last executing test programs:

5m39.093858124s ago: executing program 32 (id=338):
r0 = openat$kvm(0x0, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x18000, &(0x7f0000000000/0x18000)=nil})
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000200)="b90000004031c031d20f30f4", 0xc}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CAP_HYPERV_ENFORCE_CPUID(r2, 0x4068aea3, &(0x7f0000000300)={0xc7, 0x0, 0x1})
r3 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04)
mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, r3, 0x3, 0x11, r2, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

5m20.75197496s ago: executing program 33 (id=356):
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c1)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0)
mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x80, &(0x7f00000002c0)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}})
read$FUSE(r0, &(0x7f00000083c0)={0x2020, 0x0, <r1=>0x0, <r2=>0x0, <r3=>0x0}, 0x2020)
write$FUSE_INIT(r0, &(0x7f0000000080)={0x50, 0x0, r1, {0x7, 0x29, 0x9, 0xffffffff90adedc4, 0x0, 0x3, 0x0, 0x4, 0x0, 0x0, 0x10}}, 0x50)
r4 = openat$dir(0xffffffffffffff9c, &(0x7f0000004280)='./file0\x00', 0x0, 0x18)
syz_fuse_handle_req(r0, &(0x7f00000042c0)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000006380)={0x20, 0x0, 0x0, {0x0, 0x1c}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_fuse_handle_req(r0, &(0x7f00000063c0)="c91443d5daaf04b192358b692f84d66c60492a57cffd585b0068ccde45d94ded1e86d3670791c21f8e0b2153d10d45d37b72ee2fa06ad61b0a9354045a8dae1bd1cfb49f3c11fe54c17eee632d95574681e6c472eb8a1beaf3a4b88561847a0a0f05fa4a26639d7e74a0c1c2790d6a59d4073b1c55539b7c21b8550efbd5f835c56642f4be57d170e36a6bf3a995f418554f0cab342769089d0777b28daad5c0c4ba56a0bd6c0515d9bf488fdcf49a9a7bbfcf5ad78733f8119f2568daefbd0985a9916c0d048e38765cc7bb1c82e0f3c81d98e7179ec782331bc3cfb2caf58a99668420795e6a00ef41dcf5283bbb61ebaedbb7a675be4fb2d11c31f9b76936d1112c68978c73f42e145b094490d748c1456a14c23fe25e2fdaeaaa7dc0d35dcc9bbfe86361f99f4d04090d1e66aa9714ee9f4608ad66c60f500bf06a1b5b90fbe2f6c42c4b5f337393b0bb201473712c48f898c514fff84c46b50d3aaf44578f41d312bb5a73526db7818617dcb938ebdb17f92423ca2cf7ea2c611483e0baff012fd97e28558317049e4fe2d27f72796d7260b33900cd61f984c087d3c54f6aa11e389a49069ef99ca86c279598b42dd3485f09fc7e119f707438498316cf2f2bc8a293eeb1a35635989327d4f6c9ba6b2d5b9b8ee89a1e13d538b954479663223bb704af6a63ee497734410ea43bfdb0ad3708cb7155df2432c44e8468a7b77b807d345c9b94fedadfdeba12f4b6d11d16fd6dd5fff6cf896d0f40785ffca538dae61d8a5ffee814e96628cd945553e788b8d915762ca3b40124149b3c186ddd5f7af5b75f4725444f2f7e54b999c93e8c5fd4d4fbd7a3b3d7e85df3053c866f1dd247cac6912ed8b0e491101ca5a0b999a21014b573ba3996c76065c9d8bebf431f8be6435837193efd6e5a565b2ced30d04355435f166b09f9dc91ee50412d0daf72b28ec14c505cb155de1a46362f140ac2b633fa42b12109f0a29fa8ba271d6fc2a77af3b16032ee46b3ddead76a481ef52f6bd25cab4494681f0abc2ffc60ebb36cffcc058a067fcdae6c9de670cd6fde6eb8086a65fc05df17cf69f654516ba30ee04a1427b40fb8e81fe46787d557046854ad342442bacd781c7a6063892402fb0d765397448991206b28193e20f285e50d9219ace39b311e572ebcd80702164315656e7fa92960d0fd28c6489406f0b3061218417548e7e78b8aaaf5a623eb47c92aebfebd1c78343bc781f184e0122a28f56b18832da5646ee8405fa2fc040ab30377c447b42d0bfdddc65e064ccdf1ad52a94309a819caeb523e22b25d1ba288b7f2c726290d50021b9839c5d3c471aadb08025d97619935a9880942cf653508a0b2c43838e5aada8b84d22042928dd372dedec14672266ddceb0744c7464ab282d7fbfb2767e891832aa25d1425b33a60c6894a8d5292fdd73e05a868b8e50cb1a412d1249a77ccfc3d3eb35a67221f80bb8960fd93ceb74e102f2a6946b50caae3ccb86a8ec441d6e58dbf24b3eb962c8a28cffeded9b7cf4a54f524a1ef49fbdc91e125aad65a54df6a0f10cd8799f48aa144f7aec977b4a347c5c9628c4805ecf71f305adc9e5ca7c1f313f9ea3e99b3590efd94d831e1ff5cd7a26b72281109547facfa3abac2cfc9177b117a3757b778e95b5069236abb25d8fb032c38d296f87388fdd364b491cb828732177a2c6bcaaf831d138c898bb60c0d9d8a02d8b4b8e7efa87d3ed66221ac52e31ba9c2da488b999eaf82994bc8f1ac29d5e60b8b1cdc30a1c9829aca1cd7881c8aaac9ede0f5d8b85538d2b13751cfc6b37587b0223b9f6b6dd9340753106b1eecdf4f63c51cc2c63a1f86235bad7602e115d1e0ed78a6b170b88eb9584d2098b187695627612189998171d245797391b2b79bb690a79dac4b769e3f18c4d49359f7b460d997c03c793f51a830d5b21faed2ae1c3eb0fce0cdadde3c789ec931b6397c2a2fb2eda87756fec031e5f50f07619130f8e39f1e00004a1f204e5d87780542bdedf0b1ca5168779ad7cb2ebf27e0a5d760a2492b4d92eab24f2bc9af0a3e51140c415a6f885d0faa38ee6dcffc41652b28e628b859db0e7a0f961e37c5806df137e68c5316667f36051eb05c971e208721fdb8a49b8c49f85114be9dd7288f4e95c5f6fb8c1bc1bc7d79f32ba5419d90130a0328ba70d10c770a1540718f7d890dba9c39a116623d492275a1268c91149bfe026ca1c6a458449d4004d653f4b0a234eacd1f4da495fd1f936b4b335f64514fc8091b1dab132f599e26cb127e25011efa30a922b5a3e8807db9a00a9cc732fd323708767c905c8a3cd53e2e8d377d3b43cb971cbd0e66e2e47f3d601d49e29941b2ea4d3c8b7f5698e1a633ebba00f6c178d6d04b9f1544f04cd173e2d49f129a8725a647e1a9e798b5581c6a461b585012a302353178188e55f8102a49343c9c370ee505d09e4be8580d95f5bf39267b00e93adb6b52b2029160d78ac271e4e0c70ed835484e80302b93efd599707d4d22c806476fd04d18ebd6a9bf88c11dc2c96041ac8c3e04ac0aa5d2ac6740972717b543fb871884a7a0434a433571fd621977777984ea9c06914be966da9f349cb1ef3a116c49f0c716eae1df118cd3d5b350b917c06d853c1e1514213f5a29071e42eecee264ff20529c53c3a060a18a680ade2a08b4549e6998f06e61e4f4c36d578e9ad83dd38d1eeb100e7ab023edb38426d5165b867b9507a6b644aa0322da335b208105f2e74a9841ea7c629ea20cef740f6364e9d84a4485d3bb6b5f4e14c7764f78b65c0647870638a8f618381ec0823faed0424a448f753a59fb22e5138e0ca537b6935befb99fc6eea2d9457c01345afbbaaf3a7a96a39478b222af322f86730d137c3f570b38c7363bb9a89bb4b3b8979b9afd232927becbc91c8d4a276febe47bacd4a84c0bfdd54e685080f2c3be0b1e37bc6d21b13b7b1bfd507880f6ad7fa39bf99eaf6b7088d758d9383e38326381088e9e3e792f75d682cf61cf1176953960b0e160b2a535495d52c28f14fa45ed7a3f91e219dcd05afdda2b7e6c1b742b29f6c5f62a040a5fe6606433fce7de757ed76372dfc0b1af9af10c0128bcd335eff1c6c9660b0893730c3ef8de6e50dba419b35d1766eb9a5dce4c2fa518f8e3e2a27855e04d06b89e97578a4406ac03f3314575143db5e43ae3d03a7e90a590b4c188a5acbe1cf23cd4cf60ca98248d4e740122a55ac6e463511b4c4cd47040aafc0bed7878348a4caad4d977671cf4ac319773767ee28f8ccc4c9deae531b029eff5345470f20865549b2f2c4089306304e13e42ca37fbca6839bbcd2f10bd20c81d44ab73ad5ffcc55f51b53efb00d3c68d8d8505e005247ba23e86a803b199f36447fd01f192994b2fa27c9db59ae66b56b30c1ae5cd717407068a9b13ca941b82db254f4ecdbd1751a3f8f1061031bb41af5c04a33ffc98509f456830cf3c94c14451f04d84844e41c618e82958710d07daeba666329b914f2cc7c1d34ffbf6b50620b7c78c25c5d82a5aadcc4d824b3b68c34231fa7c0befe5241c447f90111c55848feed9d1ee67f61095ec2c0b4ac82f5cf169201516082a804c9d1775990d430d21bc65877041905caf385918f44191c134e493d960724b28f01e79fbf3b99eac1e75fbc8ab8dcfdd98b573fa6d7e6a6ead6b15ed78e2a8d564f61d8c52be8104306c104146696e16c9e9bff79a5fc1d92326cf0f2ff5e5c5c252773f2bd2c554bc409aaec03055f71d439daebc1d8b06c9ca0e1fe4729e8e6119616e8fb861b1e2694d1df267cbc496ba4a87013c3317a16b4c1e369748507794a20ad06aad20e4dbfc1834d789d2a8e9395ddad33a74c6c7cf54e61e533cae228909536eba8020f0c3845d2063270cae4d8e8dd8cfe3f112c46751444546ced9f6434741656dcda2185be13eebcc0392c256f384fc16353e89cbdeef8fb2e3cadc1ed2142f3b6485dc2d540fe799d027413128f624aaf8bc1933d3a0e6a954931bfc914921dec7ec822a31ebb652d4f312ab4068cedc6203b0de98e60c5f82296a3482132b288ba0a8eabdd8ac40faf145928e7563dbcb14d0625c92b542860993bb0388d8390dae727ae4086d4de1b7fea9d79f4844374bcd67fa5e1a3a28cd6d8da3f171fcf9d13062bb149fde18917c6650cdfa2be8de33b556ad34fad454db13a446e8a7c40167117e884d874c786768975df0b201ea0077ba735d31d65a832dc122d13c6559601b83899af1f14808f55f077ad465ed61378c63abff3ad742691168fe1e31bfd0dbb9f43d364ddf0bb185f69e69110c9eb1ab808354fdd2cf571838d5ec63bac3d70ca40878dc3c3cea26adffd5a197206d7c80d6a86c202338e72f17dc7185e1df0cfefa9475a2156738f90c6410c1698d1a160fd396548323c796ec5dca3cd59e468ff6a14caf34b4fdb16f1c92acb6bff2e859f9de1266dea0d1828598319b40a3edef657be02188fc94490c1da088d3ec2f315d6b5bb2f262764b67ba321379f4c93bb3ef9bc7db0c0e5f1e680ebfa84463e904d5351ecf25d1d22a98f81f7a1fc4c4fee3934b7672661f0bcd94109706644d0fdac4b7933b5db2acf39b98c0a8106a7a757408404a4c299a077379458e2118fb0a53b798adc1b85d3eb20b539e572741b9855e44a545809f897dde06730145b5caefe9db1c321783450d25d38834532c3e372fa92a53ac9cb4330eaaf65fe1b69a66459058e02d20c6641b7d8edfa8e356baaeb011b61208ef36ed33235144c86d6ce65da89d66da06291d4acc05e3136559ab77a7c4ad229c5307b48ed642d96c28cd06c82dedd4a16ed90bceda81292120438fd5c47b7b41b2646fe0899643f896ddb2d11e7311f8a0cbb9bfa38106507e06f35b3052ad6b6a11ac5f0129bedc59d04aee3737ebbf10f97c80f1a4e3f51ac8ac4488ad9e3f685a7c0dd4074b07774f4efe4b9f2cba400ef49f73b12fc7d96d8f3283a1eaf8c003931fc24a9248e201ac31bb49226c37d535592e00308d86ba0765a7eda13b72686101d352fb959598038b8dec44a0f18e5c8ec089912d325880390ce5186d4585df46e5662987c164f0ccfb8f12f6144f91349051d3ffa35ba597d2b5920e279ca8e139dfe2ba9923c0190fd444c8bf12a627618791a8781d6b54470777e6a5dac8cb505ae1e534b0c3af7db010dd602b1459964e1e15a812f3b4c8038e6bc1dc568ba482ee4944582abeeda1ed012391706ddb1e0ce60efd15acde8283d3612de5d0cf76185ad3a1ce89488e1cea4009573b55a2766d100ecefc5d53c99876cfec65daea82f55cf9687ec70e45cfdba9fe69fc3a822c29ff4be34857bdcd4313fb23d1d01d8a79cbd0057eeb5c1c0b39f75d5a753a2e10bd0ebb91dab1312bdf1a984332d566ab56dfd838d285995bec8726c5d1358fe10b0b6aaa99b9d9b08894c1dbd06356e5c693ddebb9d8b306062defb160db9d8f02ae3df59697866f5adeb34c8c5b27b63b09675030f344197b3bff097b996819dec9059aaf5ec1a6c585a86d16528091543a9e6bca4d850b7963fd1e7d981814dedb165c1a6444ec0a21743a4de8845b386ad4e1e9c9f2873f6a353487d9a8f8f56ae1d0f69124ee56b5c2b2a48c78cc6ba6b313b889adf0acfaebb4e2dc71054a4992366a2b6ff1f5972d7d2f0e9e3b17d7fbe931f43871819dc6e6040ba239ebce2cfa424ff7344b8a880040321909dcd16956594f5d99fdd39ea5d7209b906d2601572c56c72db899f986185194fe5aab45f27d9ac12aa8600b3c2728ef2e589a6886d711edf4d7f95b2e10d9adde3009560ad754f9e7a52808720a973dc475f8177fd5b199b69925f03a44a8bd9f3c3369861802ce5ca4b40cb47d19e2e1bda1b054f16b66ac7b7c0e5205112e011d6957f1df50505003544631ff4385d8128d46838338930aebc0496348045a7c05abd7a56e1079947d3eb1c50e4d8be001d03d8973f8f08f2f21a415174173ccb90f7ab615be5036947e164a434c059637bfeebb8b9f2e87b9774a4595c71122c9fac74347488b9a054e2e7b9c45b7b12fcca0fe789db614c70d4149d44e50fb64aabccee7447288a5b865a60c2640171f89afecda2cb18b7ecea214bd32f43d5ff66e90741697d085f3ee9bfd8662a3cc570999bb151090160d3bf5bf1d85e896d66276cba7ed97f341f595b13c02ac2a1352aec7a5980de2c8f9d890951108947b7602dcf2bdd2aef680667572b87aadf7c54338492eae763df73e89e3c438c196da83d98bc65233a242e08894f2390d8714f0abb801d9e5c42f169555284b6cf079005b373e9938db71a93ee5945c2a43a06e3df580d372318b3d203503c6e968206d7db8116cca2f2a1fae7f5b5195bea92914d66516bc3ceb2d9dc4de59d0d52ab80910aba7ebb696c7deaddcf0fedf56e2a88c3496bb79897c6420a0ef1b03ad89c76b24f67ffd41c9227d464565457bb25f0b32c83e676b0a3284f2acbed39c6875871c5e866a8284f12e383f87f12dd9bbe3078c68b3711eaa9bc17a7ac8413a8ef486922eddf43f01625671b7c3d0a4c6c2dc38217b4135c8cb46df7d936aabfd253e95e0816dd1f92b257e2f96d2a259a320756ba77d99b709711326f2ea42def974d60f817a1f6779121dd32a1cb194c7809e4c8fd052ba357323436491ec45a49fa601ed373aadd2199e4483704fb2f4edd7bf2815b552fb84d09094cab9700b5125887ee508570217c16799bc11d9e3658de8d9812f30dc8078bbecaf887a6527686b026eea70229df1e61759adf19c1b96673419decb382ae29bd685c5f32120b2d56d3e97c9ef00a2c0598c2181b8fa53172312590a9549ff55dffb9070b042c74654b2ae56371b2a6bac8e2808a40fd5d6d0af184c035101394e347521467e0ddb962e0d63614cf1461ac7b9d744084e9f6f26c88d515dbb1b7392b8e9384b81f186224d5c09e266682d8044d8afb1bd6483962b03ed6884759d2647b8f174a6695a437a1f1aac3e6a2f8ca658ee8a8ae44a77393cec61a9f335a1e859825e73df4125828fbde19d3695125992ddb2826ffbc6c7cfbfdbae19ba864c4170c79cce408e8b280a7632c855d802029ebac8627fbd6fec1c3bd858411c969ca035992f2ab909c423158dffd0dd5a407b3e0c2d9b180440996e09e15f17b4e42f365371d9dd58c4609455253c44c2ba73f592e360ab5fcccdb6e90ae0c60ada9325c4824242c0d866e7dfbefe091067d5c7ff0432814f733591eb0096659738b34cfa8c6c988ec628f34fe08f31dc0156dc39866412932d045168f4f3a48f24fb3b884be1384845d496c3009626f1c41b0189e95c9055d24eb5a0390596f6ccf50d3727e607875a3b2cf076a277e12ac07ddc59da78ee16e1952706ac6a1a9ade80b867d889789c935d196cc4da67aa35ba80ef2077ee4dd69c5f31a0410f7fd0739303ddcdbff2f53e0a44ec5de0f062e533444bd946959a1d9c25b297b6fc7675ca4add9e24e8ff390e0375f3b15e1d3e8129007d743e384659f191bd23ffe02140fa64d5c6d75937b28d51afcaa9d207f57c878f2f54493025e9eff5b5ce0c997d11c9690262e38e1e83c7f1a0ed3f200d9d0472739d59dea3cc6e8783758e3e3201731cf27211267702594356345449b42fa64b64c6f00a8f26665524fe2208b1a7c5fbdc822ea611c1811526471e4f52ab5e3a43de8fd4eba2fb2796a206e348de9b0be78ded78204dc82d9e9adccbe408d7ff538aab3d663eab189927a9cd597388e8dc5063d2db42cd65415fa32d20288da017c9f94e788dfe7cc3a0f6b6ab06116ed3f72f3c048cb1e51abf308ed7169908d1ad5b7ab3a86a3316d164084f8d88c6f96142d888ccb158efa586015914c116db114aa82c44a55d4c33bd901dc34e820d3120d57def03ea4f01b263913cc02ca586b208506d149ef03a706fd5360a12b83acb7bf97ac1f1f85389d4fbfdcf38551e9dbce760a05e8e4023d85038570d3697b3e7de73aac9c7feb39b6ccd1a775c8ce01b08d7190e28866aa7bb8d0cff0fc45b452fcb6a290f98f4b5ec125224c8a93918b1f2888befba6de3d294ee1f13a9c56e92eaac0b8e6c6905e77a60ea7e1d1ed979b6b2606652e7d75750a065c57c7efb1ef5708719ef04e354bd861b15e0a1cbc7cfe65c8a3d9a2b790260d6e6eb60bd4e0fb3f040dfa27fa00797664122add0750a23a8b20fcd68b6be1e21620dda4bf0561f4c5ed74f41612a0676dcdbf669df3436cbf2ce253e69319e3ab36e6e6314f11e0d0882ee3d7f3d3b3dcfe3cd7f061e301369207545676e09801f9bc4bc4c3dcaf48e5320a4b3211051a7525868a0ac1278ed6fc9531ed89cf4205458acc05d5351bcab7ea50250b6cb4c6fdd0cd96f30cdc9a820f495d0a3e14eb6c493a85a87e3b7fb8e5f23431c3c5359f5802f1fc11ff71c3172c6b57b5587ab38579b79e328792edb7a81d60762bc6c88693a00712f811cab9b075a97535c904396dbd2fa0994ba9c9b06fe9c042cb6860d22844b94863bf7b68a1ab8639e4487b38d48e40da4a98dedd7d73ca4b575bf4c604a364a9247c2ea5e3b127ff42f9bce1d3d37c2428edab1708ebd71ac0e4a408a9c6eb97407a4a8b5e912e2c63fadd1abad9a772a96fc4666f7d2b604adbde6f1136de2adfe38994491ab0f34ff1fd20cb8034ad39aae4c5c0076da2e7a157764b770e1c5f35b6f323ce809b2e92be1345204021d74712368e0ef77056afd85f065bba085793c9b6950d3c3fc6c445afbdd5a80cf7b0bb13055fd486700be1500bdf8771e286a63962e56d4771ed5eefbf111ba7380f02d6f96eed174246820b73bd772689c072bb3d8e43ef96f5466dce5c9392e34b7176821d2f4df3dab4c6ef5e0238ffe61582812fdacc987fbb6d98cad5a2d7af0e4c8dd3f800cd75c38a515d4d4c7118c5f81c6f7504e7ae452370c56c4b7fb4daa65bf26919c12081485d09e9d142965320211f483ed2a0a6836fa2488a878eaf9653b0528c3680b75a1920a25b5c5c17548c7ceb9a1656a0cf6a404aec14f7ed8a1dcf8ed32e1cf94dc2f60b65aa102650b7a22d9e708c606ce8403ceb81434bd9938b2c4e5a8530a156a1df7d143b2da54071ba3e673ce11760f72c32273b7bcd9a48da2a6caeb4b782cf1c3a044c1731f3ad61ce32bbd0b52cbb187cb3ecc1e85a67ffe27cf86769a0d69fe293dd30f060b8a0f26ccd0287d0b8d941ee7410a7c6aa430add67c2dd60db292e24f294ce80b0321aaa4d054a6f5d9981e1d5e859b454f5005be082bd59baca5775eedb7994333c62c452ef7b2893e4d03a28c0e368928b4bdd6e31f52a83cd7e162975405fd128321e0a8e3e77fd93257b0c46b309e16203974382ced818faac3a02e74141e9ea36c4a1b98bd859fafce43b2984d856c832f61b1ca562cee96f5843adc14b35bec1ccdafedd214f1a344345373f3c9eccee8324950a23c3e77d55dbde9a7ac1b7804927affb8b0e1488dcd8919d227bd1f50a35abf25e3f120c25b0dfb4d85b4c2a2c69cf7047c76c45e4e901e7396140496f9a322c2c2ac777a27adff5a6daf32e852b1bac89f1086739a603cf0f6838f792351c08e38ab130e5a83aa5a4f2da19df131770a308d810eed0059a2e5546a2169b9d0119f6df7c18981f4b4f119c76fdaac031ce7551f25678b5c4d8815a7ea9565e63389fca6ea0bcd40e71ac72124113dc0041ce26a0c9979ff76d7f1f2c0cd2c16d8c7a36930b909ed7e2d4adfa8352b12b99bdcbc25b485f652539fab7ac983c1ae925967c15ba2345e45d6bafe13b3e9d7acf1a592422ea09c3a45f7fe24e235bd70b106cdaa665584e74cdaf9f39b804bc6c4e7f0bf572225acd4dfe010081b91c2d5970d4f43d2e1a0e05f84baaf50642991b3704034aed74572e6a4715b79276432d06660b39c989570fc0d5d0071a7c690658caee447370d3295db3b5dc625e697e1ca2675b5430b9969024835c7d001fbce86c5165c4fe8f2d46b883daaa3fbf42dc5cf61209379013896df740b9cc32638358ea8079a33f04197f650471086e67e5cf9779268d7973c73bbbde2f1c11e1a8e2b154aaa8b4b74f8a03f14ceb7afc4ba35e6620b7af89c969021d20cb260c1868f3fa432ce7e509db06001ae6540531b126c1e3a851acbf0a9c1354bece05c094d69d9bd87f99391e23306911383d2082997339daebd67d8a707c9b496a309b7921696f39a07864f31208802db7188881e346b41c34f4129fca9c6a13172a4dabfe791584d240fc03685057d53c08737aa1d486233318eb4545f2e8d18087705b9d3a7658564592f56aea3aee53d66c249988bf353853728553a1577062e24af533f47dc012ae90c5c085babc121be2993c063e203ab949a088041271a03527c56edd4b7a87e98323a0137cd493aa05fe38d02754a66d89348b119e6200d5919bc366788eb67115fc57c4c1a9dd42c7411d6709ad82de8662a1849445b39beb2ba8f894860e41a054f61337179a9214b0884f3964c95ed2a4ab37de8038566bba76fbaa7502c0460558ff4bf4793ca68d78e50f384a81da4cfa23723747e906b82290e0b8ea07e3404bee0915800d4c3c07f94c43e7aafbc7a44d923de97963d0d1586bee06fc90aadbe5758fb9933ff7df346d62e082223741f5cb26ef953ca654ab983a72b30b296891c9e3f1ed5216b0e588eb25f5d4ccad6f96973cc2d26196bbd37c83266473071ccd84d9e3c74f22621e8bd60afa4bcad6c853c7591fe5d4298a954ea5006f682a7a65aeb26b230f3866a28a58bf532aca8fd5eaec64f442ac510a7df4114f00fd6ff7e02d77f8e72797222556959958c4c4d166c5af18a6e25588cac9871a3d5bb453889ff8d13db22024a997bf97a5afdf698b1deaff3101e27868d2de47b92c403ce82e15f3239d8923e8ca0c01e3781b5dd6121f57d2238dc3ff8a1bde3e371efd33838c552e43588042b360f55d7ca92f11987630364b263428e18601d7bf23f6432b3a9aa2c500cd9ac5f73cbe309443858a2806956b0cdcfc19904567bb1703641017c6199e768410e03d8ba603eb34249d567370202f39639ae8f6d52d9d5dbfc544c5b85ac8187095c63f1f613fe4af179fc5c837e6e0ccc21e62ac22ac045c4ac3b1ca6a4cbdbe29ea465240fc0aed1f0e086d7580bcf81d4e2a4d55a8e3bc57110e7cf1e1895df07974f0686dd2ea2b12bbfd64e7a9d0c62c662f0370e6ed495eeb2ee5029042147a1f2e5fcd6068b06567be893cb80e2cbb5fbb12847313811c13cf685698d5e2175959579e510279b9e959ac2c3f94fec653c6b521f8909d633ccedbc1109285ecbd52d27cd2891eaf354db2c966d1e3086718848433c12658fe7f6fbfef930b963139a63f6c4caee5a1964d3a038dd0db403c0a251d702c07a0fba4a3576ec6668a78e9e26efc6ad83a670a47608bf4207979bf196b3160c95e7ccc6406d46f529d34676b76d72396262e1448df051130a21484e0e977df1f7f0a259ac762eef9506877498b9998e1286d6294cf60b95352e81c3", 0x2000, &(0x7f0000001180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={0x140, 0x0, 0x3, [{{0x4, 0x2, 0x7ff, 0x7fffffffffffffff, 0x7ff, 0xa33f, {0x3, 0x9, 0x3, 0x6, 0x5, 0x2, 0x5, 0x6, 0x7, 0x8000, 0x0, r2, r3, 0x6, 0x3}}, {0x0, 0x7, 0x93, 0x300, '\xae\x9e\x90^5\xbe\xf0\x0f\xf2u\xfd\xe1\xc2\xfe\xa1m\x0f<\xe9*e\x94U\a0\xcf\xf94\xdbq=\t\x9f\x1bc\x9d`\r\x19\xb6\xce\x11\xb9\x8f{\xfa\x9a<\xbaG\xff\xfb\xd9\xa8Z\bg\xbc\x02\x15\xe0~.\"1X\xfd\xba\xc2Y\xf9\x8b\xd9\x97\x19\x953\xc1\xf4DD\xca\xf3\xa9\xf5\xb9<\xb7xu\fg\xe4|\xc7\xe2\xf2\x8e\xa5\x04\x1cP\x80\xaf\x0f\x93$a\xce\xf8]\xd6Wz\xe4\x8d]l\xbdd\x04\xc7\xb4\xae\xd5NP>r\xe8\x1d\x1d\x8f0\xc2\xe9\x9d6/\xc1VC\xb3\xed\xac\x9a\xc3'}}]}, 0x0, 0x0, 0x0})
getdents64(r4, 0x0, 0x0)

5m13.529961238s ago: executing program 34 (id=379):
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x4001})
r1 = socket$inet(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000080)={'syzkaller0\x00', {0x2, 0x0, @rand_addr=0xac140001}})
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1})
r2 = socket$inet_sctp(0x2, 0x1, 0x84)
bind(r2, &(0x7f0000000000)=@in={0x2, 0x3210, @rand_addr=0xac140001}, 0x10)
listen(r2, 0x5)
write$tun(r0, &(0x7f0000000200)=ANY=[@ANYBLOB="00000800010000000000140008004500003c000000004084ca2502020202ac14000104d2321000000000000000000100001c1122334400008000000500050000000514010008"], 0x4a)

5m11.79076328s ago: executing program 3 (id=436):
setns(0xc9, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1\x00', 0x129942, 0x18)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40a01, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201})
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = dup(r1)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}})
write$tun(r0, &(0x7f0000000080)=ANY=[@ANYBLOB="001c86dd0700100000004000000060ec97000fc83a00fe8000000000000000000000000000aaff020000000000000000000000000001"], 0xffe)

5m11.315336185s ago: executing program 3 (id=437):
sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0x2404c845)
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000000)={@mcast2={0xff, 0x5}, 0x200, 0x0, 0x1, 0x3}, 0x20)
r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/ip6_flowlabel\x00')
read$FUSE(r1, &(0x7f00000059c0)={0x2020}, 0x2020)
r2 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000280)={@mcast1, 0x800, 0x0, 0x103, 0x1}, 0x20)
read$FUSE(r1, &(0x7f00000000c0)={0x2020}, 0x2020)

5m11.111972211s ago: executing program 3 (id=439):
r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$batadv(&(0x7f0000000100), r1)
ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000003c0)={'wlan0\x00', <r2=>0x0})
sendmsg$NL80211_CMD_CHANNEL_SWITCH(r1, &(0x7f0000000200)={0x0, 0xfffffffffffffe26, &(0x7f0000000000)={&(0x7f0000000400)={0x2c, r0, 0x1, 0x4, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x994}], @NL80211_ATTR_CH_SWITCH_COUNT={0x8, 0xb7, 0xa5}]}, 0x2c}}, 0x0)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000640)={&(0x7f00000006c0)={0x78, r4, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_FRAME={0x53, 0x33, @probe_response={{{0x0, 0x0, 0x5, 0x0, 0x0, 0x1, 0x0, 0x1}, {0xb}, @broadcast, @device_a, @from_mac=@device_b, {0x5, 0x6}}, 0xaef4, @random=0x8, 0x8808, @val, @val, @val={0x3, 0x1, 0x9d}, @void, @void, @val={0x2d, 0x1a, {0x1, 0x1, 0x6, 0x0, {0x4, 0x1a39, 0x0, 0x3f3, 0x0, 0x0, 0x1}, 0x0, 0x101, 0xfe}}, @val={0x72, 0x6}, @void}}, @NL80211_ATTR_CSA_C_OFFSETS_TX={0x6, 0xcd, [0x0]}]}, 0x78}, 0x1, 0x0, 0x0, 0xc0}, 0x0)

5m8.345380293s ago: executing program 3 (id=443):
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0)
mount$bind(&(0x7f0000000380)='./file0\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x2125099, 0x0)
mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0)
mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101097, 0x0)
mount$bind(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b100a, 0x0)
mount$bind(0x0, &(0x7f0000000240)='./file0/file0\x00', 0x0, 0x80000, 0x0)
mount$bind(&(0x7f00000001c0)='./file0/file0\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0)
r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901)
move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x200)

5m8.289878599s ago: executing program 3 (id=444):
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000240)={0x73622a85, 0x0, 0x8000000000002})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x800, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000280)=[@increfs], 0x0, 0x0, 0x0})
r2 = dup3(r1, r0, 0x0)
r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0xb})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f00000005c0)=[@acquire], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000880)={0x4c, 0x0, &(0x7f0000000080)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, 0x0})

5m6.541656657s ago: executing program 3 (id=451):
mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./file1\x00', 0x100)
mkdir(&(0x7f0000000000)='./file0\x00', 0x0)
mkdir(&(0x7f0000000000)='./bus\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000380)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]})
chdir(&(0x7f0000000140)='./bus\x00')
open(&(0x7f0000000040)='./file0\x00', 0x84242, 0x1df2a23c5997fad6)
r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
renameat2(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', r0, &(0x7f00000004c0)='./file1\x00', 0x5)

5m5.89609792s ago: executing program 35 (id=451):
mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./file1\x00', 0x100)
mkdir(&(0x7f0000000000)='./file0\x00', 0x0)
mkdir(&(0x7f0000000000)='./bus\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000380)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]})
chdir(&(0x7f0000000140)='./bus\x00')
open(&(0x7f0000000040)='./file0\x00', 0x84242, 0x1df2a23c5997fad6)
r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
renameat2(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', r0, &(0x7f00000004c0)='./file1\x00', 0x5)

3m24.756187062s ago: executing program 5 (id=1023):
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./dev\x00', 0x1ff)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x0)
mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f00000001c0)='ext4\x00', 0x8410, 0x0)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuset.memory_pressure\x00', 0x275a, 0x0)
write$binfmt_script(r0, &(0x7f0000000000), 0x208e24b)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x28011, r0, 0x0)
ioctl$FS_IOC_FIEMAP(r0, 0xc020660b, &(0x7f0000000300)=ANY=[@ANYBLOB="03000000000000001100000000bbf48f0e"])

3m24.31087431s ago: executing program 5 (id=1027):
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000240)={0x0, 0x0})
mlockall(0x7)
pipe2$9p(0x0, 0x0)
pipe2$9p(&(0x7f0000000010)={0x0, 0x0}, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
fcntl$dupfd(0xffffffffffffffff, 0x406, 0xffffffffffffffff)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_mreqn(r0, 0x0, 0x27, &(0x7f0000000180)={@multicast2, @loopback}, 0xc)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'lo\x00'})
setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000480)=ANY=[@ANYBLOB="e0000002ac1414"], 0x28)

3m24.115952442s ago: executing program 5 (id=1028):
r0 = socket$inet6(0xa, 0x2, 0x0)
close(r0)
r1 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r1, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10)
recvmmsg(r0, &(0x7f000000bfc0)=[{{0x0, 0x0, 0x0}, 0xa3}], 0x1, 0x40000000, 0x0)
setsockopt$inet_opts(r1, 0x0, 0xd, &(0x7f0000000200)='`', 0x1)
r2 = socket$inet6(0xa, 0x800000000000002, 0x0)
setsockopt$inet6_udp_int(r2, 0x11, 0x67, 0x0, 0x0)
connect$inet6(r2, &(0x7f00000001c0)={0xa, 0x4e23, 0x3, @mcast1, 0x2}, 0x1c)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @multicast1}}, 0x1c)
write(r2, 0x0, 0x0)

3m23.898465473s ago: executing program 5 (id=1031):
mkdir(&(0x7f0000000000)='./file0\x00', 0x0)
mkdir(&(0x7f0000000100)='./file1\x00', 0x13b)
mkdir(&(0x7f0000000000)='./bus\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000380)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]})
chdir(&(0x7f0000000140)='./bus\x00')
openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./tracing\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./tracing\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./tracing/uprobe_events\x00', 0x401, 0x0)
syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10)
write(r0, &(0x7f0000000180)="707a73408b202e2f66696c65303a30", 0xf)

3m23.781096887s ago: executing program 5 (id=1033):
r0 = syz_usb_connect(0x0, 0x371, &(0x7f0000000280)=ANY=[@ANYBLOB="1201000057ec0020c215dcff30bd0102030109025f03019b000000090400000b403b4e000905e2379c"], 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$uac2(r0, 0x0, 0x0)
syz_usb_control_io$uac2(r0, 0x0, 0x0)
syz_usb_control_io$uac3(r0, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, 0x0)
r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x80000000)
syz_usb_control_io$rtl8150(r0, 0x0, 0x0)
write$char_usb(r1, &(0x7f0000006800)="12", 0x1)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)

3m23.395965919s ago: executing program 5 (id=1036):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
r1 = socket$inet_smc(0x2b, 0x1, 0x0)
setsockopt$inet_tcp_TCP_MD5SIG(r1, 0x6, 0x20, &(0x7f0000000080)={@in={{0x2, 0x0, @multicast2}}, 0x3, 0x0, 0x1a, 0x0, "5ec800000000000000fabcaff49c2eeb8c4614c85b196a0c67a7768e058e3008931c08d43101cb8242bc42b8e0662749302c1ffcd1d1190000000000000000000000000000000000000000000200"}, 0xd8)
socket$kcm(0x2, 0xa, 0x2)
r2 = socket(0x10, 0x3, 0x0)
setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0xc, &(0x7f0000000140)={0x4, 0x0, 0x6}, 0x10)
write(r2, &(0x7f0000000000)="1c000000", 0x4)
sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a70000000060a0b0400000000000000000200000044000480400001800a0001006d6174636800000030000280080002400000000118000300c6fffffffffffffff5000000fff50000070000000a0001006f776e65720000000900010073797a30000000000900020073797a32"], 0x98}}, 0x4048010)
r3 = syz_usbip_server_init(0x1)
syz_usb_connect(0x1, 0x3f, &(0x7f00000001c0)=ANY=[@ANYBLOB="11010000733336088dee1edb2361000000010902"], 0x0)
write$usbip_server(r3, &(0x7f00000000c0)=ANY=[@ANYBLOB="0000000300000001"], 0x35)

3m22.894944903s ago: executing program 36 (id=1036):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
r1 = socket$inet_smc(0x2b, 0x1, 0x0)
setsockopt$inet_tcp_TCP_MD5SIG(r1, 0x6, 0x20, &(0x7f0000000080)={@in={{0x2, 0x0, @multicast2}}, 0x3, 0x0, 0x1a, 0x0, "5ec800000000000000fabcaff49c2eeb8c4614c85b196a0c67a7768e058e3008931c08d43101cb8242bc42b8e0662749302c1ffcd1d1190000000000000000000000000000000000000000000200"}, 0xd8)
socket$kcm(0x2, 0xa, 0x2)
r2 = socket(0x10, 0x3, 0x0)
setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0xc, &(0x7f0000000140)={0x4, 0x0, 0x6}, 0x10)
write(r2, &(0x7f0000000000)="1c000000", 0x4)
sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a70000000060a0b0400000000000000000200000044000480400001800a0001006d6174636800000030000280080002400000000118000300c6fffffffffffffff5000000fff50000070000000a0001006f776e65720000000900010073797a30000000000900020073797a32"], 0x98}}, 0x4048010)
r3 = syz_usbip_server_init(0x1)
syz_usb_connect(0x1, 0x3f, &(0x7f00000001c0)=ANY=[@ANYBLOB="11010000733336088dee1edb2361000000010902"], 0x0)
write$usbip_server(r3, &(0x7f00000000c0)=ANY=[@ANYBLOB="0000000300000001"], 0x35)

2m12.78571939s ago: executing program 6 (id=1522):
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x6)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f0000000140)="66baf80cb8044fdc87efed660f388059e0b805000000b91e4200000f01c10f20c035000000200f22c0f20fa20f01cb36263e660f381efc660f7c150c000000b805000000b9210000000f01c1c4e17929d8", 0xfffffffffffffed0}], 0x1, 0x11, 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1)
r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x1e9100, 0x0)
r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0)
r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0)
write$binfmt_script(r6, &(0x7f0000000000), 0x208e24b)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000003, 0x28011, r6, 0x0)
preadv(r6, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x1, 0x0, 0x0)
r7 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x54, 0x0, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000014000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, 0x0}], 0x1, 0x4a, 0x0, 0x0)
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@textreal={0x8, 0x0}], 0x1, 0x7a, 0x0, 0x0)
ioctl$KVM_RUN(r3, 0xae80, 0x0)

2m12.177573107s ago: executing program 6 (id=1526):
r0 = socket$inet6_mptcp(0xa, 0x1, 0x106)
bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0xfffffffc, @empty, 0x7}, 0x1c)
syz_genetlink_get_family_id$mptcp(0x0, 0xffffffffffffffff)
sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, 0x0, 0x0)
listen(r0, 0xc)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff)
sendmsg$MPTCP_PM_CMD_ADD_ADDR(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)={0x30, r3, 0x1, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x1c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @initdev={0xac, 0x1e, 0x0, 0x0}}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x7}]}]}, 0x30}}, 0x0)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000740), 0xffffffffffffffff)
sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)={0x14, r5, 0x1, 0x70bd2c, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x20048001}, 0x800)

2m11.915373211s ago: executing program 6 (id=1530):
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./lower\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./upper\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./work\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./mnt\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./upper/dir\x00', 0x1ff)
mount(0x0, &(0x7f0000000200)='./mnt\x00', &(0x7f0000000240)='overlay\x00', 0x0, &(0x7f0000000300)='lowerdir=lower,upperdir=upper,workdir=work,index=on,nfs_export=on\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./mnt\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./mnt/dir\x00', 0x0, 0x0)
name_to_handle_at(r1, &(0x7f0000000500)='\x00', &(0x7f0000000600)=@FILEID_INO32_GEN={0x80}, &(0x7f0000000700), 0x1000)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
open_by_handle_at(r0, &(0x7f0000000600)=@FILEID_INO32_GEN={0x80}, 0x0)

2m11.625619181s ago: executing program 6 (id=1541):
mkdir(&(0x7f0000000000)='./file0\x00', 0x0)
mkdir(&(0x7f0000000100)='./file1\x00', 0x13b)
mkdir(&(0x7f0000000000)='./bus\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000380)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]})
chdir(&(0x7f0000000140)='./bus\x00')
openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./tracing\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./tracing\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./tracing/uprobe_events\x00', 0x401, 0x0)
syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10)
write(r0, &(0x7f0000000180)="707a73408b202e2f66696c65303a30", 0xf)

2m11.54813552s ago: executing program 6 (id=1535):
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/nvmet/subsystems/testnqn\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nvmet/ports/1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/ports/1/addr_trtype\x00', 0x2, 0x0)
write(r0, &(0x7f0000000280)='tcp', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/nvmet/ports/1/addr_traddr\x00', 0x2, 0x0)
write(r1, &(0x7f0000000300)='127.0.0.1', 0x9)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/nvmet/ports/1/addr_trsvcid\x00', 0x2, 0x0)
socket$packet(0x11, 0x2, 0x300)
write(r2, &(0x7f0000000380)='80', 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/nvmet/ports/1/addr_adrfam\x00', 0x2, 0x0)
write(r3, &(0x7f0000000400)='ipv4', 0x4)
symlinkat(&(0x7f0000000440)='./config/nvmet/subsystems/testnqn\x00', 0xffffffffffffff9c, &(0x7f0000000480)='./config/nvmet/ports/1/subsystems/testnqn\x00')
r4 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0)
write(r4, &(0x7f0000000500)='transport=tcp,traddr=127.0.0.1,trsvcid=8', 0x28)

2m11.32464157s ago: executing program 6 (id=1538):
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x101000, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
ioctl$KVM_CAP_HYPERV_SEND_IPI(0xffffffffffffffff, 0x4068aea3, &(0x7f00000000c0))
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000001c0)={0x205, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000280)={0x0, 0x0, @pic={0x4, 0x7, 0xe1, 0x81, 0x9, 0xd9, 0x40, 0x41, 0xfb, 0x1, 0xc, 0x2, 0x2, 0x41, 0x1, 0xf0}})
ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000000)={[0x6e, 0x0, 0x5, 0x20, 0x3, 0x2, 0x106c, 0x100, 0x8000000000000001, 0x80000004000080, 0x380000, 0x2000008, 0x8, 0x4, 0x0, 0x8000], 0x1, 0x3c4210})
setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x43, &(0x7f0000000180)=0xffffffff, 0x4)
ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}})
ioctl$KVM_RUN(r2, 0xae80, 0x0)

2m11.10732143s ago: executing program 37 (id=1538):
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x101000, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
ioctl$KVM_CAP_HYPERV_SEND_IPI(0xffffffffffffffff, 0x4068aea3, &(0x7f00000000c0))
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000001c0)={0x205, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000280)={0x0, 0x0, @pic={0x4, 0x7, 0xe1, 0x81, 0x9, 0xd9, 0x40, 0x41, 0xfb, 0x1, 0xc, 0x2, 0x2, 0x41, 0x1, 0xf0}})
ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000000)={[0x6e, 0x0, 0x5, 0x20, 0x3, 0x2, 0x106c, 0x100, 0x8000000000000001, 0x80000004000080, 0x380000, 0x2000008, 0x8, 0x4, 0x0, 0x8000], 0x1, 0x3c4210})
setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x43, &(0x7f0000000180)=0xffffffff, 0x4)
ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}})
ioctl$KVM_RUN(r2, 0xae80, 0x0)

1m56.58731298s ago: executing program 7 (id=1637):
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x8000, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0xe8, 0x0, 0x0)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0)
r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0)
write$binfmt_script(r4, &(0x7f0000000000), 0x208e24b)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000003, 0x28011, r4, 0x0)
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0xc000}, 0x4040)
preadv(r4, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x1, 0x0, 0x0)
r5 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil})
r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000640)="430fc73f0f2390b9800000c00f3235010000000f300f20d835080000000f22d8c4e18173f53866baf80cb83879e487ef66bafc0cec66b88e008ec02d1aa80000460f1c460041ae", 0x47}], 0x1, 0x74, 0x0, 0x0)
getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000240))
ioctl$KVM_RUN(r6, 0xae80, 0x0)
setrlimit(0xf, 0x0)
mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2800003, 0x31, 0xffffffffffffffff, 0x231cd000)

1m55.776530839s ago: executing program 7 (id=1642):
sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0)
recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[@cred={{0x1c}}, @rights={{0x10}}, @rights={{0x10}}, @rights={{0x10}}], 0x50}, 0x80)
r2 = mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
semctl$IPC_STAT(0x0, 0x0, 0x2, 0x0)
semctl$GETNCNT(0x0, 0x2, 0xe, 0x0)
fsopen(&(0x7f0000000000)='virtiofs\x00', 0x0)
r3 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x400, 0x0)
ioctl$COMEDI_DEVCONFIG(r3, 0x40946400, 0x0)
ioctl$COMEDI_DEVCONFIG(r3, 0x40946400, 0x0)
socketpair$unix(0x1, 0x1, 0x0, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=<r4=>0x0)
r5 = syz_io_uring_setup(0x75e7, &(0x7f0000000480)={0x0, 0x7210, 0x2, 0x1, 0x1cb}, &(0x7f0000000500), &(0x7f0000000540), &(0x7f0000000580)=<r6=>0x0)
syz_io_uring_submit$UBLK(0x0, r2, r6, 0x0)
syz_ublk_add_dev(r5, 0x0, r2, r6, 0x0, 0x0)
r7 = socket$inet6_tcp(0xa, 0x1, 0x0)
r8 = dup(r7)
syz_ublk_setup_queues(r8, r4, &(0x7f0000000180)={0x0, 0x9878, 0x0, 0x201, 0x38c}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x800, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x40, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xad4b, 0x2, 0x40040081, 0x334}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x40000, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0)

1m54.60135002s ago: executing program 7 (id=1649):
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, 0x0, 0x0)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x4002, 0x0)
ioctl(r1, 0x40480923, 0x0)
ioctl(r1, 0x40140921, 0x0)
mkdir(0x0, 0x0)
mount$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0)
chdir(0x0)
r2 = creat(&(0x7f0000000100)='./file0\x00', 0x59)
quotactl_fd$Q_GETNEXTQUOTA(r2, 0xffffffff80000900, 0x0, &(0x7f0000000440))
ioctl(r1, 0x40140921, &(0x7f0000000420))
ioctl(r1, 0x400c0930, 0x0)
r3 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFULNL_MSG_CONFIG(r3, 0x0, 0x40)
ioctl(r1, 0x40140921, 0x0)
r4 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
close(r4)
pwrite64(r1, 0x0, 0x0, 0x0)

1m54.454501361s ago: executing program 7 (id=1651):
r0 = syz_open_dev$ttys(0xc, 0x2, 0x0)
syz_open_dev$ptys(0xc, 0x3, 0x0)
ioctl$TCSETSF(r0, 0x5404, &(0x7f0000000040)={0xca8b, 0xfffffffe, 0xffffffff, 0x37ffc, 0x1b, "9820e6c7d10b030000000000000001713cf366"})
syz_open_dev$ptys(0xc, 0x3, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0)
r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x81901)
move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, 0x0, 0x262)
ioctl$SNDCTL_TMR_TIMEBASE(r1, 0xc0045401, &(0x7f0000000380)=0x147)
r2 = socket(0x29, 0x80000, 0x0)
setsockopt$sock_int(r2, 0x1, 0x3c, &(0x7f0000000240)=0x1, 0x4)
recvmmsg(r2, &(0x7f0000000140)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000001380)=""/4, 0x4}, 0x1}], 0x1, 0x60010160, 0x0)
mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0)
r3 = socket$kcm(0x10, 0x2, 0x4)
sendmsg$kcm(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000280)="89000000120081ae08060cdc030000007f03e3f7000000006ee2ffca1b1f0000000004c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec0012100001400d0c0c00bdad446b9bbc7a46e3988285dcdf12f21308f868fece01955fed0009d78f0a947ee2b49e33538afa8af92347514f0b56a20ff27fff", 0x89}], 0x1}, 0x40000)
mount$bind(0x0, 0x0, 0x0, 0x100000, 0x0)
r4 = openat2$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0/file0\x00', &(0x7f00000000c0)={0x600, 0x2, 0x4}, 0x18)
io_setup(0xaa, &(0x7f0000000100))
mount$bind(&(0x7f0000000080)='./file0\x00', &(0x7f0000000440)='./file0/file0\x00', 0x0, 0x8b101a, 0x0)
mount$bind(0x0, 0x0, 0x0, 0x80000, 0x0)
chdir(0x0)
ioctl$sock_inet_SIOCGIFPFLAGS(r3, 0x8935, 0x0)
pivot_root(&(0x7f0000000140)='./file0/file0\x00', &(0x7f0000000180)='./file0/../file0\x00')
renameat2(r4, &(0x7f0000000100)='./file0/../file0\x00', r4, &(0x7f00000001c0)='./file0/file0\x00', 0x4)

1m54.04322597s ago: executing program 7 (id=1657):
r0 = socket$rxrpc(0x21, 0x2, 0xa)
bind$rxrpc(r0, &(0x7f0000000040)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4e20, @local}}, 0x24)
r1 = socket$inet6(0xa, 0x2, 0x0)
bind$inet6(r1, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast1, 0x1}, 0x1c)
r2 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(r2, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4)
bind$inet6(r2, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast1, 0x2}, 0x1c)
r3 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(r3, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4)
bind$inet6(r3, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast1, 0x2}, 0x1c)
r4 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(r4, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4)
bind$inet6(r4, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast1, 0x2}, 0x1c)
r5 = socket$inet6(0xa, 0x2, 0x0)
bind$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @mcast1, 0x5}, 0x1c)
r6 = socket$inet6(0xa, 0x2, 0x0)
bind$inet6(r6, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast1, 0x6}, 0x1c)
r7 = socket$inet6(0xa, 0x2, 0x0)
bind$inet6(r7, &(0x7f0000000000)={0xa, 0xe20, 0x0, @empty}, 0x1c)
r8 = socket$inet6(0xa, 0x2, 0x0)
r9 = socket(0xa, 0x2, 0x0)
bind$inet6(r9, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @mcast2={0xff, 0x5}}, 0x1c)
setsockopt$sock_int(r8, 0x1, 0xf, &(0x7f0000000080)=0x5, 0x4)
bind$inet6(r8, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast1, 0x2}, 0x1c)
r10 = socket$inet6(0xa, 0x2, 0x0)
bind$inet6(r10, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @multicast2}, 0x1000000}, 0x1c)
r11 = socket$inet6(0xa, 0x2, 0x0)
bind$inet6(r11, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast2, 0x2}, 0x1c)

1m53.434612685s ago: executing program 7 (id=1660):
shmctl$IPC_INFO(0x0, 0x3, &(0x7f0000000540)=""/11)

1m53.129360577s ago: executing program 38 (id=1660):
shmctl$IPC_INFO(0x0, 0x3, &(0x7f0000000540)=""/11)

1m2.703808943s ago: executing program 9 (id=2260):
setreuid(0xee01, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x4)
mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x10b)
write(r0, &(0x7f0000000000)='7', 0x1)
add_key(&(0x7f0000000200)='id_resolver\x00', 0x0, 0x0, 0x0, 0xfffffffffffffffd)

1m2.426614819s ago: executing program 9 (id=2262):
r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="9f01000083667d1040206402d14e0102030109021b000100000000090400000190f19c000905f3ed"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000600)={0x84, &(0x7f0000000940)=ANY=[@ANYBLOB="400f01"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000040)={0x2c, &(0x7f00000006c0)={0x7fe51287edc2689d, 0xc}, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000002c0)={0x0, 0x7}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, 0x0)

59.73042825s ago: executing program 9 (id=2279):
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x1ef)
lsetxattr$security_capability(&(0x7f0000000340)='./file1\x00', &(0x7f00000002c0), &(0x7f0000000740)=@v3={0x3000000, [{0x101, 0x3}, {0x5, 0x1ff}]}, 0x18, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c8)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file2\x00', 0x207)
mount$overlay(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c})
truncate(&(0x7f0000000140)='./file0/file1\x00', 0xe2)

59.44979441s ago: executing program 9 (id=2282):
mkdir(&(0x7f0000001a80)='./file0\x00', 0x18b)
mount$bpf(0x200000000000, &(0x7f0000000000)='./file0/../file0\x00', 0x0, 0xb89046, 0x0)
mount$bpf(0x0, &(0x7f00000000c0)='./file0/../file0\x00', 0x0, 0x100000, 0x0)
mount$bpf(0x200000000000, &(0x7f0000000200)='.\x00', 0x0, 0x8b7840, 0x0)
mount$bpf(0x200000000000, &(0x7f0000000000)='.\x00', 0x0, 0x8b7848, 0x0)
mount$bpf(0x200000000000, &(0x7f0000000440)='./file0\x00', 0x0, 0x98d046, 0x0)

59.158875108s ago: executing program 9 (id=2285):
write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xb, 0xa2b9, 0x6, 0x6, 0xe1, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xd, 0x0, 0x6, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x0, 0x8a, 0x79, 0x2, 0x10080, 0xfffffffe, 0x83f4, 0x129, 0x1, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0xa9, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x489, 0x7ff, 0x4, 0x4007b, 0xffffffff, 0x1, 0x2], [0x9, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0x2, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x7, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x67af, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x6, 0x2e6bf783, 0x80000001, 0x5, 0x40000005, 0x491, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x1, 0x41, 0x6, 0xee4e, 0x2000104, 0x1, 0x9, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x100006, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x28, 0x5, 0xd500, 0x9, 0x77, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x80000000, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x2, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x8, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
sendmsg$NFNL_MSG_CTHELPER_DEL(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000280)={0x78, 0x2, 0x9, 0x101, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFCTH_NAME={0x9, 0x1, 'syz0\x00'}, @NFCTH_QUEUE_NUM={0x8, 0x3, 0x1, 0x0, 0x5}, @NFCTH_TUPLE={0x4}, @NFCTH_TUPLE={0x4c, 0x2, [@CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x21}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @dev={0xfe, 0x80, '\x00', 0x13}}, {0x14, 0x4, @loopback}}}]}]}, 0x78}, 0x1, 0x0, 0x0, 0x44800}, 0x4004054)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_RUN(r3, 0xae80, 0x0)
r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r5 = dup(r4)
r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0)
syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0)
ioctl$KVM_RUN(r6, 0xae80, 0x0)

58.686694271s ago: executing program 9 (id=2288):
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000500)='./proc\x00', &(0x7f0000000600)='proc\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./proc/sys/net/ipv6/conf/syz_tun/addr_gen_mode\x00', 0x1, 0x122)
r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00')
sendfile(r0, r1, 0x0, 0x3)

58.270437079s ago: executing program 39 (id=2288):
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000500)='./proc\x00', &(0x7f0000000600)='proc\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./proc/sys/net/ipv6/conf/syz_tun/addr_gen_mode\x00', 0x1, 0x122)
r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00')
sendfile(r0, r1, 0x0, 0x3)

18.371348338s ago: executing program 1 (id=2678):
r0 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000140)={'wlan1\x00', <r1=>0x0})
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000700), r2)
sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000980)={0x1c, r3, 0x1, 0x70bd2f, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r1}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x20000000)

18.142573081s ago: executing program 1 (id=2681):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000000c0)={'wlan0\x00', <r3=>0x0})
sendmsg$NL80211_CMD_NEW_STATION(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)={0x44, r1, 0xb97534d5fe970ccf, 0x4000, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_STA_LISTEN_INTERVAL={0x6, 0x12, 0x7}, @NL80211_ATTR_STA_SUPPORTED_RATES={0x4}, @NL80211_ATTR_PEER_AID={0x6, 0xb5, 0x2b7}, @NL80211_ATTR_STA_TX_POWER_SETTING={0x5, 0x113, 0x2}]}, 0x44}}, 0x4800)

17.669700862s ago: executing program 1 (id=2689):
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0)
r0 = getpid()
sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, 0x0)
recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0)
r1 = socket$inet_smc(0x2b, 0x1, 0x0)
ioctl$int_in(r1, 0x5421, &(0x7f0000000100)=0x9)
connect$inet(r1, &(0x7f0000000280)={0x2, 0x0, @dev}, 0x10)
close(r1)

17.205569836s ago: executing program 1 (id=2694):
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x81)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000540)='./file2\x00', 0x1c8)
mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c})
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x0)
mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000080)='./file1/file0\x00', 0x0, 0x1085408, 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x40, &(0x7f00000004c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]})
chdir(&(0x7f00000001c0)='./bus\x00')
unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200)

17.117982695s ago: executing program 1 (id=2695):
write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xb, 0xa2b9, 0x6, 0x6, 0xe1, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xd, 0x0, 0x6, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x0, 0x8a, 0x79, 0x2, 0x10080, 0xfffffffe, 0x83f4, 0x129, 0x1, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0xa9, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x489, 0x7ff, 0x4, 0x4007b, 0xffffffff, 0x1, 0x2], [0x9, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0x2, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x7, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x67af, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x6, 0x2e6bf783, 0x80000001, 0x5, 0x40000005, 0x491, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x1, 0x41, 0x6, 0xee4e, 0x2000104, 0x1, 0x9, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x100006, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x28, 0x5, 0xd500, 0x9, 0x77, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x80000000, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x2, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x8, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
sendmsg$NFNL_MSG_CTHELPER_DEL(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000280)={0x14, 0x2, 0x9, 0x101, 0x0, 0x0, {0xa, 0x0, 0x4}}, 0x14}, 0x1, 0x0, 0x0, 0x44800}, 0x4004054)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x2000000035, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x5, 0xf2, 0xd, 0x7fffffffffffe, 0xcd3, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0xc], 0x25000, 0x304})
openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_RUN(r3, 0xae80, 0x0)
r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r5 = dup(r4)
r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0)
syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0)
ioctl$KVM_RUN(r6, 0xae80, 0x0)

16.857971195s ago: executing program 1 (id=2698):
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/block/loop0/queue/scheduler\x00', 0x2, 0x0)
write(r0, &(0x7f0000000300)='bfq\x00', 0x3)
r1 = syz_open_dev$loop(&(0x7f0000000600), 0x0, 0x2)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./file\x00', 0x42, 0x1ff)
write(r2, &(0x7f0000000800)='\x00'/4096, 0x1000)
ioctl$LOOP_SET_FD(r1, 0x4c00, r2)
read(r1, &(0x7f0000000400)=""/4096, 0x1000)
write(r1, &(0x7f0000001400)='\x00'/4096, 0x1000)

16.698323723s ago: executing program 40 (id=2698):
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/block/loop0/queue/scheduler\x00', 0x2, 0x0)
write(r0, &(0x7f0000000300)='bfq\x00', 0x3)
r1 = syz_open_dev$loop(&(0x7f0000000600), 0x0, 0x2)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./file\x00', 0x42, 0x1ff)
write(r2, &(0x7f0000000800)='\x00'/4096, 0x1000)
ioctl$LOOP_SET_FD(r1, 0x4c00, r2)
read(r1, &(0x7f0000000400)=""/4096, 0x1000)
write(r1, &(0x7f0000001400)='\x00'/4096, 0x1000)

3.933067402s ago: executing program 0 (id=2830):
r0 = socket$inet6_mptcp(0xa, 0x1, 0x106)
bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0xfffffffc, @empty, 0x7}, 0x1c)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r2)
sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)={0x38, r3, 0x1, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x24, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast1=0xac1414aa}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x1}]}]}, 0x38}}, 0x0)
listen(r0, 0xc)
r4 = socket$inet_mptcp(0x2, 0x1, 0x106)
connect$inet(r4, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10)
r5 = socket$nl_generic(0x10, 0x3, 0x10)
r6 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff)
sendmsg$MPTCP_PM_CMD_ADD_ADDR(r5, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)={0x30, r6, 0x1, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x1c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast1=0xac1414aa}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x3}]}]}, 0x30}}, 0x0)
r7 = socket$nl_generic(0x10, 0x3, 0x10)
r8 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000740), 0xffffffffffffffff)
sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)={0x14, r8, 0x1, 0x70bd2c, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x20048001}, 0x800)

3.859921597s ago: executing program 2 (id=2831):
socket$nl_generic(0x10, 0x3, 0x10)
socket$inet(0x2, 0x2, 0x1)
socket$nl_netfilter(0x10, 0x3, 0xc)
socket$nl_xfrm(0x10, 0x3, 0x6)
socket$inet6_tcp(0xa, 0x1, 0x0)
mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0)
recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f00000006c0)=[@cred={{0x1c}}, @rights={{0x10}}, @rights={{0x10}}, @rights={{0x10}}], 0x50}, 0x80)
pipe2(0x0, 0x0)
syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@any_dev={0x4, 0x3f7, 0x0, 0x0, 0x1000, 0xe, 0x0, 0x0, 0x10}}}, &(0x7f0000000300)=<r2=>0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
r4 = dup(r3)
syz_ublk_setup_queues(r4, r2, &(0x7f0000000040)={0x0, 0xc1, 0x10, 0xfffffffd, 0x7f}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3, 0x42, 0x3, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc81d, 0x2, 0x1, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93ea, 0x2000, 0x4003bfff, 0x2b9}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x626d, 0x800, 0x1, 0x26d}}], 0x1, 0x0, 0x0)

3.706455578s ago: executing program 0 (id=2834):
r0 = syz_usb_connect(0x2, 0x2d, &(0x7f00000010c0)=ANY=[@ANYBLOB="12010000eafa7240936901b0293df400100109021b000124a800800904000001030000000905", @ANYRES16], 0x0)
syz_usb_disconnect(r0)
r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$uac1(r1, 0x0, 0x0)
syz_usb_control_io$cdc_ecm(r1, 0x0, 0x0)
syz_usb_control_io$printer(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, 0x0, 0x0)
syz_usb_control_io$uac1(r1, 0x0, 0x0)
syz_usb_control_io$printer(r1, 0x0, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$cdc_ecm(r1, 0x0, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$uac1(r1, 0x0, 0x0)

3.411016166s ago: executing program 2 (id=2836):
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nullb/nullb1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nullb/nullb1/zoned\x00', 0x2, 0x0)
write(r0, &(0x7f0000000500)='1\n', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000001300)='./config/nullb/nullb1/zone_nr_conv\x00', 0x2, 0x0)
write(r1, &(0x7f0000001400)='2\n', 0x2)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/nullb/nullb1/power\x00', 0x2, 0x0)
write(r2, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000002300)='./config/nullb/nullb2\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000002400)='./config/nullb/nullb2/zoned\x00', 0x2, 0x0)
write(r3, &(0x7f0000002500)='1\n', 0x2)
write(0xffffffffffffffff, &(0x7f0000003400)='2\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000002600)='./config/nullb/nullb2/power\x00', 0x2, 0x0)
write(r4, &(0x7f0000002700)='1\n', 0x2)

3.338428402s ago: executing program 2 (id=2838):
syz_usb_connect(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000b510f210950b2a77738201020301090224"], 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0)
r1 = fsopen(&(0x7f0000000140)='cifs\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r1, 0x1, 0x0, 0x0, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0xa0602, 0x0)
syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='ns\x00')
pipe2(&(0x7f0000000040), 0x0)
syz_open_dev$evdev(&(0x7f0000000040), 0x20000000000, 0x840)
syz_emit_vhci(&(0x7f0000000540)=ANY=[@ANYBLOB="043e1f0a"], 0x22)
r2 = socket$netlink(0x10, 0x3, 0x0)
syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="040e079c0814", @ANYRES32=r2], 0xa)

2.800565189s ago: executing program 8 (id=2843):
r0 = creat(0x0, 0x6a)
close(r0)
socket$tipc(0x1e, 0x4, 0x0)
mount$9p_fd(0x0, &(0x7f0000000300)='./file0\x00', 0x0, 0x0, 0x0)
syz_genetlink_get_family_id$batadv(0x0, r0)
sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, 0x0, 0x90)
capset(&(0x7f0000000040)={0x19980330}, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x20000})
syz_genetlink_get_family_id$ethtool(&(0x7f0000000140), r0)
r1 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0)
ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0xf88e470f, 0xed}]})
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000080)={0x7, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000200)={[0x2, 0x9, 0xfffffffffffffffd, 0x2, 0x2, 0x0, 0x4002004c4, 0x1004, 0x8000000000000000, 0xc595, 0x8, 0x1, 0xffffffffffffffff, 0x2000000000000000, 0xb3, 0x8d], 0xeeee8000, 0x2839d1})
ioctl$KVM_RUN(r3, 0xae80, 0x0)
ioctl$KVM_RUN(r3, 0xae80, 0x0)

2.740402802s ago: executing program 8 (id=2844):
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
listen(r0, 0x5)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
listen(r1, 0x220c)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
listen(r2, 0x3)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
listen(r3, 0x0)
r4 = socket$inet6_tcp(0xa, 0x1, 0x0)
listen(r4, 0x0)
r5 = socket$inet6_tcp(0xa, 0x1, 0x0)
listen(r5, 0x7)
r6 = socket$inet6_tcp(0xa, 0x1, 0x0)
listen(r6, 0x0)
r7 = socket$nl_sock_diag(0x10, 0x3, 0x4)
sendmsg$DCCPDIAG_GETSOCK(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="4c00000012000301000000000000000000009db7000000000000010004000000000000000000000000000000000000000000000000000000691d0f76e77044d1eb94e56239e4"], 0x4c}, 0x1, 0x0, 0x0, 0x20000000}, 0x800)

2.599456682s ago: executing program 8 (id=2845):
r0 = syz_usb_connect(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000b510f210950b2a7773820102030109022400010000000009042200028953950009050a02ff0300fa000905820250"], 0x0)
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f0000000600)=ANY=[@ANYBLOB="001606"], 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000380)={0x2c, &(0x7f0000000180)=ANY=[@ANYBLOB="500f02"], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$uac2(r0, 0x0, &(0x7f0000000880)={0x44, &(0x7f0000000640)={0x40, 0x8, 0x1, "a9"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$uac3(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_control_io$rtl8150(r0, 0x0, 0x0)
syz_usb_control_io$rtl8150(r0, 0x0, 0x0)

2.567488988s ago: executing program 4 (id=2846):
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, 0x0)
mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000)
getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x24, 0x0, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0)
r2 = openat$sndtimer(0xffffffffffffff9c, 0x0, 0x301400)
ioctl$SNDRV_TIMER_IOCTL_START(r2, 0x54a0)
recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
r3 = gettid()
timer_create(0x7, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r3}, &(0x7f0000bbdffc)=<r4=>0x0)
timer_settime(r4, 0x1, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0)
landlock_restrict_self(0xffffffffffffffff, 0xc)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
sched_setattr(0x0, 0x0, 0x0)
mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000)
msgsnd(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="03"], 0xfd1, 0x0)

2.52400389s ago: executing program 4 (id=2847):
openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0)
syz_open_dev$video4linux(&(0x7f0000001380), 0x5, 0x0)
openat$sndseq(0xffffffffffffff9c, &(0x7f00000018c0), 0xe0c81)
socket$alg(0x26, 0x5, 0x0)
socket$nl_xfrm(0x10, 0x3, 0x6)
socket$netlink(0x10, 0x3, 0x0)
pipe(&(0x7f0000000440))
socket$inet6_tcp(0xa, 0x1, 0x0)
socket$netlink(0x10, 0x3, 0x4)
socket$packet(0x11, 0x3, 0x300)
socket$netlink(0x10, 0x3, 0xc)
socket(0x10, 0x3, 0x0)
r0 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f00000002c0)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000b40)=[{&(0x7f0000000080)=ANY=[@ANYBLOB="3000000010000100000000020000000008000000", @ANYRES32, @ANYBLOB='\b\x00\x00\x00', @ANYRES32, @ANYRES8=r0], 0x30}], 0x1}, 0x0)
syz_usb_connect$cdc_ncm(0x4, 0xd1, &(0x7f0000000040)=ANY=[@ANYBLOB="12011003020000182505a1a44100010203010902bf0002010650000900000000020d001b052401082400a9b30d2d0f010a0000000300ff000606241a05001407240a050905580c240c00000000a90c0900030424020204240200042406024424"], 0x0)
syz_usb_connect(0x3, 0xf5, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000772aed408680070bb96c010203010902e30003dc2000000904003f000e01000505a40600010524007f000d240f0104000000080000000006241a03000a05240101070424020a1524120009a317a88b045e4f01a607c0ffcb7e392a09044c03003a92a2010a240109000102010205240401050c2402"], 0x0)

2.082349905s ago: executing program 2 (id=2848):
r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f00000001c0)={{0x12, 0x1, 0x250, 0x0, 0x0, 0x0, 0x40, 0x22d4, 0x1503, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0xff, 0x50, 0x9, "", [{{0x9, 0x4, 0x0, 0xd, 0x1, 0x3, 0x1, 0x2, 0x0, {0x9, 0x21, 0xff7f, 0x79, 0x1, {0x22, 0xfb1}}, {{{0x9, 0x5, 0x81, 0x3, 0x8, 0x3, 0x9, 0xf9}}}}}]}}]}}, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]})
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$lan78xx(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000400)={0x24, 0x0, 0x0, &(0x7f0000000440), 0x0}, 0x0)

2.014685801s ago: executing program 8 (id=2849):
write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xb, 0xa2b9, 0x6, 0x6, 0xe1, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xd, 0x0, 0x6, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x0, 0x8a, 0x79, 0x2, 0x10080, 0xfffffffe, 0x83f4, 0x129, 0x1, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0xa9, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x489, 0x7ff, 0x4, 0x4007b, 0xffffffff, 0x1, 0x2], [0x9, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0x2, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x7, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x67af, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x6, 0x2e6bf783, 0x80000001, 0x5, 0x40000005, 0x491, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x1, 0x41, 0x6, 0xee4e, 0x2000104, 0x1, 0x9, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x100006, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x28, 0x5, 0xd500, 0x9, 0x77, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x80000000, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x2, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x8, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
sendmsg$NFNL_MSG_CTHELPER_DEL(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000280)={0x70, 0x2, 0x9, 0x101, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFCTH_NAME={0x9, 0x1, 'syz0\x00'}, @NFCTH_QUEUE_NUM={0x8, 0x3, 0x1, 0x0, 0x5}, @NFCTH_TUPLE={0x4}, @NFCTH_TUPLE={0x44, 0x2, [@CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x21}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @dev={0xfe, 0x80, '\x00', 0x13}}, {0x14, 0x4, @loopback}}}]}]}, 0x70}, 0x1, 0x0, 0x0, 0x44800}, 0x4004054)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x2000000035, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x5, 0xf2, 0xd, 0x7fffffffffffe, 0xcd3, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0xc], 0x25000, 0x304})
openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_RUN(r3, 0xae80, 0x0)
r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r5 = dup(r4)
r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0)
syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0)
ioctl$KVM_RUN(r6, 0xae80, 0x0)

614.415625ms ago: executing program 0 (id=2850):
r0 = socket$inet_sctp(0x2, 0x1, 0x84)
r1 = socket$kcm(0xa, 0x2, 0x0)
r2 = socket$inet_sctp(0x2, 0x1, 0x84)
setsockopt$IP_VS_SO_SET_ADDDEST(r0, 0x0, 0x487, &(0x7f0000000000)={{0x84, @private=0xa010101, 0x4e21, 0x3, 'wrr\x00', 0x23, 0x81, 0x1}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0xe27, 0x10000, 0x1cb, 0x12d61, 0x12d58}}, 0x44)
setsockopt$IP_VS_SO_SET_ADDDEST(r2, 0x0, 0x487, &(0x7f0000000000)={{0x84, @rand_addr=0x64010100, 0x4e24, 0x3, 'lc\x00', 0x8, 0x323b, 0x55}, {@remote, 0x4e23, 0x10000, 0x0, 0x12d5c, 0x12d4c}}, 0x44)
sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e22, 0x0, @dev, 0xfffffeec}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)

613.662303ms ago: executing program 4 (id=2858):
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100), 0x400, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000280), 0x800c42, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x20001, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
syz_open_dev$sndctrl(&(0x7f0000000040), 0x0, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0)
openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x80882)
openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x0, 0x100)
openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0)
syz_open_dev$dri(&(0x7f0000000040), 0x21, 0x40000)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0)
openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000001c0)='devices.deny\x00', 0x2, 0x0)
openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)

613.216691ms ago: executing program 8 (id=2851):
r0 = syz_usb_connect(0x0, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000459bb2405804035000000000000109021b000111000000090400000195699b000905", @ANYRES32], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000440)={0x44, &(0x7f0000000500)={0x0, 0x0, 0x3, 'Yf\''}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000001e40)={0x2c, 0x0, 0x0, 0x0, &(0x7f0000001dc0)={0x20, 0x1, 0x34, "712bab"}, 0x0})
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000001300)={0x84, &(0x7f0000000e40)={0x0, 0x0, 0x3, "0b3b81"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_control_io$uac2(r0, 0x0, &(0x7f0000000800)={0x44, &(0x7f0000000540)={0x40, 0x12, 0x3, "64d99b"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000f40)={0x84, &(0x7f0000000a80)={0x40, 0xa, 0x3, "fbc898"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f00000005c0)={0x2c, 0x0, 0x0, 0x0, &(0x7f0000000380)={0x20, 0x1, 0x5, "86e06f6bb5"}, 0x0})
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)

517.709233ms ago: executing program 4 (id=2852):
ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000100)={[0x20d42, 0xa, 0xfffffffffffffffa, 0x4, 0x4000002, 0x0, 0x1000, 0xfffffffffffffff2, 0x4bfb, 0x40000000004, 0x7ff, 0x2, 0x20003, 0x5, 0x9, 0x100000090], 0x25000, 0xa8657})
r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
ptrace(0x10, r0)
readv(0xffffffffffffffff, &(0x7f0000000200)=[{&(0x7f0000000100)=""/20, 0x14}], 0x1)
ptrace$setregs(0xd, r0, 0x2, &(0x7f0000000180))
ptrace$cont(0x21, r0, 0x5, 0x4)

511.161817ms ago: executing program 0 (id=2853):
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sec\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sec\x00', &(0x7f0000000100)='securityfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sec/tomoyo/domain_policy\x00', 0x2, 0x0)
write(r0, &(0x7f0000000300)='<kernel> /new_domain\nfile read /etc/passwd task.uid=0 task.euid=0\nselect domain=<kernel> /new_domain\n', 0x65)
read(r0, &(0x7f0000000500)=""/10, 0xa)
read(r0, &(0x7f0000000500)=""/10, 0xa)
read(r0, &(0x7f0000000500)=""/10, 0xa)
read(r0, &(0x7f0000000500)=""/10, 0xa)
read(r0, &(0x7f0000000500)=""/10, 0xa)
read(r0, &(0x7f0000000500)=""/10, 0xa)
read(r0, &(0x7f0000000500)=""/10, 0xa)
read(r0, &(0x7f0000000500)=""/10, 0xa)
read(r0, &(0x7f0000000500)=""/10, 0xa)
read(r0, &(0x7f0000000500)=""/10, 0xa)
read(r0, &(0x7f0000000500)=""/10, 0xa)
read(r0, &(0x7f0000000500)=""/10, 0xa)

438.617369ms ago: executing program 2 (id=2854):
sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0)
recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[@cred={{0x1c}}, @rights={{0x10}}, @rights={{0x10}}], 0x40}, 0x80)
r2 = mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
fsopen(&(0x7f0000000000)='virtiofs\x00', 0x0)
socketpair$unix(0x1, 0x1, 0x0, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=<r3=>0x0)
syz_open_dev$sndpcmc(&(0x7f0000000000), 0xb, 0x0)
syz_io_uring_setup(0x75e7, &(0x7f0000000480)={0x0, 0x7210, 0x2, 0x1, 0x1cb}, &(0x7f0000000500), &(0x7f0000000540), &(0x7f0000000580)=<r4=>0x0)
syz_io_uring_submit$UBLK(0x0, r2, r4, 0x0)
r5 = socket$inet6_tcp(0xa, 0x1, 0x0)
r6 = dup(r5)
syz_ublk_setup_queues(r6, r3, &(0x7f0000000180)={0x0, 0x9878, 0x0, 0x1, 0x38c}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x800, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x20, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7333, 0x2, 0x40040081, 0x334}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x40000, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0)

382.50967ms ago: executing program 0 (id=2855):
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/nvmet/subsystems/testnqn\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nvmet/ports/1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/ports/1/addr_trtype\x00', 0x2, 0x0)
write(r0, &(0x7f0000000280)='tcp', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/nvmet/ports/1/addr_traddr\x00', 0x2, 0x0)
write(r1, &(0x7f0000000300)='127.0.0.1', 0x9)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/nvmet/ports/1/addr_trsvcid\x00', 0x2, 0x0)
socket$packet(0x11, 0x2, 0x300)
write(r2, &(0x7f0000000380)='80', 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/nvmet/ports/1/addr_adrfam\x00', 0x2, 0x0)
write(r3, &(0x7f0000000400)='ipv4', 0x4)
symlinkat(&(0x7f0000000440)='./config/nvmet/subsystems/testnqn\x00', 0xffffffffffffff9c, &(0x7f0000000480)='./config/nvmet/ports/1/subsystems/testnqn\x00')
r4 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0)
write(r4, &(0x7f0000000500)='transport=tcp,traddr=127.0.0.1,trsvcid=8', 0x28)

282.702391ms ago: executing program 4 (id=2856):
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='md0', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/block/md0/md/level\x00', 0x1, 0x0)
write(r1, &(0x7f00000001c0)='raid1', 0x5)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='2', 0x1)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0)
write(r3, &(0x7f00000002c0)='1:0', 0x3)
write(0xffffffffffffffff, 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/block/md0/md/dev-ram0/slot\x00', 0x1, 0x0)
write(0xffffffffffffffff, 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/block/md0/md/array_state\x00', 0x1, 0x0)
write(r4, &(0x7f0000000580)='inactive', 0x8)

123.214633ms ago: executing program 4 (id=2857):
r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000280)=ANY=[@ANYBLOB="12010000d3750820c80a2103be6f000000010902120001000000000904"], 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000540)={0x1c, &(0x7f0000000380)=ANY=[], 0x0, 0x0})
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000a80)={0x84, &(0x7f0000000640)={0x0, 0xe, 0x1, "06"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000000)={0x1c, &(0x7f0000000f80)=ANY=[@ANYBLOB="00df19"], 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000d00)={0x84, &(0x7f0000000680)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000580)={0x34, &(0x7f00000001c0)={0x20, 0x10}, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000c80)={0x44, &(0x7f00000006c0)={0x0, 0x1, 0x1, "b5"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

70.631842ms ago: executing program 0 (id=2859):
r0 = syz_usb_connect(0x0, 0x1cb, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000122f0d4071040403dfe4000000010902b901010000003f0904"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)
syz_usb_control_io$rtl8150(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f00000004c0)={0x84, &(0x7f00000001c0)=ANY=[@ANYBLOB="010f02"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000980)={0x84, &(0x7f0000000580)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

42.64325ms ago: executing program 2 (id=2860):
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='md0', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/block/md0/md/level\x00', 0x1, 0x0)
write(r1, &(0x7f00000001c0)='raid1', 0x5)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0)
write(r2, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r3, 0x0, 0x0)
write(0xffffffffffffffff, 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/block/md0/md/dev-ram0/slot\x00', 0x1, 0x0)
write(r4, 0x0, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/block/md0/md/array_state\x00', 0x1, 0x0)
write(r5, &(0x7f0000000540)='readon', 0x6)
write(r5, &(0x7f0000000580)='inactive', 0x8)
write(r5, &(0x7f0000000640)='readonly', 0x8)

0s ago: executing program 8 (id=2861):
write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x25, [0xb, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xb, 0xa2b9, 0x6, 0x6, 0xe1, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xd, 0x0, 0x6, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x0, 0x8a, 0x79, 0x2, 0x10080, 0xfffffffe, 0x83f4, 0x129, 0x1, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0x0, 0x81, 0x9, 0xf9a6, 0xa9, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x489, 0x7ff, 0x4, 0x4007b, 0xffffffff, 0x1, 0x2], [0x9, 0x3, 0x40000006, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0x2, 0xb, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x7, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x9, 0xffff7fff, 0x5, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x67af, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x3ff], [0x2, 0xfffffffe, 0x9, 0xc, 0x0, 0x2e6bf783, 0x80000001, 0x5, 0x40000005, 0x491, 0x9, 0x200026, 0x7f, 0x403, 0x102, 0x1, 0x41, 0x6, 0xee4e, 0x2000104, 0x1, 0x9, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x100006, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x28, 0x5, 0xd500, 0x9, 0x77, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x3, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x80000000, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x2, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x8, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
sendmsg$NFNL_MSG_CTHELPER_DEL(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000280)=ANY=[@ANYBLOB="480000000209010100000000000000000a0000040000010073797a3000000000040002000c00048008000140"], 0x48}, 0x1, 0x0, 0x0, 0x44800}, 0x4004054)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x2000000035, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x5, 0xf2, 0xd, 0x7fffffffffffe, 0xcd3, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0xc], 0x25000, 0x304})
openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_RUN(r3, 0xae80, 0x0)
r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r5 = dup(r4)
ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil})
r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0)
syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0)
ioctl$KVM_RUN(r6, 0xae80, 0x0)

kernel console output (not intermixed with test programs):

wframe+0x77/0x7f
[  338.589786][T10804]  ? clear_bhb_loop+0x70/0xc0
[  338.589813][T10804]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  338.589835][T10804] RIP: 0033:0x7f4355f9e159
[  338.589857][T10804] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  338.589876][T10804] RSP: 002b:00007f43541f6028 EFLAGS: 00000246 ORIG_RAX: 00000000000001af
[  338.589901][T10804] RAX: ffffffffffffffda RBX: 00007f4356225fa0 RCX: 00007f4355f9e159
[  338.589918][T10804] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000003
[  338.589933][T10804] RBP: 00007f4356035024 R08: 0000000000000000 R09: 0000000000000000
[  338.589947][T10804] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  338.589961][T10804] R13: 00007f4356226038 R14: 00007f4356225fa0 R15: 00007ffe31f36338
[  338.589998][T10804]  </TASK>
[  340.206081][T10844] netlink: 4 bytes leftover after parsing attributes in process `syz.7.1494'.
[  340.257974][T10845] netlink: 4 bytes leftover after parsing attributes in process `syz.7.1494'.
[  341.102458][T10855] null_blk: nullb1: using native zone append
[  341.302736][T10855] null_blk: disk nullb1 created
[  342.591812][T10893] netlink: 4 bytes leftover after parsing attributes in process `syz.8.1510'.
[  343.000145][T10902] kvm [10901]: vcpu0, guest rIP: 0x208 Unhandled WRMSR(0xc1) = 0x5f60000e526
[  343.000276][T10902] kvm [10901]: vcpu0, guest rIP: 0x208 Unhandled WRMSR(0xc1) = 0x5f60000e550
[  343.000389][T10902] kvm [10901]: vcpu0, guest rIP: 0x208 Unhandled WRMSR(0xc1) = 0x5f60000e5f4
[  343.000501][T10902] kvm [10901]: vcpu0, guest rIP: 0x208 Unhandled WRMSR(0xc1) = 0x5f60000e544
[  343.000610][T10902] kvm [10901]: vcpu0, guest rIP: 0x208 Unhandled WRMSR(0xc1) = 0x5f60000e532
[  343.000721][T10902] kvm [10901]: vcpu0, guest rIP: 0x208 Unhandled WRMSR(0xc1) = 0x5f60000e532
[  343.000833][T10902] kvm [10901]: vcpu0, guest rIP: 0x208 Unhandled WRMSR(0xc1) = 0x5f60000e532
[  343.002208][T10902] kvm [10901]: vcpu0, guest rIP: 0x208 Unhandled WRMSR(0xc1) = 0x5f60000e532
[  343.002354][T10902] kvm [10901]: vcpu0, guest rIP: 0x208 Unhandled WRMSR(0xc1) = 0x5f60000e532
[  343.004460][T10902] kvm [10901]: vcpu0, guest rIP: 0x208 Unhandled WRMSR(0xc1) = 0x5f60000e532
[  343.366693][T10907] fuse: fd is not a fuse device
[  343.972020][    C0] vxcan1: j1939_tp_rxtimer: 0xffff888031dba800: rx timeout, send abort
[  344.099628][T10919] fuse: Bad value for 'fd'
[  344.472330][    C0] vxcan1: j1939_tp_rxtimer: 0xffff888031dba800: abort rx timeout. Force session deactivation
[  344.472588][    C0] vxcan1: j1939_tp_rxtimer: 0xffff888031dbb400: rx timeout, send abort
[  344.972895][    C0] vxcan1: j1939_tp_rxtimer: 0xffff888031dbb400: abort rx timeout. Force session deactivation
[  344.983981][    C0] vxcan1: j1939_tp_rxtimer: 0xffff888031db9800: rx timeout, send abort
[  344.984429][    C0] vxcan1: j1939_xtp_rx_abort_one: 0xffff888031db9800: 0x0f001: (3) A timeout occurred and this is the connection abort to close the session.
[  345.383997][   T30] usb 8-1: new full-speed USB device number 25 using dummy_hcd
[  345.547360][   T30] usb 8-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea
[  345.551498][   T30] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  345.551525][   T30] usb 8-1: Product: syz
[  345.551541][   T30] usb 8-1: Manufacturer: syz
[  345.551557][   T30] usb 8-1: SerialNumber: syz
[  345.564249][   T30] usb 8-1: config 0 descriptor??
[  345.771049][   T30] usb 8-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state
[  345.935376][ T4936] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[  345.938479][ T4936] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[  345.940343][ T4936] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[  345.941375][ T4936] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[  345.942117][ T4936] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[  346.229392][    T9] lo speed is unknown, defaulting to 1000
[  346.229419][    T9] syz1: Port: 1 Link DOWN
[  346.229762][    T9] lo speed is unknown, defaulting to 1000
[  346.406356][T10978] tipc: Enabling of bearer <udp:syz2> rejected, failed to enable media
[  346.407496][T10978] netlink: 'syz.8.1544': attribute type 10 has an invalid length.
[  346.409668][T10978] syz_tun: entered promiscuous mode
[  346.447784][T10978] bond0: (slave syz_tun): Enslaving as an active interface with an up link
[  346.476650][T10962] lo speed is unknown, defaulting to 1000
[  346.993338][T10962] bridge0: port 1(bridge_slave_0) entered blocking state
[  346.993520][T10962] bridge0: port 1(bridge_slave_0) entered disabled state
[  346.993886][T10962] bridge_slave_0: entered allmulticast mode
[  346.995737][T10962] bridge_slave_0: entered promiscuous mode
[  346.999251][T10962] bridge0: port 2(bridge_slave_1) entered blocking state
[  346.999419][T10962] bridge0: port 2(bridge_slave_1) entered disabled state
[  346.999839][T10962] bridge_slave_1: entered allmulticast mode
[  347.001735][T10962] bridge_slave_1: entered promiscuous mode
[  347.038738][T10962] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  347.042162][T10962] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  347.079933][T10962] team0: Port device team_slave_0 added
[  347.083852][T10962] team0: Port device team_slave_1 added
[  347.123593][T10962] batman_adv: batadv0: Adding interface: batadv_slave_0
[  347.123614][T10962] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  347.123640][T10962] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  347.125957][T10962] batman_adv: batadv0: Adding interface: batadv_slave_1
[  347.125972][T10962] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  347.125996][T10962] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  347.188183][T10962] hsr_slave_0: entered promiscuous mode
[  347.189305][T10962] hsr_slave_1: entered promiscuous mode
[  347.190127][T10962] debugfs: 'hsr0' already exists in 'hsr'
[  347.190147][T10962] Cannot create hsr debugfs directory
[  347.309822][   T30] dvb_usb_rtl28xxu 8-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71
[  347.326397][   T30] usb 8-1: USB disconnect, device number 25
[  347.501049][T10962] netdevsim netdevsim9 netdevsim0: renamed from eth0
[  347.512125][T10962] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[  347.513349][T10962] netdevsim netdevsim9 netdevsim1: renamed from eth1
[  347.534546][T10962] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[  347.542921][T10962] netdevsim netdevsim9 netdevsim2: renamed from eth2
[  347.555807][T10962] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[  347.556885][T10962] netdevsim netdevsim9 netdevsim3: renamed from eth3
[  347.582023][T10962] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[  347.630690][T10962] bridge0: port 2(bridge_slave_1) entered blocking state
[  347.630823][T10962] bridge0: port 2(bridge_slave_1) entered forwarding state
[  347.635614][T10962] bridge0: port 1(bridge_slave_0) entered blocking state
[  347.635758][T10962] bridge0: port 1(bridge_slave_0) entered forwarding state
[  347.750316][T10962] 8021q: adding VLAN 0 to HW filter on device bond0
[  347.771587][   T13] bridge0: port 1(bridge_slave_0) entered disabled state
[  347.774149][   T13] bridge0: port 2(bridge_slave_1) entered disabled state
[  347.797008][T10962] 8021q: adding VLAN 0 to HW filter on device team0
[  347.802165][  T155] bridge0: port 1(bridge_slave_0) entered blocking state
[  347.802258][  T155] bridge0: port 1(bridge_slave_0) entered forwarding state
[  347.834761][   T13] bridge0: port 2(bridge_slave_1) entered blocking state
[  347.834889][   T13] bridge0: port 2(bridge_slave_1) entered forwarding state
[  348.048053][   T53] Bluetooth: hci1: command tx timeout
[  348.517507][T11031] lo speed is unknown, defaulting to 1000
[  348.651745][T10962] 8021q: adding VLAN 0 to HW filter on device batadv0
[  349.018197][T10962] veth0_vlan: entered promiscuous mode
[  349.035141][T10962] veth1_vlan: entered promiscuous mode
[  349.094339][T10962] veth0_macvtap: entered promiscuous mode
[  349.104898][T10962] veth1_macvtap: entered promiscuous mode
[  349.123414][T10962] batman_adv: batadv0: Interface activated: batadv_slave_0
[  349.136837][T10962] batman_adv: batadv0: Interface activated: batadv_slave_1
[  349.170667][ T1097] netdevsim netdevsim9 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  349.176585][ T1097] netdevsim netdevsim9 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  349.178059][  T155] netdevsim netdevsim9 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  349.178498][  T155] netdevsim netdevsim9 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  349.419089][T11044] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1226918919 (78522810816 ns) > initial count (60690011328 ns). Using initial count to start timer.
[  349.424790][T11044] pic_ioport_write: 4 callbacks suppressed
[  349.424809][T11044] kvm: pic: single mode not supported
[  349.482856][ T1416] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  349.482881][ T1416] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  349.545114][   T51] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  349.545139][   T51] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  350.023872][T11061] fuse: fd is not a fuse device
[  350.046145][   T25] usb 8-1: new high-speed USB device number 26 using dummy_hcd
[  350.126564][   T53] Bluetooth: hci1: command tx timeout
[  350.197685][   T25] usb 8-1: Using ep0 maxpacket: 8
[  350.210496][   T25] usb 8-1: New USB device found, idVendor=046d, idProduct=08ae, bcdDevice=11.58
[  350.212504][   T25] usb 8-1: config 0 has 1 interface, different from the descriptor's value: 13
[  350.220923][   T53] Bluetooth: hci2: unexpected event for opcode 0x0000
[  350.248367][   T25] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  350.248398][   T25] usb 8-1: Product: syz
[  350.248414][   T25] usb 8-1: Manufacturer: syz
[  350.248429][   T25] usb 8-1: SerialNumber: syz
[  350.252853][   T25] usb 8-1: config 0 descriptor??
[  350.287093][   T25] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08ae
[  350.346893][T11071] fuse: fd is not a fuse device
[  350.630951][T11081] fuse: Bad value for 'fd'
[  351.022241][T11089] fuse: Bad value for 'fd'
[  351.139803][T11093] fuse: fd is not a fuse device
[  352.207091][   T53] Bluetooth: hci1: command tx timeout
[  352.249724][T11118] fuse: fd is not a fuse device
[  352.777441][   T30] usb 10-1: new high-speed USB device number 2 using dummy_hcd
[  352.939238][   T30] usb 10-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00
[  352.942466][   T30] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  352.942491][   T30] usb 10-1: Product: syz
[  352.942501][   T30] usb 10-1: Manufacturer: syz
[  352.942538][   T30] usb 10-1: SerialNumber: syz
[  353.364867][   T30] lan78xx 10-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE
[  353.364934][   T30] lan78xx 10-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE
[  353.689042][   T25] gspca_zc3xx: reg_w_i err -71
[  353.728150][   T25] gspca_zc3xx 8-1:0.0: probe with driver gspca_zc3xx failed with error -71
[  353.731044][   T25] usb 8-1: USB disconnect, device number 26
[  353.735386][ T5633] udevd[5633]: setting mode of /dev/bus/usb/008/026 to 020664 failed: No such file or directory
[  353.735517][ T5633] udevd[5633]: setting owner of /dev/bus/usb/008/026 to uid=0, gid=0 failed: No such file or directory
[  354.288651][   T53] Bluetooth: hci1: command tx timeout
[  354.854736][T11148] FAULT_INJECTION: forcing a failure.
[  354.854736][T11148] name failslab, interval 1, probability 0, space 0, times 0
[  354.854774][T11148] CPU: 0 UID: 0 PID: 11148 Comm: syz.7.1596 Tainted: G             L      syzkaller #0 PREEMPT(full) 
[  354.854806][T11148] Tainted: [L]=SOFTLOCKUP
[  354.854815][T11148] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[  354.854829][T11148] Call Trace:
[  354.854839][T11148]  <TASK>
[  354.854849][T11148]  dump_stack_lvl+0xe8/0x150
[  354.854885][T11148]  should_fail_ex+0x3eb/0x540
[  354.854915][T11148]  should_failslab+0xa8/0x100
[  354.854942][T11148]  __kmalloc_noprof+0xf9/0x710
[  354.854973][T11148]  ? lockdep_hardirqs_on+0x7b/0x110
[  354.855007][T11148]  ? l2tp_session_create+0x42/0xd10
[  354.855036][T11148]  ? l2tp_session_create+0x42/0xd10
[  354.855076][T11148]  l2tp_session_create+0x42/0xd10
[  354.855118][T11148]  pppol2tp_connect+0xc68/0x18b0
[  354.855158][T11148]  ? __pfx_pppol2tp_connect+0x10/0x10
[  354.855177][T11148]  ? lock_acquire+0x115/0x350
[  354.855216][T11148]  ? __pfx_aa_sk_perm+0x10/0x10
[  354.855247][T11148]  ? apparmor_socket_connect+0x13e/0x210
[  354.855275][T11148]  ? bpf_lsm_socket_connect+0x9/0x20
[  354.855302][T11148]  __sys_connect+0x316/0x450
[  354.855339][T11148]  ? __pfx___sys_connect+0x10/0x10
[  354.855394][T11148]  ? rcu_is_watching+0x16/0xb0
[  354.855428][T11148]  __x64_sys_connect+0x7a/0x90
[  354.855461][T11148]  do_syscall_64+0x166/0x520
[  354.855483][T11148]  ? trace_irq_disable+0x3b/0x140
[  354.855513][T11148]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  354.855536][T11148]  ? clear_bhb_loop+0x70/0xc0
[  354.855564][T11148]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  354.855586][T11148] RIP: 0033:0x7f4355f9e159
[  354.855608][T11148] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  354.855627][T11148] RSP: 002b:00007f43541f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002a
[  354.855655][T11148] RAX: ffffffffffffffda RBX: 00007f4356225fa0 RCX: 00007f4355f9e159
[  354.855672][T11148] RDX: 0000000000000032 RSI: 0000200000000080 RDI: 0000000000000004
[  354.855688][T11148] RBP: 00007f4356035024 R08: 0000000000000000 R09: 0000000000000000
[  354.855702][T11148] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  354.855717][T11148] R13: 00007f4356226038 R14: 00007f4356225fa0 R15: 00007ffe31f36338
[  354.855752][T11148]  </TASK>
[  356.018679][   T30] lan78xx 10-1:1.0 (unnamed net_device) (uninitialized): Failed to write register index 0x000000e8. ret = -EPROTO
[  356.018720][   T30] lan78xx 10-1:1.0 (unnamed net_device) (uninitialized): Failed to init LTM with error -EPROTO
[  356.018733][   T30] lan78xx 10-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED....
[  356.053636][   T30] lan78xx 10-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED
[  356.071178][   T30] lan78xx 10-1:1.0: probe with driver lan78xx failed with error -71
[  356.076442][   T30] usb 10-1: USB disconnect, device number 2
[  356.869516][ T7270] usb 8-1: new full-speed USB device number 27 using dummy_hcd
[  356.989623][ T1217] usb 10-1: new high-speed USB device number 3 using dummy_hcd
[  357.020617][ T7270] usb 8-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40
[  357.021878][ T7270] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[  357.021903][ T7270] usb 8-1: config 1 has 1 interface, different from the descriptor's value: 3
[  357.023945][ T7270] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  357.023970][ T7270] usb 8-1: Product: syz
[  357.023985][ T7270] usb 8-1: Manufacturer: syz
[  357.023999][ T7270] usb 8-1: SerialNumber: syz
[  357.034603][ T7270] usb 8-1: 0:2 : does not exist
[  357.140289][ T1217] usb 10-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df
[  357.141513][ T1217] usb 10-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  357.141547][ T1217] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  357.144065][ T1217] usb 10-1: config 0 descriptor??
[  357.154627][ T1217] pwc: Askey VC010 type 2 USB webcam detected.
[  357.243269][ T7270] usb 8-1: 5:0: failed to get current value for ch 0 (-22)
[  357.289229][ T7270] usb 8-1: USB disconnect, device number 27
[  357.395220][ T5633] udevd[5633]: error opening ATTR{/sys/devices/platform/dummy_hcd.7/usb8/8-1/8-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory
[  357.597625][ T1217] pwc: recv_control_msg error -32 req 02 val 2b00
[  357.598499][ T1217] pwc: recv_control_msg error -32 req 02 val 2700
[  357.599407][ T1217] pwc: recv_control_msg error -32 req 02 val 2c00
[  357.601593][ T1217] pwc: recv_control_msg error -32 req 04 val 1000
[  357.604320][ T1217] pwc: recv_control_msg error -32 req 04 val 1300
[  357.605778][ T1217] pwc: recv_control_msg error -32 req 04 val 1400
[  357.606388][ T1217] pwc: recv_control_msg error -32 req 02 val 2000
[  357.607912][ T1217] pwc: recv_control_msg error -32 req 02 val 2100
[  357.608536][ T1217] pwc: recv_control_msg error -32 req 04 val 1500
[  357.609453][ T1217] pwc: recv_control_msg error -32 req 02 val 2500
[  357.613249][ T1217] pwc: recv_control_msg error -32 req 02 val 2400
[  357.614419][ T1217] pwc: recv_control_msg error -32 req 02 val 2600
[  358.022385][ T1217] pwc: recv_control_msg error -71 req 04 val 1100
[  358.022865][ T1217] pwc: recv_control_msg error -71 req 04 val 1200
[  358.028258][ T1217] pwc: Registered as video103.
[  358.037388][ T1217] input: PWC snapshot button as /devices/platform/dummy_hcd.9/usb10/10-1/input/input42
[  358.058358][ T1217] usb 10-1: USB disconnect, device number 3
[  358.438791][T11195] fuse: fd is not a fuse device
[  358.771873][   T12] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  358.774421][T11202] file system registered
[  358.816709][T11201] read descriptors
[  358.923248][   T12] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  358.929257][T10962] ffs_data_put(): freeing
[  359.052146][   T12] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  359.225441][   T12] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  359.737141][   T31] audit: type=1800 audit(1788585426.048:33): pid=11209 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.7.1620" name="/" dev="fuse" ino=1 res=0 errno=0
[  359.808075][   T12] bridge_slave_1: left allmulticast mode
[  359.808105][   T12] bridge_slave_1: left promiscuous mode
[  359.808355][   T12] bridge0: port 2(bridge_slave_1) entered disabled state
[  359.852730][   T12] bridge_slave_0: left allmulticast mode
[  359.852759][   T12] bridge_slave_0: left promiscuous mode
[  359.853688][   T12] bridge0: port 1(bridge_slave_0) entered disabled state
[  360.412912][ T5281] 8021q: adding VLAN 0 to HW filter on device eth21
[  360.464472][   T12] : left promiscuous mode
[  360.481531][ T5789] usb 10-1: new high-speed USB device number 4 using dummy_hcd
[  360.539522][T11246] kvm_intel: kvm [11245]: vcpu0, guest rIP: 0x0 Unhandled WRMSR(0x1d9) = 0x320f0000048081c7
[  360.540125][T11246] kvm_intel: kvm [11245]: vcpu0, guest rIP: 0x0 Unhandled WRMSR(0x1d9) = 0x320f0000048081c7
[  360.540721][T11246] kvm_intel: kvm [11245]: vcpu0, guest rIP: 0x0 Unhandled WRMSR(0x1d9) = 0x320f0000048081c7
[  360.542580][T11246] kvm_intel: kvm [11245]: vcpu0, guest rIP: 0x0 Unhandled WRMSR(0x1d9) = 0x320f0000048081c7
[  360.543012][T11246] kvm_intel: kvm [11245]: vcpu0, guest rIP: 0x0 Unhandled WRMSR(0x1d9) = 0x320f0000048081c7
[  360.543414][T11246] kvm_intel: kvm [11245]: vcpu0, guest rIP: 0x0 Unhandled WRMSR(0x1d9) = 0x320f0000048081c7
[  360.543849][T11246] kvm_intel: kvm [11245]: vcpu0, guest rIP: 0x0 Unhandled WRMSR(0x1d9) = 0x320f0000048081c7
[  360.544250][T11246] kvm_intel: kvm [11245]: vcpu0, guest rIP: 0x0 Unhandled WRMSR(0x1d9) = 0x320f0000048081c7
[  360.544652][T11246] kvm_intel: kvm [11245]: vcpu0, guest rIP: 0x0 Unhandled WRMSR(0x1d9) = 0x320f0000048081c7
[  360.545058][T11246] kvm_intel: kvm [11245]: vcpu0, guest rIP: 0x0 Unhandled WRMSR(0x1d9) = 0x320f0000048081c7
[  360.674866][   T12] tipc: Disabling bearer <udp:syz0>
[  360.675986][   T12] tipc: Left network mode
[  360.702705][ T5281] 8021q: adding VLAN 0 to HW filter on device eth22
[  360.725589][ T5789] usb 10-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00
[  360.726590][ T5789] usb 10-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[  360.726637][ T5789] usb 10-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64
[  360.726662][ T5789] usb 10-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0
[  360.726682][ T5789] usb 10-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0
[  360.726702][ T5789] usb 10-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 6
[  360.726741][ T5789] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  360.804252][T11240] raw-gadget.0 gadget.9: fail, usb_ep_enable returned -22
[  360.806956][ T5789] keyspan 10-1:1.0: Keyspan 2 port adapter converter detected
[  360.809265][ T5789] keyspan 10-1:1.0: found no endpoint descriptor for endpoint 84
[  360.809365][ T5789] keyspan 10-1:1.0: found no endpoint descriptor for endpoint 2
[  360.861188][ T5789] usb 10-1: Keyspan 2 port adapter converter now attached to ttyUSB0
[  360.877033][ T5789] keyspan 10-1:1.0: found no endpoint descriptor for endpoint 88
[  360.877129][ T5789] keyspan 10-1:1.0: found no endpoint descriptor for endpoint 6
[  360.901179][ T5789] usb 10-1: Keyspan 2 port adapter converter now attached to ttyUSB1
[  360.985990][T11255] fuse: fd is not a fuse device
[  361.145242][   T30] usb 10-1: USB disconnect, device number 4
[  361.259215][   T30] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0
[  361.289966][   T30] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1
[  361.290970][   T30] keyspan 10-1:1.0: device disconnected
[  361.295012][ T5281] 8021q: adding VLAN 0 to HW filter on device eth23
[  361.590306][ T5281] 8021q: adding VLAN 0 to HW filter on device eth24
[  362.327505][   T12] hsr_slave_0: left promiscuous mode
[  362.337886][   T12] hsr_slave_1: left promiscuous mode
[  362.338907][   T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  362.338930][   T12] batman_adv: batadv0: Removing interface: batadv_slave_0
[  362.365675][   T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  362.365709][   T12] batman_adv: batadv0: Removing interface: batadv_slave_1
[  362.417720][   T12] veth1_macvtap: left promiscuous mode
[  362.417765][   T12] veth0_macvtap: left promiscuous mode
[  362.417904][   T12] veth1_vlan: left promiscuous mode
[  362.417979][   T12] veth0_vlan: left promiscuous mode
[  362.977601][T11308] overlayfs: failed to clone upperpath
[  362.988583][   T12] team0 (unregistering): Port device team_slave_1 removed
[  363.039272][   T12] team0 (unregistering): Port device team_slave_0 removed
[  363.478373][   T53] Bluetooth: hci2: Ignoring connect complete event for invalid link type
[  363.569837][   T12] IPVS: stop unused estimator thread 0...
[  363.791069][   T53] Bluetooth: hci2: unexpected event for opcode 0x0c1b
[  363.909446][ T4936] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[  363.920830][ T4936] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[  363.921886][ T4936] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[  363.935418][ T4936] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[  363.950062][ T4936] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[  364.520131][T11320] lo speed is unknown, defaulting to 1000
[  364.745049][ T5768] usb 10-1: new high-speed USB device number 5 using dummy_hcd
[  364.752700][   T53] Bluetooth: hci3: unexpected event 0x2f length: 509 > 255
[  364.904920][ T5768] usb 10-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10
[  364.908074][ T5768] usb 10-1: config 0 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023
[  364.908108][ T5768] usb 10-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A
[  364.908135][ T5768] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x8A has invalid wMaxPacketSize 0
[  364.908158][ T5768] usb 10-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8A has invalid maxpacket 0
[  364.910561][ T5768] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  364.910589][ T5768] usb 10-1: Product: syz
[  364.910605][ T5768] usb 10-1: Manufacturer: syz
[  364.910621][ T5768] usb 10-1: SerialNumber: syz
[  364.914595][ T5768] usb 10-1: config 0 descriptor??
[  364.915465][T11349] raw-gadget.0 gadget.9: fail, usb_ep_enable returned -22
[  364.922154][ T5768] usb 10-1: ucan: probing device on interface #0
[  364.922176][ T5768] usb 10-1: ucan: invalid in_ep MaxPacketSize
[  364.922191][ T5768] usb 10-1: ucan: probe failed; try to update the device firmware
[  365.015910][   T53] Bluetooth: hci2: unexpected event for opcode 0x2027
[  365.044648][   T53] Bluetooth: hci3: unexpected event 0x36 length: 65 > 7
[  365.142817][ T5768] usb 10-1: USB disconnect, device number 5
[  365.211073][T11320] bridge0: port 1(bridge_slave_0) entered blocking state
[  365.218241][T11320] bridge0: port 1(bridge_slave_0) entered disabled state
[  365.218397][T11320] bridge_slave_0: entered allmulticast mode
[  365.225047][T11320] bridge_slave_0: entered promiscuous mode
[  365.233425][T11320] bridge0: port 2(bridge_slave_1) entered blocking state
[  365.233891][T11320] bridge0: port 2(bridge_slave_1) entered disabled state
[  365.234020][T11320] bridge_slave_1: entered allmulticast mode
[  365.235799][T11320] bridge_slave_1: entered promiscuous mode
[  365.292591][T11320] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  365.310517][T11320] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  365.359323][   T53] Bluetooth: hci3: unexpected cc 0x200b length: 2 > 1
[  365.377286][T11320] team0: Port device team_slave_0 added
[  365.380992][T11320] team0: Port device team_slave_1 added
[  365.407533][   T53] Bluetooth: hci2: Malformed Event: 0x2f
[  365.432133][T11320] batman_adv: batadv0: Adding interface: batadv_slave_0
[  365.432152][T11320] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  365.432180][T11320] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  365.439047][T11320] batman_adv: batadv0: Adding interface: batadv_slave_1
[  365.439062][T11320] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  365.439086][T11320] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  365.599604][T11320] hsr_slave_0: entered promiscuous mode
[  365.600803][T11320] hsr_slave_1: entered promiscuous mode
[  365.974239][   T53] Bluetooth: hci0: command tx timeout
[  365.982387][   T53] Bluetooth: hci1: Malformed Event: 0x02
[  366.161005][   T53] Bluetooth: hci2: unexpected event for opcode 0x200a
[  366.234574][   T53] Bluetooth: min 8 > max 3
[  366.477522][   T53] Bluetooth: Wrong link type (-71)
[  366.592011][   T53] Bluetooth: hci1: hcon ffff88802c04c000 sent 1 < count 6
[  367.109076][T11320] netdevsim netdevsim1 netdevsim0: renamed from eth0
[  367.135418][T11320] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[  367.136442][T11320] netdevsim netdevsim1 netdevsim1: renamed from eth1
[  367.142054][T11320] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[  367.172962][T11320] netdevsim netdevsim1 netdevsim2: renamed from eth2
[  367.196039][T11320] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[  367.197250][T11320] netdevsim netdevsim1 netdevsim3: renamed from eth3
[  367.201095][T11320] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[  367.450113][T11320] 8021q: adding VLAN 0 to HW filter on device bond0
[  367.502858][T11320] 8021q: adding VLAN 0 to HW filter on device team0
[  367.525984][  T155] bridge0: port 1(bridge_slave_0) entered blocking state
[  367.526112][  T155] bridge0: port 1(bridge_slave_0) entered forwarding state
[  367.548590][  T155] bridge0: port 2(bridge_slave_1) entered blocking state
[  367.548706][  T155] bridge0: port 2(bridge_slave_1) entered forwarding state
[  367.709368][T11455] gÝ[: renamed from veth1_vlan (while UP)
[  368.038182][T11464] netlink: 'syz.9.1717': attribute type 1 has an invalid length.
[  368.053327][T11464] netlink: 224 bytes leftover after parsing attributes in process `syz.9.1717'.
[  368.064128][   T53] Bluetooth: hci0: command tx timeout
[  368.295823][   T53] Bluetooth: hci2: command 0x0406 tx timeout
[  368.914980][T11320] 8021q: adding VLAN 0 to HW filter on device batadv0
[  369.051953][T11320] veth0_vlan: entered promiscuous mode
[  369.083726][T11320] veth1_vlan: entered promiscuous mode
[  369.212017][T11320] veth0_macvtap: entered promiscuous mode
[  369.230224][T11320] veth1_macvtap: entered promiscuous mode
[  369.294366][   T53] Bluetooth: latency 521 > 499
[  369.302078][T11320] batman_adv: batadv0: Interface activated: batadv_slave_0
[  369.357956][T11320] batman_adv: batadv0: Interface activated: batadv_slave_1
[  369.396885][ T1097] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  369.398351][ T1097] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  369.398468][   T33] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  369.428466][   T12] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  369.694398][ T1101] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  369.694424][ T1101] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  369.805101][   T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  369.805126][   T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  370.137044][   T53] Bluetooth: hci0: command tx timeout
[  370.556006][T11526] raw_sendmsg: syz.8.1743 forgot to set AF_INET. Fix it!
[  371.082296][   T53] Bluetooth: hci3: unexpected event for opcode 0x0c5b
[  371.271546][T11559] IPVS: lblcr: FWM 3 0x00000003 - no destination available
[  371.341855][T11561] netlink: 72 bytes leftover after parsing attributes in process `syz.4.1756'.
[  371.341901][T11561] netlink: 336 bytes leftover after parsing attributes in process `syz.4.1756'.
[  371.341917][T11561] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1756'.
[  372.077271][   T53] Bluetooth: hci2: unexpected event for opcode 0x0c26
[  372.218476][   T53] Bluetooth: hci0: command tx timeout
[  372.780181][  T990] usb 2-1: new high-speed USB device number 12 using dummy_hcd
[  372.831751][T11633] fuse: fd is not a fuse device
[  372.938722][  T990] usb 2-1: Using ep0 maxpacket: 16
[  372.947290][  T990] usb 2-1: unable to get BOS descriptor or descriptor too short
[  372.947350][  T990] usb 2-1: New USB device found, idVendor=0cf3, idProduct=1010, bcdDevice=36.87
[  372.952293][  T990] usb 2-1: config 127 has an invalid interface number: 124 but max is 0
[  372.952318][  T990] usb 2-1: config 127 has no interface number 0
[  372.952346][  T990] usb 2-1: config 127 interface 124 has no altsetting 0
[  372.958481][  T990] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  372.958505][  T990] usb 2-1: Product: syz
[  372.958519][  T990] usb 2-1: Manufacturer: syz
[  372.958532][  T990] usb 2-1: SerialNumber: syz
[  373.104021][T11644] overlayfs: failed to clone upperpath
[  373.294455][T11650] fuse: fd is not a fuse device
[  373.388656][T11653] fuse: fd is not a fuse device
[  373.854196][T11660] fuse: fd is not a fuse device
[  373.909368][  T990] usb 2-1: reset high-speed USB device number 12 using dummy_hcd
[  373.996204][   T53] Bluetooth: hci1: command 0x0406 tx timeout
[  374.060353][ T5632] Bluetooth: hci3: command 0x2016 tx timeout
[  374.113620][  T990] usb 2-1: unable to get BOS descriptor or descriptor too short
[  374.123549][  T990] usb 2-1: device firmware changed
[  374.138806][  T990] usb 2-1: USB disconnect, device number 12
[  374.363990][T11670] fuse: fd is not a fuse device
[  374.769591][T11681] netlink: 'syz.8.1807': attribute type 4 has an invalid length.
[  374.784785][T11681] netlink: 'syz.8.1807': attribute type 4 has an invalid length.
[  374.812644][  T990] lo speed is unknown, defaulting to 1000
[  374.812676][  T990] syz1: Port: 1 Link ACTIVE
[  374.812755][  T990] lo speed is unknown, defaulting to 1000
[  376.088175][T11708] sg_write: data in/out 491584/136 bytes for SCSI command 0x0-- guessing data in;
[  376.088175][T11708]    program syz.1.1816 not setting count and/or reply_len properly
[  376.670772][ T1217] usb 2-1: new full-speed USB device number 13 using dummy_hcd
[  376.850158][ T1217] usb 2-1: New USB device found, idVendor=05e0, idProduct=0600, bcdDevice=f9.9b
[  376.851462][ T1217] usb 2-1: config 0 has an invalid interface number: 175 but max is 0
[  376.851488][ T1217] usb 2-1: config 0 has an invalid descriptor of length 123, skipping remainder of the config
[  376.851507][ T1217] usb 2-1: config 0 has no interface number 0
[  376.851562][ T1217] usb 2-1: config 0 interface 175 altsetting 0 has an endpoint descriptor with address 0x9A, changing to 0x8A
[  376.851591][ T1217] usb 2-1: config 0 interface 175 altsetting 0 endpoint 0x8A has invalid maxpacket 9728, setting to 64
[  376.851617][ T1217] usb 2-1: config 0 interface 175 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 16
[  376.854245][ T1217] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  376.854272][ T1217] usb 2-1: Product: syz
[  376.854288][ T1217] usb 2-1: Manufacturer: syz
[  376.854304][ T1217] usb 2-1: SerialNumber: syz
[  376.857544][ T1217] usb 2-1: config 0 descriptor??
[  376.866646][ T1217] symbolserial 2-1:0.175: required endpoints missing
[  377.143197][ T1217] usb 2-1: USB disconnect, device number 13
[  377.567971][T11746] fuse: fd is not a fuse device
[  377.833019][   T31] audit: type=1800 audit(1788585444.129:34): pid=11752 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.1836" name="file0" dev="overlay" ino=100 res=0 errno=0
[  377.905282][T11754] fuse: fd is not a fuse device
[  378.742243][T11697] Set syz1 is full, maxelem 65536 reached
[  379.023256][ T1311] ieee802154 phy0 wpan0: encryption failed: -22
[  379.023326][ T1311] ieee802154 phy1 wpan1: encryption failed: -22
[  379.268907][    T9] hid_parser_main: 7 callbacks suppressed
[  379.268969][    T9] hid-generic 0000:0000:0000.0017: unknown main item tag 0x0
[  379.287327][    T9] hid-generic 0000:0000:0000.0017: hidraw0: <UNKNOWN> HID v0.00 Device [syz1] on syz0
[  379.421748][    T9] usb 2-1: new high-speed USB device number 14 using dummy_hcd
[  379.575664][    T9] usb 2-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40
[  379.577660][    T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  379.577712][    T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  379.595185][    T9] usb 2-1: config 0 descriptor??
[  379.832650][    T9] usbhid 2-1:0.0: can't add hid device: -71
[  379.832764][    T9] usbhid 2-1:0.0: probe with driver usbhid failed with error -71
[  379.848021][    T9] usb 2-1: USB disconnect, device number 14
[  380.066314][T11803] tipc: Started in network mode
[  380.066336][T11803] tipc: Node identity ac1414aa, cluster identity 4711
[  380.066489][T11803] tipc: New replicast peer: 172.20.20.187
[  380.068031][T11803] tipc: Enabled bearer <udp:syz0>, priority 10
[  380.278101][T11811] device ioctl magic numbers don't match! Did you rebuild pvfs2-client-core/libpvfs2? [cmd 6609, magic 66 != 6b]
[  380.312348][  T990] usb 2-1: new high-speed USB device number 15 using dummy_hcd
[  380.360898][T11814] syzkaller1: entered promiscuous mode
[  380.360925][T11814] syzkaller1: entered allmulticast mode
[  380.483027][  T990] usb 2-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 0.40
[  380.485127][  T990] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  380.485177][  T990] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  380.500418][  T990] usb 2-1: config 0 descriptor??
[  380.524549][   T31] audit: type=1804 audit(1788585446.828:35): pid=11816 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.9.1862" name="/newroot/75/bus/bus" dev="overlay" ino=417 res=1 errno=0
[  380.551153][  T990] keyspan 2-1:0.0: Keyspan 2 port adapter converter detected
[  380.559276][  T990] keyspan 2-1:0.0: found no endpoint descriptor for endpoint 1
[  380.569689][  T990] keyspan 2-1:0.0: found no endpoint descriptor for endpoint 84
[  380.569820][  T990] keyspan 2-1:0.0: found no endpoint descriptor for endpoint 2
[  380.587908][  T990] usb 2-1: Keyspan 2 port adapter converter now attached to ttyUSB0
[  380.590495][  T990] keyspan 2-1:0.0: found no endpoint descriptor for endpoint 88
[  380.590633][  T990] keyspan 2-1:0.0: found no endpoint descriptor for endpoint 6
[  380.619687][  T990] usb 2-1: Keyspan 2 port adapter converter now attached to ttyUSB1
[  380.975164][  T990] usb 2-1: USB disconnect, device number 15
[  380.993449][  T990] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0
[  381.005545][  T990] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1
[  381.007411][  T990] keyspan 2-1:0.0: device disconnected
[  381.181864][   T10] tipc: Node number set to 2886997162
[  381.667062][T11832] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state.
[  382.227342][ T4936] Bluetooth: hci2: adv larger than maximum supported
[  382.227363][ T4936] Bluetooth: hci2: Malformed LE Event: 0x0d
[  382.364102][T11846] rust_binder: Failure in copy_transaction_data: EINVAL
[  382.364131][T11846] rust_binder: 11845:11846 transaction async to 11845:0 failed EINVAL, code 0 size 0-24
[  382.400816][   T10] rust_binder: 11845: undelivered transaction 91, process died
[  382.412629][   T10] rust_binder: 11845: undelivered TRANSACTION_COMPLETE
[  382.412669][   T10] rust_binder: 11845: undelivered TRANSACTION_ERROR: 29201
[  382.990307][T11863] overlayfs: failed to clone upperpath
[  383.180171][T11868] jffs2: notice: (11868) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[  384.053557][  T990] usb 2-1: new high-speed USB device number 16 using dummy_hcd
[  384.200047][T11911] netlink: 24 bytes leftover after parsing attributes in process `syz.9.1903'.
[  384.214737][  T990] usb 2-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice= 0.00
[  384.215739][  T990] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0
[  384.215761][  T990] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0
[  384.217767][  T990] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  384.217790][  T990] usb 2-1: Product: syz
[  384.217804][  T990] usb 2-1: Manufacturer: syz
[  384.217819][  T990] usb 2-1: SerialNumber: syz
[  384.563809][    T9] usb 10-1: new low-speed USB device number 6 using dummy_hcd
[  384.638963][    C1] usb 2-1: invalid arpc response id received: 0
[  384.716337][    T9] usb 10-1: unable to get BOS descriptor or descriptor too short
[  384.716395][    T9] usb 10-1: New USB device found, idVendor=4752, idProduct=0011, bcdDevice= 0.40
[  384.717734][    T9] usb 10-1: config 1 interface 0 altsetting 0 endpoint 0xA has invalid maxpacket 64, setting to 8
[  384.721466][    T9] usb 10-1: string descriptor 0 read error: -22
[  384.721631][    T9] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  384.769103][T11913] raw-gadget.1 gadget.9: fail, usb_ep_enable returned -22
[  384.784469][    T9] usb 10-1: Quirk or no altset; falling back to MIDI 1.0
[  384.895236][  T990] usb 2-1: failed to set cport flags for port 0
[  384.895368][  T990] greybus greybus1: 0/0:0: failed to enable host cport: -71
[  384.978991][  T990] es2_ap_driver 2-1:1.0: probe with driver es2_ap_driver failed with error -71
[  385.000397][  T990] usb 2-1: USB disconnect, device number 16
[  385.177735][    T9] usb 10-1: USB disconnect, device number 6
[  386.084203][ T1217] usb 2-1: new full-speed USB device number 17 using dummy_hcd
[  386.245077][ T1217] usb 2-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e
[  386.246438][ T1217] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F
[  386.246473][ T1217] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10
[  386.246500][ T1217] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 64
[  386.249241][ T1217] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  386.249268][ T1217] usb 2-1: Product: syz
[  386.249284][ T1217] usb 2-1: Manufacturer: syz
[  386.249300][ T1217] usb 2-1: SerialNumber: syz
[  386.253157][ T1217] usb 2-1: config 0 descriptor??
[  386.328494][T11973] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22
[  386.464261][ T1217] rc_core: IR keymap rc-streamzap not found
[  386.464284][ T1217] Registered IR keymap rc-empty
[  386.465972][ T1217] rc rc0: Streamzap PC Remote Infrared Receiver as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0
[  386.468748][ T1217] input: Streamzap PC Remote Infrared Receiver as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0/input43
[  386.582468][  T990] usb 2-1: USB disconnect, device number 17
[  386.920459][T12015] netlink: 60 bytes leftover after parsing attributes in process `syz.8.1950'.
[  386.921574][T12015] netlink: 60 bytes leftover after parsing attributes in process `syz.8.1950'.
[  386.922121][T12015] netlink: 60 bytes leftover after parsing attributes in process `syz.8.1950'.
[  389.187586][  T990] usb 10-1: new high-speed USB device number 7 using dummy_hcd
[  389.341091][  T990] usb 10-1: Using ep0 maxpacket: 8
[  389.343301][  T990] usb 10-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b
[  389.346455][  T990] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  389.370787][  T990] pvrusb2: Hardware description: Terratec Grabster AV400
[  389.370827][  T990] pvrusb2: **********
[  389.370836][  T990] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental.
[  389.370848][  T990] pvrusb2: Important functionality might not be entirely working.
[  389.370858][  T990] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver.
[  389.370871][  T990] pvrusb2: **********
[  389.568040][T12108] netlink: 'syz.4.1993': attribute type 3 has an invalid length.
[  389.681585][ T2363] pvrusb2: Invalid write control endpoint
[  389.933553][ T2363] pvrusb2: Invalid write control endpoint
[  389.933571][ T2363] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work.
[  389.933582][ T2363] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device.
[  389.933591][ T2363] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups.
[  389.933602][ T2363] pvrusb2: Device being rendered inoperable
[  390.048305][T12089] pvrusb2: Killing an I2C write to 5 that is too large (desired=8192 limit=61)
[  390.051913][  T990] usb 10-1: USB disconnect, device number 7
[  390.063088][ T2363] cx25840 1-0044: Unable to detect h/w, assuming cx23887
[  390.089049][ T2363] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_a)
[  390.184147][ T2363] pvrusb2: Attached sub-driver cx25840
[  390.184227][ T2363] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it.
[  390.184240][ T2363] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover.
[  391.543234][T12151] ffs_data_put(): freeing
[  393.387838][ T5789] usb 2-1: new high-speed USB device number 18 using dummy_hcd
[  393.539766][ T5789] usb 2-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice= 1.00
[  393.540967][ T5789] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[  393.541017][ T5789] usb 2-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2
[  393.548105][ T5789] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  393.548134][ T5789] usb 2-1: Product: syz
[  393.548150][ T5789] usb 2-1: Manufacturer: syz
[  393.548165][ T5789] usb 2-1: SerialNumber: syz
[  394.175622][ T4936] Bluetooth: hci3: unexpected event for opcode 0x0c1b
[  394.918534][    T9] usb 10-1: new high-speed USB device number 8 using dummy_hcd
[  395.070693][    T9] usb 10-1: New USB device found, idVendor=0451, idProduct=505f, bcdDevice= 1.00
[  395.071734][    T9] usb 10-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7
[  395.072707][    T9] usb 10-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7
[  395.074650][    T9] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  395.074673][    T9] usb 10-1: Product: syz
[  395.074686][    T9] usb 10-1: Manufacturer: syz
[  395.074695][    T9] usb 10-1: SerialNumber: syz
[  395.090842][    T9] ti_usb_3410_5052 10-1:2.0: TI USB 5052 2 port adapter converter detected
[  395.119885][    T9] usb 10-1: TI USB 5052 2 port adapter converter now attached to ttyUSB0
[  395.130520][ T1217] usb 2-1: USB disconnect, device number 18
[  395.143433][    T9] usb 10-1: TI USB 5052 2 port adapter converter now attached to ttyUSB1
[  395.619838][T12240] overlayfs: failed to clone lowerpath
[  396.249117][ T5789] usb 2-1: new high-speed USB device number 19 using dummy_hcd
[  396.400267][ T5789] usb 2-1: New USB device found, idVendor=0681, idProduct=0005, bcdDevice= 1.00
[  396.401343][ T5789] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  396.401372][ T5789] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 0
[  396.401413][ T5789] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  396.454995][ T5789] idmouse 2-1:1.0: Siemens ID Mouse FingerTIP Sensor Driver now attached
[  396.566276][ T4936] Bluetooth: hci2: unexpected event for opcode 0x2002
[  396.884306][ T4936] Bluetooth: hci3: unexpected event for opcode 0x2035
[  397.553131][T12299] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2085'.
[  397.555769][T12296] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2085'.
[  397.556135][T12296] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2085'.
[  397.557857][T12296] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2085'.
[  398.085438][    T9] usb 2-1: USB disconnect, device number 19
[  398.113851][    T9] idmouse 2-1:1.0: disconnected
[  398.264977][T12307] overlayfs: failed to clone upperpath
[  399.240332][T12331] No source specified
[  399.310759][   T31] audit: type=1800 audit(1788585465.598:36): pid=12334 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.2095" name="nullb0" dev="tmpfs" ino=1497 res=0 errno=0
[  399.593098][T12220] ti_usb_3410_5052_2 ttyUSB0: ti_close - cannot send close port command, -110
[  399.598147][   T30] usb 10-1: USB disconnect, device number 8
[  399.613722][T12348] netlink: 32 bytes leftover after parsing attributes in process `syz.1.2099'.
[  399.648716][   T30] ti_usb_3410_5052_2 ttyUSB0: TI USB 5052 2 port adapter converter now disconnected from ttyUSB0
[  399.673901][   T30] ti_usb_3410_5052_2 ttyUSB1: TI USB 5052 2 port adapter converter now disconnected from ttyUSB1
[  399.675009][   T30] ti_usb_3410_5052 10-1:2.0: device disconnected
[  400.171277][ T1217] usb 10-1: new high-speed USB device number 9 using dummy_hcd
[  400.181177][   T30] usb 2-1: new high-speed USB device number 20 using dummy_hcd
[  400.321195][ T1217] usb 10-1: Using ep0 maxpacket: 8
[  400.321927][ T1217] usb 10-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb
[  400.323333][ T1217] usb 10-1: config 179 has an invalid interface number: 65 but max is 0
[  400.323360][ T1217] usb 10-1: config 179 has no interface number 0
[  400.323410][ T1217] usb 10-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7
[  400.323439][ T1217] usb 10-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024
[  400.323468][ T1217] usb 10-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7
[  400.323496][ T1217] usb 10-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024
[  400.323524][ T1217] usb 10-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23
[  400.323567][ T1217] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  400.334232][T12358] raw-gadget.1 gadget.9: fail, usb_ep_enable returned -22
[  400.346013][   T30] usb 2-1: Using ep0 maxpacket: 8
[  400.355520][   T30] usb 2-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a
[  400.435523][   T30] usb 2-1: config 0 has an invalid interface number: 55 but max is 0
[  400.435554][   T30] usb 2-1: config 0 has no interface number 0
[  400.435598][   T30] usb 2-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping
[  400.435623][   T30] usb 2-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B
[  400.435650][   T30] usb 2-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7
[  400.435676][   T30] usb 2-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2
[  400.435720][   T30] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  400.532104][   T30] usb 2-1: config 0 descriptor??
[  400.539731][   T30] ldusb 2-1:0.55: LD USB Device #0 now attached to major 180 minor 0
[  400.633274][ T1217] input: Generic X-Box pad as /devices/platform/dummy_hcd.9/usb10/10-1/10-1:179.65/input/input44
[  400.801776][   T30] usb 10-1: USB disconnect, device number 9
[  400.801887][    C0] xpad 10-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19
[  400.801943][    C0] xpad 10-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19
[  401.513536][ T4936] Bluetooth: hci1: unexpected event for opcode 0x0c1c
[  402.574255][    T9] usb 10-1: new high-speed USB device number 10 using dummy_hcd
[  402.743416][    T9] usb 10-1: Using ep0 maxpacket: 16
[  402.764131][    T9] usb 10-1: New USB device found, idVendor=057e, idProduct=2019, bcdDevice= 0.00
[  402.787284][    T9] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  402.787320][    T9] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x2 has an invalid bInterval 0, changing to 7
[  402.787345][    T9] usb 10-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5
[  402.787386][    T9] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  402.808935][    T9] usb 10-1: config 0 descriptor??
[  402.837268][   T30] usb 2-1: USB disconnect, device number 20
[  402.931078][   T30] ldusb 2-1:0.55: LD USB Device #0 now disconnected
[  403.311762][    T9] nintendo 0003:057E:2019.0018: hidraw0: USB HID v80.05 Device [HID 057e:2019] on usb-dummy_hcd.9-1/input0
[  403.703378][    T9] nintendo 0003:057E:2019.0018: Failed to get joycon info; ret=-71
[  403.703411][    T9] nintendo 0003:057E:2019.0018: Failed to retrieve controller info; ret=-71
[  403.703431][    T9] nintendo 0003:057E:2019.0018: Failed to initialize controller; ret=-71
[  403.760212][    T9] nintendo 0003:057E:2019.0018: probe - fail = -71
[  403.760528][    T9] nintendo 0003:057E:2019.0018: probe with driver nintendo failed with error -71
[  403.784896][    T9] usb 10-1: USB disconnect, device number 10
[  403.792759][ T4936] Bluetooth: hci3: SCO packet for unknown connection handle 0
[  404.021887][T12469] kvm_pr_unimpl_wrmsr: 3547 callbacks suppressed
[  404.021963][T12469] kvm [12468]: vcpu0, guest rIP: 0x9114 Unhandled WRMSR(0xc2) = 0x9d00
[  404.022158][T12469] kvm [12468]: vcpu0, guest rIP: 0x9114 Unhandled WRMSR(0xc1) = 0x9d00
[  404.515995][ T5789] usb 10-1: new high-speed USB device number 11 using dummy_hcd
[  404.624757][T12494] FAULT_INJECTION: forcing a failure.
[  404.624757][T12494] name failslab, interval 1, probability 0, space 0, times 0
[  404.624796][T12494] CPU: 0 UID: 0 PID: 12494 Comm: syz.1.2161 Tainted: G             L      syzkaller #0 PREEMPT(full) 
[  404.624826][T12494] Tainted: [L]=SOFTLOCKUP
[  404.624835][T12494] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[  404.624848][T12494] Call Trace:
[  404.624858][T12494]  <TASK>
[  404.624869][T12494]  dump_stack_lvl+0xe8/0x150
[  404.624908][T12494]  should_fail_ex+0x3eb/0x540
[  404.624942][T12494]  should_failslab+0xa8/0x100
[  404.624971][T12494]  __kmalloc_cache_noprof+0x9e/0x600
[  404.625005][T12494]  ? resv_map_alloc+0x51/0x2c0
[  404.625034][T12494]  ? resv_map_alloc+0x51/0x2c0
[  404.625064][T12494]  ? __pfx___mutex_unlock_slowpath+0x10/0x10
[  404.625094][T12494]  resv_map_alloc+0x51/0x2c0
[  404.625127][T12494]  hugetlbfs_get_inode+0x5f/0x660
[  404.625207][T12494]  hugetlb_file_setup+0x21d/0x630
[  404.625237][T12494]  ksys_mmap_pgoff+0x1ec/0x760
[  404.625269][T12494]  do_syscall_64+0x166/0x520
[  404.625289][T12494]  ? trace_irq_disable+0x3b/0x140
[  404.625319][T12494]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  404.625341][T12494]  ? clear_bhb_loop+0x70/0xc0
[  404.625367][T12494]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  404.625387][T12494] RIP: 0033:0x7f660d59e159
[  404.625408][T12494] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  404.625427][T12494] RSP: 002b:00007f660e45b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009
[  404.625459][T12494] RAX: ffffffffffffffda RBX: 00007f660d825fa0 RCX: 00007f660d59e159
[  404.625475][T12494] RDX: 0000000000000001 RSI: 0000000000ff5000 RDI: 0000200000000000
[  404.625490][T12494] RBP: 00007f660d635024 R08: ffffffffffffffff R09: 0000000000000000
[  404.625505][T12494] R10: 000200000005c832 R11: 0000000000000246 R12: 0000000000000000
[  404.625520][T12494] R13: 00007f660d826038 R14: 00007f660d825fa0 R15: 00007fffeef00278
[  404.625553][T12494]  </TASK>
[  404.674381][ T5789] usb 10-1: Using ep0 maxpacket: 16
[  404.678345][ T5789] usb 10-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40
[  404.679692][ T5789] usb 10-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[  404.679714][ T5789] usb 10-1: config 1 has 1 interface, different from the descriptor's value: 3
[  404.685466][ T5789] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  404.685491][ T5789] usb 10-1: Product: syz
[  404.685506][ T5789] usb 10-1: Manufacturer: syz
[  404.685519][ T5789] usb 10-1: SerialNumber: syz
[  404.734852][ T5789] usb 10-1: 0:2 : does not exist
[  404.937637][ T5789] usb 10-1: 5:0: failed to get current value for ch 0 (-22)
[  405.165297][ T5789] usb 10-1: USB disconnect, device number 11
[  405.249265][ T5633] udevd[5633]: error opening ATTR{/sys/devices/platform/dummy_hcd.9/usb10/10-1/10-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory
[  405.344885][   T10] usb 2-1: new high-speed USB device number 21 using dummy_hcd
[  405.493747][   T10] usb 2-1: Using ep0 maxpacket: 16
[  405.494952][   T10] usb 2-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1
[  405.498196][   T10] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83
[  405.498231][   T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7
[  405.543427][   T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  405.543459][   T10] usb 2-1: Product: syz
[  405.543475][   T10] usb 2-1: Manufacturer: syz
[  405.543491][   T10] usb 2-1: SerialNumber: syz
[  405.575129][   T10] usb 2-1: config 0 descriptor??
[  405.582615][   T10] em28xx 2-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0)
[  405.582649][   T10] em28xx 2-1:0.0: Audio interface 0 found (Vendor Class)
[  405.763875][T12518] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2171'.
[  405.935639][ T5789] usb 10-1: new full-speed USB device number 12 using dummy_hcd
[  406.094766][ T5789] usb 10-1: New USB device found, idVendor=0b48, idProduct=1003, bcdDevice= 1.00
[  406.095860][ T5789] usb 10-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[  406.095928][ T5789] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  406.123529][ T5789] usb 10-1: selecting invalid altsetting 1
[  406.123696][ T5789] dvb_ttusb_budget: ttusb_init_controller: error
[  406.123711][ T5789] dvbdev: DVB: registering new adapter (Technotrend/Hauppauge Nova-USB)
[  406.192423][   T10] em28xx 2-1:0.0: unknown em28xx chip ID (0)
[  406.200386][   T10] em28xx 2-1:0.0: Config register raw data: 0xfffffffb
[  406.261524][ T5789] DVB: Unable to find symbol stv0299_attach()
[  406.368806][ T5789] DVB: Unable to find symbol tda8083_attach()
[  406.368825][ T5789] dvb_ttusb_budget: no frontend driver found for device [0b48:1003]
[  406.375386][ T5789] usb 10-1: USB disconnect, device number 12
[  406.821604][   T10] em28xx 2-1:0.0: Unknown AC97 audio processor detected!
[  406.822313][   T10] em28xx 2-1:0.0: couldn't setup AC97 register 2
[  406.822925][   T10] em28xx 2-1:0.0: couldn't setup AC97 register 4
[  406.823714][   T10] em28xx 2-1:0.0: couldn't setup AC97 register 6
[  406.856641][   T10] em28xx 2-1:0.0: couldn't setup AC97 register 54
[  406.857335][   T10] em28xx 2-1:0.0: couldn't setup AC97 register 56
[  407.067273][   T10] em28xx 2-1:0.0: couldn't setup AC97 register 2
[  407.067301][   T10] em28xx 2-1:0.0: couldn't setup AC97 register 4
[  407.067318][   T10] em28xx 2-1:0.0: couldn't setup AC97 register 6
[  407.067333][   T10] em28xx 2-1:0.0: couldn't setup AC97 register 54
[  407.067349][   T10] em28xx 2-1:0.0: couldn't setup AC97 register 56
[  407.115787][   T10] usb 2-1: USB disconnect, device number 21
[  407.231200][T12541] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2182'.
[  407.725049][  T990] usb 10-1: new high-speed USB device number 13 using dummy_hcd
[  407.750054][T12564] overlayfs: failed to clone lowerpath
[  407.752282][T12564] overlayfs: failed to clone lowerpath
[  407.893225][  T990] usb 10-1: Using ep0 maxpacket: 16
[  407.895639][  T990] usb 10-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3
[  407.900295][  T990] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  407.900320][  T990] usb 10-1: Product: syz
[  407.900406][  T990] usb 10-1: Manufacturer: syz
[  407.900421][  T990] usb 10-1: SerialNumber: syz
[  407.904700][  T990] usb 10-1: config 0 descriptor??
[  407.945015][   T10] usb 2-1: new high-speed USB device number 22 using dummy_hcd
[  408.096052][   T10] usb 2-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a
[  408.100659][   T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  408.100688][   T10] usb 2-1: Product: syz
[  408.100705][   T10] usb 2-1: Manufacturer: syz
[  408.100720][   T10] usb 2-1: SerialNumber: syz
[  408.104511][   T10] usb 2-1: config 0 descriptor??
[  408.330060][  T990] dvb-usb: found a 'AME DTV-5100 USB2.0 DVB-T' in warm state.
[  408.332771][  T990] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer.
[  408.333780][  T990] dvbdev: DVB: registering new adapter (AME DTV-5100 USB2.0 DVB-T)
[  408.333836][  T990] usb 10-1: media controller created
[  408.351912][  T990] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered.
[  408.543143][  T990] zl10353_read_register: readreg error (reg=127, ret==0)
[  408.543205][  T990] dvb-usb: no frontend was attached by 'AME DTV-5100 USB2.0 DVB-T'
[  408.543297][  T990] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully initialized and connected.
[  408.551782][  T990] usb 10-1: USB disconnect, device number 13
[  408.597198][   T10] usb 2-1: Firmware version (0.0) predates our first public release.
[  408.597227][   T10] usb 2-1: Please update to version 0.2 or newer
[  408.598584][   T10] usb 2-1: Firmware: build 
[  408.667127][  T990] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully deinitialized and disconnected.
[  408.819359][   T10] usb 2-1: USB disconnect, device number 22
[  409.666989][  T990] usb 2-1: new high-speed USB device number 23 using dummy_hcd
[  409.708903][   T25] usb 10-1: new high-speed USB device number 14 using dummy_hcd
[  409.829438][  T990] usb 2-1: New USB device found, idVendor=0644, idProduct=8047, bcdDevice= 1.00
[  409.830661][  T990] usb 2-1: config 1 has an invalid interface number: 3 but max is 0
[  409.830687][  T990] usb 2-1: config 1 has no interface number 0
[  409.833452][  T990] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  409.833477][  T990] usb 2-1: Product: syz
[  409.833493][  T990] usb 2-1: Manufacturer: syz
[  409.833509][  T990] usb 2-1: SerialNumber: syz
[  409.856029][  T990] usb 2-1: 3:1 : does not exist
[  409.856052][  T990] usb 2-1: 3:2 : does not exist
[  409.867799][   T25] usb 10-1: Using ep0 maxpacket: 16
[  409.870693][   T25] usb 10-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1
[  409.873379][   T25] usb 10-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83
[  409.873411][   T25] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7
[  409.883594][   T25] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  409.883618][   T25] usb 10-1: Product: syz
[  409.883632][   T25] usb 10-1: Manufacturer: syz
[  409.883646][   T25] usb 10-1: SerialNumber: syz
[  409.892334][   T25] usb 10-1: config 0 descriptor??
[  409.914400][   T25] em28xx 10-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0)
[  409.914435][   T25] em28xx 10-1:0.0: Audio interface 0 found (Vendor Class)
[  410.504993][   T25] em28xx 10-1:0.0: unknown em28xx chip ID (0)
[  410.505499][   T25] em28xx 10-1:0.0: Config register raw data: 0xfffffffb
[  410.629708][   T30] usb 2-1: USB disconnect, device number 23
[  411.108970][   T25] em28xx 10-1:0.0: Unknown AC97 audio processor detected!
[  411.109645][   T25] em28xx 10-1:0.0: couldn't setup AC97 register 2
[  411.110164][   T25] em28xx 10-1:0.0: couldn't setup AC97 register 4
[  411.110865][   T25] em28xx 10-1:0.0: couldn't setup AC97 register 6
[  411.112778][   T25] em28xx 10-1:0.0: couldn't setup AC97 register 54
[  411.113302][   T25] em28xx 10-1:0.0: couldn't setup AC97 register 56
[  411.323223][   T25] em28xx 10-1:0.0: couldn't setup AC97 register 2
[  411.323267][   T25] em28xx 10-1:0.0: couldn't setup AC97 register 4
[  411.323285][   T25] em28xx 10-1:0.0: couldn't setup AC97 register 6
[  411.323301][   T25] em28xx 10-1:0.0: couldn't setup AC97 register 54
[  411.323318][   T25] em28xx 10-1:0.0: couldn't setup AC97 register 56
[  411.334144][   T25] usb 10-1: USB disconnect, device number 14
[  411.596943][ T5789] usb 2-1: new full-speed USB device number 24 using dummy_hcd
[  411.769484][ T5789] usb 2-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b
[  411.770846][ T5789] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x4F, changing to 0xF
[  411.770880][ T5789] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0xF has invalid maxpacket 140, setting to 64
[  411.773426][ T5789] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  411.773452][ T5789] usb 2-1: Product: syz
[  411.773468][ T5789] usb 2-1: Manufacturer: syz
[  411.773484][ T5789] usb 2-1: SerialNumber: syz
[  411.776964][ T5789] usb 2-1: config 0 descriptor??
[  411.797731][T12654] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22
[  412.020460][T12654] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22
[  412.120832][    T9] usb 10-1: new high-speed USB device number 15 using dummy_hcd
[  412.253617][T12654] usb 2-1: cannot submit urb 0, error -2: endpoint not enabled
[  412.267098][   T10] usb 2-1: USB disconnect, device number 24
[  412.290326][    T9] usb 10-1: unable to get BOS descriptor or descriptor too short
[  412.290381][    T9] usb 10-1: New USB device found, idVendor=0582, idProduct=004c, bcdDevice= 0.40
[  412.291794][    T9] usb 10-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 64, changing to 7
[  412.294280][    T9] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  412.294307][    T9] usb 10-1: Product: syz
[  412.294322][    T9] usb 10-1: Manufacturer: syz
[  412.294338][    T9] usb 10-1: SerialNumber: syz
[  412.553116][T12679] fuse: fd is not a fuse device
[  412.591427][    T9] usb 10-1: 1:1 : UAC_AS_GENERAL descriptor not found
[  412.789527][    T9] usb 10-1: 2:1 : unknown format tag 0x4 is detected.  processed as MPEG.
[  412.789561][    T9] usb 10-1: found format II with max.bitrate = 4, frame size=7372
[  412.789667][    T9] usb 10-1: parse_audio_format_rates_v2v3(): unable to find clock source (clock -22)
[  412.789819][    T9] usb 10-1: 2:1 : unknown format tag 0x4 is detected.  processed as MPEG.
[  412.789841][    T9] usb 10-1: found format II with max.bitrate = 4, frame size=7372
[  412.789862][    T9] usb 10-1: parse_audio_format_rates_v2v3(): unable to find clock source (clock -22)
[  413.057570][  T990] usb 2-1: new high-speed USB device number 25 using dummy_hcd
[  413.217430][  T990] usb 2-1: unable to get BOS descriptor or descriptor too short
[  413.217622][  T990] usb 2-1: New USB device found, idVendor=21b4, idProduct=0081, bcdDevice= 0.40
[  413.220382][  T990] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[  413.220404][  T990] usb 2-1: config 1 has 2 interfaces, different from the descriptor's value: 3
[  413.220462][  T990] usb 2-1: too many endpoints for config 1 interface 1 altsetting 76: 188, using maximum allowed: 30
[  413.220499][  T990] usb 2-1: config 1 interface 1 altsetting 76 has 0 endpoint descriptors, different from the interface descriptor's value: 188
[  413.220535][  T990] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7
[  413.220560][  T990] usb 2-1: config 1 interface 1 has no altsetting 0
[  413.223381][  T990] usb 2-1: string descriptor 0 read error: -22
[  413.223513][  T990] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  413.302909][T12698] fuse: fd is not a fuse device
[  413.490006][    T9] usb 10-1: USB disconnect, device number 15
[  413.694439][  T990] usb 2-1: 2:0: cannot get min/max values for control 2 (id 2)
[  413.694473][  T990] usb 2-1: Warning! Unlikely small volume range (=1), linear volume or custom curve?
[  413.694492][  T990] usb 2-1: [2] FU [Speaker Playback Volume] ch = 1, val = 0/1/1
[  414.168514][  T990] usb 2-1: 2:0: failed to get current value for ch 1 (-71)
[  414.285352][  T990] usb 2-1: USB disconnect, device number 25
[  414.449729][ T5619] udevd[5619]: error opening ATTR{/sys/devices/platform/dummy_hcd.9/usb10/10-1/10-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory
[  414.808560][    T9] usb 10-1: new high-speed USB device number 16 using dummy_hcd
[  414.958548][    T9] usb 10-1: Using ep0 maxpacket: 16
[  414.960985][    T9] usb 10-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1
[  414.962545][    T9] usb 10-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83
[  414.962570][    T9] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7
[  415.006917][    T9] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  415.006937][    T9] usb 10-1: Product: syz
[  415.006947][    T9] usb 10-1: Manufacturer: syz
[  415.006955][    T9] usb 10-1: SerialNumber: syz
[  415.036192][    T9] usb 10-1: config 0 descriptor??
[  415.053356][    T9] em28xx 10-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0)
[  415.053393][    T9] em28xx 10-1:0.0: Audio interface 0 found (Vendor Class)
[  415.666609][    T9] em28xx 10-1:0.0: unknown em28xx chip ID (0)
[  415.677013][    T9] em28xx 10-1:0.0: Config register raw data: 0xfffffffb
[  416.287780][    T9] em28xx 10-1:0.0: Unknown AC97 audio processor detected!
[  416.288424][    T9] em28xx 10-1:0.0: couldn't setup AC97 register 2
[  416.290119][    T9] em28xx 10-1:0.0: couldn't setup AC97 register 4
[  416.313874][    T9] em28xx 10-1:0.0: couldn't setup AC97 register 6
[  416.315011][    T9] em28xx 10-1:0.0: couldn't setup AC97 register 54
[  416.315638][    T9] em28xx 10-1:0.0: couldn't setup AC97 register 56
[  416.520622][    T9] em28xx 10-1:0.0: couldn't setup AC97 register 2
[  416.520651][    T9] em28xx 10-1:0.0: couldn't setup AC97 register 4
[  416.520667][    T9] em28xx 10-1:0.0: couldn't setup AC97 register 6
[  416.520683][    T9] em28xx 10-1:0.0: couldn't setup AC97 register 54
[  416.520700][    T9] em28xx 10-1:0.0: couldn't setup AC97 register 56
[  416.563228][    T9] usb 10-1: USB disconnect, device number 16
[  416.895165][T12762] fuse: fd is not a fuse device
[  417.003840][T12764] input: syz0 as /devices/virtual/input/input45
[  417.529861][ T5789] usb 2-1: new high-speed USB device number 26 using dummy_hcd
[  417.679885][ T5789] usb 2-1: Using ep0 maxpacket: 16
[  417.680648][ T5789] usb 2-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1
[  417.681728][ T5789] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83
[  417.681760][ T5789] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7
[  417.684046][ T5789] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  417.684071][ T5789] usb 2-1: Product: syz
[  417.684087][ T5789] usb 2-1: Manufacturer: syz
[  417.684103][ T5789] usb 2-1: SerialNumber: syz
[  417.688764][ T5789] usb 2-1: config 0 descriptor??
[  417.697381][ T5789] em28xx 2-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0)
[  417.697413][ T5789] em28xx 2-1:0.0: Audio interface 0 found (Vendor Class)
[  418.315841][ T5789] em28xx 2-1:0.0: unknown em28xx chip ID (0)
[  418.318583][ T1101] netdevsim netdevsim9 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  418.319125][ T5789] em28xx 2-1:0.0: Config register raw data: 0x41
[  418.701859][T12789] MTD: Couldn't look up './dev/mtdblock0': -2
[  418.754850][ T1101] netdevsim netdevsim9 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  418.948763][ T1101] netdevsim netdevsim9 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  419.061685][ T5632] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[  419.070912][ T5632] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[  419.074293][ T5632] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[  419.094741][ T5632] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[  419.096707][ T5632] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[  419.211628][ T1101] netdevsim netdevsim9 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  419.592404][ T1101] bridge_slave_1: left allmulticast mode
[  419.592436][ T1101] bridge_slave_1: left promiscuous mode
[  419.592673][ T1101] bridge0: port 2(bridge_slave_1) entered disabled state
[  419.597870][ T1101] bridge_slave_0: left allmulticast mode
[  419.597895][ T1101] bridge_slave_0: left promiscuous mode
[  419.598109][ T1101] bridge0: port 1(bridge_slave_0) entered disabled state
[  419.899087][ T1101] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  419.911639][ T1101] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  419.913501][ T1101] bond0 (unregistering): Released all slaves
[  420.030404][ T1101] tipc: Disabling bearer <udp:syz0>
[  420.030572][ T1101] tipc: Left network mode
[  420.234125][ T5281] 8021q: adding VLAN 0 to HW filter on device eth1
[  420.340117][ T5789] usb 2-1: USB disconnect, device number 26
[  420.355783][ T5789] em28xx 2-1:0.0: Disconnecting em28xx
[  420.383498][ T5789] em28xx: Freeing device
[  420.558335][T12797] lo speed is unknown, defaulting to 1000
[  420.696737][ T5281] 8021q: adding VLAN 0 to HW filter on device eth2
[  420.943745][ T5281] 8021q: adding VLAN 0 to HW filter on device eth3
[  421.175334][ T5281] 8021q: adding VLAN 0 to HW filter on device eth4
[  421.204342][ T4936] Bluetooth: hci1: command tx timeout
[  421.700723][ T1101] hsr_slave_0: left promiscuous mode
[  421.712819][ T1101] hsr_slave_1: left promiscuous mode
[  421.715068][ T1101] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  421.715110][ T1101] batman_adv: batadv0: Removing interface: batadv_slave_0
[  421.745839][ T1101] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  421.745863][ T1101] batman_adv: batadv0: Removing interface: batadv_slave_1
[  421.770501][ T1101] veth1_macvtap: left promiscuous mode
[  421.770543][ T1101] veth0_macvtap: left promiscuous mode
[  421.770658][ T1101] veth1_vlan: left promiscuous mode
[  421.770734][ T1101] veth0_vlan: left promiscuous mode
[  421.942131][ T5789] usb 2-1: new high-speed USB device number 27 using dummy_hcd
[  422.092062][ T5789] usb 2-1: Using ep0 maxpacket: 32
[  422.092845][ T5789] usb 2-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30
[  422.093988][ T5789] usb 2-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config
[  422.094038][ T5789] usb 2-1: config 155 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82
[  422.094068][ T5789] usb 2-1: config 155 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7
[  422.094096][ T5789] usb 2-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11
[  422.096665][ T5789] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  422.096692][ T5789] usb 2-1: Product: syz
[  422.096708][ T5789] usb 2-1: Manufacturer: syz
[  422.096724][ T5789] usb 2-1: SerialNumber: syz
[  422.170391][T12868] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  422.214094][    C1] imon 2-1:155.0: imon usb_rx_callback_intf0: status(-71)
[  422.220057][ T5789] input: iMON Panel, Knob and Mouse(15c2:ffdc) as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:155.0/input/input46
[  422.291377][ T1101] team0 (unregistering): Port device team_slave_1 removed
[  422.310735][ T1101] team0 (unregistering): Port device team_slave_0 removed
[  422.372262][ T5789] imon 2-1:155.0: Unknown 0xffdc device, defaulting to VFD and iMON IR
[  422.372287][ T5789]  (id 0x00)
[  422.452329][ T5789] rc_core: IR keymap rc-imon-pad not found
[  422.452352][ T5789] Registered IR keymap rc-empty
[  422.452436][ T5789] imon 2-1:155.0: Looks like you're trying to use an IR protocol this device does not support
[  422.452457][ T5789] imon 2-1:155.0: Unsupported IR protocol specified, overriding to iMON IR protocol
[  422.650085][ T5789] rc rc0: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:155.0/rc/rc0
[  422.674176][ T5789] input: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:155.0/rc/rc0/input47
[  422.687159][ T5789] imon 2-1:155.0: iMON device (15c2:ffdc, intf0) on usb<2:27> initialized
[  422.771020][T12881] overlayfs: failed to clone upperpath
[  422.875512][ T5789] usb 2-1: USB disconnect, device number 27
[  423.282700][ T4936] Bluetooth: hci1: command tx timeout
[  423.388769][T12797] bridge0: port 1(bridge_slave_0) entered blocking state
[  423.393227][T12797] bridge0: port 1(bridge_slave_0) entered disabled state
[  423.394299][T12797] bridge_slave_0: entered allmulticast mode
[  423.399450][T12797] bridge_slave_0: entered promiscuous mode
[  423.433180][T12797] bridge0: port 2(bridge_slave_1) entered blocking state
[  423.433304][T12797] bridge0: port 2(bridge_slave_1) entered disabled state
[  423.433446][T12797] bridge_slave_1: entered allmulticast mode
[  423.437351][T12797] bridge_slave_1: entered promiscuous mode
[  423.445758][T12899] fuse: fd is not a fuse device
[  423.517001][T12797] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  423.521191][T12797] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  423.577541][T12797] team0: Port device team_slave_0 added
[  423.580736][T12797] team0: Port device team_slave_1 added
[  423.582048][T12903] jffs2: notice: (12903) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[  423.643716][T12797] batman_adv: batadv0: Adding interface: batadv_slave_0
[  423.643736][T12797] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  423.643764][T12797] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  423.648742][T12797] batman_adv: batadv0: Adding interface: batadv_slave_1
[  423.648761][T12797] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  423.648789][T12797] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  423.791485][T12797] hsr_slave_0: entered promiscuous mode
[  423.792637][T12797] hsr_slave_1: entered promiscuous mode
[  423.799315][T12797] debugfs: 'hsr0' already exists in 'hsr'
[  423.799339][T12797] Cannot create hsr debugfs directory
[  423.895324][T12910] MTD: Couldn't look up './dev/mtdblock0': -2
[  424.803963][  T988] usb 2-1: new high-speed USB device number 28 using dummy_hcd
[  424.955429][  T988] usb 2-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.00
[  424.959081][  T988] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  424.959107][  T988] usb 2-1: Product: syz
[  424.959121][  T988] usb 2-1: Manufacturer: syz
[  424.959143][  T988] usb 2-1: SerialNumber: syz
[  425.191084][T12797] netdevsim netdevsim2 netdevsim0: renamed from eth0
[  425.205386][T12797] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[  425.210683][T12797] netdevsim netdevsim2 netdevsim1: renamed from eth1
[  425.231997][T12797] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[  425.241650][T12797] netdevsim netdevsim2 netdevsim2: renamed from eth2
[  425.264551][T12797] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[  425.265605][T12797] netdevsim netdevsim2 netdevsim3: renamed from eth3
[  425.271976][T12797] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[  425.364343][ T5632] Bluetooth: hci1: command tx timeout
[  425.519566][T12797] 8021q: adding VLAN 0 to HW filter on device bond0
[  425.557945][T12797] 8021q: adding VLAN 0 to HW filter on device team0
[  425.587970][T12430] bridge0: port 1(bridge_slave_0) entered blocking state
[  425.588094][T12430] bridge0: port 1(bridge_slave_0) entered forwarding state
[  425.590303][T12430] bridge0: port 2(bridge_slave_1) entered blocking state
[  425.590422][T12430] bridge0: port 2(bridge_slave_1) entered forwarding state
[  425.625359][  T988] (unnamed net_device) (uninitialized): Assigned a random MAC address: e6:55:96:e8:e4:3c
[  425.666188][  T988] rtl8150 2-1:1.0: eth5: rtl8150 is detected
[  425.789313][ T5632] Bluetooth: hci2: unexpected event for opcode 0x1001
[  426.207143][    C1] usb 2-1: Rx status -71
[  426.207224][    C1] usb 2-1: eth5: intr status -71
[  426.207440][    C1] usb 2-1: Rx status -71
[  426.207522][    C1] usb 2-1: eth5: intr status -71
[  426.207664][    C1] usb 2-1: Rx status -71
[  426.207705][   T10] usb 2-1: USB disconnect, device number 28
[  426.207745][    C1] usb 2-1: eth5: intr status -71
[  426.220050][ T5281] usb 2-1: device reset failed
[  426.622618][   T31] audit: type=1326 audit(1788585492.894:37): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12999 comm="syz.4.2349" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f3eec59e159 code=0x0
[  426.744588][T12797] 8021q: adding VLAN 0 to HW filter on device batadv0
[  426.871409][T12797] veth0_vlan: entered promiscuous mode
[  426.920004][T12797] veth1_vlan: entered promiscuous mode
[  427.014376][T12797] veth0_macvtap: entered promiscuous mode
[  427.027449][T12797] veth1_macvtap: entered promiscuous mode
[  427.072534][T12797] batman_adv: batadv0: Interface activated: batadv_slave_0
[  427.099112][T12797] batman_adv: batadv0: Interface activated: batadv_slave_1
[  427.204899][ T5632] Bluetooth: hci3: command 0x2016 tx timeout
[  427.256090][   T13] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  427.256527][   T13] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  427.256571][   T13] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  427.256621][   T13] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  427.445360][ T4936] Bluetooth: hci1: command tx timeout
[  427.507530][T13015] jffs2: notice: (13015) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[  427.612124][T12430] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  427.612149][T12430] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  427.738077][   T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  427.738103][   T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  428.385213][T13040] fuse: fd is not a fuse device
[  428.505243][  T988] usb 3-1: new high-speed USB device number 17 using dummy_hcd
[  428.505330][    T9] usb 2-1: new high-speed USB device number 29 using dummy_hcd
[  428.542329][T13042] fuse: fd is not a fuse device
[  428.644304][T13046] MTD: Couldn't look up './dev/mtdblock0': -2
[  428.658336][  T988] usb 3-1: New USB device found, idVendor=065a, idProduct=0009, bcdDevice= 1.00
[  428.659557][  T988] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64
[  428.659605][  T988] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  428.670139][T13036] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22
[  428.678145][  T988] opticon 3-1:1.0: opticon converter detected
[  428.699989][    T9] usb 2-1: Using ep0 maxpacket: 8
[  428.704515][  T988] usb 3-1: opticon converter now attached to ttyUSB0
[  428.711915][    T9] usb 2-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e
[  428.729528][    T9] usb 2-1: config 168 descriptor has 1 excess byte, ignoring
[  428.729566][    T9] usb 2-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30
[  428.729604][    T9] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11
[  428.729643][    T9] usb 2-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F
[  428.729670][    T9] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7
[  428.729695][    T9] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024
[  428.729720][    T9] usb 2-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100
[  428.729745][    T9] usb 2-1: config 168 interface 0 has no altsetting 0
[  428.730923][    T9] usb 2-1: config 168 descriptor has 1 excess byte, ignoring
[  428.730958][    T9] usb 2-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30
[  428.730993][    T9] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11
[  428.731017][    T9] usb 2-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F
[  428.731042][    T9] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7
[  428.731065][    T9] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024
[  428.731091][    T9] usb 2-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100
[  428.731117][    T9] usb 2-1: config 168 interface 0 has no altsetting 0
[  428.732060][    T9] usb 2-1: config 168 descriptor has 1 excess byte, ignoring
[  428.732092][    T9] usb 2-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30
[  428.732127][    T9] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11
[  428.732151][    T9] usb 2-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F
[  428.732174][    T9] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7
[  428.732198][    T9] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024
[  428.732223][    T9] usb 2-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100
[  428.732248][    T9] usb 2-1: config 168 interface 0 has no altsetting 0
[  428.803975][    T9] usb 2-1: string descriptor 0 read error: -22
[  428.804135][    T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  429.029211][    T9] adutux 2-1:168.0: ADU100  now attached to /dev/usb/adutux0
[  429.355294][ T1217] usb 2-1: USB disconnect, device number 29
[  429.421036][    T9] usb 3-1: USB disconnect, device number 17
[  429.447433][    T9] opticon ttyUSB0: opticon converter now disconnected from ttyUSB0
[  429.449769][    T9] opticon 3-1:1.0: device disconnected
[  430.485106][T13086] lo speed is unknown, defaulting to 1000
[  430.507261][T13088] syzkaller1: entered promiscuous mode
[  430.507287][T13088] syzkaller1: entered allmulticast mode
[  432.460693][T13140] overlayfs: failed to clone upperpath
[  432.843173][   T31] audit: type=1800 audit(1788585499.111:38): pid=13154 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.2406" name="file1" dev="overlay" ino=77 res=0 errno=0
[  432.972436][ T5724] usb 2-1: new high-speed USB device number 30 using dummy_hcd
[  433.128603][ T5724] usb 2-1: Using ep0 maxpacket: 16
[  433.131792][ T5724] usb 2-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00
[  433.133198][ T5724] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  433.133230][ T5724] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  433.133249][ T5724] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9
[  433.133275][ T5724] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  433.143880][ T5724] usb 2-1: config 0 descriptor??
[  433.297734][  T988] usb 3-1: new full-speed USB device number 18 using dummy_hcd
[  433.453503][  T988] usb 3-1: New USB device found, idVendor=1044, idProduct=7001, bcdDevice= 5.20
[  433.460435][  T988] usb 3-1: config 4 has an invalid interface number: 44 but max is 0
[  433.460462][  T988] usb 3-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config
[  433.460480][  T988] usb 3-1: config 4 has no interface number 0
[  433.460518][  T988] usb 3-1: config 4 interface 44 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2
[  433.464800][  T988] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  433.464824][  T988] usb 3-1: Product: syz
[  433.464838][  T988] usb 3-1: Manufacturer: syz
[  433.464852][  T988] usb 3-1: SerialNumber: syz
[  433.689865][ T5724] input: HID 045e:07da as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:045E:07DA.0019/input/input48
[  433.773481][ T5724] microsoft 0003:045E:07DA.0019: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.1-1/input0
[  433.848991][   T10] usb 2-1: USB disconnect, device number 30
[  433.912111][  T988] dvb-usb: found a 'Gigabyte U7000' in warm state.
[  433.939929][  T988] dvb-usb: will use the device's hardware PID filter (table count: 32).
[  433.945464][  T988] dvbdev: DVB: registering new adapter (Gigabyte U7000)
[  433.945524][  T988] usb 3-1: media controller created
[  433.951993][  T988] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered.
[  434.026842][T13177] fido_id[13177]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/report_descriptor': No such file or directory
[  434.104734][  T988] DVB: Unable to find symbol dib7000p_attach()
[  434.104753][  T988] dvb-usb: no frontend was attached by 'Gigabyte U7000'
[  434.211289][  T988] rc_core: IR keymap rc-dib0700-rc5 not found
[  434.211311][  T988] Registered IR keymap rc-empty
[  434.233927][  T988] dvb-usb: could not initialize remote control.
[  434.233945][  T988] dvb-usb: Gigabyte U7000 successfully initialized and connected.
[  434.259949][  T988] usb 3-1: USB disconnect, device number 18
[  434.344491][  T988] dvb-usb: Gigabyte U7000 successfully deinitialized and disconnected.
[  434.718436][   T10] usb 2-1: new high-speed USB device number 31 using dummy_hcd
[  434.882179][   T10] usb 2-1: unable to get BOS descriptor or descriptor too short
[  434.904174][   T10] usb 2-1: New USB device found, idVendor=0582, idProduct=004c, bcdDevice= 0.40
[  434.905316][   T10] usb 2-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 64, changing to 7
[  434.944805][   T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  434.944836][   T10] usb 2-1: Product: syz
[  434.944853][   T10] usb 2-1: Manufacturer: syz
[  434.944868][   T10] usb 2-1: SerialNumber: syz
[  435.195244][   T10] usb 2-1: 1:1 : UAC_AS_GENERAL descriptor not found
[  435.289495][  T988] usb 3-1: new high-speed USB device number 19 using dummy_hcd
[  435.392973][   T10] usb 2-1: 2:1 : unknown format tag 0x4 is detected.  processed as MPEG.
[  435.393006][   T10] usb 2-1: found format II with max.bitrate = 4, frame size=7372
[  435.442272][  T988] usb 3-1: New USB device found, idVendor=1199, idProduct=b000, bcdDevice= 0.00
[  435.443449][  T988] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0
[  435.443477][  T988] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0
[  435.443518][  T988] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  435.692892][    T9] usb 3-1: USB disconnect, device number 19
[  435.799436][   T10] usb 2-1: 2:1 : unknown format tag 0x4 is detected.  processed as MPEG.
[  435.799470][   T10] usb 2-1: found format II with max.bitrate = 4, frame size=7372
[  435.898557][T13213] lo speed is unknown, defaulting to 1000
[  436.005167][   T10] usb 2-1: parse_audio_format_rates_v2v3(): unable to retrieve number of sample rates (clock 0)
[  436.149455][   T10] usb 2-1: USB disconnect, device number 31
[  436.290826][T12720] udevd[12720]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory
[  436.629944][   T10] usb 3-1: new high-speed USB device number 20 using dummy_hcd
[  436.781343][   T10] usb 3-1: Using ep0 maxpacket: 32
[  436.784039][   T10] usb 3-1: New USB device found, idVendor=0ac8, idProduct=0321, bcdDevice=6f.be
[  436.788373][   T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  436.821449][   T10] usb 3-1: config 0 descriptor??
[  436.841091][   T10] gspca_main: vc032x-2.14.0 probing 0ac8:0321
[  437.200595][T13239] input: syz0 as /devices/virtual/input/input50
[  437.446490][T13242] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state.
[  437.829945][    T9] usb 2-1: new high-speed USB device number 32 using dummy_hcd
[  437.983052][    T9] usb 2-1: New USB device found, idVendor=1ba6, idProduct=0001, bcdDevice= 0.01
[  437.985399][    T9] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[  437.985441][    T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  438.026068][    T9] as10x_usb: device has been detected
[  438.037765][    T9] dvbdev: DVB: registering new adapter (Abilis Systems DVB-Titan)
[  438.062483][    T9] usb 2-1: DVB: registering adapter 1 frontend 0 (Abilis Systems DVB-Titan)...
[  438.134194][    T9] EXT4-fs warning (device sda1): ext4_dirblock_csum_verify:375: inode #274: comm kworker/0:0: No space for directory leaf checksum. Please run e2fsck -D.
[  438.134344][    T9] EXT4-fs error (device sda1): __ext4_find_entry:1628: inode #274: comm kworker/0:0: checksumming directory block 0
[  438.136749][    T9] usb 2-1: loading /lib/firmware/updates/syzkaller/as102_data1_st.hex failed with error -74
[  438.136991][    T9] EXT4-fs warning (device sda1): ext4_dirblock_csum_verify:375: inode #274: comm kworker/0:0: No space for directory leaf checksum. Please run e2fsck -D.
[  438.137053][    T9] EXT4-fs error (device sda1): __ext4_find_entry:1628: inode #274: comm kworker/0:0: checksumming directory block 0
[  438.137759][    T9] usb 2-1: loading /lib/firmware/updates/as102_data1_st.hex failed with error -74
[  438.138009][    T9] EXT4-fs warning (device sda1): ext4_dirblock_csum_verify:375: inode #274: comm kworker/0:0: No space for directory leaf checksum. Please run e2fsck -D.
[  438.138038][    T9] EXT4-fs error (device sda1): __ext4_find_entry:1628: inode #274: comm kworker/0:0: checksumming directory block 0
[  438.138792][    T9] usb 2-1: loading /lib/firmware/syzkaller/as102_data1_st.hex failed with error -74
[  438.139041][    T9] EXT4-fs warning (device sda1): ext4_dirblock_csum_verify:375: inode #274: comm kworker/0:0: No space for directory leaf checksum. Please run e2fsck -D.
[  438.139071][    T9] EXT4-fs error (device sda1): __ext4_find_entry:1628: inode #274: comm kworker/0:0: checksumming directory block 0
[  438.139767][    T9] usb 2-1: loading /lib/firmware/as102_data1_st.hex failed with error -74
[  438.139855][    T9] usb 2-1: Direct firmware load for as102_data1_st.hex failed with error -74
[  438.139877][    T9] usb 2-1: Falling back to sysfs fallback for: as102_data1_st.hex
[  438.303111][T13261] tipc: Enabling of bearer <eth:syzkaller0> rejected, failed to enable media
[  438.324624][   T10] gspca_vc032x: reg_w err -71
[  438.324700][   T10] gspca_vc032x: I2c Bus Busy Wait 00
[  438.324715][   T10] gspca_vc032x: I2c Bus Busy Wait 00
[  438.324724][   T10] gspca_vc032x: I2c Bus Busy Wait 00
[  438.324734][   T10] gspca_vc032x: I2c Bus Busy Wait 00
[  438.324744][   T10] gspca_vc032x: I2c Bus Busy Wait 00
[  438.324753][   T10] gspca_vc032x: I2c Bus Busy Wait 00
[  438.324762][   T10] gspca_vc032x: I2c Bus Busy Wait 00
[  438.324773][   T10] gspca_vc032x: I2c Bus Busy Wait 00
[  438.324782][   T10] gspca_vc032x: I2c Bus Busy Wait 00
[  438.324792][   T10] gspca_vc032x: I2c Bus Busy Wait 00
[  438.324802][   T10] gspca_vc032x: I2c Bus Busy Wait 00
[  438.324812][   T10] gspca_vc032x: I2c Bus Busy Wait 00
[  438.324821][   T10] gspca_vc032x: I2c Bus Busy Wait 00
[  438.324831][   T10] gspca_vc032x: I2c Bus Busy Wait 00
[  438.324840][   T10] gspca_vc032x: I2c Bus Busy Wait 00
[  438.324849][   T10] gspca_vc032x: I2c Bus Busy Wait 00
[  438.324859][   T10] gspca_vc032x: I2c Bus Busy Wait 00
[  438.324869][   T10] gspca_vc032x: I2c Bus Busy Wait 00
[  438.324878][   T10] gspca_vc032x: Unknown sensor...
[  438.324960][   T10] vc032x 3-1:0.0: probe with driver vc032x failed with error -22
[  438.327242][   T10] usb 3-1: USB disconnect, device number 20
[  438.775134][T13277] overlayfs: failed to clone upperpath
[  438.866360][T13279] FAULT_INJECTION: forcing a failure.
[  438.866360][T13279] name fail_page_alloc, interval 1, probability 0, space 0, times 0
[  438.866399][T13279] CPU: 0 UID: 0 PID: 13279 Comm: syz.2.2452 Tainted: G             L      syzkaller #0 PREEMPT(full) 
[  438.866431][T13279] Tainted: [L]=SOFTLOCKUP
[  438.866440][T13279] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[  438.866454][T13279] Call Trace:
[  438.866464][T13279]  <TASK>
[  438.866475][T13279]  dump_stack_lvl+0xe8/0x150
[  438.866511][T13279]  should_fail_ex+0x3eb/0x540
[  438.866541][T13279]  prepare_alloc_pages+0x21e/0x5f0
[  438.866581][T13279]  __alloc_frozen_pages_noprof+0x185/0x5a0
[  438.866615][T13279]  ? kasan_save_track+0x3e/0x80
[  438.866652][T13279]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  438.866697][T13279]  ? policy_nodemask+0x2cc/0x8e0
[  438.866723][T13279]  ? mas_start+0x46b/0x640
[  438.866760][T13279]  alloc_pages_mpol+0x21e/0x390
[  438.866797][T13279]  alloc_pages_noprof+0xb1/0x2b0
[  438.866825][T13279]  __pud_alloc+0x3a/0x460
[  438.866860][T13279]  handle_mm_fault+0x2519/0x3750
[  438.866887][T13279]  ? mt_find+0x186/0x630
[  438.866920][T13279]  ? handle_mm_fault+0xf1/0x3750
[  438.866945][T13279]  ? mt_find+0x186/0x630
[  438.866969][T13279]  ? __pfx_mt_find+0x10/0x10
[  438.866999][T13279]  ? __pfx_handle_mm_fault+0x10/0x10
[  438.867057][T13279]  __get_user_pages+0x1670/0x2750
[  438.867128][T13279]  get_user_pages_remote+0x305/0xb90
[  438.867165][T13279]  ? __pfx_get_user_pages_remote+0x10/0x10
[  438.867194][T13279]  ? mmap_read_lock_maybe_expand+0xd7/0x3b0
[  438.867230][T13279]  copy_string_kernel+0x2f9/0x5f0
[  438.867273][T13279]  ? __pfx_copy_string_kernel+0x10/0x10
[  438.867308][T13279]  ? alloc_bprm+0x57d/0x640
[  438.867342][T13279]  do_execveat_common+0x7fb/0xbd0
[  438.867381][T13279]  ? do_getname+0x151/0x250
[  438.867409][T13279]  __x64_sys_execve+0x97/0xc0
[  438.867443][T13279]  do_syscall_64+0x166/0x520
[  438.867464][T13279]  ? trace_irq_disable+0x3b/0x140
[  438.867494][T13279]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  438.867517][T13279]  ? clear_bhb_loop+0x70/0xc0
[  438.867545][T13279]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  438.867566][T13279] RIP: 0033:0x7f0db7d9e159
[  438.867588][T13279] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  438.867608][T13279] RSP: 002b:00007f0db8b89028 EFLAGS: 00000246 ORIG_RAX: 000000000000003b
[  438.867634][T13279] RAX: ffffffffffffffda RBX: 00007f0db8025fa0 RCX: 00007f0db7d9e159
[  438.867651][T13279] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000240
[  438.867666][T13279] RBP: 00007f0db7e35024 R08: 0000000000000000 R09: 0000000000000000
[  438.867681][T13279] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  438.867695][T13279] R13: 00007f0db8026038 R14: 00007f0db8025fa0 R15: 00007ffc7531df98
[  438.867732][T13279]  </TASK>
[  439.362863][T13294] tmpfs: Bad value for 'nr_blocks'
[  439.641116][  T988] usb 3-1: new high-speed USB device number 21 using dummy_hcd
[  439.791295][  T988] usb 3-1: Using ep0 maxpacket: 32
[  439.794569][  T988] usb 3-1: unable to get BOS descriptor or descriptor too short
[  439.794623][  T988] usb 3-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13
[  439.795579][  T988] usb 3-1: config 14 has an invalid interface number: 57 but max is 1
[  439.795604][  T988] usb 3-1: config 14 has an invalid interface number: 228 but max is 1
[  439.795626][  T988] usb 3-1: config 14 has no interface number 0
[  439.795644][  T988] usb 3-1: config 14 has no interface number 1
[  439.795701][  T988] usb 3-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping
[  439.795716][  T988] usb 3-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81
[  439.795732][  T988] usb 3-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10
[  439.795748][  T988] usb 3-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024
[  439.795766][  T988] usb 3-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10
[  439.795781][  T988] usb 3-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3
[  439.795797][  T988] usb 3-1: config 14 interface 57 has no altsetting 0
[  439.795809][  T988] usb 3-1: config 14 interface 228 has no altsetting 0
[  439.797772][  T988] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  439.797797][  T988] usb 3-1: Product: syz
[  439.797812][  T988] usb 3-1: Manufacturer: syz
[  439.797827][  T988] usb 3-1: SerialNumber: syz
[  440.290189][  T988] legousbtower 3-1:14.57: interrupt endpoints not found
[  440.380618][T13324] fuse: fd is not a fuse device
[  440.493865][ T1311] ieee802154 phy0 wpan0: encryption failed: -22
[  440.493931][ T1311] ieee802154 phy1 wpan1: encryption failed: -22
[  440.689780][  T988] legousbtower 3-1:14.228: LEGO USB Tower firmware version is 228.166 build 40507
[  440.691164][  T988] legousbtower 3-1:14.228: LEGO USB Tower #-159 now attached to major 180 minor 1
[  441.549576][T13356] overlayfs: failed to resolve './cgroup': -2
[  441.716322][   T31] audit: type=1800 audit(1788585507.987:39): pid=13362 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.8.2486" name="file1" dev="tmpfs" ino=2367 res=0 errno=0
[  442.435989][  T988] usb 3-1: USB disconnect, device number 21
[  442.469277][  T988] legousbtower 3-1:14.228: LEGO USB Tower #-159 now disconnected
[  442.713030][T13403] fuse: fd is not a fuse device
[  442.986627][ T4936] Bluetooth: hci3: adv larger than maximum supported
[  442.986652][ T4936] Bluetooth: hci3: Malformed LE Event: 0x0d
[  443.334799][T13417] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2514'.
[  443.334822][T13417] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2514'.
[  443.482167][T13423] syz.4.2516 calls setitimer() with new_value NULL pointer. Misfeature support will be removed
[  443.703291][  T988] usb 3-1: new high-speed USB device number 22 using dummy_hcd
[  443.865254][  T988] usb 3-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d
[  443.866562][  T988] usb 3-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7
[  443.866597][  T988] usb 3-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47
[  443.866641][  T988] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  443.871932][T13421] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22
[  443.926535][  T988] usb 3-1: Quirk or no altset; falling back to MIDI 1.0
[  444.081520][  T988] usb 3-1: USB disconnect, device number 22
[  445.141984][T13463] fuse: fd is not a fuse device
[  445.609591][T13476] tipc: Started in network mode
[  445.609628][T13476] tipc: Node identity 8a5bb1f13b48, cluster identity 4711
[  445.609811][T13476] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  445.613106][T13476] syzkaller0: MTU too low for tipc bearer
[  445.613128][T13476] tipc: Disabling bearer <eth:syzkaller0>
[  448.146880][T13529] overlayfs: failed to clone upperpath
[  448.177880][   T25] usb 3-1: new high-speed USB device number 23 using dummy_hcd
[  448.336590][   T25] usb 3-1: Using ep0 maxpacket: 8
[  448.337491][   T25] usb 3-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2e.04
[  448.360565][   T25] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  448.360597][   T25] usb 3-1: Product: syz
[  448.360613][   T25] usb 3-1: Manufacturer: syz
[  448.360629][   T25] usb 3-1: SerialNumber: syz
[  448.363836][   T25] usb 3-1: config 0 descriptor??
[  448.577109][   T25] usb 3-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state
[  448.988736][   T25] dvb_usb_rtl28xxu 3-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71
[  449.002162][   T25] usb 3-1: USB disconnect, device number 23
[  449.197277][T13558] fuse: fd is not a fuse device
[  449.269650][T13562] overlayfs: failed to clone upperpath
[  450.621774][T13613] fuse: fd is not a fuse device
[  451.090188][T13627] CIFS: Attempting to mount //127.0.0.1/share
[  451.106693][T13627] CIFS: VFS: Error connecting to socket. Aborting operation.
[  451.106748][T13627] CIFS: VFS: cifs_mount failed w/return code = -101
[  451.691299][T13646] FAULT_INJECTION: forcing a failure.
[  451.691299][T13646] name failslab, interval 1, probability 0, space 0, times 0
[  451.691334][T13646] CPU: 0 UID: 0 PID: 13646 Comm: syz.2.2597 Tainted: G             L      syzkaller #0 PREEMPT(full) 
[  451.691353][T13646] Tainted: [L]=SOFTLOCKUP
[  451.691358][T13646] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[  451.691367][T13646] Call Trace:
[  451.691373][T13646]  <TASK>
[  451.691380][T13646]  dump_stack_lvl+0xe8/0x150
[  451.691403][T13646]  should_fail_ex+0x3eb/0x540
[  451.691422][T13646]  should_failslab+0xa8/0x100
[  451.691437][T13646]  ? mas_dup_build+0x147/0x1270
[  451.691452][T13646]  kmem_cache_alloc_noprof+0x9c/0x600
[  451.691472][T13646]  ? mas_dup_build+0x147/0x1270
[  451.691489][T13646]  mas_dup_build+0x147/0x1270
[  451.691516][T13646]  __mt_dup+0x197/0x2c0
[  451.691529][T13646]  ? __pfx___mt_dup+0x10/0x10
[  451.691548][T13646]  ? get_mm_exe_file+0x1c/0x170
[  451.691569][T13646]  ? get_mm_exe_file+0x1c/0x170
[  451.691580][T13646]  ? get_mm_exe_file+0x1c/0x170
[  451.691598][T13646]  dup_mmap+0x3ee/0x1dc0
[  451.691626][T13646]  ? __pfx_dup_mmap+0x10/0x10
[  451.691643][T13646]  ? do_raw_spin_lock+0x12b/0x2f0
[  451.691667][T13646]  ? lock_acquire+0x115/0x350
[  451.691696][T13646]  copy_mm+0x11a/0x470
[  451.691711][T13646]  ? copy_process+0xd37/0x43e0
[  451.691724][T13646]  copy_process+0x1e70/0x43e0
[  451.691744][T13646]  ? copy_process+0xd37/0x43e0
[  451.691768][T13646]  ? __pfx_copy_process+0x10/0x10
[  451.691790][T13646]  kernel_clone+0x2d7/0x940
[  451.691809][T13646]  ? __pfx_kernel_clone+0x10/0x10
[  451.691839][T13646]  ? do_futex+0x3e7/0x4e0
[  451.691857][T13646]  __x64_sys_clone+0x1b6/0x230
[  451.691875][T13646]  ? __pfx___x64_sys_clone+0x10/0x10
[  451.691898][T13646]  ? __pfx___se_sys_futex+0x10/0x10
[  451.691921][T13646]  do_syscall_64+0x166/0x520
[  451.691937][T13646]  ? trace_irq_disable+0x3b/0x140
[  451.691954][T13646]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  451.691967][T13646]  ? clear_bhb_loop+0x70/0xc0
[  451.691983][T13646]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  451.691996][T13646] RIP: 0033:0x7f0db7d9e159
[  451.692009][T13646] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  451.692020][T13646] RSP: 002b:00007f0db8b88fd8 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
[  451.692036][T13646] RAX: ffffffffffffffda RBX: 00007f0db8025fa0 RCX: 00007f0db7d9e159
[  451.692046][T13646] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[  451.692054][T13646] RBP: 00007f0db7e35024 R08: 0000000000000000 R09: 0000000000000000
[  451.692062][T13646] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  451.692070][T13646] R13: 00007f0db8026038 R14: 00007f0db8025fa0 R15: 00007ffc7531df98
[  451.692091][T13646]  </TASK>
[  452.407645][ T1217] usb 3-1: new high-speed USB device number 24 using dummy_hcd
[  452.560104][ T1217] usb 3-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3
[  452.561748][ T1217] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  452.589781][ T1217] usb 3-1: config 0 descriptor??
[  452.596762][ T1217] cp210x 3-1:0.0: cp210x converter detected
[  453.016344][T13660] dvmrp0: entered allmulticast mode
[  453.031381][ T1217] usb 3-1: cp210x converter now attached to ttyUSB0
[  453.046126][ T1217] usb 3-1: USB disconnect, device number 24
[  453.062204][ T1217] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0
[  453.062892][ T1217] cp210x 3-1:0.0: device disconnected
[  454.010871][ T4986] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes.
[  454.010961][ T4986] ldm_parse_privhead(): PRIVHEAD disk size doesn't match real disk size
[  454.010975][ T4986] ldm_validate_privheads(): Cannot find PRIVHEAD 1.
[  454.011076][ T4986]  loop0:
[  455.069406][   T31] audit: type=1800 audit(1788585521.330:40): pid=13750 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.2642" name="(" dev="sda1" ino=2059 res=0 errno=0
[  455.184680][T13754] overlayfs: failed to clone upperpath
[  456.564752][T13804] fuse: fd is not a fuse device
[  456.589526][   T10] usb 3-1: new high-speed USB device number 25 using dummy_hcd
[  456.739941][   T10] usb 3-1: Using ep0 maxpacket: 16
[  456.740671][   T10] usb 3-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1
[  456.741574][   T10] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83
[  456.741607][   T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7
[  456.743599][   T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  456.743615][   T10] usb 3-1: Product: syz
[  456.743624][   T10] usb 3-1: Manufacturer: syz
[  456.743634][   T10] usb 3-1: SerialNumber: syz
[  456.745919][   T10] usb 3-1: config 0 descriptor??
[  456.815718][   T10] em28xx 3-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0)
[  456.815754][   T10] em28xx 3-1:0.0: Audio interface 0 found (Vendor Class)
[  457.246716][ T4936] Bluetooth: hci2: SCO packet for unknown connection handle 0
[  457.353455][   T10] em28xx 3-1:0.0: unknown em28xx chip ID (0)
[  457.355352][   T10] em28xx 3-1:0.0: Config register raw data: 0xfffffffb
[  457.610171][T13827] fuse: fd is not a fuse device
[  457.960074][   T10] em28xx 3-1:0.0: Unknown AC97 audio processor detected!
[  457.972588][   T10] em28xx 3-1:0.0: couldn't setup AC97 register 2
[  457.973506][   T10] em28xx 3-1:0.0: couldn't setup AC97 register 4
[  457.974238][   T10] em28xx 3-1:0.0: couldn't setup AC97 register 6
[  457.974826][   T10] em28xx 3-1:0.0: couldn't setup AC97 register 54
[  457.975734][   T10] em28xx 3-1:0.0: couldn't setup AC97 register 56
[  458.179313][   T10] em28xx 3-1:0.0: couldn't setup AC97 register 2
[  458.179341][   T10] em28xx 3-1:0.0: couldn't setup AC97 register 4
[  458.179357][   T10] em28xx 3-1:0.0: couldn't setup AC97 register 6
[  458.179370][   T10] em28xx 3-1:0.0: couldn't setup AC97 register 54
[  458.179383][   T10] em28xx 3-1:0.0: couldn't setup AC97 register 56
[  458.216197][   T10] usb 3-1: USB disconnect, device number 25
[  459.344248][T13878] netlink: 14 bytes leftover after parsing attributes in process `syz.8.2691'.
[  459.460981][   T10] usb 3-1: new high-speed USB device number 26 using dummy_hcd
[  459.612210][   T10] usb 3-1: New USB device found, idVendor=0681, idProduct=0005, bcdDevice= 1.00
[  459.614090][   T10] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  459.614120][   T10] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 0
[  459.614162][   T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  459.676121][   T10] idmouse 3-1:1.0: Siemens ID Mouse FingerTIP Sensor Driver now attached
[  459.944414][T13890] fuse: fd is not a fuse device
[  460.238527][T13900] fuse: fd is not a fuse device
[  460.356903][ T5632] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[  460.358377][ T5632] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[  460.359323][ T5632] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[  460.368712][ T5632] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[  460.393588][ T5632] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[  460.703028][T13903] lo speed is unknown, defaulting to 1000
[  461.113959][T13926] fuse: fd is not a fuse device
[  461.213700][T13931] netlink: 14 bytes leftover after parsing attributes in process `syz.8.2710'.
[  461.242885][T13903] bridge0: port 1(bridge_slave_0) entered blocking state
[  461.243091][T13903] bridge0: port 1(bridge_slave_0) entered disabled state
[  461.243240][T13903] bridge_slave_0: entered allmulticast mode
[  461.245354][T13903] bridge_slave_0: entered promiscuous mode
[  461.248347][T13903] bridge0: port 2(bridge_slave_1) entered blocking state
[  461.248515][T13903] bridge0: port 2(bridge_slave_1) entered disabled state
[  461.248922][T13903] bridge_slave_1: entered allmulticast mode
[  461.250725][T13903] bridge_slave_1: entered promiscuous mode
[  461.295623][T13903] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  461.304961][T13903] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  461.398932][T13903] team0: Port device team_slave_0 added
[  461.407788][T13903] team0: Port device team_slave_1 added
[  461.490259][T13903] batman_adv: batadv0: Adding interface: batadv_slave_0
[  461.490281][T13903] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  461.490309][T13903] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  461.497640][T13903] batman_adv: batadv0: Adding interface: batadv_slave_1
[  461.497657][T13903] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  461.497680][T13903] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  461.637558][T13903] hsr_slave_0: entered promiscuous mode
[  461.638350][T13903] hsr_slave_1: entered promiscuous mode
[  461.638813][T13903] debugfs: 'hsr0' already exists in 'hsr'
[  461.638835][T13903] Cannot create hsr debugfs directory
[  462.259728][ T5703] usb 3-1: USB disconnect, device number 26
[  462.285142][ T5703] idmouse 3-1:1.0: disconnected
[  462.423230][ T4936] Bluetooth: hci0: command tx timeout
[  463.057649][T13903] netdevsim netdevsim0 netdevsim0: renamed from eth0
[  463.062007][T13903] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[  463.072929][T13903] netdevsim netdevsim0 netdevsim1: renamed from eth1
[  463.090200][T13903] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[  463.091480][T13903] netdevsim netdevsim0 netdevsim2: renamed from eth2
[  463.106939][T13903] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[  463.108664][T13903] netdevsim netdevsim0 netdevsim3: renamed from eth3
[  463.125836][T13903] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[  463.197095][T13903] 8021q: adding VLAN 0 to HW filter on device bond0
[  463.209185][T13903] 8021q: adding VLAN 0 to HW filter on device team0
[  463.220039][T12429] bridge0: port 1(bridge_slave_0) entered blocking state
[  463.220104][T12429] bridge0: port 1(bridge_slave_0) entered forwarding state
[  463.241810][ T1416] bridge0: port 2(bridge_slave_1) entered blocking state
[  463.241875][ T1416] bridge0: port 2(bridge_slave_1) entered forwarding state
[  463.621653][T13903] 8021q: adding VLAN 0 to HW filter on device batadv0
[  463.675890][T13903] veth0_vlan: entered promiscuous mode
[  463.681488][T13903] veth1_vlan: entered promiscuous mode
[  463.721415][T13903] veth0_macvtap: entered promiscuous mode
[  463.731134][T13903] veth1_macvtap: entered promiscuous mode
[  463.754426][T13903] batman_adv: batadv0: Interface activated: batadv_slave_0
[  463.761095][T13903] batman_adv: batadv0: Interface activated: batadv_slave_1
[  463.804116][T12429] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  463.853494][ T1416] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  463.853544][ T1416] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  463.853575][ T1416] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  463.945012][   T51] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  463.945037][   T51] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  463.987205][   T51] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  463.987227][   T51] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  464.157063][   T31] audit: type=1800 audit(1788585530.416:41): pid=14010 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.2700" name="syzkaller0" dev="sda1" ino=2045 res=0 errno=0
[  464.503601][ T4936] Bluetooth: hci0: command tx timeout
[  464.988429][T13982] mount: server 127.0.0.1 not responding, timed out
[  465.299661][T14041] CIFS: Attempting to mount //127.0.0.1/share
[  465.300212][T14041] CIFS: VFS: Error connecting to socket. Aborting operation.
[  465.300261][T14041] CIFS: VFS: cifs_mount failed w/return code = -101
[  466.334158][  T988] usb 3-1: new high-speed USB device number 27 using dummy_hcd
[  466.484285][  T988] usb 3-1: Using ep0 maxpacket: 16
[  466.485582][  T988] usb 3-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00
[  466.486604][  T988] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  466.486636][  T988] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  466.486657][  T988] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9
[  466.486695][  T988] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  466.488803][  T988] usb 3-1: config 0 descriptor??
[  466.584407][ T4936] Bluetooth: hci0: command tx timeout
[  466.907314][  T988] microsoft 0003:045E:07DA.001A: unknown main item tag 0x0
[  466.907351][  T988] microsoft 0003:045E:07DA.001A: unknown main item tag 0x0
[  466.907378][  T988] microsoft 0003:045E:07DA.001A: unknown main item tag 0x0
[  466.907403][  T988] microsoft 0003:045E:07DA.001A: unknown main item tag 0x0
[  466.912750][  T988] microsoft 0003:045E:07DA.001A: unknown main item tag 0x0
[  466.912791][  T988] microsoft 0003:045E:07DA.001A: unknown main item tag 0x0
[  466.912818][  T988] microsoft 0003:045E:07DA.001A: unknown main item tag 0x0
[  466.912845][  T988] microsoft 0003:045E:07DA.001A: unknown main item tag 0x0
[  466.912871][  T988] microsoft 0003:045E:07DA.001A: unknown main item tag 0x0
[  466.912897][  T988] microsoft 0003:045E:07DA.001A: unknown main item tag 0x0
[  466.942314][  T988] input: HID 045e:07da as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:045E:07DA.001A/input/input51
[  467.050707][  T988] microsoft 0003:045E:07DA.001A: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.2-1/input0
[  467.129455][  T988] usb 3-1: USB disconnect, device number 27
[  467.222726][T14085] fido_id[14085]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.2/usb3/report_descriptor': No such file or directory
[  467.252298][T14091] fuse: fd is not a fuse device
[  467.358611][T14093] fuse: fd is not a fuse device
[  467.668242][T14095] fuse: fd is not a fuse device
[  468.106657][  T988] rust_binder: 14117: undelivered TRANSACTION_COMPLETE
[  468.106700][  T988] rust_binder: 14117: undelivered TRANSACTION_COMPLETE
[  468.159845][  T988] rust_binder: 14117: undelivered transaction 98, process died
[  468.159908][  T988] rust_binder: 14117: undelivered transaction 97, process died
[  468.205314][T14122] netlink: 'syz.2.2780': attribute type 1 has an invalid length.
[  468.213565][T12429] IPVS: starting estimator thread 0...
[  468.302147][T14124] IPVS: using max 24 ests per chain, 57600 per kthread
[  468.665704][ T4936] Bluetooth: hci0: command tx timeout
[  468.802545][T14142] netlink: 4 bytes leftover after parsing attributes in process `syz.8.2789'.
[  469.230017][T14156] rust_binder: Failed to allocate buffer. len:8, is_oneway:false
[  469.969268][T14171] syz1: rxe_newlink: already configured on lo
[  470.023937][ T5703] rust_binder: 14154: undelivered TRANSACTION_ERROR: 29189
[  470.906027][T14196] netlink: 666 bytes leftover after parsing attributes in process `syz.4.2808'.
[  470.987233][  T988] usb 3-1: new high-speed USB device number 28 using dummy_hcd
[  471.147441][  T988] usb 3-1: New USB device found, idVendor=0425, idProduct=a4a1, bcdDevice= 0.40
[  471.148151][  T988] usb 3-1: config 0 has no interfaces?
[  471.149364][  T988] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1
[  471.149389][  T988] usb 3-1: SerialNumber: syz
[  471.155635][  T988] usb 3-1: config 0 descriptor??
[  471.399494][  T988] usb 3-1: USB disconnect, device number 28
[  471.759682][T14209] FAULT_INJECTION: forcing a failure.
[  471.759682][T14209] name failslab, interval 1, probability 0, space 0, times 0
[  471.759720][T14209] CPU: 1 UID: 0 PID: 14209 Comm: syz.0.2814 Tainted: G             L      syzkaller #0 PREEMPT(full) 
[  471.759756][T14209] Tainted: [L]=SOFTLOCKUP
[  471.759765][T14209] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[  471.759778][T14209] Call Trace:
[  471.759787][T14209]  <TASK>
[  471.759797][T14209]  dump_stack_lvl+0xe8/0x150
[  471.759839][T14209]  should_fail_ex+0x3eb/0x540
[  471.759869][T14209]  should_failslab+0xa8/0x100
[  471.759895][T14209]  kmem_cache_alloc_lru_noprof+0xa2/0x5f0
[  471.759928][T14209]  ? __d_alloc+0x37/0x6f0
[  471.759956][T14209]  ? __d_alloc+0x37/0x6f0
[  471.759993][T14209]  __d_alloc+0x37/0x6f0
[  471.760027][T14209]  path_from_stashed+0x35c/0x580
[  471.760067][T14209]  pidfs_alloc_file+0xff/0x280
[  471.760099][T14209]  ? __pfx_pidfs_alloc_file+0x10/0x10
[  471.760138][T14209]  pidfd_prepare+0xfd/0x170
[  471.760176][T14209]  __se_sys_pidfd_open+0xd5/0x260
[  471.760208][T14209]  ? __pfx___se_sys_pidfd_open+0x10/0x10
[  471.760253][T14209]  do_syscall_64+0x166/0x520
[  471.760274][T14209]  ? trace_irq_disable+0x3b/0x140
[  471.760305][T14209]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  471.760328][T14209]  ? clear_bhb_loop+0x70/0xc0
[  471.760356][T14209]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  471.760379][T14209] RIP: 0033:0x7f04c039e159
[  471.760400][T14209] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  471.760420][T14209] RSP: 002b:00007f04c118b018 EFLAGS: 00000246 ORIG_RAX: 00000000000001b2
[  471.760446][T14209] RAX: ffffffffffffffda RBX: 00007f04c0625fa0 RCX: 00007f04c039e159
[  471.760463][T14209] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000014
[  471.760478][T14209] RBP: 00007f04c0435024 R08: 0000000000000000 R09: 0000000000000000
[  471.760493][T14209] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  471.760507][T14209] R13: 00007f04c0626038 R14: 00007f04c0625fa0 R15: 00007ffecdaf35e8
[  471.760542][T14209]  </TASK>
[  472.094259][T14213] rust_binder: Failure when writing BR_NOOP at beginning of buffer.
[  472.094280][T14213] rust_binder: Read failure Err(EFAULT) in pid:22
[  472.120180][T14213] rust_binder: 14212:14213 error while translating object: EBADF
[  472.120290][T14213] rust_binder: Failure in copy_transaction_data: EBADF
[  472.120323][T14213] rust_binder: 14212:14213 transaction call to 14212:0 failed EBADF, code 0 size 112-24
[  472.125297][   T25] rust_binder: 14212: undelivered TRANSACTION_ERROR: 29201
[  472.495836][T14232] input: syz0 as /devices/virtual/input/input52
[  473.480201][T14257] null_blk: nullb2: using native zone append
[  473.503391][T14257] null_blk: disk nullb2 created
[  473.791280][ T5768] usb 3-1: new high-speed USB device number 29 using dummy_hcd
[  473.938024][ T5768] usb 3-1: Using ep0 maxpacket: 16
[  473.940006][ T5768] usb 3-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73
[  473.942534][ T5768] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  473.942551][ T5768] usb 3-1: config 0 has no interfaces?
[  473.944226][ T5768] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  473.944243][ T5768] usb 3-1: Product: syz
[  473.944252][ T5768] usb 3-1: Manufacturer: syz
[  473.944261][ T5768] usb 3-1: SerialNumber: syz
[  473.946693][ T5768] usb 3-1: config 0 descriptor??
[  474.224891][ T4936] Bluetooth: hci1: failed to read key size for handle 0
[  474.224957][ T4936] Bluetooth: hci1: unexpected event for opcode 0x1408
[  474.246206][ T5768] usb 3-1: USB disconnect, device number 29
[  475.058542][  T988] usb 3-1: new high-speed USB device number 30 using dummy_hcd
[  475.210861][  T988] usb 3-1: unable to get BOS descriptor or descriptor too short
[  475.210917][  T988] usb 3-1: New USB device found, idVendor=22d4, idProduct=1503, bcdDevice= 0.40
[  475.212378][  T988] usb 3-1: config 1 interface 0 has no altsetting 0
[  475.215216][  T988] usb 3-1: string descriptor 0 read error: -22
[  475.215346][  T988] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  475.661318][  T988] hid_parser_main: 5 callbacks suppressed
[  475.661346][  T988] glorious 0003:22D4:1503.001B: unknown main item tag 0x0
[  475.661379][  T988] glorious 0003:22D4:1503.001B: unknown main item tag 0x0
[  475.661405][  T988] glorious 0003:22D4:1503.001B: unknown main item tag 0x0
[  475.661432][  T988] glorious 0003:22D4:1503.001B: unknown main item tag 0x0
[  475.661459][  T988] glorious 0003:22D4:1503.001B: unknown main item tag 0x0
[  475.661484][  T988] glorious 0003:22D4:1503.001B: unknown main item tag 0x0
[  475.661511][  T988] glorious 0003:22D4:1503.001B: unknown main item tag 0x0
[  475.661536][  T988] glorious 0003:22D4:1503.001B: unknown main item tag 0x0
[  475.661562][  T988] glorious 0003:22D4:1503.001B: unknown main item tag 0x0
[  475.661588][  T988] glorious 0003:22D4:1503.001B: unknown main item tag 0x0
[  475.705895][  T988] glorious 0003:22D4:1503.001B: hidraw0: USB HID vff.7f Device [Glorious Model I] on usb-dummy_hcd.2-1/input0
[  475.843192][ T5703] usb 3-1: USB disconnect, device number 30
[  476.608958][T14306] nvmet_tcp: enabling port 1 (127.0.0.1:80)
[  476.702778][T14306] nvme_fabrics: missing parameter 'nqn=%s'
[  476.893064][T14316] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+
[  476.946114][   T10] 
[  476.948472][   T10] ======================================================
[  476.955496][   T10] WARNING: possible circular locking dependency detected
[  476.962566][   T10] syzkaller #0 Tainted: G             L     
[  476.968569][   T10] ------------------------------------------------------
[  476.975610][   T10] kworker/0:1/10 is trying to acquire lock:
[  476.981529][   T10] ffff88805c0f2b48 (kn->active#95){++++}-{0:0}, at: __kernfs_remove+0x493/0x8e0
[  476.990632][   T10] 
[  476.990632][   T10] but task is already holding lock:
[  476.997994][   T10] ffffc900000f7c40 ((work_completion)(&mddev->del_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630
[  477.009743][   T10] 
[  477.009743][   T10] which lock already depends on the new lock.
[  477.009743][   T10] 
[  477.020153][   T10] 
[  477.020153][   T10] the existing dependency chain (in reverse order) is:
[  477.029200][   T10] 
[  477.029200][   T10] -> #4 ((work_completion)(&mddev->del_work)){+.+.}-{0:0}:
[  477.038637][   T10]        process_scheduled_works+0xc03/0x1630
[  477.044711][   T10]        worker_thread+0xa47/0xfb0
[  477.049838][   T10]        kthread+0x38b/0x480
[  477.054454][   T10]        ret_from_fork+0x514/0xb70
[  477.059580][   T10]        ret_from_fork_asm+0x1a/0x30
[  477.064879][   T10] 
[  477.064879][   T10] -> #3 ((wq_completion)md_misc){+.+.}-{0:0}:
[  477.073133][   T10]        touch_wq_lockdep_map+0xcb/0x180
[  477.078774][   T10]        __flush_workqueue+0x148/0x1470
[  477.084335][   T10]        md_alloc+0x32/0xf20
[  477.089033][   T10]        md_alloc_and_put+0x1a/0x1f0
[  477.094393][   T10]        blk_request_module+0x27d/0x2a0
[  477.099955][   T10]        blkdev_get_no_open+0x3f/0xe0
[  477.105333][   T10]        blkdev_open+0x1d7/0x600
[  477.110279][   T10]        do_dentry_open+0x80e/0x1360
[  477.115579][   T10]        vfs_open_consume+0x4a/0x350
[  477.120874][   T10]        path_openat+0x14d7/0x1e40
[  477.126003][   T10]        do_file_open+0x23e/0x4a0
[  477.131047][   T10]        do_sys_openat2+0x115/0x200
[  477.136254][   T10]        __x64_sys_openat+0x138/0x170
[  477.141630][   T10]        do_syscall_64+0x166/0x520
[  477.146747][   T10]        entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  477.153177][   T10] 
[  477.153177][   T10] -> #2 (major_names_lock){+.+.}-{4:4}:
[  477.160937][   T10]        __mutex_lock+0x197/0x15a0
[  477.166061][   T10]        blk_request_module+0x35/0x2a0
[  477.171528][   T10]        blkdev_get_no_open+0x3f/0xe0
[  477.176908][   T10]        bdev_file_open_by_dev+0xa0/0x240
[  477.182632][   T10]        md_import_device+0x2e9/0x650
[  477.188022][   T10]        md_add_new_disk+0x3a3/0x1850
[  477.193411][   T10]        md_ioctl+0x2005/0x2610
[  477.198265][   T10]        blkdev_ioctl+0x5e3/0x740
[  477.203298][   T10]        __se_sys_ioctl+0xfc/0x170
[  477.208427][   T10]        do_syscall_64+0x166/0x520
[  477.213541][   T10]        entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  477.219960][   T10] 
[  477.219960][   T10] -> #1 (&mddev->reconfig_mutex){+.+.}-{4:4}:
[  477.228223][   T10]        __mutex_lock+0x197/0x15a0
[  477.233338][   T10]        array_state_store+0x4a5/0xe90
[  477.238804][   T10]        md_attr_store+0x3b7/0x640
[  477.243923][   T10]        kernfs_fop_write_iter+0x3a4/0x540
[  477.249739][   T10]        vfs_write+0x612/0xba0
[  477.254525][   T10]        ksys_write+0x150/0x270
[  477.259383][   T10]        do_syscall_64+0x166/0x520
[  477.264496][   T10]        entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  477.270920][   T10] 
[  477.270920][   T10] -> #0 (kn->active#95){++++}-{0:0}:
[  477.278400][   T10]        __lock_acquire+0x164c/0x2de0
[  477.283783][   T10]        lock_acquire+0x115/0x350
[  477.288817][   T10]        kernfs_drain+0x293/0x640
[  477.293843][   T10]        __kernfs_remove+0x493/0x8e0
[  477.299133][   T10]        kernfs_remove_by_name_ns+0xc0/0x140
[  477.305121][   T10]        sysfs_remove_group+0x101/0x2e0
[  477.310690][   T10]        sysfs_remove_groups+0x54/0xb0
[  477.316170][   T10]        __kobject_del+0x83/0x310
[  477.321201][   T10]        kobject_put+0x23a/0x550
[  477.326158][   T10]        process_scheduled_works+0xc3d/0x1630
[  477.332232][   T10]        worker_thread+0xa47/0xfb0
[  477.337353][   T10]        kthread+0x38b/0x480
[  477.341953][   T10]        ret_from_fork+0x514/0xb70
[  477.347080][   T10]        ret_from_fork_asm+0x1a/0x30
[  477.352381][   T10] 
[  477.352381][   T10] other info that might help us debug this:
[  477.352381][   T10] 
[  477.362645][   T10] Chain exists of:
[  477.362645][   T10]   kn->active#95 --> (wq_completion)md_misc --> (work_completion)(&mddev->del_work)
[  477.362645][   T10] 
[  477.377880][   T10]  Possible unsafe locking scenario:
[  477.377880][   T10] 
[  477.385337][   T10]        CPU0                    CPU1
[  477.390756][   T10]        ----                    ----
[  477.396149][   T10]   lock((work_completion)(&mddev->del_work));
[  477.402316][   T10]                                lock((wq_completion)md_misc);
[  477.409884][   T10]                                lock((work_completion)(&mddev->del_work));
[  477.418572][   T10]   lock(kn->active#95);
[  477.422914][   T10] 
[  477.422914][   T10]  *** DEADLOCK ***
[  477.422914][   T10] 
[  477.431060][   T10] locks held by kworker/0:1/10: 2, last CPU#0:
[  477.437281][   T10]  #0: ffff888023685d40 ((wq_completion)md_misc){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630
[  477.448373][   T10]  #1: ffffc900000f7c40 ((work_completion)(&mddev->del_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630
[  477.460566][   T10] 
[  477.460566][   T10] stack backtrace:
[  477.466469][   T10] CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Tainted: G             L      syzkaller #0 PREEMPT(full) 
[  477.477234][   T10] Tainted: [L]=SOFTLOCKUP
[  477.481560][   T10] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[  477.491619][   T10] Workqueue: md_misc mddev_delayed_delete
[  477.497369][   T10] Call Trace:
[  477.500667][   T10]  <TASK>
[  477.503619][   T10]  dump_stack_lvl+0xe8/0x150
[  477.508229][   T10]  print_circular_bug+0x2e2/0x300
[  477.513265][   T10]  check_noncircular+0x12f/0x150
[  477.518211][   T10]  __lock_acquire+0x164c/0x2de0
[  477.523077][   T10]  ? kasan_record_aux_stack+0xbd/0xd0
[  477.528478][   T10]  ? __lock_acquire+0x747/0x2de0
[  477.533442][   T10]  lock_acquire+0x115/0x350
[  477.537975][   T10]  ? __kernfs_remove+0x493/0x8e0
[  477.542934][   T10]  kernfs_drain+0x293/0x640
[  477.547471][   T10]  ? __kernfs_remove+0x493/0x8e0
[  477.552422][   T10]  ? __pfx_kernfs_drain+0x10/0x10
[  477.557463][   T10]  ? __kernfs_remove+0x318/0x8e0
[  477.562440][   T10]  ? up_write+0x19d/0x4a0
[  477.566778][   T10]  __kernfs_remove+0x493/0x8e0
[  477.571554][   T10]  ? kernfs_find_ns+0x6f8/0x770
[  477.576445][   T10]  kernfs_remove_by_name_ns+0xc0/0x140
[  477.581913][   T10]  sysfs_remove_group+0x101/0x2e0
[  477.586949][   T10]  sysfs_remove_groups+0x54/0xb0
[  477.591898][   T10]  __kobject_del+0x83/0x310
[  477.596410][   T10]  kobject_put+0x23a/0x550
[  477.600839][   T10]  ? process_scheduled_works+0x97a/0x1630
[  477.606583][   T10]  process_scheduled_works+0xc3d/0x1630
[  477.612154][   T10]  ? __pfx_process_scheduled_works+0x10/0x10
[  477.618144][   T10]  ? assign_work+0x3cf/0x5d0
[  477.622740][   T10]  worker_thread+0xa47/0xfb0
[  477.627349][   T10]  kthread+0x38b/0x480
[  477.631432][   T10]  ? __pfx_worker_thread+0x10/0x10
[  477.636553][   T10]  ? __pfx_kthread+0x10/0x10
[  477.641153][   T10]  ret_from_fork+0x514/0xb70
[  477.645754][   T10]  ? __pfx_ret_from_fork+0x10/0x10
[  477.650879][   T10]  ? __switch_to+0xc89/0x1420
[  477.655584][   T10]  ? __pfx_kthread+0x10/0x10
[  477.660203][   T10]  ret_from_fork_asm+0x1a/0x30
[  477.664986][   T10]  </TASK>
[  478.350171][ T4936] Bluetooth: hci1: command 0x2016 tx timeout