 479.997138][T14109] __skb_datagram_iter+0x419/0x980 [ 479.997195][T14109] ? __pfx_simple_copy_to_iter+0x10/0x10 [ 479.997224][T14109] __skb_datagram_iter+0x6ee/0x980 [ 479.997248][T14109] ? __pfx_simple_copy_to_iter+0x10/0x10 [ 479.997277][T14109] skb_copy_datagram_iter+0xb5/0x240 [ 479.997303][T14109] udpv6_recvmsg+0x767/0x1320 [ 479.997359][T14109] ? lock_acquire+0x115/0x350 [ 479.997389][T14109] ? __pfx_udpv6_recvmsg+0x10/0x10 [ 479.997417][T14109] ? inet6_recvmsg+0xe7/0x490 [ 479.997491][T14109] ? bpf_lsm_socket_recvmsg+0x9/0x20 [ 479.997512][T14109] ? security_socket_recvmsg+0x7e/0x2c0 [ 479.997592][T14109] ? __pfx_inet6_recvmsg+0x10/0x10 [ 479.997616][T14109] sock_recvmsg+0xfa/0x1e0 [ 479.997691][T14109] __sys_recvfrom+0x231/0x3a0 [ 479.997716][T14109] ? __pfx___sys_recvfrom+0x10/0x10 [ 479.997745][T14109] ? __fget_files+0x3a2/0x420 [ 479.997778][T14109] ? ksys_write+0x242/0x270 [ 479.997809][T14109] __ia32_compat_sys_recvfrom+0xe4/0x100 [ 479.997887][T14109] __do_fast_syscall_32+0x27a/0x6a0 [ 479.997907][T14109] ? do_fast_syscall_32+0x33/0x70 [ 479.997924][T14109] ? asm_int80_emulation+0x1a/0x20 [ 479.997941][T14109] ? do_int80_emulation+0x299/0x500 [ 479.997958][T14109] ? trace_irq_disable+0x3b/0x140 [ 479.997979][T14109] do_fast_syscall_32+0x33/0x70 [ 479.997998][T14109] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 479.998020][T14109] RIP: 0023:0xf7f940ec [ 479.998038][T14109] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 479.998053][T14109] RSP: 002b:00000000f545650c EFLAGS: 00000206 ORIG_RAX: 0000000000000173 [ 479.998072][T14109] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080001a80 [ 479.998085][T14109] RDX: 0000000000000fc6 RSI: 0000000040020100 RDI: 0000000000000000 [ 479.998097][T14109] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 479.998108][T14109] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 479.998118][T14109] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 479.998145][T14109] [ 480.010651][ T5704] usb 4-1: 3:0: failed to get current value for ch 1 (-71) [ 480.030915][ T5704] usb 4-1: 3:0: failed to get current value for ch 0 (-71) [ 480.032271][ T5704] usb 4-1: 3:0: cannot get min/max values for control 11 (id 3) [ 480.282526][ T5704] usb 4-1: USB disconnect, device number 112 [ 480.343601][T14117] netlink: 6 bytes leftover after parsing attributes in process `syz.0.2757'. [ 480.406249][ T6619] udevd[6619]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 480.445637][T14117] syzkaller1: entered promiscuous mode [ 480.445690][T14117] syzkaller1: entered allmulticast mode [ 480.799254][ T30] audit: type=1400 audit(1788665498.103:3443): apparmor="DENIED" operation="setprocattr" info="invalid" error=-22 profile="unconfined" pid=14126 comm="syz.0.2762" [ 481.144174][T14141] nvme_fc: nvme_fc_parse_traddr: bad traddr string [ 481.176488][T14141] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 481.188550][T14141] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 481.652099][ T189] usb 4-1: new high-speed USB device number 113 using dummy_hcd [ 481.787152][T14153] ip6gretap0: entered promiscuous mode [ 481.799484][T14153] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2771'. [ 481.804162][ T189] usb 4-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 481.807660][ T189] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 481.807682][ T189] usb 4-1: Product: syz [ 481.807696][ T189] usb 4-1: Manufacturer: syz [ 481.807709][ T189] usb 4-1: SerialNumber: syz [ 481.813727][T14153] ipvlan1: entered promiscuous mode [ 481.829604][T14153] ipvlan1: left promiscuous mode [ 481.855854][T14154] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2771'. [ 481.970639][T14156] FAULT_INJECTION: forcing a failure. [ 481.970639][T14156] name failslab, interval 1, probability 0, space 0, times 0 [ 481.970714][T14156] CPU: 0 UID: 0 PID: 14156 Comm: syz.0.2772 Tainted: G L syzkaller #0 PREEMPT(full) [ 481.970737][T14156] Tainted: [L]=SOFTLOCKUP [ 481.970743][T14156] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 481.970752][T14156] Call Trace: [ 481.970759][T14156] [ 481.970766][T14156] dump_stack_lvl+0xe8/0x150 [ 481.970794][T14156] should_fail_ex+0x410/0x560 [ 481.970825][T14156] should_failslab+0xa8/0x100 [ 481.970845][T14156] __kmalloc_cache_noprof+0xa3/0x600 [ 481.970870][T14156] ? sctp_auth_asoc_copy_shkeys+0x14e/0x5a0 [ 481.971000][T14156] ? sctp_auth_asoc_copy_shkeys+0x14e/0x5a0 [ 481.971025][T14156] sctp_auth_asoc_copy_shkeys+0x14e/0x5a0 [ 481.971053][T14156] ? sctp_stream_interleave_init+0x55/0x90 [ 481.971077][T14156] sctp_association_new+0x15be/0x25d0 [ 481.971163][T14156] sctp_connect_new_asoc+0x2e4/0x6b0 [ 481.971237][T14156] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 481.971266][T14156] ? __local_bh_enable_ip+0xd6/0x140 [ 481.971285][T14156] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 481.971306][T14156] ? security_sctp_bind_connect+0x7e/0x2c0 [ 481.971331][T14156] sctp_sendmsg+0x159b/0x2d00 [ 481.971366][T14156] ? __pfx_sctp_sendmsg+0x10/0x10 [ 481.971390][T14156] ? lock_acquire+0x115/0x350 [ 481.971420][T14156] ? aa_sock_msg_perm+0xfc/0x210 [ 481.971469][T14156] ? sock_rps_record_flow+0x19/0x350 [ 481.971571][T14156] ? inet_sendmsg+0x298/0x320 [ 481.971592][T14156] ? __pfx_inet_sendmsg+0x10/0x10 [ 481.971611][T14156] sock_sendmsg_nosec+0x10e/0x180 [ 481.971666][T14156] __sys_sendto+0x408/0x5a0 [ 481.971687][T14156] ? __pfx___sys_sendto+0x10/0x10 [ 481.971715][T14156] ? __fget_files+0x3a2/0x420 [ 481.971744][T14156] ? ksys_write+0x242/0x270 [ 481.971771][T14156] __ia32_sys_sendto+0xdd/0x100 [ 481.971790][T14156] __do_fast_syscall_32+0x27a/0x6a0 [ 481.971808][T14156] ? do_fast_syscall_32+0x33/0x70 [ 481.971823][T14156] ? asm_int80_emulation+0x1a/0x20 [ 481.971838][T14156] ? do_int80_emulation+0x299/0x500 [ 481.971857][T14156] do_fast_syscall_32+0x33/0x70 [ 481.971873][T14156] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 481.971892][T14156] RIP: 0023:0xf6fef0ec [ 481.971907][T14156] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 481.971921][T14156] RSP: 002b:00000000f53dd50c EFLAGS: 00000206 ORIG_RAX: 0000000000000171 [ 481.971939][T14156] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000300 [ 481.971951][T14156] RDX: 000000000000fffd RSI: 0000000000008090 RDI: 0000000080000380 [ 481.971961][T14156] RBP: 0000000000000010 R08: 0000000000000000 R09: 0000000000000000 [ 481.971972][T14156] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 481.971981][T14156] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 481.972006][T14156] [ 482.136121][T14158] syzkaller0: entered promiscuous mode [ 482.136141][T14158] syzkaller0: entered allmulticast mode [ 482.153818][T14158] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 482.153843][T14158] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 482.156974][T14158] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 482.157016][T14158] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 482.238140][ T189] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 482.238200][ T189] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 482.348048][T12250] usb 3-1: USB disconnect, device number 114 [ 482.419626][T14161] kvm: user requested TSC rate below hardware speed [ 482.534121][ T30] audit: type=1400 audit(1788665499.843:3444): apparmor="DENIED" operation="setprocattr" info="invalid" error=-22 profile="unconfined" pid=14163 comm="syz.2.2775" [ 482.549459][T14166] FAULT_INJECTION: forcing a failure. [ 482.549459][T14166] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 482.549493][T14166] CPU: 1 UID: 0 PID: 14166 Comm: syz.0.2776 Tainted: G L syzkaller #0 PREEMPT(full) [ 482.549517][T14166] Tainted: [L]=SOFTLOCKUP [ 482.549524][T14166] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 482.549536][T14166] Call Trace: [ 482.549544][T14166] [ 482.549552][T14166] dump_stack_lvl+0xe8/0x150 [ 482.549583][T14166] should_fail_ex+0x410/0x560 [ 482.549615][T14166] _copy_from_iter+0x1d3/0x1660 [ 482.549642][T14166] ? __alloc_skb+0x27a/0x7a0 [ 482.549744][T14166] ? __alloc_skb+0x27a/0x7a0 [ 482.549764][T14166] ? __alloc_skb+0x27a/0x7a0 [ 482.549781][T14166] ? __pfx__copy_from_iter+0x10/0x10 [ 482.549806][T14166] ? kmem_cache_alloc_node_noprof+0x1f9/0x610 [ 482.549832][T14166] ? __alloc_skb+0x27a/0x7a0 [ 482.549848][T14166] ? __alloc_skb+0x27a/0x7a0 [ 482.549869][T14166] ? netlink_sendmsg+0x650/0xb40 [ 482.549930][T14166] ? skb_put+0x112/0x210 [ 482.549950][T14166] netlink_sendmsg+0x6c0/0xb40 [ 482.549981][T14166] ? __pfx_netlink_sendmsg+0x10/0x10 [ 482.550011][T14166] ? apparmor_socket_sendmsg+0x18b/0x360 [ 482.550076][T14166] ? __pfx_netlink_sendmsg+0x10/0x10 [ 482.550098][T14166] sock_sendmsg_nosec+0x13a/0x180 [ 482.550125][T14166] ____sys_sendmsg+0x54e/0x850 [ 482.550150][T14166] ? __pfx_____sys_sendmsg+0x10/0x10 [ 482.550183][T14166] ___sys_sendmsg+0x2a5/0x360 [ 482.550203][T14166] ? __lock_acquire+0x6df/0x2e50 [ 482.550224][T14166] ? __pfx____sys_sendmsg+0x10/0x10 [ 482.550243][T14166] ? get_pid_task+0x20/0x1f0 [ 482.550261][T14166] ? get_pid_task+0x20/0x1f0 [ 482.550277][T14166] ? get_pid_task+0x20/0x1f0 [ 482.550319][T14166] ? __fget_files+0x2a/0x420 [ 482.550341][T14166] ? __fget_files+0x3a2/0x420 [ 482.550373][T14166] __sys_sendmsg+0x177/0x240 [ 482.550395][T14166] ? __pfx___sys_sendmsg+0x10/0x10 [ 482.550437][T14166] __do_fast_syscall_32+0x27a/0x6a0 [ 482.550457][T14166] ? do_fast_syscall_32+0x33/0x70 [ 482.550474][T14166] ? asm_int80_emulation+0x1a/0x20 [ 482.550492][T14166] ? do_int80_emulation+0x299/0x500 [ 482.550506][T14166] ? trace_irq_disable+0x3b/0x140 [ 482.550526][T14166] do_fast_syscall_32+0x33/0x70 [ 482.550542][T14166] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 482.550563][T14166] RIP: 0023:0xf6fef0ec [ 482.550578][T14166] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 482.550593][T14166] RSP: 002b:00000000f53dd50c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 482.550612][T14166] RAX: ffffffffffffffda RBX: 0000000000000007 RCX: 0000000080000000 [ 482.550625][T14166] RDX: 0000000020040040 RSI: 0000000000000000 RDI: 0000000000000000 [ 482.550635][T14166] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 482.550646][T14166] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 482.550656][T14166] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 482.550682][T14166] [ 482.940454][ T189] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000000. ret = -EPROTO [ 482.940521][ T189] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 482.975122][ T189] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 483.021867][ T189] lan78xx 4-1:1.0: probe with driver lan78xx failed with error -71 [ 483.043730][ T189] usb 4-1: USB disconnect, device number 113 [ 483.118591][T14176] nvme_fc: nvme_fc_parse_traddr: bad traddr string [ 483.260662][T14185] netlink: 830 bytes leftover after parsing attributes in process `syz.4.2782'. [ 483.267461][T14185] netlink: 'syz.4.2782': attribute type 14 has an invalid length. [ 483.267481][T14185] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2782'. [ 483.267506][T14185] bond0: option xmit_hash_policy: invalid value (113) [ 483.741092][T14188] fuse: Bad value for 'fd' [ 484.025646][T14190] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2784'. [ 485.222134][ T4935] Bluetooth: hci1: command 0x0c1a tx timeout [ 485.228337][T14178] Bluetooth: hci1: Opcode 0x0c1a failed: -110 [ 485.666951][T14178] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 485.676296][T14178] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 485.684327][T14178] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 485.693577][T14178] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 485.705103][T14178] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 485.711298][T14178] Bluetooth: hci5: Opcode 0x0406 failed: -4 [ 485.722981][T14178] Bluetooth: hci5: Opcode 0x0406 failed: -4 [ 485.731185][T14179] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 485.733205][T14179] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 485.829428][T14192] kvm: user requested TSC rate below hardware speed [ 485.964981][ T30] audit: type=1400 audit(1788665503.273:3445): apparmor="DENIED" operation="setprocattr" info="invalid" error=-22 profile="unconfined" pid=14198 comm="syz.2.2787" [ 485.992419][ T5731] usb 2-1: new full-speed USB device number 111 using dummy_hcd [ 486.041331][T14204] FAULT_INJECTION: forcing a failure. [ 486.041331][T14204] name failslab, interval 1, probability 0, space 0, times 0 [ 486.055190][T14204] CPU: 1 UID: 0 PID: 14204 Comm: syz.3.2789 Tainted: G L syzkaller #0 PREEMPT(full) [ 486.055221][T14204] Tainted: [L]=SOFTLOCKUP [ 486.055228][T14204] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 486.055239][T14204] Call Trace: [ 486.055247][T14204] [ 486.055256][T14204] dump_stack_lvl+0xe8/0x150 [ 486.055287][T14204] should_fail_ex+0x410/0x560 [ 486.055319][T14204] ? __alloc_skb+0x1db/0x7a0 [ 486.055337][T14204] should_failslab+0xa8/0x100 [ 486.055362][T14204] ? __alloc_skb+0x1db/0x7a0 [ 486.055377][T14204] kmem_cache_alloc_node_noprof+0xa1/0x610 [ 486.055405][T14204] ? __alloc_skb+0x18d/0x7a0 [ 486.055422][T14204] ? __alloc_skb+0x1db/0x7a0 [ 486.055446][T14204] __alloc_skb+0x1db/0x7a0 [ 486.055520][T14204] netlink_sendmsg+0x5d4/0xb40 [ 486.055553][T14204] ? __pfx_netlink_sendmsg+0x10/0x10 [ 486.055584][T14204] ? apparmor_socket_sendmsg+0x98/0x360 [ 486.055614][T14204] ? __pfx_netlink_sendmsg+0x10/0x10 [ 486.055636][T14204] sock_sendmsg_nosec+0x13a/0x180 [ 486.055665][T14204] ____sys_sendmsg+0x54e/0x850 [ 486.055691][T14204] ? __pfx_____sys_sendmsg+0x10/0x10 [ 486.055726][T14204] ___sys_sendmsg+0x2a5/0x360 [ 486.055746][T14204] ? __lock_acquire+0x6df/0x2e50 [ 486.055767][T14204] ? __pfx____sys_sendmsg+0x10/0x10 [ 486.055786][T14204] ? get_pid_task+0x20/0x1f0 [ 486.055804][T14204] ? get_pid_task+0x20/0x1f0 [ 486.055820][T14204] ? get_pid_task+0x20/0x1f0 [ 486.055864][T14204] ? __fget_files+0x2a/0x420 [ 486.055887][T14204] ? __fget_files+0x3a2/0x420 [ 486.055919][T14204] __sys_sendmsg+0x177/0x240 [ 486.055943][T14204] ? __pfx___sys_sendmsg+0x10/0x10 [ 486.055980][T14204] __do_fast_syscall_32+0x27a/0x6a0 [ 486.056001][T14204] ? do_fast_syscall_32+0x33/0x70 [ 486.056018][T14204] ? asm_int80_emulation+0x1a/0x20 [ 486.056036][T14204] ? do_int80_emulation+0x299/0x500 [ 486.056053][T14204] ? trace_irq_disable+0x3b/0x140 [ 486.056075][T14204] do_fast_syscall_32+0x33/0x70 [ 486.056094][T14204] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 486.056117][T14204] RIP: 0023:0xf6fdf0ec [ 486.056134][T14204] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 486.056150][T14204] RSP: 002b:00000000f53cd50c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 486.056171][T14204] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 0000000080000000 [ 486.056184][T14204] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 486.056195][T14204] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 486.056206][T14204] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 486.056217][T14204] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 486.056244][T14204] [ 486.215866][ T5731] usb 2-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 486.232766][T14209] loop0: detected capacity change from 0 to 14776 [ 486.243192][ T5731] usb 2-1: config index 0 descriptor too short (expected 23569, got 27) [ 486.243241][ T5731] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x4D, changing to 0xD [ 486.243265][ T5731] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0xD has invalid wMaxPacketSize 0 [ 486.292789][ T5731] usb 2-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 486.292815][ T5731] usb 2-1: Manufacturer: syz [ 486.308359][T14209] ldm_parse_privhead(): Expected PRIVHEAD version 2.11 or 2.12, got 0.0. Aborting. [ 486.308383][T14209] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 486.308436][T14209] loop0: [ 486.426970][ T5731] usb 2-1: config 0 descriptor?? [ 486.447925][ T5731] igorplugusb 2-1:0.0: endpoint incorrect [ 486.656371][ T5704] usb 2-1: USB disconnect, device number 111 [ 486.685748][T14218] netlink: 48 bytes leftover after parsing attributes in process `syz.0.2793'. [ 486.931334][T14222] netlink: 'syz.4.2795': attribute type 4 has an invalid length. [ 487.031470][T14223] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 487.036568][T14223] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 487.089390][T14226] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2796'. [ 487.089453][T14226] netlink: 'syz.2.2796': attribute type 30 has an invalid length. [ 487.111281][T14227] kvm: user requested TSC rate below hardware speed [ 487.138682][T14226] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2796'. [ 487.138742][T14226] netlink: 'syz.2.2796': attribute type 30 has an invalid length. [ 487.152143][ T5767] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 487.152184][ T5767] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 487.152280][ T5767] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 487.152312][ T5767] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 487.261306][T14229] netlink: 'syz.3.2797': attribute type 10 has an invalid length. [ 487.285812][T14229] 8021q: adding VLAN 0 to HW filter on device team0 [ 487.302092][ T4935] Bluetooth: hci3: command 0x0c1a tx timeout [ 487.339616][T14229] bond0: (slave team0): Enslaving as an active interface with an up link [ 487.358032][T14229] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2797'. [ 487.358081][T14229] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2797'. [ 487.384667][ T5782] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 487.389915][T14238] netlink: 'syz.2.2799': attribute type 10 has an invalid length. [ 487.401514][ T5769] netdevsim netdevsim2 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 487.401575][ T5769] netdevsim netdevsim2 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 487.401618][ T5769] netdevsim netdevsim2 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 487.412150][ T5782] netdevsim netdevsim2 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 487.416036][T14238] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2799'. [ 487.416058][T14238] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2799'. [ 487.476436][T14239] nvme_fc: nvme_fc_parse_traddr: bad traddr string [ 487.552085][ T5731] usb 2-1: new high-speed USB device number 112 using dummy_hcd [ 487.702159][ T4935] Bluetooth: hci4: command 0x0406 tx timeout [ 487.702179][ T5615] Bluetooth: hci2: command 0x0c1a tx timeout [ 487.703040][ T5731] usb 2-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 487.704325][ T5731] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 487.704366][ T5731] usb 2-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 487.704402][ T5731] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 487.709532][ T5731] usb 2-1: config 0 descriptor?? [ 487.717599][ T5731] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 487.782149][ T4935] Bluetooth: hci5: command 0x0c1a tx timeout [ 487.914766][ T5731] usb 2-1: USB disconnect, device number 112 [ 488.040783][T14244] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2804'. [ 488.045021][ T5729] hid-generic 0000:0000:0000.005C: unknown main item tag 0x0 [ 488.051832][ T5729] hid-generic 0000:0000:0000.005C: hidraw0: HID v0.00 Device [syz1] on syz0 [ 488.362355][ T5731] usb 2-1: new high-speed USB device number 113 using dummy_hcd [ 488.513066][ T5731] usb 2-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice= 1.00 [ 488.514186][ T5731] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 488.514230][ T5731] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 488.514252][ T5731] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 0 [ 488.514272][ T5731] usb 2-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 488.516484][ T5731] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 488.516505][ T5731] usb 2-1: Product: syz [ 488.516519][ T5731] usb 2-1: Manufacturer: syz [ 488.516532][ T5731] usb 2-1: SerialNumber: syz [ 488.725205][ T5731] usb 2-1: USB disconnect, device number 113 [ 489.374684][T14258] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2808'. [ 489.387841][T14259] loop0: detected capacity change from 0 to 10234 [ 489.397000][T14258] tipc: Enabled bearer , priority 10 [ 489.399965][T14258] fuse: Bad value for 'user_id' [ 489.399982][T14258] fuse: Bad value for 'user_id' [ 489.455191][T14259] ldm_parse_privhead(): Expected PRIVHEAD version 2.11 or 2.12, got 0.0. Aborting. [ 489.465232][T14259] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 489.465318][T14259] loop0: [ 489.607191][T14261] netlink: 'syz.3.2809': attribute type 4 has an invalid length. [ 489.698310][T14265] kvm: user requested TSC rate below hardware speed [ 489.763386][ T4985] ldm_parse_privhead(): Expected PRIVHEAD version 2.11 or 2.12, got 0.0. Aborting. [ 489.773421][ T4985] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 489.780216][ T4985] loop0: [ 489.783473][ T4935] Bluetooth: hci4: command 0x0406 tx timeout [ 489.862352][ T4935] Bluetooth: hci5: command 0x0c1a tx timeout [ 489.943644][T12250] usb 4-1: new high-speed USB device number 114 using dummy_hcd [ 490.112065][T12250] usb 4-1: Using ep0 maxpacket: 32 [ 490.112895][T12250] usb 4-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 490.114166][T12250] usb 4-1: config index 0 descriptor too short (expected 156, got 27) [ 490.114200][T12250] usb 4-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 490.114239][T12250] usb 4-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 490.114263][T12250] usb 4-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144 [ 490.114287][T12250] usb 4-1: config 0 interface 0 has no altsetting 0 [ 490.116240][T12250] usb 4-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 490.116262][T12250] usb 4-1: Product: syz [ 490.116276][T12250] usb 4-1: Manufacturer: syz [ 490.116290][T12250] usb 4-1: SerialNumber: syz [ 490.125991][T12250] usb 4-1: config 0 descriptor?? [ 490.135850][T12250] ldusb 4-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 490.143412][T12250] ldusb 4-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 490.286532][T14283] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 490.300299][T14283] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 490.314149][ T31] usb 3-1: new high-speed USB device number 115 using dummy_hcd [ 490.347252][T14267] netlink: 'syz.3.2811': attribute type 1 has an invalid length. [ 490.364524][ T30] audit: type=1400 audit(1788665507.673:3446): apparmor="DENIED" operation="stack_onexec" class="file" info="label not found" error=-2 profile="unconfined" name=3A202020202030202020313720202020302020202030202020202030202020202020203020202020202020202020300A65727370616E303A202020202020203020202020202020302020202030202020203020202020302020202020302020202020202020202030202020202020202020302020202020202020302020202020202030202020313720202020312020202030202020202030202020202020203020202020202020202020300A69705F767469303A202020202020203020202020202020302020203139202020313920202020302020202020302020202020202020202030202020202020202020302020202020202020302020202020202030202020203020202020302020202030202020202030202020202020203020202020202020202020300A6970365F767469303A202020202020203020202020202020302020202030202020203020202020302020202020302020202020202020202030202020202020202020302020202020202020302020202020202030202020203920202020392020202030202020202030202020202020203920202020202020202020300A2020736974303A202020 [ 490.403888][T14285] batadv_slave_0: Caught tx_queue_len zero misconfig [ 490.406514][T14285] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2818'. [ 490.506323][ T31] usb 3-1: New USB device found, idVendor=7de0, idProduct=676e, bcdDevice=77.db [ 490.506384][ T31] usb 3-1: too many configurations: 164, using maximum allowed: 8 [ 490.519152][T14283] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 490.527886][T14283] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 490.533555][ T31] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 490.545261][ T31] usb 3-1: config 0 descriptor?? [ 490.623606][T14291] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2819'. [ 490.842240][ T189] usb 2-1: new full-speed USB device number 114 using dummy_hcd [ 490.895001][ T5704] usb 3-1: USB disconnect, device number 115 [ 490.995125][ T189] usb 2-1: unable to get BOS descriptor or descriptor too short [ 491.004052][ T189] usb 2-1: not running at top speed; connect to a high speed hub [ 491.012067][ T189] usb 2-1: New USB device found, idVendor=200c, idProduct=1018, bcdDevice= 0.40 [ 491.016096][T14307] loop0: detected capacity change from 0 to 9112 [ 491.029456][ T189] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 491.041797][ T189] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 491.054017][ T189] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 491.062239][ T189] usb 2-1: Product: syz [ 491.062259][ T189] usb 2-1: Manufacturer: syz [ 491.062273][ T189] usb 2-1: SerialNumber: syz [ 491.066868][T14307] ldm_parse_privhead(): Expected PRIVHEAD version 2.11 or 2.12, got 0.0. Aborting. [ 491.066892][T14307] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 491.066968][T14307] loop0: [ 491.337226][ T189] usb 2-1: 3:0: failed to get current value for ch 1 (-71) [ 491.352659][ T189] usb 2-1: 3:0: failed to get current value for ch 2 (-71) [ 491.367560][ T189] usb 2-1: 3:0: failed to get current value for ch 0 (-71) [ 491.386406][ T189] usb 2-1: 3:0: failed to get current value for ch 1 (-71) [ 491.410721][ T189] usb 2-1: 3:0: failed to get current value for ch 0 (-71) [ 491.421099][ T189] usb 2-1: 3:0: cannot get min/max values for control 11 (id 3) [ 491.434933][ T4985] ldm_parse_privhead(): Expected PRIVHEAD version 2.11 or 2.12, got 0.0. Aborting. [ 491.445911][ T4985] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 491.453172][ T4985] loop0: [ 491.510914][ T189] usb 2-1: USB disconnect, device number 114 [ 491.579002][ T5613] udevd[5613]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 491.942309][ T4935] Bluetooth: hci5: command 0x0c1a tx timeout [ 492.165802][T14336] input: syz0 as /devices/virtual/input/input110 [ 492.240999][T14340] bond0: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 492.781456][ T189] usb 4-1: USB disconnect, device number 114 [ 492.795994][ T189] ldusb 4-1:0.0: LD USB Device #0 now disconnected [ 493.007370][T14349] loop0: detected capacity change from 0 to 6 [ 493.055682][T14349] ldm_validate_privheads(): Disk read failed. [ 493.055753][T14349] loop0: [ 493.055769][T14349] loop0: partition table partially beyond EOD, truncated [ 493.329273][ T30] audit: type=1400 audit(1788665510.633:3447): apparmor="DENIED" operation="setprocattr" info="invalid" error=-22 profile="unconfined" pid=14352 comm="syz.2.2837" [ 493.458620][T14356] syzkaller1: entered promiscuous mode [ 493.458673][T14356] syzkaller1: entered allmulticast mode [ 493.623313][T12250] usb 4-1: new high-speed USB device number 115 using dummy_hcd [ 493.639940][T14351] netlink: 'syz.4.2836': attribute type 12 has an invalid length. [ 493.775001][T12250] usb 4-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 493.779678][T12250] usb 4-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 493.779707][T12250] usb 4-1: config 1 has an invalid descriptor of length 255, skipping remainder of the config [ 493.779725][T12250] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 493.779774][T12250] usb 4-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 493.781460][T12250] usb 4-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 493.781482][T12250] usb 4-1: Product: syz [ 493.781496][T12250] usb 4-1: Manufacturer: syz [ 493.793079][T12250] cdc_wdm 4-1:1.0: probe with driver cdc_wdm failed with error -22 [ 494.036936][T14357] input input111: cannot allocate more than FF_MAX_EFFECTS effects [ 494.060518][T12250] usb 4-1: USB disconnect, device number 115 [ 494.148039][T14382] loop0: detected capacity change from 0 to 6 [ 494.166077][T14382] ldm_validate_privheads(): Disk read failed. [ 494.166140][T14382] loop0: [ 494.166160][T14382] loop0: partition table partially beyond EOD, truncated [ 494.473759][ T30] audit: type=1400 audit(1788665511.783:3448): apparmor="DENIED" operation="setprocattr" info="invalid" error=-22 profile="unconfined" pid=14392 comm="syz.1.2853" [ 494.673874][T14400] __nla_validate_parse: 4 callbacks suppressed [ 494.674070][T14400] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2856'. [ 494.744760][T14405] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 494.754880][T14405] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 494.759717][T14404] loop0: detected capacity change from 0 to 6 [ 494.803932][T14404] ldm_validate_privheads(): Disk read failed. [ 494.804012][T14404] loop0: [ 494.804033][T14404] loop0: partition table partially beyond EOD, truncated [ 494.958210][T14394] netlink: 'syz.2.2854': attribute type 12 has an invalid length. [ 495.020417][T14411] FAULT_INJECTION: forcing a failure. [ 495.020417][T14411] name failslab, interval 1, probability 0, space 0, times 0 [ 495.020473][T14411] CPU: 0 UID: 0 PID: 14411 Comm: syz.3.2860 Tainted: G L syzkaller #0 PREEMPT(full) [ 495.020494][T14411] Tainted: [L]=SOFTLOCKUP [ 495.020499][T14411] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 495.020507][T14411] Call Trace: [ 495.020515][T14411] [ 495.020522][T14411] dump_stack_lvl+0xe8/0x150 [ 495.020551][T14411] should_fail_ex+0x410/0x560 [ 495.020581][T14411] should_failslab+0xa8/0x100 [ 495.020602][T14411] __kmalloc_cache_noprof+0xa3/0x600 [ 495.020635][T14411] ? __raw_spin_lock_init+0x45/0x100 [ 495.020653][T14411] ? fuse_direct_IO+0x3ea/0x12d0 [ 495.020748][T14411] ? fuse_direct_IO+0x3ea/0x12d0 [ 495.020768][T14411] ? __init_swait_queue_head+0xa8/0x150 [ 495.020791][T14411] fuse_direct_IO+0x3ea/0x12d0 [ 495.020815][T14411] ? filemap_write_and_wait_range+0x1e9/0x3f0 [ 495.020842][T14411] ? __pfx_fuse_xattr_get+0x10/0x10 [ 495.020861][T14411] ? __vfs_getxattr+0x412/0x440 [ 495.020886][T14411] ? __pfx_fuse_direct_IO+0x10/0x10 [ 495.020904][T14411] ? cap_inode_need_killpriv+0x51/0x60 [ 495.020987][T14411] ? bpf_lsm_inode_need_killpriv+0x9/0x20 [ 495.021005][T14411] ? security_inode_need_killpriv+0x71/0x240 [ 495.021026][T14411] ? file_remove_privs_flags+0x49b/0x610 [ 495.021049][T14411] ? lock_acquire+0x115/0x350 [ 495.021077][T14411] ? down_write+0x16b/0x200 [ 495.021136][T14411] generic_file_direct_write+0x1d0/0x3f0 [ 495.021163][T14411] fuse_file_write_iter+0xd16/0x11b0 [ 495.021186][T14411] ? __lock_acquire+0x6df/0x2e50 [ 495.021205][T14411] ? __pfx_stack_trace_save+0x10/0x10 [ 495.021229][T14411] ? __pfx_fuse_file_write_iter+0x10/0x10 [ 495.021248][T14411] ? kmem_cache_alloc_noprof+0x81/0x600 [ 495.021271][T14411] ? stack_depot_save_flags+0x33/0x7f0 [ 495.021328][T14411] ? count_memcg_event_mm+0x21/0x260 [ 495.021348][T14411] ? io_submit_one+0x134/0x13d0 [ 495.021364][T14411] ? kmem_cache_alloc_noprof+0x156/0x600 [ 495.021387][T14411] ? kasan_save_track+0x4f/0x80 [ 495.021402][T14411] ? kasan_save_track+0x3e/0x80 [ 495.021419][T14411] ? lock_acquire+0x115/0x350 [ 495.021439][T14411] ? aio_write+0x54a/0x870 [ 495.021458][T14411] aio_write+0x5d0/0x870 [ 495.021481][T14411] ? __pfx_aio_write+0x10/0x10 [ 495.021527][T14411] io_submit_one+0x798/0x13d0 [ 495.021549][T14411] ? lockdep_hardirqs_on+0x7b/0x110 [ 495.021573][T14411] ? irqentry_exit+0x218/0x910 [ 495.021613][T14411] ? __pfx_io_submit_one+0x10/0x10 [ 495.021637][T14411] ? lock_acquire+0x115/0x350 [ 495.021669][T14411] ? __might_fault+0xaf/0x130 [ 495.021697][T14411] __ia32_compat_sys_io_submit+0x1e1/0x390 [ 495.021728][T14411] ? __pfx___ia32_compat_sys_io_submit+0x10/0x10 [ 495.021771][T14411] __do_fast_syscall_32+0x27a/0x6a0 [ 495.021790][T14411] ? do_fast_syscall_32+0x33/0x70 [ 495.021808][T14411] ? asm_int80_emulation+0x1a/0x20 [ 495.021825][T14411] ? do_int80_emulation+0x299/0x500 [ 495.021847][T14411] do_fast_syscall_32+0x33/0x70 [ 495.021866][T14411] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 495.021887][T14411] RIP: 0023:0xf6fdf0ec [ 495.021904][T14411] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 495.021920][T14411] RSP: 002b:00000000f53cd50c EFLAGS: 00000206 ORIG_RAX: 00000000000000f8 [ 495.021939][T14411] RAX: ffffffffffffffda RBX: 00000000f5383000 RCX: 0000000000000001 [ 495.021952][T14411] RDX: 0000000080000700 RSI: 0000000000000000 RDI: 0000000000000000 [ 495.021964][T14411] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 495.021975][T14411] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 495.021986][T14411] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 495.022013][T14411] [ 495.439176][T14420] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 495.453389][T14420] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 495.557835][T14424] nvme_fc: nvme_fc_parse_traddr: bad traddr string [ 495.770064][T14433] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2867'. [ 495.802147][ T189] usb 4-1: new high-speed USB device number 116 using dummy_hcd [ 495.837551][T14434] loop5: detected capacity change from 0 to 65536 [ 495.896619][T14434] loop5: detected capacity change from 65536 to 524287995 [ 495.954364][ T189] usb 4-1: Using ep0 maxpacket: 32 [ 495.961944][ T189] usb 4-1: unable to get BOS descriptor or descriptor too short [ 495.963087][ T189] usb 4-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 495.964023][ T189] usb 4-1: config 14 has an invalid interface number: 57 but max is 1 [ 495.964044][ T189] usb 4-1: config 14 has an invalid interface number: 228 but max is 1 [ 495.964062][ T189] usb 4-1: config 14 has no interface number 0 [ 495.964077][ T189] usb 4-1: config 14 has no interface number 1 [ 495.964132][ T189] usb 4-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 495.964154][ T189] usb 4-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 495.964176][ T189] usb 4-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 495.964199][ T189] usb 4-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 495.964224][ T189] usb 4-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 495.964408][ T189] usb 4-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 495.964433][ T189] usb 4-1: config 14 interface 57 has no altsetting 0 [ 495.964451][ T189] usb 4-1: config 14 interface 228 has no altsetting 0 [ 495.966353][ T189] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 495.966374][ T189] usb 4-1: Product: syz [ 495.966387][ T189] usb 4-1: Manufacturer: syz [ 495.966400][ T189] usb 4-1: SerialNumber: syz [ 496.237215][T14438] FAULT_INJECTION: forcing a failure. [ 496.237215][T14438] name failslab, interval 1, probability 0, space 0, times 0 [ 496.237252][T14438] CPU: 0 UID: 0 PID: 14438 Comm: syz.2.2869 Tainted: G L syzkaller #0 PREEMPT(full) [ 496.237279][T14438] Tainted: [L]=SOFTLOCKUP [ 496.237287][T14438] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 496.237296][T14438] Call Trace: [ 496.237302][T14438] [ 496.237310][T14438] dump_stack_lvl+0xe8/0x150 [ 496.237338][T14438] should_fail_ex+0x410/0x560 [ 496.237369][T14438] ? __alloc_skb+0x1db/0x7a0 [ 496.237387][T14438] should_failslab+0xa8/0x100 [ 496.237410][T14438] ? __alloc_skb+0x1db/0x7a0 [ 496.237425][T14438] kmem_cache_alloc_node_noprof+0xa1/0x610 [ 496.237449][T14438] ? __alloc_skb+0x18d/0x7a0 [ 496.237466][T14438] ? __alloc_skb+0x1db/0x7a0 [ 496.237489][T14438] __alloc_skb+0x1db/0x7a0 [ 496.237511][T14438] sock_wmalloc+0xb2/0x130 [ 496.237534][T14438] l2tp_ip_sendmsg+0x1c3/0x1630 [ 496.237643][T14438] ? sock_rps_record_flow+0x19/0x350 [ 496.237669][T14438] ? inet_sendmsg+0x298/0x320 [ 496.237697][T14438] ? apparmor_socket_sendmsg+0x98/0x360 [ 496.237728][T14438] ? __pfx_inet_sendmsg+0x10/0x10 [ 496.237750][T14438] sock_sendmsg_nosec+0x10e/0x180 [ 496.237778][T14438] ____sys_sendmsg+0x54e/0x850 [ 496.237803][T14438] ? __pfx_____sys_sendmsg+0x10/0x10 [ 496.237830][T14438] ? kfree+0x4d/0x650 [ 496.237859][T14438] ___sys_sendmsg+0x2a5/0x360 [ 496.237878][T14438] ? __lock_acquire+0x6df/0x2e50 [ 496.237899][T14438] ? __pfx____sys_sendmsg+0x10/0x10 [ 496.237924][T14438] ? kstrtoull+0x137/0x1d0 [ 496.238026][T14438] __sys_sendmmsg+0x2de/0x4d0 [ 496.238052][T14438] ? __pfx___sys_sendmmsg+0x10/0x10 [ 496.238098][T14438] ? fput+0xa0/0xd0 [ 496.238118][T14438] ? ksys_write+0x242/0x270 [ 496.238150][T14438] __ia32_compat_sys_sendmmsg+0xa2/0xc0 [ 496.238177][T14438] __do_fast_syscall_32+0x27a/0x6a0 [ 496.238196][T14438] ? do_fast_syscall_32+0x33/0x70 [ 496.238213][T14438] ? asm_int80_emulation+0x1a/0x20 [ 496.238230][T14438] ? do_int80_emulation+0x299/0x500 [ 496.238247][T14438] ? trace_irq_disable+0x3b/0x140 [ 496.238269][T14438] do_fast_syscall_32+0x33/0x70 [ 496.238288][T14438] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 496.238310][T14438] RIP: 0023:0xf7fa90ec [ 496.238326][T14438] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 496.238342][T14438] RSP: 002b:00000000f546650c EFLAGS: 00000206 ORIG_RAX: 0000000000000159 [ 496.238361][T14438] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000900 [ 496.238374][T14438] RDX: 00000000040000cf RSI: 0000000000000000 RDI: 0000000000000000 [ 496.238385][T14438] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 496.238396][T14438] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 496.238407][T14438] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 496.238434][T14438] [ 496.371906][T14441] loop0: detected capacity change from 0 to 3144 [ 496.403970][ T189] legousbtower 4-1:14.57: interrupt endpoints not found [ 496.438771][T14441] ldm_parse_privhead(): Cannot find PRIVHEAD structure. LDM database is corrupt. Aborting. [ 496.438793][T14441] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 496.438848][T14441] loop0: [ 496.814997][ T4985] ldm_parse_privhead(): Cannot find PRIVHEAD structure. LDM database is corrupt. Aborting. [ 496.825989][ T4985] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 496.826065][ T4985] loop0: [ 496.840721][ T189] legousbtower 4-1:14.228: get version request failed: -121 [ 496.840907][ T189] legousbtower 4-1:14.228: probe with driver legousbtower failed with error -121 [ 497.124332][ T30] audit: type=1800 audit(1788665514.433:3449): pid=14452 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.2873" name="SYSV00000000" dev="tmpfs" ino=2 res=0 errno=0 [ 497.181712][ T30] audit: type=1326 audit(1788665514.483:3450): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14455 comm="syz.2.2875" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf7fa90ec code=0x0 [ 497.335419][ T30] audit: type=1326 audit(1788665514.643:3451): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14461 comm="syz.1.2877" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f940ec code=0x7ffc0000 [ 497.352211][ T30] audit: type=1326 audit(1788665514.643:3452): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14461 comm="syz.1.2877" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f940ec code=0x7ffc0000 [ 497.383152][ T30] audit: type=1326 audit(1788665514.693:3453): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14461 comm="syz.1.2877" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=386 compat=1 ip=0xf7f940ec code=0x7ffc0000 [ 497.383349][ T30] audit: type=1326 audit(1788665514.693:3454): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14461 comm="syz.1.2877" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f940ec code=0x7ffc0000 [ 497.383612][ T30] audit: type=1326 audit(1788665514.693:3455): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14461 comm="syz.1.2877" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f940ec code=0x7ffc0000 [ 497.384455][ T30] audit: type=1326 audit(1788665514.693:3456): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14461 comm="syz.1.2877" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=357 compat=1 ip=0xf7f940ec code=0x7ffc0000 [ 498.134275][T14473] netlink: 'syz.2.2880': attribute type 10 has an invalid length. [ 498.145185][T14473] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2880'. [ 498.145212][T14473] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2880'. [ 498.570088][ T5738] usb 4-1: USB disconnect, device number 116 [ 498.655163][T14478] FAULT_INJECTION: forcing a failure. [ 498.655163][T14478] name failslab, interval 1, probability 0, space 0, times 0 [ 498.655218][T14478] CPU: 1 UID: 0 PID: 14478 Comm: syz.0.2881 Tainted: G L syzkaller #0 PREEMPT(full) [ 498.655245][T14478] Tainted: [L]=SOFTLOCKUP [ 498.655251][T14478] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 498.655262][T14478] Call Trace: [ 498.655270][T14478] [ 498.655277][T14478] dump_stack_lvl+0xe8/0x150 [ 498.655303][T14478] should_fail_ex+0x410/0x560 [ 498.655331][T14478] should_failslab+0xa8/0x100 [ 498.655353][T14478] ? __inet_bhash2_update_saddr+0x1c5/0x1f60 [ 498.655462][T14478] kmem_cache_alloc_noprof+0xa1/0x600 [ 498.655488][T14478] ? __asan_memset+0x22/0x50 [ 498.655513][T14478] ? xfrm_lookup_with_ifid+0x180f/0x1b40 [ 498.655592][T14478] ? __inet_bhash2_update_saddr+0x1c5/0x1f60 [ 498.655619][T14478] __inet_bhash2_update_saddr+0x1c5/0x1f60 [ 498.655643][T14478] ? __pfx_ip_route_output_key_hash+0x10/0x10 [ 498.655717][T14478] ? snprintf+0xe8/0x140 [ 498.655789][T14478] ? xfrm_lookup_route+0x103/0x1c0 [ 498.655817][T14478] tcp_v4_connect+0xa4b/0x1950 [ 498.655909][T14478] ? __pfx_tcp_v4_connect+0x10/0x10 [ 498.655947][T14478] __inet_stream_connect+0x258/0xe00 [ 498.655977][T14478] ? do_raw_spin_lock+0x12b/0x2f0 [ 498.656004][T14478] ? __pfx___inet_stream_connect+0x10/0x10 [ 498.656031][T14478] ? inet_stream_connect+0x51/0xa0 [ 498.656057][T14478] ? __local_bh_enable_ip+0xd6/0x140 [ 498.656085][T14478] inet_stream_connect+0x66/0xa0 [ 498.656111][T14478] __sys_connect+0x316/0x450 [ 498.656131][T14478] ? __pfx___sys_connect+0x10/0x10 [ 498.656168][T14478] __ia32_sys_connect+0x7a/0x90 [ 498.656188][T14478] __do_fast_syscall_32+0x27a/0x6a0 [ 498.656208][T14478] ? do_fast_syscall_32+0x33/0x70 [ 498.656225][T14478] ? asm_int80_emulation+0x1a/0x20 [ 498.656241][T14478] ? do_int80_emulation+0x299/0x500 [ 498.656257][T14478] ? trace_irq_disable+0x3b/0x140 [ 498.656279][T14478] do_fast_syscall_32+0x33/0x70 [ 498.656298][T14478] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 498.656319][T14478] RIP: 0023:0xf6fef0ec [ 498.656335][T14478] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 498.656350][T14478] RSP: 002b:00000000f53dd50c EFLAGS: 00000206 ORIG_RAX: 000000000000016a [ 498.656369][T14478] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000080000180 [ 498.656383][T14478] RDX: 0000000000000010 RSI: 0000000000000000 RDI: 0000000000000000 [ 498.656394][T14478] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 498.656404][T14478] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 498.656416][T14478] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 498.656443][T14478] [ 498.675150][T14478] program syz.0.2881 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 498.743470][T14479] fuse: Unknown parameter '' [ 498.922738][ T189] usb 2-1: new high-speed USB device number 115 using dummy_hcd [ 499.072661][ T189] usb 2-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 499.073645][ T189] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 499.073668][ T189] usb 2-1: config 1 has an invalid descriptor of length 255, skipping remainder of the config [ 499.073686][ T189] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 499.073736][ T189] usb 2-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 499.075143][ T189] usb 2-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 499.075165][ T189] usb 2-1: Product: syz [ 499.075178][ T189] usb 2-1: Manufacturer: syz [ 499.082349][ T189] cdc_wdm 2-1:1.0: skipping garbage [ 499.085622][ T189] cdc_wdm 2-1:1.0: probe with driver cdc_wdm failed with error -22 [ 499.092247][ T5738] usb 4-1: new high-speed USB device number 117 using dummy_hcd [ 499.244005][ T5738] usb 4-1: unable to get BOS descriptor or descriptor too short [ 499.244065][ T5738] usb 4-1: New USB device found, idVendor=0441, idProduct=4248, bcdDevice= 0.40 [ 499.245387][ T5738] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 499.245433][ T5738] usb 4-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 499.248047][ T5738] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 499.248069][ T5738] usb 4-1: Product: syz [ 499.248083][ T5738] usb 4-1: Manufacturer: syz [ 499.248096][ T5738] usb 4-1: SerialNumber: syz [ 499.294541][T14475] input input113: cannot allocate more than FF_MAX_EFFECTS effects [ 499.317048][ T5704] usb 2-1: USB disconnect, device number 115 [ 499.537997][T14479] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=2148079185 (137477067840 ns) > initial count (37112886400 ns). Using initial count to start timer. [ 499.664447][ T5738] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 499.664638][ T5738] usb 4-1: MIDIStreaming interface descriptor not found [ 499.706460][ T5738] usb 4-1: USB disconnect, device number 117 [ 499.745594][T14493] netlink: 68 bytes leftover after parsing attributes in process `syz.0.2887'. [ 499.783881][ T5627] udevd[5627]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 499.835277][T14495] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 499.838045][T14495] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 499.842185][ T189] usb 3-1: new high-speed USB device number 116 using dummy_hcd [ 499.952081][T14495] nvme_fabrics: unknown parameter or missing value 'reconnect_delay=' in ctrl creation request [ 499.993107][ T189] usb 3-1: Using ep0 maxpacket: 16 [ 499.993916][ T189] usb 3-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 499.994974][ T189] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 499.995016][ T189] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 499.995041][ T189] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 499.995060][ T189] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 499.995081][ T189] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 499.996195][ T189] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 499.996216][ T189] usb 3-1: Manufacturer: syz [ 500.000945][ T189] usb 3-1: config 0 descriptor?? [ 500.214423][T14506] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2893'. [ 500.310830][T14511] netlink: 'syz.4.2895': attribute type 10 has an invalid length. [ 500.338826][T14511] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2895'. [ 500.338869][T14511] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2895'. [ 500.353314][ T189] rc_core: IR keymap rc-hauppauge not found [ 500.353331][ T189] Registered IR keymap rc-empty [ 500.353662][ T189] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 500.372825][ T189] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 500.394294][ T189] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0 [ 500.406162][ T189] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0/input114 [ 500.443635][T14512] nvme_fc: nvme_fc_parse_traddr: bad traddr string [ 500.455537][ T189] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 500.473864][ T189] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 500.492629][ T189] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 500.512376][ T189] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 500.534265][ T189] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 500.553718][ T189] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 500.572237][ T189] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 500.590499][T14519] hsr0: entered promiscuous mode [ 500.591859][T14519] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2896'. [ 500.594406][ T189] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 500.612242][ T5738] usb 4-1: new high-speed USB device number 118 using dummy_hcd [ 500.612733][ T189] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 500.633481][ T189] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 500.649516][ T9] hid-generic 0000:0000:0000.005D: unknown main item tag 0x0 [ 500.657663][ T189] mceusb 3-1:0.0: Registered with mce emulator interface version 1 [ 500.657683][ T189] mceusb 3-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 500.660503][ T9] hid-generic 0000:0000:0000.005D: hidraw0: HID v0.00 Device [syz1] on syz0 [ 500.668878][ T189] usb 3-1: USB disconnect, device number 116 [ 500.762743][ T5738] usb 4-1: Using ep0 maxpacket: 32 [ 500.770705][ T5738] usb 4-1: unable to get BOS descriptor or descriptor too short [ 500.770812][ T5738] usb 4-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 500.777530][ T5738] usb 4-1: config 14 has an invalid interface number: 57 but max is 1 [ 500.777555][ T5738] usb 4-1: config 14 has an invalid interface number: 228 but max is 1 [ 500.777581][ T5738] usb 4-1: config 14 has no interface number 0 [ 500.777597][ T5738] usb 4-1: config 14 has no interface number 1 [ 500.777654][ T5738] usb 4-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 500.777676][ T5738] usb 4-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 500.777699][ T5738] usb 4-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 500.777722][ T5738] usb 4-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 500.777748][ T5738] usb 4-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 500.777771][ T5738] usb 4-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 500.777794][ T5738] usb 4-1: config 14 interface 57 has no altsetting 0 [ 500.777810][ T5738] usb 4-1: config 14 interface 228 has no altsetting 0 [ 500.789792][ T5738] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 500.789817][ T5738] usb 4-1: Product: syz [ 500.789830][ T5738] usb 4-1: Manufacturer: syz [ 500.789844][ T5738] usb 4-1: SerialNumber: syz [ 501.107879][ T30] kauditd_printk_skb: 40 callbacks suppressed [ 501.107959][ T30] audit: type=1400 audit(1788665518.413:3497): apparmor="DENIED" operation="setprocattr" info="invalid" error=-22 profile="unconfined" pid=14523 comm="syz.1.2898" [ 501.227264][ T5738] legousbtower 4-1:14.57: interrupt endpoints not found [ 501.468552][ T1312] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.468627][ T1312] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.522119][ T189] usb 2-1: new high-speed USB device number 116 using dummy_hcd [ 501.628962][ T5738] legousbtower 4-1:14.228: get version request failed: -121 [ 501.629150][ T5738] legousbtower 4-1:14.228: probe with driver legousbtower failed with error -121 [ 501.673582][ T189] usb 2-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 501.674841][ T189] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 501.674865][ T189] usb 2-1: config 1 has an invalid descriptor of length 255, skipping remainder of the config [ 501.674882][ T189] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 501.674922][ T189] usb 2-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 501.677441][ T189] usb 2-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 501.677463][ T189] usb 2-1: Product: syz [ 501.677476][ T189] usb 2-1: Manufacturer: syz [ 501.685824][ T189] cdc_wdm 2-1:1.0: skipping garbage [ 501.685849][ T189] cdc_wdm 2-1:1.0: probe with driver cdc_wdm failed with error -22 [ 501.893131][T14530] input input115: cannot allocate more than FF_MAX_EFFECTS effects [ 501.910400][ T189] usb 2-1: USB disconnect, device number 116 [ 502.281326][T14541] netlink: 'syz.0.2903': attribute type 2 has an invalid length. [ 502.291961][T14541] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 502.300824][T14541] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 502.535255][ T30] audit: type=1326 audit(1788665519.843:3498): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14544 comm="syz.1.2904" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f940ec code=0x7ffc0000 [ 502.535859][ T30] audit: type=1326 audit(1788665519.843:3500): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14544 comm="syz.1.2904" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f940ec code=0x7ffc0000 [ 502.535900][ T30] audit: type=1326 audit(1788665519.843:3501): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14544 comm="syz.1.2904" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f940ec code=0x7ffc0000 [ 502.572216][ T30] audit: type=1326 audit(1788665519.843:3499): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14544 comm="syz.1.2904" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f940ec code=0x7ffc0000 [ 502.572445][ T30] audit: type=1326 audit(1788665519.883:3502): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14544 comm="syz.1.2904" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=164 compat=1 ip=0xf7f940ec code=0x7ffc0000 [ 502.572860][ T30] audit: type=1326 audit(1788665519.883:3503): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14544 comm="syz.1.2904" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f940ec code=0x7ffc0000 [ 502.572903][ T30] audit: type=1326 audit(1788665519.883:3504): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14544 comm="syz.1.2904" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f940ec code=0x7ffc0000 [ 502.573238][ T30] audit: type=1326 audit(1788665519.883:3505): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14544 comm="syz.1.2904" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f940ec code=0x7ffc0000 [ 502.573430][ T30] audit: type=1326 audit(1788665519.883:3506): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14544 comm="syz.1.2904" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f940ec code=0x7ffc0000 [ 502.862549][T14552] FAULT_INJECTION: forcing a failure. [ 502.862549][T14552] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 502.862597][T14552] CPU: 0 UID: 0 PID: 14552 Comm: syz.0.2906 Tainted: G L syzkaller #0 PREEMPT(full) [ 502.862621][T14552] Tainted: [L]=SOFTLOCKUP [ 502.862626][T14552] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 502.862635][T14552] Call Trace: [ 502.862641][T14552] [ 502.862648][T14552] dump_stack_lvl+0xe8/0x150 [ 502.862677][T14552] should_fail_ex+0x410/0x560 [ 502.862710][T14552] _copy_to_user+0x31/0xb0 [ 502.862736][T14552] simple_read_from_buffer+0xe1/0x170 [ 502.862767][T14552] proc_fail_nth_read+0x1bb/0x230 [ 502.862793][T14552] ? common_file_perm+0x20e/0x2b0 [ 502.862812][T14552] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 502.862840][T14552] ? rw_verify_area+0x24a/0x4c0 [ 502.862868][T14552] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 502.862894][T14552] vfs_read+0x213/0xa80 [ 502.862925][T14552] ? __pfx___mutex_lock+0x10/0x10 [ 502.862945][T14552] ? __pfx_vfs_read+0x10/0x10 [ 502.862972][T14552] ? __fget_files+0x2a/0x420 [ 502.862999][T14552] ? __fget_files+0x3a2/0x420 [ 502.863021][T14552] ? __fget_files+0x2a/0x420 [ 502.863053][T14552] ksys_read+0x150/0x270 [ 502.863080][T14552] ? __pfx_ksys_read+0x10/0x10 [ 502.863109][T14552] ? asm_int80_emulation+0x1a/0x20 [ 502.863133][T14552] do_int80_emulation+0x198/0x500 [ 502.863151][T14552] ? trace_irq_disable+0x3b/0x140 [ 502.863170][T14552] ? asm_int80_emulation+0x1a/0x20 [ 502.863187][T14552] ? clear_bhb_loop+0x70/0xc0 [ 502.863205][T14552] ? clear_bhb_loop+0x70/0xc0 [ 502.863227][T14552] asm_int80_emulation+0x1a/0x20 [ 502.863246][T14552] RIP: 0023:0xf71275ab [ 502.863263][T14552] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 502.863279][T14552] RSP: 002b:00000000f53dd4bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 502.863299][T14552] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00000000f53dd5d0 [ 502.863313][T14552] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 502.863324][T14552] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 502.863336][T14552] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 502.863348][T14552] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 502.863377][T14552] [ 503.109174][T14556] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2907'. [ 503.109204][T14556] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2907'. [ 503.305854][ T189] usb 4-1: USB disconnect, device number 118 [ 503.479825][T14565] loop0: detected capacity change from 0 to 6538 [ 503.515506][T14565] ldm_parse_privhead(): Cannot find PRIVHEAD structure. LDM database is corrupt. Aborting. [ 503.515545][T14565] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 503.515595][T14565] loop0: [ 503.781542][ T4985] ldm_parse_privhead(): Cannot find PRIVHEAD structure. LDM database is corrupt. Aborting. [ 503.791890][ T4985] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 503.791964][ T4985] loop0: [ 503.845003][T14569] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2912'. [ 503.849043][ T5731] hid-generic 0000:0000:0000.005E: unknown main item tag 0x0 [ 503.852344][ T5731] hid-generic 0000:0000:0000.005E: hidraw0: HID v0.00 Device [syz1] on syz0 [ 503.873950][ T189] usb 4-1: new full-speed USB device number 119 using dummy_hcd [ 504.017449][T14572] netlink: 'syz.0.2913': attribute type 10 has an invalid length. [ 504.035963][ T189] usb 4-1: unable to get BOS descriptor or descriptor too short [ 504.044090][T14572] 8021q: adding VLAN 0 to HW filter on device team0 [ 504.046797][T14572] bond0: (slave team0): Enslaving as an active interface with an up link [ 504.061302][ T189] usb 4-1: not running at top speed; connect to a high speed hub [ 504.061349][ T189] usb 4-1: New USB device found, idVendor=200c, idProduct=1018, bcdDevice= 0.40 [ 504.079658][ T189] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 504.079695][ T189] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 504.095919][T14572] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2913'. [ 504.095943][T14572] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2913'. [ 504.124409][ T189] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 504.124451][ T189] usb 4-1: Product: syz [ 504.124482][ T189] usb 4-1: Manufacturer: syz [ 504.124500][ T189] usb 4-1: SerialNumber: syz [ 504.382456][ T189] usb 4-1: 3:0: failed to get current value for ch 1 (-71) [ 504.395324][ T189] usb 4-1: 3:0: failed to get current value for ch 2 (-71) [ 504.411137][ T189] usb 4-1: 3:0: failed to get current value for ch 0 (-71) [ 504.427797][ T189] usb 4-1: 3:0: failed to get current value for ch 1 (-71) [ 504.444707][ T189] usb 4-1: 3:0: failed to get current value for ch 0 (-71) [ 504.457718][ T189] usb 4-1: 3:0: cannot get min/max values for control 11 (id 3) [ 504.526069][ T189] usb 4-1: USB disconnect, device number 119 [ 504.569901][ T6619] udevd[6619]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 504.570981][T14580] loop0: detected capacity change from 0 to 2978 [ 504.752071][T12250] usb 3-1: new high-speed USB device number 117 using dummy_hcd [ 504.912941][T12250] usb 3-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 504.914164][T12250] usb 3-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 504.914188][T12250] usb 3-1: config 1 has an invalid descriptor of length 255, skipping remainder of the config [ 504.914206][T12250] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 504.914245][T12250] usb 3-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 504.915980][T12250] usb 3-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 504.916002][T12250] usb 3-1: Product: syz [ 504.916015][T12250] usb 3-1: Manufacturer: syz [ 504.925294][T12250] cdc_wdm 3-1:1.0: skipping garbage [ 504.925316][T12250] cdc_wdm 3-1:1.0: skipping garbage [ 504.925336][T12250] cdc_wdm 3-1:1.0: probe with driver cdc_wdm failed with error -22 [ 505.165402][T14575] input input116: cannot allocate more than FF_MAX_EFFECTS effects [ 505.186338][T12250] usb 3-1: USB disconnect, device number 117 [ 505.247103][T14588] nvme_fc: nvme_fc_parse_traddr: bad traddr string [ 505.284511][ T31] usb 4-1: new high-speed USB device number 120 using dummy_hcd [ 505.442160][ T31] usb 4-1: Using ep0 maxpacket: 16 [ 505.447798][ T31] usb 4-1: New USB device found, idVendor=14f7, idProduct=0500, bcdDevice=44.85 [ 505.452703][ T31] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 505.452726][ T31] usb 4-1: Product: syz [ 505.452741][ T31] usb 4-1: Manufacturer: syz [ 505.452755][ T31] usb 4-1: SerialNumber: syz [ 505.457000][ T31] usb 4-1: config 0 descriptor?? [ 505.470231][ T31] usb 4-1: selecting invalid altsetting 1 [ 505.470249][ T31] technisat-usb2: could not set alternate setting to 0 [ 505.502384][ T5731] usb 2-1: new high-speed USB device number 117 using dummy_hcd [ 505.663811][ T5731] usb 2-1: Using ep0 maxpacket: 32 [ 505.667668][ T5731] usb 2-1: unable to get BOS descriptor or descriptor too short [ 505.667714][ T5731] usb 2-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 505.668836][ T5731] usb 2-1: config 14 has an invalid interface number: 57 but max is 1 [ 505.668858][ T5731] usb 2-1: config 14 has an invalid interface number: 228 but max is 1 [ 505.668878][ T5731] usb 2-1: config 14 has no interface number 0 [ 505.668893][ T5731] usb 2-1: config 14 has no interface number 1 [ 505.668971][ T5731] usb 2-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 505.668992][ T5731] usb 2-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 505.669013][ T5731] usb 2-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 505.669035][ T5731] usb 2-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 505.669080][ T5731] usb 2-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 505.669102][ T5731] usb 2-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 505.669122][ T5731] usb 2-1: config 14 interface 57 has no altsetting 0 [ 505.669138][ T5731] usb 2-1: config 14 interface 228 has no altsetting 0 [ 505.673562][ T5731] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 505.673607][ T5731] usb 2-1: Product: syz [ 505.673621][ T5731] usb 2-1: Manufacturer: syz [ 505.673633][ T5731] usb 2-1: SerialNumber: syz [ 505.700345][T14596] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 505.700839][T14596] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 505.845656][ T31] technisat-usb2: firmware version: 0.0 [ 505.845750][ T31] dvb-usb: found a 'Technisat SkyStar USB HD (DVB-S/S2)' in warm state. [ 506.087037][ T5731] legousbtower 2-1:14.57: interrupt endpoints not found [ 506.258025][ T31] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 506.259320][ T31] dvbdev: DVB: registering new adapter (Technisat SkyStar USB HD (DVB-S/S2)) [ 506.259392][ T31] usb 4-1: media controller created [ 506.259731][ T31] technisat-usb2: i2c-error: out failed 53 = -22 [ 506.259779][ T31] dvb-usb: MAC address reading failed. [ 506.283906][ T31] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 506.359257][T14607] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2924'. [ 506.359324][T14607] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2924'. [ 506.396749][ T31] DVB: Unable to find symbol stv090x_attach() [ 506.410222][T14605] bridge0: port 2(bridge_slave_1) entered disabled state [ 506.410865][T14605] bridge0: port 1(bridge_slave_0) entered disabled state [ 506.509899][ T5731] legousbtower 2-1:14.228: get version request failed: -121 [ 506.510121][ T5731] legousbtower 2-1:14.228: probe with driver legousbtower failed with error -121 [ 506.777250][T14618] usb 2-1: USB disconnect, device number 117 [ 506.882871][ T5769] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 506.882952][ T5769] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 506.882979][ T5769] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 506.883007][ T5769] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 506.909097][ T31] dvb-usb: no frontend was attached by 'Technisat SkyStar USB HD (DVB-S/S2)' [ 506.926634][T14599] technisat-usb2: i2c-error: out failed 41 = -22 [ 506.992166][ T31] rc_core: IR keymap rc-technisat-usb2 not found [ 506.992207][ T31] Registered IR keymap rc-empty [ 506.993516][ T31] rc rc0: Technisat SkyStar USB HD (DVB-S/S2) as /devices/platform/dummy_hcd.3/usb4/4-1/rc/rc0 [ 506.996978][ T31] input: Technisat SkyStar USB HD (DVB-S/S2) as /devices/platform/dummy_hcd.3/usb4/4-1/rc/rc0/input117 [ 507.012798][ T31] dvb-usb: schedule remote query interval to 100 msecs. [ 507.014243][ T31] dvb-usb: Technisat SkyStar USB HD (DVB-S/S2) successfully initialized and connected. [ 507.126757][ T31] dvb-usb: error -32 while querying for an remote control event. [ 507.233656][ T31] dvb-usb: error -32 while querying for an remote control event. [ 507.339929][T14632] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 507.348013][ T31] dvb-usb: error -32 while querying for an remote control event. [ 507.452549][ T31] dvb-usb: error -32 while querying for an remote control event. [ 507.519994][T14639] loop0: detected capacity change from 0 to 3514 [ 507.562941][ T31] dvb-usb: error -32 while querying for an remote control event. [ 507.672359][ T5704] usb 2-1: new full-speed USB device number 118 using dummy_hcd [ 507.678041][ T31] dvb-usb: error -32 while querying for an remote control event. [ 507.783465][T14618] dvb-usb: error -32 while querying for an remote control event. [ 507.844022][ T5704] usb 2-1: unable to get BOS descriptor or descriptor too short [ 507.852277][ T5704] usb 2-1: not running at top speed; connect to a high speed hub [ 507.852324][ T5704] usb 2-1: New USB device found, idVendor=200c, idProduct=1018, bcdDevice= 0.40 [ 507.870267][ T5704] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 507.870306][ T5704] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 507.899602][ T5704] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 507.908032][ T5704] usb 2-1: Product: syz [ 507.911295][T14611] dvb-usb: error -32 while querying for an remote control event. [ 507.920574][ T5704] usb 2-1: Manufacturer: syz [ 507.925408][ T5704] usb 2-1: SerialNumber: syz [ 508.012370][T14611] dvb-usb: error -32 while querying for an remote control event. [ 508.124081][T14611] dvb-usb: error -32 while querying for an remote control event. [ 508.147075][T14651] nvme_fc: nvme_fc_parse_traddr: bad traddr string [ 508.164481][ T5704] usb 2-1: 3:0: failed to get current value for ch 1 (-71) [ 508.169366][ T5704] usb 2-1: 3:0: failed to get current value for ch 2 (-71) [ 508.175207][ T5704] usb 2-1: 3:0: failed to get current value for ch 0 (-71) [ 508.180339][ T5704] usb 2-1: 3:0: failed to get current value for ch 1 (-71) [ 508.189445][ T5704] usb 2-1: 3:0: failed to get current value for ch 0 (-71) [ 508.190663][ T5704] usb 2-1: 3:0: cannot get min/max values for control 11 (id 3) [ 508.232374][ T31] dvb-usb: error -32 while querying for an remote control event. [ 508.249501][ T5704] usb 2-1: USB disconnect, device number 118 [ 508.252302][T13781] usb 4-1: USB disconnect, device number 120 [ 508.302969][ T6619] udevd[6619]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 508.389736][T14658] mac80211_hwsim hwsim8 syzkaller1: entered promiscuous mode [ 508.397353][T14611] usb 3-1: new high-speed USB device number 118 using dummy_hcd [ 508.397708][T14658] mac80211_hwsim hwsim8 syzkaller1: entered allmulticast mode [ 508.434288][T13781] dvb-usb: Technisat SkyStar USB HD (DVB-S/S2) successfully deinitialized and disconnected. [ 508.562093][T14611] usb 3-1: Using ep0 maxpacket: 32 [ 508.569224][T14611] usb 3-1: unable to get BOS descriptor or descriptor too short [ 508.569275][T14611] usb 3-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 508.570206][T14611] usb 3-1: config 14 has an invalid interface number: 57 but max is 1 [ 508.570228][T14611] usb 3-1: config 14 has an invalid interface number: 228 but max is 1 [ 508.570247][T14611] usb 3-1: config 14 has no interface number 0 [ 508.570262][T14611] usb 3-1: config 14 has no interface number 1 [ 508.570318][T14611] usb 3-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 508.570340][T14611] usb 3-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 508.570364][T14611] usb 3-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 508.570388][T14611] usb 3-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 508.570412][T14611] usb 3-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 508.570436][T14611] usb 3-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 508.570459][T14611] usb 3-1: config 14 interface 57 has no altsetting 0 [ 508.570475][T14611] usb 3-1: config 14 interface 228 has no altsetting 0 [ 508.573158][T14611] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 508.573179][T14611] usb 3-1: Product: syz [ 508.573192][T14611] usb 3-1: Manufacturer: syz [ 508.573206][T14611] usb 3-1: SerialNumber: syz [ 508.775544][ T30] kauditd_printk_skb: 402 callbacks suppressed [ 508.775735][ T30] audit: type=1400 audit(1788665526.083:3909): apparmor="DENIED" operation="setprocattr" info="invalid" error=-22 profile="unconfined" pid=14659 comm="syz.1.2939" [ 508.780224][T14660] lo: Caught tx_queue_len zero misconfig [ 508.991925][T14611] legousbtower 3-1:14.57: interrupt endpoints not found [ 508.996541][T14664] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2941'. [ 508.996625][T14664] FAULT_INJECTION: forcing a failure. [ 508.996625][T14664] name failslab, interval 1, probability 0, space 0, times 0 [ 508.996652][T14664] CPU: 1 UID: 0 PID: 14664 Comm: syz.3.2941 Tainted: G L syzkaller #0 PREEMPT(full) [ 508.996676][T14664] Tainted: [L]=SOFTLOCKUP [ 508.996683][T14664] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 508.996694][T14664] Call Trace: [ 508.996701][T14664] [ 508.996709][T14664] dump_stack_lvl+0xe8/0x150 [ 508.996741][T14664] should_fail_ex+0x410/0x560 [ 508.996773][T14664] should_failslab+0xa8/0x100 [ 508.996797][T14664] __kmalloc_noprof+0xfe/0x720 [ 508.996825][T14664] ? __kmalloc_cache_noprof+0x14d/0x600 [ 508.996850][T14664] ? nsim_fib_event_nb+0x283/0x11d0 [ 508.996966][T14664] ? nsim_fib_event_nb+0x283/0x11d0 [ 508.996996][T14664] nsim_fib_event_nb+0x283/0x11d0 [ 508.997023][T14664] ? lock_acquire+0x115/0x350 [ 508.997046][T14664] notifier_call_chain+0x1a5/0x3d0 [ 508.997078][T14664] ? atomic_notifier_call_chain+0x26/0x180 [ 508.997106][T14664] atomic_notifier_call_chain+0xda/0x180 [ 508.997136][T14664] call_fib_notifiers+0x31/0x60 [ 508.997211][T14664] fib6_add_rt2node+0x15f3/0x3940 [ 508.997272][T14664] ? __pfx_fib6_nh_init+0x10/0x10 [ 508.997332][T14664] ? __do_fast_syscall_32+0x27a/0x6a0 [ 508.997361][T14664] ? __pfx_fib6_add_rt2node+0x10/0x10 [ 508.997391][T14664] ? fib6_add_1+0x10dd/0x13e0 [ 508.997431][T14664] fib6_add+0x9ae/0x1a20 [ 508.997468][T14664] ? __pfx_fib6_add+0x10/0x10 [ 508.997500][T14664] ? ip6_route_add+0xc9/0x1b0 [ 508.997529][T14664] ip6_route_add+0xde/0x1b0 [ 508.997558][T14664] inet6_rtm_newroute+0x267/0x1a30 [ 508.997592][T14664] ? kasan_quarantine_put+0xbb/0x1f0 [ 508.997619][T14664] ? lockdep_hardirqs_on+0x7b/0x110 [ 508.997648][T14664] ? __pfx_inet6_rtm_newroute+0x10/0x10 [ 508.997671][T14664] ? nlmon_xmit+0xb0/0x100 [ 508.997716][T14664] ? kmem_cache_free+0x182/0x650 [ 508.997746][T14664] ? __lock_acquire+0x6df/0x2e50 [ 508.997767][T14664] ? __dev_queue_xmit+0x29b/0x3820 [ 508.997853][T14664] ? __local_bh_enable_ip+0xd6/0x140 [ 508.997884][T14664] ? lockdep_hardirqs_on+0x7b/0x110 [ 508.997936][T14664] ? __pfx_inet6_rtm_newroute+0x10/0x10 [ 508.997959][T14664] rtnetlink_rcv_msg+0x802/0xc00 [ 508.998008][T14664] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 508.998026][T14664] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 508.998043][T14664] ? ref_tracker_free+0x689/0x830 [ 508.998065][T14664] ? __pfx_ref_tracker_free+0x10/0x10 [ 508.998093][T14664] netlink_rcv_skb+0x226/0x4a0 [ 508.998118][T14664] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 508.998137][T14664] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 508.998171][T14664] ? netlink_deliver_tap+0x2e/0x1b0 [ 508.998193][T14664] ? netlink_deliver_tap+0x2e/0x1b0 [ 508.998220][T14664] netlink_unicast+0x7bd/0x940 [ 508.998251][T14664] netlink_sendmsg+0x813/0xb40 [ 508.998282][T14664] ? __pfx_netlink_sendmsg+0x10/0x10 [ 508.998312][T14664] ? apparmor_socket_sendmsg+0x98/0x360 [ 508.998342][T14664] ? __pfx_netlink_sendmsg+0x10/0x10 [ 508.998364][T14664] sock_sendmsg_nosec+0x13a/0x180 [ 508.998392][T14664] ____sys_sendmsg+0x54e/0x850 [ 508.998417][T14664] ? __pfx_____sys_sendmsg+0x10/0x10 [ 508.998452][T14664] ___sys_sendmsg+0x2a5/0x360 [ 508.998476][T14664] ? __lock_acquire+0x6df/0x2e50 [ 508.998498][T14664] ? __pfx____sys_sendmsg+0x10/0x10 [ 508.998523][T14664] ? kstrtoull+0x137/0x1d0 [ 508.998572][T14664] ? __fget_files+0x2a/0x420 [ 508.998595][T14664] ? __fget_files+0x3a2/0x420 [ 508.998627][T14664] __sys_sendmmsg+0x2de/0x4d0 [ 508.998653][T14664] ? __pfx___sys_sendmmsg+0x10/0x10 [ 508.998699][T14664] ? fput+0xa0/0xd0 [ 508.998720][T14664] ? ksys_write+0x242/0x270 [ 508.998752][T14664] __ia32_compat_sys_sendmmsg+0xa2/0xc0 [ 508.998778][T14664] __do_fast_syscall_32+0x27a/0x6a0 [ 508.998797][T14664] ? do_fast_syscall_32+0x33/0x70 [ 508.998815][T14664] ? asm_int80_emulation+0x1a/0x20 [ 508.998832][T14664] ? do_int80_emulation+0x299/0x500 [ 508.998849][T14664] ? trace_irq_disable+0x3b/0x140 [ 508.998877][T14664] do_fast_syscall_32+0x33/0x70 [ 508.998895][T14664] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 508.998917][T14664] RIP: 0023:0xf6fdf0ec [ 508.998934][T14664] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 508.998950][T14664] RSP: 002b:00000000f53cd50c EFLAGS: 00000206 ORIG_RAX: 0000000000000159 [ 508.998970][T14664] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000000 [ 508.998983][T14664] RDX: 00000000000001f2 RSI: 00000000000000fc RDI: 0000000000000000 [ 508.998995][T14664] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 508.999006][T14664] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 508.999016][T14664] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 508.999043][T14664] [ 509.098174][T14668] netdevsim netdevsim0 netdevsim0: entered allmulticast mode [ 509.098347][T14668] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 509.338912][T14672] loop0: detected capacity change from 0 to 2098 [ 509.436301][T14611] legousbtower 3-1:14.228: get version request failed: -121 [ 509.436472][T14611] legousbtower 3-1:14.228: probe with driver legousbtower failed with error -121 [ 509.582317][T14612] usb 2-1: new high-speed USB device number 119 using dummy_hcd [ 509.646705][ T31] usb 3-1: USB disconnect, device number 118 [ 509.714965][T14679] fuse: Unknown parameter 'ÿÿÿÿÿÿÿÿÿ0x00000000000000d8' [ 509.756560][T14612] usb 2-1: New USB device found, idVendor=0763, idProduct=2003, bcdDevice= 0.40 [ 509.770590][T14612] usb 2-1: string descriptor 0 read error: -22 [ 509.770727][T14612] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 509.910261][T14682] FAULT_INJECTION: forcing a failure. [ 509.910261][T14682] name failslab, interval 1, probability 0, space 0, times 0 [ 509.910302][T14682] CPU: 1 UID: 0 PID: 14682 Comm: syz.3.2946 Tainted: G L syzkaller #0 PREEMPT(full) [ 509.910326][T14682] Tainted: [L]=SOFTLOCKUP [ 509.910332][T14682] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 509.910341][T14682] Call Trace: [ 509.910351][T14682] [ 509.910359][T14682] dump_stack_lvl+0xe8/0x150 [ 509.910387][T14682] should_fail_ex+0x410/0x560 [ 509.910413][T14682] should_failslab+0xa8/0x100 [ 509.910435][T14682] __kmalloc_noprof+0xfe/0x720 [ 509.910463][T14682] ? mutex_init_lockdep+0xdf/0x110 [ 509.910483][T14682] ? security_task_alloc+0x4d/0x330 [ 509.910508][T14682] ? security_task_alloc+0x4d/0x330 [ 509.910534][T14682] ? copy_process+0xd3c/0x43e0 [ 509.910559][T14682] security_task_alloc+0x4d/0x330 [ 509.910586][T14682] ? copy_process+0xd3c/0x43e0 [ 509.910607][T14682] copy_process+0x1c45/0x43e0 [ 509.910638][T14682] ? copy_process+0xd3c/0x43e0 [ 509.910678][T14682] ? __pfx_copy_process+0x10/0x10 [ 509.910708][T14682] ? mutex_init_lockdep+0xdf/0x110 [ 509.910731][T14682] vhost_task_create+0x1f9/0x380 [ 509.910751][T14682] ? __pfx_kvm_nx_huge_page_recovery_worker+0x10/0x10 [ 509.910773][T14682] ? __pfx_kvm_nx_huge_page_recovery_worker_kill+0x10/0x10 [ 509.910796][T14682] ? __pfx_vhost_task_create+0x10/0x10 [ 509.910813][T14682] ? register_lock_class+0x31/0x2e0 [ 509.910845][T14682] ? __pfx_vhost_task_fn+0x10/0x10 [ 509.910881][T14682] kvm_mmu_post_init_vm+0x147/0x2b0 [ 509.910908][T14682] kvm_arch_vcpu_ioctl_run+0x7c/0x19c0 [ 509.910944][T14682] ? kvm_vcpu_ioctl+0xe8f/0xfd0 [ 509.910969][T14682] kvm_vcpu_ioctl+0xa61/0xfd0 [ 509.910993][T14682] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 509.911011][T14682] ? do_vfs_ioctl+0x116f/0x1530 [ 509.911032][T14682] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 509.911063][T14682] ? hook_file_ioctl_compat+0x1f2/0x600 [ 509.911182][T14682] kvm_vcpu_compat_ioctl+0x204/0x390 [ 509.911206][T14682] ? __pfx_kvm_vcpu_compat_ioctl+0x10/0x10 [ 509.911226][T14682] ? __fget_files+0x3a2/0x420 [ 509.911248][T14682] ? __fget_files+0x2a/0x420 [ 509.911274][T14682] ? bpf_lsm_file_ioctl_compat+0x9/0x20 [ 509.911303][T14682] __ia32_compat_sys_ioctl+0x5ea/0x950 [ 509.911325][T14682] ? __pfx___ia32_compat_sys_ioctl+0x10/0x10 [ 509.911341][T14682] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 509.911368][T14682] ? __fget_files+0x3a2/0x420 [ 509.911396][T14682] ? fput+0xa0/0xd0 [ 509.911418][T14682] ? ksys_write+0x242/0x270 [ 509.911454][T14682] __do_fast_syscall_32+0x27a/0x6a0 [ 509.911474][T14682] ? do_fast_syscall_32+0x33/0x70 [ 509.911491][T14682] ? asm_int80_emulation+0x1a/0x20 [ 509.911508][T14682] ? do_int80_emulation+0x299/0x500 [ 509.911530][T14682] do_fast_syscall_32+0x33/0x70 [ 509.911549][T14682] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 509.911571][T14682] RIP: 0023:0xf6fdf0ec [ 509.911586][T14682] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 509.911602][T14682] RSP: 002b:00000000f53cd50c EFLAGS: 00000206 ORIG_RAX: 0000000000000036 [ 509.911622][T14682] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 000000000000ae80 [ 509.911635][T14682] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 509.911656][T14682] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 509.911668][T14682] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 509.911678][T14682] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 509.911706][T14682] [ 510.079907][T14612] usb 2-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 510.397694][T14687] nvme_fabrics: unknown parameter or missing value 'reconnect_delay=' in ctrl creation request [ 510.672214][T14612] usb 2-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 510.752349][T14611] usb 4-1: new full-speed USB device number 121 using dummy_hcd [ 510.824040][T14612] usb 2-1: USB disconnect, device number 119 [ 510.913118][T14611] usb 4-1: unable to get BOS descriptor or descriptor too short [ 510.913596][T14611] usb 4-1: not running at top speed; connect to a high speed hub [ 510.913626][T14611] usb 4-1: New USB device found, idVendor=200c, idProduct=1018, bcdDevice= 0.40 [ 510.914551][T14611] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 510.914570][T14611] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 510.916433][T14611] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 510.916454][T14611] usb 4-1: Product: syz [ 510.916468][T14611] usb 4-1: Manufacturer: syz [ 510.916481][T14611] usb 4-1: SerialNumber: syz [ 511.031285][ T4935] Bluetooth: hci3: SCO packet for unknown connection handle 1024 [ 511.145406][T14611] usb 4-1: 3:0: failed to get current value for ch 1 (-71) [ 511.149964][T14611] usb 4-1: 3:0: failed to get current value for ch 2 (-71) [ 511.156388][T14611] usb 4-1: 3:0: failed to get current value for ch 0 (-71) [ 511.161555][T14611] usb 4-1: 3:0: failed to get current value for ch 1 (-71) [ 511.170322][T14611] usb 4-1: 3:0: failed to get current value for ch 0 (-71) [ 511.171598][T14611] usb 4-1: 3:0: cannot get min/max values for control 11 (id 3) [ 511.231059][T14611] usb 4-1: USB disconnect, device number 121 [ 511.238310][ T30] audit: type=1326 audit(1788665528.543:3910): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14705 comm="syz.4.2954" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7f560ec code=0x0 [ 511.278087][ T6619] udevd[6619]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 511.341494][T14710] FAULT_INJECTION: forcing a failure. [ 511.341494][T14710] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 511.341530][T14710] CPU: 1 UID: 0 PID: 14710 Comm: syz.1.2956 Tainted: G L syzkaller #0 PREEMPT(full) [ 511.341556][T14710] Tainted: [L]=SOFTLOCKUP [ 511.341563][T14710] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 511.341575][T14710] Call Trace: [ 511.341582][T14710] [ 511.341589][T14710] dump_stack_lvl+0xe8/0x150 [ 511.341615][T14710] should_fail_ex+0x410/0x560 [ 511.341643][T14710] _copy_from_iter+0x1d3/0x1660 [ 511.341671][T14710] ? __alloc_skb+0x27a/0x7a0 [ 511.341690][T14710] ? __alloc_skb+0x27a/0x7a0 [ 511.341717][T14710] ? __alloc_skb+0x27a/0x7a0 [ 511.341735][T14710] ? __pfx__copy_from_iter+0x10/0x10 [ 511.341759][T14710] ? kmem_cache_alloc_node_noprof+0x1f9/0x610 [ 511.341785][T14710] ? __alloc_skb+0x27a/0x7a0 [ 511.341800][T14710] ? __alloc_skb+0x27a/0x7a0 [ 511.341821][T14710] ? netlink_sendmsg+0x650/0xb40 [ 511.341844][T14710] ? skb_put+0x112/0x210 [ 511.341864][T14710] netlink_sendmsg+0x6c0/0xb40 [ 511.341894][T14710] ? __pfx_netlink_sendmsg+0x10/0x10 [ 511.341924][T14710] ? apparmor_socket_sendmsg+0x98/0x360 [ 511.341953][T14710] ? __pfx_netlink_sendmsg+0x10/0x10 [ 511.341977][T14710] sock_sendmsg_nosec+0x13a/0x180 [ 511.342004][T14710] ____sys_sendmsg+0x54e/0x850 [ 511.342029][T14710] ? __pfx_____sys_sendmsg+0x10/0x10 [ 511.342063][T14710] ___sys_sendmsg+0x2a5/0x360 [ 511.342082][T14710] ? __lock_acquire+0x6df/0x2e50 [ 511.342104][T14710] ? __pfx____sys_sendmsg+0x10/0x10 [ 511.342123][T14710] ? get_pid_task+0x20/0x1f0 [ 511.342140][T14710] ? get_pid_task+0x20/0x1f0 [ 511.342156][T14710] ? get_pid_task+0x20/0x1f0 [ 511.342198][T14710] ? __fget_files+0x2a/0x420 [ 511.342219][T14710] ? __fget_files+0x3a2/0x420 [ 511.342251][T14710] __sys_sendmsg+0x177/0x240 [ 511.342273][T14710] ? __pfx___sys_sendmsg+0x10/0x10 [ 511.342309][T14710] __do_fast_syscall_32+0x27a/0x6a0 [ 511.342328][T14710] ? do_fast_syscall_32+0x33/0x70 [ 511.342345][T14710] ? asm_int80_emulation+0x1a/0x20 [ 511.342363][T14710] ? do_int80_emulation+0x299/0x500 [ 511.342379][T14710] ? trace_irq_disable+0x3b/0x140 [ 511.342401][T14710] do_fast_syscall_32+0x33/0x70 [ 511.342419][T14710] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 511.342441][T14710] RIP: 0023:0xf7f940ec [ 511.342458][T14710] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 511.342474][T14710] RSP: 002b:00000000f545650c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 511.342494][T14710] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000000 [ 511.342507][T14710] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 511.342517][T14710] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 511.342529][T14710] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 511.342540][T14710] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 511.342566][T14710] [ 511.524673][T14713] loop0: detected capacity change from 0 to 6128 [ 511.556043][T14713] loop0: [ 511.825517][T14715] netlink: 'syz.3.2958': attribute type 1 has an invalid length. [ 511.878441][ T4985] loop0: [ 512.028924][T14717] nvme_fc: nvme_fc_parse_traddr: bad traddr string [ 512.102784][ T31] usb 4-1: new high-speed USB device number 122 using dummy_hcd [ 512.252686][ T31] usb 4-1: Using ep0 maxpacket: 16 [ 512.254165][ T31] usb 4-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice= 7.c9 [ 512.258149][ T31] usb 4-1: config 1 has an invalid interface number: 19 but max is 0 [ 512.258172][ T31] usb 4-1: config 1 has no interface number 0 [ 512.258212][ T31] usb 4-1: config 1 interface 19 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 512.258237][ T31] usb 4-1: config 1 interface 19 has no altsetting 0 [ 512.267406][ T31] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 512.267430][ T31] usb 4-1: Product: syz [ 512.267443][ T31] usb 4-1: Manufacturer: syz [ 512.267456][ T31] usb 4-1: SerialNumber: syz [ 512.282439][T14612] usb 2-1: new high-speed USB device number 120 using dummy_hcd [ 512.355643][ T31] usb 4-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 512.432095][T14612] usb 2-1: Using ep0 maxpacket: 32 [ 512.434441][T14612] usb 2-1: unable to get BOS descriptor or descriptor too short [ 512.434488][T14612] usb 2-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 512.436095][T14612] usb 2-1: config 14 has an invalid interface number: 57 but max is 1 [ 512.436117][T14612] usb 2-1: config 14 has an invalid interface number: 228 but max is 1 [ 512.436136][T14612] usb 2-1: config 14 has no interface number 0 [ 512.436150][T14612] usb 2-1: config 14 has no interface number 1 [ 512.436207][T14612] usb 2-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 512.436229][T14612] usb 2-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 512.436251][T14612] usb 2-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 512.436274][T14612] usb 2-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 512.436298][T14612] usb 2-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 512.436321][T14612] usb 2-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 512.436345][T14612] usb 2-1: config 14 interface 57 has no altsetting 0 [ 512.436362][T14612] usb 2-1: config 14 interface 228 has no altsetting 0 [ 512.439397][T14612] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 512.439419][T14612] usb 2-1: Product: syz [ 512.439445][T14612] usb 2-1: Manufacturer: syz [ 512.439458][T14612] usb 2-1: SerialNumber: syz [ 512.863921][T14612] legousbtower 2-1:14.57: interrupt endpoints not found [ 512.898033][T14737] netlink: 'syz.0.2964': attribute type 10 has an invalid length. [ 512.898254][T14737] FAULT_INJECTION: forcing a failure. [ 512.898254][T14737] name failslab, interval 1, probability 0, space 0, times 0 [ 512.898305][T14737] CPU: 1 UID: 0 PID: 14737 Comm: syz.0.2964 Tainted: G L syzkaller #0 PREEMPT(full) [ 512.898330][T14737] Tainted: [L]=SOFTLOCKUP [ 512.898336][T14737] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 512.898348][T14737] Call Trace: [ 512.898356][T14737] [ 512.898363][T14737] dump_stack_lvl+0xe8/0x150 [ 512.898394][T14737] should_fail_ex+0x410/0x560 [ 512.898430][T14737] should_failslab+0xa8/0x100 [ 512.898453][T14737] __kmalloc_noprof+0xfe/0x720 [ 512.898487][T14737] ? team_add_slave+0x26c/0x28c0 [ 512.898630][T14737] ? team_add_slave+0x26c/0x28c0 [ 512.898662][T14737] team_add_slave+0x26c/0x28c0 [ 512.898691][T14737] ? netlink_broadcast_filtered+0xe27/0xea0 [ 512.898732][T14737] ? do_set_master+0x52a/0x720 [ 512.898753][T14737] ? __pfx_team_add_slave+0x10/0x10 [ 512.898780][T14737] ? __mutex_unlock_slowpath+0x731/0x900 [ 512.898811][T14737] ? __pfx___dev_notify_flags+0x10/0x10 [ 512.898829][T14737] ? __dev_change_flags+0x5f1/0x820 [ 512.898848][T14737] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 512.898881][T14737] ? mutex_is_locked+0x17/0x50 [ 512.898914][T14737] do_set_master+0x563/0x720 [ 512.898942][T14737] do_setlink+0xe7b/0x4670 [ 512.898960][T14737] ? __wake_up_klogd+0xf0/0x130 [ 512.898989][T14737] ? __pfx_vprintk_emit+0x10/0x10 [ 512.899017][T14737] ? __pfx_do_setlink+0x10/0x10 [ 512.899037][T14737] ? __lock_acquire+0x6df/0x2e50 [ 512.899067][T14737] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 512.899092][T14737] ? ___ratelimit+0x584/0x8e0 [ 512.899162][T14737] ? __mutex_trylock_common+0x15f/0x270 [ 512.899188][T14737] ? __pfx___mutex_trylock_common+0x10/0x10 [ 512.899213][T14737] ? rcu_is_watching+0x16/0xb0 [ 512.899234][T14737] ? trace_contention_end+0x3d/0x140 [ 512.899258][T14737] ? __mutex_lock+0x30b/0x1550 [ 512.899284][T14737] ? rtnl_newlink+0xc10/0x1c30 [ 512.899305][T14737] ? __pfx___mutex_lock+0x10/0x10 [ 512.899331][T14737] ? ns_capable+0x89/0xe0 [ 512.899354][T14737] ? rtnl_nets_add+0x16c/0x300 [ 512.899372][T14737] ? refcount_inc+0x46/0x70 [ 512.899427][T14737] rtnl_newlink+0x15a3/0x1c30 [ 512.899456][T14737] ? __pfx_rtnl_newlink+0x10/0x10 [ 512.899475][T14737] ? __lock_acquire+0x6df/0x2e50 [ 512.899500][T14737] ? __lock_acquire+0x6df/0x2e50 [ 512.899532][T14737] ? lock_acquire+0x115/0x350 [ 512.899556][T14737] ? lock_acquire+0x115/0x350 [ 512.899582][T14737] ? is_bpf_text_address+0x26/0x2b0 [ 512.899609][T14737] ? __lock_acquire+0x6df/0x2e50 [ 512.899630][T14737] ? kernel_text_address+0xa5/0xe0 [ 512.899651][T14737] ? __kernel_text_address+0xd/0x30 [ 512.899669][T14737] ? unwind_get_return_address+0x4d/0x90 [ 512.899691][T14737] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 512.899718][T14737] ? arch_stack_walk+0xfb/0x150 [ 512.899748][T14737] ? lock_acquire+0x115/0x350 [ 512.899765][T14737] ? __pfx_rtnl_newlink+0x10/0x10 [ 512.899794][T14737] ? __pfx_rtnl_newlink+0x10/0x10 [ 512.899812][T14737] rtnetlink_rcv_msg+0x802/0xc00 [ 512.899828][T14737] ? netlink_sendmsg+0x5d4/0xb40 [ 512.899854][T14737] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 512.899871][T14737] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 512.899890][T14737] ? __lock_acquire+0x6df/0x2e50 [ 512.899939][T14737] netlink_rcv_skb+0x226/0x4a0 [ 512.899962][T14737] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 512.899982][T14737] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 512.900016][T14737] ? netlink_deliver_tap+0x2e/0x1b0 [ 512.900038][T14737] ? netlink_deliver_tap+0x2e/0x1b0 [ 512.900065][T14737] netlink_unicast+0x7bd/0x940 [ 512.900095][T14737] netlink_sendmsg+0x813/0xb40 [ 512.900127][T14737] ? __pfx_netlink_sendmsg+0x10/0x10 [ 512.900157][T14737] ? apparmor_socket_sendmsg+0x98/0x360 [ 512.900187][T14737] ? __pfx_netlink_sendmsg+0x10/0x10 [ 512.900209][T14737] sock_sendmsg_nosec+0x13a/0x180 [ 512.900236][T14737] ____sys_sendmsg+0x54e/0x850 [ 512.900262][T14737] ? __pfx_____sys_sendmsg+0x10/0x10 [ 512.900296][T14737] ___sys_sendmsg+0x2a5/0x360 [ 512.900316][T14737] ? __lock_acquire+0x6df/0x2e50 [ 512.900338][T14737] ? __pfx____sys_sendmsg+0x10/0x10 [ 512.900358][T14737] ? get_pid_task+0x20/0x1f0 [ 512.900374][T14737] ? get_pid_task+0x20/0x1f0 [ 512.900390][T14737] ? get_pid_task+0x20/0x1f0 [ 512.900434][T14737] ? __fget_files+0x2a/0x420 [ 512.900456][T14737] ? __fget_files+0x3a2/0x420 [ 512.900488][T14737] __sys_sendmsg+0x177/0x240 [ 512.900511][T14737] ? __pfx___sys_sendmsg+0x10/0x10 [ 512.900548][T14737] __do_fast_syscall_32+0x27a/0x6a0 [ 512.900568][T14737] ? do_fast_syscall_32+0x33/0x70 [ 512.900585][T14737] ? asm_int80_emulation+0x1a/0x20 [ 512.900602][T14737] ? do_int80_emulation+0x299/0x500 [ 512.900619][T14737] ? trace_irq_disable+0x3b/0x140 [ 512.900640][T14737] do_fast_syscall_32+0x33/0x70 [ 512.900658][T14737] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 512.900681][T14737] RIP: 0023:0xf6fef0ec [ 512.900696][T14737] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 512.900713][T14737] RSP: 002b:00000000f53dd50c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 512.900733][T14737] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000600 [ 512.900746][T14737] RDX: 0000000000000040 RSI: 0000000000000000 RDI: 0000000000000000 [ 512.900757][T14737] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 512.900769][T14737] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 512.900780][T14737] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 512.900807][T14737] [ 513.325809][T14612] legousbtower 2-1:14.228: get version request failed: -121 [ 513.325979][T14612] legousbtower 2-1:14.228: probe with driver legousbtower failed with error -121 [ 513.423774][T14745] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 513.427002][T14745] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 513.466641][ T5780] usb 4-1: Failed to submit usb control message: -110 [ 513.466677][ T5780] usb 4-1: unable to send the bmi data to the device: -110 [ 513.466694][ T5780] usb 4-1: unable to get target info from device [ 513.466723][ T5780] usb 4-1: could not get target info (-110) [ 513.466886][ T5780] usb 4-1: could not probe fw (-110) [ 513.545236][T14612] usb 2-1: USB disconnect, device number 120 [ 513.634362][T14750] loop0: detected capacity change from 0 to 9408 [ 513.699621][T14750] loop0: [ 514.200150][T14761] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2973'. [ 514.263109][ T32] INFO: task kworker/1:3:5675 blocked for more than 143 seconds. [ 514.263161][ T32] Tainted: G ** replaying previous printk message ** [ 514.263161][ T32] Tainted: G L syzkaller #0 [ 514.263172][ T32] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 514.263180][ T32] task:kworker/1:3 state:D stack:20592 pid:5675 tgid:5675 ppid:2 task_flags:0x4208060 flags:0x00080000 [ 514.263224][ T32] Workqueue: usb_hub_wq hub_event [ 514.263363][ T32] Call Trace: [ 514.263371][ T32] [ 514.263384][ T32] __schedule+0x17db/0x58f0 [ 514.263429][ T32] ? do_raw_spin_lock+0x12b/0x2f0 [ 514.263461][ T32] ? __pfx___schedule+0x10/0x10 [ 514.263493][ T32] ? schedule+0x90/0x2b0 [ 514.263521][ T32] schedule+0x164/0x2b0 [ 514.263547][ T32] schedule_preempt_disabled+0x13/0x30 [ 514.263572][ T32] __mutex_lock+0x7c1/0x1550 [ 514.263595][ T32] ? __mutex_lock+0x5d4/0x1550 [ 514.263615][ T32] ? hub_event+0x20c9/0x4d30 [ 514.263636][ T32] ? __pfx___mutex_lock+0x10/0x10 [ 514.263672][ T32] hub_event+0x20c9/0x4d30 [ 514.263691][ T32] ? do_raw_spin_unlock+0xf5/0x200 [ 514.263726][ T32] ? register_lock_class+0x31/0x2e0 [ 514.263796][ T32] ? __pfx_hub_event+0x10/0x10 [ 514.263823][ T32] ? rcu_is_watching+0x16/0xb0 [ 514.263847][ T32] ? process_scheduled_works+0x97a/0x1630 [ 514.263872][ T32] process_scheduled_works+0xc3d/0x1630 [ 514.263924][ T32] ? __pfx_process_scheduled_works+0x10/0x10 [ 514.263954][ T32] ? assign_work+0x3cf/0x5d0 [ 514.263982][ T32] worker_thread+0xa47/0xfb0 [ 514.264018][ T32] ? __kthread_parkme+0x71/0x1f0 [ 514.264053][ T32] kthread+0x38b/0x480 [ 514.264073][ T32] ? __pfx_worker_thread+0x10/0x10 [ 514.264095][ T32] ? __pfx_kthread+0x10/0x10 [ 514.264114][ T32] ret_from_fork+0x514/0xb70 [ 514.264135][ T32] ? __pfx_ret_from_fork+0x10/0x10 [ 514.264161][ T32] ? load_gs_index+0x97/0xc0 [ 514.264185][ T32] ? __switch_to+0xc89/0x1420 [ 514.264211][ T32] ? __pfx_kthread+0x10/0x10 [ 514.264230][ T32] ret_from_fork_asm+0x1a/0x30 [ 514.264273][ T32] [ 514.264352][ T32] [ 514.264352][ T32] Showing all locks held in the system: [ 514.264363][ T32] locks held by pr/ttyS0/16: 2, last CPU#0: [ 514.264377][ T32] #0: ffffffff8ec362b8 (console_srcu){....}-{0:0}, at: console_srcu_read_lock+0x30/0x60 [ 514.264426][ T32] #1: ffffffff9ad33098 (&port_lock_key){-.-.}-{3:3}, at: univ8250_console_device_lock+0x67/0xc0 [ 514.267716][ T32] locks held by khungtaskd/32: 1, last CPU#1: [ 514.267731][ T32] #0: ffffffff8ed5c6e0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 514.267815][ T32] locks held by udevd/4985: 2, last CPU#1: [ 514.267829][ T32] #0: ffffffff8f4ef9f8 (tomoyo_ss){.+.+}-{0:0}, at: tomoyo_check_open_permission+0x1d3/0x470 [ 514.267921][ T32] #1: ffffffff8ed5c6e0 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550 [ 514.267969][ T32] locks held by getty/5371: 2, on CPU#0: [ 514.267983][ T32] #0: ffff8880340a50a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 514.268081][ T32] #1: ffffc9000322b2e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45a/0x1360 [ 514.268133][ T32] locks held by kworker/1:3/5675: 5, on CPU#1: [ 514.268147][ T32] #0: ffff888022ae1140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 514.268194][ T32] #1: ffffc90003c47c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 514.268242][ T32] #2: ffff88802ac941d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 [ 514.268285][ T32] #3: ffff88802aa08568 (&port_dev->status_lock){+.+.}-{4:4}, at: hub_event+0x20a1/0x4d30 [ 514.268326][ T32] #4: ffff88802a82c360 (hcd->address0_mutex){+.+.}-{4:4}, at: hub_event+0x20c9/0x4d30 [ 514.268370][ T32] locks held by kworker/1:5/5690: 5, on CPU#1: [ 514.268383][ T32] #0: ffff888022ae1140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 514.268431][ T32] #1: ffffc90003e47c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 514.268479][ T32] #2: ffff88802a3bc1d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 [ 514.268520][ T32] #3: ffff88802a290568 (&port_dev->status_lock){+.+.}-{4:4}, at: hub_event+0x20a1/0x4d30 [ 514.268563][ T32] #4: ffff88802a82c360 (hcd->address0_mutex){+.+.}-{4:4}, at: hub_event+0x20c9/0x4d30 [ 514.268620][ T32] locks held by syz-executor/13597: 4, last CPU#1: [ 514.268633][ T32] #0: ffffffff8ee35c10 (dup_mmap_sem){.+.+}-{0:0}, at: copy_mm+0x10f/0x480 [ 514.268680][ T32] #1: ffff88801b09dcf8 (&mm->mmap_lock){++++}-{4:4}, at: dup_mmap+0x195/0x1dc0 [ 514.268728][ T32] #2: ffff88801253e9b8 (&mm->mmap_lock/1){+.+.}-{4:4}, at: dup_mmap+0x221/0x1dc0 [ 514.268779][ T32] #3: ffffffff8ed5c6e0 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x240 [ 514.268841][ T32] [ 514.268847][ T32] ============================================= [ 514.268847][ T32] [ 514.268856][ T32] NMI backtrace for cpu 1 [ 514.268871][ T32] CPU: 1 UID: 0 PID: 32 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 514.268894][ T32] Tainted: [L]=SOFTLOCKUP [ 514.268901][ T32] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 514.268912][ T32] Call Trace: [ 514.268920][ T32] [ 514.268928][ T32] dump_stack_lvl+0xe8/0x150 [ 514.268954][ T32] nmi_cpu_backtrace+0x274/0x2d0 [ 514.268978][ T32] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 514.269007][ T32] nmi_trigger_cpumask_backtrace+0x17d/0x390 [ 514.269032][ T32] sys_info+0x135/0x170 [ 514.269055][ T32] watchdog+0xfd7/0x1030 [ 514.269080][ T32] ? watchdog+0x1c7/0x1030 [ 514.269103][ T32] kthread+0x38b/0x480 [ 514.269122][ T32] ? __pfx_watchdog+0x10/0x10 [ 514.269137][ T32] ? __pfx_kthread+0x10/0x10 [ 514.269155][ T32] ret_from_fork+0x514/0xb70 [ 514.269176][ T32] ? __pfx_ret_from_fork+0x10/0x10 [ 514.269202][ T32] ? __switch_to+0xc89/0x1420 [ 514.269229][ T32] ? __pfx_kthread+0x10/0x10 [ 514.269248][ T32] ret_from_fork_asm+0x1a/0x30 [ 514.269287][ T32] [ 514.269312][ T32] Sending NMI from CPU 1 to CPUs 0: [ 514.269347][ C0] NMI backtrace for cpu 0 [ 514.269364][ C0] CPU: 0 UID: 0 PID: 16 Comm: pr/ttyS0 Tainted: G L syzkaller #0 PREEMPT(full) [ 514.269390][ C0] Tainted: [L]=SOFTLOCKUP [ 514.269398][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 514.269410][ C0] RIP: 0010:io_serial_in+0x77/0xc0 [ 514.269471][ C0] Code: e8 fe 97 55 fc 44 89 f9 d3 e3 49 83 c6 40 4c 89 f0 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 f7 e8 8f 6f c5 fc 41 03 1e 89 da ec <0f> b6 c0 5b 41 5c 41 5e 41 5f e9 4a 35 75 06 cc 44 89 f9 80 e1 07 [ 514.269488][ C0] RSP: 0000:ffffc900001578b8 EFLAGS: 00000002 [ 514.269505][ C0] RAX: 1ffffffff35a6600 RBX: 00000000000003fd RCX: 0000000000000000 [ 514.269519][ C0] RDX: 00000000000003fd RSI: 0000000000000000 RDI: 0000000000000020 [ 514.269532][ C0] RBP: dffffc0000000000 R08: 0000000000000003 R09: 0000000000000004 [ 514.269546][ C0] R10: dffffc0000000000 R11: ffffffff857222d0 R12: dffffc0000000000 [ 514.269562][ C0] R13: 0000000000000000 R14: ffffffff9ad330c0 R15: 0000000000000000 [ 514.269576][ C0] FS: 0000000000000000(0000) GS:ffff888124cd8000(0000) knlGS:0000000000000000 [ 514.269592][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 514.269607][ C0] CR2: 000000000c3adad8 CR3: 000000007f68c000 CR4: 00000000003526f0 [ 514.269624][ C0] Call Trace: [ 514.269632][ C0] [ 514.269641][ C0] wait_for_lsr+0x184/0x2f0 [ 514.269674][ C0] __serial8250_console_fifo_write+0xcd/0x3e0 [ 514.269702][ C0] serial8250_console_write+0xaa1/0x1200 [ 514.269738][ C0] ? __pfx_serial8250_console_write+0x10/0x10 [ 514.269768][ C0] ? rcu_is_watching+0x16/0xb0 [ 514.269798][ C0] nbcon_emit_next_record+0xef5/0x1a90 [ 514.269836][ C0] ? __pfx_nbcon_emit_next_record+0x10/0x10 [ 514.269860][ C0] ? nbcon_context_try_acquire+0x819/0xbd0 [ 514.269889][ C0] ? _raw_spin_lock_irqsave+0x4c/0x60 [ 514.269918][ C0] nbcon_kthread_func+0x679/0x880 [ 514.269942][ C0] ? nbcon_kthread_func+0x163/0x880 [ 514.269961][ C0] ? __pfx_nbcon_kthread_func+0x10/0x10 [ 514.269985][ C0] ? __kthread_parkme+0x71/0x1f0 [ 514.270013][ C0] ? __kthread_parkme+0x199/0x1f0 [ 514.270044][ C0] kthread+0x38b/0x480 [ 514.270062][ C0] ? __pfx_nbcon_kthread_func+0x10/0x10 [ 514.270080][ C0] ? __pfx_kthread+0x10/0x10 [ 514.270099][ C0] ret_from_fork+0x514/0xb70 [ 514.270119][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 514.270149][ C0] ? __switch_to+0xc89/0x1420 [ 514.270177][ C0] ? __pfx_kthread+0x10/0x10 [ 514.270196][ C0] ret_from_fork_asm+0x1a/0x30 [ 514.270234][ C0] [ 514.277293][ T32] Kernel panic - not syncing: hung_task: blocked tasks [ 515.102181][ T32] CPU: 1 UID: 0 PID: 32 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 515.112881][ T32] Tainted: [L]=SOFTLOCKUP [ 515.117188][ T32] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 515.127220][ T32] Call Trace: [ 515.130485][ T32] [ 515.133397][ T32] vpanic+0x56d/0xa60 [ 515.137366][ T32] ? __pfx___schedule+0x10/0x10 [ 515.142202][ T32] ? __pfx_vpanic+0x10/0x10 [ 515.146715][ T32] panic+0xc5/0xd0 [ 515.150419][ T32] ? __pfx_panic+0x10/0x10 [ 515.154815][ T32] ? preempt_schedule_common+0x7f/0xd0 [ 515.160372][ T32] ? preempt_schedule_thunk+0x16/0x40 [ 515.165740][ T32] ? nmi_trigger_cpumask_backtrace+0x31a/0x390 [ 515.171878][ T32] ? nmi_trigger_cpumask_backtrace+0x31f/0x390 [ 515.178021][ T32] watchdog+0x1030/0x1030 [ 515.182425][ T32] ? watchdog+0x1c7/0x1030 [ 515.186821][ T32] kthread+0x38b/0x480 [ 515.190870][ T32] ? __pfx_watchdog+0x10/0x10 [ 515.195521][ T32] ? __pfx_kthread+0x10/0x10 [ 515.200088][ T32] ret_from_fork+0x514/0xb70 [ 515.204659][ T32] ? __pfx_ret_from_fork+0x10/0x10 [ 515.209758][ T32] ? __switch_to+0xc89/0x1420 [ 515.214421][ T32] ? __pfx_kthread+0x10/0x10 [ 515.218988][ T32] ret_from_fork_asm+0x1a/0x30 [ 515.223741][ T32] [ 515.226961][ T32] Kernel Offset: disabled [ 515.231319][ T32] Rebooting in 86400 seconds..