last executing test programs: 6m45.390385954s ago: executing program 0 (id=1569): r0 = socket$inet6(0xa, 0x3, 0xff) fsopen(&(0x7f00000001c0)='cpuset\x00', 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x7, @private2, 0x8543}, 0x12) dup(r0) r1 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$inet_opts(r1, 0x0, 0xd, &(0x7f00000008c0)=';', 0x1) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x41, &(0x7f0000000200)=0x632a, 0x4) setsockopt$inet6_int(r1, 0x29, 0x31, &(0x7f0000000000)=0xb2, 0x4) sendmmsg$inet6(r1, &(0x7f0000000e00)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c, 0x0}}], 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000000c0)=@file={0x0, './file0\x00'}, 0x6e) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000000)=0xfffffffe) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000019100)='net/udp6\x00') openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x3f, 0x0) r4 = syz_usb_connect(0x7, 0x9dd, &(0x7f0000000940)=ANY=[@ANYBLOB], &(0x7f0000001780)={0xa, &(0x7f0000000500)={0xa, 0x6, 0x250, 0x7e, 0xff, 0x88, 0x20, 0xfd}, 0x19, &(0x7f0000000400)=ANY=[@ANYRES8=r3]}) ioctl$I2C_SMBUS(0xffffffffffffffff, 0x720, &(0x7f0000000300)={0x1, 0x0, 0x7, 0x0}) syz_usb_control_io$hid(r4, &(0x7f0000000380)={0x24, 0x0, 0x0, &(0x7f0000000700)=ANY=[@ANYRES16], 0x0}, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) socket(0x10, 0x3, 0x0) r5 = fsopen(&(0x7f0000000140)='devpts\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) fsmount(r5, 0x0, 0xf) fsconfig$FSCONFIG_SET_FLAG(r5, 0x0, 0x0, 0x0, 0x0) fsconfig$FSCONFIG_CMD_RECONFIGURE(r5, 0x7, 0x0, 0x0, 0x0) 6m41.563540519s ago: executing program 0 (id=1579): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, 0x0, 0x0) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8000007, 0x0, 0x5, 0x0, 0x40000000000006, 0xfa11, 0xffffffff}, 0x0) r4 = openat$kvm(0xffffffffffffff9c, 0x0, 0x20a00, 0x0) ioctl$KVM_CHECK_EXTENSION(r4, 0xae03, 0x95) pwritev2(0xffffffffffffffff, 0x0, 0x0, 0x1000, 0x7, 0x4) syz_emit_ethernet(0x3e, &(0x7f0000000080)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff08004700003000000000000690780000000000"], 0x0) syz_usb_connect(0x0, 0x41, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000e518a708ac0501859d200000690109022f00010000000009040000000e010000152403"], 0x0) ioctl$USBDEVFS_REAPURBNDELAY(0xffffffffffffffff, 0x4004550c, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000200)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, &(0x7f0000000300)="c99b57381801238c09d0ff0f1d0dbd30", 0x10) r6 = accept4(r5, 0x0, 0x0, 0x0) sendmsg$NL80211_CMD_GET_KEY(r6, &(0x7f0000000800)={0x0, 0x0, &(0x7f00000007c0)={0x0, 0x44}, 0x1, 0x0, 0x0, 0x40000}, 0x20000000) recvmmsg(r6, &(0x7f00000048c0)=[{{0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000001d00)=""/1, 0x1}], 0x1}, 0xc}], 0x1, 0x10002, 0x0) 6m38.383570251s ago: executing program 0 (id=1594): r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, &(0x7f00000000c0)=0xa0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, &(0x7f0000000040)={@host}) ioctl$IOCTL_VMCI_DATAGRAM_SEND(r0, 0x7ab, 0x0) 6m38.286137921s ago: executing program 0 (id=1595): socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x1) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r3, &(0x7f0000000140)='.\x00', r2, 0x0, 0x41) move_mount(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', r3, &(0x7f0000000100)='./file0\x00', 0x220) unshare(0x2040400) syz_usb_connect$hid(0x6, 0x36, &(0x7f0000000180)=ANY=[], 0x0) openat$udambuf(0xffffffffffffff9c, 0x0, 0x2) r4 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r5 = dup(r4) r6 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8b0f, &(0x7f0000000000)={'wlan1\x00'}) r7 = syz_io_uring_setup(0x118d, &(0x7f00000000c0)={0x0, 0x8d2dc, 0x0, 0xffffffff, 0xc2}, &(0x7f00000003c0)=0x0, &(0x7f0000000200)=0x0) epoll_create1(0x80000) syz_open_procfs(0x0, 0x0) syz_open_dev$sndpcmc(&(0x7f0000000000), 0x0, 0x80000) syz_memcpy_off$IO_URING_METADATA_GENERIC(r8, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r8, r9, &(0x7f00000002c0)=@IORING_OP_ACCEPT={0xd, 0x72, 0x5, r5, 0x0, 0x0, 0x0, 0x80000}) io_uring_enter(r7, 0x47f5, 0x0, 0x0, 0x0, 0x0) r10 = landlock_create_ruleset(&(0x7f0000000040)={0x2, 0x3, 0x3}, 0x18, 0x0) landlock_restrict_self(r10, 0x5) r11 = landlock_create_ruleset(&(0x7f0000000080)={0x8040}, 0x18, 0x0) landlock_restrict_self(r11, 0x6) syz_io_uring_setup(0x837, &(0x7f0000000180)={0x0, 0x679a, 0x80, 0x4, 0x3cc}, &(0x7f0000000040), &(0x7f0000000140)) 6m34.993724596s ago: executing program 0 (id=1608): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f0000000a80)={0x14}, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="01000000020000001c0012000c000100626f6e64000000000c0002000800010005"], 0x3c}}, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=ANY=[@ANYBLOB="4c00200010001fff00000000fddbdf2500000000", @ANYRES32=0x0, @ANYBLOB="04210200003f0000240012800b0001006272696467650000140002800500070006000000050029000000000008000a00", @ANYRES32=r2], 0x4c}, 0x1, 0x0, 0x0, 0x2000c0c1}, 0x20048000) 6m34.71415249s ago: executing program 0 (id=1609): r0 = socket$inet6(0xa, 0x3, 0xff) fsopen(&(0x7f00000001c0)='cpuset\x00', 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x7, @private2, 0x8543}, 0x12) dup(r0) r1 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$inet_opts(r1, 0x0, 0xd, &(0x7f00000008c0)=';', 0x1) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x41, &(0x7f0000000200)=0x632a, 0x4) setsockopt$inet6_int(r1, 0x29, 0x31, &(0x7f0000000000)=0xb2, 0x4) sendmmsg$inet6(r1, &(0x7f0000000e00)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c, 0x0}}], 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000000c0)=@file={0x0, './file0\x00'}, 0x6e) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000000)=0xfffffffe) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000019100)='net/udp6\x00') openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x3f, 0x0) syz_usb_connect(0x7, 0x9dd, &(0x7f0000000940)=ANY=[@ANYBLOB], &(0x7f0000001780)={0xa, &(0x7f0000000500)={0xa, 0x6, 0x250, 0x7e, 0xff, 0x88, 0x20, 0xfd}, 0x19, &(0x7f0000000400)=ANY=[@ANYRES8=r3]}) ioctl$I2C_SMBUS(0xffffffffffffffff, 0x720, &(0x7f0000000300)={0x1, 0x0, 0x7, 0x0}) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) r4 = socket(0x10, 0x3, 0x0) sendto$inet6(r4, &(0x7f0000000000), 0x0, 0x0, 0x0, 0x0) r5 = fsopen(&(0x7f0000000140)='devpts\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) fsmount(r5, 0x0, 0xf) fsconfig$FSCONFIG_SET_FLAG(r5, 0x0, 0x0, 0x0, 0x0) fsconfig$FSCONFIG_CMD_RECONFIGURE(r5, 0x7, 0x0, 0x0, 0x0) 6m34.52681868s ago: executing program 32 (id=1609): r0 = socket$inet6(0xa, 0x3, 0xff) fsopen(&(0x7f00000001c0)='cpuset\x00', 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x7, @private2, 0x8543}, 0x12) dup(r0) r1 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$inet_opts(r1, 0x0, 0xd, &(0x7f00000008c0)=';', 0x1) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x41, &(0x7f0000000200)=0x632a, 0x4) setsockopt$inet6_int(r1, 0x29, 0x31, &(0x7f0000000000)=0xb2, 0x4) sendmmsg$inet6(r1, &(0x7f0000000e00)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c, 0x0}}], 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000000c0)=@file={0x0, './file0\x00'}, 0x6e) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000000)=0xfffffffe) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000019100)='net/udp6\x00') openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x3f, 0x0) syz_usb_connect(0x7, 0x9dd, &(0x7f0000000940)=ANY=[@ANYBLOB], &(0x7f0000001780)={0xa, &(0x7f0000000500)={0xa, 0x6, 0x250, 0x7e, 0xff, 0x88, 0x20, 0xfd}, 0x19, &(0x7f0000000400)=ANY=[@ANYRES8=r3]}) ioctl$I2C_SMBUS(0xffffffffffffffff, 0x720, &(0x7f0000000300)={0x1, 0x0, 0x7, 0x0}) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) r4 = socket(0x10, 0x3, 0x0) sendto$inet6(r4, &(0x7f0000000000), 0x0, 0x0, 0x0, 0x0) r5 = fsopen(&(0x7f0000000140)='devpts\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) fsmount(r5, 0x0, 0xf) fsconfig$FSCONFIG_SET_FLAG(r5, 0x0, 0x0, 0x0, 0x0) fsconfig$FSCONFIG_CMD_RECONFIGURE(r5, 0x7, 0x0, 0x0, 0x0) 20.850369675s ago: executing program 2 (id=2592): openat$fuse(0xffffffffffffff9c, &(0x7f00000009c0), 0x42, 0x0) ioctl$VIDIOC_ENUM_FREQ_BANDS(0xffffffffffffffff, 0xc0405665, &(0x7f00000003c0)={0x0, 0x2, 0x0, 0x1, 0x7, 0x7, 0xa}) openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) openat$nci(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={0x0, 0xb8}}, 0x0) sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000340)=ANY=[@ANYBLOB="8400000000020102fffd0000000000000700000224000a800800014000000000080001400000000008000140000000000800014000000001"], 0x84}, 0x1, 0x0, 0x0, 0x40010}, 0x4008000) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) r3 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) ioctl$SCSI_IOCTL_GET_PCI(r3, 0x5393, &(0x7f0000000000)) 19.361682749s ago: executing program 2 (id=2599): r0 = syz_usb_connect(0x0, 0x1cb, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000122f0d4071040403dfe4000000010902b901010000003f0904"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0xa4242, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000007, 0x38011, r1, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f00000001c0)={0x14, &(0x7f0000000040)=ANY=[@ANYBLOB="0021a5000000a5045104c3b97c072c542e41534d71cda005baf9a9536f922b48a9f2104a8183c0dbe52a152b31bd00160ca14102b28373b6c2221dbccbc4907505aef6552cdd0c8537311dfb8e9e0ac6b160dd43843256e6ff6f1802694aca5752bee2372aa4ddb2d68d7f2b1e4ff29c0a4d28cfc17195f64a23e8e4d1a0a1e4a02024e86fa6a0fb900b90b4d71b571c88a6fd45b9205e69e2ec6d76c4dd12745c6518ba5a619d75d56a4a"], &(0x7f0000000100)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x500a}}, &(0x7f0000000140)={0x0, 0x22, 0xc, {[@local=@item_4={0x3, 0x2, 0x1a, "7020a09b"}, @local=@item_4={0x3, 0x2, 0xa, "c5caa830"}, @local=@item_012={0x0, 0x2, 0x7}, @global=@item_012={0x0, 0x1, 0x9}]}}, &(0x7f0000000180)={0x0, 0x21, 0x9, {0x9, 0x21, 0x6, 0x0, 0x1, {0x22, 0xbc}}}}, &(0x7f00000004c0)={0x18, &(0x7f0000000500)=ANY=[@ANYBLOB="20300001000036542af38c162e80fc624f5f9041a5d7191fb4ee4b9102a56db7fee02cc02e90f81fc877fd8ad54c6faee56398dd21979c7966b4b3923137c2c467826403ee550327052c4644b345e2532f34d72f08d97aad86eb137b709415dc4ea9c84b519c74d870847206ce2ea75306c09ee287f48330e43dbd4f221592c059f614ebf1b9629a85a17b7b98dc52693bbfd2a60e0df5e92e515db71659e331964896acad214d7f644296b70b2998101da194afb6634db4a7bb945d0081171a0e6daa323eafb13855b73f5e1af3134936f0742d68209fe3cb97d32802308bdfb30c66960c61da315902f652a100"/247], &(0x7f0000000300)={0x0, 0xa, 0x1, 0xa}, &(0x7f0000000340)={0x0, 0x8, 0x1, 0x4}, &(0x7f0000000380)={0x20, 0x1, 0xe2, "756d202dbbdcd444228b681373dbe67af1130c3cb6ddadc6446a69757374adfca325e0baf0de9de169d279a7ccf80143cb59f4c518cbe9cc909948eadb6492220a96abf5d59fe5dea05f9127466f5aae3fcc4b4292b5d804575f5a7979a6003381e5ddafbf484990fb080d4dc715d11d56aa7e9fc3a93767cb3243e2a0b8328be4af9ae302939b61a320cb309b654c93bac89fff8bafcdf778c1690b90fd15bc1e897a926a2ec5b237ebd22559ee514fb1672eecebb40eb9b18347f0defe52559906771b1831a8bc7df3108b4f72d0c5b95eef73f0efa19dab00afe3b23bfa9b8c3a"}, &(0x7f0000000480)={0x20, 0x3, 0x1, 0x7}}) madvise(&(0x7f0000010000/0x1000)=nil, 0x1000, 0xe) openat$vicodec0(0xffffff9c, &(0x7f0000000000), 0x2, 0x0) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x2) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x17) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_open_procfs$pagemap(0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) bpf$MAP_CREATE(0x0, 0x0, 0xffffffffffffffc6) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, 0x0, 0x0) 14.316645519s ago: executing program 2 (id=2623): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = socket(0x840000000002, 0x3, 0xfa) mkdir(0x0, 0x22) close_range(r2, 0xffffffffffffffff, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000300)={0x6, 0x2, 0x4}) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0) ioctl$PPPIOCNEWUNIT(r3, 0xc004743e, &(0x7f00000000c0)) ioctl$PPPIOCSMRRU(r3, 0x4004743b, &(0x7f0000000180)=0x200) bpf$MAP_CREATE(0x0, 0x0, 0x50) unshare(0x62040200) syz_usb_connect(0x0, 0x4a, 0x0, 0x0) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) socket$inet6(0xa, 0x2, 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000100)={0x38, 0x2, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}]}, 0x38}}, 0x8000) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000780)=ANY=[@ANYBLOB="74000000090601020000000000000000030000000900020073797a310000000005000100070000004c0007801800018014000240fe8000000000000000000000000000aa1800148014000240fc000000000000000000000000000000060004404e1f0000050007008400000006000540"], 0x74}, 0x1, 0x0, 0x0, 0x10040003}, 0x0) 12.547709071s ago: executing program 5 (id=2631): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000004300), 0x1, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_PIT(0xffffffffffffffff, 0x8048ae66, &(0x7f0000000000)={[{0x4, 0x200, 0xc2, 0x4f, 0x19, 0x7, 0xc0, 0x1, 0xff, 0x6, 0xc, 0x0, 0x9}, {0x8, 0xaef3, 0x6, 0x8, 0x9, 0xff, 0x8, 0x3, 0x4, 0x13, 0x1, 0x6, 0x10005}, {0x1fb, 0x7, 0xd, 0x10, 0x25, 0xe, 0x0, 0xfb, 0x4, 0x15, 0x1, 0x3, 0x3ffffffffffffd}], 0x9}) r2 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = openat$procfs(0xffffff9c, &(0x7f0000000340)='/proc/zoneinfo\x00', 0x0, 0x0) ioctl$LOOP_SET_FD(r4, 0x4c00, r0) r5 = openat$incfs(0xffffffffffffffff, &(0x7f0000000100)='.pending_reads\x00', 0xb8480, 0x40) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r5, &(0x7f0000000300)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x9}, 0xc, &(0x7f00000002c0)={&(0x7f00000001c0)={0x14, 0x3, 0x2, 0x5, 0x0, 0x0, {0x2, 0x0, 0x2}, ["", "", "", "", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x8000001}, 0x8000) r6 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r6, 0x4090ae82, &(0x7f0000000200)={[0x2, 0x9, 0xfffffffffffffffd, 0x0, 0x2, 0x3, 0x4002004c8, 0x1004, 0xffffffffffffffff, 0x9, 0x0, 0xdf, 0xffffffffffffffff, 0x2000000000000000, 0x0, 0x8d], 0xeeee8000, 0x40003}) ioctl$KVM_RUN(r6, 0xae80, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) syz_usb_connect(0x1, 0x3f, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000d0918108ac051582588f0000000109022d00010000000009040000030b08000009058da203002a000009050502"], 0x0) r7 = eventfd2(0x6, 0x801) r8 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_INITMSG(r8, 0x84, 0x2, &(0x7f00000000c0)={0xfffc}, 0x8) sendto$inet6(r8, &(0x7f00000004c0)='W', 0x1, 0x0, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback, 0x8}, 0x1c) getsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r8, 0x84, 0x8, &(0x7f0000000100), &(0x7f0000000440)=0x4) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x32, 0xffffffffffffffff, 0x739ef000) ioctl$KVM_HYPERV_EVENTFD(r1, 0x4018aebd, &(0x7f0000000000)={0x3, r7}) fchown(0xffffffffffffffff, 0x0, 0x0) ioctl$KVM_HYPERV_EVENTFD(r1, 0x4018aebd, &(0x7f0000000180)={0x1, 0xffffffffffffffff, 0x1}) 9.817460159s ago: executing program 2 (id=2636): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x20702, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r1) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$devlink(&(0x7f0000000140), r0) sendmsg$DEVLINK_CMD_PORT_GET(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000180)={&(0x7f0000000240)={0xf8, r3, 0x0, 0x70bd2b, 0x25dfdbfc, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}}}, {{@pci={{0x8}, {0x11}}, {0x8}}}, {{@pci={{0x8}, {0x11}}, {0x8}}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2}}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2}}}, {{@pci={{0x8}, {0x11}}, {0x8}}}]}, 0xf8}, 0x1, 0x0, 0x0, 0x20008004}, 0x20000000) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f0000000340), 0x11000) writev(r4, &(0x7f0000000380)=[{&(0x7f00000006c0)="0d612c10150bbfda8a172837ee3897325f9fa9480b707c0e8606af24f2695bc78ec68f1083694b6d2e1b3315b08924ae3adbe2ba29bb3c2070e9df8002e907a3f2ee23b451f5653465a138511b3e4b311bb38dbee4e1293032a08f3ff8c1401d955b02ee3185553f3bd7848224aa7820b4b42932c10e59e0208956b057ca7043ae43c33d007d30e32d3171e91827083dceb0b13a2d8102b4106b4a3f5bfd992b332b30a6fce114de88610040ab8e2a689ac9bc23c9edf2e37046a751b07104e4693498f9fb0d9fa8b27417bcea9d3a4fa96e37b6ea0b66a6b6fbcd12d85b24762775d49fc9a370cf6dda486b96fdc7375909e271485ec02ae71e5fcce5c2ddb92f089eaace96b3337c16e297eef52e4e579bed5e6d7ca095908d7d5c239f8ace29cfccb49294faa696a5aed28b435180d7f6e54cfa3d9a41f7bae51465733e5e98bfa96ef227931178c17415dfb35dfe0ec3f00eef20edbf6a7649417e1b3e5587c9605eaac8a8b0bb6ac4ca4a555a3940dae10aec0df46e06798948b88a875a95c4ddd67faafaaabb66c9de583600d5a17800e04f4e365348f17a8b5da39cb93e00c7ced564c6f62c9208560b85f2ba5f6e6b5dfd23b58ff85fade7c6f94c6f92ddac7591efdd1cd9def36fc100940fc2c22bc56ffb1b26c02d30015d6da9a81fde11f3ef08375427cf83963bab83940650d0db960b2a5cdc94348c0334ac83476d617c9b0cb2ec251753f6c5c37203bd4119726d5ea26ec965e174395a8657dbea23e0b9499d3045328ad61dd4238b207200eb100bba933ddebbed33c6f2633a242535c313ee09df66370100fd859493c87ffacc52a2d14b264ece76cf296b603bd3051aaefa78d792ad387a164e9df431126bcf27d72eb76b8eb734a51de9ffcfea6573387b238a398e3ad2dc38c136777f0792bbcb6a949ae6ccc85fd9f3c4c42d51d6b4829cf4804295caa8d4b76dccbfabb0fe95f896bbd201174ca38716615c9ce35263f1667ce2d2913e190023bb106d83eacffda6308e4b393143425386ff2c43a0df48583216482866ab7759d0183f74f2bd48bf710edf94d5d6b6c037f6cdbdaaeab3beddd4df1b2d9d464c03902b6a8def2232cc690468caa8dc37563a14800c0654e2e121cc1173aa2fc613a00eeb1fef542c12456231424b4a00f412c98e81da276d854951ebfafd4c6c1d966e93843ed5273e321dc3deb7b59d31734d917f861ee82dbe3dc3a51d81074e9a4081bb438b0554efd0d704e5776cc1e5a400c9ce6ed4663e1afa8526f5dfe51be5a20d7a72dd6f4ef3ad113ad180e0e5712e25cd442c08afc57f265ee8b6b5d31c72c374ed123ec1c1b008fe5c81ce2a6a7458af50635b861c567285e361f86b49aad7c06a6af0c59a5d1898afc401928f187e948a636f0fe6813a07e4bb53664f7a7af42739d2be73ebc520ea78209feea33be8e9dac7c71a65868f36242b95f4f17339e3136cc49ad8679d2f24f978221a47aac900263c2a04fcd96b9f631caa109c33c78213e27f3abb1cc90dd806901723731723afa9810eb4d6529bd1d0a9d5b8ddb7bba1124d86977d45b9ce99317a457063ed7b35f8e136e175f6b6a4e0ac33ee5084caa1f7974afcf96b2b2e53891feb89be8f2b0da5fb8f05ea6dacf5b0ba5c0b4c8f5371e0ede86019051adff8911759d915714ff133a5cd9a00dbb2c4d1f7186a7bd62694a992be2489baeeca6d3b4b80c0773bd7fea5f38d9339fa924b8767bcf213bac2745b85b34c5dde8125fa4aa4f82a977796d9cf264408244ae3e928254a3bd8465b2dcca9e8a53c04fd16e9a77c68881cc07d8db637cc50ec38347fa4acc9df66080ea69780c878465564a05ff53e56d8f267c0eb3466fc0cea4550fa8f72755c473f2df19e8f5f4aefe48bf9995b0be5e533759a26177b82d46b3388328f3d57e56a9789919e8e54c06c9b9490812d7a24deca484af904bf6a68a330577f9dc2891318cb30cb25ecb388d131a596b36a4179c30c0c391a737973179b04f25c4ff04690fafd373a778ae2c99196e13f6bde39557daf73ae6336663f980b33352da9e842ff0d4d6c314befdf4629b89acbb22a990cbeca3baa0ef941a070904f40bc7612b472383ac360ba5ccdfa0d0d3fe8693a6bce3100ecfb97d8baf2ecd7a8b1675ab00cb5364917271631d40fbbfea443e4817d05180079eb2927693d19901b1cfe5be1a240a89c8998db2bc91f51ecec6f9e03ca725007bfcf9025909b6e71a12cc27dc37f7ba075a9c00976f3b0642cfa8157ee0ad93e161e5eb70d47d005cfab953914bbb66bbe46fb504df4c3e61b8fc21f8590028ea37f07592b5994175302c3c16c144c6a3369ca6c8183999bf4b27be7dbdbc1207a0be41424d06f860b879b139c503de79196c7448501112642e161cba60df354419e6ba4e368d7e924f22317e1edf4d49a54bacd03146b0e1edef9a4edfaa01f9b73aae82050e4c8ab96c43b12545a9697b8d0cc7d364bcfc160806168e8f4206c07ec216ceefa2849834085ae2991045571ee2c41de0a4e7f015b8bbe7a074130929107fba4649063686e3b6bd0863cc56be99fa51418360eaa9195db348c3003458aeee58b93ac729fbcfbe24b974a5263c7bbbc07314841c870caa10e6265c99af3fce1bd4fdd30d6e32694f207f027be9bc73f29074d9386e3618901f4eaeb63f3c430b4fdd18cb3108a98cce5672e027546af044cfcd83f372abe78fe92bb2df93ce2decbd8c9e5510b4625caa5ab74a43f1f09b6a2fca5aeb28e1f25a91a1ac95781dce67cbdcc73005afacd5ff0d62eecd25e8cb6b36d3d1d1ca1575d77cbab3a6ac69d7e27e90fc4c9daad29f0cd19409c8b925d8bb8a2fe5585ceceae33bcc329cd26915fbc5eb79cdf72d6eafe9dce60d7cd337ec633b3341260f843ed7d21616f88f3917e0fa8f8efc6f72177bb4aa2c7568f2a6f27397716de807d65db7aeee5d08f48c31ccacf9f94468dd14098fc2573fde7dd6eedfccf472f230d56b49265b999a3f1d42601eb268a7bfa6f03b7e06193c2b253e83f956bf2194f27d8e0d044244cef6785a2329e7d82c78ebce481a0e9412bb7dafde8d4a536bf2805e21e76ee289abcfaa93a19743b7b376f309242f7d34a3d3f152064e1c40a2bb187f00f854d91dfc26d458ae3f0166a164c45c3020b80ecf9905c8870def82f5a466776e0b8772fa931690b8bc641372dbd04619231a3d1ea9f8afb2834d5e13d110b129de527cb3f4e936d5f64757842c43af36972c18704c58f34b47555a2813637c1f126a1de14a129e6fb4dfebb8135cc7ea6d18a23fda3980f626bcb5fdc9b878f0225efab398ed2ac76384d3259b03ab592efc82485b2c4c0014d79f2ac87f64dbc8028631c178ed39da0113998939db4389bfe7d92a0092d571c0d026aa71c70c4fb30eebfb8c5d1305e02efccedf90652cede8443b92e63a2c30db57347782e1388fd27992694332708fe7ae50d1466b8b698655e090c9fe30e2f77192c7f7073ceb670d2311d108c9f5fd16bda8e3da20c31f369c4612f7647e3da9aca491750b51b0b84c676c4b773543fdf5f92634f1fefa1ed2230fbc6b9bf7e1a0b88dd2b7882ae18106930a79cd8150047c7ad0e4393d9595e743d877a2dcdfa1fabb7b136e6c1e1ff92ef258aa44274e0c3ed755e63befbb5f9865ec6f8382547d34ba590e14eecd851c1002f850bfb672de51bbac8ed00bf5ca05aa9f5115b26d7cb154e4e80c064259baaffeb485384542acb83b3dc972e7886178a1d329b071b9045b7aaa7758266014eced858a431feab9a34226966d597454e963a7cdeb2bd884e15eba854e34e74f07304a6b198bb7516f0f6eb23696dc456345eb30d4ac6ad0aaa8abe664a2f961add7d322ff98e123225219fb0689d1029dcc638b23b1fb38a9174b6959c63dfb23dd5a0bf1c6b33587b6df6086c9a1bfb779b5a21fdd5818beadcea4b273ba43641f02faeac4e80b075b6c1c338754af5b1c8899cf1574dfba02356479ee9572d9ee444193fe3adc23123df523e8803ce1ebafe89db56a3a6ec8d0df064c1854c9ffe25f62aa9657d4961cbed76d379f5d511c31d067acbca4286083c942cbc05d02238d5951a413ed6d653455099d91000a26d7e8a4546516d62c87ec11573d316469e686885c162cfdaa84a0e92c86d192db4f32cc101d189df5cf738810d7e9cc8932c18675078173a715a18a350c26a66b02da8e678f63e531302b13d0b64676ef746abfeff4908271d5f707786b328dfe8da4b69530e6213e0577539ce6e2ccb9325ab4272826816b870c3ff05a3bff349e8374b7ebb56a3071c9c9fc124faf1806735648e37244f3bf358c71eb266b9095b2e1cc14f67e689f3e14902ea548334642b2efa592c938c1ba8ce609e11787f0f63563363de3ca7a5c8033f76225d995d1b3fa5c3968e7b2f205f873e0c1e18307f07d4defff779dc57a67a16ceea120ae5b4880f5d1ce067b0d2b436339d1c58804ccb782498b852d83fbe63b443164d4278baa5b52b5d7e7747733acc4e6ce53bb32b52431dc6809bcf92f8f225291c2111ddbc9a77e01b54d9dbb774ae24ba04e37c9fc697fad580b44e4fadb2b93481d3b2fbaa1aeb417a385496829a09fe623c43b7f4b09da0c571c5548b80841ad9f6048730cc7ab6efbb8865a8a8aa45e33490886d116b9bbe38f079a766a4e1a3ad626eb241c6708a60f6f682adffcb2ee36f38c2e3b68523eee2fc3099e802ea414fe7700696f191f173deb18d357084deb98bcee328287e87809d74b1389c7a96afafd0d4451440e3feb7127c7e97339dcb8f9f81daa36bc496c92f3bcdc57fffb74994c1bbb251a29b2bde5787036233b02832b4637f5008ff521b77b65c3b2e0ffd9b04eaf6dbdb0edc1eb3ccf2a4e51fa732c21cc13ffd941238f144968fa13074b30f0b3d5415c56809b5433096ecdb2042a2b3754811dfabd9ac83b9d44522537519dd4b6f59c44ff11b31447ac8241f5d7298ac56ee0c6adc21027184249e13919cfaab328ededf824074b0dbdac88e678cc4b237fd39252d3cd5c2ad33aca8c2de6c843f0efa5be057934dc81ba3a0c1c54478ad95c55d6579f4aaca2d2c7760df4226fca9a20adc1874346c3d4fb2fb515e0b2b5f609faa44b2e1b2f66021a28653ec28842a4090bd996fe8f9520552d7f1e1b40107f8a893e4b4fcc2d4efdfda74326a8977fc833997fbe2404e1e2f1eb49cfb548cf0af13bcb2325c8ddcbcbfcf0c4db1a711cb9b8719b26e91ee3a43a9b2f91b52303ab711e8324aa8b636aef13c20c63ca1315022c49d637f306c2deb62e3ce2b93521bc028e41efc393c22096447fc481249f6040406a0bd46eb2d6cb58b2ebd7892086873bd356dd94bbbf010f4c928d8b948073d25b076e231581d967bc487d104ab5c95c1b996620647a8198c13b4aed351f7d9a62ad27240bdb4ec388e5ea80d998c15217a174dbbac07bfb1012b48f86f7856e60de42127fd800898c2fe2e8b60334d2b71c4807f75074dc7b4c40847548a9615437fce320d21122419fdd2a7359f3d1c4a68044719477b42aaf88aa6a85e12976bfa96d3956098214c86a7956b3c813d3127bf25c60f458e6e333d7de4834090ebe85bbfe4e84d94ce4e1bc2033701b0611e62c37f57e995f8d264adb84f4485fdd9483710515c01b68f6cdcfe16a1c354ac14f128df3d057ffa0aebd91f225b94472eeda0a15a6c474f648aff524032169e584ad5244791990bdb2c5efb0d59dcdda09c67", 0x1000}], 0x1) r5 = socket$unix(0x1, 0x1, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r7 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r8, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xb}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x2}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000700)=@newtfilter={0x8c, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r8, {0xd, 0x5}, {}, {0x7, 0xb}}, [@filter_kind_options=@f_matchall={{0xd}, {0x58, 0x2, [@TCA_MATCHALL_ACT={0x54, 0x2, [@m_ife={0x50, 0x1, 0x0, 0x0, {{0x8}, {0x28, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x4000048, 0x8, 0x20000000, 0xa, 0x3}, 0x1}}, @TCA_IFE_TYPE={0x6, 0x5, 0xfff}]}, {0x4}, {0xc}, {0xc, 0x8, {0x2, 0x3}}}}]}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x404c000}, 0x24000850) write$cgroup_int(r4, &(0x7f00000000c0)=0xa7, 0x12) 8.885493749s ago: executing program 4 (id=2641): r0 = syz_io_uring_setup(0x10d, &(0x7f0000000380)={0x0, 0x0, 0x80, 0x0, 0x4000}, &(0x7f0000000340)=0x0, &(0x7f0000000240)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000440)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f00000002c0)=@IORING_OP_SHUTDOWN={0x22, 0x9}) io_uring_enter(r0, 0x3516, 0x0, 0x0, 0x0, 0x0) r3 = openat$userio(0xffffffffffffff9c, &(0x7f0000000000), 0x2002, 0x0) readv(r3, &(0x7f0000000340)=[{&(0x7f00000003c0)=""/79, 0x4f}], 0x1) write$USERIO_CMD_SET_PORT_TYPE(r3, &(0x7f0000000040)={0x1, 0x6}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r3, &(0x7f0000000080)={0x2, 0xdf}, 0x2) socket$igmp6(0xa, 0x3, 0x2) r4 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000340)=ANY=[@ANYBLOB="12010000000018105704da0700000000000109022400010000ba0009040000090300000009210000000122220009058103"], 0x0) syz_usb_control_io$hid(r4, 0x0, 0x0) syz_usb_control_io$hid(r4, &(0x7f00000001c0)={0x14, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="00222200000049e9b3"], 0x0}, 0x0) syz_open_dev$hidraw(&(0x7f0000002300), 0x0, 0x14e040) write$USERIO_CMD_REGISTER(r3, &(0x7f0000000100), 0x2) syz_emit_ethernet(0x80, &(0x7f0000000000)={@local, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x72, 0x0, 0x0, 0x0, 0x1, 0x0, @rand_addr=0x64010100, @local}, @time_exceeded={0xb, 0x0, 0x0, 0x3, 0x2c, 0x0, {0x15, 0x4, 0x0, 0x1, 0x0, 0x66, 0x0, 0x0, 0x89, 0x0, @private=0xa010102, @private=0xa010102, {[@cipso={0x86, 0xfffffdda, 0x2, [{0x6, 0xc, "5e000000ff000000f587"}, {0x1, 0x2}, {0x0, 0x12, "9606053d0006ff00800000b61af93a93"}]}, @end]}}, "a815"}}}}}, 0x0) 8.699517497s ago: executing program 5 (id=2642): socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2) ioctl$KVM_SET_CPUID2(r4, 0x4008ae90, &(0x7f0000000000)={0x2, 0x0, [{0x80000008, 0x1, 0x3, 0xfc, 0x4, 0x2, 0x7}, {0x80000000, 0x0, 0x6, 0x3, 0x4, 0x6}]}) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) ioctl$USBDEVFS_REAPURBNDELAY(0xffffffffffffffff, 0x4004550c, 0x0) r5 = openat$vnet(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$int_in(r5, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r5, 0x4008af03, &(0x7f00000016c0)={0x2, 0x0, [{0x2, 0x28, &(0x7f0000000080)=""/40}, {0xd100828e98ba2273, 0xef, &(0x7f00000015c0)=""/239}]}) ioctl$VHOST_NET_SET_BACKEND(r5, 0x4008af30, &(0x7f00000003c0)={0x1}) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r6 = fsopen(&(0x7f0000000080)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r6, 0x1, &(0x7f00000000c0)='nsdelegate', &(0x7f0000000140)='&)\x00', 0x0) setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2a, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}, 0x2}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108) setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2a, &(0x7f0000000080)={0x20, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x2, @remote}}}, 0x108) socket$inet6_tcp(0xa, 0x1, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="140000001c00"], 0x14}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000200)=ANY=[@ANYBLOB="b7000000ff000003bfa30000000000000703000000feffff620af0fff8ffffff71a4f0ff0000000015040200000000001d400200000000004704000001ed000062030000000000001d440000000000007a0a00fe00ffffffdb03000040000000b5000000000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710e4d58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00c37dfca3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebba2c598b4fc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa5b4e377184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7592566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c3bfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed93517a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f62e96753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c25000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6cb5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e1661261173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b393cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd849904568916694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a09313b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abae1cf01ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028ad0c74e2a9478fa3be18a1a2b65079cc1c7bc46dd12305a1ae9dd19e8d525206c0a728cfd42193abe8130b51d6c9b94c5513df2d85e8c01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ad1012fd7a8139166fd5e59c84f4ab279b1b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336d205c5913ef670000000000000000ba470bfe62fe2933082149d42e8a00"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xfffffffffffffd00}, 0x48) r8 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r8, &(0x7f0000000600)={0x0, 0xfffffffe, &(0x7f0000000080)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f8480d0000005e140604000000000e000a000f00000002800000121f", 0x2e}], 0x1}, 0x0) 8.515929552s ago: executing program 3 (id=2643): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000001c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'xchacha20\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="c99b57381801238c09d0ff0f1d0dbd301e5a47b2f3caa73dcd2a6a370554375a", 0x20) r1 = accept4(r0, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000006880)=[{{0x0, 0x0, 0x0}, 0x3}, {{&(0x7f0000000740)=@qipcrtr, 0x80, &(0x7f0000004c80)=[{&(0x7f0000000a40)=""/222, 0xde}], 0x1}, 0x10}, {{0x0, 0x0, 0x0}, 0x401}], 0x3, 0x40000021, 0x0) sendmsg$xdp(r1, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000fc0)=[{0x0}, {&(0x7f0000005100)}, {&(0x7f0000000d00)="7eb1130807ead1654df00749b902bff496de8910", 0x14}, {0x0}, {0x0}], 0x5, 0x0, 0x0, 0x44}, 0x2c090) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={0x0, 0x43}}, 0x0) 7.605919934s ago: executing program 3 (id=2644): add_key$user(&(0x7f0000000380), &(0x7f0000000000)={'syz', 0x0}, &(0x7f0000000140)='_', 0x1, 0xfffffffffffffffe) add_key$user(&(0x7f0000006400), &(0x7f0000006c00)={'syz', 0x1}, &(0x7f00000009c0)="3e12d23d34", 0x5, 0xfffffffffffffffe) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) write(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f000000}, 0x600) sendmmsg$inet(0xffffffffffffffff, 0x0, 0x23, 0x4008000) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x22, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x2}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) mknodat(0xffffffffffffff9c, &(0x7f0000000140)='./file4\x00', 0x11c0, 0x80000) openat2$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file4\x00', &(0x7f0000000380)={0x8a001, 0x0, 0x12}, 0x18) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0, 0x650ce4b086bd444b) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_GET_MPP(r1, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) gettid() r2 = add_key$keyring(&(0x7f00000001c0), &(0x7f0000000200)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) add_key$keyring(&(0x7f0000000140), &(0x7f0000000180)={'syz', 0x2}, 0x0, 0x0, r2) keyctl$link(0x8, r2, r2) syz_open_dev$sndpcmc(&(0x7f0000000a00), 0x0, 0x0) 7.364624103s ago: executing program 1 (id=2645): openat$incfs(0xffffffffffffffff, &(0x7f00000000c0)='.pending_reads\x00', 0x402600, 0x113) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'bridge0\x00'}) socket$inet_tcp(0x2, 0x1, 0x0) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000000)=0x2b00, 0x12) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0x0, 0x0, &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x19, '\x00', 0x0, @fallback=0xa}, 0x94) r0 = syz_io_uring_setup(0x8dd, &(0x7f0000000440)={0x0, 0x9b7, 0x800, 0x6, 0x199}, &(0x7f0000000000)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000400)={0x1, &(0x7f0000000200)=[{0x29, 0x0, 0x0, 0x204}]}, 0x10) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_REMOVE={0x7, 0x50, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1}) io_uring_enter(r0, 0x47bc, 0x0, 0x0, 0x0, 0x0) (fail_nth: 3) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f00000063c0)=[{0x0, 0x0, &(0x7f0000000000)=[{0x0}], 0x1, &(0x7f00000003c0), 0x0, 0x14}], 0x1, 0x800) recvmsg$can_raw(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000c00)=[{0x0}], 0x1}, 0x10081) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000140)=ANY=[], 0x48}}, 0x0) 6.929875696s ago: executing program 1 (id=2647): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x48e80, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r4, &(0x7f0000000600)={0x0, 0x0, 0x0}, 0x40) syz_open_dev$sndctrl(&(0x7f0000000040), 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x0, 0x4, 0x8001, 0x0, 0xb49, 0x200080000002, 0x7, 0x8, 0x3}, 0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r5, 0x0, 0x40, &(0x7f0000000c00)=@filter={'filter\x00', 0x42, 0x4, 0xb5c, 0xffffffff, 0x9e4, 0x9e4, 0xec, 0xffffffff, 0xffffffff, 0xac8, 0xac8, 0xac8, 0xffffffff, 0x5, 0x0, {[{{@ip={@empty, @dev, 0x0, 0x0, 'bridge_slave_1\x00', 'nr0\x00'}, 0x3127, 0xc8, 0xec, 0x1ba, {0x46010000}, [@common=@addrtype={{0x2c}}, @common=@addrtype={{0x2c}}]}, @REJECT={0x24}}, {{@uncond, 0x287, 0x898, 0x8f8, 0x0, {0x0, 0x4}, [@common=@unspec=@u32={{0x7e0}, {[{[{}, {0x1000000}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}]}, {[{}, {}, {0x0, 0x2}], [{}, {0x0, 0x8}]}, {}, {}, {[{}, {}, {}, {}, {}, {0xfffffffe}], [{0x6}, {0x0, 0x3}], 0xfe}, {[{}, {}, {}, {}, {}, {}, {0x0, 0x2}], [{}, {}, {}, {}, {}, {}, {}, {0x0, 0xfe40}]}, {[{0x0, 0x3}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x4}]}, {[{}, {}, {}, {}, {}, {}, {}, {}, {0x3}]}, {}, {[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}]}, {[], [{}, {0x4}]}], 0x5}}, @common=@unspec=@ipvs={{0x48}, {@ipv4=@private=0xa010102, [0xff000000, 0xff, 0xff0000ff], 0x4e24, 0xc, 0x2, 0x4e24, 0x1, 0x8}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0xffffffffffffffff, [0x2, 0x1], 0x1, 0x1}, {0x0, [0x4, 0x0, 0x5, 0x1, 0x5, 0x4], 0x4, 0x3}}}}, {{@ip={@multicast1, @broadcast, 0x0, 0x0, 'lo\x00', 'veth0_virt_wifi\x00'}, 0x0, 0xc0, 0xe4, 0x0, {}, [@common=@osf={{0x50}, {'syz1\x00', 0x0, 0x1, 0x1, 0x1}}]}, @REJECT={0x24}}], {{'\x00', 0x0, 0x70, 0x94}, {0x24}}}}, 0xbb8) dup2(0xffffffffffffffff, r5) ioctl$KVM_XEN_HVM_CONFIG(r1, 0x4038ae7a, &(0x7f00000001c0)={0x6, 0x2fc, &(0x7f00000009c0)="566ed15191ec0a918ac47114e78018ae8cc14e34f964d3d9a6edb8795c31f7d7b4d4a0e36ef0e0bb17328349b4616ffb4cf7781ebf2f4f190f972db09810c05092a49e631c013466d4689663838b025366ef3bf0e26f62c2a0aef9f938eaf406fa17110d0140fb175378daaca553551fef8893705d431ef2b99c47a12401dafdb4adb43623043b3fb3397d4f40a850b28a8fe8172350861ae1e6f51119f1c07a754603b9bdb434b28a612c166fd79070ef9478102700bc1b5f6d8416f48047730eb20f9926c438b1ebb5cd19f8c73a565c6c7c323a14bd5a9d9585c4a03c39fdb3c432201b26589c3f9280b3f24fa2c0a3255cdc9a8ade52ff2b1c64408e1c0498c6ae50196b5716ea68cac086cae109837d47a19c3d57d7707304d185ed18bcc98f3b20b8349cfbc493949d2623e130a3857389f268058b4ed5af9467a8c6f9d9cda59ea6a7f089dd1d30c415b2a56dccda5b69e2fa69ea5ae70369a23d7f1cca402092c940a12412c1f7e7f23a6a09feb4fe7cd1e94772625588ee305e19c4ff7ff9d42e721a05e4b0c6ed4339cda7846bd1b8863ab148f87d1f5ac9937509a1e3db00dbc7c7fcabda98b2e2191e5114eae78b20072766bcdadfb898ddc5a41107bdd6400bb4cabccdca511d71ba5dd766b5600a9f11e3826173e432f1e6de9b040d15ddcb8fdc14f29f345649da449941b9d7703134c197d388d07f4d362a0b05edc81dffc68cc2cd83234d99b912b8adc8eab6438388107e5041d97b98241de2049ab6d98734a5258e086b2ee759a629e38a7c4c488201cd61fc930ddc536002c4ef338c5dc9afae5c2aa9542c7b58ef803db406f18364cc8a5e2c3260fcdb9d2cec55ec8cf3aecbfbeaeabbec0cde187519f79d1a4811ca3a5318e9121fde9f986d6cb2a45ea4e69e3d4fa05a66bb779eb8037d8c299c12605efe038a5f4c22cfedb9baa086b18ee0a3e5cce6dbf8dcd4bd6f3d8a67aaa5d3d09cd720196826f8e8cc1b1f7bde9786840bedfcb42ca4781b195efe6d66046eef53f86f6f0a8c9dd86446dec51d00b1b48c82a3716d841b306664e570c20a04b92616c34f8a9cfa778ca5e3bf23c3e9f7a80fbe26be831614c8d91a26fa47e478a4940cc7c4c847efaeeef56f3ede97480814d2f4909a153fae743325ca2bea2e44a42b9a1dd84afeb0d5e888148281534c35cd8079bddf5e7a11df5df4cc139db8c659c54107409aa80b1ddceb2f8c11290e3be479233ec92aadc4fc67b39c81d70277b59b19392d4d9498dedba6686177fa1ab5a451298ad6723df334547b06e51599343360154460f4076947cdd67611a3715639a78cb1e823a4fb6db4f783e065e9b11c196f9efe11629c28a28cc50b06e11fce67a2cad1138e81d06685b6e325b1fb342678a68e3463e21d2df1b12920a0f3dbdc452313158ed6423c5a7b47028c45544984f6f82d61914a5bbce6d34567d83a71281b7eb30ba099037c81d46eb4cf2e7c59561f7ca3d7f3c49901ea5ff2e42e7928518ec0d277d1b1c2ca3aeef26df89daff30b3e514817696040771fe9c4dbd7afbb30e5977f5b9d5300a08360d9856685fc5e409ea22a78ef603672d8117209f1f7dd2c942e5a3b70668cc13258c67ebef5a2b1e16922f5bb07afbe5b1edf7fa4b67996169aac3ca2fb6e544e7bb868415c17333beda1907e245a1290f223b39ec94b51776b36d12b03a8719f4df36694e19d741752c6689ee13ecd72c7c99132673b1859746763f6a5af1d26bfbe67d40f7c767232676fa3d5573d8b6c73d2df7c241a5d00f57e8cefb5b380ec16aac9ffddb39b3f6522df40482edd84222906f33482950b361d2b59bef35ed0fe325af4379d2eea372088886ed123e173a69873b41dea0adb62b4edfa59cefd70cb528c976d85ef7883664f4cde5f60f113ce1557f1ae14521b2386573b6e7461d64e3b6013a5bb434494fb105ea91e5c9b7a4ed5796798e90ef193f5423a9dd9b9f9a0e5d39cd20cf184787b5fb5c3f3dcbd6d69d5d7ac950c2400acdb5879f6297d558b621e2b1c2d90ee313cd4c73997c7bb6ef79130b9b52d37eab3d7d2f9634d47d5682d639bc2e35411e4561970312fbf8e61707e0563e976e4b6820de003bf80fcd3f7351acfc46ea0c9d3ca11e8f2aa81ba69a687e27589eaf071becc88163f702b84a4cdccf49d922709ba94a25bb22281ae09f35ca5c0a631dffa9e92c70405971fbdadc3e2375f9f122d37a1fc2b07c51fff50bdd76bad20cd5707ec4c26a718000838cc14dd0e9a4caad9b6ef66a22544c72cd2feae51d823b4a9760ac643b883f96f0f02f6cbbe14a8e58af1cdef6bb43fbebfc6696ac52ed79bb6f19aca79505b5d8310dbf2e7276817010b8860b84b6d84cfbcbf676dcdad60a2cfc9abba1dee15f54d9b1f969f3451a6e4ae3a22e179c86f2d31719115592dbf9425fc0d99bba8a91563a9c3c54adbeb5a2b746997889f0b297015443d1d972f27d17170cb9374c16b993540d4628c85b93816136ea372bdcb33c2ee448c33534409debca70b370506d09c7be295726b526291e897ba76f9cf9d0f3274fc202984f92639d47571923ee48d18f8a98bd0f9021d5f0b8621a4699254865ed1940bb079a27af8866ff4922ea9388c402ae66870410519f687c4bcc9908e876254a3b5cd193e65a9ea0b1346dc2f5d45ddaf6a3f49d8c4b9179b68c1e92a8e13db407f296b1e55eb5f4647353b8da6a17d332aa6b8b5842cbd11700a34c1e598346a8ea3f5e5a8c3f1ea1f089dc7cdbec12fb826ba5ace700a397ba5d78e0a010ba0e244c2e0dd25be5d6b3e8f1bb072f5a80d6a9e64a583ca993d0aa6e3609e04d58b40fe103ba37a2384a4cfcb0730f9559c90a7481c609f98c118748ebacb8b0ada449b353e8ad002acfd7096b57d24fa0fb3016fec60c0643cf184744ddcf9bfb227cbbf4b327d5a4ee181654be52e4fe8135b96b8d9d95b09229a1026d9ac4a50f5d614942656e612095b275070b986b632330b207f69e57e7d1e1af759c94126d99cc5aae6c27b614ff199481b05b055d74fc847580690ccb978bc29fbd7a5b36fd76896727df9d2c860fc57c5b4d86c86ee8b1da6a936b1f45508e4ad8dca59d2bfb9bebcf9d2ee7ea5816bbe4e23d030c93aadd495ef9870e1c07c7635ccf5fcdf3e533e7f0d2f4763eb37f08bfd6ed1b0761f9be484c7d503bef24b29e642d8e4efc00307db742ff2cd4c77a00f5decf9497ec07336e2ec129c7868d3c81e484bc5373256ed34e1ae14c20b7170b815677dae07fafe331d8f86f0e33cb8200cc09b2b9509d5c8e6b54abe29c754eb26906247ea3ea6ca6426be83e21455205a8327292d9a45f43e636f72b25e6683670844b706e3221ad4f7a0b484c3fe9094efdb16578570b51af901b069c41ba3b7c1338021e0911970816596684489a97b11233eb8eb457459d27066b5ccd1a7d0cee2efb716e68c264ebfcdecd165520e01e7118c9b3b645a2de2490f94f63b9bd7d8af4580b59b7f0d2ce4c06203f1e96e2ee497e0a93675a03f065a259f0c3fd4a3f76ad9e8ce1972f2fe12300a26daef06627ee22bba0262aa5f707e538dfb8d681b7d1477e6a9f1d76580e22fb253d1a10c6faa923f80b4df5b3a978cefd9a21a35426bd2920c6fb915cdac53b47af544a26d65653dc3383ff8e58c4a22bf70651ef62e46e06fca15e9c2fe5395e937cc06c20ec34b9a2f2def7c37b1e6c7a2a088c9c55c5d69cc1d3afdbd38ab1e9c47cf88098f1f8a6bad1ed87fd3b19103dc3bd7bcc2613a8e47dda92977436e770d65fd7b2e739bd6cc4bc5b82d9c0512cafc1714f4680e69f84a13ff1dc77ee56309459d28efe74e9f3087738798851921677b7119b98375243b1250bbcfd76081bf71c1e2048c185547e970b8db40b2b586ea27ac62ae32ca3bddffd90ee3a76a167564abb02f15cab8b3eb9c9115650dac0bb494200f0b4758ed3bd8254cb44b25144f03f68b2b5d96b4a4b2607b8d7f76a25f43032041305690068d88cf17f558b54f9b19f6f7a7a9a1ca1a2565f114e086f22c3a41812b8b21ccce2206ae306926d1a376d23d168d89d25c3f8e33b68d79f8f1b05d37a896c24556f9328ddad3deb7f93d0c7d8f29ab6e764e129b4b4fc9873dadae105b915a909fdf712d2f7145ac85a916844d70a5fd149ed4d1bef8a4a44692995959af5f1ad987202c3cf7975d0932cb7edbaaa8798384d0c29d6aed67b7fce7880223f385031b87603079eceb2734b285258e002ef372900ae0a39f03da5285f2afbe8c721a34ed63f16e722f9b06341f987f07afa7aaddc697222c5bf0d1feeee2b68a", &(0x7f0000000640), 0xc00}) r6 = add_key$keyring(&(0x7f0000000340), &(0x7f00000004c0)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) r7 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000980)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r7, &(0x7f0000000240)='asymmetric\x00', &(0x7f0000000180)=@keyring={'key_or_keyring:', r6}) r8 = add_key(&(0x7f0000000080)='rxrpc_s\x00', 0x0, 0x0, 0x0, r6) request_key(&(0x7f0000000280)='id_resolver\x00', &(0x7f00000002c0)={'syz', 0x2}, &(0x7f0000000300)='/dev/kvm\x00', r8) ioctl$KVM_SET_MP_STATE(r2, 0x4004ae99, &(0x7f0000000000)=0x3) ptrace(0x10, 0x0) ptrace$setregset(0x4205, 0x0, 0x1, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, 0x0) syz_usb_connect(0x0, 0x24, 0x0, 0x0) 6.419837692s ago: executing program 3 (id=2648): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = socket(0x840000000002, 0x3, 0xfa) mkdir(0x0, 0x22) close_range(r2, 0xffffffffffffffff, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000300)={0x6, 0x2, 0x4}) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0) ioctl$PPPIOCNEWUNIT(r3, 0xc004743e, &(0x7f00000000c0)) ioctl$PPPIOCSMRRU(r3, 0x4004743b, &(0x7f0000000180)=0x200) bpf$MAP_CREATE(0x0, 0x0, 0x50) unshare(0x62040200) syz_usb_connect(0x0, 0x4a, 0x0, 0x0) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) socket$inet6(0xa, 0x2, 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000100)={0x38, 0x2, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}]}, 0x38}}, 0x8000) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000780)=ANY=[@ANYBLOB="74000000090601020000000000000000030000000900020073797a310000000005000100070000004c0007801800018014000240fe8000000000000000000000000000aa1800148014000240fc000000000000000000000000000000060004404e1f0000050007008400000006000540"], 0x74}, 0x1, 0x0, 0x0, 0x10040003}, 0x0) 6.103849066s ago: executing program 4 (id=2649): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000200)={'bridge0\x00'}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[], 0x7c}, 0x1, 0x0, 0x0, 0x800}, 0x0) sendmmsg(r1, &(0x7f0000000000), 0x400000000000235, 0x0) 5.954288422s ago: executing program 4 (id=2650): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet6_buf(r0, 0x29, 0x39, &(0x7f0000000040)="ff02040000ffffffffffffffff1f2be82db1af0000000000", 0x18) sendmmsg$inet6(r0, &(0x7f0000004400)=[{{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000000100)="d5", 0x1}], 0x1}}], 0x1, 0x20002845) 5.675564235s ago: executing program 4 (id=2651): socket$l2tp6(0xa, 0x2, 0x73) r0 = syz_io_uring_setup(0x1e1e, &(0x7f0000000200)={0x0, 0x286f7, 0x10100, 0x0, 0x40000000}, &(0x7f0000002000)=0x0, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x22}) io_uring_enter(r0, 0x48e9, 0x0, 0x2, 0x0, 0x0) 5.440478579s ago: executing program 4 (id=2652): r0 = socket$inet6(0xa, 0x2, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000140)={'bridge_slave_0\x00'}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newqdisc={0x24, 0x24, 0x2, 0x60b924, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x1}, {0x6, 0xb}, {0xa, 0xffe0}}}, 0x24}, 0x1, 0x0, 0x0, 0x4048060}, 0x20004080) openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) getsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(r0, 0x84, 0x12, &(0x7f0000000100), &(0x7f0000000180)=0x4) pselect6(0x40, &(0x7f0000000000)={0x6, 0x1, 0xd, 0x9, 0x0, 0x5, 0x2, 0x4}, &(0x7f0000000040)={0x8, 0x0, 0x3, 0x7fffffff, 0x7fffffff, 0x9, 0xfffffffffffffff7, 0x8001}, 0x0, &(0x7f00000001c0), 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$netlink_NETLINK_NO_ENOBUFS(r2, 0x10e, 0x5, &(0x7f00000000c0)=0x7, 0x4) sendmsg$nl_generic(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="280000002e00090027097000000000220400000008000c"], 0x28}, 0x1, 0x0, 0x0, 0x42804}, 0x0) 3.939222597s ago: executing program 5 (id=2653): pipe2$9p(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) unshare(0x24020400) vmsplice(r0, &(0x7f0000001b80)=[{&(0x7f00000020c0)='+', 0x1}], 0x1, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x800, 0x0) ioctl$KVM_CHECK_EXTENSION(r1, 0xae03, 0xc0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000000), r4) ioctl$ifreq_SIOCGIFINDEX_wireguard(r4, 0x8933, &(0x7f00000003c0)={'wg2\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000000080008c891ccbc4f01000000000000000000", @ANYRES32=r6, @ANYBLOB="4c00088048000080200004000a004e2100000000000000000000000000000000000000010000000024000100975c9d81c983c8209ee781254b899f8ed925ae9f0923c23c62f53c57cdbf691c"], 0x68}}, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x0) r8 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r8, 0x4018620d, &(0x7f0000000100)) r9 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r9, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r10 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder1\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r10, 0x7) r11 = syz_io_uring_setup(0x51ca, &(0x7f0000000400)={0x0, 0x100002, 0x1000, 0x2}, &(0x7f0000000180)=0x0, &(0x7f0000000280)=0x0) syz_io_uring_submit(r12, r13, &(0x7f00000001c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}) io_uring_enter(r11, 0xa3d, 0x0, 0x0, 0x0, 0xff39) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r10, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) r14 = socket$rds(0x15, 0x5, 0x0) bind$rds(r14, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) setsockopt$RDS_CANCEL_SENT_TO(r14, 0x114, 0x1, 0x0, 0x0) 3.779560242s ago: executing program 1 (id=2654): socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x4, 0x0, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x38, 0x0, 0x4, 0x8001, 0x0, 0xb49, 0x200000000002, 0x7, 0x8, 0x5}, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc01cf509, &(0x7f0000000080)={r1, 0xfffffffffffffff7, 0x3, 0x10001}) ioctl$KVM_GET_SUPPORTED_HV_CPUID_cpu(r2, 0xc008aec1, &(0x7f0000000100)={0x3, 0x0, [{0x1, 0x5, 0x1, 0xfffffffd, 0xc, 0x400, 0xffffffa7}, {0x40000001, 0x40000000, 0x5, 0x55, 0x9, 0x2, 0x3}, {0xc0000000, 0x80, 0x5, 0xfff, 0x240, 0x3, 0xfffffffe}]}) symlink(0x0, 0x0) mount_setattr(0xffffffffffffff9c, 0x0, 0x9100, 0x0, 0x0) r3 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r3}, &(0x7f0000bbdffc)) pipe2$watch_queue(&(0x7f0000000280), 0x80) r4 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) fcntl$setown(r4, 0x8, r3) r5 = socket$inet_sctp(0x2, 0x1, 0x84) socket(0x2, 0x80805, 0x0) r6 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r6, 0x0) close(0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r6, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r6, 0x84, 0x7a, &(0x7f0000000340)={r7, @in6={{0xa, 0x3, 0x4, @remote, 0x100000}}}, &(0x7f0000000040)=0x84) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(r5, 0x84, 0x1b, &(0x7f00000019c0), &(0x7f0000000080)=0x8) socket$kcm(0x29, 0x6, 0x0) fcntl$lock(0xffffffffffffffff, 0x5, &(0x7f0000000240)={0x0, 0x0, 0x10001, 0x5, r3}) getsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r2, 0x84, 0x12, &(0x7f0000000180), &(0x7f00000001c0)=0x4) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET(r8, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="2c0000000102010400000000801400018008000100ec14142f080002000000000000e1000000000023d64b0b54f50a7f869d0842e686cccf0000"], 0x2c}, 0x1, 0x0, 0x0, 0x20008080}, 0x4) 3.777802879s ago: executing program 4 (id=2655): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = socket(0x840000000002, 0x3, 0xfa) mkdir(0x0, 0x22) close_range(r2, 0xffffffffffffffff, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000300)={0x6, 0x2, 0x4}) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0) ioctl$PPPIOCNEWUNIT(r3, 0xc004743e, &(0x7f00000000c0)) ioctl$PPPIOCSMRRU(r3, 0x4004743b, &(0x7f0000000180)=0x200) bpf$MAP_CREATE(0x0, 0x0, 0x50) unshare(0x62040200) syz_usb_connect(0x0, 0x4a, 0x0, 0x0) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet6(0xa, 0x2, 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000100)={0x4c, 0x2, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x14, 0x3, 'hash:ip,port,ip\x00'}]}, 0x4c}}, 0x8000) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000780)=ANY=[], 0x74}, 0x1, 0x0, 0x0, 0x10040003}, 0x0) 3.734199979s ago: executing program 2 (id=2656): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000001c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'xchacha20\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="c99b57381801238c09d0ff0f1d0dbd301e5a47b2f3caa73dcd2a6a370554375a", 0x20) r1 = accept4(r0, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000006880)=[{{0x0, 0x0, 0x0}, 0x3}, {{&(0x7f0000000740)=@qipcrtr, 0x80, &(0x7f0000004c80)=[{&(0x7f0000000a40)=""/222, 0xde}], 0x1}, 0x10}, {{0x0, 0x0, 0x0}, 0x401}], 0x3, 0x40000021, 0x0) sendmsg$xdp(r1, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000fc0)=[{0x0}, {&(0x7f0000005100)}, {&(0x7f0000000d00)="7eb1130807ead1654df00749b902bff496de8910", 0x14}, {0x0}, {0x0}], 0x5, 0x0, 0x0, 0x44}, 0x2c090) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={0x0, 0x43}}, 0x0) 3.17800469s ago: executing program 1 (id=2657): socket(0x200000000000011, 0x2, 0x0) openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000002a82, 0x0) futex(0x0, 0xa, 0x0, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) symlink(&(0x7f00000000c0)='./file0\x00', 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x1b, 0x8001, 0x0, 0x9, 0x2, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./file0\x00', 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000180), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', 0x0, 0x800, &(0x7f00000003c0)=ANY=[]) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') read$FUSE(r2, &(0x7f0000004100)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r5 = openat$vim2m(0xffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$vim2m_VIDIOC_S_FMT(r5, 0xc0cc5605, &(0x7f0000000040)={0x1, @win={{0xb, 0x9, 0x7, 0x9}, 0x8, 0x2, &(0x7f00000003c0)={{0x3, 0x5165, 0x10000, 0x3}, &(0x7f0000000300)={{0x1, 0x1, 0xbd8, 0xa}, &(0x7f0000000400)={{0x4, 0x6, 0x1, 0x5}}}}, 0x8, &(0x7f0000000580)="af42d41f067cec3e5fe8540883fd98dffd7d6e4521d84c6d3c446994c31f1686eaff79eff0346b5272bb284b3dc81a83ed7f43dc761fc6fb9ce3840bdd99d49b6b9e97e9d6cb216d54961395b77931e1c174b1c44a2034b19bfb7a2297326eee0b34394419ef7767ef39bcde00a16134da0fa0a3946b17000bbea3ea65803de1d2706e1e0b460432df3bbbffd9a95ccd0dc3e4ed5e7f79e2ee3c521d5a87d3b39ab94d45b56badc1a3687f2ed727f8f53dbdb317b24cb4c46d96b463c120c1d3af7a61289d35b4db8810cdf0"}}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=ANY=[@ANYRESOCT=r3, @ANYRESDEC=r4, @ANYRES8=0x0, @ANYRES64=r4], 0x40}, 0x1, 0x0, 0x0, 0x14}, 0x20004001) socket$inet_udp(0x2, 0x2, 0x0) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) ioctl$KVM_GET_MSRS_cpu(r8, 0xc008ae88, &(0x7f0000000380)={0x1, 0x0, [{0x290, 0x0, 0xcd}]}) r9 = socket(0x400000000010, 0x3, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='smaps\x00') sendmsg$nl_route(r9, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000006c0)=ANY=[@ANYBLOB="4800000010000104000000000007000000000000db006524b840d2fd667a8b78d5af046c139e1c9e25d051312a392909aa1910fddd50abc0f1deae9435e725eb27ffef39d9aba47e8d301640280abded8f2963b8a1cde595892fb06b9000bedfbabc0e6811d3e085bd4ec05047951a2b4ba90c235881fb6e857483a89bfda3638785df9b9525fb8aa9231d9b8688ec3be76a449e8a48cb24aa93ab8bbfe0e048a58844cf223b70d425464d6fd9411b9f33055ae0361c5c3804c3d800a61a7a938cec2434048cfc0ffbb12918168211dd632513d8c92f7945df3fc0c3453ac1def73c0a6b392a06586b71e53d509b4ea0b4efcffdbf01f04737b5fbbd46cb32fe9bcb871580ef2fae288eac248cfeac790de2213efb93f6ff0e2dd67f95763714128ae2f8747a7c21a7b574e604bb67b2df5686286f555a72711a23373217ccf0dce3e9e27799223425444dbf7522f281612dce54091fefc1b54f994771c7898b31afc757920c9ade4053e178daa37c04aeedc2dcf008fc70a6815b2a7a8a7b3d8b541f2729b509d9bf60ead3c80d997fae7995834e282f8cb29c98f42798934ee32c498bd646bab6d9594e0992f0bfc8c8109026de4633c0606cb8ad3f4086d5d2862dcd3fa0f2baa05c37f1400a7074a4efe0", @ANYRES32, @ANYRES64=0x0], 0x48}, 0x1, 0x0, 0x0, 0x44000}, 0x10) r10 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFDSTADDR(r10, 0x8918, &(0x7f0000000040)={'ipvlan0\x00', {0x2, 0x4f22, @rand_addr=0x64010100}}) 2.98451885s ago: executing program 5 (id=2658): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = dup(r0) write$UHID_INPUT(r1, 0x0, 0x0) 2.662178255s ago: executing program 3 (id=2659): r0 = socket(0x2b, 0x1, 0x1) setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x0, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x21800, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, 0x0) keyctl$dh_compute(0x17, &(0x7f0000000380), &(0x7f0000000480)=""/82, 0x52, 0x0) socket(0x1d, 0x2, 0x6) openat$dsp(0xffffffffffffff9c, &(0x7f0000000300), 0x6000, 0x0) pipe(&(0x7f0000000600)) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_open_dev$evdev(&(0x7f0000000000), 0x2, 0x101000) ioctl$EVIOCGKEYCODE(r7, 0x40044582, 0x0) r8 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) sendmsg$TIPC_NL_BEARER_ENABLE(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="5493a800", @ANYRES16=r8, @ANYBLOB="0100000000000000000003000000400001802c0004001400010002000000ac1414aa00000000000000001400020002000000e000000100000000000000000d0001007564703a73797a3200000000"], 0x54}}, 0x0) sendmsg$TIPC_NL_KEY_SET(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="0100feffff130100010017000000440006803c21040067632d28616573290000000000000000000000000000000000000000000000009f000000e3de3d7b4cd07ec3ee777de774fc7987cca4198904000500"], 0x58}, 0x1, 0x0, 0x0, 0x4}, 0x0) sendmsg$TIPC_CMD_ENABLE_BEARER(r4, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000280)=ANY=[@ANYBLOB="ae986d5a"], 0x30}, 0x1, 0x0, 0x0, 0x24008044}, 0x0) r9 = syz_open_dev$vim2m(&(0x7f0000000180), 0x100007, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r9, 0xc0145608, &(0x7f0000000340)={0x800, 0x1, 0x1, 0x0, 0x1}) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x4e21, 0x2, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) 2.655850539s ago: executing program 5 (id=2660): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000200)={'bridge0\x00'}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[], 0x7c}, 0x1, 0x0, 0x0, 0x800}, 0x0) sendmmsg(r1, &(0x7f0000000000), 0x400000000000235, 0x0) 2.384060047s ago: executing program 2 (id=2661): r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) syz_open_procfs(0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) r4 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_tcp_int(r4, 0x6, 0x18, 0x0, &(0x7f0000000300)) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) write$P9_RVERSION(0xffffffffffffffff, 0x0, 0x500) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, 0x0, 0x0) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x2000, 0x0) ioctl$TIOCSPTLCK(r5, 0x40045431, &(0x7f0000000000)=0x2) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)={{0x14}, [@NFT_MSG_NEWRULE={0x6c, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x40, 0x4, 0x0, 0x1, [{0x3c, 0x1, 0x0, 0x1, @immediate={{0xe}, @val={0x28, 0x2, 0x0, 0x1, [@NFTA_IMMEDIATE_DATA={0x1c, 0x2, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x18, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}]}]}, @NFTA_IMMEDIATE_DREG={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}, @NFT_MSG_DELRULE={0x2c, 0x8, 0xa, 0x3, 0x0, 0x0, {0x2, 0x0, 0x5}, [@NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0xc0}}, 0x0) r7 = ioctl$TIOCGPTPEER(r5, 0x5441, 0x9) ioctl$TCSETAW(r7, 0x5407, &(0x7f0000000140)={0x7, 0xfff7, 0x8, 0x3, 0x17, "a9b39ba517c50901"}) write(r7, &(0x7f0000000180)="a788b9a48d1de6603c475fe3cfa8a27d7c8425073f756d1cefddc08a6dd4c4c0a5323f8f93d65682bc4974397001a396624e1bd23560952dee5736311e3d06e60f168e59f8a3125595ff42643b55d9addf2ea3fa011611a8c539558baf2581e9a8b722f2108f58cb3d552779ea51ba9462992a9156243c50c162d06280d116e26d280aacfb494b66c66bb4df665381440690afc4854f4a19db6357a3e57802de79c221ae7c5171faa19b3dc84934b452b1c81e98bf2eaeedca4e6cce792c6e01c592688acaefe150f0ffd163d3d54d4318b5df03be5916dd0fc3cbb297cc1cda81fbc3cc8c552216b48289eb4065a84e76d035c469ed7f879f1d522715f615d3d9b4e7b270b25837894d7609819a02fd202762975b2bf49910e57aea28e3632353f29711d460d5e85c5881f265e2372722654532bfb30b7ee54d40cafe09c96e65a6304a570ea8069fa0649f1bd6cbe5b2d8e42fa0ab835b4eae46e983df2fefa0b5e5bec1594ba024b6acef03fc561a86959e3b928c552b39845621b549746ea4157b0d4b72855c0d7f7578474c456a888a7b60a6e73a57bbccc733319619c140728332ae5d4c3a2c949741dd9950774fddd896ad9ca2d190176537eccee02958a68c4eb26384721bf0f3902387902a0e1fc7ce3d1b92291a1da43f29ac9ccccc5224909627819dae861ad9a80bb145e161851017f6967c4d6786df994c99cfd14eeec8a906f919196bf4fe42ba78c1e7c9559a32104562180e23b6bd02556d324d210c05d4c11b375b9a496f245670f1390341c533ed70b927ac87b14dded63dec46c80949c44b344e897deda9c96485a6fdcbfb6a81fa1f06548b62d6e4726d6c7c724c860cc0a3ae911692255cac73c6bd24332f763b7ee4411ac4c7bdfb4dc5243111e80e1275adbec72259dfd7bdbfe8b16ee19f73b444b094b64d33558116e37404b83ccf56fd3002880b44f9f0e46d8549bf061274812047665f83f82f71d0e8260668e026b7914f89a66342c38337e372efb345d4eb5273613a69fd5318cbc21788825895cffd0a93aaf0a25c7c17aadfe0415d00062aff52abea2b080310026189f137188a2fcf134e9f4b98f0e7adf657f3c368853a6d2ab1bb3e534f54208913613561e971f78c0b466d231251e0661bb2d1df030e31168bfed86bb5059096e74aa1f24213edec5a9c55a773b1b0b588d0646887759f73037da3196c596d7d54a10a47950fd52665d4059acf03d89d41201ca51d98baf9f549b09f0bd891850917d294ffd7a6fcfbefdf6192f7e3e51c67f45fb578bcd0ebc8447ded0a40bf17e73f1419e3cb6a8232e52d6646831f87148b7d9de7b4e1b7fae5afd5a22edf95602ac820712343bd79098dcdac62747c32a2657dd94799fe1407573f918355f84cc1c44a6499c0a7a5f188cf7971a952e03e245c022ea1ac6b3115dfaec5072c1a6ef298470899a2223908e099bd9f045a824f7ec21b9ef478f7f1253e99117bc90fb35b155ef4badcc95d1a1e913c1b3d7b5305289ba328d813bf47a2e808e8b96058faddb63dc7d0e039f1c51c872d6497097822ac3a86296ea3963c5bb6aea2ead05d85b859ecc4646c6f078b7ec3b6b9186b4ccdd87bd30653bcdc09ad5f5c5778406708de50653be9a34d9dc57279d1fa418788f4dbd22dcca75a012ca9689c42e93265669a504deb7bb906aa4012074668a546a24ff49f51aad8920a2c48b7390fb479d93e646eac6cfad65d55d1de0f0a3a35ea00b9c6ceb1febe4b838ea74f2444fba078d5d2c740f00064f56b000575de1be6f4fd26086b437d2ae622373b555f8a3ae5a65b158265f8840d3e8ef012e0ae671c9b51abd9c8c0c407e5813ae0ce4bc101363b7b2908b189c4c09efb06cf77985eb82fe229dd3619bf74d24a5010bb4594cb358fd6f182c94a45ba6782f92f6227f3d9e449f327a578647c21384836fbd9d1c25e8b4433b2aa720a6f0acbb069142a18b4c18f909fdff818a28a62d8d91ee8f618a49d42255f303c5b86727e93dd28d0f1ee33e3840f146b130d2e74e291307aa07d581089fc0ed123b788a668e33d69ba44e9375a4c4b5a9c563dcbac76548f6f558376d42a48eed5d2c9ae6e23ee037984fe7fdf752765dee6b03731dae01a59c694e4dbb378ee5cc7e115e768bd53c0d280b0174c357f19e941499d19d92b8c4eef63053e72a0d52309404235cb5531b8b1448de43807af6135236be025281e583b3d3cf7aa4afe1327674ad6098e7a0dac5ea9d58685e960a0901e3d5040fe5c9b8788fafd982f4d7fb168b1c5e1143d9bf9aee4b83852ae8b93d28561fcb97e07932b00fbb3fae454e72a73d1c2e79d2455ae7cba25668568c06b45de8833d252cbabdd5b4b1dcb250601b131a73eba8da52adec08836383db04664bd62c2b60bba11e8a71de436ba68fa0cffd411dcd90fbf2be6de2fa96fe1932d48aad8c1d067fa110563c5e9231646807da74b4b5f31d53082c12f3ddaa7fed45ed7a6c722c4f2584622a6666ea5130307acc2b4c7c18e434fbad78f2d47b037b6a8cf79d82af02a537be7be30e39891b82bd565e1f98f4ef6acaf899ce37ea6a477c22b8e0f995ec34711e997202424a7f4da1d1787c1ca9ef96f430ec8df1fa9d0ce6b0d105415d58cfac87b87841b6359ac42dac56daa3139ee8ed7b9970e0ddb647a352006ec73a94a335df2b06ed70dd5823ecc9b10813594c83016e960af4cecf04ead1a6f1ab62c35fc011e2475c1b110086c8b20b0a69c2d866a9acde6c07e2f3c56f07099270b3068a0d8393da1abb6deb0327565c9562d6cb641ccce5d5f550f8bb9313656e9fa5ad9f6bd45fc6b68527047f229a8ed28c1fc342f77954ce88d8490066ddd48a1bb6e8526a54fc6d9aba6d407c45a2fd4da5136437ea72a1ac451bd9c1573726036962beea071edb8b033773b84f0d1258add5aec21288159dbb524d83ccc7e79380b066da91efcc0ab6d84c1c3a12dc221c8fb043f01bb6f01f23a39b8fbc15059f5309d7369a24e1b255c8994ef763b1118a05d46f0a79ca5df04e04a065cf7cf19ef62643e9315bec3053ff4220a8056c8d3d597f66611bf7ac3455b7f48bb2f7aedf3ef2a59984ef783a1f40417ccc61b3e6f65731d4c97906688b9dff31bdfef1c5faefbfe1a29eb3aa9a8ecd696c33a253935f61fb34909b12d295fadab159729128fb6fa84abbe0774579ddb52bac51ed54678cebe34fe4da23e4773132ec3ae66d7b550d98eb863518fa315855102d242886706d193bc8f7b25a990ea3dd55e35188f840329837da47b441de242c9c474997933be20aa447d9f49d9f43bd05dd8946c73e18ab1e6a6996b09592036df65444fe51e849ec6cbe36a079c6734cc02b101b5833090358af4908bef98092de74642e27b790c4fb0047caea61fa9aa5889", 0x97f) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x20, &(0x7f0000000040)=[@in={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}, @in={0x2, 0x4e24, @remote}]}, &(0x7f0000000080)=0xc) writev(r0, &(0x7f00000002c0), 0x0) 1.813660838s ago: executing program 5 (id=2662): socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet(0x2, 0x3, 0x9) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xffff, 0xfff3}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x5}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8848}, 0x20004804) r7 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50}, 0x0) shutdown(r2, 0x0) recvmmsg(r2, &(0x7f00000066c0), 0xa0d, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) r8 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r9 = openat$cgroup_int(r8, &(0x7f0000000080)='memory.low\x00', 0x2, 0x0) sendfile(r9, r9, 0x0, 0x4) r10 = fsopen(&(0x7f00000000c0)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r10, 0x6, 0x0, 0x0, 0x0) fsmount(r10, 0x0, 0x0) 1.242103249s ago: executing program 1 (id=2663): openat$rfkill(0xffffffffffffff9c, &(0x7f0000000140), 0x480, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r1 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x11, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x1}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) bpf$TOKEN_CREATE(0x24, &(0x7f00000000c0), 0x8) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) lsetxattr$trusted_overlay_upper(0x0, 0x0, 0x0, 0xfe37, 0x0) mmap(&(0x7f000000b000/0x4000)=nil, 0x4000, 0x2000000, 0x4040172, 0xffffffffffffffff, 0xc47ce000) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, 0x0) ioctl$TCXONC(r0, 0x540a, 0x0) ioctl$TCXONC(r0, 0x540a, 0x2) 883.399009ms ago: executing program 3 (id=2664): r0 = socket$nl_generic(0x10, 0x3, 0x10) socket$packet(0x11, 0xa, 0x300) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) openat$vimc2(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r3 = socket$inet6(0xa, 0x3, 0x3c) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a3200000000140000001100"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000002100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000040900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff27414000000110001"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) connect$inet6(r3, &(0x7f0000000000)={0xa, 0x5000, 0x80000001, @remote, 0x7}, 0x1c) writev(r3, &(0x7f00000000c0)=[{&(0x7f0000000100)=',', 0xffdf}], 0x1) r5 = socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000002ac0)={0x14, 0x11, &(0x7f0000002680)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x922c}, [@ringbuf_output={{}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xf}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @alu={0x4, 0x1, 0xa, 0x1, 0x4, 0x9c, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x2}, @map_idx_val={0x18, 0x8, 0x6, 0x0, 0x5, 0x0, 0x0, 0x0, 0x2}]}, &(0x7f0000000400)='GPL\x00', 0x7, 0x85, &(0x7f0000002740)=""/133, 0x40f00, 0x1, '\x00', 0x0, @fallback=0x23, 0xffffffffffffffff, 0x8, &(0x7f0000000500)={0x0, 0x1}, 0x8, 0x10, &(0x7f0000000540)={0x0, 0xe, 0x5, 0x6}, 0x10, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000002a80)=[0xffffffffffffffff], 0x0, 0x10, 0x8}, 0x94) r6 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r7, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)={0x24, r8, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r9}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0xb}]}, 0x24}, 0x1, 0x0, 0x0, 0x400c000}, 0x0) sendmsg$ETHTOOL_MSG_PAUSE_SET(r5, &(0x7f00000013c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)={0x34, r6, 0x401, 0x70bd2e, 0x25dfdbfe, {}, [@ETHTOOL_A_PAUSE_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'netdevsim0\x00'}]}, @ETHTOOL_A_PAUSE_RX={0x5, 0x3, 0x1}]}, 0x34}, 0x1, 0x0, 0x0, 0x4048810}, 0x14008080) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000001c0)={'wlan0\x00'}) sendmsg$NL80211_CMD_SET_MAC_ACL(r5, 0x0, 0x24000000) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_IBSS(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000480)={0x74, r10, 0x101, 0x70bd26, 0x0, {{}, {@val={0x8, 0x3, r11}, @void}}, [@NL80211_ATTR_HT_CAPABILITY_MASK={0x1e, 0x94, {0x4000, 0x0, 0x4, 0x0, {0x329, 0xf70, 0x0, 0x319, 0x0, 0x0, 0x0, 0x1, 0x1}, 0xf, 0xa, 0x48}}, @NL80211_ATTR_SSID={0x5, 0x34, @random="a9"}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0x8}], @NL80211_ATTR_HT_CAPABILITY={0x1e, 0x1f, {0x2, 0x2, 0x1, 0x0, {0x3ff, 0x0, 0x0, 0x3c0, 0x0, 0x1, 0x0, 0x2}, 0x1, 0x2009, 0x3}}]}, 0x74}, 0x1, 0x0, 0x0, 0x4890}, 0x4010) r12 = syz_open_procfs(0x0, &(0x7f0000000000)='net/netstat\x00') read$FUSE(r12, &(0x7f0000000640)={0x2020}, 0x2020) 251.745781ms ago: executing program 1 (id=2665): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x48e80, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r4, &(0x7f0000000600)={0x0, 0x0, 0x0}, 0x40) syz_open_dev$sndctrl(&(0x7f0000000040), 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x0, 0x4, 0x8001, 0x0, 0xb49, 0x200080000002, 0x7, 0x8, 0x3}, 0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r5, 0x0, 0x40, &(0x7f0000000c00)=@filter={'filter\x00', 0x42, 0x4, 0xb5c, 0xffffffff, 0x9e4, 0x9e4, 0xec, 0xffffffff, 0xffffffff, 0xac8, 0xac8, 0xac8, 0xffffffff, 0x5, 0x0, {[{{@ip={@empty, @dev, 0x0, 0x0, 'bridge_slave_1\x00', 'nr0\x00'}, 0x3127, 0xc8, 0xec, 0x1ba, {0x46010000}, [@common=@addrtype={{0x2c}}, @common=@addrtype={{0x2c}}]}, @REJECT={0x24}}, {{@uncond, 0x287, 0x898, 0x8f8, 0x0, {0x0, 0x4}, [@common=@unspec=@u32={{0x7e0}, {[{[{}, {0x1000000}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}]}, {[{}, {}, {0x0, 0x2}], [{}, {0x0, 0x8}]}, {}, {}, {[{}, {}, {}, {}, {}, {0xfffffffe}], [{0x6}, {0x0, 0x3}], 0xfe}, {[{}, {}, {}, {}, {}, {}, {0x0, 0x2}], [{}, {}, {}, {}, {}, {}, {}, {0x0, 0xfe40}]}, {[{0x0, 0x3}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x4}]}, {[{}, {}, {}, {}, {}, {}, {}, {}, {0x3}]}, {}, {[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}]}, {[], [{}, {0x4}]}], 0x5}}, @common=@unspec=@ipvs={{0x48}, {@ipv4=@private=0xa010102, [0xff000000, 0xff, 0xff0000ff], 0x4e24, 0xc, 0x2, 0x4e24, 0x1, 0x8}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0xffffffffffffffff, [0x2, 0x1], 0x1, 0x1}, {0x0, [0x4, 0x0, 0x5, 0x1, 0x5, 0x4], 0x4, 0x3}}}}, {{@ip={@multicast1, @broadcast, 0x0, 0x0, 'lo\x00', 'veth0_virt_wifi\x00'}, 0x0, 0xc0, 0xe4, 0x0, {}, [@common=@osf={{0x50}, {'syz1\x00', 0x0, 0x1, 0x1, 0x1}}]}, @REJECT={0x24}}], {{'\x00', 0x0, 0x70, 0x94}, {0x24}}}}, 0xbb8) dup2(0xffffffffffffffff, r5) ioctl$KVM_XEN_HVM_CONFIG(r1, 0x4038ae7a, &(0x7f00000001c0)={0x6, 0x2fc, &(0x7f00000009c0)="566ed15191ec0a918ac47114e78018ae8cc14e34f964d3d9a6edb8795c31f7d7b4d4a0e36ef0e0bb17328349b4616ffb4cf7781ebf2f4f190f972db09810c05092a49e631c013466d4689663838b025366ef3bf0e26f62c2a0aef9f938eaf406fa17110d0140fb175378daaca553551fef8893705d431ef2b99c47a12401dafdb4adb43623043b3fb3397d4f40a850b28a8fe8172350861ae1e6f51119f1c07a754603b9bdb434b28a612c166fd79070ef9478102700bc1b5f6d8416f48047730eb20f9926c438b1ebb5cd19f8c73a565c6c7c323a14bd5a9d9585c4a03c39fdb3c432201b26589c3f9280b3f24fa2c0a3255cdc9a8ade52ff2b1c64408e1c0498c6ae50196b5716ea68cac086cae109837d47a19c3d57d7707304d185ed18bcc98f3b20b8349cfbc493949d2623e130a3857389f268058b4ed5af9467a8c6f9d9cda59ea6a7f089dd1d30c415b2a56dccda5b69e2fa69ea5ae70369a23d7f1cca402092c940a12412c1f7e7f23a6a09feb4fe7cd1e94772625588ee305e19c4ff7ff9d42e721a05e4b0c6ed4339cda7846bd1b8863ab148f87d1f5ac9937509a1e3db00dbc7c7fcabda98b2e2191e5114eae78b20072766bcdadfb898ddc5a41107bdd6400bb4cabccdca511d71ba5dd766b5600a9f11e3826173e432f1e6de9b040d15ddcb8fdc14f29f345649da449941b9d7703134c197d388d07f4d362a0b05edc81dffc68cc2cd83234d99b912b8adc8eab6438388107e5041d97b98241de2049ab6d98734a5258e086b2ee759a629e38a7c4c488201cd61fc930ddc536002c4ef338c5dc9afae5c2aa9542c7b58ef803db406f18364cc8a5e2c3260fcdb9d2cec55ec8cf3aecbfbeaeabbec0cde187519f79d1a4811ca3a5318e9121fde9f986d6cb2a45ea4e69e3d4fa05a66bb779eb8037d8c299c12605efe038a5f4c22cfedb9baa086b18ee0a3e5cce6dbf8dcd4bd6f3d8a67aaa5d3d09cd720196826f8e8cc1b1f7bde9786840bedfcb42ca4781b195efe6d66046eef53f86f6f0a8c9dd86446dec51d00b1b48c82a3716d841b306664e570c20a04b92616c34f8a9cfa778ca5e3bf23c3e9f7a80fbe26be831614c8d91a26fa47e478a4940cc7c4c847efaeeef56f3ede97480814d2f4909a153fae743325ca2bea2e44a42b9a1dd84afeb0d5e888148281534c35cd8079bddf5e7a11df5df4cc139db8c659c54107409aa80b1ddceb2f8c11290e3be479233ec92aadc4fc67b39c81d70277b59b19392d4d9498dedba6686177fa1ab5a451298ad6723df334547b06e51599343360154460f4076947cdd67611a3715639a78cb1e823a4fb6db4f783e065e9b11c196f9efe11629c28a28cc50b06e11fce67a2cad1138e81d06685b6e325b1fb342678a68e3463e21d2df1b12920a0f3dbdc452313158ed6423c5a7b47028c45544984f6f82d61914a5bbce6d34567d83a71281b7eb30ba099037c81d46eb4cf2e7c59561f7ca3d7f3c49901ea5ff2e42e7928518ec0d277d1b1c2ca3aeef26df89daff30b3e514817696040771fe9c4dbd7afbb30e5977f5b9d5300a08360d9856685fc5e409ea22a78ef603672d8117209f1f7dd2c942e5a3b70668cc13258c67ebef5a2b1e16922f5bb07afbe5b1edf7fa4b67996169aac3ca2fb6e544e7bb868415c17333beda1907e245a1290f223b39ec94b51776b36d12b03a8719f4df36694e19d741752c6689ee13ecd72c7c99132673b1859746763f6a5af1d26bfbe67d40f7c767232676fa3d5573d8b6c73d2df7c241a5d00f57e8cefb5b380ec16aac9ffddb39b3f6522df40482edd84222906f33482950b361d2b59bef35ed0fe325af4379d2eea372088886ed123e173a69873b41dea0adb62b4edfa59cefd70cb528c976d85ef7883664f4cde5f60f113ce1557f1ae14521b2386573b6e7461d64e3b6013a5bb434494fb105ea91e5c9b7a4ed5796798e90ef193f5423a9dd9b9f9a0e5d39cd20cf184787b5fb5c3f3dcbd6d69d5d7ac950c2400acdb5879f6297d558b621e2b1c2d90ee313cd4c73997c7bb6ef79130b9b52d37eab3d7d2f9634d47d5682d639bc2e35411e4561970312fbf8e61707e0563e976e4b6820de003bf80fcd3f7351acfc46ea0c9d3ca11e8f2aa81ba69a687e27589eaf071becc88163f702b84a4cdccf49d922709ba94a25bb22281ae09f35ca5c0a631dffa9e92c70405971fbdadc3e2375f9f122d37a1fc2b07c51fff50bdd76bad20cd5707ec4c26a718000838cc14dd0e9a4caad9b6ef66a22544c72cd2feae51d823b4a9760ac643b883f96f0f02f6cbbe14a8e58af1cdef6bb43fbebfc6696ac52ed79bb6f19aca79505b5d8310dbf2e7276817010b8860b84b6d84cfbcbf676dcdad60a2cfc9abba1dee15f54d9b1f969f3451a6e4ae3a22e179c86f2d31719115592dbf9425fc0d99bba8a91563a9c3c54adbeb5a2b746997889f0b297015443d1d972f27d17170cb9374c16b993540d4628c85b93816136ea372bdcb33c2ee448c33534409debca70b370506d09c7be295726b526291e897ba76f9cf9d0f3274fc202984f92639d47571923ee48d18f8a98bd0f9021d5f0b8621a4699254865ed1940bb079a27af8866ff4922ea9388c402ae66870410519f687c4bcc9908e876254a3b5cd193e65a9ea0b1346dc2f5d45ddaf6a3f49d8c4b9179b68c1e92a8e13db407f296b1e55eb5f4647353b8da6a17d332aa6b8b5842cbd11700a34c1e598346a8ea3f5e5a8c3f1ea1f089dc7cdbec12fb826ba5ace700a397ba5d78e0a010ba0e244c2e0dd25be5d6b3e8f1bb072f5a80d6a9e64a583ca993d0aa6e3609e04d58b40fe103ba37a2384a4cfcb0730f9559c90a7481c609f98c118748ebacb8b0ada449b353e8ad002acfd7096b57d24fa0fb3016fec60c0643cf184744ddcf9bfb227cbbf4b327d5a4ee181654be52e4fe8135b96b8d9d95b09229a1026d9ac4a50f5d614942656e612095b275070b986b632330b207f69e57e7d1e1af759c94126d99cc5aae6c27b614ff199481b05b055d74fc847580690ccb978bc29fbd7a5b36fd76896727df9d2c860fc57c5b4d86c86ee8b1da6a936b1f45508e4ad8dca59d2bfb9bebcf9d2ee7ea5816bbe4e23d030c93aadd495ef9870e1c07c7635ccf5fcdf3e533e7f0d2f4763eb37f08bfd6ed1b0761f9be484c7d503bef24b29e642d8e4efc00307db742ff2cd4c77a00f5decf9497ec07336e2ec129c7868d3c81e484bc5373256ed34e1ae14c20b7170b815677dae07fafe331d8f86f0e33cb8200cc09b2b9509d5c8e6b54abe29c754eb26906247ea3ea6ca6426be83e21455205a8327292d9a45f43e636f72b25e6683670844b706e3221ad4f7a0b484c3fe9094efdb16578570b51af901b069c41ba3b7c1338021e0911970816596684489a97b11233eb8eb457459d27066b5ccd1a7d0cee2efb716e68c264ebfcdecd165520e01e7118c9b3b645a2de2490f94f63b9bd7d8af4580b59b7f0d2ce4c06203f1e96e2ee497e0a93675a03f065a259f0c3fd4a3f76ad9e8ce1972f2fe12300a26daef06627ee22bba0262aa5f707e538dfb8d681b7d1477e6a9f1d76580e22fb253d1a10c6faa923f80b4df5b3a978cefd9a21a35426bd2920c6fb915cdac53b47af544a26d65653dc3383ff8e58c4a22bf70651ef62e46e06fca15e9c2fe5395e937cc06c20ec34b9a2f2def7c37b1e6c7a2a088c9c55c5d69cc1d3afdbd38ab1e9c47cf88098f1f8a6bad1ed87fd3b19103dc3bd7bcc2613a8e47dda92977436e770d65fd7b2e739bd6cc4bc5b82d9c0512cafc1714f4680e69f84a13ff1dc77ee56309459d28efe74e9f3087738798851921677b7119b98375243b1250bbcfd76081bf71c1e2048c185547e970b8db40b2b586ea27ac62ae32ca3bddffd90ee3a76a167564abb02f15cab8b3eb9c9115650dac0bb494200f0b4758ed3bd8254cb44b25144f03f68b2b5d96b4a4b2607b8d7f76a25f43032041305690068d88cf17f558b54f9b19f6f7a7a9a1ca1a2565f114e086f22c3a41812b8b21ccce2206ae306926d1a376d23d168d89d25c3f8e33b68d79f8f1b05d37a896c24556f9328ddad3deb7f93d0c7d8f29ab6e764e129b4b4fc9873dadae105b915a909fdf712d2f7145ac85a916844d70a5fd149ed4d1bef8a4a44692995959af5f1ad987202c3cf7975d0932cb7edbaaa8798384d0c29d6aed67b7fce7880223f385031b87603079eceb2734b285258e002ef372900ae0a39f03da5285f2afbe8c721a34ed63f16e722f9b06341f987f07afa7aaddc697222c5bf0d1feeee2b68a", &(0x7f0000000640), 0xc00}) r6 = add_key$keyring(&(0x7f0000000340), &(0x7f00000004c0)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) r7 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000980)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r7, &(0x7f0000000240)='asymmetric\x00', &(0x7f0000000180)=@keyring={'key_or_keyring:', r6}) r8 = add_key(&(0x7f0000000080)='rxrpc_s\x00', 0x0, 0x0, 0x0, r6) request_key(&(0x7f0000000280)='id_resolver\x00', &(0x7f00000002c0)={'syz', 0x2}, &(0x7f0000000300)='/dev/kvm\x00', r8) ioctl$KVM_SET_MP_STATE(r2, 0x4004ae99, &(0x7f0000000000)=0x3) ptrace(0x10, 0x0) ptrace$setregset(0x4205, 0x0, 0x1, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, 0x0) syz_usb_connect(0x0, 0x24, 0x0, 0x0) 0s ago: executing program 3 (id=2666): r0 = syz_usb_connect(0x4, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="18640aaf8bcfe31cddc821666922806ca9b27dfebd731b"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000080)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) syz_usb_ep_read(r0, 0x4, 0x6b, &(0x7f0000000100)=""/107) syz_usb_ep_write$ath9k_ep1(r1, 0x82, 0x0, 0x0) syz_usb_connect(0x4, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="18640aaf8bcfe31cddc821666922806ca9b27dfebd731b"], 0x0) (async) syz_usb_control_io$hid(r0, 0x0, 0x0) (async) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000080)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) (async) syz_usb_ep_read(r0, 0x4, 0x6b, &(0x7f0000000100)=""/107) (async) syz_usb_ep_write$ath9k_ep1(r1, 0x82, 0x0, 0x0) (async) kernel console output (not intermixed with test programs): ink_sendmsg+0x813/0xb40 [ 797.612963][T14257] ? __pfx_netlink_sendmsg+0x10/0x10 [ 797.612991][T14257] ? aa_sock_msg_perm+0xf1/0x1b0 [ 797.613025][T14257] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 797.613048][T14257] ? __pfx_netlink_sendmsg+0x10/0x10 [ 797.613069][T14257] ____sys_sendmsg+0xa68/0xad0 [ 797.613107][T14257] ? __pfx_____sys_sendmsg+0x10/0x10 [ 797.613136][T14257] ? kstrtoull+0x12f/0x1d0 [ 797.613165][T14257] ___sys_sendmsg+0x2a5/0x360 [ 797.613197][T14257] ? __pfx____sys_sendmsg+0x10/0x10 [ 797.613224][T14257] ? get_pid_task+0x20/0x1f0 [ 797.613243][T14257] ? get_pid_task+0x20/0x1f0 [ 797.613258][T14257] ? get_pid_task+0x20/0x1f0 [ 797.613303][T14257] ? __fget_files+0x2a/0x420 [ 797.613329][T14257] ? __fget_files+0x3a0/0x420 [ 797.613363][T14257] __sys_sendmsg+0x183/0x260 [ 797.613392][T14257] ? __pfx___sys_sendmsg+0x10/0x10 [ 797.613440][T14257] __do_fast_syscall_32+0x20d/0x640 [ 797.613462][T14257] ? do_fast_syscall_32+0x33/0x70 [ 797.613479][T14257] ? asm_int80_emulation+0x1a/0x20 [ 797.613496][T14257] ? do_int80_emulation+0x274/0x4d0 [ 797.613513][T14257] ? trace_irq_disable+0x3b/0x150 [ 797.613554][T14257] do_fast_syscall_32+0x33/0x70 [ 797.613572][T14257] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 797.613596][T14257] RIP: 0023:0xf704ef6c [ 797.613615][T14257] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 58 b8 77 00 00 00 cd 80 0f 0b 90 90 90 90 90 90 b8 ad [ 797.613631][T14257] RSP: 002b:00000000f543d50c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 797.613653][T14257] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080014800 [ 797.613666][T14257] RDX: 0000000000048080 RSI: 0000000000000000 RDI: 0000000000000000 [ 797.613677][T14257] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 797.613688][T14257] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 797.613700][T14257] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 797.613728][T14257] [ 798.255800][ T5908] usb 2-1: Using ep0 maxpacket: 16 [ 798.266838][ T5908] usb 2-1: New USB device found, idVendor=046d, idProduct=0721, bcdDevice=9c.25 [ 798.288440][ T5908] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 798.296882][ T5908] usb 2-1: Product: syz [ 798.301088][ T5908] usb 2-1: Manufacturer: syz [ 798.305783][ T5908] usb 2-1: SerialNumber: syz [ 798.314210][ T5908] usb 2-1: config 0 descriptor?? [ 798.331599][ T5908] uvcvideo 2-1:0.0: Found UVC 0.00 device syz (046d:0721) [ 798.339423][ T5908] uvcvideo 2-1:0.0: No valid video chain found. [ 798.547696][T14272] netlink: 'syz.2.2077': attribute type 10 has an invalid length. [ 798.571505][ T5953] usb 2-1: USB disconnect, device number 77 [ 799.156199][ T5908] IPVS: starting estimator thread 0... [ 799.178267][T14287] netlink: 28 bytes leftover after parsing attributes in process `syz.5.2081'. [ 799.725718][T14285] IPVS: using max 49 ests per chain, 117600 per kthread [ 800.015612][ T5953] usb 2-1: new high-speed USB device number 78 using dummy_hcd [ 800.170364][ T5953] usb 2-1: Using ep0 maxpacket: 32 [ 800.190377][ T5953] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 800.204856][ T5953] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 800.239769][T14299] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2085'. [ 800.269237][ T5953] usb 2-1: New USB device found, idVendor=07ca, idProduct=b800, bcdDevice=9b.26 [ 800.297977][ T5953] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 800.325532][ T5953] usb 2-1: Product: syz [ 800.329876][ T5953] usb 2-1: Manufacturer: syz [ 800.334590][ T5953] usb 2-1: SerialNumber: syz [ 800.344652][T14304] netlink: 264 bytes leftover after parsing attributes in process `syz.2.2086'. [ 800.466281][ T5953] usb 2-1: config 0 descriptor?? [ 800.966403][T11486] IPVS: stop unused estimator thread 0... [ 800.998035][ T5908] usb 2-1: USB disconnect, device number 78 [ 802.094876][T14326] ALSA: mixer_oss: invalid OSS volume 'RgºECLEV' [ 802.245932][T14326] ALSA: mixer_oss: invalid OSS volume 'PHOõfiЧaEEAKER' [ 802.922808][T14332] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2092'. [ 803.052602][T14337] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2094'. [ 803.162976][T14345] netlink: 'syz.1.2093': attribute type 10 has an invalid length. [ 803.171661][T14347] FAULT_INJECTION: forcing a failure. [ 803.171661][T14347] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 803.187648][T14347] CPU: 0 UID: 0 PID: 14347 Comm: syz.5.2105 Tainted: G L syzkaller #0 PREEMPT(full) [ 803.187671][T14347] Tainted: [L]=SOFTLOCKUP [ 803.187676][T14347] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 803.187683][T14347] Call Trace: [ 803.187689][T14347] [ 803.187695][T14347] dump_stack_lvl+0xe8/0x150 [ 803.187717][T14347] should_fail_ex+0x412/0x560 [ 803.187735][T14347] strncpy_from_user+0x36/0x2b0 [ 803.187750][T14347] do_getname+0x77/0x250 [ 803.187767][T14347] user_path_at+0x2a/0x160 [ 803.187779][T14347] __ia32_sys_umount+0xf6/0x170 [ 803.187794][T14347] ? __pfx___ia32_sys_umount+0x10/0x10 [ 803.187812][T14347] __do_fast_syscall_32+0x20d/0x640 [ 803.187826][T14347] ? do_fast_syscall_32+0x33/0x70 [ 803.187836][T14347] ? asm_int80_emulation+0x1a/0x20 [ 803.187847][T14347] ? do_int80_emulation+0x274/0x4d0 [ 803.187858][T14347] ? trace_irq_disable+0x3b/0x150 [ 803.187876][T14347] do_fast_syscall_32+0x33/0x70 [ 803.187887][T14347] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 803.187901][T14347] RIP: 0023:0xf6fcef6c [ 803.187913][T14347] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 58 b8 77 00 00 00 cd 80 0f 0b 90 90 90 90 90 90 b8 ad [ 803.187923][T14347] RSP: 002b:00000000f539c50c EFLAGS: 00000206 ORIG_RAX: 0000000000000034 [ 803.187938][T14347] RAX: ffffffffffffffda RBX: 0000000080000040 RCX: 000000000000000b [ 803.187946][T14347] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 803.187953][T14347] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 803.187960][T14347] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 803.187967][T14347] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 803.187983][T14347] [ 803.498520][T14347] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2105'. [ 803.577474][T14352] netlink: 'syz.3.2095': attribute type 10 has an invalid length. [ 805.035509][T14376] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2104'. [ 805.035693][ T5953] usb 4-1: new high-speed USB device number 74 using dummy_hcd [ 805.404377][ T5953] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 805.420773][ T5953] usb 4-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 805.460490][ T5953] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 805.535293][ T5953] usb 4-1: config 0 descriptor?? [ 805.612864][ T5953] pwc: Askey VC010 type 2 USB webcam detected. [ 806.089619][ T5953] pwc: recv_control_msg error -32 req 02 val 2b00 [ 806.098171][ T5953] pwc: recv_control_msg error -32 req 02 val 2700 [ 806.108493][ T5953] pwc: recv_control_msg error -32 req 02 val 2c00 [ 806.329277][ T5953] pwc: recv_control_msg error -32 req 04 val 1000 [ 806.355296][ T5953] pwc: recv_control_msg error -32 req 04 val 1300 [ 806.389585][ T5953] pwc: recv_control_msg error -32 req 04 val 1400 [ 806.417301][ T5953] pwc: recv_control_msg error -32 req 02 val 2000 [ 806.535751][T14396] netlink: 264 bytes leftover after parsing attributes in process `syz.2.2110'. [ 806.551800][T14393] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2107'. [ 806.680192][T14404] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2112'. [ 806.790362][ T5953] pwc: recv_control_msg error -32 req 02 val 2100 [ 806.859397][T14413] netdevsim netdevsim4: Firmware load for './file0/../file0/file0' refused, path contains '..' component [ 806.886807][T14413] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2113'. [ 807.146018][ T5927] usb 5-1: new high-speed USB device number 62 using dummy_hcd [ 807.238875][T14419] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2117'. [ 807.592458][ T5927] usb 5-1: config 0 has an invalid interface number: 117 but max is 0 [ 807.606246][ T5927] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 807.616657][ T5927] usb 5-1: config 0 has no interface number 0 [ 807.622820][ T5927] usb 5-1: config 0 interface 117 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 807.642673][ T5927] usb 5-1: config 0 interface 117 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 808.304141][ T5927] usb 5-1: New USB device found, idVendor=0afa, idProduct=03e8, bcdDevice=99.d0 [ 808.315416][ T5927] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 808.323831][ T5927] usb 5-1: Product: syz [ 808.328293][ T5927] usb 5-1: Manufacturer: syz [ 808.332994][ T5927] usb 5-1: SerialNumber: syz [ 808.342284][ T5927] usb 5-1: config 0 descriptor?? [ 808.532431][ T5953] pwc: recv_control_msg error -71 req 04 val 1500 [ 808.633442][ T5953] pwc: recv_control_msg error -71 req 02 val 2500 [ 808.653819][ T5953] pwc: recv_control_msg error -71 req 02 val 2400 [ 808.669026][ T5953] pwc: recv_control_msg error -71 req 02 val 2600 [ 808.685973][ T5953] pwc: recv_control_msg error -71 req 02 val 2900 [ 808.696297][T14413] FAULT_INJECTION: forcing a failure. [ 808.696297][T14413] name failslab, interval 1, probability 0, space 0, times 0 [ 808.716017][ T5953] pwc: recv_control_msg error -71 req 02 val 2800 [ 808.734353][ T5953] pwc: recv_control_msg error -71 req 04 val 1100 [ 808.753523][ T5953] pwc: recv_control_msg error -71 req 04 val 1200 [ 808.775163][ T5953] pwc: Registered as video103. [ 808.797003][ T5953] input: PWC snapshot button as /devices/platform/dummy_hcd.3/usb4/4-1/input/input122 [ 808.811131][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 808.817617][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 808.839236][T14413] CPU: 1 UID: 0 PID: 14413 Comm: syz.4.2113 Tainted: G L syzkaller #0 PREEMPT(full) [ 808.839270][T14413] Tainted: [L]=SOFTLOCKUP [ 808.839286][T14413] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 808.839298][T14413] Call Trace: [ 808.839308][T14413] [ 808.839317][T14413] dump_stack_lvl+0xe8/0x150 [ 808.839351][T14413] should_fail_ex+0x412/0x560 [ 808.839381][T14413] should_failslab+0xa8/0x100 [ 808.839407][T14413] __kmalloc_noprof+0xe8/0x760 [ 808.839429][T14413] ? tomoyo_encode+0x28b/0x550 [ 808.839460][T14413] tomoyo_encode+0x28b/0x550 [ 808.839491][T14413] tomoyo_realpath_from_path+0x58d/0x5d0 [ 808.839528][T14413] ? tomoyo_path_number_perm+0x219/0x630 [ 808.839551][T14413] tomoyo_path_number_perm+0x246/0x630 [ 808.839576][T14413] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 808.839602][T14413] ? __lock_acquire+0x6b5/0x2cf0 [ 808.839663][T14413] ? __fget_files+0x2a/0x420 [ 808.839696][T14413] ? __fget_files+0x3a0/0x420 [ 808.839729][T14413] ? __fget_files+0x2a/0x420 [ 808.839759][T14413] security_file_ioctl_compat+0xc3/0x2a0 [ 808.839783][T14413] __ia32_compat_sys_ioctl+0x139/0x950 [ 808.839805][T14413] ? __pfx___ia32_compat_sys_ioctl+0x10/0x10 [ 808.839825][T14413] ? __fget_files+0x3a0/0x420 [ 808.839850][T14413] ? fput+0xa0/0xd0 [ 808.839870][T14413] ? ksys_write+0x242/0x270 [ 808.839895][T14413] __do_fast_syscall_32+0x20d/0x640 [ 808.839913][T14413] ? do_fast_syscall_32+0x33/0x70 [ 808.839927][T14413] ? asm_int80_emulation+0x1a/0x20 [ 808.839941][T14413] ? do_int80_emulation+0x274/0x4d0 [ 808.839964][T14413] ? trace_irq_disable+0x3b/0x150 [ 808.839988][T14413] do_fast_syscall_32+0x33/0x70 [ 808.840003][T14413] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 808.840021][T14413] RIP: 0023:0xf700ef6c [ 808.840036][T14413] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 58 b8 77 00 00 00 cd 80 0f 0b 90 90 90 90 90 90 b8 ad [ 808.840050][T14413] RSP: 002b:00000000f53bb50c EFLAGS: 00000206 ORIG_RAX: 0000000000000036 [ 808.840067][T14413] RAX: ffffffffffffffda RBX: 0000000000000008 RCX: 0000000080086f53 [ 808.840077][T14413] RDX: 0000000080000040 RSI: 0000000000000000 RDI: 0000000000000000 [ 808.840086][T14413] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 808.840095][T14413] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 808.840104][T14413] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 808.840132][T14413] [ 808.840540][T14413] ERROR: Out of memory at tomoyo_realpath_from_path. [ 809.117844][ T5953] usb 4-1: USB disconnect, device number 74 [ 809.787793][ T5953] usb 4-1: new high-speed USB device number 75 using dummy_hcd [ 809.991629][ T5953] usb 4-1: Using ep0 maxpacket: 16 [ 810.076439][ T5953] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 810.105854][ T5953] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 810.153776][ T5953] usb 4-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 810.176016][ T5953] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 810.193894][ T5953] usb 4-1: Product: syz [ 810.213914][ T5953] usb 4-1: Manufacturer: syz [ 810.288258][ T5953] usb 4-1: SerialNumber: syz [ 810.297376][T14444] netlink: 264 bytes leftover after parsing attributes in process `syz.1.2122'. [ 810.416869][ T5953] r8152-cfgselector 4-1: Unknown version 0x0000 [ 810.423275][ T5953] r8152-cfgselector 4-1: config 0 descriptor?? [ 810.467877][T14446] FAULT_INJECTION: forcing a failure. [ 810.467877][T14446] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 810.504899][T14448] fuse: Bad value for 'group_id' [ 810.523115][T14448] fuse: Bad value for 'group_id' [ 810.561992][T14446] CPU: 1 UID: 0 PID: 14446 Comm: syz.2.2123 Tainted: G L syzkaller #0 PREEMPT(full) [ 810.562019][T14446] Tainted: [L]=SOFTLOCKUP [ 810.562024][T14446] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 810.562031][T14446] Call Trace: [ 810.562037][T14446] [ 810.562045][T14446] dump_stack_lvl+0xe8/0x150 [ 810.562067][T14446] should_fail_ex+0x412/0x560 [ 810.562084][T14446] _copy_from_user+0x2d/0xb0 [ 810.562101][T14446] __sys_bpf+0x229/0x950 [ 810.562120][T14446] ? __pfx___sys_bpf+0x10/0x10 [ 810.562144][T14446] ? fput+0xa0/0xd0 [ 810.562166][T14446] ? ksys_write+0x242/0x270 [ 810.562182][T14446] __ia32_sys_bpf+0x7c/0x90 [ 810.562198][T14446] __do_fast_syscall_32+0x20d/0x640 [ 810.562212][T14446] ? do_fast_syscall_32+0x33/0x70 [ 810.562222][T14446] ? asm_int80_emulation+0x1a/0x20 [ 810.562233][T14446] ? do_int80_emulation+0x274/0x4d0 [ 810.562244][T14446] ? trace_irq_disable+0x3b/0x150 [ 810.562262][T14446] do_fast_syscall_32+0x33/0x70 [ 810.562273][T14446] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 810.562292][T14446] RIP: 0023:0xf704ef6c [ 810.562304][T14446] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 58 b8 77 00 00 00 cd 80 0f 0b 90 90 90 90 90 90 b8 ad [ 810.562314][T14446] RSP: 002b:00000000f543d50c EFLAGS: 00000206 ORIG_RAX: 0000000000000165 [ 810.562328][T14446] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 000000008000e000 [ 810.562336][T14446] RDX: 0000000000000023 RSI: 0000000000000000 RDI: 0000000000000000 [ 810.562343][T14446] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 810.562350][T14446] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 810.562357][T14446] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 810.562373][T14446] [ 810.952414][ T5953] usb 5-1: USB disconnect, device number 62 [ 810.953549][T14448] fuse: Bad value for 'group_id' [ 810.964010][T14448] fuse: Bad value for 'group_id' [ 810.994727][T14453] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2126'. [ 811.121766][T14459] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 811.130607][T14459] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 811.275580][ T5927] usb 2-1: new high-speed USB device number 79 using dummy_hcd [ 811.395555][ T5953] usb 5-1: new high-speed USB device number 63 using dummy_hcd [ 811.447041][ T5927] usb 2-1: config 0 has an invalid interface number: 106 but max is 0 [ 811.458930][ T5927] usb 2-1: config 0 has no interface number 0 [ 811.468153][ T5927] usb 2-1: too many endpoints for config 0 interface 106 altsetting 113: 140, using maximum allowed: 30 [ 811.486980][ T5927] usb 2-1: config 0 interface 106 altsetting 113 has 0 endpoint descriptors, different from the interface descriptor's value: 140 [ 811.505587][ T5927] usb 2-1: config 0 interface 106 has no altsetting 0 [ 811.518071][ T5927] usb 2-1: New USB device found, idVendor=08fd, idProduct=0002, bcdDevice=ca.fd [ 811.527748][ T5927] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 811.536472][ T5927] usb 2-1: Product: syz [ 811.542744][ T5927] usb 2-1: Manufacturer: syz [ 811.548730][ T5927] usb 2-1: SerialNumber: syz [ 811.554402][ T5953] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 811.558163][ T5927] usb 2-1: config 0 descriptor?? [ 811.623484][ T5953] usb 5-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 811.632761][ T5953] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 811.670458][ T5953] usb 5-1: config 0 descriptor?? [ 811.681197][ T5953] pwc: Askey VC010 type 2 USB webcam detected. [ 811.942729][ T5927] usb 2-1: USB disconnect, device number 79 [ 812.222823][ T5908] r8152-cfgselector 4-1: USB disconnect, device number 75 [ 812.223607][ T5953] pwc: recv_control_msg error -32 req 02 val 2b00 [ 812.262675][ T5953] pwc: recv_control_msg error -32 req 02 val 2700 [ 812.272381][ T5953] pwc: recv_control_msg error -32 req 02 val 2c00 [ 812.280901][ T5953] pwc: recv_control_msg error -32 req 04 val 1000 [ 812.291840][ T5953] pwc: recv_control_msg error -32 req 04 val 1300 [ 812.306565][ T5953] pwc: recv_control_msg error -32 req 04 val 1400 [ 812.313969][ T5953] pwc: recv_control_msg error -32 req 02 val 2000 [ 812.456927][T14469] netlink: 'syz.5.2130': attribute type 10 has an invalid length. [ 812.695203][ T5953] pwc: recv_control_msg error -32 req 02 val 2100 [ 813.235871][ T5894] usb 3-1: new high-speed USB device number 68 using dummy_hcd [ 813.498638][ T5894] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 813.510626][ T5894] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 813.538485][ T5894] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 813.574262][ T5894] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 813.625558][ T5894] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 813.689273][ T5894] usb 3-1: config 0 descriptor?? [ 814.132137][ T5894] plantronics 0003:047F:FFFF.0019: reserved main item tag 0xd [ 814.201221][ T5894] plantronics 0003:047F:FFFF.0019: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 814.278734][T14491] netlink: 264 bytes leftover after parsing attributes in process `syz.3.2134'. [ 814.987156][ T5927] usb 3-1: USB disconnect, device number 68 [ 815.219670][ T5908] usb 2-1: new high-speed USB device number 80 using dummy_hcd [ 815.472429][ T5953] pwc: recv_control_msg error -71 req 04 val 1500 [ 815.485640][ T5953] pwc: recv_control_msg error -71 req 02 val 2500 [ 815.488206][ T5908] usb 2-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 815.494728][ T5953] pwc: recv_control_msg error -71 req 02 val 2400 [ 815.532472][ T5908] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 815.555992][ T5908] usb 2-1: Product: syz [ 815.560360][ T5908] usb 2-1: Manufacturer: syz [ 815.693712][ T5908] usb 2-1: SerialNumber: syz [ 815.701866][ T5953] pwc: recv_control_msg error -71 req 02 val 2600 [ 815.735621][ T5953] pwc: recv_control_msg error -71 req 02 val 2900 [ 815.758146][ T5953] pwc: recv_control_msg error -71 req 02 val 2800 [ 815.815699][ T5953] pwc: recv_control_msg error -71 req 04 val 1100 [ 815.843726][ T5953] pwc: recv_control_msg error -71 req 04 val 1200 [ 815.897024][ T5953] pwc: Registered as video103. [ 815.924646][ T5953] input: PWC snapshot button as /devices/platform/dummy_hcd.4/usb5/5-1/input/input124 [ 815.943311][T14519] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2139'. [ 816.065794][ T5953] usb 5-1: USB disconnect, device number 63 [ 816.183682][ T5908] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 816.212402][ T5908] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 817.035973][ T5927] usb 3-1: new high-speed USB device number 69 using dummy_hcd [ 817.196330][ T5927] usb 3-1: Using ep0 maxpacket: 16 [ 817.241029][ T5927] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 817.251904][ T5927] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 817.263442][ T5927] usb 3-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 817.272981][ T5927] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 817.292537][ T5927] usb 3-1: Product: syz [ 817.386906][ T5927] usb 3-1: Manufacturer: syz [ 817.391617][ T5927] usb 3-1: SerialNumber: syz [ 817.416726][ T5927] r8152-cfgselector 3-1: Unknown version 0x0000 [ 817.423124][ T5927] r8152-cfgselector 3-1: config 0 descriptor?? [ 818.276682][T14553] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 818.292353][T14554] netlink: 256 bytes leftover after parsing attributes in process `syz.5.2147'. [ 818.416093][T14553] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 819.634902][ T5953] IPVS: starting estimator thread 0... [ 819.765722][T14574] IPVS: using max 51 ests per chain, 122400 per kthread [ 819.783316][ T5953] r8152-cfgselector 3-1: USB disconnect, device number 69 [ 819.832563][ T5908] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to write register index 0x000000e4. ret = -EPROTO [ 819.845154][ T5908] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to init LTM with error -EPROTO [ 819.877369][ T5908] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 819.897988][ T5908] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 820.071078][ T5908] lan78xx 2-1:1.0: probe with driver lan78xx failed with error -71 [ 820.203473][T14590] netlink: 44 bytes leftover after parsing attributes in process `syz.1.2153'. [ 820.226629][ T5908] usb 2-1: USB disconnect, device number 80 [ 821.202579][T11467] IPVS: stop unused estimator thread 0... [ 821.470438][T14608] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2156'. [ 822.976514][T14621] netlink: 256 bytes leftover after parsing attributes in process `syz.1.2158'. [ 823.227913][T14632] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2162'. [ 823.269429][T14637] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2163'. [ 823.331259][T14638] tipc: Failed to remove unknown binding: 66,1,1/0:4164472005/4164472007 [ 823.412995][T14632] tipc: Failed to remove unknown binding: 66,1,1/0:4164472005/4164472007 [ 823.452276][T14632] tipc: Failed to remove unknown binding: 66,1,1/0:4164472005/4164472007 [ 823.473872][T14639] netlink: 'syz.1.2163': attribute type 5 has an invalid length. [ 823.991254][T14653] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2167'. [ 826.101065][T14679] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2171'. [ 826.724966][T14690] netlink: 256 bytes leftover after parsing attributes in process `syz.4.2173'. [ 827.161099][T14694] netlink: 28 bytes leftover after parsing attributes in process `syz.5.2175'. [ 827.205663][T14702] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2176'. [ 827.385727][T14702] netlink: 'syz.4.2176': attribute type 5 has an invalid length. [ 827.701308][T14711] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2178'. [ 827.775673][ T5927] usb 6-1: new high-speed USB device number 22 using dummy_hcd [ 827.968293][ T5927] usb 6-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 827.984904][ T5927] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 828.074075][T14722] netlink: 'syz.3.2180': attribute type 10 has an invalid length. [ 828.135894][ T5927] usb 6-1: config 0 descriptor?? [ 828.403613][T14730] netlink: 'syz.1.2185': attribute type 10 has an invalid length. [ 828.463308][T14709] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 828.475879][T14709] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 828.488044][ T5927] udl 6-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 829.477391][ T5927] [drm:udl_init] *ERROR* Selecting channel failed [ 829.527348][ T5927] [drm] Initialized udl 0.0.1 for 6-1:0.0 on minor 2 [ 829.550525][ T5927] [drm] Initialized udl on minor 2 [ 829.619722][ T5927] udl 6-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 830.198733][ T5927] udl 6-1:0.0: [drm] Cannot find any crtc or sizes [ 830.365786][ T1216] udl 6-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 830.385660][ T5927] usb 6-1: USB disconnect, device number 22 [ 830.406338][ T1216] udl 6-1:0.0: [drm] Cannot find any crtc or sizes [ 830.861496][T14748] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2190'. [ 831.437728][T14758] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2193'. [ 831.469694][T14758] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2193'. [ 833.155597][T14794] netlink: 5268 bytes leftover after parsing attributes in process `syz.3.2198'. [ 833.170664][T14794] netlink: 5264 bytes leftover after parsing attributes in process `syz.3.2198'. [ 833.615075][T14812] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2203'. [ 833.758918][T14816] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2206'. [ 833.802382][T14816] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2206'. [ 835.415648][ T1216] usb 5-1: new high-speed USB device number 64 using dummy_hcd [ 835.665556][ T1216] usb 5-1: Using ep0 maxpacket: 32 [ 835.679977][ T1216] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 835.700353][ T1216] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 835.752989][ T1216] usb 5-1: New USB device found, idVendor=07ca, idProduct=b800, bcdDevice=9b.26 [ 835.765694][ T1216] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 835.841674][ T1216] usb 5-1: Product: syz [ 835.857562][ T1216] usb 5-1: Manufacturer: syz [ 835.863116][ T1216] usb 5-1: SerialNumber: syz [ 835.875549][ T1216] usb 5-1: config 0 descriptor?? [ 835.910929][T14845] netlink: 28 bytes leftover after parsing attributes in process `syz.5.2214'. [ 835.952238][T14847] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2215'. [ 836.086335][T14848] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2215'. [ 836.307520][ T1216] usb 5-1: USB disconnect, device number 64 [ 836.668463][T14864] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2218'. [ 839.315789][ T1216] usb 3-1: new high-speed USB device number 70 using dummy_hcd [ 839.339338][T14893] FAULT_INJECTION: forcing a failure. [ 839.339338][T14893] name failslab, interval 1, probability 0, space 0, times 0 [ 839.353035][T14893] CPU: 0 UID: 0 PID: 14893 Comm: syz.5.2225 Tainted: G L syzkaller #0 PREEMPT(full) [ 839.353067][T14893] Tainted: [L]=SOFTLOCKUP [ 839.353074][T14893] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 839.353085][T14893] Call Trace: [ 839.353094][T14893] [ 839.353101][T14893] dump_stack_lvl+0xe8/0x150 [ 839.353130][T14893] should_fail_ex+0x412/0x560 [ 839.353157][T14893] should_failslab+0xa8/0x100 [ 839.353179][T14893] ? security_inode_alloc+0x39/0x310 [ 839.353204][T14893] kmem_cache_alloc_noprof+0x87/0x650 [ 839.353230][T14893] security_inode_alloc+0x39/0x310 [ 839.353256][T14893] inode_init_always_gfp+0x9ed/0xdc0 [ 839.353287][T14893] ? __pfx_sock_alloc_inode+0x10/0x10 [ 839.353308][T14893] alloc_inode+0x82/0x1b0 [ 839.353333][T14893] do_accept+0x13e/0x760 [ 839.353363][T14893] ? __pfx_do_accept+0x10/0x10 [ 839.353409][T14893] __sys_accept4+0x139/0x230 [ 839.353438][T14893] ? __pfx___sys_accept4+0x10/0x10 [ 839.353464][T14893] ? ksys_write+0x1fc/0x270 [ 839.353493][T14893] __ia32_sys_accept4+0x9a/0xb0 [ 839.353521][T14893] __do_fast_syscall_32+0x20d/0x640 [ 839.353544][T14893] ? do_fast_syscall_32+0x33/0x70 [ 839.353563][T14893] ? asm_int80_emulation+0x1a/0x20 [ 839.353581][T14893] ? do_int80_emulation+0x274/0x4d0 [ 839.353599][T14893] ? trace_irq_disable+0x3b/0x150 [ 839.353630][T14893] do_fast_syscall_32+0x33/0x70 [ 839.353650][T14893] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 839.353673][T14893] RIP: 0023:0xf6fcef6c [ 839.353693][T14893] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 58 b8 77 00 00 00 cd 80 0f 0b 90 90 90 90 90 90 b8 ad [ 839.353710][T14893] RSP: 002b:00000000f53bd50c EFLAGS: 00000206 ORIG_RAX: 000000000000016c [ 839.353733][T14893] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000000000 [ 839.353746][T14893] RDX: 0000000000000000 RSI: 0000000000080800 RDI: 0000000000000000 [ 839.353756][T14893] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 839.353767][T14893] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 839.353779][T14893] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 839.353809][T14893] [ 839.475509][ T1216] usb 3-1: Using ep0 maxpacket: 16 [ 839.633105][ T1216] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 839.787401][ T1216] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 839.797973][ T1216] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 839.814185][ T1216] usb 3-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 839.905865][T14115] usb 5-1: new high-speed USB device number 65 using dummy_hcd [ 839.927657][ T1216] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 839.949929][ T1216] usb 3-1: config 0 descriptor?? [ 839.984041][ T5953] usb 6-1: new high-speed USB device number 23 using dummy_hcd [ 840.179617][T14115] usb 5-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 840.189420][T14115] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 840.195527][ T5953] usb 6-1: Using ep0 maxpacket: 8 [ 840.198081][T14115] usb 5-1: Product: syz [ 840.209190][T14918] FAULT_INJECTION: forcing a failure. [ 840.209190][T14918] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 840.217458][ T5953] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 840.222736][T14115] usb 5-1: Manufacturer: syz [ 840.237816][T14115] usb 5-1: SerialNumber: syz [ 840.246670][T14918] CPU: 1 UID: 0 PID: 14918 Comm: syz.1.2231 Tainted: G L syzkaller #0 PREEMPT(full) [ 840.246704][T14918] Tainted: [L]=SOFTLOCKUP [ 840.246712][T14918] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 840.246723][T14918] Call Trace: [ 840.246732][T14918] [ 840.246740][T14918] dump_stack_lvl+0xe8/0x150 [ 840.246782][T14918] should_fail_ex+0x412/0x560 [ 840.246813][T14918] _copy_to_user+0x31/0xb0 [ 840.246842][T14918] simple_read_from_buffer+0xe1/0x170 [ 840.246874][T14918] proc_fail_nth_read+0x1bb/0x230 [ 840.246905][T14918] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 840.246943][T14918] ? rw_verify_area+0x2a6/0x4d0 [ 840.246965][T14918] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 840.246994][T14918] vfs_read+0x20c/0xa70 [ 840.247014][T14918] ? fdget_pos+0x246/0x320 [ 840.247047][T14918] ? __pfx___mutex_lock+0x10/0x10 [ 840.247068][T14918] ? __pfx_vfs_read+0x10/0x10 [ 840.247090][T14918] ? __fget_files+0x2a/0x420 [ 840.247122][T14918] ? __fget_files+0x3a0/0x420 [ 840.247148][T14918] ? __fget_files+0x2a/0x420 [ 840.247182][T14918] ksys_read+0x150/0x270 [ 840.247206][T14918] ? __pfx_ksys_read+0x10/0x10 [ 840.247231][T14918] ? asm_int80_emulation+0x1a/0x20 [ 840.247256][T14918] do_int80_emulation+0x173/0x4d0 [ 840.247276][T14918] ? asm_int80_emulation+0x1a/0x20 [ 840.247295][T14918] ? clear_bhb_loop+0x40/0x90 [ 840.247314][T14918] ? clear_bhb_loop+0x40/0x90 [ 840.247338][T14918] asm_int80_emulation+0x1a/0x20 [ 840.247356][T14918] RIP: 0023:0xf71a5cab [ 840.247374][T14918] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 840.247392][T14918] RSP: 002b:00000000f545d4bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 840.247415][T14918] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 00000000f545d5d0 [ 840.247429][T14918] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 840.247441][T14918] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 840.247452][T14918] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 840.247464][T14918] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 840.247494][T14918] [ 840.722175][ T5953] usb 6-1: New USB device found, idVendor=05ac, idProduct=8501, bcdDevice=20.9d [ 840.735074][ T5953] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=105 [ 840.743384][ T5953] usb 6-1: SerialNumber: syz [ 840.746565][ T1216] hid_parser_main: 58 callbacks suppressed [ 840.746587][ T1216] microsoft 0003:045E:07DA.001A: unknown main item tag 0x0 [ 840.762074][ T5953] usb 6-1: config 0 descriptor?? [ 840.771340][ T1216] microsoft 0003:045E:07DA.001A: ignoring exceeding usage max [ 840.776998][ T5953] uvcvideo 6-1:0.0: Found UVC 0.00 device (05ac:8501) [ 840.798877][ T5953] uvcvideo 6-1:0.0: No valid video chain found. [ 840.929033][ T1216] input: HID 045e:07da as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:045E:07DA.001A/input/input125 [ 841.050510][ T1216] microsoft 0003:045E:07DA.001A: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.2-1/input0 [ 841.104622][ T9] usb 6-1: USB disconnect, device number 23 [ 841.237514][ T5894] usb 3-1: USB disconnect, device number 70 [ 841.324717][T14115] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 841.343380][T14115] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 842.040712][T14941] netlink: 44 bytes leftover after parsing attributes in process `syz.5.2234'. [ 844.584373][T14115] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to write register index 0x000000e4. ret = -EPROTO [ 844.627859][T14115] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to init LTM with error -EPROTO [ 844.737052][T14115] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 844.769666][T14115] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 844.800910][T14115] lan78xx 5-1:1.0: probe with driver lan78xx failed with error -71 [ 844.840968][T14115] usb 5-1: USB disconnect, device number 65 [ 845.619859][T14978] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2241'. [ 845.717448][T14985] tc_dump_action: action bad kind [ 846.095577][ T5894] usb 2-1: new high-speed USB device number 81 using dummy_hcd [ 846.368162][ T5894] usb 2-1: Using ep0 maxpacket: 32 [ 846.391884][ T5894] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 846.405515][ T5894] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 846.444822][ T5894] usb 2-1: New USB device found, idVendor=07ca, idProduct=b800, bcdDevice=9b.26 [ 846.455727][ T5894] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 846.463770][ T5894] usb 2-1: Product: syz [ 846.504198][ T5894] usb 2-1: Manufacturer: syz [ 846.514703][ T5894] usb 2-1: SerialNumber: syz [ 846.532260][ T5894] usb 2-1: config 0 descriptor?? [ 846.825177][ T5894] usb 2-1: USB disconnect, device number 81 [ 847.375545][ T5908] usb 6-1: new high-speed USB device number 24 using dummy_hcd [ 847.615522][ T5908] usb 6-1: Using ep0 maxpacket: 8 [ 847.629064][ T5908] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0xE has invalid wMaxPacketSize 0 [ 847.640709][ T5908] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xB3, changing to 0x83 [ 847.880865][ T5908] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 848.011705][ T5908] usb 6-1: New USB device found, idVendor=077d, idProduct=627a, bcdDevice= 0.10 [ 848.066567][ T5908] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 848.086752][ T5908] usb 6-1: Product: syz [ 848.100004][ T5908] usb 6-1: Manufacturer: syz [ 848.120431][ T5908] usb 6-1: SerialNumber: syz [ 848.140148][ T5908] usb 6-1: config 0 descriptor?? [ 848.187345][ T5908] radioshark2 6-1:0.0: Invalid radioSHARK2 device [ 848.194052][ T5908] radioshark2 6-1:0.0: probe with driver radioshark2 failed with error -22 [ 848.241852][ T5908] usbhid 6-1:0.0: couldn't find an input interrupt endpoint [ 848.403316][ T5894] usb 6-1: USB disconnect, device number 24 [ 849.009915][T14115] usb 2-1: new high-speed USB device number 82 using dummy_hcd [ 849.387563][T14115] usb 2-1: config 220 has an invalid interface number: 76 but max is 2 [ 849.410277][T14115] usb 2-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 849.475023][T14115] usb 2-1: config 220 has no interface number 2 [ 849.491427][T14115] usb 2-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 849.555569][ T5894] usb 6-1: new low-speed USB device number 25 using dummy_hcd [ 849.567806][T14115] usb 2-1: config 220 interface 0 has no altsetting 0 [ 849.576823][T14115] usb 2-1: config 220 interface 76 has no altsetting 0 [ 849.583747][T14115] usb 2-1: config 220 interface 1 has no altsetting 0 [ 849.613410][T14115] usb 2-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 849.623987][T14115] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 849.654772][T14115] usb 2-1: Product: syz [ 849.659270][T14115] usb 2-1: Manufacturer: syz [ 849.684134][T14115] usb 2-1: SerialNumber: syz [ 849.729311][ T5894] usb 6-1: config 0 has an invalid interface number: 1 but max is 0 [ 849.746721][ T5894] usb 6-1: config 0 has no interface number 0 [ 849.764729][ T5894] usb 6-1: config 0 interface 1 altsetting 19 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 849.779977][ T5894] usb 6-1: config 0 interface 1 altsetting 19 endpoint 0x81 has invalid wMaxPacketSize 0 [ 849.796420][ T5894] usb 6-1: config 0 interface 1 has no altsetting 0 [ 849.811586][ T5894] usb 6-1: New USB device found, idVendor=2179, idProduct=0053, bcdDevice= 0.00 [ 849.820906][ T5894] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 849.832576][ T5894] usb 6-1: config 0 descriptor?? [ 849.885848][ T5908] usb 4-1: new high-speed USB device number 76 using dummy_hcd [ 849.980840][T14115] usb 2-1: selecting invalid altsetting 0 [ 849.988223][T14115] uvcvideo 2-1:220.0: Found UVC 7.01 device syz (8086:0b07) [ 850.001997][T14115] uvcvideo 2-1:220.0: No valid video chain found. [ 850.009262][ T1216] usb 5-1: new high-speed USB device number 66 using dummy_hcd [ 850.024885][T14115] usb 2-1: selecting invalid altsetting 0 [ 850.031153][T14115] usbtest 2-1:220.1: probe with driver usbtest failed with error -22 [ 850.040196][ T5908] usb 4-1: Using ep0 maxpacket: 16 [ 850.050572][ T5908] usb 4-1: unable to get BOS descriptor or descriptor too short [ 850.060781][ T5908] usb 4-1: config 13 has an invalid interface number: 50 but max is 0 [ 850.076749][T14115] usb 2-1: USB disconnect, device number 82 [ 850.082868][ T5908] usb 4-1: config 13 has no interface number 0 [ 850.091494][ T5908] usb 4-1: config 13 interface 50 altsetting 167 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 850.111202][ T5908] usb 4-1: config 13 interface 50 has no altsetting 0 [ 850.124889][ T5908] usb 4-1: New USB device found, idVendor=1aca, idProduct=b28e, bcdDevice=92.32 [ 850.135368][ T5908] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 850.143813][ T5908] usb 4-1: Product: syz [ 850.148311][ T5908] usb 4-1: Manufacturer: syz [ 850.153217][ T5908] usb 4-1: SerialNumber: syz [ 850.165540][ T1216] usb 5-1: Using ep0 maxpacket: 16 [ 850.172940][ T1216] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 850.184616][ T1216] usb 5-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 850.196216][ T1216] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 850.216688][ T1216] usb 5-1: config 0 descriptor?? [ 850.454271][T15049] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 850.467118][T15049] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 850.646535][ T1216] mcp2221 0003:04D8:00DD.001C: USB HID v0.05 Device [HID 04d8:00dd] on usb-dummy_hcd.4-1/input0 [ 850.748099][T15061] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2258'. [ 850.757534][T15061] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2258'. [ 850.835590][ T9] usb 3-1: new high-speed USB device number 71 using dummy_hcd [ 850.985516][ T9] usb 3-1: Using ep0 maxpacket: 16 [ 850.997563][ T9] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 851.010362][ T9] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 851.030890][ T9] usb 3-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 851.049586][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 851.066402][ T9] usb 3-1: Product: syz [ 851.073965][ T9] usb 3-1: Manufacturer: syz [ 851.083099][ T9] usb 3-1: SerialNumber: syz [ 851.105143][ T1216] usb 5-1: USB disconnect, device number 66 [ 851.141276][ T9] r8152-cfgselector 3-1: Unknown version 0x0000 [ 851.161129][ T9] r8152-cfgselector 3-1: config 0 descriptor?? [ 851.509432][ T5908] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 851.553852][ T5908] usb 4-1: MIDIStreaming interface descriptor not found [ 851.688972][ T5908] usb 4-1: USB disconnect, device number 76 [ 852.350816][ T5894] uclogic 0003:2179:0053.001B: failed retrieving string descriptor #100: -71 [ 852.381107][ T5894] uclogic 0003:2179:0053.001B: failed retrieving pen parameters: -71 [ 852.422815][ T5894] uclogic 0003:2179:0053.001B: pen probing failed: -71 [ 852.442790][ T5894] uclogic 0003:2179:0053.001B: failed probing parameters: -71 [ 852.464732][ T5894] uclogic 0003:2179:0053.001B: probe with driver uclogic failed with error -71 [ 852.495409][ T5894] usb 6-1: USB disconnect, device number 25 [ 853.630239][ T5908] r8152-cfgselector 3-1: USB disconnect, device number 71 [ 854.425808][ T9] usb 3-1: new high-speed USB device number 72 using dummy_hcd [ 854.597828][ T9] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 854.608683][ T9] usb 3-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 854.619735][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 854.640198][ T9] usb 3-1: config 0 descriptor?? [ 854.661050][ T9] pwc: Askey VC010 type 2 USB webcam detected. [ 855.118740][ T9] pwc: recv_control_msg error -32 req 02 val 2b00 [ 855.145156][ T9] pwc: recv_control_msg error -32 req 02 val 2700 [ 855.158680][ T9] pwc: recv_control_msg error -32 req 02 val 2c00 [ 855.168386][ T9] pwc: recv_control_msg error -32 req 04 val 1000 [ 855.186197][ T9] pwc: recv_control_msg error -32 req 04 val 1300 [ 855.195688][ T9] pwc: recv_control_msg error -32 req 04 val 1400 [ 855.400116][ T9] pwc: recv_control_msg error -32 req 02 val 2000 [ 856.148096][T15112] block device autoloading is deprecated and will be removed. [ 857.679825][T15141] netlink: 'syz.3.2276': attribute type 10 has an invalid length. [ 858.229768][ T9] pwc: recv_control_msg error -71 req 02 val 2100 [ 858.248841][ T9] pwc: recv_control_msg error -71 req 04 val 1500 [ 858.272354][ T9] pwc: recv_control_msg error -71 req 02 val 2500 [ 858.663323][ T9] pwc: recv_control_msg error -71 req 02 val 2400 [ 858.801017][ T9] pwc: recv_control_msg error -71 req 02 val 2600 [ 858.851993][ T9] pwc: recv_control_msg error -71 req 02 val 2900 [ 858.872570][ T9] pwc: recv_control_msg error -71 req 02 val 2800 [ 858.936315][ T9] pwc: recv_control_msg error -71 req 04 val 1100 [ 858.959443][ T9] pwc: recv_control_msg error -71 req 04 val 1200 [ 858.988749][ T9] pwc: Registered as video103. [ 859.017733][ T9] input: PWC snapshot button as /devices/platform/dummy_hcd.2/usb3/3-1/input/input126 [ 859.099481][ T9] usb 3-1: USB disconnect, device number 72 [ 863.345225][T15225] netlink: 28 bytes leftover after parsing attributes in process `syz.5.2293'. [ 863.940845][T15241] fuse: Bad value for 'fd' [ 865.452857][T15284] FAULT_INJECTION: forcing a failure. [ 865.452857][T15284] name failslab, interval 1, probability 0, space 0, times 0 [ 865.467307][T15284] CPU: 1 UID: 0 PID: 15284 Comm: syz.2.2304 Tainted: G L syzkaller #0 PREEMPT(full) [ 865.467330][T15284] Tainted: [L]=SOFTLOCKUP [ 865.467335][T15284] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 865.467342][T15284] Call Trace: [ 865.467348][T15284] [ 865.467354][T15284] dump_stack_lvl+0xe8/0x150 [ 865.467376][T15284] should_fail_ex+0x412/0x560 [ 865.467394][T15284] should_failslab+0xa8/0x100 [ 865.467409][T15284] __kmalloc_cache_noprof+0x88/0x660 [ 865.467423][T15284] ? mpi_alloc+0x52/0x140 [ 865.467440][T15284] mpi_alloc+0x52/0x140 [ 865.467455][T15284] mpi_read_raw_data+0x139/0x970 [ 865.467473][T15284] dh_set_secret+0x200/0x320 [ 865.467488][T15284] ? crypto_create_tfm_node+0x83/0x3f0 [ 865.467499][T15284] ? __kmalloc_node_noprof+0x34f/0x7c0 [ 865.467513][T15284] ? __pfx_dh_set_secret+0x10/0x10 [ 865.467530][T15284] ? crypto_alloc_tfm_node+0x3c0/0x3f0 [ 865.467543][T15284] ? __keyctl_dh_compute+0x3df/0xd10 [ 865.467560][T15284] __keyctl_dh_compute+0x5ae/0xd10 [ 865.467580][T15284] ? get_pid_task+0x20/0x1f0 [ 865.467598][T15284] ? __pfx___keyctl_dh_compute+0x10/0x10 [ 865.467627][T15284] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 865.467643][T15284] compat_keyctl_dh_compute+0x19d/0x220 [ 865.467660][T15284] ? __pfx_compat_keyctl_dh_compute+0x10/0x10 [ 865.467680][T15284] ? fput+0xa0/0xd0 [ 865.467695][T15284] ? ksys_write+0x242/0x270 [ 865.467710][T15284] ? __ia32_compat_sys_keyctl+0x3f6/0x630 [ 865.467726][T15284] __do_fast_syscall_32+0x20d/0x640 [ 865.467739][T15284] ? do_fast_syscall_32+0x33/0x70 [ 865.467750][T15284] ? asm_int80_emulation+0x1a/0x20 [ 865.467762][T15284] ? do_int80_emulation+0x274/0x4d0 [ 865.467775][T15284] ? trace_irq_disable+0x3b/0x150 [ 865.467809][T15284] do_fast_syscall_32+0x33/0x70 [ 865.467821][T15284] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 865.467838][T15284] RIP: 0023:0xf704ef6c [ 865.467850][T15284] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 58 b8 77 00 00 00 cd 80 0f 0b 90 90 90 90 90 90 b8 ad [ 865.467860][T15284] RSP: 002b:00000000f543d50c EFLAGS: 00000206 ORIG_RAX: 0000000000000120 [ 865.467874][T15284] RAX: ffffffffffffffda RBX: 0000000000000017 RCX: 0000000080000100 [ 865.467882][T15284] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 865.467889][T15284] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 865.467896][T15284] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 865.467903][T15284] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 865.467919][T15284] [ 867.929702][T15337] netlink: 'syz.4.2315': attribute type 10 has an invalid length. [ 868.367400][ T5953] usb 6-1: new full-speed USB device number 26 using dummy_hcd [ 868.557745][T15340] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 868.574639][T15340] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 868.611779][T15340] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 868.640212][T15340] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 868.659673][T15340] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 868.673511][T15340] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 868.690601][T15340] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 868.709972][T15340] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 868.724488][T15340] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 868.746280][T15340] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 869.066133][ T5953] usb 6-1: unable to read config index 0 descriptor/start: -71 [ 869.102877][ T5953] usb 6-1: can't read configurations, error -71 [ 869.166742][T15355] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2320'. [ 869.279690][T15355] netlink: 'syz.2.2320': attribute type 5 has an invalid length. [ 870.239813][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 870.246389][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 871.095687][ T5953] usb 2-1: new low-speed USB device number 83 using dummy_hcd [ 871.208135][T15418] netlink: 'syz.3.2329': attribute type 10 has an invalid length. [ 871.322807][ T5953] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 871.332161][ T5953] usb 2-1: config 0 has no interface number 0 [ 871.349927][ T5953] usb 2-1: config 0 interface 1 altsetting 19 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 871.380668][ T5953] usb 2-1: config 0 interface 1 altsetting 19 endpoint 0x81 has invalid wMaxPacketSize 0 [ 871.398655][ T5953] usb 2-1: config 0 interface 1 has no altsetting 0 [ 871.406157][ T5953] usb 2-1: New USB device found, idVendor=2179, idProduct=0053, bcdDevice= 0.00 [ 871.496532][ T5953] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 871.565903][ T5953] usb 2-1: config 0 descriptor?? [ 872.526543][T15431] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2331'. [ 872.570401][T15410] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 872.608462][T15410] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 873.026756][T15442] netlink: 28 bytes leftover after parsing attributes in process `syz.5.2333'. [ 873.702133][ T9] usb 4-1: new high-speed USB device number 77 using dummy_hcd [ 873.963396][ T9] usb 4-1: Using ep0 maxpacket: 8 [ 874.026151][ T5953] uclogic 0003:2179:0053.001D: failed retrieving string descriptor #100: -71 [ 874.051990][ T5953] uclogic 0003:2179:0053.001D: failed retrieving pen parameters: -71 [ 874.064354][ T5953] uclogic 0003:2179:0053.001D: pen probing failed: -71 [ 874.074448][ T5953] uclogic 0003:2179:0053.001D: failed probing parameters: -71 [ 874.092455][ T9] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 874.141764][ T9] usb 4-1: New USB device found, idVendor=05ac, idProduct=8501, bcdDevice=20.9d [ 874.160142][T15461] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2337'. [ 874.183033][ T5953] uclogic 0003:2179:0053.001D: probe with driver uclogic failed with error -71 [ 874.244949][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=105 [ 874.333408][ T5953] usb 2-1: USB disconnect, device number 83 [ 874.339621][ T9] usb 4-1: SerialNumber: syz [ 874.483007][ T9] usb 4-1: config 0 descriptor?? [ 874.557778][ T9] uvcvideo 4-1:0.0: Found UVC 0.00 device (05ac:8501) [ 874.580218][ T9] uvcvideo 4-1:0.0: No valid video chain found. [ 875.380280][T15481] netlink: 'syz.5.2339': attribute type 10 has an invalid length. [ 876.346277][ T5953] usb 4-1: USB disconnect, device number 77 [ 876.621405][T15506] netlink: 'syz.4.2342': attribute type 10 has an invalid length. [ 876.925557][T14115] usb 3-1: new high-speed USB device number 73 using dummy_hcd [ 877.106728][T14115] usb 3-1: Using ep0 maxpacket: 16 [ 877.190856][T14115] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 877.210763][T14115] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 877.292694][T14115] usb 3-1: New USB device found, idVendor=046d, idProduct=c50c, bcdDevice= 0.00 [ 877.314556][T14115] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 877.345616][T14115] usb 3-1: config 0 descriptor?? [ 877.800110][T14115] usbhid 3-1:0.0: can't add hid device: -71 [ 877.808703][T14115] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 877.965682][ T5953] usb 6-1: new high-speed USB device number 28 using dummy_hcd [ 878.135613][T14115] usb 3-1: USB disconnect, device number 73 [ 878.137549][ T5953] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 878.163081][ T5953] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 878.185173][ T5953] usb 6-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 878.194775][ T5953] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 878.215086][ T5953] usb 6-1: SerialNumber: syz [ 878.504422][T15523] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2349'. [ 878.536668][T15523] openvswitch: netlink: Unknown nsh attribute 0 [ 878.705556][ T9] usb 4-1: new high-speed USB device number 78 using dummy_hcd [ 878.825546][ T5894] usb 5-1: new high-speed USB device number 67 using dummy_hcd [ 878.845544][ T5901] usb 3-1: new low-speed USB device number 74 using dummy_hcd [ 878.865539][ T9] usb 4-1: Using ep0 maxpacket: 32 [ 878.872451][ T9] usb 4-1: config 231 has an invalid descriptor of length 0, skipping remainder of the config [ 878.892156][ T9] usb 4-1: config 231 has 0 interfaces, different from the descriptor's value: 1 [ 878.904089][ T9] usb 4-1: New USB device found, idVendor=0572, idProduct=cb01, bcdDevice=1b.c4 [ 878.913499][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 878.922518][ T9] usb 4-1: Product: syz [ 878.927069][ T9] usb 4-1: Manufacturer: syz [ 878.931867][ T9] usb 4-1: SerialNumber: syz [ 879.008839][ T5901] usb 3-1: Invalid ep0 maxpacket: 64 [ 879.019050][ T5894] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 879.040457][ T5894] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 879.067133][ T5894] usb 5-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 879.080688][ T5894] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 879.089991][ T5894] usb 5-1: SerialNumber: syz [ 879.128023][ T5953] usb 6-1: 0:2 : does not exist [ 879.145631][ T5901] usb 3-1: new low-speed USB device number 75 using dummy_hcd [ 879.217509][ T5953] usb 6-1: USB disconnect, device number 28 [ 879.415732][ T5901] usb 3-1: Invalid ep0 maxpacket: 64 [ 879.446121][ T5901] usb usb3-port1: attempt power cycle [ 879.462045][T13489] udevd[13489]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 879.775574][ T5953] usb 6-1: new high-speed USB device number 29 using dummy_hcd [ 879.805557][ T5901] usb 3-1: new low-speed USB device number 76 using dummy_hcd [ 879.836621][ T5901] usb 3-1: Invalid ep0 maxpacket: 64 [ 880.009023][ T5953] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 880.030138][ T5953] usb 6-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 880.043742][ T5901] usb 3-1: new low-speed USB device number 77 using dummy_hcd [ 880.054155][ T5953] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 880.092104][ T5901] usb 3-1: Invalid ep0 maxpacket: 64 [ 880.102722][ T5901] usb usb3-port1: unable to enumerate USB device [ 880.110179][ T5953] usb 6-1: config 0 descriptor?? [ 880.147496][ T5953] pwc: Askey VC010 type 2 USB webcam detected. [ 880.169607][ T5894] usb 5-1: 0:2 : does not exist [ 880.295720][T15534] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2351'. [ 880.336074][ T5894] usb 5-1: USB disconnect, device number 67 [ 880.403045][T13489] udevd[13489]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 880.566306][ T5953] pwc: recv_control_msg error -32 req 02 val 2b00 [ 880.599942][ T5953] pwc: recv_control_msg error -32 req 02 val 2700 [ 880.608775][ T5953] pwc: recv_control_msg error -32 req 02 val 2c00 [ 880.616683][ T5953] pwc: recv_control_msg error -32 req 04 val 1000 [ 880.624753][ T5953] pwc: recv_control_msg error -32 req 04 val 1300 [ 880.639081][ T5953] pwc: recv_control_msg error -32 req 04 val 1400 [ 880.695957][ T5953] pwc: recv_control_msg error -32 req 02 val 2000 [ 882.024463][ T9] usb 4-1: USB disconnect, device number 78 [ 882.336067][T14115] usb 3-1: new high-speed USB device number 78 using dummy_hcd [ 882.796459][T14115] usb 3-1: Using ep0 maxpacket: 32 [ 882.809215][T14115] usb 3-1: config 0 has an invalid interface number: 188 but max is 0 [ 882.822441][T14115] usb 3-1: config 0 has no interface number 0 [ 882.865572][T14115] usb 3-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 882.936271][T14115] usb 3-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 882.958027][T14115] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 882.983158][T14115] usb 3-1: Product: syz [ 882.998711][T14115] usb 3-1: Manufacturer: syz [ 883.005765][ T1216] usb 5-1: new high-speed USB device number 68 using dummy_hcd [ 883.020422][T14115] usb 3-1: SerialNumber: syz [ 883.156633][T14115] usb 3-1: config 0 descriptor?? [ 883.170079][T15561] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 883.195766][ T1216] usb 5-1: Using ep0 maxpacket: 8 [ 883.205137][ T1216] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 883.219359][ T1216] usb 5-1: New USB device found, idVendor=05ac, idProduct=8501, bcdDevice=20.9d [ 883.366337][ T1216] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=105 [ 883.418538][ T1216] usb 5-1: SerialNumber: syz [ 883.432170][ T1216] usb 5-1: config 0 descriptor?? [ 883.456061][T15561] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 883.494381][ T1216] uvcvideo 5-1:0.0: Found UVC 0.00 device (05ac:8501) [ 883.508686][ T1216] uvcvideo 5-1:0.0: No valid video chain found. [ 884.431028][ T5953] pwc: recv_control_msg error -71 req 02 val 2100 [ 884.441244][ T5953] pwc: recv_control_msg error -71 req 04 val 1500 [ 884.461225][T15581] netlink: 'syz.1.2358': attribute type 10 has an invalid length. [ 884.540760][ T5953] pwc: recv_control_msg error -71 req 02 val 2500 [ 884.593503][T14115] asix 3-1:0.188 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61 [ 884.611648][T14115] asix 3-1:0.188: probe with driver asix failed with error -61 [ 884.627640][ T5953] pwc: recv_control_msg error -71 req 02 val 2400 [ 884.678180][ T5953] pwc: recv_control_msg error -71 req 02 val 2600 [ 884.688009][ T5953] pwc: recv_control_msg error -71 req 02 val 2900 [ 884.725123][ T5953] pwc: recv_control_msg error -71 req 02 val 2800 [ 884.733090][ T5953] pwc: recv_control_msg error -71 req 04 val 1100 [ 884.741241][ T5953] pwc: recv_control_msg error -71 req 04 val 1200 [ 884.820896][ T5953] pwc: Registered as video103. [ 885.040045][ T5953] input: PWC snapshot button as /devices/platform/dummy_hcd.5/usb6/6-1/input/input127 [ 885.075812][ T5953] usb 6-1: USB disconnect, device number 29 [ 885.122259][T14115] usb 5-1: USB disconnect, device number 68 [ 885.994561][T14115] usb 3-1: USB disconnect, device number 78 [ 886.221887][T15600] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2362'. [ 886.422596][T15600] netlink: 'syz.3.2362': attribute type 5 has an invalid length. [ 888.745530][T14115] usb 6-1: new high-speed USB device number 30 using dummy_hcd [ 888.897895][T14115] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 888.922771][T14115] usb 6-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 888.932557][T14115] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 889.099486][T14115] usb 6-1: config 0 descriptor?? [ 889.109009][T14115] pwc: Askey VC010 type 2 USB webcam detected. [ 889.533786][T14115] pwc: recv_control_msg error -32 req 02 val 2b00 [ 889.543701][T14115] pwc: recv_control_msg error -32 req 02 val 2700 [ 889.552699][T14115] pwc: recv_control_msg error -32 req 02 val 2c00 [ 889.561735][T14115] pwc: recv_control_msg error -32 req 04 val 1000 [ 889.582755][T14115] pwc: recv_control_msg error -32 req 04 val 1300 [ 889.612005][T14115] pwc: recv_control_msg error -32 req 04 val 1400 [ 889.664164][T14115] pwc: recv_control_msg error -32 req 02 val 2000 [ 890.051863][T15663] netlink: 'syz.3.2374': attribute type 10 has an invalid length. [ 890.145799][ T5908] usb 3-1: new high-speed USB device number 79 using dummy_hcd [ 890.509401][ T5908] usb 3-1: Using ep0 maxpacket: 16 [ 890.517521][ T5908] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 890.529037][ T5908] usb 3-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 890.538630][ T5908] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 890.633556][ T5908] usb 3-1: config 0 descriptor?? [ 891.243104][ T5908] mcp2221 0003:04D8:00DD.001E: USB HID v0.05 Device [HID 04d8:00dd] on usb-dummy_hcd.2-1/input0 [ 891.649570][ T5953] usb 3-1: USB disconnect, device number 79 [ 891.823370][T15672] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2376'. [ 892.012636][T15672] netlink: 'syz.4.2376': attribute type 5 has an invalid length. [ 892.366687][ T5953] usb 4-1: new full-speed USB device number 79 using dummy_hcd [ 892.385568][ T9] usb 5-1: new high-speed USB device number 69 using dummy_hcd [ 892.505547][ T5953] usb 4-1: device descriptor read/64, error -71 [ 892.545507][ T9] usb 5-1: Using ep0 maxpacket: 8 [ 892.554031][ T9] usb 5-1: unable to get BOS descriptor or descriptor too short [ 892.564485][ T9] usb 5-1: config 4 has an invalid descriptor of length 129, skipping remainder of the config [ 892.575300][ T9] usb 5-1: config 4 has 0 interfaces, different from the descriptor's value: 1 [ 892.586841][ T9] usb 5-1: New USB device found, idVendor=058f, idProduct=6610, bcdDevice=48.05 [ 892.596783][ T9] usb 5-1: New USB device strings: Mfr=2, Product=0, SerialNumber=3 [ 892.605330][ T9] usb 5-1: Manufacturer: syz [ 892.610682][ T9] usb 5-1: SerialNumber: syz [ 892.766042][ T5953] usb 4-1: new full-speed USB device number 80 using dummy_hcd [ 892.778818][T14115] pwc: recv_control_msg error -71 req 02 val 2100 [ 892.788853][T14115] pwc: recv_control_msg error -71 req 04 val 1500 [ 892.801433][T14115] pwc: recv_control_msg error -71 req 02 val 2500 [ 892.811302][T14115] pwc: recv_control_msg error -71 req 02 val 2400 [ 892.823383][T14115] pwc: recv_control_msg error -71 req 02 val 2600 [ 892.831109][T14115] pwc: recv_control_msg error -71 req 02 val 2900 [ 892.838862][T14115] pwc: recv_control_msg error -71 req 02 val 2800 [ 892.863955][T14115] pwc: recv_control_msg error -71 req 04 val 1100 [ 892.872246][T14115] pwc: recv_control_msg error -71 req 04 val 1200 [ 892.881700][T14115] pwc: Registered as video103. [ 892.898340][T15682] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 892.902612][T14115] input: PWC snapshot button as /devices/platform/dummy_hcd.5/usb6/6-1/input/input128 [ 892.926108][ T5953] usb 4-1: device descriptor read/64, error -71 [ 892.953108][T14115] usb 6-1: USB disconnect, device number 30 [ 893.071848][ T5953] usb usb4-port1: attempt power cycle [ 893.082863][T15682] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 893.104176][T15682] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 893.237112][T15690] netlink: 'syz.5.2380': attribute type 10 has an invalid length. [ 893.477512][ T5953] usb 4-1: new full-speed USB device number 81 using dummy_hcd [ 893.507411][ T5953] usb 4-1: device descriptor read/8, error -71 [ 893.836868][ T5953] usb 4-1: new full-speed USB device number 82 using dummy_hcd [ 893.869150][ T5953] usb 4-1: device descriptor read/8, error -71 [ 894.010361][ T5953] usb usb4-port1: unable to enumerate USB device [ 895.265899][ T9] usb 5-1: USB disconnect, device number 69 [ 896.087659][T15721] netlink: 'syz.3.2388': attribute type 10 has an invalid length. [ 897.735902][ T9] usb 2-1: new high-speed USB device number 84 using dummy_hcd [ 897.998697][ T9] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 898.010712][ T9] usb 2-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 898.043664][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 898.073682][ T9] usb 2-1: config 0 descriptor?? [ 898.106828][ T9] pwc: Askey VC010 type 2 USB webcam detected. [ 898.555442][ T9] pwc: recv_control_msg error -32 req 02 val 2b00 [ 898.564721][ T9] pwc: recv_control_msg error -32 req 02 val 2700 [ 898.579539][ T9] pwc: recv_control_msg error -32 req 02 val 2c00 [ 898.587411][ T9] pwc: recv_control_msg error -32 req 04 val 1000 [ 898.594739][ T9] pwc: recv_control_msg error -32 req 04 val 1300 [ 898.604379][ T9] pwc: recv_control_msg error -32 req 04 val 1400 [ 898.677789][ T9] pwc: recv_control_msg error -32 req 02 val 2000 [ 898.995906][T14115] usb 5-1: new high-speed USB device number 70 using dummy_hcd [ 899.157349][T14115] usb 5-1: Using ep0 maxpacket: 16 [ 899.173472][T14115] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 899.227377][T14115] usb 5-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 899.267695][T14115] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 899.304710][T14115] usb 5-1: config 0 descriptor?? [ 899.495790][ T5908] usb 3-1: new high-speed USB device number 80 using dummy_hcd [ 899.685901][ T5908] usb 3-1: Using ep0 maxpacket: 16 [ 899.701905][ T5908] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 899.749037][T14115] mcp2221 0003:04D8:00DD.001F: USB HID v0.05 Device [HID 04d8:00dd] on usb-dummy_hcd.4-1/input0 [ 899.760304][ T5908] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 899.839215][ T5908] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 899.873457][ T5908] usb 3-1: New USB device found, idVendor=04d8, idProduct=f002, bcdDevice= 0.00 [ 899.911349][ T5908] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 899.978355][ T5908] usb 3-1: config 0 descriptor?? [ 900.158303][T14115] usb 5-1: USB disconnect, device number 70 [ 900.218459][ T5908] usbhid 3-1:0.0: can't add hid device: -71 [ 900.232137][ T5908] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 900.287357][ T5908] usb 3-1: USB disconnect, device number 80 [ 900.675783][ T5908] usb 3-1: new high-speed USB device number 81 using dummy_hcd [ 900.825552][ T5908] usb 3-1: Using ep0 maxpacket: 8 [ 900.847884][ T5908] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 900.867748][ T5908] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 900.884983][ T5908] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 900.897914][ T5908] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 900.911849][ T5908] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 900.921370][ T5908] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 901.165762][ T5908] usb 3-1: GET_CAPABILITIES returned 0 [ 901.171456][ T5908] usbtmc 3-1:16.0: can't read capabilities [ 901.304087][ T9] pwc: recv_control_msg error -71 req 02 val 2100 [ 901.318239][ T9] pwc: recv_control_msg error -71 req 04 val 1500 [ 901.336260][ T9] pwc: recv_control_msg error -71 req 02 val 2500 [ 901.356703][ T9] pwc: recv_control_msg error -71 req 02 val 2400 [ 901.373314][ T9] pwc: recv_control_msg error -71 req 02 val 2600 [ 901.385323][T15758] FAULT_INJECTION: forcing a failure. [ 901.385323][T15758] name failslab, interval 1, probability 0, space 0, times 0 [ 901.405785][T15758] CPU: 0 UID: 0 PID: 15758 Comm: syz.2.2397 Tainted: G L syzkaller #0 PREEMPT(full) [ 901.405809][T15758] Tainted: [L]=SOFTLOCKUP [ 901.405813][T15758] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 901.405821][T15758] Call Trace: [ 901.405826][T15758] [ 901.405832][T15758] dump_stack_lvl+0xe8/0x150 [ 901.405862][T15758] should_fail_ex+0x412/0x560 [ 901.405880][T15758] should_failslab+0xa8/0x100 [ 901.405897][T15758] __kmalloc_noprof+0xe8/0x760 [ 901.405910][T15758] ? tomoyo_encode+0x28b/0x550 [ 901.405928][T15758] tomoyo_encode+0x28b/0x550 [ 901.405945][T15758] tomoyo_realpath_from_path+0x58d/0x5d0 [ 901.405966][T15758] ? tomoyo_path_number_perm+0x219/0x630 [ 901.405979][T15758] tomoyo_path_number_perm+0x246/0x630 [ 901.405992][T15758] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 901.406007][T15758] ? __lock_acquire+0x6b5/0x2cf0 [ 901.406039][T15758] ? __fget_files+0x2a/0x420 [ 901.406057][T15758] ? __fget_files+0x3a0/0x420 [ 901.406072][T15758] ? __fget_files+0x2a/0x420 [ 901.406089][T15758] security_file_ioctl_compat+0xc3/0x2a0 [ 901.406102][T15758] __ia32_compat_sys_ioctl+0x139/0x950 [ 901.406118][T15758] ? __pfx___ia32_compat_sys_ioctl+0x10/0x10 [ 901.406133][T15758] ? __fget_files+0x3a0/0x420 [ 901.406152][T15758] ? fput+0xa0/0xd0 [ 901.406173][T15758] ? ksys_write+0x242/0x270 [ 901.406192][T15758] __do_fast_syscall_32+0x20d/0x640 [ 901.406210][T15758] ? do_fast_syscall_32+0x33/0x70 [ 901.406227][T15758] ? asm_int80_emulation+0x1a/0x20 [ 901.406245][T15758] ? do_int80_emulation+0x274/0x4d0 [ 901.406262][T15758] ? trace_irq_disable+0x3b/0x150 [ 901.406291][T15758] do_fast_syscall_32+0x33/0x70 [ 901.406310][T15758] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 901.406333][T15758] RIP: 0023:0xf704ef6c [ 901.406351][T15758] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 58 b8 77 00 00 00 cd 80 0f 0b 90 90 90 90 90 90 b8 ad [ 901.406368][T15758] RSP: 002b:00000000f543d50c EFLAGS: 00000206 ORIG_RAX: 0000000000000036 [ 901.406389][T15758] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000c0145b0d [ 901.406402][T15758] RDX: 0000000080000040 RSI: 0000000000000000 RDI: 0000000000000000 [ 901.406414][T15758] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 901.406426][T15758] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 901.406438][T15758] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 901.406469][T15758] [ 901.408747][T15758] ERROR: Out of memory at tomoyo_realpath_from_path. [ 901.685670][ T9] pwc: recv_control_msg error -71 req 02 val 2900 [ 901.707402][ T9] pwc: recv_control_msg error -71 req 02 val 2800 [ 901.725584][ T9] pwc: recv_control_msg error -71 req 04 val 1100 [ 901.737875][ T9] pwc: recv_control_msg error -71 req 04 val 1200 [ 901.758591][ C1] usbtmc 3-1:16.0: usbtmc_write_bulk_cb - nonzero write bulk status received: -71 [ 901.829055][ T9] pwc: Registered as video103. [ 901.847311][ T9] input: PWC snapshot button as /devices/platform/dummy_hcd.1/usb2/2-1/input/input129 [ 901.867161][ T5953] usb 3-1: USB disconnect, device number 81 [ 902.058972][ T9] usb 2-1: USB disconnect, device number 84 [ 902.597753][T15783] netlink: 'syz.3.2403': attribute type 10 has an invalid length. [ 905.637580][T15803] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2407'. [ 906.616635][T15829] netlink: 212408 bytes leftover after parsing attributes in process `syz.3.2412'. [ 907.203628][ T5908] usb 6-1: new high-speed USB device number 31 using dummy_hcd [ 907.766877][ T5908] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 907.778115][ T5908] usb 6-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 907.834274][ T5908] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 907.865889][ T5908] usb 6-1: config 0 descriptor?? [ 907.879957][ T5908] pwc: Askey VC010 type 2 USB webcam detected. [ 908.312609][ T5908] pwc: recv_control_msg error -32 req 02 val 2b00 [ 908.329614][ T5908] pwc: recv_control_msg error -32 req 02 val 2700 [ 908.339486][ T5908] pwc: recv_control_msg error -32 req 02 val 2c00 [ 908.349803][ T5908] pwc: recv_control_msg error -32 req 04 val 1000 [ 908.364062][ T5908] pwc: recv_control_msg error -32 req 04 val 1300 [ 908.375199][ T5908] pwc: recv_control_msg error -32 req 04 val 1400 [ 908.487295][ T5908] pwc: recv_control_msg error -32 req 02 val 2000 [ 909.985537][T14115] usb 5-1: new high-speed USB device number 71 using dummy_hcd [ 910.032535][T15875] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2419'. [ 910.215509][T14115] usb 5-1: Using ep0 maxpacket: 8 [ 910.229710][T14115] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 910.245639][T14115] usb 5-1: New USB device found, idVendor=05ac, idProduct=8501, bcdDevice=20.9d [ 910.255006][T14115] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=105 [ 910.263735][T14115] usb 5-1: SerialNumber: syz [ 910.310359][T14115] usb 5-1: config 0 descriptor?? [ 910.753964][T14115] uvcvideo 5-1:0.0: Found UVC 0.00 device (05ac:8501) [ 910.768054][T14115] uvcvideo 5-1:0.0: No valid video chain found. [ 911.594733][ T5908] pwc: recv_control_msg error -71 req 02 val 2100 [ 911.602494][ T5908] pwc: recv_control_msg error -71 req 04 val 1500 [ 911.636389][ T5908] pwc: recv_control_msg error -71 req 02 val 2500 [ 911.665858][ T5908] pwc: recv_control_msg error -71 req 02 val 2400 [ 911.690244][ T5908] pwc: recv_control_msg error -71 req 02 val 2600 [ 911.708506][ T5908] pwc: recv_control_msg error -71 req 02 val 2900 [ 911.726981][T15883] netlink: 'syz.3.2420': attribute type 5 has an invalid length. [ 911.754497][ T5908] pwc: recv_control_msg error -71 req 02 val 2800 [ 911.779111][ T5908] pwc: recv_control_msg error -71 req 04 val 1100 [ 911.794145][ T5908] pwc: recv_control_msg error -71 req 04 val 1200 [ 911.818340][ T5908] pwc: Registered as video103. [ 911.826629][ T5908] input: PWC snapshot button as /devices/platform/dummy_hcd.5/usb6/6-1/input/input130 [ 911.921772][ T5908] usb 6-1: USB disconnect, device number 31 [ 912.301826][T15899] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2424'. [ 912.574868][T14115] usb 5-1: USB disconnect, device number 71 [ 913.844061][T15921] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 913.860406][T15921] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 913.921697][T15921] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 913.990682][T15921] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 914.081376][ T5953] usb 3-1: new high-speed USB device number 82 using dummy_hcd [ 917.388026][T15956] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2438'. [ 918.195939][T14115] usb 2-1: new high-speed USB device number 85 using dummy_hcd [ 918.435842][T14115] usb 2-1: Using ep0 maxpacket: 32 [ 918.451560][T14115] usb 2-1: New USB device found, idVendor=041e, idProduct=403c, bcdDevice=cc.d7 [ 918.505947][T14115] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 918.521713][T14115] usb 2-1: config 0 descriptor?? [ 918.547308][T14115] gspca_main: sq930x-2.14.0 probing 041e:403c [ 918.763313][T15976] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 918.937227][T15976] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 919.095669][T14115] gspca_sq930x: reg_r 001f failed -32 [ 919.196115][T14115] sq930x 2-1:0.0: probe with driver sq930x failed with error -32 [ 919.755578][T14115] usb 4-1: new high-speed USB device number 83 using dummy_hcd [ 919.926165][T14115] usb 4-1: Using ep0 maxpacket: 8 [ 919.933853][T14115] usb 4-1: config 179 has an invalid interface number: 65 but max is 0 [ 919.948572][T14115] usb 4-1: config 179 has no interface number 0 [ 919.967306][T14115] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 919.994503][T14115] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 920.066037][T14115] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 920.084721][T14115] usb 4-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 920.118579][T14115] usb 4-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 920.138753][T14115] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 920.168207][T16008] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 920.414860][T14115] usb 4-1: USB disconnect, device number 83 [ 920.849646][T16018] netlink: 28 bytes leftover after parsing attributes in process `syz.5.2449'. [ 920.872606][ T9] usb 2-1: USB disconnect, device number 85 [ 921.695539][ T5953] usb 2-1: new high-speed USB device number 86 using dummy_hcd [ 921.780171][T16041] netlink: 19 bytes leftover after parsing attributes in process `syz.3.2454'. [ 921.855545][ T5953] usb 2-1: Using ep0 maxpacket: 16 [ 921.864753][ T5953] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 921.926329][ T5953] usb 2-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 921.939927][ T5953] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 921.956011][ T5953] usb 2-1: config 0 descriptor?? [ 922.385116][ T5953] mcp2221 0003:04D8:00DD.0020: USB HID v0.05 Device [HID 04d8:00dd] on usb-dummy_hcd.1-1/input0 [ 922.803014][ T5908] usb 2-1: USB disconnect, device number 86 [ 923.566465][T16065] netlink: 264 bytes leftover after parsing attributes in process `syz.2.2459'. [ 925.055646][ T5908] usb 3-1: new high-speed USB device number 83 using dummy_hcd [ 925.102199][T14115] usb 6-1: new full-speed USB device number 32 using dummy_hcd [ 925.125284][T16088] openvswitch: netlink: Flow key attr not present in new flow. [ 925.206686][ T5908] usb 3-1: Using ep0 maxpacket: 32 [ 925.221703][ T5908] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 925.242767][ T5908] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 925.274054][T14115] usb 6-1: config 0 has an invalid interface number: 128 but max is 0 [ 925.290724][T14115] usb 6-1: config 0 has no interface number 0 [ 925.305052][ T5908] usb 3-1: New USB device found, idVendor=07ca, idProduct=b800, bcdDevice=9b.26 [ 925.336650][T14115] usb 6-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 925.351771][ T5908] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 925.366440][T14115] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 925.374625][T14115] usb 6-1: Product: syz [ 925.381015][ T5908] usb 3-1: Product: syz [ 925.389986][T14115] usb 6-1: Manufacturer: syz [ 925.394739][ T5908] usb 3-1: Manufacturer: syz [ 925.400261][T14115] usb 6-1: SerialNumber: syz [ 925.405139][ T5908] usb 3-1: SerialNumber: syz [ 925.417259][T14115] usb 6-1: config 0 descriptor?? [ 925.432784][ T5908] usb 3-1: config 0 descriptor?? [ 925.550113][T16098] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2472'. [ 925.756042][ T5953] usb 3-1: USB disconnect, device number 83 [ 926.000716][T14115] usb 6-1: Firmware version (0.0) predates our first public release. [ 926.026410][T14115] usb 6-1: Please update to version 0.2 or newer [ 926.154480][T16111] FAULT_INJECTION: forcing a failure. [ 926.154480][T16111] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 926.176865][T16111] CPU: 1 UID: 0 PID: 16111 Comm: syz.1.2474 Tainted: G L syzkaller #0 PREEMPT(full) [ 926.176894][T16111] Tainted: [L]=SOFTLOCKUP [ 926.176899][T16111] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 926.176906][T16111] Call Trace: [ 926.176913][T16111] [ 926.176919][T16111] dump_stack_lvl+0xe8/0x150 [ 926.176946][T16111] should_fail_ex+0x412/0x560 [ 926.176963][T16111] _copy_to_user+0x31/0xb0 [ 926.176981][T16111] simple_read_from_buffer+0xe1/0x170 [ 926.177000][T16111] proc_fail_nth_read+0x1bb/0x230 [ 926.177019][T16111] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 926.177036][T16111] ? rw_verify_area+0x2a6/0x4d0 [ 926.177048][T16111] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 926.177063][T16111] vfs_read+0x20c/0xa70 [ 926.177074][T16111] ? __fget_files+0x2a/0x420 [ 926.177089][T16111] ? fdget_pos+0x246/0x320 [ 926.177106][T16111] ? __pfx___mutex_lock+0x10/0x10 [ 926.177119][T16111] ? __pfx_vfs_read+0x10/0x10 [ 926.177131][T16111] ? __fget_files+0x2a/0x420 [ 926.177149][T16111] ? __fget_files+0x3a0/0x420 [ 926.177163][T16111] ? __fget_files+0x2a/0x420 [ 926.177183][T16111] ksys_read+0x150/0x270 [ 926.177196][T16111] ? __pfx_ksys_read+0x10/0x10 [ 926.177210][T16111] ? asm_int80_emulation+0x1a/0x20 [ 926.177225][T16111] do_int80_emulation+0x173/0x4d0 [ 926.177238][T16111] ? asm_int80_emulation+0x1a/0x20 [ 926.177248][T16111] ? clear_bhb_loop+0x40/0x90 [ 926.177262][T16111] ? clear_bhb_loop+0x40/0x90 [ 926.177276][T16111] asm_int80_emulation+0x1a/0x20 [ 926.177291][T16111] RIP: 0023:0xf71a5cab [ 926.177304][T16111] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 926.177314][T16111] RSP: 002b:00000000f545d4bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 926.177329][T16111] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000f545d5d0 [ 926.177338][T16111] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 926.177345][T16111] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 926.177352][T16111] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 926.177359][T16111] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 926.177377][T16111] [ 926.527631][T14115] usb 6-1: USB disconnect, device number 32 [ 928.203707][T16136] netlink: 'syz.5.2481': attribute type 10 has an invalid length. [ 928.526487][ T5953] usb 2-1: new high-speed USB device number 87 using dummy_hcd [ 928.708211][ T5953] usb 2-1: Using ep0 maxpacket: 16 [ 928.721185][ T5953] usb 2-1: unable to get BOS descriptor or descriptor too short [ 928.762539][ T5953] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 928.845477][ T5953] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 928.934616][ T5953] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x82 has invalid wMaxPacketSize 0 [ 929.114716][ T5953] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 0 [ 929.390116][ T5953] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 929.430452][ T5953] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 0 [ 929.490364][ T5953] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 929.504146][ T5953] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 929.522378][ T5953] usb 2-1: Product: syz [ 929.542092][ T5953] usb 2-1: SerialNumber: syz [ 929.791476][T16132] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 929.800437][T16132] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 929.836983][T14115] usb 3-1: new high-speed USB device number 84 using dummy_hcd [ 929.943980][ T5953] cdc_ncm 2-1:1.0: bind() failure [ 929.977419][ T5953] cdc_ncm 2-1:1.1: CDC Union missing and no IAD found [ 929.984506][ T5953] cdc_ncm 2-1:1.1: bind() failure [ 930.039083][ T5953] usb 2-1: USB disconnect, device number 87 [ 930.105726][T14115] usb 3-1: Using ep0 maxpacket: 8 [ 930.125071][T14115] usb 3-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 930.145818][T14115] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 930.172035][T14115] usb 3-1: Product: syz [ 930.180538][T14115] usb 3-1: Manufacturer: syz [ 930.185282][T14115] usb 3-1: SerialNumber: syz [ 930.199576][T14115] usb 3-1: config 0 descriptor?? [ 930.316251][ T5908] usb 4-1: new high-speed USB device number 84 using dummy_hcd [ 930.339434][T16166] syzkaller0: mtu greater than device maximum [ 930.411909][T14115] usb 3-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 930.468765][ T5908] usb 4-1: Using ep0 maxpacket: 16 [ 930.481468][ T5908] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 930.492797][ T5908] usb 4-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 930.502032][ T5908] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 930.512757][ T5908] usb 4-1: config 0 descriptor?? [ 930.605530][ T1216] usb 6-1: new high-speed USB device number 33 using dummy_hcd [ 930.802942][ T1216] usb 6-1: Using ep0 maxpacket: 8 [ 930.811031][ T1216] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 930.824370][ T1216] usb 6-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 930.848397][ T1216] usb 6-1: New USB device found, idVendor=16d0, idProduct=10a9, bcdDevice=30.52 [ 930.858303][ T1216] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 930.890370][ T1216] usb 6-1: Product: syz [ 930.895278][ T1216] usb 6-1: Manufacturer: syz [ 930.903445][ T1216] usb 6-1: SerialNumber: syz [ 930.921528][ T1216] usb 6-1: config 0 descriptor?? [ 930.954535][ T5908] mcp2221 0003:04D8:00DD.0021: USB HID v0.05 Device [HID 04d8:00dd] on usb-dummy_hcd.3-1/input0 [ 931.361229][ T5908] usb 4-1: USB disconnect, device number 84 [ 931.660230][T14115] dvb_usb_rtl28xxu 3-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 931.680035][T14115] usb 3-1: USB disconnect, device number 84 [ 931.680204][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 931.704319][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 932.049571][T16182] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2495'. [ 933.156154][T14115] usb 6-1: USB disconnect, device number 33 [ 934.995140][T16211] netlink: 'syz.3.2501': attribute type 5 has an invalid length. [ 935.895852][ T5908] usb 6-1: new high-speed USB device number 34 using dummy_hcd [ 936.166789][ T5908] usb 6-1: Using ep0 maxpacket: 16 [ 936.176844][ T5908] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 936.195668][ T5908] usb 6-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 936.239159][ T5908] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 936.271328][ T5908] usb 6-1: config 0 descriptor?? [ 936.704008][ T5908] mcp2221 0003:04D8:00DD.0022: USB HID v0.05 Device [HID 04d8:00dd] on usb-dummy_hcd.5-1/input0 [ 937.157125][ T5908] usb 6-1: USB disconnect, device number 34 [ 938.213246][T16288] xt_AUDIT: Audit type out of range (valid range: 0..2) [ 938.915560][ T5908] usb 4-1: new high-speed USB device number 85 using dummy_hcd [ 939.165951][ T5908] usb 4-1: Using ep0 maxpacket: 8 [ 939.235290][ T5908] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 939.272349][ T5908] usb 4-1: New USB device found, idVendor=05ac, idProduct=8501, bcdDevice=20.9d [ 939.370510][ T5908] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=105 [ 939.397393][ T5908] usb 4-1: SerialNumber: syz [ 939.434249][ T5908] usb 4-1: config 0 descriptor?? [ 939.482030][ T5908] uvcvideo 4-1:0.0: Found UVC 0.00 device (05ac:8501) [ 939.501412][ T5908] uvcvideo 4-1:0.0: No valid video chain found. [ 940.555767][ T5953] usb 3-1: new high-speed USB device number 85 using dummy_hcd [ 940.707721][T16334] F2FS-fs: Conflicting test_dummy_encryption options [ 940.718126][ T5953] usb 3-1: Using ep0 maxpacket: 16 [ 940.745293][ T5953] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 940.818871][ T5953] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 940.934013][ T5953] usb 3-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 940.954815][ T5953] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 940.982437][ T5953] usb 3-1: Product: syz [ 940.994483][ T5953] usb 3-1: Manufacturer: syz [ 941.117006][ T5953] usb 3-1: SerialNumber: syz [ 941.314997][ T5953] r8152-cfgselector 3-1: Unknown version 0x0000 [ 941.322868][ T5953] r8152-cfgselector 3-1: config 0 descriptor?? [ 941.580748][ T5812] usb 4-1: USB disconnect, device number 85 [ 941.882126][T16354] syzkaller0: entered promiscuous mode [ 942.894523][T16386] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2533'. [ 943.430869][T14115] r8152-cfgselector 3-1: USB disconnect, device number 85 [ 945.320220][ T1216] usb 4-1: new high-speed USB device number 86 using dummy_hcd [ 945.488055][ T1216] usb 4-1: config 1 has an invalid interface number: 7 but max is 0 [ 945.505939][ T1216] usb 4-1: config 1 has no interface number 0 [ 945.516269][ T1216] usb 4-1: config 1 interface 7 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 8 [ 945.542434][ T1216] usb 4-1: config 1 interface 7 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 1023 [ 945.639961][ T1216] usb 4-1: New USB device found, idVendor=1199, idProduct=68a3, bcdDevice= 0.00 [ 945.663291][ T1216] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 945.691095][ T1216] usb 4-1: Product: syz [ 945.709416][ T1216] usb 4-1: Manufacturer: syz [ 945.724642][ T1216] usb 4-1: SerialNumber: syz [ 945.730498][T16437] FAULT_INJECTION: forcing a failure. [ 945.730498][T16437] name failslab, interval 1, probability 0, space 0, times 0 [ 945.759077][T16429] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 945.841886][T16437] CPU: 1 UID: 0 PID: 16437 Comm: syz.2.2543 Tainted: G L syzkaller #0 PREEMPT(full) [ 945.841921][T16437] Tainted: [L]=SOFTLOCKUP [ 945.841929][T16437] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 945.841940][T16437] Call Trace: [ 945.841949][T16437] [ 945.841958][T16437] dump_stack_lvl+0xe8/0x150 [ 945.841998][T16437] should_fail_ex+0x412/0x560 [ 945.842028][T16437] should_failslab+0xa8/0x100 [ 945.842051][T16437] ? security_inode_alloc+0x39/0x310 [ 945.842074][T16437] kmem_cache_alloc_noprof+0x87/0x650 [ 945.842099][T16437] security_inode_alloc+0x39/0x310 [ 945.842125][T16437] inode_init_always_gfp+0x9ed/0xdc0 [ 945.842156][T16437] ? __pfx_sock_alloc_inode+0x10/0x10 [ 945.842175][T16437] alloc_inode+0x82/0x1b0 [ 945.842198][T16437] do_accept+0x13e/0x760 [ 945.842226][T16437] ? __pfx_do_accept+0x10/0x10 [ 945.842271][T16437] __sys_accept4+0x139/0x230 [ 945.842298][T16437] ? __pfx___sys_accept4+0x10/0x10 [ 945.842322][T16437] ? ksys_write+0x1fc/0x270 [ 945.842350][T16437] __ia32_sys_accept4+0x9a/0xb0 [ 945.842378][T16437] __do_fast_syscall_32+0x20d/0x640 [ 945.842400][T16437] ? do_fast_syscall_32+0x33/0x70 [ 945.842418][T16437] ? asm_int80_emulation+0x1a/0x20 [ 945.842436][T16437] ? do_int80_emulation+0x274/0x4d0 [ 945.842453][T16437] ? trace_irq_disable+0x3b/0x150 [ 945.842614][T16437] do_fast_syscall_32+0x33/0x70 [ 945.842634][T16437] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 945.842654][T16437] RIP: 0023:0xf704ef6c [ 945.842672][T16437] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 58 b8 77 00 00 00 cd 80 0f 0b 90 90 90 90 90 90 b8 ad [ 945.842687][T16437] RSP: 002b:00000000f543d50c EFLAGS: 00000206 ORIG_RAX: 000000000000016c [ 945.842710][T16437] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000000000 [ 945.842721][T16437] RDX: 0000000000000000 RSI: 0000000000080800 RDI: 0000000000000000 [ 945.842731][T16437] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 945.842739][T16437] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 945.842748][T16437] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 945.842774][T16437] [ 946.086147][T16429] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 946.208680][ T1216] usb 4-1: Error in usbnet_get_endpoints (-22) [ 946.294983][T16427] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 946.320371][T16427] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 946.412435][ T1216] usb 4-1: USB disconnect, device number 86 [ 946.515795][ T9] usb 3-1: new high-speed USB device number 86 using dummy_hcd [ 946.675517][ T9] usb 3-1: Using ep0 maxpacket: 16 [ 946.686897][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 946.704353][ T9] usb 3-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 946.721935][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 946.760456][ T9] usb 3-1: config 0 descriptor?? [ 946.925534][ T1216] usb 2-1: new high-speed USB device number 88 using dummy_hcd [ 947.088913][ T1216] usb 2-1: Using ep0 maxpacket: 16 [ 947.112752][ T1216] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 947.135298][ T1216] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 947.174753][ T9] mcp2221 0003:04D8:00DD.0023: USB HID v0.05 Device [HID 04d8:00dd] on usb-dummy_hcd.2-1/input0 [ 947.261114][ T1216] usb 2-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 947.280875][ T1216] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 947.311452][ T1216] usb 2-1: Product: syz [ 947.331946][ T1216] usb 2-1: Manufacturer: syz [ 947.339633][ T1216] usb 2-1: SerialNumber: syz [ 947.361850][ T1216] r8152-cfgselector 2-1: Unknown version 0x0000 [ 947.369301][ T1216] r8152-cfgselector 2-1: config 0 descriptor?? [ 947.677469][ T1216] usb 3-1: USB disconnect, device number 86 [ 947.986456][ T5908] usb 4-1: new high-speed USB device number 87 using dummy_hcd [ 948.151001][ T5908] usb 4-1: Using ep0 maxpacket: 8 [ 948.160011][ T5908] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 948.183929][ T5908] usb 4-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 948.251759][ T5908] usb 4-1: New USB device found, idVendor=16d0, idProduct=10a9, bcdDevice=30.52 [ 948.277517][ T5908] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 948.324325][ T5908] usb 4-1: Product: syz [ 948.342168][ T5908] usb 4-1: Manufacturer: syz [ 948.353295][ T5908] usb 4-1: SerialNumber: syz [ 948.364987][ T5908] usb 4-1: config 0 descriptor?? [ 949.038781][T16488] netlink: 28 bytes leftover after parsing attributes in process `syz.5.2556'. [ 949.454427][ T5908] r8152-cfgselector 2-1: USB disconnect, device number 88 [ 950.758210][ T5953] usb 4-1: USB disconnect, device number 87 [ 951.085555][ T1216] usb 5-1: new high-speed USB device number 72 using dummy_hcd [ 951.251494][ T1216] usb 5-1: Using ep0 maxpacket: 16 [ 951.261509][ T1216] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 951.274248][ T1216] usb 5-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 951.283995][ T1216] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 951.296410][ T1216] usb 5-1: config 0 descriptor?? [ 951.738994][ T1216] mcp2221 0003:04D8:00DD.0024: USB HID v0.05 Device [HID 04d8:00dd] on usb-dummy_hcd.4-1/input0 [ 952.161397][ T9] usb 5-1: USB disconnect, device number 72 [ 952.507374][ T5953] usb 3-1: new high-speed USB device number 87 using dummy_hcd [ 952.680652][ T5953] usb 3-1: config 0 has an invalid interface number: 50 but max is 0 [ 952.689046][ T5953] usb 3-1: config 0 has no interface number 0 [ 952.705650][ T5953] usb 3-1: config 0 interface 50 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 952.739097][ T5953] usb 3-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=e6.fc [ 952.759273][ T5953] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 952.768877][ T5953] usb 3-1: Product: syz [ 952.784765][ T5953] usb 3-1: Manufacturer: syz [ 952.790169][ T5953] usb 3-1: SerialNumber: syz [ 952.804624][ T5953] usb 3-1: config 0 descriptor?? [ 952.840422][ T5953] yurex 3-1:0.50: USB YUREX device now attached to Yurex #0 [ 953.265971][ T1216] usb 3-1: USB disconnect, device number 87 [ 953.280082][ T1216] yurex 3-1:0.50: USB YUREX #0 now disconnected [ 954.425489][ T5953] usb 3-1: new high-speed USB device number 88 using dummy_hcd [ 954.598869][ T5953] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 954.610164][ T5953] usb 3-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 954.621235][ T5953] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 954.638941][ T5953] usb 3-1: config 0 descriptor?? [ 954.662716][ T5953] pwc: Askey VC010 type 2 USB webcam detected. [ 955.073759][ T5953] pwc: recv_control_msg error -32 req 02 val 2b00 [ 955.084312][ T5953] pwc: recv_control_msg error -32 req 02 val 2700 [ 955.093523][ T5953] pwc: recv_control_msg error -32 req 02 val 2c00 [ 955.094691][ T5953] pwc: recv_control_msg error -32 req 04 val 1000 [ 955.096080][ T5953] pwc: recv_control_msg error -32 req 04 val 1300 [ 955.097325][ T5953] pwc: recv_control_msg error -32 req 04 val 1400 [ 955.203003][ T5953] pwc: recv_control_msg error -32 req 02 val 2000 [ 956.001185][T16598] syzkaller0: entered promiscuous mode [ 956.336007][T16608] netlink: 'syz.3.2581': attribute type 10 has an invalid length. [ 957.428532][T16614] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2583'. [ 957.602876][T16614] team_slave_0: entered promiscuous mode [ 957.607908][T16616] FAULT_INJECTION: forcing a failure. [ 957.607908][T16616] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 957.608986][T16614] team_slave_1: entered promiscuous mode [ 957.624432][T16616] CPU: 0 UID: 0 PID: 16616 Comm: syz.3.2584 Tainted: G L syzkaller #0 PREEMPT(full) [ 957.624466][T16616] Tainted: [L]=SOFTLOCKUP [ 957.624472][T16616] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 957.624483][T16616] Call Trace: [ 957.624490][T16616] [ 957.624498][T16616] dump_stack_lvl+0xe8/0x150 [ 957.624528][T16616] should_fail_ex+0x412/0x560 [ 957.624555][T16616] _copy_from_user+0x2d/0xb0 [ 957.624579][T16616] get_compat_msghdr+0xb3/0x4c0 [ 957.624611][T16616] ? kstrtoull+0x12f/0x1d0 [ 957.624634][T16616] ? __pfx_get_compat_msghdr+0x10/0x10 [ 957.624668][T16616] ___sys_recvmsg+0x1dd/0x590 [ 957.624693][T16616] ? get_pid_task+0x20/0x1f0 [ 957.624712][T16616] ? __pfx____sys_recvmsg+0x10/0x10 [ 957.624759][T16616] ? __fget_files+0x3a0/0x420 [ 957.624791][T16616] __sys_recvmsg+0x180/0x250 [ 957.624817][T16616] ? __pfx___sys_recvmsg+0x10/0x10 [ 957.624861][T16616] __do_fast_syscall_32+0x20d/0x640 [ 957.624880][T16616] ? do_fast_syscall_32+0x33/0x70 [ 957.624896][T16616] ? asm_int80_emulation+0x1a/0x20 [ 957.624913][T16616] ? do_int80_emulation+0x274/0x4d0 [ 957.624933][T16616] do_fast_syscall_32+0x33/0x70 [ 957.624951][T16616] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 957.624970][T16616] RIP: 0023:0xf7fc5f6c [ 957.624987][T16616] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 58 b8 77 00 00 00 cd 80 0f 0b 90 90 90 90 90 90 b8 ad [ 957.625001][T16616] RSP: 002b:00000000f548650c EFLAGS: 00000206 ORIG_RAX: 0000000000000174 [ 957.625020][T16616] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000800001c0 [ 957.625033][T16616] RDX: 0000000000010141 RSI: 0000000000000000 RDI: 0000000000000000 [ 957.625044][T16616] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 957.625053][T16616] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 957.625064][T16616] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 957.625090][T16616] [ 957.837585][T16614] 8021q: adding VLAN 0 to HW filter on device macvtap1 [ 957.854007][T16614] team_slave_0: left promiscuous mode [ 957.859695][T16614] team_slave_1: left promiscuous mode [ 958.575506][ C0] hrtimer: interrupt took 154141 ns [ 958.690316][ T5953] pwc: recv_control_msg error -71 req 02 val 2100 [ 958.709779][ T5953] pwc: recv_control_msg error -71 req 04 val 1500 [ 958.732448][ T5953] pwc: recv_control_msg error -71 req 02 val 2500 [ 958.747434][ T5953] pwc: recv_control_msg error -71 req 02 val 2400 [ 958.764513][ T5953] pwc: recv_control_msg error -71 req 02 val 2600 [ 958.798212][ T5953] pwc: recv_control_msg error -71 req 02 val 2900 [ 958.806709][ T5953] pwc: recv_control_msg error -71 req 02 val 2800 [ 958.815011][ T5953] pwc: recv_control_msg error -71 req 04 val 1100 [ 958.828493][ T5953] pwc: recv_control_msg error -71 req 04 val 1200 [ 958.893394][ T5953] pwc: Registered as video103. [ 959.021246][ T5953] input: PWC snapshot button as /devices/platform/dummy_hcd.2/usb3/3-1/input/input131 [ 959.085488][ T9] usb 4-1: new high-speed USB device number 88 using dummy_hcd [ 959.221562][ T5953] usb 3-1: USB disconnect, device number 88 [ 959.306325][ T9] usb 4-1: Using ep0 maxpacket: 16 [ 959.325587][ T9] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 959.348186][ T9] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 959.480478][ T9] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 959.490629][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 959.531413][ T9] usb 4-1: Product: syz [ 959.549970][ T9] usb 4-1: Manufacturer: syz [ 959.559413][ T9] usb 4-1: SerialNumber: syz [ 959.804213][ T9] usb 4-1: 0:2 : does not exist [ 959.832046][ T9] usb 4-1: 5:0: failed to get current value for ch 0 (-22) [ 960.064381][ T9] usb 4-1: USB disconnect, device number 88 [ 960.194662][T16664] syzkaller0: entered promiscuous mode [ 960.198542][T13489] udevd[13489]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 960.732751][T16664] syzkaller0: entered allmulticast mode [ 961.180034][T16672] FAULT_INJECTION: forcing a failure. [ 961.180034][T16672] name failslab, interval 1, probability 0, space 0, times 0 [ 961.227772][T16672] CPU: 0 UID: 0 PID: 16672 Comm: syz.3.2598 Tainted: G L syzkaller #0 PREEMPT(full) [ 961.227807][T16672] Tainted: [L]=SOFTLOCKUP [ 961.227814][T16672] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 961.227826][T16672] Call Trace: [ 961.227835][T16672] [ 961.227843][T16672] dump_stack_lvl+0xe8/0x150 [ 961.227876][T16672] should_fail_ex+0x412/0x560 [ 961.227907][T16672] should_failslab+0xa8/0x100 [ 961.227933][T16672] __kmalloc_cache_noprof+0x88/0x660 [ 961.227956][T16672] ? nft_delchain+0x54/0x4b0 [ 961.227982][T16672] nft_delchain+0x54/0x4b0 [ 961.228007][T16672] nf_tables_delchain+0xd4f/0x1060 [ 961.228052][T16672] ? __pfx_nf_tables_delchain+0x10/0x10 [ 961.228093][T16672] ? __nla_parse+0x40/0x60 [ 961.228124][T16672] nfnetlink_rcv+0x1240/0x27b0 [ 961.228183][T16672] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 961.228222][T16672] ? ref_tracker_free+0x693/0x840 [ 961.228275][T16672] ? __netlink_deliver_tap+0x807/0x850 [ 961.228300][T16672] ? netlink_deliver_tap+0x2e/0x1b0 [ 961.228354][T16672] netlink_unicast+0x80f/0x9b0 [ 961.228386][T16672] ? __pfx_netlink_unicast+0x10/0x10 [ 961.228410][T16672] ? netlink_sendmsg+0x650/0xb40 [ 961.228431][T16672] ? skb_put+0x11b/0x210 [ 961.228462][T16672] netlink_sendmsg+0x813/0xb40 [ 961.228493][T16672] ? __pfx_netlink_sendmsg+0x10/0x10 [ 961.228520][T16672] ? aa_sock_msg_perm+0xf1/0x1b0 [ 961.228546][T16672] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 961.228570][T16672] ? __pfx_netlink_sendmsg+0x10/0x10 [ 961.228591][T16672] ____sys_sendmsg+0xa68/0xad0 [ 961.228630][T16672] ? __pfx_____sys_sendmsg+0x10/0x10 [ 961.228663][T16672] ? kstrtoull+0x12f/0x1d0 [ 961.228694][T16672] ___sys_sendmsg+0x2a5/0x360 [ 961.228728][T16672] ? __pfx____sys_sendmsg+0x10/0x10 [ 961.228758][T16672] ? get_pid_task+0x20/0x1f0 [ 961.228777][T16672] ? get_pid_task+0x20/0x1f0 [ 961.228793][T16672] ? get_pid_task+0x20/0x1f0 [ 961.228840][T16672] ? __fget_files+0x2a/0x420 [ 961.228866][T16672] ? __fget_files+0x3a0/0x420 [ 961.228903][T16672] __sys_sendmsg+0x183/0x260 [ 961.228935][T16672] ? __pfx___sys_sendmsg+0x10/0x10 [ 961.228987][T16672] __do_fast_syscall_32+0x20d/0x640 [ 961.229010][T16672] ? do_fast_syscall_32+0x33/0x70 [ 961.229029][T16672] ? asm_int80_emulation+0x1a/0x20 [ 961.229046][T16672] ? do_int80_emulation+0x274/0x4d0 [ 961.229064][T16672] ? trace_irq_disable+0x3b/0x150 [ 961.229093][T16672] do_fast_syscall_32+0x33/0x70 [ 961.229113][T16672] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 961.229136][T16672] RIP: 0023:0xf7fc5f6c [ 961.229157][T16672] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 58 b8 77 00 00 00 cd 80 0f 0b 90 90 90 90 90 90 b8 ad [ 961.229175][T16672] RSP: 002b:00000000f548650c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 961.229203][T16672] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000080 [ 961.229217][T16672] RDX: 0000000000000800 RSI: 0000000000000000 RDI: 0000000000000000 [ 961.229229][T16672] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 961.229241][T16672] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 961.229252][T16672] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 961.229284][T16672] [ 961.296172][ T5927] usb 6-1: new high-speed USB device number 35 using dummy_hcd [ 961.835895][ T5927] usb 6-1: Using ep0 maxpacket: 32 [ 961.844080][ T5927] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 961.855116][ T5927] usb 6-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 961.913250][ T5927] usb 6-1: New USB device found, idVendor=07ca, idProduct=b800, bcdDevice=9b.26 [ 961.930462][ T5927] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 961.945105][ T9] usb 3-1: new high-speed USB device number 89 using dummy_hcd [ 961.945864][ T5927] usb 6-1: Product: syz [ 962.078776][ T5927] usb 6-1: Manufacturer: syz [ 962.090874][ T5927] usb 6-1: SerialNumber: syz [ 962.110841][ T5927] usb 6-1: config 0 descriptor?? [ 962.377979][ T9] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 962.394459][ T5953] usb 6-1: USB disconnect, device number 35 [ 962.407955][ T9] usb 3-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 962.451011][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 962.479999][ T9] usb 3-1: config 0 descriptor?? [ 962.501899][ T9] pwc: Askey VC010 type 2 USB webcam detected. [ 962.894504][ T9] pwc: recv_control_msg error -32 req 02 val 2b00 [ 962.914419][ T9] pwc: recv_control_msg error -32 req 02 val 2700 [ 962.930591][ T9] pwc: recv_control_msg error -32 req 02 val 2c00 [ 962.950557][ T9] pwc: recv_control_msg error -32 req 04 val 1000 [ 962.966873][ T9] pwc: recv_control_msg error -32 req 04 val 1300 [ 962.983905][ T9] pwc: recv_control_msg error -32 req 04 val 1400 [ 963.056441][ T9] pwc: recv_control_msg error -32 req 02 val 2000 [ 963.084062][T16703] netlink: 40 bytes leftover after parsing attributes in process `syz.5.2609'. [ 963.532471][ T5927] usb 6-1: new high-speed USB device number 36 using dummy_hcd [ 963.731516][ T5927] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 963.773190][ T5927] usb 6-1: config 1 has no interface number 0 [ 963.786336][ T5927] usb 6-1: config 1 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 963.809618][ T5927] usb 6-1: Duplicate descriptor for config 1 interface 1 altsetting 0, skipping [ 963.828638][ T5927] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 963.854937][ T5927] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 963.864548][ T5927] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 963.873909][ T5927] usb 6-1: Product: syz [ 963.896351][ T5927] usb 6-1: Manufacturer: syz [ 963.911963][ T5927] usb 6-1: SerialNumber: syz [ 964.959490][ T5927] cdc_ncm 6-1:1.1: bind() failure [ 965.177817][ T5953] usb 6-1: USB disconnect, device number 36 [ 965.495937][ T5927] usb 4-1: new full-speed USB device number 89 using dummy_hcd [ 965.657630][ T5927] usb 4-1: New USB device found, idVendor=055d, idProduct=9000, bcdDevice=31.44 [ 965.667069][ T5927] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 965.678415][ T5927] usb 4-1: config 0 descriptor?? [ 965.688209][ T5927] pwc: Samsung MPC-C10 USB webcam detected. [ 965.854846][T16746] FAULT_INJECTION: forcing a failure. [ 965.854846][T16746] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 965.868469][T16746] CPU: 0 UID: 0 PID: 16746 Comm: syz.1.2621 Tainted: G L syzkaller #0 PREEMPT(full) [ 965.868499][T16746] Tainted: [L]=SOFTLOCKUP [ 965.868507][T16746] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 965.868517][T16746] Call Trace: [ 965.868526][T16746] [ 965.868535][T16746] dump_stack_lvl+0xe8/0x150 [ 965.868567][T16746] should_fail_ex+0x412/0x560 [ 965.868600][T16746] _copy_from_user+0x2d/0xb0 [ 965.868627][T16746] kstrtouint_from_user+0xd6/0x180 [ 965.868662][T16746] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 965.868702][T16746] proc_fail_nth_write+0x8e/0x210 [ 965.868729][T16746] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 965.868759][T16746] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 965.868786][T16746] vfs_write+0x29a/0xb90 [ 965.868815][T16746] ? __pfx_vfs_write+0x10/0x10 [ 965.868838][T16746] ? __fget_files+0x2a/0x420 [ 965.868870][T16746] ? __fget_files+0x3a0/0x420 [ 965.868895][T16746] ? __fget_files+0x2a/0x420 [ 965.868932][T16746] ksys_write+0x150/0x270 [ 965.868955][T16746] ? __pfx_ksys_write+0x10/0x10 [ 965.868981][T16746] ? asm_int80_emulation+0x1a/0x20 [ 965.869006][T16746] do_int80_emulation+0x173/0x4d0 [ 965.869026][T16746] ? trace_irq_disable+0x3b/0x150 [ 965.869052][T16746] ? asm_int80_emulation+0x1a/0x20 [ 965.869069][T16746] ? clear_bhb_loop+0x40/0x90 [ 965.869087][T16746] ? clear_bhb_loop+0x40/0x90 [ 965.869110][T16746] asm_int80_emulation+0x1a/0x20 [ 965.869129][T16746] RIP: 0023:0xf71a5cab [ 965.869148][T16746] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 965.869165][T16746] RSP: 002b:00000000f545d4bc EFLAGS: 00000246 ORIG_RAX: 0000000000000004 [ 965.869186][T16746] RAX: ffffffffffffffda RBX: 0000000000000008 RCX: 00000000f545d5d0 [ 965.869199][T16746] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 [ 965.869210][T16746] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 965.869222][T16746] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 965.869233][T16746] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 965.869264][T16746] [ 966.186649][ T9] pwc: recv_control_msg error -71 req 02 val 2100 [ 966.199940][ T5927] pwc: send_video_command error -71 [ 966.205288][ T5927] pwc: Failed to set video mode VGA@30 fps; return code = -71 [ 966.213850][ T9] pwc: recv_control_msg error -71 req 04 val 1500 [ 966.221089][ T9] pwc: recv_control_msg error -71 req 02 val 2500 [ 966.228606][ T9] pwc: recv_control_msg error -71 req 02 val 2400 [ 966.235761][ T9] pwc: recv_control_msg error -71 req 02 val 2600 [ 966.242901][ T9] pwc: recv_control_msg error -71 req 02 val 2900 [ 966.249922][ T9] pwc: recv_control_msg error -71 req 02 val 2800 [ 966.257898][ T9] pwc: recv_control_msg error -71 req 04 val 1100 [ 966.335776][ T9] pwc: recv_control_msg error -71 req 04 val 1200 [ 966.344420][ T9] pwc: Registered as video103. [ 966.354254][ T9] input: PWC snapshot button as /devices/platform/dummy_hcd.2/usb3/3-1/input/input132 [ 966.398533][ T5927] Philips webcam 4-1:0.0: probe with driver Philips webcam failed with error -71 [ 966.525681][ T5927] usb 4-1: USB disconnect, device number 89 [ 966.665213][ T9] usb 3-1: USB disconnect, device number 89 [ 967.015918][ T5927] usb 4-1: new high-speed USB device number 90 using dummy_hcd [ 967.257768][ T5927] usb 4-1: New USB device found, idVendor=055d, idProduct=9000, bcdDevice=31.44 [ 967.269363][ T5927] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 967.388128][ T5927] usb 4-1: config 0 descriptor?? [ 967.434779][ T5927] pwc: Samsung MPC-C10 USB webcam detected. [ 967.833423][ T5927] pwc: recv_control_msg error -71 req 02 val 2b00 [ 967.963951][ T5927] pwc: recv_control_msg error -71 req 02 val 2700 [ 967.972213][ T5927] pwc: recv_control_msg error -71 req 04 val 1700 [ 967.980206][ T5927] pwc: recv_control_msg error -71 req 02 val 2c00 [ 968.218406][ T5927] pwc: recv_control_msg error -71 req 04 val 1000 [ 968.226267][ T5927] pwc: recv_control_msg error -71 req 04 val 1300 [ 968.235035][ T5927] pwc: recv_control_msg error -71 req 04 val 1400 [ 968.242119][ T5927] pwc: recv_control_msg error -71 req 02 val 2000 [ 968.250505][ T5927] pwc: recv_control_msg error -71 req 02 val 2100 [ 968.263334][ T5927] pwc: recv_control_msg error -71 req 02 val 2200 [ 968.280825][ T5927] pwc: recv_control_msg error -71 req 06 val 0600 [ 968.300783][ T5927] pwc: recv_control_msg error -71 req 04 val 1500 [ 968.320629][ T5927] pwc: recv_control_msg error -71 req 02 val 2500 [ 968.328478][ T5927] pwc: recv_control_msg error -71 req 02 val 2400 [ 968.336456][ T5927] pwc: recv_control_msg error -71 req 02 val 2600 [ 968.364192][ T5927] pwc: recv_control_msg error -71 req 02 val 2900 [ 968.386571][ T5927] pwc: recv_control_msg error -71 req 02 val 2800 [ 968.406519][ T5927] pwc: recv_control_msg error -71 req 04 val 1100 [ 968.430845][ T5927] pwc: recv_control_msg error -71 req 04 val 1200 [ 968.454411][T16793] FAULT_INJECTION: forcing a failure. [ 968.454411][T16793] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 968.467852][ T5927] pwc: Registered as video103. [ 968.489078][ T5927] input: PWC snapshot button as /devices/platform/dummy_hcd.3/usb4/4-1/input/input133 [ 968.517667][T16793] CPU: 0 UID: 0 PID: 16793 Comm: syz.1.2632 Tainted: G L syzkaller #0 PREEMPT(full) [ 968.517699][T16793] Tainted: [L]=SOFTLOCKUP [ 968.517707][T16793] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 968.517718][T16793] Call Trace: [ 968.517727][T16793] [ 968.517736][T16793] dump_stack_lvl+0xe8/0x150 [ 968.517770][T16793] should_fail_ex+0x412/0x560 [ 968.517798][T16793] _copy_to_user+0x31/0xb0 [ 968.517827][T16793] drm_ioctl+0x6da/0xb80 [ 968.517858][T16793] ? __pfx_drm_mode_atomic_ioctl+0x10/0x10 [ 968.517883][T16793] ? __pfx_drm_ioctl+0x10/0x10 [ 968.517920][T16793] ? __fget_files+0x3a0/0x420 [ 968.517947][T16793] ? __fget_files+0x2a/0x420 [ 968.517971][T16793] ? drm_compat_ioctl+0xa7/0x330 [ 968.518002][T16793] ? bpf_lsm_file_ioctl_compat+0x9/0x20 [ 968.518030][T16793] __ia32_compat_sys_ioctl+0x5ea/0x950 [ 968.518057][T16793] ? __pfx___ia32_compat_sys_ioctl+0x10/0x10 [ 968.518083][T16793] ? __fget_files+0x3a0/0x420 [ 968.518117][T16793] ? fput+0xa0/0xd0 [ 968.518143][T16793] ? ksys_write+0x242/0x270 [ 968.518177][T16793] __do_fast_syscall_32+0x20d/0x640 [ 968.518199][T16793] ? do_fast_syscall_32+0x33/0x70 [ 968.518217][T16793] ? asm_int80_emulation+0x1a/0x20 [ 968.518235][T16793] ? do_int80_emulation+0x274/0x4d0 [ 968.518253][T16793] ? trace_irq_disable+0x3b/0x150 [ 968.518284][T16793] do_fast_syscall_32+0x33/0x70 [ 968.518305][T16793] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 968.518328][T16793] RIP: 0023:0xf706ef6c [ 968.518347][T16793] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 58 b8 77 00 00 00 cd 80 0f 0b 90 90 90 90 90 90 b8 ad [ 968.518364][T16793] RSP: 002b:00000000f545d50c EFLAGS: 00000206 ORIG_RAX: 0000000000000036 [ 968.518384][T16793] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000c03864bc [ 968.518398][T16793] RDX: 0000000080000180 RSI: 0000000000000000 RDI: 0000000000000000 [ 968.518410][T16793] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 968.518421][T16793] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 968.518433][T16793] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 968.518463][T16793] [ 968.744852][ T9] usb 6-1: new low-speed USB device number 37 using dummy_hcd [ 968.808509][ T5927] usb 4-1: USB disconnect, device number 90 [ 968.990163][ T9] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 969.000554][ T9] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8D is Bulk; changing to Interrupt [ 969.020806][ T9] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x5 is Bulk; changing to Interrupt [ 969.072621][ T9] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 969.136953][T16799] tipc: Enabling of bearer rejected, failed to enable media [ 969.165255][ T9] usb 6-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 969.184440][ T9] usb 6-1: New USB device found, idVendor=05ac, idProduct=8215, bcdDevice=8f.58 [ 969.196461][ T9] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 969.212223][ T9] usb 6-1: config 0 descriptor?? [ 969.224178][T16790] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 969.385729][ T5927] usb 4-1: new high-speed USB device number 91 using dummy_hcd [ 969.557811][ T5927] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 969.569557][ T5927] usb 4-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 969.581056][ T5927] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 969.595108][ T5927] usb 4-1: config 0 descriptor?? [ 969.618279][ T5927] pwc: Askey VC010 type 2 USB webcam detected. [ 970.014794][ T5927] pwc: recv_control_msg error -32 req 02 val 2b00 [ 970.029943][ T5927] pwc: recv_control_msg error -32 req 02 val 2700 [ 970.037575][ T5927] pwc: recv_control_msg error -32 req 02 val 2c00 [ 970.044703][ T5927] pwc: recv_control_msg error -32 req 04 val 1000 [ 970.052158][ T5927] pwc: recv_control_msg error -32 req 04 val 1300 [ 970.059799][ T5927] pwc: recv_control_msg error -32 req 04 val 1400 [ 970.139678][ T5927] pwc: recv_control_msg error -32 req 02 val 2000 [ 971.637435][ T9] usb 6-1: USB disconnect, device number 37 [ 971.848700][ T5927] pwc: recv_control_msg error -71 req 02 val 2100 [ 971.880471][ T5927] pwc: recv_control_msg error -71 req 04 val 1500 [ 971.908618][ T5927] pwc: recv_control_msg error -71 req 02 val 2500 [ 971.934981][ T5927] pwc: recv_control_msg error -71 req 02 val 2400 [ 971.943090][T16840] misc userio: The device must be registered before sending interrupts [ 972.034520][ T5927] pwc: recv_control_msg error -71 req 02 val 2600 [ 972.065260][T16844] netlink: 'syz.5.2642': attribute type 10 has an invalid length. [ 972.125544][ T5927] pwc: recv_control_msg error -71 req 02 val 2900 [ 972.142568][ T5927] pwc: recv_control_msg error -71 req 02 val 2800 [ 972.154263][ T5927] pwc: recv_control_msg error -71 req 04 val 1100 [ 972.161909][ T5927] pwc: recv_control_msg error -71 req 04 val 1200 [ 972.195814][ T9] usb 5-1: new full-speed USB device number 73 using dummy_hcd [ 972.202264][ T5927] pwc: Registered as video103. [ 972.220119][ T5927] input: PWC snapshot button as /devices/platform/dummy_hcd.3/usb4/4-1/input/input134 [ 972.264491][ T5927] usb 4-1: USB disconnect, device number 91 [ 972.365290][ T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 972.376657][ T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 972.411817][ T9] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 972.443181][ T9] usb 5-1: New USB device found, idVendor=0457, idProduct=07da, bcdDevice= 0.00 [ 972.455535][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 972.484820][ T9] usb 5-1: config 0 descriptor?? [ 972.937645][ T9] hid-multitouch 0003:0457:07DA.0025: unknown main item tag 0x0 [ 972.949196][ T9] hid-multitouch 0003:0457:07DA.0025: unknown main item tag 0x0 [ 973.003596][ T9] hid-multitouch 0003:0457:07DA.0025: unknown main item tag 0x0 [ 973.011485][ T9] hid-multitouch 0003:0457:07DA.0025: unknown main item tag 0x0 [ 973.032457][ T9] hid-multitouch 0003:0457:07DA.0025: unknown main item tag 0x0 [ 973.040969][ T9] hid-multitouch 0003:0457:07DA.0025: unknown main item tag 0x0 [ 973.056994][ T9] hid-multitouch 0003:0457:07DA.0025: unknown main item tag 0x0 [ 973.064981][ T9] hid-multitouch 0003:0457:07DA.0025: unknown main item tag 0x0 [ 973.081942][ T9] hid-multitouch 0003:0457:07DA.0025: unknown main item tag 0x0 [ 973.090306][ T9] hid-multitouch 0003:0457:07DA.0025: unknown main item tag 0x0 [ 973.212408][T16852] FAULT_INJECTION: forcing a failure. [ 973.212408][T16852] name failslab, interval 1, probability 0, space 0, times 0 [ 973.237929][ T9] hid-multitouch 0003:0457:07DA.0025: hidraw0: USB HID v0.00 Device [HID 0457:07da] on usb-dummy_hcd.4-1/input0 [ 973.270091][T16852] CPU: 1 UID: 0 PID: 16852 Comm: syz.1.2645 Tainted: G L syzkaller #0 PREEMPT(full) [ 973.270113][T16852] Tainted: [L]=SOFTLOCKUP [ 973.270119][T16852] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 973.270126][T16852] Call Trace: [ 973.270132][T16852] [ 973.270137][T16852] dump_stack_lvl+0xe8/0x150 [ 973.270159][T16852] should_fail_ex+0x412/0x560 [ 973.270178][T16852] should_failslab+0xa8/0x100 [ 973.270193][T16852] __kmalloc_cache_noprof+0x88/0x660 [ 973.270216][T16852] ? io_fsetxattr_prep+0x186/0x2b0 [ 973.270245][T16852] io_fsetxattr_prep+0x186/0x2b0 [ 973.270272][T16852] io_submit_sqes+0xb35/0x2370 [ 973.270310][T16852] __se_sys_io_uring_enter+0x2cc/0x18c0 [ 973.270337][T16852] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 973.270353][T16852] ? __fget_files+0x3a0/0x420 [ 973.270369][T16852] ? __pfx___se_sys_io_uring_enter+0x10/0x10 [ 973.270386][T16852] ? fput+0xa0/0xd0 [ 973.270402][T16852] ? ksys_write+0x242/0x270 [ 973.270417][T16852] ? __ia32_sys_io_uring_enter+0x21/0xf0 [ 973.270435][T16852] __do_fast_syscall_32+0x20d/0x640 [ 973.270448][T16852] ? do_fast_syscall_32+0x33/0x70 [ 973.270459][T16852] ? asm_int80_emulation+0x1a/0x20 [ 973.270470][T16852] ? do_int80_emulation+0x274/0x4d0 [ 973.270480][T16852] ? trace_irq_disable+0x3b/0x150 [ 973.270499][T16852] do_fast_syscall_32+0x33/0x70 [ 973.270511][T16852] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 973.270524][T16852] RIP: 0023:0xf706ef6c [ 973.270536][T16852] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 58 b8 77 00 00 00 cd 80 0f 0b 90 90 90 90 90 90 b8 ad [ 973.270546][T16852] RSP: 002b:00000000f545d50c EFLAGS: 00000206 ORIG_RAX: 00000000000001aa [ 973.270560][T16852] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000000047bc [ 973.270569][T16852] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 973.270575][T16852] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 973.270584][T16852] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 973.270592][T16852] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 973.270609][T16852] [ 973.540053][ T9] usb 5-1: USB disconnect, device number 73 [ 973.711143][T16854] fido_id[16854]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.4/usb5/report_descriptor': No such file or directory [ 975.259024][T16873] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2652'. [ 977.671627][T16893] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2657'. [ 978.058531][T16903] netlink: 64 bytes leftover after parsing attributes in process `syz.3.2659'. [ 980.732570][ C1] [ 980.734981][ C1] ============================= [ 980.739999][ C1] [ BUG: Invalid wait context ] [ 980.744855][ C1] syzkaller #0 Tainted: G L [ 980.750827][ C1] ----------------------------- [ 980.755673][ C1] kworker/u8:18/11489 is trying to lock: [ 980.761298][ C1] ffff88807ab792e0 (&gpc->lock){....}-{3:3}, at: kvm_xen_set_evtchn_fast+0x1fb/0x9b0 [ 980.770882][ C1] other info that might help us debug this: [ 980.776851][ C1] context-{2:2} [ 980.780499][ C1] 6 locks held by kworker/u8:18/11489: [ 980.785951][ C1] #0: ffff88801b6d6948 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x9ea/0x1830 [ 980.797004][ C1] #1: ffffc9001bd17c40 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0xa25/0x1830 [ 980.807734][ C1] #2: ffffffff8fbbe870 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xf4/0x800 [ 980.817310][ C1] #3: ffffffff8fbcd088 (rtnl_mutex){+.+.}-{4:4}, at: default_device_exit_batch+0xe5/0xa00 [ 980.827405][ C1] #4: ffffffff8e91ee98 (sysctl_lock){+.+.}-{3:3}, at: drop_sysctl_table+0x217/0x5e0 [ 980.837333][ C1] #5: ffff88807ab79840 (&kvm->srcu){.?.+}-{0:0}, at: kvm_xen_set_evtchn_fast+0x1c3/0x9b0 [ 980.847510][ C1] stack backtrace: [ 980.851319][ C1] CPU: 1 UID: 0 PID: 11489 Comm: kworker/u8:18 Tainted: G L syzkaller #0 PREEMPT(full) [ 980.851339][ C1] Tainted: [L]=SOFTLOCKUP [ 980.851345][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 980.851355][ C1] Workqueue: netns cleanup_net [ 980.851374][ C1] Call Trace: [ 980.851381][ C1] [ 980.851387][ C1] dump_stack_lvl+0xe8/0x150 [ 980.851407][ C1] __lock_acquire+0xec1/0x2cf0 [ 980.851427][ C1] ? xas_start+0x3d4/0x770 [ 980.851447][ C1] ? xa_load+0x60/0x210 [ 980.851460][ C1] lock_acquire+0xf0/0x2e0 [ 980.851476][ C1] ? kvm_xen_set_evtchn_fast+0x1fb/0x9b0 [ 980.851494][ C1] _raw_read_lock_irqsave+0x48/0x60 [ 980.851513][ C1] ? kvm_xen_set_evtchn_fast+0x1fb/0x9b0 [ 980.851528][ C1] kvm_xen_set_evtchn_fast+0x1fb/0x9b0 [ 980.851544][ C1] ? kvm_xen_set_evtchn_fast+0x1c3/0x9b0 [ 980.851560][ C1] xen_timer_callback+0x109/0x220 [ 980.851577][ C1] ? __pfx_xen_timer_callback+0x10/0x10 [ 980.851593][ C1] __hrtimer_run_queues+0x4e7/0xcc0 [ 980.851616][ C1] ? __pfx___hrtimer_run_queues+0x10/0x10 [ 980.851633][ C1] ? ktime_get_update_offsets_now+0x3b2/0x3d0 [ 980.851651][ C1] hrtimer_interrupt+0x42b/0x1010 [ 980.851673][ C1] ? __pfx_sched_clock_cpu+0x10/0x10 [ 980.851693][ C1] __sysvec_apic_timer_interrupt+0x102/0x460 [ 980.851714][ C1] sysvec_apic_timer_interrupt+0xa1/0xc0 [ 980.851733][ C1] [ 980.851739][ C1] [ 980.851744][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 980.851759][ C1] RIP: 0010:lock_acquire+0x20b/0x2e0 [ 980.851776][ C1] Code: e9 30 ff ff ff e8 d5 ed 0b 0a f7 c3 00 02 00 00 0f 84 38 ff ff ff 65 48 8b 05 51 3b 7a 11 48 3b 44 24 30 75 33 fb 48 83 c4 38 <5b> 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc 48 8d 3d ee 5a 73 [ 980.851788][ C1] RSP: 0018:ffffc9001bd17150 EFLAGS: 00000296 [ 980.851801][ C1] RAX: 6ccafa4bd6958200 RBX: 0000000000000246 RCX: 0000000080000001 [ 980.851811][ C1] RDX: 0000000067fc6b00 RSI: ffffffff8e163674 RDI: ffffffff8c27ae80 [ 980.851821][ C1] RBP: 0000000000000000 R08: ffffffff826deed7 R09: ffffffff8e91ee98 [ 980.851831][ C1] R10: dffffc0000000000 R11: fffffbfff1d23dd1 R12: 0000000000000000 [ 980.851840][ C1] R13: ffffffff8e91ee98 R14: 0000000000000000 R15: 0000000000000001 [ 980.851851][ C1] ? drop_sysctl_table+0x217/0x5e0 [ 980.851873][ C1] _raw_spin_lock+0x2e/0x40 [ 980.851890][ C1] ? drop_sysctl_table+0x217/0x5e0 [ 980.851908][ C1] drop_sysctl_table+0x217/0x5e0 [ 980.851926][ C1] ? __kfree_rcu_sheaf+0x1f/0x5d0 [ 980.851942][ C1] ? __pfx_drop_sysctl_table+0x10/0x10 [ 980.851959][ C1] ? __kfree_rcu_sheaf+0x1f/0x5d0 [ 980.851972][ C1] ? __kfree_rcu_sheaf+0x1f/0x5d0 [ 980.851986][ C1] ? __kfree_rcu_sheaf+0x1ad/0x5d0 [ 980.851999][ C1] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 980.852013][ C1] ? kvfree_call_rcu+0x9e/0x430 [ 980.852028][ C1] drop_sysctl_table+0x3f2/0x5e0 [ 980.852048][ C1] ? __pfx_drop_sysctl_table+0x10/0x10 [ 980.852067][ C1] ? do_raw_spin_lock+0x12b/0x2f0 [ 980.852080][ C1] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 980.852096][ C1] unregister_sysctl_table+0x41/0x60 [ 980.852115][ C1] addrconf_ifdown+0x16c8/0x1a40 [ 980.852134][ C1] ? tls_dev_event+0x745/0xf00 [ 980.852154][ C1] ? __pfx_addrconf_ifdown+0x10/0x10 [ 980.852174][ C1] addrconf_notify+0x1bc/0x1050 [ 980.852193][ C1] notifier_call_chain+0x1be/0x400 [ 980.852216][ C1] unregister_netdevice_many_notify+0x186a/0x2370 [ 980.852235][ C1] ? __pfx_unregister_netdevice_many_notify+0x10/0x10 [ 980.852257][ C1] ? __mutex_lock+0x319/0x1300 [ 980.852274][ C1] default_device_exit_batch+0x981/0xa00 [ 980.852294][ C1] ? __pfx_netdev_run_todo+0x10/0x10 [ 980.852307][ C1] ? __pfx_default_device_exit_batch+0x10/0x10 [ 980.852328][ C1] ? __pfx_default_device_exit_batch+0x10/0x10 [ 980.852345][ C1] ops_undo_list+0x52b/0x940 [ 980.852363][ C1] ? __pfx_ops_undo_list+0x10/0x10 [ 980.852381][ C1] ? idr_destroy+0x218/0x290 [ 980.852398][ C1] ? do_raw_spin_unlock+0xf5/0x210 [ 980.852412][ C1] cleanup_net+0x56b/0x800 [ 980.852429][ C1] ? __pfx_cleanup_net+0x10/0x10 [ 980.852448][ C1] ? process_scheduled_works+0xa25/0x1830 [ 980.852464][ C1] ? process_scheduled_works+0xa25/0x1830 [ 980.852480][ C1] process_scheduled_works+0xb02/0x1830 [ 980.852504][ C1] ? __pfx_process_scheduled_works+0x10/0x10 [ 980.852522][ C1] ? assign_work+0x3d5/0x5e0 [ 980.852539][ C1] worker_thread+0xa50/0xfc0 [ 980.852563][ C1] kthread+0x388/0x470 [ 980.852575][ C1] ? __pfx_worker_thread+0x10/0x10 [ 980.852591][ C1] ? __pfx_kthread+0x10/0x10 [ 980.852604][ C1] ret_from_fork+0x51e/0xb90 [ 980.852622][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 980.852637][ C1] ? __switch_to+0xc7d/0x1450 [ 980.852652][ C1] ? __pfx_kthread+0x10/0x10 [ 980.852664][ C1] ret_from_fork_asm+0x1a/0x30 [ 980.852687][ C1] [ 981.455737][ T5908] usb 4-1: new high-speed USB device number 92 using dummy_hcd [ 981.620155][ T5908] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 981.629374][ T5908] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 981.637409][ T5908] usb 4-1: Product: syz [ 981.641675][ T5908] usb 4-1: Manufacturer: syz [ 981.646476][ T5908] usb 4-1: SerialNumber: syz [ 981.655038][ T5908] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 981.707027][ T1216] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 982.122803][T16934] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 982.132024][T16934] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 982.324038][ T9] usb 4-1: USB disconnect, device number 92 [ 982.795636][ T1216] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 982.802689][ T1216] ath9k_htc: Failed to initialize the device [ 982.809946][ T9] usb 4-1: ath9k_htc: USB layer deinitialized