last executing test programs: 16m28.006209986s ago: executing program 4 (id=837): socket$tipc(0x1e, 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000700)={0x38, 0x5, 0x43, 0x8001, 0x0, 0xf, 0x0, 0xfffffe0000000001, 0xfa11, 0x1}, 0x0) r2 = syz_mount_image$fuse(0x0, &(0x7f0000000240)='./file0\x00', 0x100809, &(0x7f0000000600)={{}, 0x2c, {'rootmode', 0x3d, 0x1000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, 0xffffffffffffffff}, 0x2c, {[{@max_read={'max_read', 0x3d, 0x4}}, {@allow_other}, {@default_permissions}], [{@subj_type}, {@fsuuid={'fsuuid', 0x3d, {[0x63, 0x37, 0x35, 0x37, 0x32, 0x35, 0x66, 0x34], 0x2d, [0x37, 0x62, 0x38, 0x37], 0x2d, [0x31, 0x63, 0x64, 0xf6d70af54b35891c], 0x2d, [0x64, 0x62, 0x39, 0x38], 0x2d, [0x36, 0x31, 0x37, 0x39, 0x0, 0x62, 0x30, 0x31]}}}, {@obj_type={'obj_type', 0x3d, '/dev/audio#\x00'}}]}}, 0x1, 0x0, &(0x7f0000000300)="11eb7621eb5dc4b38a4b818d1aab099259038740c7eda50af7c05c61fa8a838a") mkdirat(r2, 0x0, 0x29) openat$fuse(0xffffffffffffff9c, &(0x7f0000000180), 0x42, 0x0) getsockopt$inet_sctp6_SCTP_AUTO_ASCONF(0xffffffffffffffff, 0x84, 0x1e, &(0x7f0000000480), &(0x7f00000004c0)=0x4) r3 = syz_open_dev$vbi(&(0x7f0000000080), 0x3, 0x2) r4 = socket$xdp(0x2c, 0x3, 0x0) getsockopt$XDP_STATISTICS(r4, 0x11b, 0x7, 0x0, &(0x7f0000000040)=0x18) ioctl$VIDIOC_S_OUTPUT(r3, 0xc004562f, &(0x7f0000000000)=0x1) ioctl$VIDIOC_S_DV_TIMINGS(r3, 0xc0845657, &(0x7f0000000380)={0x0, @bt={0x2d0, 0x191, 0x1, 0x0, 0xdd9f83, 0x1, 0x670, 0xf3, 0x2, 0x8, 0x722, 0x6, 0x7, 0x7f, 0x27, 0x2e, {0x0, 0x6fd8e84b}, 0x3, 0xed}}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)) memfd_create(0x0, 0x1) r5 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000180)=ANY=[@ANYBLOB="120100000cb768405e0483020b990102030109021b0001000000000904000001012900000905"], 0x0) socket$nl_route(0x10, 0x3, 0x0) syz_usb_control_io$hid(r5, 0x0, 0x0) syz_open_dev$audion(&(0x7f00000011c0), 0x3, 0x8c4201) pipe2$watch_queue(&(0x7f0000000240), 0x80) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r6, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x670, 0xd0, 0xd0, 0x428, 0xd0, 0xd0, 0x5a0, 0x5a0, 0x5a0, 0x5a0, 0x5a0, 0x6, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE2={0x28, 'NFQUEUE\x00', 0x2, {0x0, 0x5}}}, {{@ipv6={@mcast1, @local, [], [], 'macvtap0\x00', 'ip6tnl0\x00', {}, {}, 0x11, 0x0, 0x0, 0x73}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x0, @ipv4=@broadcast}}}, {{@ipv6={@mcast2, @loopback, [], [], 'veth0_to_team\x00', 'syzkaller0\x00'}, 0x0, 0x100, 0x128, 0x0, {}, [@common=@unspec=@connmark={{0x30}}, @common=@inet=@socket1={{0x28, 'socket\x00', 0x2}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffc}}, {{@uncond, 0x0, 0x120, 0x148, 0x0, {}, [@common=@frag={{0x30}}, @common=@hbh={{0x48}}]}, @inet=@DSCP={0x28}}, {{@uncond, 0x0, 0x138, 0x178, 0x0, {}, [@common=@dst={{0x48}}, @common=@dst={{0x48}}]}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x0, @ipv4=@dev}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x6d0) r7 = openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x80800, 0x0) fcntl$notify(r7, 0x402, 0x20) r8 = syz_open_procfs(0x0, 0x0) ioctl$BTRFS_IOC_QUOTA_RESCAN_STATUS(r8, 0x8040942d, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f00000011c0), 0x3, 0x8c4201) 16m23.842550032s ago: executing program 4 (id=845): socket$pppl2tp(0x18, 0x1, 0x1) socket$nl_generic(0x10, 0x3, 0x10) socket$netlink(0x10, 0x3, 0xf) socket$inet_tcp(0x2, 0x1, 0x0) pipe2(&(0x7f0000000000), 0x80000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) syz_io_uring_setup(0x10b, &(0x7f00000003c0)={0x0, 0x854b, 0x80, 0x2, 0x805}, 0x0, 0x0) pipe(&(0x7f0000000080)) pipe2(&(0x7f0000000300), 0x80) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000007000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000004000/0x2000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24004045) io_uring_enter(0xffffffffffffffff, 0x8af, 0xc0b8, 0x0, &(0x7f0000000100)={[0x6]}, 0x8) r0 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0x970, 0x1f480, 0x0, 0x399}) sendmsg$DEVLINK_CMD_PORT_UNSPLIT(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="150000003162e5005e12b85ea211e55d554bececa759977e9f89a5214b3cfabab6edeff92ce1d3c5e71a8ecef6b0ae4ecaec35c8682766097458dd6c28ffff3c07954d17662111a8939d3a0dcc395f09", @ANYRES16=0x0, @ANYBLOB='1\a\x00\x00\x00\x00\x00\x00\x00\x00.\x00\x00\x00', @ANYRESHEX=0x0], 0x14}, 0x1, 0x2}, 0x0) io_uring_enter(r0, 0x8ae, 0x6933, 0x17, 0x0, 0xeffd) 16m23.640792572s ago: executing program 4 (id=848): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) r1 = fsopen(&(0x7f0000000140)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) fsmount(r1, 0x0, 0xf) ioctl$INCFS_IOC_GET_FILLED_BLOCKS(0xffffffffffffffff, 0x80286722, &(0x7f0000000000)={&(0x7f0000000180)=""/96, 0x60, 0x7, 0x6}) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, &(0x7f0000000040)) syz_emit_ethernet(0x4a, &(0x7f0000000240)=ANY=[@ANYBLOB="aaaa"], 0x0) syz_usb_ep_write$ath9k_ep1(0xffffffffffffffff, 0x82, 0xa8, &(0x7f0000000040)=ANY=[@ANYBLOB="6b0ee0b3d4"]) syz_emit_ethernet(0x4a, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaabb86dd69010000001406fffe800000000000000000000039fe8000000000000000000000000000aa4e224e24000000", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="51c2"], 0x0) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000007880)=[{{0x0, 0x0, &(0x7f0000000740)=[{&(0x7f0000000040)="af0ac9", 0x3}], 0x1}}], 0x1, 0x4000000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x18, 0xf, &(0x7f0000000200)=ANY=[@ANYRESDEC, @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7020000000000008500000051000000bf0900000000000055"], 0x0, 0x7, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) r2 = syz_open_dev$loop(&(0x7f0000000100), 0x2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.idle_time\x00', 0x275a, 0x0) write$binfmt_misc(r3, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r2, 0x4c0a, &(0x7f00000002c0)={r3, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x8000000, 0x0, 0x9, 0xb, 0x1c, "fee8a2ab78fc979fd1e00db6072000001ea89de2b4410000e60080b8785d960000100000000000000000000000000000000000527000", "2809e8dbe108598948224ad44afac11d875397bdb22d0000b420a1a93c5240f45f819ef6167d3d458dd4992861ac00", "f4bd000000000000005d2df604e0b1b4f4d833000000000000011100", [0x0, 0x2000000000001]}}) fsconfig$FSCONFIG_SET_FLAG(r1, 0x0, &(0x7f0000000040)='rw\x00', 0x0, 0x0) r4 = eventfd2(0x0, 0x80001) write$eventfd(r4, 0x0, 0x0) mprotect(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) clock_adjtime(0xa, 0x0) 16m22.934462488s ago: executing program 4 (id=851): r0 = gettid() r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f00000000c0)={0x2, 0x2, 0x0, 0x2000, &(0x7f0000f8b000/0x2000)=nil}) r3 = syz_open_dev$vim2m(&(0x7f0000000040), 0x8001006, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r3, 0xc0405602, &(0x7f0000000080)={0x11, 0x2, 0x1, "b427ec0600", 0x32315559}) ioctl$KVM_SET_USER_MEMORY_REGION2(r2, 0x40a0ae49, &(0x7f0000000280)={0x5, 0x0, 0x7000, 0x2000, &(0x7f0000d6c000/0x2000)=nil, 0x7}) syz_kvm_setup_syzos_vm$x86(r2, &(0x7f0000c00000/0x400000)=nil) munmap(&(0x7f0000ec1000/0x3000)=nil, 0x3000) timer_create(0x0, &(0x7f0000000080)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)=0x0) r5 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000002040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r5, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0], 0x0, 0x0, 0x0) r6 = open_tree(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x89901) move_mount(r6, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r7 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet6_int(r7, 0x29, 0x1a, &(0x7f0000000280)=0x80000001, 0x4) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r7, 0x84, 0x6f, &(0x7f00000002c0)={0x0, 0x1c, &(0x7f0000000200)=[@in6={0xa, 0x4e21, 0x2, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x41}}, 0x100}]}, &(0x7f0000000300)=0x10) chroot(&(0x7f0000000300)='./file0/../file0/../file0/../file0\x00') r8 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r8, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) pivot_root(&(0x7f00000000c0)='./file0/../file0/../file0/../file0\x00', &(0x7f0000000080)='./file0/../file0/../file0/../file0/file0\x00') timer_settime(r4, 0x1, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) r9 = socket$inet_sctp(0x2, 0x5, 0x84) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x3d, &(0x7f0000000040)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0x7ffffdbd}]}) process_mrelease(0xffffffffffffffff, 0x0) close(r9) r10 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r10, 0x84, 0x6f, &(0x7f0000000040)={0x0, 0x10, &(0x7f0000000000)=[@in={0x2, 0x0, @private=0xa010101}]}, &(0x7f0000000080)=0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r10, 0x84, 0x1d, &(0x7f0000000140)={0x1, [0x0]}, &(0x7f0000000240)=0x8) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000fd3f000000000000090000009500000000"], &(0x7f0000000080)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x32, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) 16m22.038041949s ago: executing program 4 (id=854): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) arch_prctl$ARCH_SHSTK_UNLOCK(0x5004, 0x3) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0xe2a0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./file0\x00', 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000080), 0x800, &(0x7f00000003c0)=ANY=[]) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') read$FUSE(r1, &(0x7f00000066c0)={0x2020}, 0x2020) r2 = socket$nl_route(0x10, 0x3, 0x0) syz_usb_connect(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000014da2108ab1204000000000000010902240001b30000040904410c17ff5d810009050f1f05e13f00000905"], 0x0) sendmsg$nl_route(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={0x0}, 0x1, 0x0, 0x0, 0x4000054}, 0x44800) r3 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000680)={'bridge0\x00'}) socket(0x400000000010, 0x3, 0x0) modify_ldt$write(0x1, &(0x7f0000000100)={0xe, 0xc363ac0399f6d33e, 0x400, 0x1, 0x2, 0x1, 0x1}, 0x10) modify_ldt$read(0x0, &(0x7f0000000000)=""/250, 0xfa) r4 = syz_open_procfs(0x0, 0x0) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000080)={0xffffffffffffffff}, 0x13f, 0x6}}, 0x20) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000880)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16, @ANYRES16=r1, @ANYRES32=r7], 0x30}}, 0x0) sendmsg$NL80211_CMD_ABORT_SCAN(r4, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)=ANY=[@ANYBLOB="20df0000", @ANYRES16=0x0, @ANYBLOB="0c0029bd7000feb41914417ab45531dfab02", @ANYRES32=r7, @ANYBLOB="0c0099007f00"], 0x28}, 0x1, 0x0, 0x0, 0x810}, 0x800) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r5, &(0x7f0000000680)={0x15, 0x110, 0xfa08, {r6, 0x0, 0x10, 0x10, 0x0, @in={0x2, 0x4e23, @empty}, @in={0x2, 0x8, @dev={0xac, 0x14, 0x14, 0xde}}}}, 0x118) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000500), 0x40, 0x0) 16m21.682976935s ago: executing program 4 (id=858): socket$pppl2tp(0x18, 0x1, 0x1) socket$nl_generic(0x10, 0x3, 0x10) socket$netlink(0x10, 0x3, 0xf) socket$inet_tcp(0x2, 0x1, 0x0) pipe2(&(0x7f0000000000), 0x80000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) syz_io_uring_setup(0x10b, &(0x7f00000003c0)={0x0, 0x854b, 0x80, 0x2, 0x805}, 0x0, 0x0) pipe(&(0x7f0000000080)) pipe2(&(0x7f0000000300), 0x80) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000007000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000004000/0x2000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24004045) io_uring_enter(0xffffffffffffffff, 0x8af, 0xc0b8, 0x0, &(0x7f0000000100)={[0x6]}, 0x8) r0 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0x970, 0x1f480, 0x0, 0x399}) sendmsg$DEVLINK_CMD_PORT_UNSPLIT(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="150000003162e5005e12b85ea211e55d554bececa759977e9f89a5214b3cfabab6edeff92ce1d3c5e71a8ecef6b0ae4ecaec35c8682766097458dd6c28ffff3c07954d17662111a8939d3a0dcc395f09", @ANYRES16=0x0, @ANYBLOB='1\a\x00\x00\x00\x00\x00\x00\x00\x00.\x00\x00\x00', @ANYRESHEX=0x0], 0x14}, 0x1, 0x2}, 0x0) io_uring_enter(r0, 0x8ae, 0x6933, 0x17, 0x0, 0xeffd) 16m21.265056773s ago: executing program 32 (id=858): socket$pppl2tp(0x18, 0x1, 0x1) socket$nl_generic(0x10, 0x3, 0x10) socket$netlink(0x10, 0x3, 0xf) socket$inet_tcp(0x2, 0x1, 0x0) pipe2(&(0x7f0000000000), 0x80000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) syz_io_uring_setup(0x10b, &(0x7f00000003c0)={0x0, 0x854b, 0x80, 0x2, 0x805}, 0x0, 0x0) pipe(&(0x7f0000000080)) pipe2(&(0x7f0000000300), 0x80) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000007000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000004000/0x2000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24004045) io_uring_enter(0xffffffffffffffff, 0x8af, 0xc0b8, 0x0, &(0x7f0000000100)={[0x6]}, 0x8) r0 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0x970, 0x1f480, 0x0, 0x399}) sendmsg$DEVLINK_CMD_PORT_UNSPLIT(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="150000003162e5005e12b85ea211e55d554bececa759977e9f89a5214b3cfabab6edeff92ce1d3c5e71a8ecef6b0ae4ecaec35c8682766097458dd6c28ffff3c07954d17662111a8939d3a0dcc395f09", @ANYRES16=0x0, @ANYBLOB='1\a\x00\x00\x00\x00\x00\x00\x00\x00.\x00\x00\x00', @ANYRESHEX=0x0], 0x14}, 0x1, 0x2}, 0x0) io_uring_enter(r0, 0x8ae, 0x6933, 0x17, 0x0, 0xeffd) 14m36.882030696s ago: executing program 5 (id=1230): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x8001, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYRES32=r0], 0x50) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000140)={0x2, 0x0, [{0x10, 0x0, 0xffffffffffffffff}, {0x10, 0x0, 0x3fb}]}) syz_usb_connect(0x3, 0x24, &(0x7f0000000140)={{0x12, 0x1, 0x201, 0xd, 0x50, 0xe8, 0x40, 0x584, 0x8, 0x102, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0xd0, 0x4, 0xd0, 0xe, "", [{{0x9, 0x4, 0x77, 0xe0, 0x0, 0xff, 0x2, 0x6, 0x3}}]}}]}}, &(0x7f00000000c0)={0x0, 0x0, 0x5, 0x0}) 14m35.142644493s ago: executing program 5 (id=1237): r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000002280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0], 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f0000002300)={0x2020}, 0x2020) r1 = socket$inet_smc(0x2b, 0x1, 0x0) socket$nl_generic(0x10, 0x3, 0x10) getsockopt$ARPT_SO_GET_INFO(r1, 0x0, 0x60, &(0x7f0000000000)={'filter\x00', 0x0, [0x7fff, 0x3, 0x73d]}, &(0x7f0000000080)=0x44) socket$inet_sctp(0x2, 0x5, 0x84) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r2, 0x0) close(0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000001280)=0x10) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) close_range(r3, 0xffffffffffffffff, 0x0) r4 = creat(&(0x7f0000000400)='./bus\x00', 0x0) r5 = socket$kcm(0x2d, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r5, 0x89e2, &(0x7f0000000340)={r5}) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000080)="d84a56bd0d001c00180081064e32e82331734c368cc79100", 0x18}], 0x1}, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r6, 0x89e3, &(0x7f0000000180)={r5, r4}) 14m34.545963654s ago: executing program 5 (id=1238): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) arch_prctl$ARCH_SHSTK_UNLOCK(0x5004, 0x3) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0xe2a0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./file0\x00', 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000080), 0x800, &(0x7f00000003c0)=ANY=[]) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') read$FUSE(r2, &(0x7f00000066c0)={0x2020}, 0x2020) r3 = socket$nl_route(0x10, 0x3, 0x0) syz_usb_connect(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000014da2108ab1204000000000000010902240001b30000040904410c17ff5d810009050f1f05e13f0000090583"], 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={0x0}, 0x1, 0x0, 0x0, 0x4000054}, 0x44800) r4 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000680)={'bridge0\x00'}) socket(0x400000000010, 0x3, 0x0) modify_ldt$write(0x1, &(0x7f0000000100)={0xe, 0xc363ac0399f6d33e, 0x400, 0x1, 0x2, 0x1, 0x1}, 0x10) modify_ldt$read(0x0, &(0x7f0000000000)=""/250, 0xfa) r5 = syz_open_procfs(0x0, &(0x7f0000000000)='smaps\x00') r6 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) r7 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000002440), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r7, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x3, 0x0, 0x13f, 0x6}}, 0x20) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000880)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r2, @ANYRES32=r8, @ANYBLOB="0a0018000303030303"], 0x30}}, 0x0) sendmsg$NL80211_CMD_ABORT_SCAN(r5, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)=ANY=[@ANYBLOB="20df0000", @ANYRES16=0x0, @ANYBLOB="0c0029bd7000feb41914417ab45531dfab02", @ANYRES32=r8, @ANYBLOB="0c0099007f00000073000000"], 0x28}, 0x1, 0x0, 0x0, 0x810}, 0x800) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r6, &(0x7f0000000680)={0x15, 0x110, 0xfa08, {0xffffffffffffffff, 0x0, 0x10, 0x10, 0x0, @in={0x2, 0x4e23, @empty}, @in={0x2, 0x8, @dev={0xac, 0x14, 0x14, 0xde}}}}, 0x118) 14m30.010056976s ago: executing program 5 (id=1251): pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) syz_mount_image$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x9801) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r1, 0xc1105517, &(0x7f00000017c0)={{0x3, 0x3, 0x4, 0x86, 'syz1\x00', 0x76}, 0x2, 0x400, 0xffffb90e, 0xffffffffffffffff, 0x5, 0xfffffffc, 'syz0\x00', &(0x7f0000000300)=['nl80211\x00', '\x00', 'nl80211\x00', '(\x00', ',])\'.].@-*\x00'], 0x1e}) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x10024, &(0x7f00000004c0)=ANY=[@ANYBLOB='=', @ANYBLOB=',rootmode=0']) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) r3 = syz_clone(0x20800000, 0x0, 0x0, 0x0, 0x0, 0x0) r4 = socket$inet6(0xa, 0x3, 0x9) bind$inet6(r4, &(0x7f00000000c0)={0xa, 0x0, 0x0, @local, 0x20000040}, 0x1c) setsockopt$inet6_MCAST_JOIN_GROUP(r4, 0x29, 0x6, &(0x7f0000000000)={0x7f, {{0x29, 0x0, 0x2000000, @mcast2, 0x5}}}, 0x88) getresuid(&(0x7f0000000100), 0x0, 0x0) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x0) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r6 = openat$cgroup_procs(r5, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r6, &(0x7f00000005c0)=r3, 0x12) r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r8 = openat$cgroup_ro(r7, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000680)={0x0, ""/256, 0x0, 0x0, 0x0, 0x0, ""/16, ""/16, ""/16, 0x0, 0x0, 0x0, 0x0}) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), r2) sendmsg$NL80211_CMD_SET_TID_CONFIG(r0, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000880)={0xf2c, r10, 0x100, 0x70bd2c, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x0, 0x7f}}}}, [@NL80211_ATTR_TID_CONFIG={0x35c, 0x11d, 0x0, 0x1, [{0x18, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_NOACK={0x5, 0x6, 0x1}, @NL80211_TID_CONFIG_ATTR_PEER_SUPP={0xc, 0x3, 0xffffffffffffffff}]}, {0x40, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0x9f}, @NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5, 0xa, 0x1}, @NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc, 0x2, 0x9}, @NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0x45}, @NL80211_TID_CONFIG_ATTR_RETRY_SHORT={0x5, 0x7, 0xb3}]}, {0x28c, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_TX_RATE={0x260, 0xd, 0x0, 0x1, [@NL80211_BAND_6GHZ={0x44, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x6, 0x8001, 0x10, 0x85ac, 0x8, 0xfff7, 0x800, 0xffff]}}, @NL80211_TXRATE_HT={0x23, 0x2, [{0x7, 0x8}, {0x3, 0x6}, {0x5, 0x6}, {0x3, 0x6}, {0x4}, {}, {0x1, 0xa}, {0x6}, {0x2}, {0x2, 0x9}, {0x1, 0x1}, {0x7, 0x4}, {0x7, 0x7}, {0x0, 0xc}, {0x7, 0x8}, {0x7, 0xa}, {0x5, 0x6}, {0x4, 0x3}, {0x1, 0x4}, {0x3, 0x2}, {0x4, 0x2}, {0x0, 0x4}, {0x1, 0x3}, {0x5, 0x8}, {0x5, 0x3}, {0x5}, {0x0, 0x6}, {0x6, 0x8}, {0x6, 0x7}, {0x1, 0xa}, {0x4, 0x5}]}, @NL80211_TXRATE_GI={0x5}]}, @NL80211_BAND_60GHZ={0x14, 0x2, 0x0, 0x1, [@NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}]}, @NL80211_BAND_60GHZ={0x80, 0x2, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x20, 0x1, [0x60, 0x24, 0x48, 0x6c, 0x3, 0x9, 0x16, 0x16, 0x3, 0x3, 0x24, 0x60, 0x1b, 0x24, 0x16, 0x6, 0xb, 0x1b, 0x60, 0x1b, 0x24, 0x18, 0x12, 0x16, 0x1b, 0x12, 0x30, 0x60]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x0, 0x322, 0x8, 0x3, 0x2, 0x8, 0x2, 0x8]}}, @NL80211_TXRATE_HT={0x45, 0x2, [{0x2, 0x4}, {0x1, 0x3}, {0x4, 0x7}, {0x5, 0xa}, {0x7, 0x1}, {0x0, 0x9}, {0x3, 0x7}, {0x2, 0x3}, {0x6, 0xa}, {0x1, 0x8}, {0x1, 0x5}, {0x0, 0x1}, {0x3, 0xa}, {0x1, 0x5}, {0x7}, {0x5, 0x1}, {0x6, 0x2}, {0x4, 0x3}, {0x5, 0x1}, {0x5, 0x1}, {0x4, 0x3}, {0x1, 0x7}, {0x6, 0x5}, {0x4}, {0x2, 0x7}, {0x4}, {0x4, 0x3}, {0x7, 0x4}, {0x0, 0x3}, {0x4, 0x2}, {0x5, 0x5}, {0x4, 0x2}, {0x2, 0x6}, {0x2, 0x5}, {0x5}, {}, {0x0, 0x3}, {0x0, 0xa}, {0x6, 0x9}, {0x1, 0x6}, {0x6, 0x4}, {0x1, 0x6}, {}, {0x6}, {0x6, 0x1}, {0x1, 0x1}, {0x4, 0xa}, {0x3, 0x4}, {0x1, 0x9}, {0x4, 0xc}, {0x7, 0x3}, {0x7, 0x3}, {0x3}, {0x2, 0x8}, {0x3, 0x2}, {0x4, 0xa}, {0x0, 0x6}, {0x0, 0x5}, {0x2, 0x9}, {0x0, 0x5}, {0x6, 0x4}, {0x6}, {0x1, 0x8}, {0x4, 0x2}, {0x2, 0x8}]}]}, @NL80211_BAND_2GHZ={0xc, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}]}, @NL80211_BAND_2GHZ={0xcc, 0x0, 0x0, 0x1, [@NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}, @NL80211_TXRATE_HT={0x42, 0x2, [{0x7, 0x4}, {0x7, 0xa}, {0x7, 0x2}, {0x1, 0xa}, {0x2, 0x8}, {0x2, 0x3}, {0x3, 0x2}, {0x4, 0x5}, {0x5, 0x1}, {0x5, 0x5}, {0x1, 0x2}, {0x3, 0x7}, {0x4, 0x5}, {0x0, 0x4}, {0x7, 0x6}, {0x1, 0x7}, {0x7, 0x3}, {0x1, 0x4}, {0x0, 0xa}, {0x5, 0x3}, {0x2, 0x8}, {0x2, 0x4}, {0x3, 0x3}, {0x0, 0xa}, {0x5, 0x7}, {0x0, 0x8}, {0x7}, {0x4, 0x3}, {0x2, 0xa}, {0x7, 0xa}, {0x7, 0x5}, {0x4, 0x4}, {0x0, 0x8}, {0x2, 0x1}, {0x6, 0x2}, {0x1, 0x9}, {0x4, 0x3}, {0x4, 0xa}, {0x7, 0x8}, {0x4, 0x3}, {0x1, 0x8}, {0x0, 0x3}, {0x7, 0x1}, {0x1, 0xa}, {0x3, 0x8}, {0x1, 0x4}, {0x1, 0x4}, {0x0, 0xa}, {0x3, 0x6}, {0x6, 0x5}, {0x6, 0x9}, {0x0, 0x2}, {0x4, 0x7}, {}, {0x0, 0x7}, {0x4, 0x5}, {0x1}, {0x4, 0x5}, {0x1, 0x5}, {0x2, 0x6}, {}, {0x5, 0xa}]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x1, 0x7, 0x0, 0x3, 0x5, 0x1, 0xfff9, 0x8001]}}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x2, 0xd, 0x9, 0x9, 0x1, 0x1, 0x7, 0xc]}}, @NL80211_TXRATE_HT={0x39, 0x2, [{0x1, 0x4}, {0x7}, {0x1, 0xa}, {0x3, 0x2}, {0x7, 0x9}, {0x0, 0xa}, {0x0, 0x5}, {0x1, 0x9}, {0x0, 0x7}, {0x0, 0x6}, {0x0, 0x8}, {0x3, 0xa}, {0x4, 0x9}, {0x5, 0x3}, {0x3, 0x9}, {0x7, 0x6}, {0x1, 0x6}, {0x0, 0x9}, {0x3, 0x8}, {0x1, 0x4}, {0x4, 0x6}, {0x0, 0x8}, {0x0, 0x3}, {0x7, 0x9}, {0x6, 0x6}, {0x7, 0x4}, {0x6, 0x3}, {0x1, 0x7}, {0x5, 0x1}, {0x2, 0x5}, {0x2, 0xa}, {0x0, 0xa}, {0x3, 0x8}, {0x2, 0x2}, {0x6, 0xa}, {0x1, 0x9}, {0x4, 0x1}, {0x1, 0xa}, {0x3, 0x7}, {0x3, 0x4}, {0x7, 0x2}, {0x1, 0x4}, {0x2, 0x5}, {0x0, 0x7}, {0x7, 0x8}, {0x6, 0x6}, {0x3, 0x8}, {0x5, 0x7}, {0x1, 0xa}, {0x0, 0x4}, {0x1, 0x6}, {0x7, 0x3}, {0x7, 0x5}]}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}]}, @NL80211_BAND_5GHZ={0x20, 0x1, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x0, 0x2, 0x6, 0x7ff, 0x5, 0xc19, 0x3, 0x800]}}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}]}, @NL80211_BAND_6GHZ={0x34, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x400, 0x14eb, 0x0, 0x2, 0x8, 0x8a81, 0x0, 0x1]}}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x1, 0x2, 0x14e1, 0x3, 0xbf51, 0xb7b, 0x2, 0x6]}}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}]}, @NL80211_BAND_60GHZ={0x58, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0xf, 0xe6b9, 0x6, 0xf, 0x8001, 0x3600, 0x5, 0x3]}}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_LEGACY={0x7, 0x1, [0x18, 0x5, 0x6c]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x3c4d, 0x4, 0x2, 0x0, 0x5, 0x9, 0x1000, 0x7]}}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x8, 0x9, 0x9, 0x5, 0x8, 0x2, 0x5, 0xcc7]}}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}]}]}, @NL80211_TID_CONFIG_ATTR_RETRY_LONG={0x5, 0x8, 0x9e}, @NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5, 0xc, 0x1}, @NL80211_TID_CONFIG_ATTR_RETRY_SHORT={0x5, 0x7, 0x41}, @NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5, 0xc, 0x2}]}, {0x28, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_NOACK={0x5}, @NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0x6f}, @NL80211_TID_CONFIG_ATTR_PEER_SUPP={0xc, 0x3, 0x1}, @NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0xa3}]}, {0x1c, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0xca}, @NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0x15}, @NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5}]}, {0x30, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_RETRY_LONG={0x5, 0x8, 0x3f}, @NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc, 0x2, 0x9}, @NL80211_TID_CONFIG_ATTR_RETRY_LONG={0x5, 0x8, 0x31}, @NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5, 0xb, 0x1}, @NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5, 0xc, 0x1}]}]}, @NL80211_ATTR_TID_CONFIG={0x240, 0x11d, 0x0, 0x1, [{0xc, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5}]}, {0x230, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5, 0xc, 0x2}, @NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0x8b}, @NL80211_TID_CONFIG_ATTR_TX_RATE={0x20c, 0xd, 0x0, 0x1, [@NL80211_BAND_2GHZ={0x54, 0x0, 0x0, 0x1, [@NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_LEGACY={0x1e, 0x1, [0x16, 0x18, 0x1b, 0xc, 0x3, 0x24, 0x16, 0x3, 0x6, 0x1, 0x12, 0x6c, 0x60, 0xc, 0x30, 0x1, 0x1, 0x48, 0x6c, 0x24, 0x9, 0x48, 0x24, 0x75, 0xc, 0x3]}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_HT={0x10, 0x2, [{0x3, 0x4}, {0x7, 0x8}, {0x6, 0x5}, {0x6, 0x2}, {0x0, 0x4}, {0x3, 0x5}, {0x7, 0xa}, {0x7, 0x5}, {0x6, 0x5}, {0x6, 0x1}, {0x3, 0x9}, {0x7, 0x2}]}]}, @NL80211_BAND_5GHZ={0x7c, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x0, 0x9, 0x40, 0x9, 0x9, 0xffff, 0x8, 0x8d]}}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x2df4, 0xbd, 0x9, 0xe, 0xfa, 0x176, 0x8001, 0xc]}}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x0, 0x0, 0x10, 0x1a0e, 0x9, 0x86a, 0x9, 0x9]}}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x8, 0x371, 0x5, 0x4, 0x9, 0x3, 0x401, 0x2]}}, @NL80211_TXRATE_LEGACY={0xf, 0x1, [0x24, 0x24, 0x30, 0xb, 0xb, 0x48, 0xb, 0x18, 0x48, 0x6c, 0xb]}, @NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}]}, @NL80211_BAND_2GHZ={0x2c, 0x0, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x4, 0x0, 0x8000, 0x8d2, 0x1, 0x1, 0x401, 0x200]}}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x4, 0x5, 0x9, 0x81, 0x2, 0x7fff, 0xb, 0x9]}}]}, @NL80211_BAND_60GHZ={0xbc, 0x2, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0xb, 0x1, [0x3, 0xc, 0x24, 0xb, 0xc, 0x6c, 0x24]}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x4, 0x821, 0x1, 0x3, 0x8, 0x0, 0x3ff, 0x9]}}, @NL80211_TXRATE_LEGACY={0x1a, 0x1, [0x24, 0x6c, 0x48, 0x2, 0x4, 0x1b, 0x18, 0x18, 0x16, 0x36, 0x1b, 0x36, 0x36, 0x6c, 0x384cd3f138cbbe7c, 0x6e, 0x3, 0x30, 0x3, 0x18, 0x5, 0x4]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x31, 0x2, 0xd4, 0x8, 0x8, 0x0, 0xfff7, 0x2]}}, @NL80211_TXRATE_LEGACY={0x4}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x6, 0x0, 0x2, 0x9, 0x8000, 0xfffb, 0x8, 0x97]}}, @NL80211_TXRATE_HT={0x3e, 0x2, [{0x4, 0x4}, {0x1, 0x8}, {0x3, 0x4}, {0x0, 0x5}, {0x1, 0x1}, {0x0, 0xa}, {0x7, 0x9}, {0x4}, {0x1, 0x1}, {0x3, 0x1}, {0x6, 0x6}, {0x3, 0x5}, {0x3, 0x4}, {0x6, 0xa}, {0x1, 0x2}, {0x3}, {0x3, 0x4}, {0x2}, {0x7, 0x7}, {0x2, 0x1}, {0x1, 0xa}, {0x0, 0x6}, {0x1, 0x9}, {0x7, 0x3}, {0x6, 0x6}, {0x0, 0x2}, {0x4, 0xa}, {0x3, 0xa}, {0x6, 0x7}, {0x7}, {0x0, 0x3}, {0x0, 0xa}, {0x3}, {0x1, 0x5}, {0x1, 0x2}, {0x2, 0x5}, {0x4, 0xa}, {0x1, 0x4}, {0x0, 0x7}, {0x1}, {0x7, 0x2}, {}, {0x0, 0x1}, {}, {0x1, 0x7}, {0x0, 0x7}, {0x2, 0x4}, {}, {0x0, 0x9}, {0x2, 0x6}, {0x0, 0x7}, {0x5, 0x7}, {0x0, 0x4}, {0x3, 0x9}, {0x1}, {0x5}, {0x0, 0x5}, {0x2, 0x1}]}]}, @NL80211_BAND_2GHZ={0x50, 0x0, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x1f, 0x1, [0x16, 0x5, 0x1, 0x36, 0x0, 0x6, 0x30, 0x30, 0xc, 0x1, 0x30, 0x18, 0x6, 0x36, 0x0, 0x1b, 0x16, 0xb, 0xc, 0xc, 0x3, 0x1b, 0x12, 0x9, 0x6c, 0x6f, 0x1]}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_LEGACY={0x10, 0x1, [0x48, 0x12, 0x16, 0x5, 0x12, 0x48, 0x81401b4182ed2a1c, 0x0, 0x16, 0x4, 0xc, 0x48]}, @NL80211_TXRATE_LEGACY={0x14, 0x1, [0x24, 0x24, 0x7c, 0x3, 0x1b, 0x48, 0x1b, 0x3f, 0x16, 0x18, 0xb, 0xb, 0x12, 0x24, 0x0, 0xc]}]}]}, @NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0x90}, @NL80211_TID_CONFIG_ATTR_NOACK={0x5, 0x6, 0x1}]}]}, @NL80211_ATTR_TID_CONFIG={0x49c, 0x11d, 0x0, 0x1, [{0xc, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_RETRY_LONG={0x5, 0x8, 0x3e}]}, {0x344, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0x76}, @NL80211_TID_CONFIG_ATTR_TX_RATE={0x78, 0xd, 0x0, 0x1, [@NL80211_BAND_2GHZ={0x74, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}, @NL80211_TXRATE_LEGACY={0x4}, @NL80211_TXRATE_HT={0x30, 0x2, [{0x3, 0x1}, {0x0, 0x9}, {0x2, 0x2}, {0x1, 0x3}, {0x7, 0x9}, {0x2, 0xa}, {0x3, 0x2}, {0x0, 0x4}, {0x3, 0x3}, {0x4, 0x2}, {0x0, 0x9}, {0x0, 0x7}, {0x7, 0x6}, {0x3, 0x7}, {0x6, 0x2}, {0x6, 0xa}, {0x2, 0x9}, {0x4, 0x4}, {0x3, 0x2}, {0x2, 0x2}, {0x3, 0xa}, {0x2, 0x9}, {0x4, 0x6}, {0x6, 0x1a}, {0x2, 0x6}, {0x5, 0x9}, {0x0, 0xa}, {0x1, 0x5}, {0x6, 0x2}, {0x6, 0x4}, {0x0, 0x7}, {0x1, 0x1}, {0x3, 0x4}, {0x3, 0x2}, {}, {0x0, 0x9}, {0x0, 0x9}, {0x1, 0x2}, {0x2, 0x3}, {}, {0x4, 0xa}, {0x3, 0x6}, {0x5, 0x9}, {0x1, 0x7}]}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x10, 0x1, 0x7f, 0x8, 0x2, 0x8, 0x9, 0x5]}}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}]}]}, @NL80211_TID_CONFIG_ATTR_RETRY_LONG={0x5, 0x8, 0x2}, @NL80211_TID_CONFIG_ATTR_TX_RATE={0x2b8, 0xd, 0x0, 0x1, [@NL80211_BAND_60GHZ={0x34, 0x2, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x1e, 0x1, [0x30, 0x48, 0x0, 0x1, 0x24, 0x36f05edd4c1c780, 0x4, 0x3, 0x48, 0x12, 0x0, 0x48, 0x4, 0x18, 0x6, 0xb, 0x1b, 0x3, 0x16, 0x1e, 0x2, 0xe6, 0x9, 0x48, 0x16, 0x64]}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_HE_GI={0x5}]}, @NL80211_BAND_2GHZ={0x3c, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5, 0x6, 0x7f}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x2755, 0x0, 0x879, 0x3, 0x4, 0x9, 0x92, 0x6]}}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x0, 0x1, 0x6, 0x0, 0xfff1, 0x0, 0x2, 0x9]}}]}, @NL80211_BAND_60GHZ={0x98, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}, @NL80211_TXRATE_HT={0x45, 0x2, [{0x1}, {0x4, 0x2}, {0x0, 0x3}, {0x1, 0x1}, {0x2, 0x3}, {0x1, 0x8}, {0x7, 0x3}, {0x7, 0x8}, {0x3, 0x1}, {0x3, 0x7}, {0x5, 0x1}, {0x5, 0x9}, {0x0, 0x4}, {0x1, 0x8}, {0x7, 0xa}, {0x0, 0x7}, {0x2, 0x5}, {0x3, 0x2}, {0x5}, {0x2, 0x1}, {0x0, 0x9}, {0x0, 0xa}, {0x4, 0x6}, {0x4, 0x7}, {0x1, 0x1}, {0x7, 0x1}, {}, {0x5, 0x6}, {0x2, 0xa}, {0x0, 0x9}, {0x2, 0x7}, {0x2, 0x8}, {0x4, 0x9}, {0x4, 0x7}, {0x1, 0x5}, {0x1, 0x5}, {0x6, 0xa}, {0x7, 0x3}, {0x2, 0x6}, {0x0, 0x9}, {0x3, 0x6}, {0x0, 0x2}, {0x3}, {0x2, 0x7}, {0x6, 0xa}, {0x7}, {0x3, 0x3}, {0x0, 0x6}, {0x0, 0x3}, {0x5, 0x2}, {0x7, 0x4}, {0x1, 0x2}, {0x4, 0x9}, {0x7, 0x9}, {0x1, 0x5}, {0x1, 0x6}, {0x1, 0xa}, {0x7, 0x2}, {0x6, 0x4}, {0x2, 0x1}, {0x0, 0xa}, {0x1, 0x2}, {}, {0x1, 0x3}, {0x4, 0x9}]}, @NL80211_TXRATE_HT={0x42, 0x2, [{0x1}, {0x0, 0x1}, {0x6, 0x7}, {0x7, 0x5}, {0x0, 0x7}, {0x7, 0x4}, {0x4, 0x5}, {}, {0x6, 0xa}, {0x6, 0x8}, {0x4, 0x1}, {0x5, 0x1}, {0x4, 0x9}, {0x1, 0xa}, {0x3, 0x7}, {0x4, 0x8}, {0x1, 0x4}, {0x1, 0x6}, {0x2, 0x2}, {0x3, 0x1f}, {0x3, 0x7}, {0x0, 0x3}, {0x2, 0x3}, {0x3, 0x1}, {0x1, 0x2}, {0x6, 0x6}, {0x1, 0x4}, {0x4, 0x1}, {0x1, 0x2}, {0x2, 0x4}, {0x7, 0x2}, {0x6, 0x9}, {0x6, 0x7}, {0x4, 0x8}, {0x1, 0x1}, {0x0, 0x5}, {}, {0x1, 0x2}, {0x4, 0x8}, {0x7, 0x2}, {0x3, 0x6}, {0x7, 0x8}, {0x3, 0x5}, {0x3, 0x5}, {0x4, 0x1}, {0x7, 0x9}, {0x4, 0xa}, {}, {0x5}, {0x1, 0x5}, {0x7, 0x1}, {0x5, 0x4}, {0x3, 0x2}, {0x4, 0x3}, {0x1, 0x6}, {0x7, 0x8}, {0x0, 0x1}, {0x2, 0x7}, {0x1, 0x5}, {0x2, 0x1}, {0x7, 0x2}, {0x3, 0x4}]}]}, @NL80211_BAND_5GHZ={0x9c, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HT={0x3c, 0x2, [{0x0, 0x17}, {0x5}, {0x2, 0x6}, {0x7, 0x4}, {0x6, 0x3}, {0x4, 0x7}, {0x6, 0x5}, {0x6, 0x5}, {0x0, 0x1b}, {0x5, 0x7}, {0x5, 0x4}, {0x3, 0x6}, {0x5, 0x2}, {0x7, 0xa}, {0x6, 0x2}, {0x3, 0x8}, {0x3, 0x8}, {0x4, 0x8}, {0x2, 0x8}, {0x0, 0x4}, {0x7, 0x6}, {0x2, 0x8}, {0x1, 0x2}, {0x0, 0x5}, {0x7, 0x9}, {0x5, 0x4}, {0x1, 0x8}, {0x6, 0x5}, {0x7, 0x4}, {0x5, 0x5}, {0x2, 0x1}, {0x7, 0x8}, {0x7, 0x5}, {0x3, 0x8}, {0x3, 0x5}, {0x5}, {0x6, 0x6}, {0x1, 0x5}, {0x2, 0x6}, {0x1, 0x9}, {0x6, 0x3}, {0x1, 0x1f}, {0x1, 0x4}, {0x5}, {0x7, 0x1}, {0x4, 0x3}, {0x5, 0x7}, {0x5, 0x1}, {0x0, 0x8}, {0x3, 0x8}, {0x7}, {0x0, 0x4}, {0x1, 0xa}, {0x4, 0x4}, {0x3, 0x3}, {0x1, 0x2}]}, @NL80211_TXRATE_LEGACY={0xb, 0x1, [0x6, 0x36, 0xb, 0x1c, 0x18, 0xb, 0x24]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x0, 0x2, 0xf, 0x5, 0x9, 0x1ff, 0x7fff, 0x9]}}, @NL80211_TXRATE_LEGACY={0x22, 0x1, [0x6c, 0x16, 0xb, 0x12, 0x18, 0x36, 0x16, 0x1b, 0xc, 0xb, 0x4, 0x36, 0x1, 0x18, 0x6, 0x4, 0x16, 0x60, 0xc, 0x30, 0x70, 0x3, 0x6c, 0xb, 0x4, 0x2, 0xc, 0xb, 0x30, 0x9]}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_LEGACY={0x6, 0x1, [0x6, 0x60]}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}]}, @NL80211_BAND_2GHZ={0x18, 0x0, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x5, 0x6842, 0x800, 0x3, 0x7, 0x9, 0x8, 0x9]}}]}, @NL80211_BAND_5GHZ={0x54, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_LEGACY={0x9, 0x1, [0x6c, 0x1, 0x48, 0xc, 0x4]}, @NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_HT={0x7, 0x2, [{0x3, 0x6}, {}, {0x6, 0x8}]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x8, 0x5, 0x5, 0x0, 0x6, 0x6, 0x0, 0x7f]}}]}, @NL80211_BAND_6GHZ={0xa4, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0xe, 0x6, 0x1, 0x6, 0x0, 0x8a, 0x7f, 0x9]}}, @NL80211_TXRATE_HT={0x4b, 0x2, [{0x0, 0x3}, {0x6, 0x5}, {0x4, 0x4}, {0x7, 0x6}, {0x1, 0x2}, {0x6, 0x4}, {0x1, 0x3}, {0x0, 0xa}, {0x3, 0x3}, {0x7, 0xa}, {0x7, 0xa}, {0x0, 0x5}, {0x4, 0x6}, {0x5, 0x7}, {0x0, 0x1}, {0x1, 0x2}, {0x7, 0x4}, {0x7, 0x6}, {0x1, 0xa}, {0x0, 0x3}, {0x5, 0x8}, {0x5, 0x4}, {0x6, 0x2}, {0x7, 0x4}, {0x1, 0x7}, {0x5}, {0x4, 0xa}, {0x6, 0xa}, {0x1}, {0x0, 0x9}, {0x6, 0x7}, {0x4, 0x1}, {0x6}, {0x5, 0x9}, {0x6, 0x2}, {0x3}, {0x5, 0x4}, {0x4, 0x1}, {}, {0x2, 0xa}, {0x7, 0x3}, {0x5, 0x6}, {0x1, 0x8}, {0x6, 0x7}, {0x0, 0x4}, {0x3, 0x7}, {0x6, 0x4}, {0x0, 0x9}, {0x3, 0x2}, {0x0, 0x2}, {0x0, 0x8}, {0x4, 0x5}, {0x0, 0x2}, {0x3}, {0x2, 0x2}, {0x4, 0x9}, {0x0, 0x1}, {0x1, 0x8}, {0x6, 0x1}, {0x3, 0x1}, {0x5, 0x2}, {0x3, 0x7}, {0x3, 0x7}, {0x7, 0xa}, {0x0, 0x3}, {0x4, 0x9}, {0x7, 0x8}, {0x1, 0x9}, {0x4, 0xa}, {0x7, 0x2}, {0x0, 0x5}]}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_HE={0x14, 0x5, {[0xe, 0xb, 0xe34d, 0x4, 0xfffb, 0xeaa8, 0x449, 0x3]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x94d, 0x1, 0xf, 0x8, 0x7, 0x9, 0x2, 0x6]}}]}]}]}, {0x28, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_OVERRIDE={0x4}, @NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_RETRY_SHORT={0x5, 0x7, 0x5f}, @NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5, 0xc, 0x1}, @NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5, 0x9, 0x1}]}, {0x54, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5, 0xc, 0x2}, @NL80211_TID_CONFIG_ATTR_TX_RATE={0x34, 0xd, 0x0, 0x1, [@NL80211_BAND_5GHZ={0x30, 0x1, 0x0, 0x1, [@NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x5, 0x4e, 0x67a, 0x8, 0x1, 0x6]}}, @NL80211_TXRATE_LEGACY={0xe, 0x1, [0x60, 0x30, 0x36, 0x30, 0x1, 0x3, 0x9, 0x12, 0x1, 0x1b]}]}]}, @NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0x1f}, @NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc, 0x2, 0xcf3}]}, {0x34, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_NOACK={0x5}, @NL80211_TID_CONFIG_ATTR_RETRY_SHORT={0x5, 0x7, 0x8f}, @NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5, 0xc, 0x2}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5, 0xc, 0x2}]}, {0x48, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5, 0xa, 0x1}, @NL80211_TID_CONFIG_ATTR_PEER_SUPP={0xc, 0x3, 0x7}, @NL80211_TID_CONFIG_ATTR_RETRY_SHORT={0x5, 0x7, 0x1}, @NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5, 0xb, 0x1}, @NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0x31}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5, 0xa, 0x1}]}, {0xc, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5}]}, {0x20, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_PEER_SUPP={0xc, 0x3, 0x1}, @NL80211_TID_CONFIG_ATTR_NOACK={0x5, 0x6, 0x1}]}, {0x24, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5, 0xa, 0x1}, @NL80211_TID_CONFIG_ATTR_RETRY_LONG={0x5, 0x8, 0xed}, @NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0x74}, @NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5}]}]}, @NL80211_ATTR_TID_CONFIG={0x30, 0x11d, 0x0, 0x1, [{0x2c, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5, 0xa, 0x1}, @NL80211_TID_CONFIG_ATTR_NOACK={0x5, 0x6, 0x1}, @NL80211_TID_CONFIG_ATTR_RETRY_LONG={0x5, 0x8, 0xab}, @NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5, 0xb, 0x1}]}]}, @NL80211_ATTR_TID_CONFIG={0x78, 0x11d, 0x0, 0x1, [{0x2c, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0x2}, @NL80211_TID_CONFIG_ATTR_RETRY_SHORT={0x5, 0x7, 0x3d}, @NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_OVERRIDE={0x4}, @NL80211_TID_CONFIG_ATTR_OVERRIDE={0x4}, @NL80211_TID_CONFIG_ATTR_RETRY_LONG={0x5, 0x8, 0xbb}]}, {0x1c, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5}]}, {0xc, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0x45}]}, {0x20, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_OVERRIDE={0x4}, @NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_NOACK={0x5}]}]}, @NL80211_ATTR_TID_CONFIG={0x42c, 0x11d, 0x0, 0x1, [{0xc, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5, 0xa, 0x1}]}, {0x34, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5, 0xb, 0x1}, @NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0x30}, @NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc, 0x2, 0x10}, @NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc, 0x2, 0x9}]}, {0x1a4, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_OVERRIDE={0x4}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_TX_RATE={0x184, 0xd, 0x0, 0x1, [@NL80211_BAND_2GHZ={0x38, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HT={0x29, 0x2, [{0x0, 0x4}, {0x6, 0x6}, {0x7, 0x8}, {0x7, 0x5}, {0x5}, {0x3, 0x1}, {0x2, 0x8}, {0x3, 0x2}, {0x7, 0x9}, {0x2}, {0x2, 0x9}, {}, {0x5, 0x8}, {0x7, 0x4}, {0x1, 0x9}, {0x0, 0x9}, {0x5, 0x6}, {0x6, 0x7}, {0x3, 0x6}, {0x7, 0x6}, {0x6, 0x8}, {0x5, 0xa}, {0x3, 0x8}, {0x3, 0x3}, {0x6, 0x4}, {0x3, 0x6}, {0x2, 0x9}, {0x6, 0x5}, {0x0, 0x6}, {0x6, 0xa}, {0x1, 0x7}, {0x0, 0x7}, {0x7, 0x9}, {0x1, 0x2}, {0x4, 0x3}, {0x2, 0x6}, {0x6, 0xa}]}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}]}, @NL80211_BAND_60GHZ={0x18, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x8, 0x400, 0x1, 0x8, 0x3, 0x728, 0x100, 0x2]}}]}, @NL80211_BAND_6GHZ={0x74, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x1, 0x7, 0x6, 0x8, 0x3, 0x6, 0xe, 0x4]}}, @NL80211_TXRATE_LEGACY={0x9, 0x1, [0x12, 0x6c, 0x24, 0x0, 0x60]}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x7, 0x8, 0x5, 0x4, 0xfc00, 0x7, 0x2, 0x8]}}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x40}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x9, 0x4, 0x6, 0x9, 0x2, 0x1, 0x4, 0x6]}}]}, @NL80211_BAND_2GHZ={0x68, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x6, 0xfff1, 0x101, 0x48, 0x7, 0x8001, 0x5, 0xe]}}, @NL80211_TXRATE_LEGACY={0xc, 0x1, [0x3, 0x12, 0x2, 0x4, 0x60, 0xb, 0x36, 0x5]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x4, 0x9317, 0x5, 0x9, 0x9, 0x8001, 0x80, 0xc85]}}, @NL80211_TXRATE_HT={0x2e, 0x2, [{0x1, 0x7}, {0x5, 0xa}, {0x0, 0x5}, {0x7, 0xa}, {0x4, 0x1}, {0x4, 0x7}, {0x2, 0xa}, {0x1, 0x4}, {0x3, 0x6}, {0x0, 0x8}, {0x4, 0x6}, {0x4, 0x9}, {0x2, 0x8}, {0x3, 0x8}, {0x6, 0x4}, {0x5, 0x8}, {0x2}, {0x3, 0x3}, {0x6, 0x7}, {0x6, 0x4}, {0x2, 0x6}, {0x0, 0x3}, {0x4, 0x2}, {0x5, 0x7}, {0x7, 0x1}, {0x7}, {0x0, 0x1}, {0x2, 0x3}, {0x5, 0x5}, {0x2, 0xa}, {0x0, 0x3}, {0x1, 0x6}, {0x2}, {0x7, 0x1}, {0x6, 0x5}, {0x4, 0x7}, {0x0, 0x7}, {0x1, 0x4}, {0x0, 0x9}, {0x7, 0x1}, {0x4, 0x3}, {0x3, 0x8}]}]}, @NL80211_BAND_6GHZ={0x4}, @NL80211_BAND_60GHZ={0x50, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HT={0x30, 0x2, [{0x0, 0x1}, {0x2, 0x6}, {0x7, 0x8}, {0x4, 0xa}, {0x1, 0x6}, {0x5}, {0x1, 0x6}, {0x5, 0x2}, {}, {0x7, 0x5}, {0x1, 0x7}, {0x1, 0x6}, {0x3, 0x1}, {0x7, 0xa}, {0x5, 0x7}, {0x2, 0x7}, {0x1, 0x2}, {0x2, 0x7}, {0x0, 0x3}, {0x6, 0x4}, {0x7, 0x2}, {0x1, 0x1}, {0x1, 0x3}, {0x7}, {0x5}, {0x4}, {0x1, 0xa}, {0x2}, {0x2, 0x3}, {0x4}, {0x4, 0x7}, {0x4, 0x9}, {0x2, 0x5}, {0x5, 0x6}, {0x3, 0x3}, {0x0, 0x8}, {0x3, 0xa}, {0x6, 0x3}, {0x1, 0x1}, {0x4, 0x1}, {0x6, 0x2}, {0x4}, {0x3, 0x6}, {0x2, 0x8}]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x8, 0x745, 0x0, 0x9, 0x80, 0x9, 0x5, 0x2]}}, @NL80211_TXRATE_GI={0x5}]}]}, @NL80211_TID_CONFIG_ATTR_RETRY_SHORT={0x5, 0x7, 0xb5}, @NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5}]}, {0x204, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TX_RATE={0x1f0, 0xd, 0x0, 0x1, [@NL80211_BAND_60GHZ={0x108, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_HT={0x49, 0x2, [{0x0, 0x1}, {0x3, 0x8}, {0x7, 0x5}, {0x6, 0x9}, {0x3, 0x9}, {0x6, 0x4}, {0x5}, {0x6, 0x4}, {0x3, 0x1}, {0x0, 0x9}, {0x5, 0x3}, {0x5, 0x1}, {0x1, 0x7}, {0x0, 0x7}, {0x0, 0x9}, {0x2, 0x3}, {0x6}, {0x0, 0x2}, {0x6, 0x2}, {0x1, 0x2}, {0x5, 0x7}, {0x1, 0xa}, {0x1, 0x5}, {0x6}, {0x2, 0x5}, {0x1, 0x1}, {0x0, 0x8}, {0x3, 0x5}, {0x7, 0x4}, {0x2, 0x2}, {0x6, 0x5}, {0x3, 0x6}, {0x5, 0x1}, {0x2, 0xa}, {}, {0x5, 0x3}, {0x6, 0x5}, {0x6, 0x9}, {0x4, 0x4}, {0x1, 0x3}, {0x4, 0x6}, {0x3, 0x9}, {0x0, 0x2}, {0x2, 0x7}, {0x0, 0x2}, {0x5, 0x2}, {0x7, 0x9}, {0x4, 0x3}, {0x4, 0x8}, {0x0, 0x4}, {0x2, 0x5}, {0x2, 0x1}, {0x6, 0x3}, {0x1, 0x1}, {0x4, 0x5}, {0x4, 0x3}, {0x7, 0x1}, {0x0, 0x1}, {0x5, 0xa}, {0x7, 0x9}, {0x6, 0x8}, {0x2}, {0x1, 0x3}, {0x2, 0xa}, {0x4, 0x3}, {0x1, 0x7}, {0x7, 0x2}, {0x0, 0xa}, {0x5, 0x8}]}, @NL80211_TXRATE_LEGACY={0x23, 0x1, [0x1b, 0x6, 0x6, 0x1b, 0x12, 0x16, 0x24, 0x7c, 0x6, 0x6c, 0x1, 0x18, 0x9, 0x16, 0x18, 0x2, 0x24, 0x30, 0x3, 0xb, 0x6, 0x12, 0x3, 0x4, 0x2, 0x4, 0x0, 0x5, 0x0, 0x1b, 0x4]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x904, 0x0, 0x9, 0x5, 0x1f, 0x9, 0x2000, 0x9]}}, @NL80211_TXRATE_HT={0x42, 0x2, [{0x2, 0x6}, {0x5}, {0x7}, {0x1, 0x7}, {0x5, 0x8}, {0x7, 0x7}, {0x6, 0x4}, {0x7, 0x3}, {0x3, 0x4}, {0x1, 0x8}, {0x4, 0x9}, {0x0, 0x9}, {0x0, 0x5}, {0x6, 0x11}, {0x1, 0x8}, {0x2, 0x2}, {0x0, 0x5}, {0x1, 0x3}, {0x5, 0x1}, {0x5, 0xa}, {0x2, 0x1}, {0x6, 0x9}, {0x1, 0x4}, {0x2}, {0x6, 0x4}, {0x1, 0x2}, {0x0, 0x7}, {0x2, 0x5}, {0x3, 0x7}, {0x0, 0x9}, {0x4, 0x1}, {0x5, 0x1}, {0x7, 0x4}, {0x5, 0xa}, {0x6, 0x3}, {0x4, 0x2}, {0x3, 0x8}, {0x0, 0x6}, {0x2, 0x9}, {0x1, 0x2}, {0x3, 0x7}, {0x1, 0x2}, {0x7, 0x6}, {0x4, 0xa}, {0x2, 0x9}, {0x7, 0x2}, {0x0, 0x3}, {0x6, 0xa}, {0x6}, {0x1, 0xa}, {0x5, 0xa}, {0x7, 0xa}, {0x1, 0x2}, {0x2, 0x6}, {0x2, 0x1}, {0x5, 0x2}, {0x0, 0x6}, {0x5, 0x9}, {0x3, 0x1}, {0x7}, {0x7, 0x2}, {0x3, 0x8}]}, @NL80211_TXRATE_LEGACY={0x22, 0x1, [0x12, 0x30, 0x9, 0x30, 0x3, 0x4, 0x18, 0x16, 0x0, 0x48, 0x48, 0x16, 0x24, 0x1, 0x12, 0x9, 0x18, 0x24, 0x36, 0x36, 0x5, 0x20, 0x0, 0xb, 0xb, 0x2b, 0x17, 0xc, 0x60, 0x24]}, @NL80211_TXRATE_HE_LTF={0x5}]}, @NL80211_BAND_5GHZ={0x54, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x4, 0x16, 0x1, 0x2, 0x4, 0x6cc, 0x0, 0x8]}}, @NL80211_TXRATE_HT={0x28, 0x2, [{0x4, 0x2}, {0x3, 0x4}, {0x1, 0x9}, {0x2, 0x7}, {0x2}, {0x1, 0x9}, {0x7, 0xa}, {0x0, 0x8}, {0x0, 0x7}, {0x2, 0x8}, {0x1}, {0x5, 0x9}, {0x7, 0x3}, {0x4, 0x7}, {0x3, 0x5}, {0x4, 0x5}, {0x5}, {0x7, 0x2}, {0x4, 0x4}, {0x7, 0x6}, {0x2, 0x9}, {0x3, 0xa}, {0x2}, {0x5, 0xa}, {0x2, 0x8}, {0x1}, {0x4, 0x1}, {0x7, 0x6}, {0x5, 0x6}, {0x1, 0x7}, {0x2}, {0x3, 0x9}, {0x4}, {0x1, 0x3}, {0x4}, {0x6, 0x8}]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x5, 0x2, 0x9, 0x1, 0x30bb, 0x0, 0x1, 0x80]}}]}, @NL80211_BAND_5GHZ={0x64, 0x1, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0xfff7, 0x3ff, 0x3, 0x3ff, 0x7, 0xfff, 0xa, 0xd]}}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x7f, 0x1000, 0x2, 0xfffc, 0x1, 0x7fff, 0x5, 0x4]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x5, 0x3ff, 0x4, 0x9f66, 0x1, 0x7, 0x9, 0x4]}}, @NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x9044, 0x8134, 0x2d5, 0x6, 0x401, 0x5, 0x3ff, 0x5]}}]}, @NL80211_BAND_5GHZ={0x2c, 0x1, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0xb4, 0x5, 0x6, 0xfffb, 0x4, 0x7ff, 0x1ff, 0x1000]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0xfff, 0xfff7, 0xe588, 0x28c6, 0x5, 0x4, 0x3d4]}}]}]}, @NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_NOACK={0x5, 0x6, 0x1}]}, {0xc, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_RETRY_SHORT={0x5, 0x7, 0x92}]}, {0x14, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_NOACK={0x5, 0x6, 0x1}, @NL80211_TID_CONFIG_ATTR_NOACK={0x5}]}, {0x20, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_RETRY_SHORT={0x5, 0x7, 0x65}, @NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc, 0x2, 0xffff}, @NL80211_TID_CONFIG_ATTR_NOACK={0x5}]}]}]}, 0xf2c}, 0x1, 0x0, 0x0, 0xc0}, 0x4080) ioctl$BTRFS_IOC_WAIT_SYNC(r7, 0x40089416, &(0x7f00000000c0)=r9) write$cgroup_int(r8, &(0x7f0000000200)=0x1, 0x12) 14m29.738604541s ago: executing program 5 (id=1252): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$packet(0x11, 0x3, 0x300) fsetxattr(r1, &(0x7f0000000000)=@known='system.posix_acl_access\x00', &(0x7f0000000080)=')-\x00', 0x3, 0x1) r2 = socket$unix(0x1, 0x5, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r0) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_MPATH(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)={0x1c, r3, 0x1, 0x70bd29, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r4}, @void}}}, 0x1c}}, 0x4054000) 14m28.435060089s ago: executing program 5 (id=1255): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000000106a053103000000000001090224000100008000090400101c0300010009210000000122f80409058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) (async) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r2) (async, rerun: 32) r3 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 32) r4 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r3) sendmsg$TIPC_CMD_ENABLE_BEARER(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x0) (async) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r5) (async) r6 = socket$unix(0x1, 0x2, 0x0) (async, rerun: 64) r7 = fcntl$getown(r1, 0x9) (rerun: 64) sched_setattr(r7, &(0x7f0000000380)={0x38, 0x6, 0x4c, 0xdf2d, 0x8bb, 0x2, 0x4, 0x5, 0x80, 0x4}, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) (async) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) (async) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000026c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0x0, {0x0, 0x0, 0x0, r11, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0x2}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0x1, 0x7, 0x100, 0x8}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2b, 0x80000, {0x0, 0x0, 0x0, r9, {0x0, 0xe}, {0xfff1, 0xb}, {0xffe0, 0xffff}}, [@qdisc_kind_options=@q_bfifo={{0xa}, {0x8, 0x2, 0x4}}]}, 0x38}, 0x1, 0x0, 0x0, 0x2004c0f1}, 0x4008000) ioctl$SIOCSIFHWADDR(r5, 0x8922, &(0x7f0000000240)={'syzkaller0\x00', @random="2b0100004ec6"}) syz_usb_connect$hid(0x5, 0x0, 0x0, &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x40, &(0x7f0000000440)=ANY=[@ANYBLOB="4003564c0e0c7944959731d6dc34d7f25d034c1ae5fe16520961716f123793afae32d3c4849088d0c708e8745f056b4b924ce9e90a49343a83aa1acae27dad544ada8448db9d1c5e85b02daa65d755554da1cb615b520bdc4d1613f7ac34f13e9df4bf25f15f671b148980cc2ac4d66ea5043685c78a3d62c523b6ae71ea1ac9d2de5b69ad1071a4f0f2e8725f7d2e85606c74fa6009e24b4e612df8b42a1ddb56fe7b577429a8556b15dda3b793c0945570ceb7ab8c7bd6316f8a2c3989ea7923f8258af7122b8ccbd25a9dcfb6740dadcb7ce3ea12"]}]}) r12 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r12, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) (async) r13 = socket$nl_route(0x10, 0x3, 0x0) r14 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r14, 0x8933, &(0x7f0000000040)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r13, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000000)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r15, {0x0, 0xffe0}, {0xfff1, 0xffff}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0x4}]}, 0x2c}}, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000340)={0x24, 0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="00220508"], 0x0}, 0x0) 14m27.882467664s ago: executing program 33 (id=1255): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000000106a053103000000000001090224000100008000090400101c0300010009210000000122f80409058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) (async) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r2) (async, rerun: 32) r3 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 32) r4 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r3) sendmsg$TIPC_CMD_ENABLE_BEARER(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x0) (async) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r5) (async) r6 = socket$unix(0x1, 0x2, 0x0) (async, rerun: 64) r7 = fcntl$getown(r1, 0x9) (rerun: 64) sched_setattr(r7, &(0x7f0000000380)={0x38, 0x6, 0x4c, 0xdf2d, 0x8bb, 0x2, 0x4, 0x5, 0x80, 0x4}, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) (async) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) (async) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000026c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0x0, {0x0, 0x0, 0x0, r11, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0x2}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0x1, 0x7, 0x100, 0x8}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2b, 0x80000, {0x0, 0x0, 0x0, r9, {0x0, 0xe}, {0xfff1, 0xb}, {0xffe0, 0xffff}}, [@qdisc_kind_options=@q_bfifo={{0xa}, {0x8, 0x2, 0x4}}]}, 0x38}, 0x1, 0x0, 0x0, 0x2004c0f1}, 0x4008000) ioctl$SIOCSIFHWADDR(r5, 0x8922, &(0x7f0000000240)={'syzkaller0\x00', @random="2b0100004ec6"}) syz_usb_connect$hid(0x5, 0x0, 0x0, &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x40, &(0x7f0000000440)=ANY=[@ANYBLOB="4003564c0e0c7944959731d6dc34d7f25d034c1ae5fe16520961716f123793afae32d3c4849088d0c708e8745f056b4b924ce9e90a49343a83aa1acae27dad544ada8448db9d1c5e85b02daa65d755554da1cb615b520bdc4d1613f7ac34f13e9df4bf25f15f671b148980cc2ac4d66ea5043685c78a3d62c523b6ae71ea1ac9d2de5b69ad1071a4f0f2e8725f7d2e85606c74fa6009e24b4e612df8b42a1ddb56fe7b577429a8556b15dda3b793c0945570ceb7ab8c7bd6316f8a2c3989ea7923f8258af7122b8ccbd25a9dcfb6740dadcb7ce3ea12"]}]}) r12 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r12, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) (async) r13 = socket$nl_route(0x10, 0x3, 0x0) r14 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r14, 0x8933, &(0x7f0000000040)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r13, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000000)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r15, {0x0, 0xffe0}, {0xfff1, 0xffff}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0x4}]}, 0x2c}}, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000340)={0x24, 0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="00220508"], 0x0}, 0x0) 6.299879911s ago: executing program 0 (id=4783): socket$inet_tcp(0x2, 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)) socket$nl_netfilter(0x10, 0x3, 0xc) syz_open_procfs(0x0, &(0x7f0000000440)='mounts\x00') r0 = socket$inet6(0xa, 0x3, 0x5) sendmmsg(r0, &(0x7f0000001500)=[{{&(0x7f0000000180)=@l2tp6={0xa, 0x500, 0x80000, @remote, 0x0, 0x3}, 0x80, 0x0}, 0x5b4}, {{&(0x7f0000000040)=@l2tp6={0xa, 0x0, 0x7080000, @ipv4={'\x00', '\xff\xff', @loopback}, 0x7, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000001580)=ANY=[@ANYBLOB="080100000000000029000000", @ANYRES64=r0], 0x108}}], 0x2, 0xc040) 6.130967517s ago: executing program 0 (id=4784): socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$team(&(0x7f0000000480), 0xffffffffffffffff) r0 = socket$inet6_udp(0xa, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000600)={0x9, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt(0xffffffffffffffff, 0x84, 0x81, &(0x7f00000002c0)="1a00000002", 0x5) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(0xffffffffffffffff, 0x84, 0x15, 0x0, 0x0) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) msync(&(0x7f0000952000/0x2000)=nil, 0x87abbe8d1cc6ad9, 0x6) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000000)) 4.762330193s ago: executing program 0 (id=4803): r0 = socket$packet(0x11, 0x2, 0x300) r1 = socket(0x1d, 0x2, 0x6) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000780)={'vxcan1\x00', 0x0}) bind$can_j1939(r1, &(0x7f0000000040)={0x1d, r2, 0x3}, 0x18) syz_genetlink_get_family_id$mptcp(&(0x7f0000000280), r1) syz_usb_connect$cdc_ncm(0x0, 0x0, 0x0, 0x0) 3.535632757s ago: executing program 3 (id=4821): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000000140)={0x28, 0x19, 0x7, 0xd1, 0x30, 0x10, 0xaa, 0x6, 0xfd, 0x5, 0xc, 0x40, 0x0, 0x2}, 0xe) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f0000000080)=[@in6={0xa, 0x4e23, 0x5, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x22}}, 0x9}]}, &(0x7f0000000040)=0x10) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000100)={r1, 0x9}, &(0x7f0000000240)=0x8) 3.535017802s ago: executing program 6 (id=4822): syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) syz_clone3(&(0x7f00000003c0)={0xac020080, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000002c0)='children\x00') pread64(r0, &(0x7f0000000300)=""/4092, 0xffc, 0x4) 3.364032611s ago: executing program 3 (id=4824): prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$tipc(0x1e, 0x5, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x20, &(0x7f00000000c0)={@rand_addr=' \x01\x00', 0x0, 0x0, 0x1, 0x1}, 0x21) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) close_range(r4, 0xffffffffffffffff, 0x0) 3.18348036s ago: executing program 6 (id=4827): r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0xd81) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) 3.148070013s ago: executing program 0 (id=4828): r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000140), 0x40000) write$sndseq(r0, &(0x7f0000000180), 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) syz_usb_connect(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002a2b8d240bb2170200b87010203010902240001a00800040904c81e010103f70909050803ff0304060902210725", @ANYRESOCT=0x0], 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x38, 0x0, 0x4, 0x8001, 0x0, 0xb49, 0x200000000002, 0x7, 0x8, 0x5}, 0x0) socket(0x840000000002, 0x3, 0xff) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=@gettclass={0x24, 0x25, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x6}, {0x0, 0xfff1}, {0x0, 0x9}}}, 0x24}}, 0x40c0) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, &(0x7f0000000080)='source', 0x0, 0x0) getpid() ioctl$sock_FIOSETOWN(0xffffffffffffffff, 0x8901, 0x0) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, 0x0) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0xc) r1 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/mm/ksm/run\x00', 0x1, 0x0) timer_create(0x7, &(0x7f0000001880)={0x0, 0x2b, 0x1, @thr={0x0, 0x0}}, 0x0) openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$sysctl(r1, &(0x7f0000000580)='1\x00', 0x2) syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12011900000000406a0563000000000000010902"], 0x0) write$sysctl(r1, &(0x7f00000000c0)='2\x00', 0x2) 3.022542012s ago: executing program 6 (id=4830): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) syz_open_dev$tty1(0xc, 0x4, 0x1) pselect6(0x40, &(0x7f0000000040)={0x9, 0x5, 0x3, 0x8, 0xb, 0xec, 0x0, 0x1}, &(0x7f00000000c0)={0x3, 0x0, 0x6, 0x0, 0x101, 0x9, 0xfffffffffffffffb, 0x9}, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0xf, 0x9, &(0x7f0000000680)=@framed={{0x18, 0x8}, [@func={0x85, 0x0, 0x1, 0x0, 0x5}, @call={0x85, 0x0, 0x0, 0xe}, @generic={0x5f}, @initr0, @exit]}, &(0x7f0000000000)='GPL\x00'}, 0x94) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000680)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x1c, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}]}, @NFT_MSG_NEWSETELEM={0x20, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x64}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) 2.977687216s ago: executing program 1 (id=4831): r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./file1\x00', 0x103a42, 0x32) ftruncate(r0, 0x6000000) r1 = inotify_init1(0x0) inotify_add_watch(r1, &(0x7f0000000000)='./file1\x00', 0xa4000061) write$P9_RGETATTR(r0, &(0x7f0000000140)={0xa0, 0x19, 0x2, {0x101d, {0x40, 0x1, 0x4}, 0x90, 0x0, 0x0, 0x6, 0xffff, 0x6, 0x4, 0x7, 0x9, 0x0, 0x9, 0x7, 0x7, 0x100000001, 0x6, 0x287, 0x9, 0x4217}}, 0xa0) copy_file_range(r0, 0x0, r0, &(0x7f00000004c0)=0x100, 0x9, 0x0) 2.911002666s ago: executing program 1 (id=4832): fcntl$lock(0xffffffffffffffff, 0x24, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c1) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x404, &(0x7f0000000680)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r0, &(0x7f0000006200)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r0, &(0x7f0000001dc0)={0x50, 0x0, r1, {0x7, 0x2b, 0x0, 0x2b418c52, 0x6, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40}}, 0x50) statx(0xffffffffffffff9c, &(0x7f0000000640)='./file0/file1\x00', 0x1000, 0x100, 0x0) syz_fuse_handle_req(r0, &(0x7f0000008e80)="0e24ac7705237246fc1db898fda0c7f95d375ea7f4bc7a07517a51095880f2219d9e4329f6c4e734f2bb34564a1c2e298d7eb8844d8af7b30e1a71750a2511e44b368fc6e9ae65e40e64e4b5fd3d0f87009b5727519df1ddbcbb38ef00871f00ed2543b7f2990a44482bf3d7478c3c2799dd8120fc3258cfeccf648fe15128c54d1d4272bfd44950915afd3aa0abb5b04d4dbec287df0816c3e43c2503cac6e95041aa205c5958f51a9c4c8214ae2108401b08ae7ff8440988c93424422f06c628077d767432521fefa0f8d0f387e685e4af54bdd7f931c3eace52ca7a6ba2d0fd701e5d77393e6268f52e68d97087f87edd2ae49180028bf08ab7e02c3ef12aec2f286d1bf40fd3a5f337b0f0b63d701c60bae36a5e1644bc90f34165049ac5c4fc8a0ada90e345df1420a58c92cfcc6973d3fa532b8b4088592e0f2c36f7e756139b272fc99104a93c5cf2599c683b60910af98a55b17bf646ddddb13e73d0bfdcfb3e3d261d84f83270832708f6e5b3fd2bb98e135b914e21681b409d717afa8f65dc9d3ab6a78b9b026b6aa1f1ee5872426b4bd4fd652072f86dfb96ef79649396a0f19239b0ce6ba9a8ff49f8f4820579a3169fe54b6f060a69236d57a1a13f033054fb22dbfb3f72861acc7ed51ebed60a8a03c3e16030e7a114d0690c268713d8206b34a005fb89d5123103d36ab57594fc731e8a6353ab3be3af22faa6f85b54ba78b90aba30e17dad90c31a20cc5f39c8ff50097bb310535efd6ecbc49dfc2d547bee78d5c5ebfe0d4bd3c093413e12cfefbfdb5f38c437ce831b209f3337979f6e0c46d8bf272a3ac6076c7940f905536167d2285d2a7d0e75f1765f0c080f1dfd9bae98afdfda7e7837d1081d83effab72e6eff493cc9031a299383f726227d75474e4c8378b2376fc7fef8b213b26794edc4c2fc110d917b863d25e7382b19b1b90cc90428f6aa0b1df015bcbbe83de36ff56c065ba92f1f49e61ac6bc6b3c20e42e7763dd52f66095f07e235f0062accb0eab60ce54d84391cbf2613096ded353543b5d6a884cc981b759e4499ab72881f88542208c9fd81b541514d6d2ed54683926b0d6bfe904b76215aea6db4cff8242d3ee5524acb456ec219e42d46c1b1e3fa9748404db4583537b195ad326853ed9472790656ab01bd031b19fb64b0e5227d18ea09ea7557c9afdc918c918a1fafdd18f9f54682bf0f49ba2ae14f963340dc6600e1b344ce50ed61af0726e3441583f8cf045df193dfbce93285d7fddfc0d831fefc85cd3e7920757f27a4e09b5cfa77b93a5e82f571d1293d9437cf89997011eee6ba9f9b7e6ce2fe1c381cb2db053a6e2d9351edbddcc10faf80f5b686727dd8982b12604fde3467f4a7e98b13250df7e1eef67da8f7fe3fffd3a185457aaaecb38f5ca31ea3e35cc7c6adc3873c734cb661e3c43e64bf0843b2cf1d950642eeb20d698cc9e598eb7ec71d3a0d83f311afa2d40a659a219defad76fdb7e8146756ff02a8a74abf8a8ccd72ffd7f70911698d54552aada8ef27b3f5b2644d4d0fda2976d838686a7469b296a98b67b7cc9834dc94f2292581dd242d1abb42db30d4de42c4611c0fbdc77134a6cb0c0d7b36d18a217aaabd34744ed5cac171e2a8bfe90b2dad03d0ca5f74d3eb95c454757be4c77f386c63fee91e95a508d8fcea5cd6bef9bd05e0b992da4e4cbc2f52c9cfde09b6f17f3d73fffc01d7ac55f328061516cf0e4fa50fff5b03dca67b163a68d9ddbb988f50a68fdbfc6e6feb6c892b58eb766d3429396669228dd1653bcbb5cb47c0857d27660e62d23e90178ef2b75713c2c58a207d8c21e9ce64556bfd71b40207ee76416f9f40c5601173b1d84105ac331247c021941a6a27e86de4f9a4db382f67dd6dc8e86a02a8438ddda1a636256fcac8e2328aaa3c054ab86f55c9d7bb2c2999a5c7933f092a3bf66523cb388052c65d138346ad1c5137fa383d7b9023b1868af02cf48923289162544db8fb29cf592c306a76ec92b35f33fae90f5aeac830b82dcc3f0069f668aebe6e5fe13c811f150de080632e357221d2f220ef95ce436730d1f9390d9f192220347d04ac5a94631e349ad330276b9524f775f7a8f68be7823ad7ed3ac4b4d87a12c0261846ec1dfe785b60675968e79496d7ae4e5d478661bd7125f2cc0de35422764556b63d687b339e2b25ad43ca85bc861944d19f9689dffe71d87030d23e0428942441d622de361778cbe8952f7b93c74783552b0087bff535afaf92935aa889018e46d34b2a258f863d89e4b6da841389fa63d489d135e559b7d11b8d97215323548501c275248eb07916ae3f0814c6af32f5ece7eb0330bdaac4394c518f3c8e48cafc36057cfa7788fb2f9a73bddb1d40546cf21b681e6c9ef6f0ac43c512762323209b2c878ed5a9f55e207b56a33c863eaa34a6eb14ad8de9885d52a7c073a406ea4324f8433ddfd89b269d6716072627054197928370ae01a94e3dd4d07125560a5cb1d1bfbbd8c099194de5f787a550a3400ce796e115702255d1f17d96a7fb63384ff497cf72beeb50bd24008ffc58256aec6b2faff2c20336e29bc1acd853214496893af25e8efb571c96edf64fbcd136c95e1213e73bc3f1a896fca2bde0894449ee2927c38114de5f1063d0c203c3fab1389861c4cda173a991eb275ccffe04f75d67df181c26777b18e5552b42fb4332046554109a9a6007592a62d2553dbd098f1daae593322e45f66a64bdb09869feede70d1fcc88fd4c19f4008d1b1d5f34a6025a71d9bf6ff20daccda25cbcc662cfc687ffe5ebc344468f338f4c9bbdc7ed9820feb5e3b09ace47f4253a81da7029816656613aef7456524fc68f4345bc0e7f26240d4594374d2fcb39560e2828e0e219b2417f5787add73418b465b1308d5ac5169791f55802d11354eb62940a492d955e8bd11b952a28acea90cb43af774e6fc75e57383e68937aa3643aa37f7e7665c703576579dcccf63d2bdadfbf14be796d4023689880453b0ff576fb01bb141be3c17478f0d555ca96ff7c3f3e4f53be1f088827203fab2008ec6687e4f5df305f58fe647b93ad09a70165c989498d313ca5ba05f3ce90adc80d55b56d0ec4cd5a78268cc6def7e8bb810bc29f8e742487048363815fa3fe645194ee8529ffba2b8d6756915530f142b42f31eae1703faeae14f3d81ae5c2297c3476b0f89b32f53802453fc74c80bf217097577a910a51860bbead4f73a29423816eadca7b1e2d24a9895949b352fe59f13abfa7b69c0f0061eaae2ada6d72b2f90c9c553ad8be9ee4e4ad2876851a3f3e979c4d770d7df9a27e72ab215ec3efd252d622e7ec6160ac951d1ee9b8c0adc0fc853f2a4f36602c955b61646246e07bd7b745f5d3e99f95f55a1616ed36633db6efa97a96dacf12219cf1555222cc6a589a6def5680124f7ac2f1ec83832a30fd011ff02dbf4ab01afb5989fcc678383f179b5d647cf0a762acf0714e9e4151afa39626884e6f56859d3aafc9fc7f7bbcfb27e038e238783cf56c86f0be52568c4bed0917d651f4d26f76ba6c343e075146504590da391e1c4d028dc81767294df5de9370d62756584baa3bfa31578b6f754e77b0d6ea7357d8915ff0bda182b604b014ecf7dc94ab97061765bfab2053fa863fb671fad3b6312d6e59ba0e70b0ea2476399e925f8fa2e51c9bbfac19aeb11db3dd6ea8d916c4d4eae7de17259e6155591be9b704d3e24cda131eded5e9dd6758dc90a5c7a43332957d26ac91bc65120b1c6b7b94fdf83b397bd8990747f01d3ed912abeab74bb5ae3ff2ee0009cfe8cdb6b4e75a7de3566c8ff7bdddb06b7775cf3116b029e7c85fb7189147e753d614caa490594ff2e22b7144153c635ac7b20a49c2d8575af2f546b968bea9fc4ee5ff417a6fa86ca09c8fed14ea4b721b2d5870d4b670761c70516daa07809ac3817246844f01eadda045c57d1c864cbaabedf90cb42d374392e77b3d1a1afdf962feb55a4e04a77c8fb452429007e0046a406a5f2325f0c7f75a19deed1b456ac5de6486eebbc126ff97c5ee8531a975676b61a0d79f56ff75cbcd20337119422815537a57766648777f1b5f75d358dc63764083406e2d95afd87d00099581940367ed029065df0d9008301fb92e019feac9bb406032167eb053ab07309385771aacc2c52a5d526d14721fd530e63cb7c53f27518c679ccd0f3d2db8aa52ef95c6ac3f5dac0b9b5c3a96a794690f3d49aa0e5a4a95b36609cf61d471cc2c0cd55e8cd96be47558b055280313b15907eba5761180f5229a59341faa1e11eb5b6a48ec9320efb1d9f00936d9a5d91f2bf837fe72edf6ec025c1c4e87171cc02c7342fa5d4f825157d70d8f66f6fa0542de2255373d8743612e7d4e16b8ceebf4e92c40926f21929cab343b981120236b8b0b900772a33bbe4eef06feff3c7b104cf63d92c7f9233982f9b713489fb8bf80f2feffd6c22007b63925209e158a837dc95b42d52ed764350b5f83ad54041bc15a7552c0b8c1933d674a16b0c0934277d9895c1ad01327231a7fffc4b5e1a1495489559bebff324d54f2894563a23b85d3bef62c356eb476e01e0c039287ca38626751f701ef4e20d951433940ce1138660589ff389dee9f85a7faebb9cc494bbe7138b413303af6e05806032d8131d5a25a5d7c0ed87906d92bdd87ce7d62c13989f3435ad77a29b721d8219d2cf530c2ec9edc3de9ce2dcd5053c38a6797de8d8cbd3596ed545d2dc6f825a0e65428dd73df96d5f3e40dbe5a62f0f440f712419d1558ef97bf1d0ca1d59fa1caf6ed0d422456848e196e94b4741b757935bc3aef3a46f53066dc7a74f42d539da2228fb8593ddb79ac977a8b67c0a6058efdbe23ba75fb2faf5b9f152e60b8a96ee19fbf0c417c89f882c53d389bf27a18b9e34b2a33aa27029cfed7a03335cf33d95ea803ad125237a9cc70520f18bc7e9f0c1432368a5304544f5d1e1599242bcd905f69f25cd0fcde391960fc57426e0bf22155ea315f0caee330bf3b7f4f4363f87146531175ad4f69002d46e95a48f714c9bbd9e39b95783406d477dabe03397d68e7af5ee623b4c05eb64120ca76af4f1d37348f93f39d8fa1d22fef874ce65b66f8a1aaff9db97520dab97eb8d1f99efef4d4c9704d181d687874ec4fbb400ed4ce050ac997c843e647bebeddc33eeb70201b3286ea25ad1bdb80dba1fc78a6883ecca84d17645be16bee32967bd487c6f5e0714ca819d5913436ac9aeeab4e5092ec1897dad39737365e8414246a81a731bf7d3ad8d789b42c651702b70ee786032356e3b9fc4402104ffbe55026c84e8ec5dd2a1860cefd0e7789ac2a47fa5ee9610dee980fa3c2fa7219b4e57642f31012b3e00e64285fda219fa9ca37955e3c25fd5872172ed2f5651d208897ed4e1d224243b2f241f24580e924e02cb60af5e14898028596400a770f94e67590df5fe99e9d170d061397f71f4202eca4c91c7fc27e2379358a8d9bfc28c2fb67842b0bd1e5e68e017b34084aa08e7453fc6b03bd42772643eae036f25f10e4da022818dc84f35eea2c07e4dbb41e861b8a4c6df4f0b4b785f0df55f863707a0563cdd5b9fcaa352b54071cd486cf4948575ddbe4654a566438922887a3bd304853a98283c7a4d7757cc6e8298b0121aca5fdb64d86996d8c0ddfa1ee4ccef1ee21dcf853bdb02471383f73ddae17dfef217c6a3f79b182fc36bdb47d1899e87bb4c4e490ad4a2724d223b31b889685355f349ca8bc62d39150ebccaba863bd72bf91d65cffe560eecf162b2440f9d74fe0fb3f8479fd8f6293f16e4d67b3ec30e83180444cec51d2b455a3ab2b6286d4fac1acba8b7b5026671fef497d5e050e0aa34dcecf2d06a9e4b60cdb3f9cbb7cadd73c817f255f8e2eb22d6283a7934e0fd64eaf52caab2d1862baf505889e4db1a1870f0049b3ada06d38af52535da352bedbf1e88e34595820cedd4559cbe0fe0578c557a62f56060d75c5a6806e384d3c274c218d57beecbd8e7832f3cc050668b44c1b8ff8cdcd2b85b5ecb9eca1dcc1204d27bc3689578eab43dac5658a1cfe75456b221c15ed26720a49829f96d501fda6d7839724207d6a5f6bb3d8390e90dd7c6b80e15e6b20b7c74ff3282c770eb1c77583fc97bdb5f2df62a74b3385e2e8ba06fc39730f1f02107477c215deb6c8599cdacc7c710b7b1a77afbe3b2a593f6eec5c8014dd366f5890a1a579e51d858cc8ef93aff098af9903b4e3633a3090a630e64be99f49d32d63d779f989d0198044717741d3bfab4242a05dae33f11ed6b1d850fb379f725fdb7b296d9d9b3024160d4fd735a77c8ab23f0816bfc2715a2561c3cee6e41cf79030c1500c09e75ebbd5a7aa8a0e4826542ad46a9350e969b357c142af13afdd8927cdce3d1f35493f6a7a14c5a20739d462d566fe3ab620f1ef323768bd871eb454dad947f2a871efa05d601cf9fb08d992caf6f4b0f652e13df7dfc658f50e0c9bfc3bf28114a51142f65e25435a32c8719fde2a3d5c4850e31ffa675fa44f9e54957d108e46a67a3b7d71b272ecb0385466e39238f6421b2fd6f33a258883a4501b63001ee9ecb9137162488051f7ff15e6f4be81ca31ffac70f48bcd3457fcb137a2f5108d908ba1d51b0fca7e14273b176af4b954837dc3d40b4341fd0f199000000000000bb303bb0540db3aadb26240242f4a55cb9f6623b6e724e0f9d8b73d02c9fd9140873c0bb884e3cf4c844bad6f27388b56840b63d65ca760dbddf778e430e1f03c246e74e9b56a08a56617658f7fc42e3582f3181a720e51598d22062815ca3caebf36389a58278acc788035d8deb0b800180ef6537d92bfa18947cb18232bfd27e048fcd49d44c137f1d8a10294a6dd20251a00c379bb0936fcb5137c9f5a7a7404976c778912a37f1503deb27b85d3b1d886415a98348d3632c7eb4bf58fdfddd5b24407709474e4478c991a03ed8b456d9a71ec82f05791eb17425e0360493fb5ec343eba7e9c970f47f4cd85edda849cc524d42a11eaf29be950e621cd12e16e3a304516ce5c74a2b47a1baf1f3321b84318883bb023cb5f67dc3541a4d72ebb3316244f96cde4aebc1a77336a93d226c315ab02581123140e45373f40c8cfc7fb5d478607f9b38c2b95bcd55fb8a2047569ac7927b9e4208f75032abfe83442d2ca5db1ee8903888548b5fa9724520083052f8e652f1b0d39d031d2c61f63e5cfb98061b5b913dc6da26e690c85b07fa19b9bf83d124a5fcf96de21d9f00c9aaf2ec66580e4dd99c21c01b7557b7c6336cec525003157d3efdd16a52407b35225f65e44933d56c90dbeeffcfbe2b10bdd921a507592817043c88bab1882ac8863f8a73fed3310138ae56c9b5fb8aa22d5d6ab9e5ece2afb94c5054bdc8444b00a46d74716c21346f2dce31f180f3e01453d7a7aaf4200c4be278a2a88fbec4529a551189da822d1365c8ac70bd6c6cb3c3791e183eeba95e65f1f87c10b2f740bee2575807c486e3b7939f093d44693ac069089830afff26d7165712abb7ba5bf8aaa87a3d57c5670b3a45d707b87aa7689b18292d851cac59802b38bd7ab8e1c3b8a134db1a366aaa8f77a6e2c937f49961637d291970b4541e3405948ba2ef49b40f600e28861c54f06a2400f82ffb2b9a0d4c6da720f9fea31dbe3f42aa29bd126fcbfccb9d809c8bbd76d241fc2588963f10434b69e9415d20bea13c30a08b22f5f21bd945a11466d228848b7b68927725239142fc536f784b705d3bd318f5d5fce31ddd32eca57309b1f9e5cdb0164df0bc45d04db323ed272fef5e4e0554cbe0eef83999d6dd82b67a5de6986b7063851602f833a23946ffb004b9cb30f6af2108e2aee029aa3e4fd525597f4a8d0184750731821bf21aaf703753270d3f12d5ed5f7bdb47c891074a44c63bebe47c66aab7f24e422b5f549249f26cab0aac9484087871de53cdb6d575e0e7ea3c73de23460c5b1bbe1e838433de48ecc812c1e21861dc290f22733090b5d3f88910478bff51307e6d869b68a745255ca007b9f5dda63074845d4d8f03604ada7cb5f8c1bcad9f3a84bab71e6c109ef7bd8eb29ba18011430f28eee91aa83749594aa5c717c0d53e0ff68372284e356e55f9cf33716ade1e148beda327236f4005472600f99a1c2fbe10c5492d2e082d15fa962492b16029a222bce55a001b2726fad239160f3ed55e98343fa5266cd7f5e36158480430e2f802fbfa3aa6e7299ab0940eea91682c79fffb171a705a23b70173f0973ca0b0ea230b306418677be4e6bcca0e6cc7bdbf6a3a96090819d541f505402ce505b40bd7d012ffb6a62f2528c5d370b2d6d6cf4b49c6886d20a5cc94cbe5e7cdf012af5d27c0c89c190956d1aaf1911888b33f67341fe74a10cba3328b84e3c4b83bb8b25da32122ed8df7b831e77bf9528af4b0960a0abb420e931eead4dcf31849cafc6099e8a3053758200bdbb411346662442e8274bc9780fd69abb4ef9ddd292f791b846a5849610862453cdb9263ddc232492de5d24c2c52751223cb961bb9ba7c86988b2a5490c3540ada6ffb9ba287c3e15d228aa0a6491ceced135cb1533b31c0b8ca218ffe4e1a07f29b4557a05b447358350ebfdcff9793b2eb1d7e0ea082b1f4fde8207071a8beb8c1e5efc49e1153fb8fb21ebc46c4d5b404a743a54076e4987da1748a39c70c083960873ffa0b88d4cccae69cdf4630a78250db81141e216e2007b7aea7500ad3176ae8e22c5fce5f14f0aa581bbe520a6d6c5f504547b178e62236f54809dd43763107e49b0d44a7968dcdf73a8c3c395fecd8a557ab850bebf1a67e82714131e0380fd6684e8094783190ce491a03243d903b4488d574be3847b4219145f5aa05201b4bafcbe2c2c98fb4e968c15822e20c06e83b0fc24d8d30acc9e24b36cfd06ad1a073719bf3a92922111e76efac5a813faaca76acfb065ad4faf1efe403aee89bc149bfa4e907008fe5f81d4e795c7a646c2b48e79b7ba54ec42425978c4d084c3c1f66ccdf230515366b08cd506a210e92e75bf7adfbaada44b619feecc4427ca23e74b68abfe9796a6e9a1f540d6a438042f506c27bb4f4814c73541b38eb7d548010363cdf7b2b6faf1a41a10fb71bd206388f32777c6b8e3fd7f6cd76342a1fba80deba8100f878eb4e4a09287ce513bb6b1f445e3cbdf220ff5faceb36c3a7f1a1710e780b9772124e5728fed14bbe348f0f4831913ae69ff40c953cc6447babbcf55b08491357531dc9d86fbe5cd4fd0d6e03e5b71daca299a8d31c3596fb98d21acc09d03e3fe7cc1f13c3e8b49b9dd40b8397ae617b322951a4bd8fe8a1eff9f920b79ddad1639da4d4a18c12ca3b65430e41506198483d5a2a0bc058269e7575cd6dc8d1a0393748622369c107b8a5fe570a7795d98b75e23d4c05c39655c8b81a389b512461a20711487695b8d4ff2d81ab4fe8c884768cbb99640a9ec5b54d3cd13a90f318e0264038b7f91dd73205342400eb9d186ed30286ff7cb9e459341ee59638b253148cfa74bada6b959f185b5cf68a313ff757836aafbbdf1f4440ec0f44d99c3950a6e2fdc6b7d8c6120f921630b93ec31c216e93e6b3781d02ef2339dbea56125ffe79019b1689c25d35db7d3f3e5c613060400977a2f7e142b50591b2ae5738dfd208c0f4daeda71edd05beaf4fc0b128fd004bd2bf1cea1d6883b4287cab96354e8f34f9d3707763b731686cbe6c175848a9f4bdd7c2961d270d9ef63ac95aa0603d3612a8933660c303fd1a91b3eb700718cdf40a34795399a7812c89b44f7b223dbe8bb08e0c01c4bf740c95431445a6b6fae337df7778e834813b34e0e6d3f0e935fdd136e6ac50c8e11fffb518b06c734985f31884a411293a3a3757a6e5be3d2495916314dc072fc9c0dbefcb5100513df15c18e04b2ad744d660f9cb5f4c64eead30fdd52507bba003c625108e6cdfcd7a1b38e8fd4fef0d419f695904be3026aeb9bab1ad3566a0a46a2a2d092c75ae2cbad109a117b7db76b729aaab3a89bcef8a5e63008613414fa5ce56988bbe3e839ccb8e192c56115522620e0851fbd19790f3acf9669915ef0f1ca0a2ca8a5578747f2d6cbec07a7bc4128ae131b7685191d5cf05210cc4bca2dc6303747c72cc0e4165512cccd43c5a79800b84ca018190a70984d73056e2a8bbdea91fdfcda72d9f8705227c5c4fdef9e0b81948420cae7344ba872a85e2d47c1e40fefcaa8d246fac5c7abe90b2bf39ec601390dd0a8cacbe82fc1ba0cf13c3cd89220a42e82ce62ccdf63fcb1be53c91d36349c7d3aa30170dccd5262d9ee570581ae5c9f84cf5b32261d8f531f6df0636cea496c698f36aee3274f0f9dfb7d72c074530a2679d13e5cc1bfcd957be3eba04a12f8897507122fc74ad66a7f621012ea43878cfa9a2a3ed95581aebdf1ffd7a8985f65c63de9eab4286cb94e57e3076e4e2850faef69b1d9f75ff45227b9e1bcc256c0236dc63483cffb8d72543eb213b2e0a487217850ab3bf7213dabb360c35714dbab5604357ea7b23fc0ba27d0bd09dc09e7ac471088c58d28e3ef12c3054d8a017a5023f378ae81bbbf55228620e061ace44906cc82520bfac2e1d7f7e340f53215bcf6f6078d82266abaaf479e084e73f0600572a7d482a84633eefc6e196f27638e8f08c6a4c615ef98238895d2cffb221a800424e115b0e84b960424fe39a2f33a203eb42f7f5e70e8f73aa172a8adf1d977b176cae2750859c96692bdac1067b7a1b1496dbd7c8220f3f0b42938ba0779c9bfa414a0e6073556d651d526875a4cfa95e8e981f40fc6d8bdd4704a12f44612e8eb8842535edea3d609d929b3fc05c2b02bd44e02a732ba814caf9e03e0bd7f41a24b3b6e282d07d74de2ab968ac739e994c0265416a7347f44bb80d1948cf8c9a69409e850b13f379dd672eb34a732b0b1d7b67ef2ee1bcb686cc4d1f4512c1ffb105ad2e46d783e0ca5f97ef9e4ab2798ce1c29b0f3292fbf1001d9487adfc3b34b4329be6b72ebf7a62158e488bd7888060f1e562045ecf9388c492fe3e0a6ce9b92b5a3eb29c80cc69da72f7dc2f2ac730e5d82cc5b75cecdd0809db8f1cc17bf5b72ed46fa3038722b6369d9f9497b83cc2ea1d0ebea0ac1306a83249705ae0b1c0145af67388d2153dbcb8856971216ee8f3d0cc6f532f159e5e28c6308154bf8efe46333b30740e9d94993393a27eb263dc0d19f182913ffa3953a52847fe979b9e682d304944529131b02ed468c88b5aac0483ff22ad56f9630b4f6134f266ee446068edd079411571f7e77acf2035d483043b8ad85b6277dca9e590ca801dc1896acdfc88dcf3cf83fca85afefe6addd27131f8be0fd5a80a0723556639fff59d56453ec76d3ebad3f5cb04e7b758b13e3d64c2ff5c3b018f52ba9363e053ee2fd78e35b2a834a069953e759455047521ad6615ab87e6381f0363a4554b86dd14f5ab43eb6b3fff64d94af0949a9e5c63d8c8e883886e61bd36f5ca11dfe2c025290cd49f369f8a3f9023d5daa7410fba96927fd0b5d2c75e", 0x2000, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x90, 0x0, 0x8, {0x5, 0x3, 0xfffffffffffffffd, 0x4000000000008, 0x6, 0x800081, {0xffffffffffffffff, 0xfffffffffffffffd, 0x8, 0x100000000001, 0x7, 0x39, 0x8, 0x6, 0x2008, 0xa000, 0xe44, r2, r3, 0x4, 0xfff}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) 2.578771671s ago: executing program 1 (id=4833): socket$nl_route(0x10, 0x3, 0x0) socket$nl_sock_diag(0x10, 0x3, 0x4) socket$nl_route(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet_sctp(0x2, 0x5, 0x84) socket$inet(0x10, 0x3, 0x0) r0 = socket$packet(0x11, 0x2, 0x300) socketpair(0x1, 0x3, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) bind$packet(r0, &(0x7f00000000c0)={0x11, 0x18, r2, 0x1, 0x81}, 0x14) setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x0, 0x0, 0xffffffff}, 0x1c) 2.392432051s ago: executing program 2 (id=4834): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000880)={0x4c, 0x0, &(0x7f00000006c0)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x50, 0x0, &(0x7f00000007c0)="6b8e0e307567b3dd5911e2396ced1c403284490fb328389824929522e40fa378fb329b13ee5cea56a721183ba5b0e2a7a5a0dbe6c6cb322d518f4e83051f819febbe60ea044d3ce9a7d468d12e6cf262"}) 2.296642324s ago: executing program 1 (id=4835): r0 = socket(0x10, 0x803, 0x0) write(r0, &(0x7f0000000340)="2600000022004701050007108980e8ff06006d20002b1ffec0e90101c7bb0000b00000000000", 0x26) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000d9bffc), 0x4) sendto(r0, &(0x7f0000000380)="120000001200e7ef007b00000000000000a1", 0x12, 0x20000090, 0x0, 0x0) recvmmsg(r0, 0x0, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f00000000c0)=[{{0x0, 0x0, 0x0}, 0xfffd}], 0x1, 0x10120, 0x0) 2.238920711s ago: executing program 2 (id=4836): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @broadcast}, 0x10) sendto$inet(r0, &(0x7f0000000140), 0xffffffffffffff58, 0x20008005, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) ppoll(&(0x7f0000000040)=[{r0, 0xd0c}, {r0, 0xc22}], 0x2, 0x0, 0x0, 0x0) recvfrom(r0, &(0x7f0000000480)=""/110, 0x168f6f3d, 0x734, 0x0, 0xfffffffffffffecb) 2.044627604s ago: executing program 2 (id=4837): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000003280)={0x73622a85, 0xa, 0x4}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000180)=[@increfs], 0x0, 0x0, 0x0}) dup3(r1, r0, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000540)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r2, 0x10000000000) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a, 0xfffffffffffffffd}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0xffffffffffffff67, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x70, 0x28, &(0x7f0000000800)={@ptr={0x66642a85, 0x0, 0x0, 0x0, 0x2, 0x1a}, @ptr={0x70742a85, 0x20000000, &(0x7f0000000580)=""/236, 0xec, 0x1, 0x26}, @fda={0x66646185, 0x9, 0x1, 0xb8}}, &(0x7f0000000240)={0x0, 0x28, 0x50}}, 0x1040}], 0x0, 0x0, 0x0}) 1.98322937s ago: executing program 1 (id=4838): socket$kcm(0x11, 0x200000000000002, 0x300) socket$netlink(0x10, 0x3, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) unshare(0x8000000) r2 = socket$packet(0x11, 0x3, 0x300) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$BATADV_CMD_GET_MESH(r4, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={0x0, 0x92}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r5, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}, 0x1, 0x0, 0x0, 0xc000}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=@newqdisc={0x44, 0x24, 0xe0b, 0xfefffffc, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0x9}, {0xffff, 0xffff}, {0x2}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x14, 0x2, [@TCA_CAKE_WASH={0x8, 0xd, 0x1}, @TCA_CAKE_DIFFSERV_MODE={0x8, 0x3, 0x3}]}}]}, 0x44}}, 0x0) sendto$packet(r2, &(0x7f00000002c0)="44c394f305916c4516999da288a8", 0xe, 0x0, &(0x7f0000000080)={0x11, 0x17, r5, 0x1, 0x0, 0x6, @multicast}, 0x14) semget$private(0x0, 0x4000, 0x0) setsockopt$inet6_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x29, 0x2d, &(0x7f00000001c0)={0xa, {{0xa, 0x4e20, 0x6, @local}}}, 0x84) socket$nl_generic(0x10, 0x3, 0x10) socket$netlink(0x10, 0x3, 0x15) open$dir(0x0, 0x2225c3, 0x0) r6 = syz_open_dev$video4linux(&(0x7f0000000080), 0x0, 0x0) ioctl$VIDIOC_SUBSCRIBE_EVENT(r6, 0x4020565a, &(0x7f0000000100)={0x3, 0x980900}) r7 = syz_open_dev$video4linux(&(0x7f0000000080), 0x0, 0x0) ioctl$VIDIOC_SUBSCRIBE_EVENT(r7, 0x4020565a, &(0x7f0000000280)={0x3, 0x980900, 0x2eae0342ca72d7ea}) ioctl$VIDIOC_QUERYMENU(r7, 0xc008561c, &(0x7f00000001c0)={0x980900, 0xfffffff2, @value=0x9}) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000040)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2, 0x9}}, './file0\x00'}) 1.866378279s ago: executing program 3 (id=4839): bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="010000"], 0x50) 1.816997621s ago: executing program 2 (id=4840): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb010018000000000000001c0000001c00000003000000010000000000000e0200000000000000000000000000000504000000002e"], 0x0, 0x37}, 0x20) r3 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f0000000080)=ANY=[], 0x0, 0x37}, 0x20) bpf$MAP_CREATE(0x0, &(0x7f0000004440)=@base={0x9, 0x4, 0x4, 0x7, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, r3, 0x2, 0x1}, 0x48) 1.625238473s ago: executing program 3 (id=4841): r0 = socket(0x10, 0x3, 0x0) getsockopt$sock_int(r0, 0x1, 0xb, 0x0, &(0x7f0000000280)) 1.354369649s ago: executing program 0 (id=4842): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000200)=@newlink={0x3c, 0x10, 0x437, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @macsec={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_MACSEC_ENCRYPT={0x5, 0x7, 0xd0}]}}}]}, 0x3c}}, 0x1020) 1.354184321s ago: executing program 3 (id=4843): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x4688, @local, 0x3}, 0x1c) socket$rds(0x15, 0x5, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000fc0)) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000fc0)) unshare(0x22020400) pselect6(0x39, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffff9, 0x0, 0x8, 0x0, 0x2}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x81, 0x0, 0x0, 0x7ffffffe}, 0x0, 0x0) 1.201865605s ago: executing program 0 (id=4844): prlimit64(0x0, 0xe, &(0x7f0000000180)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xffffe000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) fcntl$setown(r2, 0x8, r0) r3 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r3, 0x0, 0x482, &(0x7f0000000040)={0x84, @dev={0xac, 0x14, 0x14, 0xb}, 0x15, 0x3, 'sh\x00', 0x1, 0x4, 0x72}, 0x2c) setsockopt$IP_VS_SO_SET_EDITDEST(r3, 0x0, 0x489, &(0x7f0000000380)={{0x84, @multicast1, 0x4e20, 0x3, 'sh\x00', 0x0, 0x60000000, 0xc}, {@rand_addr=0x64010102, 0x4e26, 0x12002, 0x3, 0x8001, 0x1}}, 0x44) 1.191441148s ago: executing program 6 (id=4845): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000000140)={0x28, 0x19, 0x7, 0xd1, 0x30, 0x10, 0xaa, 0x6, 0xfd, 0x5, 0xc, 0x40, 0x0, 0x2}, 0xe) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000100)={0x0, 0x9}, &(0x7f0000000240)=0x8) 870.808603ms ago: executing program 6 (id=4846): r0 = socket$inet(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @empty}, 0x10) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r1 = io_uring_setup(0x56ab, &(0x7f0000000040)={0x0, 0x36d, 0xc000, 0xc, 0xa0002f5}) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) pwritev(0xffffffffffffffff, &(0x7f0000000240)=[{&(0x7f0000000000)='0', 0x1}], 0x1, 0x0, 0x3) io_uring_enter(r1, 0x2219, 0x7721, 0x16, 0x0, 0x0) 652.958038ms ago: executing program 6 (id=4847): r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) syz_usb_connect$uac1(0x0, 0xa4, &(0x7f0000001200)=ANY=[@ANYBLOB="2a01000020000040b7080080000000000301090292"], 0x0) 448.710399ms ago: executing program 1 (id=4848): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r0 = fsopen(&(0x7f00000014c0)='proc\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r2 = fsmount(r0, 0x0, 0x0) fchdir(r2) r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='.\x00', 0x101000, 0x108) getdents64(r3, &(0x7f0000000f80)=""/4096, 0x1000) 319.111779ms ago: executing program 3 (id=4849): syz_usb_connect(0x3, 0x24, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000cc1ef420890b070064ef000000010902120001000000000904"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f00000002c0), 0x1, 0x0) ioctl$DVB_DEMUX_DMX_SET_FILTER(r0, 0x403c6f2b, &(0x7f0000000200)={0x7, {"9db867d09ed91aa9c5c29f2f1e4be6bf", "cc6c2d12e0353c0e42899a29fdefe3bc", "9defe9f49655f386b84e6bb715dac54f"}, 0x445, 0x7}) ioctl$DVB_DEMUX_DMX_START(r0, 0x6f29) 80.255709ms ago: executing program 2 (id=4850): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) r1 = fcntl$dupfd(r0, 0x406, r0) sendto$inet(r0, 0x0, 0x0, 0x200047fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendmsg$TIPC_NL_NODE_GET(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000000c0)=ANY=[], 0x134}, 0x1, 0x0, 0x0, 0x40d0}, 0x1404cc09) write$binfmt_elf64(r1, &(0x7f0000000f80)=ANY=[], 0x540) syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r1) syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), r1) 0s ago: executing program 2 (id=4851): bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[], 0x50) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sched_setattr(0x0, 0x0, 0x0) execveat(0xffffffffffffff9c, 0x0, 0x0, 0x0, 0x0) syz_io_uring_setup(0x3af2, &(0x7f00000000c0)={0x0, 0xa5f5, 0x80, 0x2, 0x131}, &(0x7f0000000140), &(0x7f0000000180)) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x2, 0xe, &(0x7f0000000200)=ANY=[@ANYBLOB="b70000001f000000bca30000000000002403000020feffff620af0fff8ffffff71a4f2ff000000001f03000000000000e5000500000000002604fdffff02000014010000033800001d13f8ff000000007a0af0ff0000001f0f14000000000000b503f7fff80000009500000000000000033bc065b78111c6dfa041b63af4a3912435f1a864a7aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168e5181554a090f300020000fe275daf51efd601b6bf01c8e8b1b526375ee4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e65440000000000000000028610643a98d9ec21ead2ed51b104d4d91af25b845b9f7d08d123deda88c658d42ecbf28bf7076c15b463bebc72f526dd70252e79166d858fcd0e06dd31af9612fa402d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff61623604000000000000006a89adaf17b0a6041bdeebdfd1f5089048ddff6da40f9411fe7226a40409d6e37c4f46756d31cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564163427afea62d84f3a10076443d643649393bf52d2105bd901128c7e0ec82701c8204a1deeed4155617572652d950ad31928b0b036dc2869f478341d02d0f5ad94b081fcd507acb4b9c67382f13d000000225d85ae49cee383dc5049076b98fb6853ab39a21514da60d2ae20cfb91d6a49964757cdf538f9ce2bdbb9893a5de817101a3062cd54f9ff51d355d84ce97bb0c6b6a595e487a2cc47c0efbb2d71cde2c10f0bc6980fe78683ac5c0c31032599dd273863be9261eee52216d009f4c52048ef8c126aeef5f510a8f1aded94a129e4aec6e8d9ab06faffc3a15d91c2ea3e2e04cfe031b287539d0540059fe6c7fe7cd8697502c7596566d674e425da5e7f009602a9f61d3804b3e0a1053abdc31282dfb15eb6841bb64a1b3045024a982f3c48153baae244e7bf573eac34b781337ad5905c6bbf1137548c7f1a4cad2422ee965a38f7defbd2960242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a90144022a579dfc0229cc0dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc48899b212c55318294270a1ad10c80fef7c24d47afcc829ba0f85da6d888f18ea40ab959f6074ab2a40d85d1501783a7ab540b8d7b4ead35a385e0b4a26b702396df7e0c1e02b88c114f244a9bf93f04bf072f0861f5c0b000000000000eedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba3401e6a52acb11883ad2a3b1832371fe5bc621426d1ed01b389708165b9cdbae2ed9dc7358f0ebadde0b727f27feeb7464dcd857ab15e355713767c536cbae2f5c7d951680f6f2f9a6a8346962a350845ffa0d82884f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010ae20e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbada1ee7baa19faf67256b56a41fd355b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ced301efeb6dc5f6a9037d2283c42efc54fa84323afc4c10eff462c8843187f1dd48ef0981000000000000ff0f40b1888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538c6ee6ba65893ff1f908ba7554ba583ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738612e4fee18a22da19fc08001011e32f80fb60e14b9eee094277bbc170882c8890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f62e3f753b639a924599c1f69219927ea5301fff0a6063d427180d61542c2571f983e96635600000554f327a3535e7c7542799493c31ac05a7b57f03ca91a01ba2a30ca99e969d6fd09dc28ebc15edb4d91675767999d146aef7799738b292fd64bb25b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a794963342aece449a0d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b6ef9d12096833d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e1661261173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec035d232f89fe0120f64c62e8e3ed8bcb45202c204bbec8d722824c0ebca8db1ea4a05e41f6016ab5bbe4fe7ff5d785d0128171c90d9900ca2532b0f9d01c4b45294fbba468df3e1b393cb4e62e753b4172ba7ac1f2b51c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd849904568916694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a881192292ffff5392ab3d1311b82432662806add87047f601fa888400000000000000000000000000006acc19808d7cf29bc974b0ea92499a41b9b9a7c2bca311a28ee4952f2d325a56397c78f12205db653a536f9f3322405d1efd78e578dc6b3fb84f3738a4b6caa800000087efa51c5d95ecba4e50e529d1e8c89600e809dc3d0a2f65579e23457949a50f2d0455cf79a43746979f99f6a1527f004f1e37a3926937e84fb478199dc1020f4beb98b8074bf7df8b5e783637da740800000000000000c55a4385e9a617aa6c8e10d4202c5afeb06e2f9115558ea12f92d7ae633d44086b3f03b20d546fa66a72e38207c9d20035abc46271a30f1240de52536941242d23896ab74a3c6670fdc49c14f34fc4eadd6db8d80eba439772bf60a1db18c472dafc5569adc282928d2a1ffe29f1a57d3f18f4edaeb5d37918e6fddcd821da67a0785585a4443440dc65600e64a6a2740000000000000000000000000000000000000000000a0009dd14b38f2f4426d7cf5075047c31f6ce6adddfe3ac649c0643c8bfbeb14ba1fd7a485aa893915cf81e29aaf375e904bbe52691a4100260ffcd8f1d04166d291ebcef893e1b9ccb6797d0646fe0e7274434f28efb43e06e64f0698caca42f4e6018a455736c482a017e2b13dac4a90faa109f0e87cc94e3efb649692456463ca74aa6ad4bf50c1acb0000000000000005375e528285544d0064b98646f3109e9a4942ce42c6e7ec84b664f6c2770803f10baa804a707f0a1fcbfc309381aeba191950bae71f37f1eb7ceeffb3c0547ac6571603adbfde4c8b5f8d7f4b854441613633b48865b65bdc415e1e0dcf672d68cf4cebf04f4bc1eebf560a26d34d3757b1450fdb0a9a69f432e277f3a0386eb2bd3305c821c64757f786b79fef54dbe64c67d73934bc80b2133fb3c04cc7ea48bf97a6243c9f95dcbddecf45f008f1822c7868e1ff5a3cff5d6b6898335792749df7b1f51e91f8c1c3b1b93b33aaa3fab69cef08a9f6f6cf39dea3d878b2ed42545421970cc426e644332bc956d1c6adefdf0ede2c5c94aa632646ae225accdf031f611d01622921f1b922a5ac887cca3136133dce8d9f5f4da7bed2ea5d94362200000000000000000000f296b0c1484e5f781ad26bff696b05ff0a5e2270e07618b04273bd4075ea38ab463bfa6a38e7c537498ba3e4df8dfc9e040000003c3ffad44d2a376def42e41e9fc31678257e040fa7cf32c221aaac08000000000000001a00000000000000000000173570f0c11ae694b0f7a4f9c2f6790044a357e785af6e153d5f1ea460af92c7cbbd6295afe740f5e154346d483e0d641ef02e4d5295d756e110522a7a945b93fb705b95b6aae27a8fb33732ce1da1c0b1af8eb9222a06e984ab1e6984c8bdc12360627137ab67b6b68ab08acb29a74dc36b51209cfbc87f61182bbeb2772e9d5a1ffc477179be481efe46a4ce86be0b1d8eee42a611a3d44ca450b14586ed63dd92005c79e4a8ab8a94f0c6cb4bed8594a39bd76d3ef8a7ab014e787596db796bd93a36c2880423291e3bccc86f66ba792ff4d87b3f80e5908779e51c5e9055fc5b23605cd000c723187ef09dcf4b07b06a9342f3f62ee7acddff292082c1f4d8eb9561f80873a09a1ae0c9af1121175e5600f43a1179484502009759264a5729f07c2b218fa36ba2316a99aaad0130df83d0bda1e711290f78c143ea143967b00adcd77e6ad5e48d839ea61aadb83e4d071c54691924a3830d3e7b5c198bb0ed623153590000000000000000004b985ea1702f34f2f85b168c083e810ed567e3f1979b9ed1a4bf6a10dac825c96a0828b335de445a4880bb6474157efd1a72ca46ae4cbe3ab648c9bc4867a5a4cb87d7d6d55475b34b3cb6aa9e2337d4e04a37e35109752522ac9b186ddd80c47da6a2f4ef7bb909c975520000000000000000000000219cf5c1376ab33786f6b856d354e90a2733f78f2d188057cead3480eade49d55b770fad7fa000d23da6275768810b6b2df91d3a991ea98d929d271696c258d5b735d5db11df434e7dd1b7c1ca05cea3977df564115f4ec6ffab1d2ff8a642ca50934b3fbe44b0abeba9df209566984a29dfc0466e439a"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f00000000c0), 0x10}, 0x94) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x15) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) socket(0x10, 0x3, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f0000000180)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) r2 = syz_open_dev$dri(&(0x7f0000000c00), 0x1ff, 0x80800) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r2, 0xc04064a0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000240)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(r2, 0xc05064a7, &(0x7f0000000540)={0x0, 0x0, &(0x7f00000002c0)=[0x0], &(0x7f0000000cc0), 0x0, 0x1, 0x0, 0x0, r3}) kernel console output (not intermixed with test programs): ] ? __fget_files+0x2a/0x420 [ 1136.992110][T22066] __x64_sys_getsockopt+0x1a4/0x240 [ 1136.992126][T22066] do_syscall_64+0x14d/0xf80 [ 1136.992146][T22066] ? trace_irq_disable+0x3b/0x150 [ 1136.992156][T22066] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1136.992172][T22066] ? clear_bhb_loop+0x40/0x90 [ 1136.992185][T22066] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1136.992195][T22066] RIP: 0033:0x7f3aa979c799 [ 1136.992207][T22066] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1136.992217][T22066] RSP: 002b:00007f3aaa57f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 1136.992229][T22066] RAX: ffffffffffffffda RBX: 00007f3aa9a15fa0 RCX: 00007f3aa979c799 [ 1136.992237][T22066] RDX: 0000000000000070 RSI: 0000000000000084 RDI: 0000000000000003 [ 1136.992244][T22066] RBP: 00007f3aaa57f090 R08: 0000200000000280 R09: 0000000000000000 [ 1136.992251][T22066] R10: 0000200000000380 R11: 0000000000000246 R12: 0000000000000001 [ 1136.992260][T22066] R13: 00007f3aa9a16038 R14: 00007f3aa9a15fa0 R15: 00007f3aa9b3fa48 [ 1136.992275][T22066] [ 1138.958792][ T5885] usb 1-1: new full-speed USB device number 77 using dummy_hcd [ 1139.135583][ T5885] usb 1-1: config 0 has an invalid interface number: 133 but max is 0 [ 1139.153079][ T5885] usb 1-1: config 0 has no interface number 0 [ 1139.177650][ T5885] usb 1-1: config 0 interface 133 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1139.209243][ T5885] usb 1-1: New USB device found, idVendor=06cd, idProduct=0121, bcdDevice=dd.3d [ 1139.223104][ T5885] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1139.239122][ T5885] usb 1-1: Product: syz [ 1139.275278][ T5885] usb 1-1: Manufacturer: syz [ 1139.303564][ T5885] usb 1-1: SerialNumber: syz [ 1139.327304][ T5885] usb 1-1: config 0 descriptor?? [ 1139.561949][T22098] usb usb9: check_ctrlrecip: process 22098 (syz.0.4244) requesting ep 01 but needs 81 [ 1139.633100][T22098] usb usb9: usbfs: process 22098 (syz.0.4244) did not claim interface 0 before use [ 1139.711725][ T5885] keyspan 1-1:0.133: Keyspan 1 port adapter converter detected [ 1139.753039][ T5885] keyspan 1-1:0.133: unsupported endpoint type 0 [ 1139.761859][ T5885] keyspan 1-1:0.133: found no endpoint descriptor for endpoint 81 [ 1139.771221][T22098] netlink: 76 bytes leftover after parsing attributes in process `syz.0.4244'. [ 1139.782361][T22125] ptrace attach of "./syz-executor exec"[11062] was attempted by "./syz-executor exec"[22125] [ 1139.809683][ T5885] keyspan 1-1:0.133: found no endpoint descriptor for endpoint 1 [ 1139.818444][ T5885] keyspan 1-1:0.133: found no endpoint descriptor for endpoint 2 [ 1139.968860][ T5885] usb 1-1: Keyspan 1 port adapter converter now attached to ttyUSB0 [ 1139.985154][ T5885] usb 1-1: USB disconnect, device number 77 [ 1140.001333][ T5885] keyspan_1 ttyUSB0: Keyspan 1 port adapter converter now disconnected from ttyUSB0 [ 1140.040582][ T29] usb 4-1: new high-speed USB device number 70 using dummy_hcd [ 1140.130137][ T5953] usb 3-1: new high-speed USB device number 91 using dummy_hcd [ 1140.209133][ T5885] keyspan 1-1:0.133: device disconnected [ 1140.303059][ T5953] usb 3-1: Using ep0 maxpacket: 16 [ 1140.304646][ T29] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 9865, setting to 1024 [ 1140.323260][ T5953] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1140.334063][ T5953] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1140.335229][ T29] usb 4-1: New USB device found, idVendor=5543, idProduct=0064, bcdDevice= 0.00 [ 1140.381161][ T5953] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1140.394475][ T29] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1140.423169][ T29] usb 4-1: config 0 descriptor?? [ 1140.430115][T22122] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 1140.452626][ T5953] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 1140.482048][ T5953] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1140.592504][ T5953] usb 3-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1140.811265][ T5953] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1140.841122][ T5953] usb 3-1: Manufacturer: syz [ 1140.861787][ T5953] usb 3-1: config 0 descriptor?? [ 1141.181960][ T29] hid (null): unknown global tag 0xd [ 1141.197693][ T29] hid (null): invalid report_size 10679 [ 1141.238592][ T29] hid_parser_main: 74 callbacks suppressed [ 1141.238609][ T29] uclogic 0003:5543:0064.0040: unknown main item tag 0x0 [ 1141.267508][ T29] uclogic 0003:5543:0064.0040: unknown main item tag 0x0 [ 1141.286966][ T29] uclogic 0003:5543:0064.0040: unknown main item tag 0x0 [ 1141.301455][ T29] uclogic 0003:5543:0064.0040: unknown main item tag 0x0 [ 1141.305149][ T5953] rc_core: IR keymap rc-hauppauge not found [ 1141.315603][ T5953] Registered IR keymap rc-empty [ 1141.320943][ T5953] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 1141.332679][ T29] uclogic 0003:5543:0064.0040: unknown main item tag 0x0 [ 1141.348249][ T29] uclogic 0003:5543:0064.0040: unknown main item tag 0x0 [ 1141.363271][ T29] uclogic 0003:5543:0064.0040: unexpected long global item [ 1141.363296][ T5953] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 1141.386681][ T29] uclogic 0003:5543:0064.0040: parse failed [ 1141.398965][ T29] uclogic 0003:5543:0064.0040: probe with driver uclogic failed with error -22 [ 1141.428470][ T5953] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0 [ 1141.450191][ T29] usb 4-1: USB disconnect, device number 70 [ 1141.490154][ T5953] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0/input71 [ 1141.539268][ T5953] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 1141.583826][ T5953] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 1141.613173][ T5953] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 1141.633184][ T5953] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 1141.661112][ T5953] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 1141.713584][ T5953] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 1141.897230][ T5953] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 1141.957556][ T5953] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 1141.984615][ T5953] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 1142.013408][ T5953] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 1142.051633][ T5953] mceusb 3-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 1142.235893][ T5953] mceusb 3-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 1142.413784][T22147] ptrace attach of "./syz-executor exec"[21425] was attempted by "./syz-executor exec"[22147] [ 1143.867423][ T5908] usb 3-1: USB disconnect, device number 91 [ 1145.134516][T22181] FAULT_INJECTION: forcing a failure. [ 1145.134516][T22181] name failslab, interval 1, probability 0, space 0, times 0 [ 1145.165531][T22181] CPU: 1 UID: 0 PID: 22181 Comm: syz.1.4267 Tainted: G L syzkaller #0 PREEMPT(full) [ 1145.165553][T22181] Tainted: [L]=SOFTLOCKUP [ 1145.165557][T22181] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1145.165564][T22181] Call Trace: [ 1145.165569][T22181] [ 1145.165574][T22181] dump_stack_lvl+0xe8/0x150 [ 1145.165595][T22181] should_fail_ex+0x412/0x560 [ 1145.165614][T22181] should_failslab+0xa8/0x100 [ 1145.165630][T22181] __kmalloc_noprof+0xe8/0x760 [ 1145.165643][T22181] ? nft_set_elem_expr_alloc+0x1a5/0x5f0 [ 1145.165664][T22181] nft_set_elem_expr_alloc+0x1a5/0x5f0 [ 1145.165680][T22181] ? __pfx_nft_set_elem_expr_alloc+0x10/0x10 [ 1145.165705][T22181] ? kasan_quarantine_put+0xbb/0x1f0 [ 1145.165716][T22181] ? lockdep_hardirqs_on+0x7a/0x110 [ 1145.165731][T22181] nft_set_expr_alloc+0x4da/0x760 [ 1145.165826][T22181] nf_tables_newset+0x1c6b/0x2580 [ 1145.165845][T22181] ? __pfx_nf_tables_newset+0x10/0x10 [ 1145.165868][T22181] ? __nla_parse+0x40/0x60 [ 1145.165881][T22181] nfnetlink_rcv+0x1240/0x27b0 [ 1145.165912][T22181] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 1145.165934][T22181] ? ref_tracker_free+0x693/0x840 [ 1145.165969][T22181] ? __netlink_deliver_tap+0x807/0x850 [ 1145.165987][T22181] ? netlink_deliver_tap+0x2e/0x1b0 [ 1145.166013][T22181] netlink_unicast+0x80f/0x9b0 [ 1145.166032][T22181] ? __pfx_netlink_unicast+0x10/0x10 [ 1145.166048][T22181] ? netlink_sendmsg+0x650/0xb40 [ 1145.166056][T22181] ? skb_put+0x11b/0x210 [ 1145.166070][T22181] netlink_sendmsg+0x813/0xb40 [ 1145.166084][T22181] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1145.166095][T22181] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1145.166112][T22181] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1145.166136][T22181] ____sys_sendmsg+0x972/0x9f0 [ 1145.166162][T22181] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1145.166190][T22181] ? import_iovec+0x73/0xa0 [ 1145.166214][T22181] ___sys_sendmsg+0x2a5/0x360 [ 1145.166238][T22181] ? __pfx____sys_sendmsg+0x10/0x10 [ 1145.166289][T22181] ? __fget_files+0x2a/0x420 [ 1145.166315][T22181] ? __fget_files+0x3a0/0x420 [ 1145.166348][T22181] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1145.166374][T22181] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1145.166405][T22181] ? __pfx_ksys_write+0x10/0x10 [ 1145.166436][T22181] do_syscall_64+0x14d/0xf80 [ 1145.166456][T22181] ? trace_irq_disable+0x3b/0x150 [ 1145.166472][T22181] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1145.166490][T22181] ? clear_bhb_loop+0x40/0x90 [ 1145.166513][T22181] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1145.166532][T22181] RIP: 0033:0x7f85a579c799 [ 1145.166550][T22181] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1145.166566][T22181] RSP: 002b:00007f85a66dd028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1145.166587][T22181] RAX: ffffffffffffffda RBX: 00007f85a5a15fa0 RCX: 00007f85a579c799 [ 1145.166600][T22181] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 1145.166612][T22181] RBP: 00007f85a66dd090 R08: 0000000000000000 R09: 0000000000000000 [ 1145.166624][T22181] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1145.166633][T22181] R13: 00007f85a5a16038 R14: 00007f85a5a15fa0 R15: 00007f85a5b3fa48 [ 1145.166663][T22181] [ 1145.790591][T22188] loop5: detected capacity change from 0 to 7 [ 1145.824363][ C0] blk_print_req_error: 10 callbacks suppressed [ 1145.824392][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1145.840192][ C0] buffer_io_error: 27 callbacks suppressed [ 1145.840203][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 1145.855813][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1145.865422][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 1145.874853][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1145.884429][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 1145.894125][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1145.903696][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 1145.914053][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1145.923660][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 1145.949994][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1145.959681][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 1145.968576][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1145.978207][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 1146.003108][T22188] ldm_validate_partition_table(): Disk read failed. [ 1146.019155][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1146.028824][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 1146.048039][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1146.057649][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 1146.069043][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1146.078678][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 1146.087176][T22188] Dev loop5: unable to read RDB block 0 [ 1146.135314][T22188] loop5: unable to read partition table [ 1146.178909][T22188] loop5: partition table beyond EOD, truncated [ 1146.450071][T22188] loop_reread_partitions: partition scan of loop5 () failed (rc=-5) [ 1148.364763][T22221] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 1148.371244][T22221] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 1149.773452][T22242] netlink: 68 bytes leftover after parsing attributes in process `syz.6.4286'. [ 1150.973043][ T5825] usb 1-1: new full-speed USB device number 78 using dummy_hcd [ 1151.147189][ T5825] usb 1-1: config 0 interface 0 altsetting 251 endpoint 0x9 has an invalid bInterval 39, changing to 4 [ 1151.162772][ T5825] usb 1-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid maxpacket 15380, setting to 1023 [ 1151.183184][ T5825] usb 1-1: config 0 interface 0 has no altsetting 0 [ 1151.209813][ T30] audit: type=1326 audit(1774547276.683:2491): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22270 comm="syz.2.4295" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f048ad9c799 code=0x0 [ 1151.359740][T22273] netlink: 'syz.2.4295': attribute type 11 has an invalid length. [ 1151.518325][ T5825] usb 1-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 1151.583046][ T5825] usb 1-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 1151.591443][ T5825] usb 1-1: Product: syz [ 1151.595854][ T5825] usb 1-1: Manufacturer: syz [ 1151.600493][ T5825] usb 1-1: SerialNumber: syz [ 1151.764834][ T5825] usb 1-1: config 0 descriptor?? [ 1151.856586][ T5825] usb 1-1: selecting invalid altsetting 0 [ 1151.903397][T22295] netlink: 2 bytes leftover after parsing attributes in process `syz.1.4303'. [ 1151.951813][T22295] batadv_slave_1: entered promiscuous mode [ 1152.133497][T22291] netlink: 68 bytes leftover after parsing attributes in process `syz.2.4301'. [ 1152.204245][T22264] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1152.309507][T22296] netlink: 'syz.6.4302': attribute type 3 has an invalid length. [ 1152.321840][T22264] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1152.377147][ T5892] usb 1-1: USB disconnect, device number 78 [ 1153.358946][ T5825] usb 3-1: new full-speed USB device number 92 using dummy_hcd [ 1153.558235][ T5825] usb 3-1: New USB device found, idVendor=200c, idProduct=100b, bcdDevice= 0.40 [ 1153.573586][ T5825] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1153.599857][ T5825] usb 3-1: Product: syz [ 1153.642572][ T5825] usb 3-1: Manufacturer: syz [ 1153.647499][ T5825] usb 3-1: SerialNumber: syz [ 1153.984948][T22333] usb usb8: usbfs: process 22333 (syz.3.4309) did not claim interface 0 before use [ 1154.097304][ T5825] usb 3-1: unit 8 not found! [ 1154.103141][ T5825] usb 3-1: unit 6 not found! [ 1154.108462][ T5825] usb 3-1: unit 199 not found! [ 1154.113423][ T5825] usb 3-1: unit 208 not found! [ 1154.129599][T22330] netlink: 68 bytes leftover after parsing attributes in process `syz.0.4315'. [ 1154.142266][T22330] tipc: Failed to remove unknown binding: 66,1,1/0:1580199535/1580199537 [ 1154.194065][T22332] netlink: 'syz.6.4314': attribute type 3 has an invalid length. [ 1154.308782][ T5825] usb 3-1: USB disconnect, device number 92 [ 1154.363370][ T29] usb 4-1: new full-speed USB device number 71 using dummy_hcd [ 1154.607577][ T29] usb 4-1: config 3 has an invalid interface number: 3 but max is 1 [ 1154.616178][ T29] usb 4-1: config 3 has an invalid interface number: 50 but max is 1 [ 1154.679975][ T29] usb 4-1: config 3 has no interface number 0 [ 1154.692424][ T29] usb 4-1: config 3 has no interface number 1 [ 1154.703117][ T29] usb 4-1: config 3 interface 3 has no altsetting 0 [ 1154.710305][ T29] usb 4-1: config 3 interface 50 has no altsetting 0 [ 1154.730905][ T29] usb 4-1: New USB device found, idVendor=04da, idProduct=250d, bcdDevice=1d.43 [ 1154.743939][ T29] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1154.762323][ T29] usb 4-1: Product: syz [ 1154.863405][ T29] usb 4-1: Manufacturer: syz [ 1154.935057][ T29] usb 4-1: SerialNumber: syz [ 1154.974057][ T5953] usb 2-1: new high-speed USB device number 68 using dummy_hcd [ 1155.057376][T22350] mac80211_hwsim hwsim36 syzkaller0: left promiscuous mode [ 1155.078756][T22350] mac80211_hwsim hwsim36 syzkaller0: left allmulticast mode [ 1155.136830][ T5953] usb 2-1: config 48 interface 0 altsetting 98 bulk endpoint 0x4 has invalid maxpacket 1024 [ 1155.152439][ T5953] usb 2-1: config 48 interface 0 altsetting 98 has an endpoint descriptor with address 0x5A, changing to 0xA [ 1155.176600][ T5953] usb 2-1: config 48 interface 0 altsetting 98 endpoint 0xA has an invalid bInterval 0, changing to 7 [ 1155.207010][ T5953] usb 2-1: config 48 interface 0 altsetting 98 endpoint 0xA has invalid wMaxPacketSize 0 [ 1155.238378][ T5953] usb 2-1: config 48 interface 0 has no altsetting 0 [ 1155.257707][ T5953] usb 2-1: New USB device found, idVendor=1784, idProduct=0006, bcdDevice=bb.2f [ 1155.268742][ T5953] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1155.277049][ T5953] usb 2-1: Product: syz [ 1155.282834][ T5953] usb 2-1: Manufacturer: syz [ 1155.288617][ T5953] usb 2-1: SerialNumber: syz [ 1155.317712][T22340] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 1156.116183][ T5953] usb 2-1: USB disconnect, device number 68 [ 1156.452571][T22367] ptrace attach of "./syz-executor exec"[17662] was attempted by "./syz-executor exec"[22367] [ 1156.911119][ T29] usb 4-1: unknown number of interfaces: 2 [ 1157.016734][ T29] usb 4-1: USB disconnect, device number 71 [ 1157.062484][T21300] udevd[21300]: setting owner of /dev/bus/usb/004/071 to uid=0, gid=0 failed: No such file or directory [ 1157.756704][T22383] netlink: 68 bytes leftover after parsing attributes in process `syz.3.4328'. [ 1157.815520][T22383] tipc: Failed to remove unknown binding: 66,1,1/0:759557151/759557153 [ 1159.003452][T22401] FAULT_INJECTION: forcing a failure. [ 1159.003452][T22401] name failslab, interval 1, probability 0, space 0, times 0 [ 1159.036938][T22401] CPU: 1 UID: 0 PID: 22401 Comm: syz.0.4335 Tainted: G L syzkaller #0 PREEMPT(full) [ 1159.036959][T22401] Tainted: [L]=SOFTLOCKUP [ 1159.036963][T22401] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1159.036970][T22401] Call Trace: [ 1159.036974][T22401] [ 1159.036980][T22401] dump_stack_lvl+0xe8/0x150 [ 1159.037008][T22401] should_fail_ex+0x412/0x560 [ 1159.037027][T22401] should_failslab+0xa8/0x100 [ 1159.037042][T22401] __kmalloc_noprof+0xe8/0x760 [ 1159.037055][T22401] ? tomoyo_encode+0x28b/0x550 [ 1159.037069][T22401] tomoyo_encode+0x28b/0x550 [ 1159.037081][T22401] tomoyo_realpath_from_path+0x58d/0x5d0 [ 1159.037096][T22401] ? tomoyo_path_number_perm+0x219/0x630 [ 1159.037110][T22401] tomoyo_path_number_perm+0x246/0x630 [ 1159.037125][T22401] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1159.037141][T22401] ? __lock_acquire+0x6b5/0x2cf0 [ 1159.037161][T22401] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 1159.037184][T22401] ? __fget_files+0x2a/0x420 [ 1159.037202][T22401] ? __fget_files+0x2a/0x420 [ 1159.037216][T22401] ? __fget_files+0x3a0/0x420 [ 1159.037231][T22401] ? __fget_files+0x2a/0x420 [ 1159.037248][T22401] security_file_ioctl+0xc3/0x2a0 [ 1159.037263][T22401] __se_sys_ioctl+0x47/0x170 [ 1159.037277][T22401] do_syscall_64+0x14d/0xf80 [ 1159.037288][T22401] ? trace_irq_disable+0x3b/0x150 [ 1159.037297][T22401] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1159.037308][T22401] ? clear_bhb_loop+0x40/0x90 [ 1159.037321][T22401] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1159.037331][T22401] RIP: 0033:0x7f37b079c799 [ 1159.037342][T22401] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1159.037352][T22401] RSP: 002b:00007f37b16ed028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1159.037365][T22401] RAX: ffffffffffffffda RBX: 00007f37b0a15fa0 RCX: 00007f37b079c799 [ 1159.037373][T22401] RDX: 0000200000000280 RSI: 00000000c4c85512 RDI: 0000000000000003 [ 1159.037380][T22401] RBP: 00007f37b16ed090 R08: 0000000000000000 R09: 0000000000000000 [ 1159.037387][T22401] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1159.037393][T22401] R13: 00007f37b0a16038 R14: 00007f37b0a15fa0 R15: 00007f37b0b3fa48 [ 1159.037409][T22401] [ 1159.037421][T22401] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1160.156340][T22412] usb usb8: usbfs: process 22412 (syz.0.4338) did not claim interface 0 before use [ 1160.433107][ T5892] usb 1-1: new full-speed USB device number 79 using dummy_hcd [ 1160.661853][ T5892] usb 1-1: config 3 has an invalid interface number: 3 but max is 1 [ 1160.669977][ T5892] usb 1-1: config 3 has an invalid interface number: 50 but max is 1 [ 1160.678781][ T5892] usb 1-1: config 3 has no interface number 0 [ 1160.766619][ T5892] usb 1-1: config 3 has no interface number 1 [ 1160.800443][ T5892] usb 1-1: config 3 interface 3 has no altsetting 0 [ 1160.857890][ T5892] usb 1-1: config 3 interface 50 has no altsetting 0 [ 1160.918904][ T5892] usb 1-1: New USB device found, idVendor=04da, idProduct=250d, bcdDevice=1d.43 [ 1160.966913][ T5892] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1161.104316][ T5892] usb 1-1: Product: syz [ 1161.118935][ T5892] usb 1-1: Manufacturer: syz [ 1161.145992][ T5892] usb 1-1: SerialNumber: syz [ 1161.433535][T22428] netlink: 7064 bytes leftover after parsing attributes in process `syz.3.4344'. [ 1161.443603][T22428] openvswitch: netlink: EtherType 0 is less than min 600 [ 1161.626222][T22436] mac80211_hwsim hwsim36 syzkaller0: entered promiscuous mode [ 1161.634328][T22436] mac80211_hwsim hwsim36 syzkaller0: entered allmulticast mode [ 1161.729567][T22436] netlink: 16 bytes leftover after parsing attributes in process `syz.6.4346'. [ 1161.833997][T22440] netlink: 36 bytes leftover after parsing attributes in process `syz.3.4345'. [ 1161.868001][T22445] FAULT_INJECTION: forcing a failure. [ 1161.868001][T22445] name failslab, interval 1, probability 0, space 0, times 0 [ 1161.882130][T22445] CPU: 0 UID: 0 PID: 22445 Comm: syz.2.4348 Tainted: G L syzkaller #0 PREEMPT(full) [ 1161.882165][T22445] Tainted: [L]=SOFTLOCKUP [ 1161.882173][T22445] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1161.882187][T22445] Call Trace: [ 1161.882199][T22445] [ 1161.882205][T22445] dump_stack_lvl+0xe8/0x150 [ 1161.882226][T22445] should_fail_ex+0x412/0x560 [ 1161.882249][T22445] should_failslab+0xa8/0x100 [ 1161.882266][T22445] __kmalloc_cache_noprof+0x88/0x660 [ 1161.882280][T22445] ? nfnetlink_rcv+0xfe1/0x27b0 [ 1161.882297][T22445] nfnetlink_rcv+0xfe1/0x27b0 [ 1161.882328][T22445] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 1161.882350][T22445] ? ref_tracker_free+0x693/0x840 [ 1161.882380][T22445] ? __netlink_deliver_tap+0x807/0x850 [ 1161.882397][T22445] ? netlink_deliver_tap+0x2e/0x1b0 [ 1161.882420][T22445] netlink_unicast+0x80f/0x9b0 [ 1161.882439][T22445] ? __pfx_netlink_unicast+0x10/0x10 [ 1161.882455][T22445] ? netlink_sendmsg+0x650/0xb40 [ 1161.882464][T22445] ? skb_put+0x11b/0x210 [ 1161.882477][T22445] netlink_sendmsg+0x813/0xb40 [ 1161.882492][T22445] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1161.882503][T22445] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1161.882521][T22445] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1161.882535][T22445] ____sys_sendmsg+0x972/0x9f0 [ 1161.882553][T22445] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1161.882570][T22445] ? import_iovec+0x73/0xa0 [ 1161.882583][T22445] ___sys_sendmsg+0x2a5/0x360 [ 1161.882598][T22445] ? __pfx____sys_sendmsg+0x10/0x10 [ 1161.882627][T22445] ? __fget_files+0x2a/0x420 [ 1161.882643][T22445] ? __fget_files+0x3a0/0x420 [ 1161.882663][T22445] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1161.882676][T22445] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1161.882693][T22445] ? __pfx_ksys_write+0x10/0x10 [ 1161.882711][T22445] do_syscall_64+0x14d/0xf80 [ 1161.882724][T22445] ? trace_irq_disable+0x3b/0x150 [ 1161.882733][T22445] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1161.882751][T22445] ? clear_bhb_loop+0x40/0x90 [ 1161.882764][T22445] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1161.882774][T22445] RIP: 0033:0x7f048ad9c799 [ 1161.882785][T22445] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1161.882795][T22445] RSP: 002b:00007f048bd02028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1161.882807][T22445] RAX: ffffffffffffffda RBX: 00007f048b015fa0 RCX: 00007f048ad9c799 [ 1161.882815][T22445] RDX: 0000000020044804 RSI: 00002000000000c0 RDI: 0000000000000003 [ 1161.882822][T22445] RBP: 00007f048bd02090 R08: 0000000000000000 R09: 0000000000000000 [ 1161.882828][T22445] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1161.882834][T22445] R13: 00007f048b016038 R14: 00007f048b015fa0 R15: 00007f048b13fa48 [ 1161.882850][T22445] [ 1162.162608][T22440] netlink: 1 bytes leftover after parsing attributes in process `syz.3.4345'. [ 1162.943033][ T5864] usb 3-1: new high-speed USB device number 93 using dummy_hcd [ 1163.083093][ T5864] usb 3-1: device descriptor read/64, error -71 [ 1163.113947][ T5892] usb 1-1: unknown number of interfaces: 2 [ 1163.133912][ T5892] usb 1-1: USB disconnect, device number 79 [ 1163.323264][ T5864] usb 3-1: new high-speed USB device number 94 using dummy_hcd [ 1163.453066][ T5864] usb 3-1: device descriptor read/64, error -71 [ 1163.622523][ T5864] usb usb3-port1: attempt power cycle [ 1164.274434][T22466] netlink: 7064 bytes leftover after parsing attributes in process `syz.3.4355'. [ 1164.293221][ T5864] usb 3-1: new high-speed USB device number 95 using dummy_hcd [ 1164.312712][T22466] openvswitch: netlink: EtherType 0 is less than min 600 [ 1164.327213][ T5864] usb 3-1: device descriptor read/8, error -71 [ 1164.573568][ T5864] usb 3-1: new high-speed USB device number 96 using dummy_hcd [ 1164.603872][ T5864] usb 3-1: device descriptor read/8, error -71 [ 1164.723308][ T5864] usb usb3-port1: unable to enumerate USB device [ 1164.743635][ T5953] usb 2-1: new full-speed USB device number 69 using dummy_hcd [ 1164.894917][ T5953] usb 2-1: config 150 has an invalid interface number: 204 but max is 2 [ 1164.905725][ T5953] usb 2-1: config 150 has 2 interfaces, different from the descriptor's value: 3 [ 1164.923067][ T5953] usb 2-1: config 150 has no interface number 0 [ 1164.932237][ T5953] usb 2-1: too many endpoints for config 150 interface 1 altsetting 255: 255, using maximum allowed: 30 [ 1164.950206][ T5953] usb 2-1: config 150 interface 1 altsetting 255 has 0 endpoint descriptors, different from the interface descriptor's value: 255 [ 1164.985594][ T5953] usb 2-1: config 150 interface 204 has no altsetting 0 [ 1164.995989][ T5953] usb 2-1: config 150 interface 1 has no altsetting 0 [ 1165.008831][ T5953] usb 2-1: New USB device found, idVendor=04e2, idProduct=1424, bcdDevice=c7.eb [ 1165.018194][ T5953] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1165.033395][ T5953] usb 2-1: Product: syz [ 1165.037594][ T5953] usb 2-1: Manufacturer: syz [ 1165.042259][ T5953] usb 2-1: SerialNumber: syz [ 1165.057869][T22487] netlink: 'syz.3.4361': attribute type 3 has an invalid length. [ 1165.257020][ T5953] xr_serial 2-1:150.204: skipping garbage [ 1165.266920][ T5953] xr_serial 2-1:150.204: xr_serial converter detected [ 1165.787507][T22489] dvmrp1: entered allmulticast mode [ 1165.801171][T22488] dvmrp1: left allmulticast mode [ 1166.235780][ T5953] usb 2-1: xr_serial converter now attached to ttyUSB0 [ 1166.655193][T22503] netlink: 'syz.6.4365': attribute type 3 has an invalid length. [ 1166.718424][T22505] netlink: 7064 bytes leftover after parsing attributes in process `syz.0.4366'. [ 1166.727970][T22505] openvswitch: netlink: EtherType 0 is less than min 600 [ 1167.791783][ T29] usb 2-1: USB disconnect, device number 69 [ 1167.815626][ T29] xr_serial ttyUSB0: xr_serial converter now disconnected from ttyUSB0 [ 1167.881023][ T29] xr_serial 2-1:150.204: device disconnected [ 1167.919849][ T5892] usb 1-1: new full-speed USB device number 80 using dummy_hcd [ 1168.109531][ T5892] usb 1-1: unable to get BOS descriptor or descriptor too short [ 1168.130349][ T5892] usb 1-1: not running at top speed; connect to a high speed hub [ 1168.159951][ T5892] usb 1-1: New USB device found, idVendor=0dba, idProduct=5000, bcdDevice= 0.40 [ 1168.200088][ T5892] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1168.229339][ T5892] usb 1-1: Product: syz [ 1168.266640][ T5892] usb 1-1: Manufacturer: syz [ 1168.289797][ T5892] usb 1-1: SerialNumber: syz [ 1168.963386][ T5892] usb 1-1: MBOX3: Invalid descriptor size=18. [ 1168.991377][ T5892] usb 1-1: USB disconnect, device number 80 [ 1169.058508][T22540] loop4: detected capacity change from 0 to 7 [ 1169.092042][T21300] loop4: [CUMANA/ADFS] p1 [ADFS] p1 [ 1169.097591][T21300] loop4: partition table partially beyond EOD, truncated [ 1169.105387][T21300] loop4: p1 size 2989602745 extends beyond EOD, truncated [ 1169.300801][T22540] loop4: [CUMANA/ADFS] p1 [ADFS] p1 [ 1169.310605][T22540] loop4: partition table partially beyond EOD, truncated [ 1169.336682][T22540] loop4: p1 size 2989602745 extends beyond EOD, truncated [ 1169.487206][T21300] udevd[21300]: inotify_add_watch(7, /dev/loop4p1, 10) failed: No such file or directory [ 1169.642552][T21300] udevd[21300]: inotify_add_watch(7, /dev/loop4p1, 10) failed: No such file or directory [ 1170.347169][T22560] fuse: Unknown parameter 'grou00000000000000000000' [ 1170.643632][ T5953] usb 3-1: new high-speed USB device number 97 using dummy_hcd [ 1170.672575][T22567] netlink: 36 bytes leftover after parsing attributes in process `syz.3.4387'. [ 1170.730410][T22567] D`$: renamed from caif0 [ 1170.760366][T22567] A link change request failed with some changes committed already. Interface D`$ may have been left with an inconsistent configuration, please check. [ 1170.823488][ T5953] usb 3-1: Using ep0 maxpacket: 16 [ 1170.843036][ T5953] usb 3-1: unable to get BOS descriptor or descriptor too short [ 1170.855654][ T5953] usb 3-1: too many configurations: 208, using maximum allowed: 8 [ 1170.890043][ T5953] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 1170.904495][ T5953] usb 3-1: can't read configurations, error -61 [ 1171.054688][T22569] binder: 22568:22569 ioctl c0306201 200000000180 returned -14 [ 1171.093154][ T5953] usb 3-1: new high-speed USB device number 98 using dummy_hcd [ 1171.273819][ T5953] usb 3-1: Using ep0 maxpacket: 16 [ 1171.372412][ T5953] usb 3-1: unable to get BOS descriptor or descriptor too short [ 1171.438155][ T5953] usb 3-1: too many configurations: 208, using maximum allowed: 8 [ 1171.512857][ T5953] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 1171.543709][ T5953] usb 3-1: can't read configurations, error -61 [ 1171.563083][ T5885] usb 2-1: new high-speed USB device number 70 using dummy_hcd [ 1171.584125][ T5953] usb usb3-port1: attempt power cycle [ 1171.810187][ T5885] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1172.100960][ T5885] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1172.111402][ T5885] usb 2-1: Product: syz [ 1172.119282][ T5885] usb 2-1: Manufacturer: syz [ 1172.134718][ T5885] usb 2-1: SerialNumber: syz [ 1172.152114][ T5885] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1172.238712][ T5953] usb 3-1: new high-speed USB device number 99 using dummy_hcd [ 1172.265323][ T5953] usb 3-1: Using ep0 maxpacket: 16 [ 1172.273857][ T5953] usb 3-1: unable to get BOS descriptor or descriptor too short [ 1172.319543][ T5908] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1172.335688][ T5953] usb 3-1: too many configurations: 208, using maximum allowed: 8 [ 1172.377344][ T5953] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 1172.422132][ T5953] usb 3-1: can't read configurations, error -61 [ 1172.593086][ T5953] usb 3-1: new high-speed USB device number 100 using dummy_hcd [ 1172.623642][ T5953] usb 3-1: Using ep0 maxpacket: 16 [ 1172.633488][ T5953] usb 3-1: unable to get BOS descriptor or descriptor too short [ 1172.641922][ T5953] usb 3-1: too many configurations: 208, using maximum allowed: 8 [ 1172.653998][ T5953] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 1172.662315][ T5953] usb 3-1: can't read configurations, error -61 [ 1172.671173][ T5953] usb usb3-port1: unable to enumerate USB device [ 1173.044199][ T5885] usb 2-1: USB disconnect, device number 70 [ 1173.374414][ T5908] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 1173.389907][ T5908] ath9k_htc: Failed to initialize the device [ 1173.406015][ T5885] usb 2-1: ath9k_htc: USB layer deinitialized [ 1173.509125][T22597] FAULT_INJECTION: forcing a failure. [ 1173.509125][T22597] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1173.537616][T22598] netlink: 68 bytes leftover after parsing attributes in process `syz.3.4396'. [ 1173.571555][T22597] CPU: 1 UID: 0 PID: 22597 Comm: syz.2.4397 Tainted: G L syzkaller #0 PREEMPT(full) [ 1173.571576][T22597] Tainted: [L]=SOFTLOCKUP [ 1173.571581][T22597] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1173.571587][T22597] Call Trace: [ 1173.571592][T22597] [ 1173.571597][T22597] dump_stack_lvl+0xe8/0x150 [ 1173.571618][T22597] should_fail_ex+0x412/0x560 [ 1173.571636][T22597] _copy_from_user+0x2d/0xb0 [ 1173.571653][T22597] ___sys_recvmsg+0x175/0x590 [ 1173.571666][T22597] ? __lock_acquire+0x6b5/0x2cf0 [ 1173.571682][T22597] ? __pfx____sys_recvmsg+0x10/0x10 [ 1173.571711][T22597] do_recvmmsg+0x334/0x800 [ 1173.571728][T22597] ? __pfx_do_recvmmsg+0x10/0x10 [ 1173.571745][T22597] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1173.571767][T22597] __x64_sys_recvmmsg+0x198/0x250 [ 1173.571781][T22597] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 1173.571799][T22597] do_syscall_64+0x14d/0xf80 [ 1173.571811][T22597] ? trace_irq_disable+0x3b/0x150 [ 1173.571820][T22597] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1173.571831][T22597] ? clear_bhb_loop+0x40/0x90 [ 1173.571844][T22597] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1173.571854][T22597] RIP: 0033:0x7f048ad9c799 [ 1173.571865][T22597] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1173.571874][T22597] RSP: 002b:00007f048bd02028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 1173.571888][T22597] RAX: ffffffffffffffda RBX: 00007f048b015fa0 RCX: 00007f048ad9c799 [ 1173.571895][T22597] RDX: 03ffffffffffff67 RSI: 0000200000002440 RDI: 0000000000000004 [ 1173.571903][T22597] RBP: 00007f048bd02090 R08: 0000000000000000 R09: 0000000000000000 [ 1173.571910][T22597] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1173.571916][T22597] R13: 00007f048b016038 R14: 00007f048b015fa0 R15: 00007f048b13fa48 [ 1173.571931][T22597] [ 1174.370772][T22603] netlink: 7064 bytes leftover after parsing attributes in process `syz.2.4399'. [ 1174.466920][T22605] netlink: 'syz.1.4398': attribute type 3 has an invalid length. [ 1174.510816][T22603] openvswitch: netlink: EtherType 0 is less than min 600 [ 1175.485916][T22620] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4402'. [ 1175.983404][ T5945] usb 3-1: new full-speed USB device number 101 using dummy_hcd [ 1176.157334][ T5945] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 1176.204024][T22628] usb usb8: usbfs: process 22628 (syz.1.4406) did not claim interface 0 before use [ 1176.242229][ T5945] usb 3-1: config 0 has no interface number 0 [ 1176.253185][ T5945] usb 3-1: config 0 interface 1 altsetting 128 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 1176.336776][ T5945] usb 3-1: config 0 interface 1 altsetting 128 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1176.357593][ T5945] usb 3-1: config 0 interface 1 altsetting 128 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1176.402767][ T5945] usb 3-1: config 0 interface 1 has no altsetting 0 [ 1176.425395][ T5945] usb 3-1: New USB device found, idVendor=145f, idProduct=0212, bcdDevice= 0.00 [ 1176.489688][T22634] fuse: Unknown parameter 'grou00000000000000000000' [ 1176.523062][ T29] usb 2-1: new full-speed USB device number 71 using dummy_hcd [ 1176.583479][ T5945] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1176.631245][ T5945] usb 3-1: config 0 descriptor?? [ 1176.736498][ T29] usb 2-1: config 3 has an invalid interface number: 3 but max is 1 [ 1176.763867][ T29] usb 2-1: config 3 has an invalid interface number: 50 but max is 1 [ 1176.783349][ T29] usb 2-1: config 3 has no interface number 0 [ 1176.789510][ T29] usb 2-1: config 3 has no interface number 1 [ 1176.799169][ T29] usb 2-1: config 3 interface 3 has no altsetting 0 [ 1176.833098][ T29] usb 2-1: config 3 interface 50 has no altsetting 0 [ 1176.870668][ T29] usb 2-1: New USB device found, idVendor=04da, idProduct=250d, bcdDevice=1d.43 [ 1176.886778][ T29] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1176.912419][ T29] usb 2-1: Product: syz [ 1176.951960][ T29] usb 2-1: Manufacturer: syz [ 1176.965640][ T29] usb 2-1: SerialNumber: syz [ 1177.140649][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 1177.151591][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 1177.338899][ T5945] uclogic 0003:145F:0212.0041: pen parameters not found [ 1177.359837][ T5945] uclogic 0003:145F:0212.0041: interface is invalid, ignoring [ 1177.376224][T22640] loop5: detected capacity change from 0 to 7 [ 1177.417485][ C0] blk_print_req_error: 10 callbacks suppressed [ 1177.417506][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1177.433286][ C0] buffer_io_error: 10 callbacks suppressed [ 1177.433304][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 1177.448287][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1177.457899][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 1177.478976][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1177.488621][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 1177.497100][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1177.506708][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 1177.516059][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1177.525654][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 1177.545123][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1177.554755][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 1177.563118][ T5945] usb 3-1: USB disconnect, device number 101 [ 1177.574084][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1177.583760][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 1177.591730][T22640] ldm_validate_partition_table(): Disk read failed. [ 1177.605604][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1177.615210][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 1177.623304][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1177.633011][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 1177.644780][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1177.654427][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 1177.662733][T22640] Dev loop5: unable to read RDB block 0 [ 1177.673399][T22640] loop5: unable to read partition table [ 1177.713319][T22640] loop5: partition table beyond EOD, truncated [ 1177.719818][T22640] loop_reread_partitions: partition scan of loop5 () failed (rc=-5) [ 1178.137318][T22644] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4410'. [ 1178.587688][T22649] netlink: 'syz.2.4411': attribute type 3 has an invalid length. [ 1179.259164][ T29] usb 2-1: unknown number of interfaces: 2 [ 1179.259477][T22656] FAULT_INJECTION: forcing a failure. [ 1179.259477][T22656] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1179.308841][T22656] CPU: 0 UID: 0 PID: 22656 Comm: syz.3.4413 Tainted: G L syzkaller #0 PREEMPT(full) [ 1179.308869][T22656] Tainted: [L]=SOFTLOCKUP [ 1179.308873][T22656] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1179.308880][T22656] Call Trace: [ 1179.308885][T22656] [ 1179.308890][T22656] dump_stack_lvl+0xe8/0x150 [ 1179.308911][T22656] should_fail_ex+0x412/0x560 [ 1179.308930][T22656] _copy_from_iter+0x1d3/0x1670 [ 1179.308954][T22656] ? __pfx__copy_from_iter+0x10/0x10 [ 1179.308968][T22656] ? sock_alloc_send_pskb+0x896/0x990 [ 1179.308985][T22656] ? __pfx__copy_from_iter+0x10/0x10 [ 1179.309002][T22656] ? page_copy_sane+0x16a/0x270 [ 1179.309013][T22656] copy_page_from_iter+0xdd/0x170 [ 1179.309025][T22656] skb_copy_datagram_from_iter+0x306/0x710 [ 1179.309045][T22656] tun_get_user+0xc38/0x3dd0 [ 1179.309064][T22656] ? aa_file_perm+0x192/0x15e0 [ 1179.309077][T22656] ? aa_file_perm+0x50e/0x15e0 [ 1179.309086][T22656] ? __pfx_tun_get_user+0x10/0x10 [ 1179.309096][T22656] ? aa_file_perm+0x192/0x15e0 [ 1179.309108][T22656] ? __lock_acquire+0x6b5/0x2cf0 [ 1179.309133][T22656] ? ref_tracker_alloc+0x35c/0x4c0 [ 1179.309150][T22656] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 1179.309169][T22656] ? tun_get+0x1c/0x2f0 [ 1179.309182][T22656] ? tun_get+0x1c/0x2f0 [ 1179.309192][T22656] ? tun_get+0x1c/0x2f0 [ 1179.309204][T22656] tun_chr_write_iter+0x113/0x200 [ 1179.309217][T22656] vfs_write+0x61d/0xb90 [ 1179.309233][T22656] ? __pfx_vfs_write+0x10/0x10 [ 1179.309248][T22656] ? __fget_files+0x2a/0x420 [ 1179.309268][T22656] ksys_write+0x150/0x270 [ 1179.309281][T22656] ? __pfx_ksys_write+0x10/0x10 [ 1179.309297][T22656] do_syscall_64+0x14d/0xf80 [ 1179.309310][T22656] ? trace_irq_disable+0x3b/0x150 [ 1179.309319][T22656] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1179.309330][T22656] ? clear_bhb_loop+0x40/0x90 [ 1179.309342][T22656] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1179.309353][T22656] RIP: 0033:0x7f778df9c799 [ 1179.309364][T22656] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1179.309373][T22656] RSP: 002b:00007f778ee24028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1179.309387][T22656] RAX: ffffffffffffffda RBX: 00007f778e216090 RCX: 00007f778df9c799 [ 1179.309395][T22656] RDX: 000000000000fd6c RSI: 0000200000000280 RDI: 0000000000000003 [ 1179.309402][T22656] RBP: 00007f778ee24090 R08: 0000000000000000 R09: 0000000000000000 [ 1179.309408][T22656] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1179.309414][T22656] R13: 00007f778e216128 R14: 00007f778e216090 R15: 00007f778e33fa48 [ 1179.309430][T22656] [ 1179.650267][ T29] usb 2-1: USB disconnect, device number 71 [ 1180.512206][T22660] netlink: 68 bytes leftover after parsing attributes in process `syz.1.4414'. [ 1180.531044][T22660] tipc: Failed to remove unknown binding: 66,1,1/0:2456464710/2456464712 [ 1180.766735][T22678] syzkaller1: entered promiscuous mode [ 1180.772341][T22678] syzkaller1: entered allmulticast mode [ 1180.778974][T22672] sctp: [Deprecated]: syz.3.4418 (pid 22672) Use of int in max_burst socket option. [ 1180.778974][T22672] Use struct sctp_assoc_value instead [ 1180.883154][ T5945] usb 3-1: new full-speed USB device number 102 using dummy_hcd [ 1181.215311][ T5945] usb 3-1: New USB device found, idVendor=174f, idProduct=6a31, bcdDevice=26.3f [ 1181.253458][ T5945] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1181.275622][ T5945] usb 3-1: Product: syz [ 1181.279837][ T5945] usb 3-1: Manufacturer: syz [ 1181.295891][ T5945] usb 3-1: SerialNumber: syz [ 1181.351017][ T5945] usb 3-1: config 0 descriptor?? [ 1181.368280][ T5945] gspca_main: stk1135-2.14.0 probing 174f:6a31 [ 1181.483177][ T29] usb 4-1: new high-speed USB device number 72 using dummy_hcd [ 1181.652578][ T29] usb 4-1: Using ep0 maxpacket: 32 [ 1181.664446][ T29] usb 4-1: config 0 has an invalid interface number: 12 but max is 0 [ 1181.682917][ T29] usb 4-1: config 0 has no interface number 0 [ 1181.689118][ T29] usb 4-1: config 0 interface 12 has no altsetting 0 [ 1181.709540][ T29] usb 4-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 1181.719036][ T29] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1182.165616][ T5945] gspca_stk1135: reg_w 0x2 err -110 [ 1182.172189][ T5945] gspca_stk1135: serial bus timeout: status=0x00 [ 1182.178742][ T5945] gspca_stk1135: Sensor write failed [ 1182.184317][ T5945] gspca_stk1135: serial bus timeout: status=0x00 [ 1182.190678][ T5945] gspca_stk1135: Sensor write failed [ 1182.203927][ T5945] gspca_stk1135: serial bus timeout: status=0x00 [ 1182.210394][ T5945] gspca_stk1135: Sensor read failed [ 1182.215697][ T5945] gspca_stk1135: serial bus timeout: status=0x00 [ 1182.216260][ T29] usb 4-1: Product: syz [ 1182.222144][ T5945] gspca_stk1135: Sensor read failed [ 1182.267499][ T29] usb 4-1: Manufacturer: syz [ 1182.272137][ T29] usb 4-1: SerialNumber: syz [ 1182.313021][ T5945] gspca_stk1135: Detected sensor type unknown (0x0) [ 1182.330307][ T5945] gspca_stk1135: serial bus timeout: status=0x00 [ 1182.353121][ T5945] gspca_stk1135: Sensor read failed [ 1182.363133][ T5945] gspca_stk1135: serial bus timeout: status=0x00 [ 1182.390657][ T29] usb 4-1: config 0 descriptor?? [ 1182.422689][ T5945] gspca_stk1135: Sensor read failed [ 1182.472642][T22698] usb usb8: usbfs: process 22698 (syz.0.4421) did not claim interface 0 before use [ 1182.517855][ T5945] gspca_stk1135: serial bus timeout: status=0x00 [ 1182.523227][ T5908] usb 2-1: new full-speed USB device number 72 using dummy_hcd [ 1182.533253][ T5945] gspca_stk1135: Sensor write failed [ 1182.553204][ T5945] gspca_stk1135: serial bus timeout: status=0x00 [ 1182.579843][ T5945] gspca_stk1135: Sensor write failed [ 1182.593173][ T5945] stk1135 3-1:0.0: probe with driver stk1135 failed with error -110 [ 1182.827753][ T5908] usb 2-1: config 0 interface 0 altsetting 251 endpoint 0x9 has an invalid bInterval 39, changing to 4 [ 1182.843097][ T5906] usb 1-1: new full-speed USB device number 81 using dummy_hcd [ 1182.876679][ T5908] usb 2-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid maxpacket 15380, setting to 1023 [ 1182.935009][ T5908] usb 2-1: config 0 interface 0 has no altsetting 0 [ 1182.947817][ T5908] usb 2-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 1182.958774][ T5908] usb 2-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 1183.003383][ T5908] usb 2-1: Product: syz [ 1183.007623][ T5908] usb 2-1: Manufacturer: syz [ 1183.012753][ T5908] usb 2-1: SerialNumber: syz [ 1183.020940][ T5906] usb 1-1: config 3 has an invalid interface number: 3 but max is 1 [ 1183.029697][ T5906] usb 1-1: config 3 has an invalid interface number: 50 but max is 1 [ 1183.038634][ T5906] usb 1-1: config 3 has no interface number 0 [ 1183.108474][ T5908] usb 2-1: config 0 descriptor?? [ 1183.116870][ T5906] usb 1-1: config 3 has no interface number 1 [ 1183.143608][ T5906] usb 1-1: config 3 interface 3 has no altsetting 0 [ 1183.154438][ T5908] usb 2-1: selecting invalid altsetting 0 [ 1183.168821][ T29] f81534 4-1:0.12: f81534_get_register: reg: 1003 failed: -71 [ 1183.176526][ T29] f81534 4-1:0.12: f81534_find_config_idx: read failed: -71 [ 1183.209371][ T5906] usb 1-1: config 3 interface 50 has no altsetting 0 [ 1183.218353][ T29] f81534 4-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 1183.273680][ T5906] usb 1-1: New USB device found, idVendor=04da, idProduct=250d, bcdDevice=1d.43 [ 1183.303051][ T29] f81534 4-1:0.12: probe with driver f81534 failed with error -71 [ 1183.316762][ T5906] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1183.344488][ T29] usb 4-1: USB disconnect, device number 72 [ 1183.357269][ T5906] usb 1-1: Product: syz [ 1183.384417][ T5906] usb 1-1: Manufacturer: syz [ 1183.395717][T22695] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1183.417997][ T5906] usb 1-1: SerialNumber: syz [ 1183.486926][T22695] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1183.740524][T22695] snd-usb-audio 2-1:0.0: Runtime PM usage count underflow! [ 1183.752058][ T29] usb 2-1: USB disconnect, device number 72 [ 1184.138683][ T5945] usb 3-1: USB disconnect, device number 102 [ 1184.170900][T22709] tipc: Started in network mode [ 1184.177281][T22709] tipc: Node identity , cluster identity 4711 [ 1184.187622][T22709] tipc: Failed to obtain node identity [ 1184.195158][T22709] tipc: Enabling of bearer rejected, failed to enable media [ 1184.256276][T22710] fuse: Unknown parameter 'grou00000000000000000000' [ 1184.391433][T22714] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1184.559895][ T30] audit: type=1326 audit(1774547310.033:2492): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22713 comm="syz.3.4428" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f778df9c799 code=0x7ffc0000 [ 1184.585645][ T30] audit: type=1326 audit(1774547310.033:2493): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22713 comm="syz.3.4428" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f778df9c799 code=0x7ffc0000 [ 1184.722282][ T30] audit: type=1326 audit(1774547310.033:2494): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22713 comm="syz.3.4428" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f778df5cfce code=0x7ffc0000 [ 1184.811518][ T30] audit: type=1326 audit(1774547310.033:2495): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22713 comm="syz.3.4428" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f778df9c799 code=0x7ffc0000 [ 1184.913673][ T30] audit: type=1326 audit(1774547310.033:2496): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22713 comm="syz.3.4428" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f778df9c799 code=0x7ffc0000 [ 1185.018412][ T30] audit: type=1326 audit(1774547310.063:2497): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22713 comm="syz.3.4428" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f778df9c799 code=0x7ffc0000 [ 1185.082588][T22729] netlink: 'syz.3.4431': attribute type 5 has an invalid length. [ 1185.095057][ T30] audit: type=1326 audit(1774547310.063:2498): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22713 comm="syz.3.4428" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f778df9c799 code=0x7ffc0000 [ 1185.173661][ T5906] usb 1-1: unknown number of interfaces: 2 [ 1185.216661][ T5906] usb 1-1: USB disconnect, device number 81 [ 1185.273078][ T30] audit: type=1326 audit(1774547310.063:2499): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22713 comm="syz.3.4428" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f778df9c799 code=0x7ffc0000 [ 1185.364291][ T30] audit: type=1326 audit(1774547310.173:2500): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22713 comm="syz.3.4428" exe="/root/syz-executor" sig=0 arch=c000003e syscall=127 compat=0 ip=0x7f778df9c799 code=0x7ffc0000 [ 1185.444300][T22736] syzkaller1: entered promiscuous mode [ 1185.449812][T22736] syzkaller1: entered allmulticast mode [ 1185.457557][ T30] audit: type=1326 audit(1774547310.173:2501): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22713 comm="syz.3.4428" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f778df9c799 code=0x7ffc0000 [ 1185.970546][ T5906] usb 4-1: new high-speed USB device number 73 using dummy_hcd [ 1186.008433][T22747] netlink: 40 bytes leftover after parsing attributes in process `syz.1.4436'. [ 1186.102487][T22750] netlink: 'syz.2.4437': attribute type 29 has an invalid length. [ 1186.145345][ T5906] usb 4-1: Using ep0 maxpacket: 32 [ 1186.157374][T22750] netlink: 'syz.2.4437': attribute type 29 has an invalid length. [ 1186.184346][ T5906] usb 4-1: config 0 has an invalid interface number: 184 but max is 0 [ 1186.223719][ T5906] usb 4-1: config 0 has no interface number 0 [ 1186.443285][ T5906] usb 4-1: config 0 interface 184 has no altsetting 0 [ 1186.457319][ T5906] usb 4-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 1186.468157][ T5906] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1186.478724][T22750] netlink: 'syz.2.4437': attribute type 29 has an invalid length. [ 1186.486726][ T5906] usb 4-1: Product: syz [ 1186.491019][ T5906] usb 4-1: Manufacturer: syz [ 1186.523028][ T5906] usb 4-1: SerialNumber: syz [ 1186.538205][ T5906] usb 4-1: config 0 descriptor?? [ 1186.844021][ T5945] usb 2-1: new high-speed USB device number 73 using dummy_hcd [ 1187.005039][ T5953] usb 1-1: new high-speed USB device number 82 using dummy_hcd [ 1187.012780][ T5945] usb 2-1: Using ep0 maxpacket: 16 [ 1187.013204][ T29] usb 3-1: new full-speed USB device number 103 using dummy_hcd [ 1187.038996][ T5945] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1187.050621][ T5945] usb 2-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 1187.065691][ T5945] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1187.076537][ T5945] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1187.085054][ T5945] usb 2-1: Manufacturer: syz [ 1187.101927][ T5945] usb 2-1: config 0 descriptor?? [ 1187.190138][ T5906] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 1187.203071][ T5953] usb 1-1: Using ep0 maxpacket: 16 [ 1187.213534][T22740] 8021q: VLANs not supported on ip_vti0 [ 1187.243120][ T29] usb 3-1: config 0 interface 0 altsetting 251 endpoint 0x9 has an invalid bInterval 39, changing to 4 [ 1187.261051][ T5953] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1187.284607][ T5953] usb 1-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 9 [ 1187.315043][ T5953] usb 1-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 1187.324325][ T5906] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 1187.333634][ T29] usb 3-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid maxpacket 15380, setting to 1023 [ 1187.345736][ T29] usb 3-1: config 0 interface 0 has no altsetting 0 [ 1187.359373][ T29] usb 3-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 1187.369155][ T29] usb 3-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 1187.381262][ T29] usb 3-1: Product: syz [ 1187.385725][ T29] usb 3-1: Manufacturer: syz [ 1187.389649][ T5953] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1187.390362][ T29] usb 3-1: SerialNumber: syz [ 1187.408502][ T29] usb 3-1: config 0 descriptor?? [ 1187.443521][ T5953] usb 1-1: config 0 descriptor?? [ 1187.460016][ T29] usb 3-1: selecting invalid altsetting 0 [ 1187.513888][ T5953] usbhid 1-1:0.0: couldn't find an input interrupt endpoint [ 1187.586378][ T5906] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000010: -61 [ 1187.603085][ T5906] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Failed to read HW_CFG: -61 [ 1187.616707][ T5906] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -61 [ 1187.626710][ T5906] smsc75xx 4-1:0.184: probe with driver smsc75xx failed with error -61 [ 1187.792635][ T29] usb 1-1: USB disconnect, device number 82 [ 1187.804462][T22758] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1187.827352][T22758] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1187.848419][ T5892] usb 2-1: USB disconnect, device number 73 [ 1187.873999][ T5906] usb 3-1: USB disconnect, device number 103 [ 1188.840202][T22780] usb usb8: usbfs: process 22780 (syz.0.4443) did not claim interface 0 before use [ 1189.143008][ T5953] usb 1-1: new full-speed USB device number 83 using dummy_hcd [ 1189.325875][ T5953] usb 1-1: config 3 has an invalid interface number: 3 but max is 1 [ 1189.356114][ T5953] usb 1-1: config 3 has an invalid interface number: 50 but max is 1 [ 1189.389089][ T5953] usb 1-1: config 3 has no interface number 0 [ 1189.417925][ T5953] usb 1-1: config 3 has no interface number 1 [ 1189.438817][ T5953] usb 1-1: config 3 interface 3 has no altsetting 0 [ 1189.465071][ T5953] usb 1-1: config 3 interface 50 has no altsetting 0 [ 1189.507439][ T5953] usb 1-1: New USB device found, idVendor=04da, idProduct=250d, bcdDevice=1d.43 [ 1189.536898][ T5953] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1189.558036][ T5945] usb 4-1: USB disconnect, device number 73 [ 1189.579055][ T5953] usb 1-1: Product: syz [ 1189.600662][ T5953] usb 1-1: Manufacturer: syz [ 1189.624797][ T5953] usb 1-1: SerialNumber: syz [ 1189.748457][T22785] usb usb8: usbfs: process 22785 (syz.6.4445) did not claim interface 0 before use [ 1190.002479][T22788] syzkaller1: entered promiscuous mode [ 1190.017013][T22788] syzkaller1: entered allmulticast mode [ 1191.149094][T22811] fuse: Unknown parameter 'grou00000000000000000000' [ 1191.483104][ T5892] usb 3-1: new high-speed USB device number 104 using dummy_hcd [ 1191.752545][ T5892] usb 3-1: Using ep0 maxpacket: 16 [ 1191.768667][ T5953] usb 1-1: unknown number of interfaces: 2 [ 1191.810691][ T5953] usb 1-1: USB disconnect, device number 83 [ 1191.851579][ T5892] usb 3-1: unable to get BOS descriptor or descriptor too short [ 1191.911950][ T5892] usb 3-1: too many configurations: 208, using maximum allowed: 8 [ 1192.033003][ T5892] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 1192.073427][ T5892] usb 3-1: can't read configurations, error -61 [ 1192.353095][ T5892] usb 3-1: new high-speed USB device number 105 using dummy_hcd [ 1192.379810][T22817] netlink: 68 bytes leftover after parsing attributes in process `syz.0.4452'. [ 1192.524394][T22817] tipc: Failed to remove unknown binding: 66,1,1/0:4082063485/4082063487 [ 1192.573176][ T5892] usb 3-1: Using ep0 maxpacket: 16 [ 1192.616136][ T5892] usb 3-1: unable to get BOS descriptor or descriptor too short [ 1192.656387][ T5892] usb 3-1: too many configurations: 208, using maximum allowed: 8 [ 1192.678722][ T5892] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 1192.689366][ T5892] usb 3-1: can't read configurations, error -61 [ 1192.697615][ T5892] usb usb3-port1: attempt power cycle [ 1193.125326][T22829] FAULT_INJECTION: forcing a failure. [ 1193.125326][T22829] name failslab, interval 1, probability 0, space 0, times 0 [ 1193.138364][T22829] CPU: 0 UID: 0 PID: 22829 Comm: syz.3.4457 Tainted: G L syzkaller #0 PREEMPT(full) [ 1193.138383][T22829] Tainted: [L]=SOFTLOCKUP [ 1193.138387][T22829] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1193.138394][T22829] Call Trace: [ 1193.138400][T22829] [ 1193.138405][T22829] dump_stack_lvl+0xe8/0x150 [ 1193.138425][T22829] should_fail_ex+0x412/0x560 [ 1193.138444][T22829] should_failslab+0xa8/0x100 [ 1193.138460][T22829] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 1193.138474][T22829] ? __alloc_skb+0x1d0/0x7d0 [ 1193.138484][T22829] ? __local_bh_enable_ip+0xd0/0x130 [ 1193.138502][T22829] __alloc_skb+0x1d0/0x7d0 [ 1193.138515][T22829] fdb_notify+0xa6/0x160 [ 1193.138611][T22829] fdb_add_local+0x155/0x250 [ 1193.138625][T22829] br_fdb_changeaddr+0x3ba/0x470 [ 1193.138644][T22829] br_device_event+0x699/0x970 [ 1193.138671][T22829] ? __pfx_br_device_event+0x10/0x10 [ 1193.138700][T22829] ? lockdep_rtnl_is_held+0x26/0x40 [ 1193.138728][T22829] notifier_call_chain+0x1be/0x400 [ 1193.138752][T22829] call_netdevice_notifiers+0x90/0xd0 [ 1193.138770][T22829] ? __pfx_call_netdevice_notifiers+0x10/0x10 [ 1193.138786][T22829] ? dev_ifsioc+0x684/0x1280 [ 1193.138796][T22829] ? netdev_need_ops_lock+0xbe/0xf0 [ 1193.138807][T22829] dev_ifsioc+0x699/0x1280 [ 1193.138819][T22829] ? dev_load+0x21/0x1f0 [ 1193.138836][T22829] dev_ioctl+0x7b4/0x1150 [ 1193.138854][T22829] sock_do_ioctl+0x23e/0x320 [ 1193.138870][T22829] ? __pfx_sock_do_ioctl+0x10/0x10 [ 1193.138884][T22829] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 1193.138905][T22829] sock_ioctl+0x5c6/0x7f0 [ 1193.138920][T22829] ? __pfx_sock_ioctl+0x10/0x10 [ 1193.138934][T22829] ? __fget_files+0x2a/0x420 [ 1193.138950][T22829] ? __fget_files+0x3a0/0x420 [ 1193.138964][T22829] ? __fget_files+0x2a/0x420 [ 1193.138981][T22829] ? bpf_lsm_file_ioctl+0x9/0x20 [ 1193.138996][T22829] ? __pfx_sock_ioctl+0x10/0x10 [ 1193.139009][T22829] __se_sys_ioctl+0xfc/0x170 [ 1193.139023][T22829] do_syscall_64+0x14d/0xf80 [ 1193.139035][T22829] ? trace_irq_disable+0x3b/0x150 [ 1193.139044][T22829] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1193.139055][T22829] ? clear_bhb_loop+0x40/0x90 [ 1193.139068][T22829] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1193.139078][T22829] RIP: 0033:0x7f778df9c799 [ 1193.139090][T22829] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1193.139101][T22829] RSP: 002b:00007f778ee45028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1193.139113][T22829] RAX: ffffffffffffffda RBX: 00007f778e215fa0 RCX: 00007f778df9c799 [ 1193.139122][T22829] RDX: 0000200000000000 RSI: 0000000000008937 RDI: 0000000000000004 [ 1193.139129][T22829] RBP: 00007f778ee45090 R08: 0000000000000000 R09: 0000000000000000 [ 1193.139135][T22829] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1193.139141][T22829] R13: 00007f778e216038 R14: 00007f778e215fa0 R15: 00007f778e33fa48 [ 1193.139157][T22829] [ 1193.432210][ T5892] usb 3-1: new high-speed USB device number 106 using dummy_hcd [ 1193.463918][ T5892] usb 3-1: Using ep0 maxpacket: 16 [ 1193.476325][ T5892] usb 3-1: unable to get BOS descriptor or descriptor too short [ 1193.484127][ T5892] usb 3-1: too many configurations: 208, using maximum allowed: 8 [ 1193.495680][ T5892] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 1193.504202][ T5892] usb 3-1: can't read configurations, error -61 [ 1193.633673][ T5892] usb 3-1: new high-speed USB device number 107 using dummy_hcd [ 1193.694597][ T5892] usb 3-1: Using ep0 maxpacket: 16 [ 1193.729112][ T5892] usb 3-1: unable to get BOS descriptor or descriptor too short [ 1193.737631][ T5892] usb 3-1: too many configurations: 208, using maximum allowed: 8 [ 1193.760993][ T5892] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 1193.852543][ T5892] usb 3-1: can't read configurations, error -61 [ 1193.874887][ T5892] usb usb3-port1: unable to enumerate USB device [ 1193.889748][T22842] kernel profiling enabled (shift: 63) [ 1193.895836][T22842] profiling shift: 63 too large [ 1193.936506][T22843] ptrace attach of "./syz-executor exec"[18527] was attempted by "./syz-executor exec"[22843] [ 1194.061161][T22847] xt_hashlimit: size too large, truncated to 1048576 [ 1194.154955][T22850] syzkaller1: entered promiscuous mode [ 1194.179861][T22850] syzkaller1: entered allmulticast mode [ 1194.353078][ T29] usb 1-1: new high-speed USB device number 84 using dummy_hcd [ 1194.507117][ T29] usb 1-1: New USB device found, idVendor=1604, idProduct=8001, bcdDevice=44.1f [ 1194.516296][ T29] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1194.572755][ T29] usb 1-1: Product: syz [ 1194.589216][ T29] usb 1-1: Manufacturer: syz [ 1194.603463][ T29] usb 1-1: SerialNumber: syz [ 1194.619369][ T29] usb 1-1: config 0 descriptor?? [ 1194.772486][T22856] usb usb8: usbfs: process 22856 (syz.2.4463) did not claim interface 0 before use [ 1195.030257][ T5892] usb 1-1: USB disconnect, device number 84 [ 1195.037028][ T5864] usb 3-1: new full-speed USB device number 108 using dummy_hcd [ 1195.216213][ T5864] usb 3-1: config 3 has an invalid interface number: 3 but max is 1 [ 1195.225602][ T5864] usb 3-1: config 3 has an invalid interface number: 50 but max is 1 [ 1195.240698][ T5864] usb 3-1: config 3 has no interface number 0 [ 1195.253057][ T5864] usb 3-1: config 3 has no interface number 1 [ 1195.265124][ T5864] usb 3-1: config 3 interface 3 has no altsetting 0 [ 1195.283046][ T5864] usb 3-1: config 3 interface 50 has no altsetting 0 [ 1195.301193][ T5864] usb 3-1: New USB device found, idVendor=04da, idProduct=250d, bcdDevice=1d.43 [ 1195.320128][ T5864] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1195.341061][ T5864] usb 3-1: Product: syz [ 1195.355413][ T5864] usb 3-1: Manufacturer: syz [ 1195.377135][ T5864] usb 3-1: SerialNumber: syz [ 1196.005696][T22870] FAULT_INJECTION: forcing a failure. [ 1196.005696][T22870] name failslab, interval 1, probability 0, space 0, times 0 [ 1196.053133][T22870] CPU: 1 UID: 0 PID: 22870 Comm: syz.0.4469 Tainted: G L syzkaller #0 PREEMPT(full) [ 1196.053165][T22870] Tainted: [L]=SOFTLOCKUP [ 1196.053172][T22870] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1196.053184][T22870] Call Trace: [ 1196.053192][T22870] [ 1196.053201][T22870] dump_stack_lvl+0xe8/0x150 [ 1196.053233][T22870] should_fail_ex+0x412/0x560 [ 1196.053262][T22870] ? __d_alloc+0x37/0x6f0 [ 1196.053283][T22870] should_failslab+0xa8/0x100 [ 1196.053309][T22870] kmem_cache_alloc_lru_noprof+0x87/0x640 [ 1196.053336][T22870] __d_alloc+0x37/0x6f0 [ 1196.053364][T22870] d_alloc+0x4b/0x190 [ 1196.053379][T22870] ? lookup_one_qstr_excl+0xc8/0x360 [ 1196.053407][T22870] lookup_one_qstr_excl+0xdc/0x360 [ 1196.053438][T22870] filename_create+0x20e/0x370 [ 1196.053465][T22870] ? __pfx_filename_create+0x10/0x10 [ 1196.053484][T22870] ? strncpy_from_user+0x150/0x2b0 [ 1196.053514][T22870] ? do_getname+0x151/0x250 [ 1196.053542][T22870] start_creating_user_path+0x3b/0x150 [ 1196.053568][T22870] bpf_obj_pin_user+0x148/0x390 [ 1196.053626][T22870] ? __pfx_bpf_obj_pin_user+0x10/0x10 [ 1196.053661][T22870] __sys_bpf+0x857/0x950 [ 1196.053693][T22870] ? __pfx___sys_bpf+0x10/0x10 [ 1196.053737][T22870] ? ksys_write+0x242/0x270 [ 1196.053761][T22870] ? __pfx_ksys_write+0x10/0x10 [ 1196.053799][T22870] __x64_sys_bpf+0x7c/0x90 [ 1196.053827][T22870] do_syscall_64+0x14d/0xf80 [ 1196.053850][T22870] ? trace_irq_disable+0x3b/0x150 [ 1196.053867][T22870] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1196.053888][T22870] ? clear_bhb_loop+0x40/0x90 [ 1196.053911][T22870] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1196.053931][T22870] RIP: 0033:0x7f37b079c799 [ 1196.053951][T22870] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1196.053969][T22870] RSP: 002b:00007f37b16ed028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1196.053991][T22870] RAX: ffffffffffffffda RBX: 00007f37b0a15fa0 RCX: 00007f37b079c799 [ 1196.054006][T22870] RDX: 0000000000000018 RSI: 0000200000000140 RDI: 0000000000000006 [ 1196.054019][T22870] RBP: 00007f37b16ed090 R08: 0000000000000000 R09: 0000000000000000 [ 1196.054031][T22870] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1196.054043][T22870] R13: 00007f37b0a16038 R14: 00007f37b0a15fa0 R15: 00007f37b0b3fa48 [ 1196.054073][T22870] [ 1196.809481][T11059] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 1196.822871][T11059] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 1196.831657][T11059] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 1196.840851][T11059] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 1196.848915][T11059] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 1197.213994][ T5864] usb 3-1: unknown number of interfaces: 2 [ 1197.257652][ T5864] usb 3-1: USB disconnect, device number 108 [ 1197.932583][T22903] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1198.048009][T22876] chnl_net:caif_netlink_parms(): no params data found [ 1198.316358][T22906] netlink: 'syz.1.4476': attribute type 3 has an invalid length. [ 1198.906218][T13975] Bluetooth: hci4: command tx timeout [ 1199.045756][ T176] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1199.294734][ T176] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1199.499601][T22915] ptrace attach of "./syz-executor exec"[21425] was attempted by "./syz-executor exec"[22915] [ 1199.542021][T22876] bridge0: port 1(bridge_slave_0) entered blocking state [ 1199.659542][T22876] bridge0: port 1(bridge_slave_0) entered disabled state [ 1199.696003][T22876] bridge_slave_0: entered allmulticast mode [ 1199.716271][T22876] bridge_slave_0: entered promiscuous mode [ 1199.987867][ T176] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1200.107770][T22876] bridge0: port 2(bridge_slave_1) entered blocking state [ 1200.286090][T22876] bridge0: port 2(bridge_slave_1) entered disabled state [ 1200.293796][T22876] bridge_slave_1: entered allmulticast mode [ 1200.301703][T22876] bridge_slave_1: entered promiscuous mode [ 1200.527116][ T176] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1200.597994][T22876] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1200.612221][T22876] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1200.691617][T22876] team0: Port device team_slave_0 added [ 1200.702239][T22876] team0: Port device team_slave_1 added [ 1200.901951][T22876] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1200.917655][T22876] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1200.975734][T13975] Bluetooth: hci4: command tx timeout [ 1201.029159][T22876] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1201.677140][T22876] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1201.717564][T22876] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1201.746116][T22876] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1201.994163][ T176] bridge_slave_1: left allmulticast mode [ 1202.001436][ T176] bridge_slave_1: left promiscuous mode [ 1202.008712][ T176] bridge0: port 2(bridge_slave_1) entered disabled state [ 1202.020385][ T176] bridge_slave_0: left allmulticast mode [ 1202.027201][ T176] bridge_slave_0: left promiscuous mode [ 1202.033401][ T176] bridge0: port 1(bridge_slave_0) entered disabled state [ 1202.370793][ T176] bond4 (unregistering): (slave gretap1): Releasing active interface [ 1202.511657][ T6319] wlan0: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 1202.529108][ T176] bond2 (unregistering): (slave bridge2): Releasing backup interface [ 1202.543340][ T176] bridge2 (unregistering): left promiscuous mode [ 1202.557450][ T176] bridge2 (unregistering): left allmulticast mode [ 1202.616754][ T176] bond5 (unregistering): (slave bridge3): Removing an active aggregator [ 1202.625703][ T176] bond5 (unregistering): (slave bridge3): Releasing backup interface [ 1202.634265][ T176] bond5 (unregistering): (slave bridge3): the permanent HWaddr of slave - 62:b3:28:93:95:ba - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts [ 1202.654115][ T176] bridge3 (unregistering): left promiscuous mode [ 1202.660516][ T176] bridge3 (unregistering): left allmulticast mode [ 1202.706559][ T176] bond5 (unregistering): (slave bridge4): Releasing backup interface [ 1202.716169][ T176] bridge4 (unregistering): left promiscuous mode [ 1202.722540][ T176] bridge4 (unregistering): left allmulticast mode [ 1202.799175][ T176] .` (unregistering): (slave bond_slave_0): Releasing backup interface [ 1202.813293][ T176] .` (unregistering): (slave bond_slave_1): Releasing backup interface [ 1202.837506][ T176] .` (unregistering): Released all slaves [ 1202.860325][ T176] bond1 (unregistering): Released all slaves [ 1202.882149][ T176] bond0 (unregistering): Released all slaves [ 1202.911694][ T176] bond2 (unregistering): Released all slaves [ 1202.945551][ T176] bond3 (unregistering): Released all slaves [ 1202.965092][ T176] bond4 (unregistering): Released all slaves [ 1202.995760][ T176] bond5 (unregistering): Released all slaves [ 1203.053339][T13975] Bluetooth: hci4: command tx timeout [ 1203.127605][T22876] hsr_slave_0: entered promiscuous mode [ 1203.174375][T22876] hsr_slave_1: entered promiscuous mode [ 1203.180780][T22876] debugfs: 'hsr0' already exists in 'hsr' [ 1203.190089][T22876] Cannot create hsr debugfs directory [ 1203.376084][ T176] : left promiscuous mode [ 1203.960425][ T176] tipc: Disabling bearer [ 1204.275254][ T176] tipc: Left network mode [ 1204.360705][ T176] IPVS: stopping master sync thread 19590 ... [ 1205.223102][T13975] Bluetooth: hci4: command tx timeout [ 1205.662802][T22996] netlink: 'syz.1.4496': attribute type 2 has an invalid length. [ 1205.677879][T22996] tipc: Started in network mode [ 1205.700073][T22996] tipc: Node identity 1340008, cluster identity 4711 [ 1205.733369][T22996] tipc: Node number set to 20185096 [ 1206.234845][ T5864] usb 3-1: new low-speed USB device number 110 using dummy_hcd [ 1206.463262][ T5864] usb 3-1: Invalid ep0 maxpacket: 64 [ 1206.542726][ T176] hsr_slave_0: left promiscuous mode [ 1206.554503][ T176] hsr_slave_1: left promiscuous mode [ 1206.571079][ T176] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1206.623115][ T5864] usb 3-1: new low-speed USB device number 111 using dummy_hcd [ 1206.644318][ T176] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1206.670995][ T176] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1206.686124][ T176] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1206.767540][ T176] veth1_macvtap: left promiscuous mode [ 1206.774852][ T176] veth0_macvtap: left promiscuous mode [ 1206.783171][ T176] veth1_vlan: left promiscuous mode [ 1206.869606][ T5864] usb 3-1: Invalid ep0 maxpacket: 64 [ 1206.950969][ T5864] usb usb3-port1: attempt power cycle [ 1206.957483][ T176] veth0_vlan: left promiscuous mode [ 1207.396538][ T5864] usb 3-1: new low-speed USB device number 112 using dummy_hcd [ 1207.505929][ T5864] usb 3-1: Invalid ep0 maxpacket: 64 [ 1207.983184][ T5864] usb 3-1: new low-speed USB device number 113 using dummy_hcd [ 1208.020550][ T5864] usb 3-1: Invalid ep0 maxpacket: 64 [ 1208.029940][ T5864] usb usb3-port1: unable to enumerate USB device [ 1208.099388][ T176] team0 (unregistering): Port device team_slave_1 removed [ 1208.143239][ T5892] usb 1-1: new high-speed USB device number 85 using dummy_hcd [ 1208.151424][ T176] team0 (unregistering): Port device team_slave_0 removed [ 1208.795167][ T5892] usb 1-1: Using ep0 maxpacket: 16 [ 1208.811231][ T5892] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1208.827777][ T5892] usb 1-1: New USB device found, idVendor=041e, idProduct=3100, bcdDevice= 0.00 [ 1208.838272][ T5892] usb 1-1: New USB device strings: Mfr=34, Product=0, SerialNumber=0 [ 1208.853338][ T5892] usb 1-1: Manufacturer: syz [ 1208.875380][ T5892] usb 1-1: config 0 descriptor?? [ 1209.220952][T22876] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 1209.301390][ T5892] input: syz as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:041E:3100.0042/input/input72 [ 1209.546671][T22876] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 1209.577369][T22876] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 1209.594824][T22876] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 1209.626801][ T5892] creative-sb0540 0003:041E:3100.0042: input,hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.0-1/input0 [ 1209.743586][T23031] FAULT_INJECTION: forcing a failure. [ 1209.743586][T23031] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1209.760255][T23031] CPU: 0 UID: 0 PID: 23031 Comm: syz.0.4504 Tainted: G L syzkaller #0 PREEMPT(full) [ 1209.760288][T23031] Tainted: [L]=SOFTLOCKUP [ 1209.760296][T23031] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1209.760306][T23031] Call Trace: [ 1209.760314][T23031] [ 1209.760322][T23031] dump_stack_lvl+0xe8/0x150 [ 1209.760354][T23031] should_fail_ex+0x412/0x560 [ 1209.760385][T23031] _copy_from_user+0x2d/0xb0 [ 1209.760407][T23031] ___sys_sendmsg+0x1c6/0x360 [ 1209.760440][T23031] ? __pfx____sys_sendmsg+0x10/0x10 [ 1209.760490][T23031] ? __fget_files+0x2a/0x420 [ 1209.760515][T23031] ? __fget_files+0x3a0/0x420 [ 1209.760548][T23031] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1209.760570][T23031] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1209.760597][T23031] ? __pfx_ksys_write+0x10/0x10 [ 1209.760628][T23031] do_syscall_64+0x14d/0xf80 [ 1209.760650][T23031] ? trace_irq_disable+0x3b/0x150 [ 1209.760666][T23031] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1209.760682][T23031] ? clear_bhb_loop+0x40/0x90 [ 1209.760702][T23031] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1209.760719][T23031] RIP: 0033:0x7f37b079c799 [ 1209.760738][T23031] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1209.760754][T23031] RSP: 002b:00007f37b16ed028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1209.760776][T23031] RAX: ffffffffffffffda RBX: 00007f37b0a15fa0 RCX: 00007f37b079c799 [ 1209.760791][T23031] RDX: 0000000000000000 RSI: 0000200000000400 RDI: 0000000000000005 [ 1209.760804][T23031] RBP: 00007f37b16ed090 R08: 0000000000000000 R09: 0000000000000000 [ 1209.760817][T23031] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1209.760828][T23031] R13: 00007f37b0a16038 R14: 00007f37b0a15fa0 R15: 00007f37b0b3fa48 [ 1209.760855][T23031] [ 1209.975054][T22876] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1209.990192][T22876] 8021q: adding VLAN 0 to HW filter on device team0 [ 1210.017025][T22876] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 1210.028160][T22876] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1210.052825][T22876] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1210.078292][T22876] veth0_vlan: entered promiscuous mode [ 1210.089517][T22876] veth1_vlan: entered promiscuous mode [ 1210.109178][T22876] veth0_macvtap: entered promiscuous mode [ 1210.117873][T22876] veth1_macvtap: entered promiscuous mode [ 1210.132418][T22876] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1210.142648][T22876] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1210.251147][ T6319] bridge0: port 1(bridge_slave_0) entered blocking state [ 1210.258377][ T6319] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1210.345034][ T6319] bridge0: port 2(bridge_slave_1) entered blocking state [ 1210.352238][ T6319] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1210.623713][ T6303] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1210.664183][ T6319] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1210.721960][ T6319] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1210.765356][ T6319] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1210.915534][ T6303] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1210.963841][ T6303] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1211.061709][ T6300] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1211.085282][ T6300] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1211.276405][T23079] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4510'. [ 1212.082736][ T5953] usb 1-1: USB disconnect, device number 85 [ 1213.734890][T23119] netlink: 'syz.6.4521': attribute type 21 has an invalid length. [ 1213.742782][T23119] netlink: 8 bytes leftover after parsing attributes in process `syz.6.4521'. [ 1213.751813][T23119] bond0: option lacp_rate: mode dependency failed, not supported in mode balance-rr(0) [ 1213.920734][T23129] netlink: 8 bytes leftover after parsing attributes in process `syz.6.4525'. [ 1213.946064][T23129] netlink: 120 bytes leftover after parsing attributes in process `syz.6.4525'. [ 1213.960545][T23130] FAULT_INJECTION: forcing a failure. [ 1213.960545][T23130] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1214.004692][T23130] CPU: 1 UID: 0 PID: 23130 Comm: syz.1.4524 Tainted: G L syzkaller #0 PREEMPT(full) [ 1214.004727][T23130] Tainted: [L]=SOFTLOCKUP [ 1214.004735][T23130] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1214.004747][T23130] Call Trace: [ 1214.004755][T23130] [ 1214.004763][T23130] dump_stack_lvl+0xe8/0x150 [ 1214.004795][T23130] should_fail_ex+0x412/0x560 [ 1214.004828][T23130] _copy_from_iter+0x1d3/0x1670 [ 1214.004869][T23130] ? __pfx__copy_from_iter+0x10/0x10 [ 1214.004898][T23130] ? alloc_pages_noprof+0xbd/0x190 [ 1214.004926][T23130] ? skb_page_frag_refill+0x199/0x310 [ 1214.004958][T23130] kcm_sendmsg+0xe0c/0x2b60 [ 1214.005125][T23130] ? __pfx_kcm_sendmsg+0x10/0x10 [ 1214.005148][T23130] ? rcu_is_watching+0x15/0xb0 [ 1214.005174][T23130] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1214.005203][T23130] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1214.005229][T23130] ____sys_sendmsg+0x972/0x9f0 [ 1214.005261][T23130] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1214.005291][T23130] ? import_iovec+0x73/0xa0 [ 1214.005316][T23130] ___sys_sendmsg+0x2a5/0x360 [ 1214.005344][T23130] ? __pfx____sys_sendmsg+0x10/0x10 [ 1214.005400][T23130] ? __fget_files+0x2a/0x420 [ 1214.005427][T23130] ? __fget_files+0x3a0/0x420 [ 1214.005464][T23130] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1214.005489][T23130] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1214.005519][T23130] ? rcu_is_watching+0x15/0xb0 [ 1214.005557][T23130] do_syscall_64+0x14d/0xf80 [ 1214.005579][T23130] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1214.005597][T23130] ? clear_bhb_loop+0x40/0x90 [ 1214.005620][T23130] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1214.005645][T23130] RIP: 0033:0x7f85a579c799 [ 1214.005663][T23130] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1214.005680][T23130] RSP: 002b:00007f85a66bc028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1214.005700][T23130] RAX: ffffffffffffffda RBX: 00007f85a5a16090 RCX: 00007f85a579c799 [ 1214.005713][T23130] RDX: 0000000000000000 RSI: 0000200000002080 RDI: 0000000000000003 [ 1214.005724][T23130] RBP: 00007f85a66bc090 R08: 0000000000000000 R09: 0000000000000000 [ 1214.005736][T23130] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1214.005747][T23130] R13: 00007f85a5a16128 R14: 00007f85a5a16090 R15: 00007f85a5b3fa48 [ 1214.005777][T23130] [ 1214.821820][T23147] netlink: 8 bytes leftover after parsing attributes in process `syz.6.4530'. [ 1215.578631][T23149] netlink: 68 bytes leftover after parsing attributes in process `syz.1.4529'. [ 1216.145483][ T5945] usb 3-1: new high-speed USB device number 114 using dummy_hcd [ 1216.179201][T23165] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4535'. [ 1216.208268][T23165] bond0: option lp_interval: invalid value (0) [ 1216.225907][T23165] bond0: option lp_interval: allowed values 1 - 2147483647 [ 1216.310524][ T5945] usb 3-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1216.327795][T23167] ptrace attach of "./syz-executor exec"[18527] was attempted by " ./file0   8    \x09   /sys/kernel/debug/binder/stats cgroup.controllers [ 1216.339061][ T5945] usb 3-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 1216.640896][ T5945] usb 3-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 1216.699704][ T5945] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1216.700641][T23176] EXT4-fs: Conflicting test_dummy_encryption options [ 1216.712628][T23159] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 1216.741871][ T5945] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 1217.123046][ T5885] usb 2-1: new high-speed USB device number 74 using dummy_hcd [ 1217.144457][T23159] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4533'. [ 1217.273002][ T5885] usb 2-1: Using ep0 maxpacket: 8 [ 1217.280539][ T5885] usb 2-1: unable to get BOS descriptor or descriptor too short [ 1217.290484][ T5885] usb 2-1: config 4 interface 0 has no altsetting 0 [ 1217.307245][ T5885] usb 2-1: string descriptor 0 read error: -22 [ 1217.314806][ T5885] usb 2-1: New USB device found, idVendor=058f, idProduct=6610, bcdDevice=48.05 [ 1217.334384][ T5885] usb 2-1: New USB device strings: Mfr=2, Product=0, SerialNumber=3 [ 1217.363472][ T5885] usb 2-1: dvb_usb_v2: found a 'Sigmatek DVB-110' in warm state [ 1217.396247][ T5885] usb 2-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 1217.413476][ T5885] dvbdev: DVB: registering new adapter (Sigmatek DVB-110) [ 1217.420991][ T5885] usb 2-1: media controller created [ 1217.444116][T23182] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1217.491808][ T5885] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1217.755484][ T5953] usb 3-1: USB disconnect, device number 114 [ 1218.660794][ T5885] zl10353_read_register: readreg error (reg=127, ret==0) [ 1218.660863][T23191] usb 2-1: dvb_usb_au6610: wlen=245, aborting [ 1218.858472][T23198] netlink: 68 bytes leftover after parsing attributes in process `syz.3.4543'. [ 1219.857578][ T5885] usb 2-1: USB disconnect, device number 74 [ 1220.030462][T23212] netlink: 68 bytes leftover after parsing attributes in process `syz.2.4546'. [ 1220.195881][T11059] Bluetooth: hci1: command 0x0406 tx timeout [ 1220.902222][T23222] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4551'. [ 1220.925787][T23220] netlink: 8 bytes leftover after parsing attributes in process `syz.6.4549'. [ 1221.103676][T23220] bond0: option lp_interval: invalid value (0) [ 1221.245722][T23220] bond0: option lp_interval: allowed values 1 - 2147483647 [ 1221.295791][T23232] netlink: 11 bytes leftover after parsing attributes in process `syz.0.4552'. [ 1221.373091][T23232] netlink: 11 bytes leftover after parsing attributes in process `syz.0.4552'. [ 1223.434178][T23267] netlink: 68 bytes leftover after parsing attributes in process `syz.1.4561'. [ 1224.213865][T23277] syzkaller0: entered promiscuous mode [ 1224.243075][T23277] syzkaller0: entered allmulticast mode [ 1224.265258][T23281] FAULT_INJECTION: forcing a failure. [ 1224.265258][T23281] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1224.316276][T23281] CPU: 0 UID: 0 PID: 23281 Comm: syz.6.4565 Tainted: G L syzkaller #0 PREEMPT(full) [ 1224.316299][T23281] Tainted: [L]=SOFTLOCKUP [ 1224.316303][T23281] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1224.316309][T23281] Call Trace: [ 1224.316314][T23281] [ 1224.316319][T23281] dump_stack_lvl+0xe8/0x150 [ 1224.316343][T23281] should_fail_ex+0x412/0x560 [ 1224.316363][T23281] _copy_from_user+0x2d/0xb0 [ 1224.316376][T23281] __copy_msghdr+0x3c5/0x5b0 [ 1224.316393][T23281] ___sys_sendmsg+0x213/0x360 [ 1224.316408][T23281] ? __pfx____sys_sendmsg+0x10/0x10 [ 1224.316435][T23281] ? __fget_files+0x2a/0x420 [ 1224.316453][T23281] ? __fget_files+0x3a0/0x420 [ 1224.316472][T23281] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1224.316486][T23281] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1224.316502][T23281] ? __pfx_ksys_write+0x10/0x10 [ 1224.316525][T23281] do_syscall_64+0x14d/0xf80 [ 1224.316539][T23281] ? trace_irq_disable+0x3b/0x150 [ 1224.316551][T23281] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1224.316564][T23281] ? clear_bhb_loop+0x40/0x90 [ 1224.316578][T23281] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1224.316589][T23281] RIP: 0033:0x7f8395b9c799 [ 1224.316601][T23281] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1224.316610][T23281] RSP: 002b:00007f8393dd5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1224.316625][T23281] RAX: ffffffffffffffda RBX: 00007f8395e16090 RCX: 00007f8395b9c799 [ 1224.316634][T23281] RDX: 0000000000000004 RSI: 00002000000000c0 RDI: 0000000000000004 [ 1224.316641][T23281] RBP: 00007f8393dd5090 R08: 0000000000000000 R09: 0000000000000000 [ 1224.316649][T23281] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1224.316656][T23281] R13: 00007f8395e16128 R14: 00007f8395e16090 R15: 00007f8395f3fa48 [ 1224.316672][T23281] [ 1224.765858][T23285] xt_hashlimit: size too large, truncated to 1048576 [ 1225.203708][T23288] syzkaller1: entered promiscuous mode [ 1225.279147][T23288] syzkaller1: entered allmulticast mode [ 1225.783021][ T5885] usb 2-1: new high-speed USB device number 75 using dummy_hcd [ 1225.845010][T23311] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4575'. [ 1226.068936][ T5885] usb 2-1: Using ep0 maxpacket: 8 [ 1226.116557][ T5885] usb 2-1: unable to get BOS descriptor or descriptor too short [ 1226.141327][ T5885] usb 2-1: config 4 interface 0 has no altsetting 0 [ 1226.178581][ T5885] usb 2-1: string descriptor 0 read error: -22 [ 1226.196902][ T5885] usb 2-1: New USB device found, idVendor=058f, idProduct=6610, bcdDevice=48.05 [ 1226.235145][T23320] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4578'. [ 1226.244177][T23320] bond0: option lp_interval: invalid value (0) [ 1226.250327][T23320] bond0: option lp_interval: allowed values 1 - 2147483647 [ 1226.268820][ T5885] usb 2-1: New USB device strings: Mfr=2, Product=0, SerialNumber=3 [ 1226.305383][ T5885] usb 2-1: dvb_usb_v2: found a 'Sigmatek DVB-110' in warm state [ 1226.331669][ T5885] usb 2-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 1226.356368][ T5885] dvbdev: DVB: registering new adapter (Sigmatek DVB-110) [ 1226.365866][ T5885] usb 2-1: media controller created [ 1226.428268][ T5885] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1226.724361][T23326] xt_hashlimit: size too large, truncated to 1048576 [ 1226.834521][T23326] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1227.455506][T23338] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4584'. [ 1227.519207][T23342] xt_hashlimit: size too large, truncated to 1048576 [ 1227.533632][ T5885] zl10353_read_register: readreg error (reg=127, ret==0) [ 1227.549911][T23329] usb 2-1: dvb_usb_au6610: wlen=245, aborting [ 1227.596221][T23345] syzkaller1: entered promiscuous mode [ 1227.605317][T23345] syzkaller1: entered allmulticast mode [ 1227.636860][T23347] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4587'. [ 1228.051301][ T29] IPVS: starting estimator thread 0... [ 1228.225105][T23356] IPVS: using max 34 ests per chain, 81600 per kthread [ 1228.235658][T23358] IPVS: wrr: FWM 3 0x00000003 - no destination available [ 1228.510371][T23360] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4590'. [ 1228.524160][T23360] bond0: option lp_interval: invalid value (0) [ 1228.531929][T23360] bond0: option lp_interval: allowed values 1 - 2147483647 [ 1228.785795][ T5885] usb 2-1: USB disconnect, device number 75 [ 1229.263789][T23375] netlink: 68 bytes leftover after parsing attributes in process `syz.1.4594'. [ 1229.383237][ T5864] usb 4-1: new high-speed USB device number 74 using dummy_hcd [ 1229.622856][ T5864] usb 4-1: unable to get BOS descriptor or descriptor too short [ 1229.641903][ T5864] usb 4-1: config 13 has an invalid interface number: 177 but max is 0 [ 1229.666644][ T5864] usb 4-1: config 13 has no interface number 0 [ 1229.685252][ T5864] usb 4-1: config 13 interface 177 altsetting 4 has an endpoint descriptor with address 0x99, changing to 0x89 [ 1229.700732][T23378] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4597'. [ 1229.730385][ T5864] usb 4-1: config 13 interface 177 altsetting 4 endpoint 0x89 has an invalid bInterval 0, changing to 7 [ 1229.769420][ T5864] usb 4-1: config 13 interface 177 altsetting 4 endpoint 0x89 has invalid wMaxPacketSize 0 [ 1229.771570][T23380] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4598'. [ 1229.779690][ T5864] usb 4-1: config 13 interface 177 has no altsetting 0 [ 1229.781819][ T5864] usb 4-1: New USB device found, idVendor=15c2, idProduct=f142, bcdDevice=ef.b7 [ 1229.810122][ T5864] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1229.819354][ T5864] usb 4-1: Product: syz [ 1229.989236][ T5864] usb 4-1: Manufacturer: syz [ 1229.999563][ T5864] usb 4-1: SerialNumber: syz [ 1230.106181][T23388] xt_hashlimit: size too large, truncated to 1048576 [ 1230.220830][T23392] syzkaller1: entered promiscuous mode [ 1230.243218][T23390] netlink: 68 bytes leftover after parsing attributes in process `syz.0.4601'. [ 1230.257404][T23390] tipc: Failed to remove unknown binding: 66,1,1/0:444936525/444936527 [ 1230.295231][T23373] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1230.309371][T23373] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1230.375368][T23392] syzkaller1: entered allmulticast mode [ 1230.395148][ T5864] usb 4-1: USB disconnect, device number 74 [ 1230.727554][T23397] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4602'. [ 1230.737631][T23397] bond0: option lp_interval: invalid value (0) [ 1230.744336][T23397] bond0: option lp_interval: allowed values 1 - 2147483647 [ 1230.959821][T23403] loop5: detected capacity change from 0 to 7 [ 1230.966382][ C0] blk_print_req_error: 10 callbacks suppressed [ 1230.966409][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1230.966438][ C0] buffer_io_error: 10 callbacks suppressed [ 1230.966449][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 1230.983783][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1230.983823][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 1230.984053][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1230.984079][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 1230.986507][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1230.986528][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 1230.986671][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1230.986686][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 1230.986777][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1230.986791][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 1230.986872][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1230.986886][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 1230.986938][T23403] ldm_validate_partition_table(): Disk read failed. [ 1230.987001][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1230.987015][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 1230.987120][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1230.987134][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 1230.987263][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1230.987277][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 1230.987425][T23403] Dev loop5: unable to read RDB block 0 [ 1230.987795][T23403] loop5: unable to read partition table [ 1230.987919][T23403] loop5: partition table beyond EOD, truncated [ 1230.987946][T23403] loop_reread_partitions: partition scan of loop5 () failed (rc=-5) [ 1232.222343][T23427] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4614'. [ 1233.209551][T23443] xt_hashlimit: size too large, truncated to 1048576 [ 1235.047219][T23469] netlink: 8 bytes leftover after parsing attributes in process `syz.6.4625'. [ 1235.153107][T23478] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4629'. [ 1235.162349][T23478] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4629'. [ 1235.313171][ T5945] usb 4-1: new full-speed USB device number 75 using dummy_hcd [ 1235.533183][T11059] Bluetooth: hci3: command 0x0406 tx timeout [ 1235.553190][T23486] xt_hashlimit: size too large, truncated to 1048576 [ 1235.555665][ T5945] usb 4-1: New USB device found, idVendor=14f7, idProduct=0500, bcdDevice=44.85 [ 1235.626263][ T5945] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1235.634490][ T5945] usb 4-1: Product: syz [ 1235.638715][ T5945] usb 4-1: Manufacturer: syz [ 1235.644624][ T5945] usb 4-1: SerialNumber: syz [ 1235.653610][ T5945] usb 4-1: config 0 descriptor?? [ 1235.672749][ T5945] usb 4-1: selecting invalid altsetting 1 [ 1235.933824][ T5945] technisat-usb2: could not set alternate setting to 0 [ 1235.986446][ T5945] technisat-usb2: firmware version: 0.0 [ 1235.992128][ T5945] dvb-usb: found a 'Technisat SkyStar USB HD (DVB-S/S2)' in warm state. [ 1236.082745][T23496] fuse: Unknown parameter 'grou00000000000000000000' [ 1236.423138][ T5908] usb 2-1: new high-speed USB device number 76 using dummy_hcd [ 1236.746251][ T5945] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 1236.783034][ T5908] usb 2-1: device descriptor read/64, error -71 [ 1236.800977][ T5945] dvb-usb: Technisat SkyStar USB HD (DVB-S/S2) error while loading driver (-19) [ 1237.058167][ T5945] usb 4-1: USB disconnect, device number 75 [ 1237.164267][ T5908] usb 2-1: new high-speed USB device number 77 using dummy_hcd [ 1237.506921][ T5908] usb 2-1: device descriptor read/64, error -71 [ 1237.688218][T23518] netlink: 'syz.3.4637': attribute type 3 has an invalid length. [ 1237.744684][ T5908] usb usb2-port1: attempt power cycle [ 1237.878341][T23522] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4640'. [ 1238.016917][T23524] CUSE: unknown device info "" [ 1238.213853][T23524] CUSE: unknown device info "" [ 1238.283019][ T5908] usb 2-1: new high-speed USB device number 78 using dummy_hcd [ 1238.340485][ T5908] usb 2-1: device descriptor read/8, error -71 [ 1238.365472][T23524] CUSE: unknown device info "" [ 1238.370828][T23524] CUSE: unknown device info "" [ 1238.384616][T23524] CUSE: unknown device info "" [ 1238.421842][T23524] CUSE: unknown device info "" [ 1238.429657][T23524] CUSE: unknown device info "" [ 1238.439451][T23524] CUSE: unknown device info "" [ 1238.449693][T23524] CUSE: zero length info key specified [ 1238.562539][T23536] xt_hashlimit: size too large, truncated to 1048576 [ 1238.576856][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 1238.584000][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 1238.593160][ T5908] usb 2-1: new high-speed USB device number 79 using dummy_hcd [ 1238.613894][ T5908] usb 2-1: device descriptor read/8, error -71 [ 1238.649385][T23538] syzkaller1: entered promiscuous mode [ 1238.695087][T23538] syzkaller1: entered allmulticast mode [ 1238.717863][T23541] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4645'. [ 1238.723771][ T5908] usb usb2-port1: unable to enumerate USB device [ 1239.515308][T23558] netlink: 68 bytes leftover after parsing attributes in process `syz.0.4646'. [ 1239.984008][T23566] netlink: 'syz.3.4647': attribute type 3 has an invalid length. [ 1240.258304][T23553] netlink: 68 bytes leftover after parsing attributes in process `syz.6.4648'. [ 1240.613074][ T5885] usb 2-1: new high-speed USB device number 80 using dummy_hcd [ 1240.884673][ T5885] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1240.903267][ T5885] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1240.923033][ T5885] usb 2-1: Product: syz [ 1240.983004][ T5885] usb 2-1: Manufacturer: syz [ 1240.993852][ T5885] usb 2-1: SerialNumber: syz [ 1241.013806][ T5885] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1241.060327][ T5908] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1241.571416][ T5892] usb 1-1: new high-speed USB device number 86 using dummy_hcd [ 1241.812316][ T5892] usb 1-1: Using ep0 maxpacket: 8 [ 1241.837074][ T5892] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1242.014114][ T5892] usb 1-1: New USB device found, idVendor=22b8, idProduct=6425, bcdDevice=d3.6c [ 1242.044056][ T5892] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1242.052087][ T5892] usb 1-1: Product: syz [ 1242.077576][ T5892] usb 1-1: Manufacturer: syz [ 1242.103309][ T5908] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 1242.110413][ T5908] ath9k_htc: Failed to initialize the device [ 1242.121523][ T5892] usb 1-1: SerialNumber: syz [ 1242.158082][ T5892] usb 1-1: config 0 descriptor?? [ 1242.176771][ T5908] usb 2-1: ath9k_htc: USB layer deinitialized [ 1242.196157][ T5892] usb 1-1: bad CDC descriptors [ 1242.234584][ T5864] usb 2-1: USB disconnect, device number 80 [ 1242.250480][ T5892] usb 1-1: unsupported MDLM descriptors [ 1242.285931][ T5892] cdc_acm 1-1:0.0: Zero length descriptor references [ 1242.341151][ T5892] cdc_acm 1-1:0.0: probe with driver cdc_acm failed with error -22 [ 1242.452333][T23580] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1242.527734][T23580] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1242.559773][ T5885] usb 1-1: USB disconnect, device number 86 [ 1242.578614][T23588] netlink: 8 bytes leftover after parsing attributes in process `syz.6.4656'. [ 1242.670220][T23590] netlink: 4 bytes leftover after parsing attributes in process `syz.6.4657'. [ 1242.688998][ T5864] usb 4-1: new full-speed USB device number 76 using dummy_hcd [ 1242.889847][ T5864] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1242.945719][ T5864] usb 4-1: New USB device found, idVendor=22b8, idProduct=6027, bcdDevice=c2.80 [ 1242.973770][T23594] xt_hashlimit: size too large, truncated to 1048576 [ 1242.988293][ T5864] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1242.990845][T23600] syzkaller1: entered promiscuous mode [ 1243.002196][T23600] syzkaller1: entered allmulticast mode [ 1243.015260][ T5864] usb 4-1: Product: syz [ 1243.019512][ T5864] usb 4-1: Manufacturer: syz [ 1243.033113][ T5864] usb 4-1: SerialNumber: syz [ 1243.057240][ T5864] usb 4-1: config 0 descriptor?? [ 1243.088913][ T5864] usb 4-1: bad CDC descriptors [ 1243.132791][ T5864] usb 4-1: unsupported MDLM descriptors [ 1243.399614][T23605] netlink: 68 bytes leftover after parsing attributes in process `syz.6.4661'. [ 1244.260425][T23624] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4667'. [ 1244.378907][T23628] loop5: detected capacity change from 0 to 7 [ 1244.469976][ C1] blk_print_req_error: 10 callbacks suppressed [ 1244.469993][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1244.485833][ C1] buffer_io_error: 10 callbacks suppressed [ 1244.485848][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 1244.500946][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1244.510547][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 1244.524376][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1244.534043][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 1244.542163][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1244.551778][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 1244.567340][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1244.576972][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 1244.585397][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1244.595018][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 1244.604342][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1244.613961][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 1244.621797][T23628] ldm_validate_partition_table(): Disk read failed. [ 1244.628679][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1244.638307][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 1244.647654][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1244.657285][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 1244.666104][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1244.675776][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 1244.684238][T23628] Dev loop5: unable to read RDB block 0 [ 1244.690671][T23628] loop5: unable to read partition table [ 1244.696512][T23628] loop5: partition table beyond EOD, truncated [ 1244.716362][T23628] loop_reread_partitions: partition scan of loop5 () failed (rc=-5) [ 1245.603946][ T5908] usb 4-1: USB disconnect, device number 76 [ 1245.796847][T23652] binder: 23651:23652 ioctl c0306201 200000000680 returned -14 [ 1245.901316][T23649] usb usb8: usbfs: process 23649 (syz.1.4670) did not claim interface 0 before use [ 1246.453244][ T5892] usb 2-1: new full-speed USB device number 81 using dummy_hcd [ 1246.903109][ T5892] usb 2-1: config 3 has an invalid interface number: 3 but max is 1 [ 1247.024208][ T5892] usb 2-1: config 3 has an invalid interface number: 50 but max is 1 [ 1247.049887][ T5892] usb 2-1: config 3 has no interface number 0 [ 1247.099450][ T5892] usb 2-1: config 3 has no interface number 1 [ 1247.120839][ T5892] usb 2-1: config 3 interface 3 has no altsetting 0 [ 1247.179717][ T5892] usb 2-1: config 3 interface 50 has no altsetting 0 [ 1247.288031][ T5892] usb 2-1: New USB device found, idVendor=04da, idProduct=250d, bcdDevice=1d.43 [ 1247.339818][ T5892] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1247.369294][ T5892] usb 2-1: Product: syz [ 1247.380146][ T5892] usb 2-1: Manufacturer: syz [ 1247.395623][ T5892] usb 2-1: SerialNumber: syz [ 1247.407695][T23670] netlink: 7064 bytes leftover after parsing attributes in process `syz.3.4678'. [ 1247.491922][T23670] openvswitch: netlink: EtherType 0 is less than min 600 [ 1247.736213][T23679] ptrace attach of "./syz-executor exec"[18527] was attempted by "./syz-executor exec"[23679] [ 1247.847072][T23680] loop5: detected capacity change from 0 to 7 [ 1247.954894][T23680] ldm_validate_partition_table(): Disk read failed. [ 1247.964548][T23680] Dev loop5: unable to read RDB block 0 [ 1247.974998][T23680] loop5: unable to read partition table [ 1248.083569][T23680] loop5: partition table beyond EOD, truncated [ 1248.091406][T23680] loop_reread_partitions: partition scan of loop5 () failed (rc=-5) [ 1248.861226][T23694] binder: 23692:23694 ioctl c0306201 200000000680 returned -14 [ 1248.943719][T23695] No buffer was provided with the request [ 1249.484598][T23702] syzkaller0: entered promiscuous mode [ 1249.490325][T23702] syzkaller0: entered allmulticast mode [ 1249.827857][ T5892] usb 2-1: unknown number of interfaces: 2 [ 1249.874455][ T5892] usb 2-1: USB disconnect, device number 81 [ 1249.944706][T23707] netlink: 7064 bytes leftover after parsing attributes in process `syz.6.4690'. [ 1250.092294][T23707] openvswitch: netlink: EtherType 0 is less than min 600 [ 1250.889214][T23718] loop5: detected capacity change from 0 to 7 [ 1250.914645][ C1] blk_print_req_error: 30 callbacks suppressed [ 1250.914665][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1250.930477][ C1] buffer_io_error: 30 callbacks suppressed [ 1250.930503][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 1250.948494][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1250.958145][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 1250.968295][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1250.977942][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 1250.996122][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1251.005793][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 1251.013023][ T5892] usb 4-1: new high-speed USB device number 77 using dummy_hcd [ 1251.014806][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1251.030741][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 1251.042958][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1251.052653][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 1251.061452][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1251.071122][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 1251.079032][T22766] ldm_validate_partition_table(): Disk read failed. [ 1251.087008][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1251.096625][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 1251.105086][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1251.114685][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 1251.123941][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1251.133578][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 1251.141954][T22766] Dev loop5: unable to read RDB block 0 [ 1251.149708][T22766] loop5: unable to read partition table [ 1251.157749][T22766] loop5: partition table beyond EOD, truncated [ 1251.166362][T23718] ldm_validate_partition_table(): Disk read failed. [ 1251.174233][T23718] Dev loop5: unable to read RDB block 0 [ 1251.184252][T23718] loop5: unable to read partition table [ 1251.190237][T23718] loop5: partition table beyond EOD, truncated [ 1251.203454][T23718] loop_reread_partitions: partition scan of loop5 () failed (rc=-5) [ 1251.283144][ T5892] usb 4-1: Using ep0 maxpacket: 8 [ 1251.321762][ T5892] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1251.337440][ T5892] usb 4-1: New USB device found, idVendor=22b8, idProduct=6425, bcdDevice=d3.6c [ 1251.351019][ T5892] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1251.370421][ T5892] usb 4-1: Product: syz [ 1251.376902][ T5892] usb 4-1: Manufacturer: syz [ 1251.387029][ T5892] usb 4-1: SerialNumber: syz [ 1251.390979][T23724] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4695'. [ 1251.423029][ T5892] usb 4-1: config 0 descriptor?? [ 1251.429922][ T5892] usb 4-1: bad CDC descriptors [ 1251.436154][ T5892] usb 4-1: unsupported MDLM descriptors [ 1251.444293][ T5892] cdc_acm 4-1:0.0: Zero length descriptor references [ 1251.451232][ T5892] cdc_acm 4-1:0.0: probe with driver cdc_acm failed with error -22 [ 1251.505979][T23727] binder: 23726:23727 ioctl c0306201 200000000680 returned -14 [ 1251.676498][T23716] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1251.703501][T23716] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1251.725514][ T5892] usb 4-1: USB disconnect, device number 77 [ 1251.962600][T23742] netlink: 7064 bytes leftover after parsing attributes in process `syz.1.4701'. [ 1251.975222][T23742] openvswitch: netlink: EtherType 0 is less than min 600 [ 1252.517060][T23755] loop5: detected capacity change from 0 to 7 [ 1252.549424][T23755] ldm_validate_partition_table(): Disk read failed. [ 1252.556626][T23755] Dev loop5: unable to read RDB block 0 [ 1252.602780][T23750] netlink: 'syz.1.4702': attribute type 3 has an invalid length. [ 1252.633754][T23755] loop5: unable to read partition table [ 1252.675911][T23755] loop5: partition table beyond EOD, truncated [ 1252.691890][T23755] loop_reread_partitions: partition scan of loop5 () failed (rc=-5) [ 1253.077977][T23763] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4706'. [ 1253.525131][T23769] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4708'. [ 1254.434885][T23781] netlink: 7064 bytes leftover after parsing attributes in process `syz.1.4712'. [ 1254.451529][T23781] openvswitch: netlink: EtherType 0 is less than min 600 [ 1255.488401][ T5892] usb 2-1: new high-speed USB device number 82 using dummy_hcd [ 1255.662997][ T5892] usb 2-1: Using ep0 maxpacket: 16 [ 1255.682731][ T5892] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1255.724450][ T5892] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1255.852296][ T5892] usb 2-1: New USB device found, idVendor=045e, idProduct=0284, bcdDevice= 1.00 [ 1255.879845][ T5892] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1255.913763][ T5892] usb 2-1: config 0 descriptor?? [ 1255.929881][ T5892] xbox_remote_probe: endpoint_in message size==0? [ 1256.155107][ T5892] usbhid 2-1:0.0: can't add hid device: -71 [ 1256.161173][ T5892] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 1256.171715][ T5892] usb 2-1: USB disconnect, device number 82 [ 1256.325615][T23803] netlink: 68 bytes leftover after parsing attributes in process `syz.6.4717'. [ 1256.348846][T23803] tipc: Failed to remove unknown binding: 66,1,1/0:81750942/81750944 [ 1256.834384][T23819] netlink: 68 bytes leftover after parsing attributes in process `syz.0.4722'. [ 1256.852446][T23819] tipc: Failed to remove unknown binding: 66,1,1/0:1613791159/1613791161 [ 1257.220717][T23828] netlink: 7064 bytes leftover after parsing attributes in process `syz.3.4724'. [ 1257.473057][T23828] openvswitch: netlink: EtherType 0 is less than min 600 [ 1257.586530][T23827] netlink: 68 bytes leftover after parsing attributes in process `syz.1.4723'. [ 1257.895681][T23827] tipc: Failed to remove unknown binding: 66,1,1/20185096:804137056/804137058 [ 1258.154489][T23843] ptrace attach of "./syz-executor exec"[21425] was attempted by "./syz-executor exec"[23843] [ 1258.813165][ T5885] usb 4-1: new high-speed USB device number 78 using dummy_hcd [ 1259.102986][ T5885] usb 4-1: Using ep0 maxpacket: 32 [ 1259.110019][ T5885] usb 4-1: config 0 has an invalid interface number: 119 but max is 0 [ 1259.118526][ T5885] usb 4-1: config 0 has no interface number 0 [ 1259.128541][ T5885] usb 4-1: config 0 interface 119 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1259.149900][ T5885] usb 4-1: config 0 interface 119 altsetting 0 has an endpoint descriptor with address 0xE3, changing to 0x83 [ 1259.173287][ T5885] usb 4-1: config 0 interface 119 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 27 [ 1259.187312][ T5885] usb 4-1: config 0 interface 119 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 1259.213855][ T5885] usb 4-1: New USB device found, idVendor=05ac, idProduct=0292, bcdDevice=88.73 [ 1259.228694][ T5885] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1259.246032][ T5885] usb 4-1: Product: syz [ 1259.264944][ T5885] usb 4-1: Manufacturer: syz [ 1259.273150][ T5885] usb 4-1: SerialNumber: syz [ 1259.295891][ T5885] usb 4-1: config 0 descriptor?? [ 1259.301648][T23846] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 1259.325193][ T5885] input: bcm5974 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.119/input/input73 [ 1259.350729][ T5176] usb 4-1: BOGUS urb xfer, pipe 1 != type 3 [ 1259.365127][ C1] bcm5974 4-1:0.119: trackpad urb failed: -1 [ 1259.529768][ T5945] usb 4-1: USB disconnect, device number 78 [ 1260.488221][T23870] netlink: 7064 bytes leftover after parsing attributes in process `syz.3.4735'. [ 1260.505684][T23870] openvswitch: netlink: EtherType 0 is less than min 600 [ 1260.656782][T23874] FAULT_INJECTION: forcing a failure. [ 1260.656782][T23874] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1260.824240][T23874] CPU: 0 UID: 0 PID: 23874 Comm: syz.3.4736 Tainted: G L syzkaller #0 PREEMPT(full) [ 1260.824273][T23874] Tainted: [L]=SOFTLOCKUP [ 1260.824280][T23874] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1260.824291][T23874] Call Trace: [ 1260.824299][T23874] [ 1260.824309][T23874] dump_stack_lvl+0xe8/0x150 [ 1260.824341][T23874] should_fail_ex+0x412/0x560 [ 1260.824374][T23874] _copy_to_user+0x31/0xb0 [ 1260.824398][T23874] simple_read_from_buffer+0xe1/0x170 [ 1260.824431][T23874] proc_fail_nth_read+0x1bb/0x230 [ 1260.824462][T23874] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1260.824492][T23874] ? rw_verify_area+0x2a6/0x4d0 [ 1260.824512][T23874] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1260.824541][T23874] vfs_read+0x20c/0xa70 [ 1260.824560][T23874] ? fdget_pos+0x246/0x320 [ 1260.824582][T23874] ? __pfx___mutex_lock+0x10/0x10 [ 1260.824606][T23874] ? __pfx_vfs_read+0x10/0x10 [ 1260.824627][T23874] ? __fget_files+0x2a/0x420 [ 1260.824659][T23874] ? __fget_files+0x3a0/0x420 [ 1260.824685][T23874] ? __fget_files+0x2a/0x420 [ 1260.824720][T23874] ksys_read+0x150/0x270 [ 1260.824743][T23874] ? __pfx_ksys_read+0x10/0x10 [ 1260.824763][T23874] ? __pfx_v4l2_ioctl+0x10/0x10 [ 1260.824801][T23874] do_syscall_64+0x14d/0xf80 [ 1260.824822][T23874] ? trace_irq_disable+0x3b/0x150 [ 1260.824839][T23874] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1260.824858][T23874] ? clear_bhb_loop+0x40/0x90 [ 1260.824888][T23874] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1260.824908][T23874] RIP: 0033:0x7f778df5cfce [ 1260.824927][T23874] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1260.824943][T23874] RSP: 002b:00007f778ee44fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1260.824964][T23874] RAX: ffffffffffffffda RBX: 00007f778ee456c0 RCX: 00007f778df5cfce [ 1260.824979][T23874] RDX: 000000000000000f RSI: 00007f778ee450a0 RDI: 0000000000000004 [ 1260.824991][T23874] RBP: 00007f778ee45090 R08: 0000000000000000 R09: 0000000000000000 [ 1260.825003][T23874] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1260.825014][T23874] R13: 00007f778e216038 R14: 00007f778e215fa0 R15: 00007f778e33fa48 [ 1260.825044][T23874] [ 1261.168648][T23872] netlink: 68 bytes leftover after parsing attributes in process `syz.6.4733'. [ 1261.842529][T23892] netlink: 68 bytes leftover after parsing attributes in process `syz.1.4738'. [ 1261.865728][T23892] tipc: Failed to remove unknown binding: 66,1,1/20185096:323299651/323299653 [ 1262.416500][T23893] netlink: 'syz.0.4739': attribute type 3 has an invalid length. [ 1263.873621][T23922] netlink: 7064 bytes leftover after parsing attributes in process `syz.6.4746'. [ 1263.883305][T23922] openvswitch: netlink: EtherType 0 is less than min 600 [ 1264.030402][T23927] netlink: 'syz.2.4745': attribute type 3 has an invalid length. [ 1264.833880][T23934] ptrace attach of "./syz-executor exec"[18527] was attempted by "./syz-executor exec"[23934] [ 1265.420314][T23936] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4750'. [ 1265.811421][T23953] fuse: Unknown parameter '0x0000000000000004' [ 1267.053209][T23981] netlink: 'syz.1.4768': attribute type 39 has an invalid length. [ 1268.145532][ T5945] usb 2-1: new high-speed USB device number 83 using dummy_hcd [ 1268.331019][ T5945] usb 2-1: config 3 has an invalid interface number: 78 but max is 0 [ 1268.350188][ T5945] usb 2-1: config 3 has no interface number 0 [ 1268.743516][ T5945] usb 2-1: config 3 interface 78 has no altsetting 0 [ 1268.752517][ T5945] usb 2-1: New USB device found, idVendor=2639, idProduct=0003, bcdDevice=3c.47 [ 1268.773150][ T5945] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1268.781188][ T5945] usb 2-1: Product: syz [ 1268.792960][ T5945] usb 2-1: Manufacturer: syz [ 1268.797601][ T5945] usb 2-1: SerialNumber: syz [ 1269.030806][T24004] tipc: Enabling of bearer rejected, failed to enable media [ 1269.088237][ T5945] usb 2-1: USB disconnect, device number 83 [ 1270.043646][T24057] loop4: detected capacity change from 0 to 7 [ 1270.074064][T24056] syzkaller0: entered promiscuous mode [ 1270.083233][T22766] buffer_io_error: 45 callbacks suppressed [ 1270.083251][T22766] Buffer I/O error on dev loop4, logical block 0, async page read [ 1270.090843][T24056] syzkaller0: entered allmulticast mode [ 1270.133023][T22766] Buffer I/O error on dev loop4, logical block 0, async page read [ 1270.161265][T22766] Buffer I/O error on dev loop4, logical block 0, async page read [ 1270.176662][T22766] Buffer I/O error on dev loop4, logical block 0, async page read [ 1270.201811][T22766] Buffer I/O error on dev loop4, logical block 0, async page read [ 1270.221737][T22766] Buffer I/O error on dev loop4, logical block 0, async page read [ 1270.228521][T21429] tipc: Subscription rejected, illegal request [ 1270.230659][T22766] Buffer I/O error on dev loop4, logical block 0, async page read [ 1270.307553][T22766] ldm_validate_partition_table(): Disk read failed. [ 1270.320917][T22766] Buffer I/O error on dev loop4, logical block 0, async page read [ 1270.338779][T22766] Buffer I/O error on dev loop4, logical block 0, async page read [ 1270.355840][T22766] Buffer I/O error on dev loop4, logical block 0, async page read [ 1270.387224][T22766] Dev loop4: unable to read RDB block 0 [ 1270.403084][T22766] loop4: unable to read partition table [ 1270.419518][T22766] loop4: partition table beyond EOD, truncated [ 1270.434832][T24057] ldm_validate_partition_table(): Disk read failed. [ 1270.453135][T24057] Dev loop4: unable to read RDB block 0 [ 1270.458799][T24057] loop4: unable to read partition table [ 1270.473337][T24057] loop4: partition table beyond EOD, truncated [ 1270.490797][T24057] loop_reread_partitions: partition scan of loop4 (Sj %`ր5) failed (rc=-5) [ 1271.154591][T24099] netlink: 'syz.3.4817': attribute type 32 has an invalid length. [ 1271.162447][T24099] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4817'. [ 1271.257092][T24099] bond5: option coupled_control: invalid value (143) [ 1271.274358][T24099] bond5 (unregistering): Released all slaves [ 1272.213087][T22592] usb 1-1: new high-speed USB device number 87 using dummy_hcd [ 1272.385720][T22592] usb 1-1: config 160 has an invalid interface number: 200 but max is 0 [ 1272.398820][T22592] usb 1-1: config 160 has no interface number 0 [ 1272.415828][T22592] usb 1-1: config 160 interface 200 has no altsetting 0 [ 1272.434242][T22592] usb 1-1: New USB device found, idVendor=21bb, idProduct=2070, bcdDevice=87.0b [ 1272.447327][T22592] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1272.465459][T22592] usb 1-1: Product: syz [ 1272.475055][T22592] usb 1-1: Manufacturer: syz [ 1272.485291][T22592] usb 1-1: SerialNumber: syz [ 1272.771875][T24126] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1272.834937][T24126] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1272.929491][T22592] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 1272.954961][T22592] usb 1-1: MIDIStreaming interface descriptor not found [ 1273.057903][T24151] binder: 24150:24151 ioctl c0306201 2000000003c0 returned -14 [ 1273.112978][T22592] usb 1-1: USB disconnect, device number 87 [ 1273.188718][T22336] udevd[22336]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:160.200/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1273.265097][T24157] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4838'. [ 1274.679211][T22592] IPVS: starting estimator thread 0... [ 1274.773467][T24180] IPVS: using max 31 ests per chain, 74400 per kthread [ 1275.013006][T22592] usb 4-1: new high-speed USB device number 79 using dummy_hcd [ 1275.182959][T22592] usb 4-1: Using ep0 maxpacket: 32 [ 1275.204116][T22592] usb 4-1: New USB device found, idVendor=0b89, idProduct=0007, bcdDevice=ef.64 [ 1275.215988][T22592] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1275.273481][T22592] usb 4-1: config 0 descriptor?? [ 1275.297277][T22592] as10x_usb: device has been detected [ 1275.424011][T22592] dvbdev: DVB: registering new adapter (nBox DVB-T Dongle) [ 1275.566865][T24184] ------------[ cut here ]------------ [ 1275.572416][T24184] DEBUG_LOCKS_WARN_ON(lock->magic != lock) [ 1275.572444][T24184] WARNING: kernel/locking/mutex.c:593 at __mutex_lock+0x10a4/0x1300, CPU#0: syz.3.4849/24184 [ 1275.572783][T22592] usb 4-1: DVB: registering adapter 1 frontend 0 (nBox DVB-T Dongle)... [ 1275.578405][T24184] Modules linked in: [ 1275.600821][T24184] CPU: 0 UID: 0 PID: 24184 Comm: syz.3.4849 Tainted: G L syzkaller #0 PREEMPT(full) [ 1275.612030][T24184] Tainted: [L]=SOFTLOCKUP [ 1275.616712][T24184] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1275.627098][T24184] RIP: 0010:__mutex_lock+0x10ab/0x1300 [ 1275.632555][T24184] Code: 11 90 48 c1 e8 03 42 0f b6 04 28 84 c0 0f 85 33 02 00 00 83 3d d9 a4 61 04 00 75 13 48 8d 3d 1c ba 64 04 48 c7 c6 c0 e0 cc 8b <67> 48 0f b9 3a 90 e9 ac f0 ff ff 90 0f 0b 90 e9 73 f4 ff ff 90 0f [ 1275.652819][T24184] RSP: 0018:ffffc90002e87a20 EFLAGS: 00010246 [ 1275.659088][T24184] RAX: 0000000000000000 RBX: 1ffff920005d0f5c RCX: 0000000000080000 [ 1275.667128][T24184] RDX: ffffc90017c19000 RSI: ffffffff8bcce0c0 RDI: ffffffff9014ff10 [ 1275.675137][T24184] RBP: ffffc90002e87bd8 R08: ffffffff9011e9c3 R09: 1ffffffff2023d38 [ 1275.683130][T24184] R10: dffffc0000000000 R11: fffffbfff2023d39 R12: ffff88804515eb60 [ 1275.691089][T24184] R13: dffffc0000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1275.699566][T24184] FS: 00007f778ee456c0(0000) GS:ffff88812545a000(0000) knlGS:0000000000000000 [ 1275.708543][T24184] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1275.715138][T24184] CR2: 0000001b32723ffc CR3: 000000008a1c0000 CR4: 00000000003526f0 [ 1275.723115][T24184] Call Trace: [ 1275.726853][T24184] [ 1275.729773][T24184] ? __mutex_lock+0x319/0x1300 [ 1275.734750][T24184] ? as102_dvb_dmx_start_feed+0x70/0x290 [ 1275.740485][T24184] ? dmx_section_feed_allocate_filter+0x34f/0x3e0 [ 1275.746950][T24184] ? __pfx___mutex_lock+0x10/0x10 [ 1275.751959][T24184] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 1275.757605][T24184] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1275.763604][T24184] ? do_raw_spin_lock+0x12b/0x2f0 [ 1275.768610][T24184] as102_dvb_dmx_start_feed+0x70/0x290 [ 1275.774079][T24184] dmx_section_feed_start_filtering+0x518/0x6c0 [ 1275.780301][T24184] dvb_dmxdev_filter_start+0xcf4/0x10e0 [ 1275.785937][T24184] ? dvb_dmxdev_filter_set+0x2d1/0x580 [ 1275.791385][T24184] dvb_demux_do_ioctl+0x470/0x540 [ 1275.796418][T24184] dvb_usercopy+0x199/0x2e0 [ 1275.800902][T24184] ? __pfx_dvb_demux_do_ioctl+0x10/0x10 [ 1275.806468][T24184] ? __pfx_dvb_usercopy+0x10/0x10 [ 1275.811479][T24184] ? __fget_files+0x3a0/0x420 [ 1275.816171][T24184] ? __fget_files+0x2a/0x420 [ 1275.820747][T24184] ? __pfx_dvb_demux_ioctl+0x10/0x10 [ 1275.826059][T24184] dvb_demux_ioctl+0x29/0x40 [ 1275.830986][T24184] __se_sys_ioctl+0xfc/0x170 [ 1275.835863][T24184] do_syscall_64+0x14d/0xf80 [ 1275.840481][T24184] ? trace_irq_disable+0x3b/0x150 [ 1275.845534][T24184] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1275.851591][T24184] ? clear_bhb_loop+0x40/0x90 [ 1275.856446][T24184] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1275.862327][T24184] RIP: 0033:0x7f778df9c799 [ 1275.866809][T24184] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1275.886533][T24184] RSP: 002b:00007f778ee45028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1275.894975][T24184] RAX: ffffffffffffffda RBX: 00007f778e215fa0 RCX: 00007f778df9c799 [ 1275.902976][T24184] RDX: 0000200000000200 RSI: 00000000403c6f2b RDI: 0000000000000004 [ 1275.910944][T24184] RBP: 00007f778e032c99 R08: 0000000000000000 R09: 0000000000000000 [ 1275.918920][T24184] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1275.926995][T24184] R13: 00007f778e216038 R14: 00007f778e215fa0 R15: 00007f778e33fa48 [ 1275.935308][T24184] [ 1275.938328][T24184] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 1275.945590][T24184] CPU: 0 UID: 0 PID: 24184 Comm: syz.3.4849 Tainted: G L syzkaller #0 PREEMPT(full) [ 1275.956502][T24184] Tainted: [L]=SOFTLOCKUP [ 1275.960804][T24184] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1275.970841][T24184] Call Trace: [ 1275.974102][T24184] [ 1275.977014][T24184] vpanic+0x56c/0xa60 [ 1275.981008][T24184] ? __pfx__printk+0x10/0x10 [ 1275.985579][T24184] ? __pfx_vpanic+0x10/0x10 [ 1275.990064][T24184] ? is_bpf_text_address+0x292/0x2b0 [ 1275.995328][T24184] ? is_bpf_text_address+0x26/0x2b0 [ 1276.000521][T24184] panic+0xc5/0xd0 [ 1276.004239][T24184] ? __pfx_panic+0x10/0x10 [ 1276.008657][T24184] __warn+0x315/0x4f0 [ 1276.012626][T24184] ? __mutex_lock+0x10a4/0x1300 [ 1276.017475][T24184] ? __mutex_lock+0x10a4/0x1300 [ 1276.022323][T24184] __report_bug+0x29a/0x540 [ 1276.026884][T24184] ? dvb_demux_do_ioctl+0x470/0x540 [ 1276.032079][T24184] ? __mutex_lock+0x10a4/0x1300 [ 1276.037004][T24184] ? __pfx___report_bug+0x10/0x10 [ 1276.042359][T24184] ? pfn_valid+0x125/0x4c0 [ 1276.046766][T24184] ? __lock_acquire+0x6b5/0x2cf0 [ 1276.051691][T24184] report_bug_entry+0x19a/0x290 [ 1276.056521][T24184] ? __mutex_lock+0x10ab/0x1300 [ 1276.061349][T24184] ? __mutex_lock+0x10b0/0x1300 [ 1276.066176][T24184] handle_bug+0xce/0x200 [ 1276.070401][T24184] exc_invalid_op+0x1a/0x50 [ 1276.074889][T24184] asm_exc_invalid_op+0x1a/0x20 [ 1276.079721][T24184] RIP: 0010:__mutex_lock+0x10ab/0x1300 [ 1276.085160][T24184] Code: 11 90 48 c1 e8 03 42 0f b6 04 28 84 c0 0f 85 33 02 00 00 83 3d d9 a4 61 04 00 75 13 48 8d 3d 1c ba 64 04 48 c7 c6 c0 e0 cc 8b <67> 48 0f b9 3a 90 e9 ac f0 ff ff 90 0f 0b 90 e9 73 f4 ff ff 90 0f [ 1276.104746][T24184] RSP: 0018:ffffc90002e87a20 EFLAGS: 00010246 [ 1276.110796][T24184] RAX: 0000000000000000 RBX: 1ffff920005d0f5c RCX: 0000000000080000 [ 1276.118747][T24184] RDX: ffffc90017c19000 RSI: ffffffff8bcce0c0 RDI: ffffffff9014ff10 [ 1276.126699][T24184] RBP: ffffc90002e87bd8 R08: ffffffff9011e9c3 R09: 1ffffffff2023d38 [ 1276.134651][T24184] R10: dffffc0000000000 R11: fffffbfff2023d39 R12: ffff88804515eb60 [ 1276.142605][T24184] R13: dffffc0000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1276.150569][T24184] ? __mutex_lock+0x319/0x1300 [ 1276.155324][T24184] ? as102_dvb_dmx_start_feed+0x70/0x290 [ 1276.160939][T24184] ? dmx_section_feed_allocate_filter+0x34f/0x3e0 [ 1276.167335][T24184] ? __pfx___mutex_lock+0x10/0x10 [ 1276.172339][T24184] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 1276.177951][T24184] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1276.183909][T24184] ? do_raw_spin_lock+0x12b/0x2f0 [ 1276.188912][T24184] as102_dvb_dmx_start_feed+0x70/0x290 [ 1276.194357][T24184] dmx_section_feed_start_filtering+0x518/0x6c0 [ 1276.200579][T24184] dvb_dmxdev_filter_start+0xcf4/0x10e0 [ 1276.206103][T24184] ? dvb_dmxdev_filter_set+0x2d1/0x580 [ 1276.211542][T24184] dvb_demux_do_ioctl+0x470/0x540 [ 1276.216551][T24184] dvb_usercopy+0x199/0x2e0 [ 1276.221034][T24184] ? __pfx_dvb_demux_do_ioctl+0x10/0x10 [ 1276.226558][T24184] ? __pfx_dvb_usercopy+0x10/0x10 [ 1276.231566][T24184] ? __fget_files+0x3a0/0x420 [ 1276.236245][T24184] ? __fget_files+0x2a/0x420 [ 1276.240823][T24184] ? __pfx_dvb_demux_ioctl+0x10/0x10 [ 1276.246096][T24184] dvb_demux_ioctl+0x29/0x40 [ 1276.250672][T24184] __se_sys_ioctl+0xfc/0x170 [ 1276.255245][T24184] do_syscall_64+0x14d/0xf80 [ 1276.259819][T24184] ? trace_irq_disable+0x3b/0x150 [ 1276.264822][T24184] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1276.270872][T24184] ? clear_bhb_loop+0x40/0x90 [ 1276.275527][T24184] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1276.281421][T24184] RIP: 0033:0x7f778df9c799 [ 1276.285818][T24184] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1276.305409][T24184] RSP: 002b:00007f778ee45028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1276.313803][T24184] RAX: ffffffffffffffda RBX: 00007f778e215fa0 RCX: 00007f778df9c799 [ 1276.321753][T24184] RDX: 0000200000000200 RSI: 00000000403c6f2b RDI: 0000000000000004 [ 1276.329726][T24184] RBP: 00007f778e032c99 R08: 0000000000000000 R09: 0000000000000000 [ 1276.337681][T24184] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1276.345662][T24184] R13: 00007f778e216038 R14: 00007f778e215fa0 R15: 00007f778e33fa48 [ 1276.353624][T24184] [ 1276.356899][T24184] Kernel Offset: disabled [ 1276.361207][T24184] Rebooting in 86400 seconds..