last executing test programs: 4m37.144383576s ago: executing program 4 (id=2627): sendmsg$inet6(0xffffffffffffffff, &(0x7f0000000800)={0x0, 0x0, &(0x7f00000004c0)=[{0x0}], 0x1}, 0x4048043) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000040)={0x0, 0x10, &(0x7f0000000000)=[@in={0x2, 0x0, @private=0xa010101}]}, &(0x7f0000000080)=0x10) sendmsg$inet(0xffffffffffffffff, &(0x7f00000015c0)={0x0, 0x14, &(0x7f0000001600)=[{&(0x7f0000000240)=' ', 0xa2732}], 0x1}, 0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f00000001c0)={&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x0, 0x0, &(0x7f0000000200)=""/172, 0xfffffffffffffeb6, 0x0, 0x0}, &(0x7f0000000040)=0x40) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f0000000140)={0x1, [0x0]}, &(0x7f0000000240)=0x8) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x84, &(0x7f00000000c0)={r1, @in6={{0xa, 0x0, 0x0, @rand_addr=' \x01\x00'}}, 0xfffffffd, 0x79b, 0x1, 0xfffffffc, 0x20}, &(0x7f00000001c0)=0x9c) 4m35.930491868s ago: executing program 4 (id=2632): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0xfd, 0x7fff0000}]}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) fsetxattr(r0, &(0x7f0000000340)=@known='system.sockprotoname\x00', 0x0, 0x0, 0x3) r1 = syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000a3b370086d04ae08581101020301090212000d000000000904"], 0x0) r2 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x62181) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000004c0)=@newtfilter={0x24, 0x2c, 0xd27, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0xb, 0x1}, {0x0, 0x1}, {0x9, 0xfff4}}}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x4) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f00000001c0)={0x0, 0x0, 0x0, 'queue0\x00'}) write$sndseq(r2, &(0x7f0000000300)=[{0x2, 0x0, 0x5, 0x83, @tick, {0xfd}, {}, @note={0x81}}, {0x6, 0x3, 0x9, 0xff, @tick=0x1, {0x10, 0x5}, {0xc, 0x2}, @control={0x3, 0xa, 0x7fff}}, {0x8, 0x3, 0x6, 0x4, @tick=0x9, {0xbb, 0x3}, {0xdb}, @result={0x5, 0x9}}], 0x54) syz_usb_control_io(r1, 0x0, 0x0) r3 = socket$tipc(0x1e, 0x5, 0x0) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000540)='/proc/slabinfo\x00', 0x0, 0x0) lseek(r4, 0x0, 0x0) syz_usb_control_io(r1, &(0x7f00000000c0)={0x2c, 0x0, 0x0, 0x0, &(0x7f0000000440)={0x20, 0x29, 0xf, {0xf, 0x29, 0x9, 0x18, 0x7f, 0x2, "da488970", "d7690ecb"}}, 0x0}, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000080)='./binderfs2/binder1\x00', 0x2, 0x0) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r5 = memfd_create(&(0x7f0000000040)='\x02A\xbb\xcc\x96\x0e\x00\x00\x00\x00\x00\x00', 0x6) ftruncate(r5, 0x200000000000) syz_usb_control_io$uac1(r1, 0x0, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000380)=ANY=[@ANYBLOB="600000001000010828bd7000feffffff00000000", @ANYRESHEX=r3, @ANYBLOB="000000000420040008001b000000000024002b8008000100", @ANYRES32, @ANYBLOB="0800030019000000080008"], 0x60}, 0x1, 0x0, 0x0, 0x20}, 0x20004004) syz_usb_disconnect(r1) r7 = syz_open_procfs(0x0, &(0x7f0000000080)='net/tcp\x00') pread64(r7, &(0x7f0000000000)=""/105, 0x92, 0x12c) setsockopt$packet_fanout_data(r7, 0x107, 0x16, &(0x7f0000000140)={0x4, &(0x7f0000000100)=[{0x7, 0x6, 0x8, 0x3}, {0x2, 0x3, 0x7, 0x9}, {0x9, 0xb, 0xc9, 0x6}, {0x8000, 0x0, 0x8, 0x2d}]}, 0x10) r8 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r8, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0], 0x0, 0x0, 0x0) r9 = landlock_create_ruleset(&(0x7f0000000040)={0x0, 0x3}, 0x10, 0x0) landlock_restrict_self(r9, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x88000, 0x0) 4m30.409498961s ago: executing program 4 (id=2658): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), r0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000140)={'erspan0\x00', &(0x7f00000000c0)={'gretap0\x00', 0x0, 0x7800, 0x700, 0x3, 0x1, {{0x6, 0x4, 0x0, 0x16, 0x18, 0x64, 0x0, 0x81, 0x4, 0x0, @rand_addr=0x64010101, @multicast1, {[@ra={0x94, 0x4, 0x1}]}}}}}) r3 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000000c0)={'ipvlan1\x00', 0x0}) r5 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc, 0x0, 0x0, 0x0, 0xff], 0x0, [0x1, 0x2, 0xfffe, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x5c4, 0x8000, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}]}, 0x88}}, 0x20000000) sendmsg$ETHTOOL_MSG_PAUSE_GET(r0, &(0x7f0000000380)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x4c, r1, 0x1, 0x70bd2d, 0x25dfdbff, {}, [@HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x7}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}]}, @HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}, @HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}, @HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}]}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20040084}, 0x44000) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_DEL_KEY(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000001c0)={0x28, r6, 0x1, 0x70bd27, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r7}, @void}}, [@NL80211_ATTR_KEY_SEQ={0x4}, @NL80211_ATTR_KEY_CIPHER={0x8, 0x9, 0xfac01}]}, 0x28}, 0x1, 0x0, 0x0, 0x44004}, 0x0) 4m29.300173883s ago: executing program 4 (id=2667): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x2, 0x80805, 0x0) close(0x3) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) shutdown(r2, 0x1) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) connect$inet6(r2, &(0x7f0000000100)={0xa, 0x0, 0xfffffffc, @loopback, 0x6}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_DEBUG_SET(r3, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000001500)={&(0x7f0000000000)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="0100000000000000000008000000180001801400020073797a5f74756e00000000000000000018000280080002001100000004000100080004"], 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x8090) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000180)={'team0\x00', 0x0}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000300)={'sit0\x00', &(0x7f0000000280)={'syztnl0\x00', 0x0, 0x32a99bf5c80c90da, 0x8, 0x3, 0x800, {{0xc, 0x4, 0x1, 0x4, 0x30, 0x66, 0x0, 0x5, 0x4, 0x0, @rand_addr=0x64010100, @multicast2, {[@rr={0x7, 0x1b, 0x44, [@broadcast, @multicast1, @multicast1, @loopback, @rand_addr=0x64010101, @broadcast]}]}}}}}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000380)={'batadv0\x00', 0x0}) sendmsg$ETHTOOL_MSG_COALESCE_GET(r1, &(0x7f00000005c0)={&(0x7f00000000c0), 0xc, &(0x7f0000000580)={&(0x7f00000004c0)={0xa4, r4, 0x1, 0x70bd28, 0x25dfdbff, {}, [@HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}, @HEADER={0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'nr0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}]}, @HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @HEADER={0x48, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_team\x00'}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x4048001}, 0x800) writev(r2, &(0x7f0000000480)=[{&(0x7f0000000400)="91", 0x1}], 0x1) sendmmsg$inet_sctp(r1, &(0x7f00000032c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB='0\x00'], 0x30}], 0x1, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) r9 = syz_open_dev$video(&(0x7f0000000680), 0x5f, 0x41) ioctl$VIDIOC_CROPCAP(r9, 0xc02c563a, &(0x7f00000006c0)={0xb, {0x5435, 0x5, 0x1, 0x2}, {0x8, 0x11, 0xb4d1, 0x2}, {0x6, 0x10000}}) r10 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x101040, 0x0) r11 = ioctl$KVM_CREATE_VM(r10, 0xae01, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) r12 = ioctl$KVM_CREATE_VCPU(r11, 0xae41, 0x0) ioctl$KVM_SET_XCRS(r12, 0x4188aea7, &(0x7f00000002c0)={0x3, 0x0, [{0x1}, {0x1, 0x0, 0x286}, {0x1, 0x0, 0x1}, {0x8, 0x0, 0x1}, {0x8000, 0x0, 0x10001}, {0x1, 0x0, 0x9}, {0x8, 0x0, 0xffff}, {0xf73, 0x0, 0x10000}, {0xfff, 0x0, 0xbbb}, {0x5, 0x0, 0x8}, {0xf, 0x0, 0x8000000001}, {0x9, 0x0, 0x7}, {0x3, 0x0, 0x4}, {0x5f, 0x0, 0x169c}, {0x8, 0x0, 0xd}, {0x0, 0x0, 0x3}]}) sendmsg$IPSET_CMD_ADD(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)=ANY=[@ANYBLOB="400000000906010200000000000a0000000000000900020073797a31000000000500010007000000180007800c00018008000140ffffffff080009"], 0x40}, 0x1, 0x0, 0x0, 0x10000047}, 0x4000084) r13 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), r1) sendmsg$NL80211_CMD_GET_COALESCE(r1, &(0x7f0000000640)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000600)={&(0x7f0000000440)={0x20, r13, 0x400, 0x70bd2d, 0x25dfdbfd, {{}, {@void, @void, @val={0xc, 0x99, {0xe, 0x2}}}}, ["", "", "", "", "", "", "", ""]}, 0x20}, 0x1, 0x0, 0x0, 0x1}, 0x800) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000340)=@ipv6_newrule={0x38, 0x20, 0x2d2c6d60ea1da725, 0x70bd29, 0x25dfdbfd, {0xa, 0x0, 0x0, 0xcd, 0xfe, 0x0, 0x0, 0x1, 0x10002}, [@FIB_RULE_POLICY=@FRA_PRIORITY={0x8, 0x6, 0x7ffe}, @FIB_RULE_POLICY=@FRA_OIFNAME={0x14, 0x11, 'veth1_to_team\x00'}]}, 0x38}, 0x1, 0x0, 0x0, 0x20008005}, 0x44) 4m27.144423164s ago: executing program 4 (id=2683): ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000180)={'gre0\x00', &(0x7f0000000000)={'gre0\x00', 0x0, 0x701, 0x7800, 0xf, 0x80, {{0x5, 0x4, 0x1, 0x0, 0x14, 0x66, 0x0, 0x5, 0x61f136bf14efd2c7, 0x0, @private=0xa010102, @dev={0xac, 0x14, 0x14, 0x25}}}}}) r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg$ETHTOOL_MSG_CHANNELS_SET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYRES32, @ANYRES16, @ANYBLOB="010000000000fcdbdf25120000001800018014000200766574683000000000000000080000000800"], 0x3c}, 0x1, 0x0, 0x0, 0x4044890}, 0x200480b8) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="2c000000190001000000000000000000021800000000fd000000ed0008000100ac1414003400080004"], 0x2c}, 0x1, 0x0, 0x0, 0x4000016}, 0x0) sendto$inet6(r0, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000040)={0x4, &(0x7f0000000000)=[{0x45, 0x1, 0x2}, {0x44, 0x1, 0x9, 0x8016}, {0x1, 0x9, 0x7, 0x5}, {0x6, 0x9, 0x5, 0x5}]}) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_KEY(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r2, @ANYRESDEC, @ANYRES32=r3, @ANYBLOB="2c005080050002"], 0x54}, 0x1, 0x0, 0x0, 0x4}, 0x4044000) 4m24.012679901s ago: executing program 4 (id=2697): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/partitions\x00', 0x0, 0x0) r2 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) sendfile(r2, r1, &(0x7f0000002080)=0x58, 0x12) bind$inet(r0, &(0x7f00000001c0)={0x2, 0x4e22, @local}, 0x10) connect$inet(r0, &(0x7f0000000040)={0x2, 0x0, @remote}, 0x10) syz_emit_ethernet(0x91, &(0x7f0000000100)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1b}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x83, 0x265, 0x0, 0x0, 0x6, 0x0, @remote, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x2, 0x18, 0x4, 0x0, 0x0, 0x0, {[@timestamp={0x8, 0xa, 0xf, 0x93b}, @sack_perm={0x4, 0x2}, @md5sig={0x13, 0x12, "79e6f44d530dc1a2bbb526931e89c384"}, @mss={0x2, 0x4, 0x801}, @fastopen={0x22, 0x12, "00045900e16c156eca2887ae44c1e862"}, @window={0x3, 0x3, 0x80}, @md5sig={0x13, 0x12, 'G\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00'}]}}, {"755623fd2f4a494e90f0f092d3ca7f"}}}}}}, 0x0) 4m9.079496228s ago: executing program 32 (id=2697): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/partitions\x00', 0x0, 0x0) r2 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) sendfile(r2, r1, &(0x7f0000002080)=0x58, 0x12) bind$inet(r0, &(0x7f00000001c0)={0x2, 0x4e22, @local}, 0x10) connect$inet(r0, &(0x7f0000000040)={0x2, 0x0, @remote}, 0x10) syz_emit_ethernet(0x91, &(0x7f0000000100)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1b}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x83, 0x265, 0x0, 0x0, 0x6, 0x0, @remote, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x2, 0x18, 0x4, 0x0, 0x0, 0x0, {[@timestamp={0x8, 0xa, 0xf, 0x93b}, @sack_perm={0x4, 0x2}, @md5sig={0x13, 0x12, "79e6f44d530dc1a2bbb526931e89c384"}, @mss={0x2, 0x4, 0x801}, @fastopen={0x22, 0x12, "00045900e16c156eca2887ae44c1e862"}, @window={0x3, 0x3, 0x80}, @md5sig={0x13, 0x12, 'G\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00'}]}}, {"755623fd2f4a494e90f0f092d3ca7f"}}}}}}, 0x0) 7.496621596s ago: executing program 0 (id=4014): r0 = socket$alg(0x26, 0x5, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) bind$alg(r0, &(0x7f0000000040)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000000)="adcd1a9a3fc36e961ed00fe41b0cd695", 0x20) r1 = accept4$alg(r0, 0x0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f00000021c0)=[{0x0, 0x0, &(0x7f0000001000)=[{&(0x7f0000000100)="a92e81d0991808e33c2330164cf023df", 0x10}], 0x1, 0x0, 0x0, 0x880}], 0x1, 0x80001) 7.279877588s ago: executing program 3 (id=4018): r0 = syz_usb_connect(0x5, 0x58, &(0x7f0000000000)={{0x12, 0x1, 0x310, 0x8e, 0x3a, 0xc6, 0x20, 0x694, 0x1, 0x7813, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x46, 0x2, 0xe, 0x6, 0x10, 0x3, "", [{{0x9, 0x4, 0x39, 0xd8, 0x1, 0x1a, 0xda, 0xa8, 0x8, [], [{{0x9, 0x5, 0x8, 0x10, 0x20, 0x7, 0x9, 0x80}}]}}, {{0x9, 0x4, 0xe4, 0x5, 0x3, 0xb9, 0x56, 0xda, 0x2, [], [{{0x9, 0x5, 0x8, 0x0, 0x400, 0x1, 0x12, 0xfc}}, {{0x9, 0x5, 0xb, 0x0, 0x20, 0x7, 0x3, 0x9a, [@generic={0x7, 0x5, "d15b89f26d"}]}}, {{0x9, 0x5, 0x9, 0x3, 0x40, 0x7a, 0xa, 0x84}}]}}]}}]}}, &(0x7f0000000a40)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, &(0x7f0000000bc0)={0x14, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0003040000000403"], 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000011c0)={0x24, 0x0, &(0x7f0000001040)={0x0, 0x3, 0x2, @string={0x2}}, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000001600)={0x24, 0x0, &(0x7f0000001540)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x44a}}, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000500)={0x18, &(0x7f0000000300)=ANY=[@ANYBLOB='@\b\b'], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000002280)={0x84, &(0x7f0000001e00)={0x20, 0xd, 0x4, "348b35e5"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x5001}) ioctl$TUNSETVNETHDRSZ(0xffffffffffffffff, 0x400454d8, 0x0) syz_usb_connect$printer(0x5, 0x2d, &(0x7f0000000080)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x20, 0x4b8, 0x202, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x1, 0x9, 0xa0, 0x20, "", [{{0x9, 0x4, 0x0, 0x9, 0x1, 0x7, 0x1, 0x3, 0x9, "", {{{0x9, 0x5, 0x1, 0x2, 0x200, 0xa, 0x7, 0x8}}}}}]}}]}}, &(0x7f00000005c0)={0xa, &(0x7f0000000100)={0xa, 0x6, 0x250, 0x3, 0x0, 0x2, 0x10, 0x4}, 0x5, &(0x7f0000000180)={0x5, 0xf, 0x5}, 0x6, [{0x2, &(0x7f0000000240)=@string={0x2}}, {0x4, &(0x7f0000000200)=@lang_id={0x4, 0x3, 0x424}}, {0xb4, &(0x7f0000000340)=@string={0xb4, 0x3, "28384b8beaac4e765b6b6ac972475af81f11f4234780475a6f13af623fa06a94e995c5f34eb56da09e873ac12f7a49f85314fb914d8585c76d6480c159ed0261e3e98ef4e8c0a8b9e86b07219ee488d6e01f2f1439d6ef01431b4d0560729bf2c1483723e97be2f78a0ee0462339366c39c60252fb533c799cfc485d35094e81b29076889f78cfeba1d72e6dc3077a676d790b5385ec0fc23595760228ac05f8c2ee0a15351e0ca3434c97837de321f8586b"}}, {0x4, &(0x7f0000000440)=@lang_id={0x4, 0x3, 0x40a}}, {0x2, &(0x7f0000000480)=@string={0x2}}, {0x4, &(0x7f00000004c0)=@lang_id={0x4, 0x3, 0x407}}]}) writev(r1, &(0x7f0000000280)=[{&(0x7f00000002c0)="a6", 0x1}, {&(0x7f00000000c0)="84", 0x1}], 0x2) 7.185029553s ago: executing program 0 (id=4020): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="120100008e88052086800095d89301020301090212000100000000090401"], 0x0) r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000000380)=ANY=[], 0x0) syz_usb_control_io$hid(r1, &(0x7f0000000180)={0x24, 0x0, &(0x7f0000000340)=ANY=[@ANYRESDEC=r0, @ANYRES32=r0], 0x0, 0x0}, 0x0) socket$inet6(0xa, 0x805, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[], 0x28}, 0x1, 0x0, 0x0, 0x24004894}, 0x40) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x0, 0x0}, &(0x7f0000000140)=0x10) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r3 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) socket$tipc(0x1e, 0x5, 0x0) r4 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r4, 0x10f, 0x87, &(0x7f00000001c0)={0x40}, 0x10) r5 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r5, 0x10f, 0x87, &(0x7f0000000280)={0x41, 0x0, 0x2}, 0x10) sendmsg$tipc(r5, &(0x7f0000000240)={&(0x7f0000000080), 0x10, 0x0}, 0x0) r6 = socket$tipc(0x1e, 0x0, 0x0) setsockopt$TIPC_GROUP_JOIN(r6, 0x10f, 0x87, &(0x7f0000000000)={0x41, 0x0, 0x1}, 0x10) sendmsg$tipc(r6, &(0x7f0000000180)={&(0x7f0000000080)=@nameseq={0x1e, 0x1, 0x0, {0x41}}, 0x10, 0x0}, 0x0) sendmsg$tipc(r5, &(0x7f0000000240)={&(0x7f00000002c0)=@name={0x1e, 0x2, 0x2, {{0x42, 0x107}, 0x2}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x20044050}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="44000000100000082abd7000ffffffff00000000eb5372db4b6255e833e5846f08784bb306d9d1c2440e2e5bb2", @ANYRES32=0x0, @ANYBLOB="6cf2040000c000001c0016801800018014000a000aa3000000000000c65d00000000000008001b005a000000"], 0x44}, 0x1, 0x0, 0x0, 0x240040c2}, 0x48080) r8 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2603) ioctl$I2C_SMBUS(r8, 0x720, &(0x7f0000000100)={0x0, 0x6, 0x2, &(0x7f0000000140)={0x2, "1a9c66bf2f615e427b2644e953449f6c12f206b2855cd8c82b1b9950cf5e1dee93"}}) r9 = syz_open_dev$I2C(&(0x7f0000000000), 0x2, 0x941242) syz_open_dev$dri(&(0x7f0000000080), 0x0, 0x0) close(0x3) ioctl$I2C_RDWR(r9, 0x707, &(0x7f00000000c0)={&(0x7f00000003c0)=[{0x1e, 0x14400, 0x0, 0x0}], 0x34}) 6.782866477s ago: executing program 2 (id=4022): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000006c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x3}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x90, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x3}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x68, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xc}, @NFTA_EXTHDR_OFFSET={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x7}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x2f}]}}}, {0x30, 0x1, 0x0, 0x1, @cmp={{0x8}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_CMP_DATA={0x10, 0x3, 0x0, 0x1, [@NFTA_DATA_VALUE={0x9, 0x1, "910d000000"}]}, @NFTA_CMP_SREG={0x8, 0x1, 0x1, 0x0, 0x15}, @NFTA_CMP_OP={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x104}, 0x1, 0x0, 0x0, 0x910}, 0x0) (fail_nth: 12) 6.352472502s ago: executing program 2 (id=4023): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000780)=ANY=[@ANYBLOB="12010000cf8bed20d90f25004029000000010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000580)={0x24, &(0x7f0000000700)=ANY=[@ANYBLOB="201109"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$I2C_RDWR(0xffffffffffffffff, 0x707, &(0x7f00000000c0)={&(0x7f00000002c0)=[{0x5, 0x0, 0x0, 0x0}, {0x99, 0x2000, 0x2000, 0x0}, {0xfffe, 0x200, 0x0, 0x0}], 0x3}) 5.035844654s ago: executing program 0 (id=4030): r0 = socket$alg(0x26, 0x5, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) bind$alg(r0, &(0x7f0000000040)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000000)="adcd1a9a3fc36e961ed00fe41b0cd695", 0x20) r1 = accept4$alg(r0, 0x0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f00000021c0)=[{0x0, 0x0, &(0x7f0000001000)=[{&(0x7f0000000100)="a92e81d0991808e33c2330164cf023df", 0x10}], 0x1, 0x0, 0x0, 0x880}], 0x1, 0x80001) 4.821911631s ago: executing program 0 (id=4032): ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x5, 0x9, 0x6, 0x0, 0xb49, 0x9, 0x8, 0x2, 0x3}, 0x0) mkdir(0x0, 0x22) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8) r2 = socket(0x18, 0x800, 0x0) r3 = syz_open_dev$vbi(&(0x7f0000000080), 0x3, 0x2) ioctl$VIDIOC_S_OUTPUT(r3, 0xc004562f, &(0x7f0000000140)=0xfffffffe) ioctl$VIDIOC_S_DV_TIMINGS(r3, 0xc0845657, &(0x7f0000000380)={0x0, @bt={0x2d0, 0x191, 0x1, 0x0, 0xdd9f83, 0x1, 0x9, 0x100f3, 0xfffffffe, 0x5, 0x1, 0x4, 0x7, 0x7f, 0x3f, 0xb763599953cb091d, {0x7fff, 0x6fd8e84b}, 0x3, 0xed}}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000780)={'netdevsim0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=@newqdisc={0x38, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0x1, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x1}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000001300)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=@newtfilter={0x34, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0xffffffff, {}, {0x1}, {0x300, 0xa}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=@newqdisc={0x38, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x1}]}, 0x38}}, 0x0) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f00000000c0)={{&(0x7f0000621000/0x1000)=nil, 0x1000}, 0x6}) r6 = socket(0x10, 0x803, 0x1ffd) ioctl$sock_SIOCETHTOOL(r6, 0x8946, &(0x7f00000002c0)={'veth0_to_team\x00', &(0x7f0000000000)=@ethtool_cmd={0x2c, 0x6, 0x40004, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xfc, 0x6}}) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f00000002c0)={'veth0_to_team\x00', &(0x7f0000000000)=@ethtool_channels={0x3d, 0xfffffffe, 0x0, 0x0, 0x0, 0x1, 0x1}}) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000100)) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000001880)=ANY=[@ANYBLOB="b700000012edfffebfa30000000000000703000028feffff620af0fff8ffffff61a4f0ff000000003e040000000000003f000000000000005504000001ed0a002500000017ffffff460400007fffffff7b0a00fe000000006e04000000000000c6000000000000009500000000000000023bc065b7a379d17cf9333379fc9e84af69912435f1b6a693002e7f3be3619184e50b91f32050e436fe275daf51efd601b6482a0800000098efd2a102ee010400006e7a1de4a21f379dbf01de00b1b564fef3bef70548aed0d600c095199fe3ff3128e599b0eaebbdbd7359a48f5b0afc532ef58de3c1b7646cb7798b3e6440c2fbdb00a3e35208b0bbf12cd8dff095edc710e4000000000000009fbe4b61a615c6c57a2b649dc74a1a610643b08d9e104d4d91af25b8123deda8a3658d42ecbf28bf6d8e8afcb913466aaa7f6df70252e79166d8582755a314d31a76e42f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0800000000000000d5f728d236619074d6ebdf098bc908f50ae728a40f9411fe7226a4040b96e37c4f46010400000000c3da29faf75ddd1aa96960bca97af133824b881cc1f62c0f8f8f0e8d76b86f9c45636614786f5a2cb77230a874640dcbe0b20bb77c022d4cab080078fce8c5c81b7037181fc2f18f781aaa6e2957d7e39cc1baddcb7ec6667e699f24e41697ee7ea23e4b29a8b6cc9a1f5a7b3caae05f1300010000949b3aab06b1e042ff2164d80c8ab1c156b97e5889685a96949e4cb40df77b8bb84b0e733a63784ccc214d930cbb7e090df9a2867b3acec439c163fc8706869ada11390d4dbcf840fa68e7d7071b53ac29df826f8ae6d6e18c1e0600bf870768d5217e9bb5a05d9e224e67f1231bd236ed200073824d93c4e1a0f50a74bb4850486727d970acc546087acbf30f2f8165b47ba56dfadd14b306e98931485747292c6fe6e188750cf4f87cce2aa7d67c7133a9f05954cde298a35ea6d715ba80aee6330000000000000000000000000000000000004000000000000000038600008fb854adb4f8080064e8407c6bdb37114c80fbaa4a0ec5aaf4b0ac6f2128668279eb6fc144344e2d461c9a1be8fa0061ea9d55ee4716bea8e1cebf9ed39325ab4c5530dd6ee9fffc00000000000000d7c5af73c683625aaad5eda5004a76c9f8975ed4c5e4eb3e77e9885f69754932609f19e2f615a01cb6d17fbf5cb539403cb0572534f054d5514ad8264f7b029b2bdf2ca4958a62a6e744f9a4c1e646e1dd2ca19583f0f8b0dc53debd7d44f334e6ed7445a9580f970e483b307c4b3c018bc194b23d37e6a2e52d8265e5aab6fec586d52386e8c07a88c88e8faec5f1b16b2014f6952ce7d6be12c6bdb9651ca6fc907061be311d1354e6295698594a73136237bee068d3819400e43544830a3f74b7942f22336953978a5b2032da4238cc61162c04c1297395b73e18c9387615a2bc87d9e2445f3d323d3fac347926a4bac694c55fe9d145906d410f58f1951405d10504efe402cae085afef5dbd617e87ddbd239e4a50d7eb8e327fb5db12cbd6a9efe8e671c4f251cafffe3400a670d14b9b3cd8d86e492997a0168c022ef3536bd1dc731f4f9f8cb66701f4578ba4cb9b706e605a88c3857fb8aaaa95024f8da775f72950212b84fc6133ae14d1429cd4905dabb52e43af7e65acf97b4951fa1e967d16a5ed642efc855a4a46b85cd079934ad3188276efae9387eaa232697526e24b5d4fded86c3811ccd00520150b16000080122965558074956da5e4c3bbefcb64aa8be4456ed2caf0f467b6bbf3aa4371f5e76ab3f6a20278a3c779e03afd9a6af6fd518e5dce030f88ec5a5cb7601a161da0f80893220800c523040d13e1f1300c2c6555bce60d95dd3288e53435713f03add23f14c8db5555c62de4f626483632a2ab547f88dd6efec73a0271a19ca3aa860aa4dcaeeb9bd91a0cb429efae2a5fcc08b3a572969bbe917d1767e38ba49e3e57fafea83e495a6a1d1a4ebf83434986091dd66ffe3ffed0c39552a312e2db596d9c827e02f6fc13c8ddbb50bfd7dd8aa2f35f259fc83e007fe79d2d25e30830b92fca00a292dd3b856faa4b7e66e1b64505f65900839df71a97d4d07d37f7ecf8ed9a22da26ae674bba16c204f6b2f8f74fc56b7126d7c11ece6e88ec41192aaee75415c58d264a2b6adae02c821b62428902aad499825ab85a348638384cd12e61dbde5c47056f0a20b4e2a2328d5db5cf026657a129e6be231acf5f57995c60d9fca5f63a0dfd18054717120bda466d04774b53208ad8b022719ca77a4e0a66b4708f791d849a5e2aaa0074a9560ede2600df5a5c41392fe9460080fcb1e65233fb8dbeec4c86dbcf6a0673e38d2d3615e5bfbde44afe0fa7564231fff7e7f1f3ad68492dd2cccb15b5d7d3e37e8b7d28921c4b9280979521173f322df408d9818b6cc400090300000021911480a876fbba698801937e8b4264eb6f5137bdaa075f1488d22230592a79000000000000000000000000000000000000000000110000000000000000000000000000000000000000000000000000000000000000002f316aa0886c174b73decb46c1c85edf50d8fcbac5ff76b365611666da86a8e65b308706bd7c000000000000003f7cd4d5cb9076b81b7741ec03877afb5237ea1694addebc14c3ae49f88c462ea2050acf2d9a97d3be29a5614d1eba2c98cf0236401e02d7c445e50f76419ab4f78f67a09e63dd4faa2e7b59399f055f2fa278783f26d0a52aefb0a5ef0b41e14a6fe6ba306206670b84894e901a523fcbadfeff535f2514bc834e876810d9a6a78e70a9e22860c36a724770b4185de44db6bf21fef32a8d5b36d9014f38fee012365f963b2a85e7d8075c333475b9f0284405e3127dde7e41285fbe0bdd370c06c6a41744c3d24eab511317f97b7b4a1c2ec33fedc46e9bf0fa640eebd3d58f0ebdb7cb8ccffd6d6ab7e0e843591d2618e2d2cdc7081c8fafffe9c3500800000087de4ee7aac6478d99de7dd82bef044a6d33c789d566c90c46ad581aa22f910547a77d55e26bf19f1d4661550b177ef53933a305e69b8a95119dcf5bda599d625054776151b2cd1fcde238bdc527594a6c17aa9728af24e2bb7a3830e7092b01b119ea4e7e7f0e21527d622cc29c9f0c8720195368f8374337ab4d130619d93c5ef37e7ddd0b2da147e6e513455b88753452de959a6cbfa1ffbc7ad5d8c3b48017fd31dcf72f337b639253f44cb27a12174bc4c191e21015d0c431a71906eb9c6a14c8a060459ef26787ce3d1cbfd5cc459f0048b5d06f6cbd3e9b34c89f3fb2f951ae81d7fcc8bc0000000000000000000000000000000000000000009231feef3117197c796369f776c8b2ea3970f358107945d9e74e9bdfa58e68b65a8f01bc4b73cc31df5aa29f363917f90e3fa1eaf553db1c761dd9b634a9c4d7c21c24fe6d953ed9438cad0f8dfe03e5e2f73019352f1fb682a5a6ebbf24ebc49e3d7058e696eb3f4b642f36c9006c0067e24a64aa8c53dd824a3c08bfda74a143c855030ae004ac797c575c202d8091eb77565212548ead770d68000000000099347593f67da85d1c962bfb320d1553a74ec3bf003ba62b1784dbf0168a7e85f28b77bdebce96bf386a6dd5df162a16f2b7e8a4de0ffc464a87f91f81866d2ef0af71ebb07a739c3cb1b7000000000000"], &(0x7f00000001c0)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x43}, 0x48) sendmsg$nl_xfrm(r7, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000600)=ANY=[@ANYBLOB="940100001a001307fdffffff00000000fe8000000000000000000000000000aafc010000000000000000000000000000fffc00"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="6401010000000000000000000000000000000000330000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003000000000000000000000000006b2e0507cd51b00d250000000000000030bde6a3d2492e652df74700000007000000000000000000000000000000000000000000000000000000060000000200000000000000000000000a0002006000000000000000a200010073686131000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d00200008ad957b65964f40189fd88c98a3b09ecbd5b9eeb6c9c618b4cfc97232d64fae3be67da1d16afe4a1fc4af5146c45100e40d9473088fa9693f7e6da8737ef7346f025cb9d2b4f6669"], 0x194}}, 0x8000) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) socket$inet6_sctp(0xa, 0x5, 0x84) 4.721131816s ago: executing program 2 (id=4033): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(serpent)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept4(r0, 0x0, 0x0, 0x80800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000001840)=[{&(0x7f00000007c0)=""/89, 0x59}, {&(0x7f0000000080)=""/71, 0x47}, {&(0x7f00000002c0)=""/231, 0xe7}, {&(0x7f00000003c0)=""/149, 0x95}, {&(0x7f0000000600)=""/188, 0xbc}, {&(0x7f0000000840)=""/4096, 0x1000}], 0x6}, 0x0) 4.430877396s ago: executing program 2 (id=4035): r0 = syz_usb_connect(0x3, 0x2d, &(0x7f0000000080)=ANY=[@ANYBLOB="120100004898b610c2154500201f0102030109021b0001000500ea09040002018c78fd00090582f3c6"], 0x0) syz_usb_control_io(r0, &(0x7f0000001480)={0x2c, &(0x7f0000001300)={0x20, 0x23, 0x69, {0x69, 0x23, "5dce7c8ad9dde649d203aa24e4dcc35d0f31992aa7e3c11ff4d27816aee70459ea46f496a102b3b940cea741346af1bf5c2628e12a7e89d8e70523e3f85f1028f4afbd2794b07333b8c498163403407358294165d7c825627f849eece02fb7a6581492ba5f970f"}}, &(0x7f0000002240)={0x0, 0x3, 0x4, @string={0x0, 0x3, "45acc361bcc0022c34d679fe243552305c510339e44119fc714ddd778faff9bebd636a2bb2ebb752ee7bda2d62264af66eb388b79fae3d2b928134fbbb71a3b879dca36cf842e323a5b5bde816cf498acd8fceb8dd2db24110addbda7498af830e417e8d865e58127c6fb713a0b212d9dfe45adee13113"}}, &(0x7f00000013c0)={0x0, 0xf, 0x54, {0x5, 0xf, 0x5}}, &(0x7f0000001400)={0x20, 0x29, 0xf, {0xf, 0x29, 0xa, 0x60, 0x1, 0x7, "da0b82fe", "8374e6ff"}}, &(0x7f0000001440)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x4, 0x80, 0x5, 0x6, 0x0, 0x10, 0x7f}}}, &(0x7f0000001940)={0x84, &(0x7f00000014c0)=ANY=[@ANYBLOB="0014a8000000f7ab76db25a9f300898789bd7c113702284aff556368f5cfad97e4e32f70d5ec7a143f5e0800bfd840504b6a6a19b0c96462e5121f8a1b003a4f701bfda4ef919074692aaa4cdd3675550323b81570c807b4613c502d79454323819cd8ef986eff97314229030bda2687180e5ec9ccc800838dd005eefbdd1dcdf22591f8913181ad1173917fff5037757ea5549de81258334b7019dfca676028f278fd0ef7a800fbe12b021f1efa"], &(0x7f0000001580)={0x0, 0xa, 0x1, 0x4}, &(0x7f00000015c0)={0x0, 0x8, 0x1, 0xff}, &(0x7f0000001600)={0x20, 0x0, 0x4, {0x0, 0x1}}, &(0x7f0000001640)={0x20, 0x0, 0x8, {0xc0, 0x40, [0xf0f0]}}, &(0x7f0000001680)={0x40, 0x7, 0x2, 0xee10}, &(0x7f00000016c0)={0x40, 0x9, 0x1, 0x4}, &(0x7f0000001700)={0x40, 0xb, 0x2, "e517"}, &(0x7f0000001740)={0x40, 0xf, 0x2, 0x8}, &(0x7f0000001780)={0x40, 0x13, 0x6, @local}, &(0x7f00000017c0)={0x40, 0x17, 0x6}, &(0x7f0000001800)={0x40, 0x19, 0x2, "08ff"}, &(0x7f0000001840)={0x40, 0x1a, 0x2, 0x1d64}, &(0x7f0000001880)={0x40, 0x1c, 0x1, 0x9}, &(0x7f00000018c0)={0x40, 0x1e, 0x1, 0x4}, &(0x7f0000001900)={0x40, 0x21, 0x1, 0x5}}) (async) syz_usb_disconnect(r0) (async) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_DELETE(r1, 0x0, 0x20008886) (async) r2 = syz_open_dev$radio(&(0x7f0000000040), 0x2, 0x2) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r1, 0x84009422, &(0x7f00000022c0)={0x0, 0x0, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @struct}}) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r3, 0xc400941d, &(0x7f0000000b00)={0x0, 0x7, 0x5f85}) ioctl$BTRFS_IOC_BALANCE_V2(r3, 0xc4009420, &(0x7f0000000f00)={0x13, 0x7, {0xfffffffffffffff9, @struct={0x1580, 0x1}, r4, 0x3, 0x80000000000009, 0x9, 0x40, 0x1000, 0x15, @struct={0x8, 0x8}, 0x8, 0x9, [0xc, 0x6, 0xfffffffffffffffd, 0xd, 0x1, 0x7fffffffffffffff]}, {0x4, @usage=0xd392, 0x0, 0x8, 0x7f, 0x1, 0x9, 0x10, 0xa8, @usage, 0x1, 0x3, [0xfffffffffffeffff, 0x9, 0x10000, 0x74, 0xffffffffffe00000, 0x8000]}, {0x7, @usage=0xd8e, r5, 0x5e30, 0x2c7, 0x80000001, 0x3, 0xfffffffffffffffa, 0x8, @struct={0xffffff7f, 0x40}, 0x4d, 0x3, [0x9, 0x8, 0x4, 0x80000001, 0xfff, 0x100000000]}, {0x100000001, 0x4, 0x1ff}}) r6 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_buf(r6, 0x29, 0x32, 0x0, 0x0) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r1, 0x84009422, &(0x7f0000001a40)={0x0, 0x0, {}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) ioctl$BTRFS_IOC_GET_DEV_STATS(r6, 0xc4089434, &(0x7f0000000540)={r7, 0x1000, 0x0, [0xffffffffffffffff, 0x9, 0x7, 0x1, 0x9], [0x9, 0x9, 0x7, 0x8000000000000001, 0x3, 0x3b, 0x3, 0x54, 0xbd, 0x127b, 0x1, 0x6, 0x9, 0xee46, 0x4e4a, 0xcb52, 0x1, 0xfffffffffffffffc, 0x392, 0x9, 0x3, 0x8000, 0x6e4, 0x9, 0x8, 0x1ff, 0x6, 0xff56, 0x9, 0x169, 0xa81, 0x3, 0x100000001, 0x2, 0x3, 0x7, 0x87, 0x7dde, 0x442, 0x9, 0x401, 0x7fffffff, 0xa738, 0xe, 0x9, 0x5, 0x100020, 0xe, 0x4, 0x0, 0x5, 0xfff, 0x7698, 0x8, 0xf46, 0x3, 0x1, 0x4, 0x415b, 0x1, 0x3, 0x8, 0x100000001, 0x3, 0x0, 0x4, 0x3, 0x1, 0x8, 0x0, 0xf, 0x3, 0x200, 0x2, 0x4, 0x96, 0x1, 0x2, 0x0, 0x8, 0x0, 0x2, 0x0, 0x7, 0x100, 0x1, 0x7fffffff, 0xfffffffeffffffff, 0x5e, 0x8000000000000000, 0xfffffffffffffffd, 0x800, 0x5, 0x2, 0xfffffffffffffffd, 0xd2c4, 0x5, 0x6, 0x897, 0x1, 0x737, 0x7fffffffffffffff, 0x800, 0x6, 0x7, 0x3, 0xff, 0xd, 0x1, 0x1c0000, 0xff, 0x400000000000014, 0x8000000000000000, 0x50, 0x1, 0x7, 0x3, 0x43e2, 0x9, 0x3800, 0x9c02]}) (async) ioctl$BTRFS_IOC_BALANCE_V2(r1, 0xc4009420, &(0x7f0000000540)={0x0, 0x1, {0x7, @struct={0xfffffffe, 0xfffffffb}, 0x0, 0x578, 0x7fffffffffffffff, 0x0, 0x9, 0x10001, 0x0, @usage=0x7fffffffffffffff, 0x0, 0x6, [0x4, 0x6, 0x80, 0xffff, 0x9, 0x3]}, {0x19, @struct={0x4000000, 0x3}, 0x0, 0x2, 0x5, 0x7fffffffffffffff, 0x7, 0x7, 0x40, @usage=0xda3e, 0x4, 0xfffffff8, [0x8000, 0x2ab0, 0x6, 0x8, 0x8c00000000000000, 0x2]}, {0x6, @struct={0x200, 0x9}, 0x0, 0x4, 0xfffffffffffffffb, 0x3, 0xffffffff, 0xfffffffffffffffb, 0xa, @usage=0x1, 0x7, 0xff, [0x8b5, 0x9b1, 0x2, 0x3e, 0x8, 0x3]}, {0x1200000000, 0xfffffc0000000000, 0xc}}) (async) r9 = add_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000100)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc) r10 = add_key(&(0x7f0000000040)='asymmetric\x00', 0x0, &(0x7f0000000200)="308205553082033da00302010202147398ea982dd02ea8b1cf57c7f297b3e61afc8c0a300d06092a864886f70d01010b050030343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b65793020170d3232303531383232333234315a180f32313232303432343232333234315a30343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b657a30820222300d06092a864886f70d01010105000382020f003082020a0282020100ccac49dd3bcab0157e846ab20a695f1c0a61823b4f2ca3952c08584bb15d99e0c3c179c2b3ebc01e6d3e541dbdb7927b4db59558b2522ec6244b7163803277a7385edb72ae6e0decfbb66d017fe95566dfbf1d76780231e8e507f8b7825c0dd4bbfba2590d2e3a78953a8b4606474446d7cd066a4113e319f6bb6e38f48301a3bf4a394fd70ae938b3f594144eddf743fd24b2493ca5f77a7cd4453d977568f1ed4c420b70ca85f3dee5882cc5beb69734ba2402cd8b869fa973ca73cf9281ee7555bb18675cff3fb5dd331b0ce978db5ccfaa5c4342df5ea96decd7d7ffe6a13a921adaaef68c6f7bd5b46e06e98fe8de093189ed0e11a1fa8ae9e964596253dad170be11d4999711cf99de0b9d947eaab852ea37db907e35bdd9fe6d0a487028ddd50d7f03809314238fb922cd7c29fef172b55c0b12cf9c15f6114c7a45258c450a34ac2d9a81ca0b1322cdeb1a38881897960881aacc8f0f8a327b7668036843bf11ba5560fd801c0d9b69b60972bc0f412f0782c6e3b21391c46d149531be19bdbcede14c74a2e0780bbb94ec4c533aa2b5841d4b657edcf7db367dbe9e3b366642667635bfbef0c13c7ce9425c24530305a86724500275ff24463b358976e670dac5518c9ae505b00bd02dd47d5775946bf90aad0e410015d04fc07f902d18488f28fe5da7cd999ebd026c8a31f31cc74be693cd42a2e46810479dfc210203010001a35d305b300c0603551d130101ff04023000300b0603551d0f040403020780301d0603551d0e04160414f58703bb33ce1b73ee02eccdee5b8817518fe3db301f0603551d23041830168014f58703bb33ce1b73ee02eccdee5b8817518fe3db300d06092a864886f70d01010b05000382020100c02e12417b738516c8db8679e8f5cd44f4c6e281235e47cbab25f11e583e317f78ad85ebfe148860f77fd226a2f4982afdba050c203312cc4d1461648193d333edc8fff178cc5f519f09d7be0d5c74fd9bdf524ac9a871253304106736d0b30bc9a14072ae417b68e6e47bd028f76de73f50fc917c9156d4dfa6bbe84d1b58aa28fac119eb112f248b7cc5a98626aa6eb79bd5f806fb02527b9c9ea1e0078b5ee4b85529f648521c1b542d46d8e571b960d145b592898a63582ab3c6b276e23c825904ae5ac4997b2e4b4657b82924b2fdee2c0da483fa652a07358b97cfbd962ed17e6cc21e87b66c7665b5b262da8be973e3db33dd133a17636a76de8d8fe04761283a83ff8fe7c7e04aa3e507cfe98c35352ee7806631bf91580ae1253d38d3a4f059344707620fbe30dd818858f028b096e582f805b71301bcfac61f8672ccf9ee8ed9d6048c246cbf0f5d3739cf45c1933ad2ed5c5879748662307e8ebbdd7aa9edca40cb6247f4b49f527f7263a8f02baf452a48196de3fbf9196669c8cc62876c532b2d6e906c543a822541cb186aa422a8a1c447d781001c15510f1aafef9fa6618cbd6b8bede6ac0eb63a4c92e60f910a0f71c7a0b90d3a175a6f35c8e7504f46e870604806828b6658e673919c123d358e46ad5af5b3db692104fdd31cdf949d56b00ad195768dec9edd0b159764ade5f26202fc9e5f56423905b3", 0x559, r9) keyctl$KEYCTL_PKEY_VERIFY(0x1c, &(0x7f0000000080)={r10}, &(0x7f00000008c0)=ANY=[], 0x0, &(0x7f0000000880)) (async) ioctl$BTRFS_IOC_BALANCE_V2(r2, 0xc4009420, &(0x7f0000000940)={0x12, 0x5, {0x2, @struct={0xb, 0xc}, r4, 0xfff, 0xa5c, 0x79, 0x0, 0x5729, 0x2, @usage, 0xa, 0x6f78, [0x2, 0x2, 0x5, 0x7, 0x2, 0x8000000000000001]}, {0xf, @usage=0x401, r7, 0x0, 0x3, 0xffff, 0x8000000000000000, 0x9, 0x40b, @usage=0x4, 0x4, 0x4, [0x9, 0x0, 0x1, 0x2, 0x9, 0x1]}, {0x9, @usage=0x4, r8, 0x7, 0x1495, 0x6, 0x1, 0x1, 0x0, @struct={0xfffffffb, 0xff}, 0x5, 0x7, [0x9, 0x2, 0x8, 0x0, 0x5, 0x1]}, {0x7fffffff, 0x3, 0x3}}) (async) ioctl$BTRFS_IOC_SCRUB_PROGRESS(0xffffffffffffffff, 0xc400941d, &(0x7f0000000340)={r4, 0xfffffffffffffff0, 0x81, 0x1}) (async) r11 = syz_usb_connect$printer(0x2, 0x2d, &(0x7f00000000c0)={{0x12, 0x1, 0x110, 0x7, 0x1, 0x3, 0x40, 0x4b8, 0x202, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x1, 0xfb, 0xb0, 0xc, "", [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, "", {{{0x9, 0x5, 0x1, 0x2, 0x20}}}}}]}}]}}, 0x0) (async, rerun: 64) r12 = syz_open_dev$usbfs(&(0x7f0000001a00), 0x2, 0x440) (rerun: 64) ioctl$USBDEVFS_FORBID_SUSPEND(r12, 0x5521) syz_usb_control_io$printer(r11, &(0x7f0000001100)={0x14, 0x0, &(0x7f0000000300)={0x0, 0x3, 0x2, @string={0x2}}}, 0x0) (async) syz_usb_control_io(r11, 0x0, 0x0) syz_usb_control_io$uac2(r0, &(0x7f00000001c0)={0x14, &(0x7f0000000000)={0x0, 0x22, 0x3c, {0x3c, 0x0, "3bad8b52c5893bd3b6c56a4a7bec89a3ef0937a1fe5e23bee733b9689e530f2bd8eea4102dd2b9ef2ac1f425474186dbe907802f153e35df1e75"}}, &(0x7f0000000100)={0x0, 0x3, 0x8b, @string={0x8b, 0x3, "b54d73d62ccae499978ebdf0e845bc8251d4527bbb54e3cc80d862283b2b8bd73ac7ca576915751cade7d35c2b95ec6a805b5ed308529c5d4bba1e358a32a6a47c4346bcb4c11f2cfbc1afbc748f298fb6f3589da342b15131272e939c90731ef7bc8c66d1202ed57052de6a0bfe72ff108191f5884291cfa10ffc308588e2a7f271c857bdb26116d4"}}}, 0xfffffffffffffffd) (async, rerun: 64) syz_usb_control_io(r11, 0x0, 0x0) (async, rerun: 64) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) r13 = syz_open_dev$char_usb(0xc, 0xb4, 0x80000000) write$char_usb(r13, &(0x7f00000007c0)="0bcde56ca9a62cbf", 0x8) 4.113056477s ago: executing program 5 (id=4037): r0 = syz_usb_connect(0x0, 0x8a, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004082057d0000000000000109027800030100c0000904000000010100000904000101010100000705830340000109040100000102000009040101010102000007058101000201072401010101000b2402010203180144ac0009040200000102000009040201010102000007050201000201072401010101000b2402010203180144ac00"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) nanosleep(&(0x7f0000000100)={0x0, 0x1dcd6500}, 0x0) (async) nanosleep(&(0x7f0000000100)={0x0, 0x1dcd6500}, 0x0) r1 = socket$kcm(0xa, 0x5, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0x4, &(0x7f0000000580)=ANY=[@ANYBLOB="18010000000000000000000000000000850000007a00000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r2, 0x0, 0xe, 0x0, &(0x7f0000000640)="e0b9540db7f96a7ed38703e9ab02", 0x0, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) (async) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r2, 0x0, 0xe, 0x0, &(0x7f0000000640)="e0b9540db7f96a7ed38703e9ab02", 0x0, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$sock_kcm_SIOCKCMCLONE(r1, 0x890b, 0x0) (async) ioctl$sock_kcm_SIOCKCMCLONE(r1, 0x890b, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000200), 0x2, 0x0) nanosleep(&(0x7f0000000100)={0x0, 0x1dcd6500}, 0x0) (async) nanosleep(&(0x7f0000000100)={0x0, 0x1dcd6500}, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000200), 0x2, 0x0) r3 = open(&(0x7f00000001c0)='./file0\x00', 0x60840, 0x5a) fcntl$setlease(r3, 0x400, 0x1) ioctl$SNDCTL_DSP_CHANNELS(r3, 0xc0045006, &(0x7f00000000c0)=0x6) nanosleep(&(0x7f0000000100)={0x0, 0x1dcd6500}, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000200), 0x2, 0x480241) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_buf(r4, 0x29, 0x20, &(0x7f0000000380)="0bbb268dd6ffa80800000000000000000000210d0000aaa8fa0172ffff9301001400000000000000290000000400000000000000", 0x34) nanosleep(&(0x7f0000000100)={0x0, 0x1dcd6500}, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000200), 0x2, 0x0) 3.855493269s ago: executing program 5 (id=4038): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) (async) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x69, 0x0, 0x0) (async) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000080)={0x2, 0x0, [{0x4b564d02, 0xec000000, 0xcd}, {0x4b564d02}]}) (async) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x1, 0x0) ioctl$KVM_GET_MSRS_sys(r3, 0xc008ae88, &(0x7f0000000240)={0x1, 0x0, [{0x48a}]}) (async) syz_usb_connect(0x5, 0x2d, &(0x7f0000000040)=ANY=[], 0x0) 3.802542001s ago: executing program 3 (id=4039): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) connect$packet(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x1000000, 0x100010, r2, 0xa94000) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000dc0)={0x38, 0x5, 0x8, 0x9, 0x0, 0x9, 0x0, 0xaa, 0xfa11, 0xffffffff}, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x41, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f0000000dc0)={0x0, 0x9, 0x5, 0x6, 0xe, "e9e2baffffe3559e1bee0208f60509660800"}) r3 = add_key$keyring(&(0x7f0000000080), &(0x7f00000000c0)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r3, 0x0, 0x0) add_key$keyring(&(0x7f0000000340), 0x0, 0x0, 0x0, r3) r4 = syz_create_resource$binfmt(&(0x7f0000001400)='./file0\x00') r5 = openat$vimc1(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r5, 0xc0405610, &(0x7f0000000080)={0xc, 0x5, 0xf497}) openat$binfmt(0xffffffffffffff9c, r4, 0x42, 0x1ff) r6 = syz_open_dev$usbfs(&(0x7f0000000480), 0x100000000003, 0x161341) ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000380)={0x80, 0x6, 0xf00, 0x6, 0x0, 0xfffffff9, 0x0}) r7 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000180)='./file0\x00', 0x0, 0x2000413, &(0x7f00000002c0)={{'fd', 0x3d, r7}, 0x2c, {'rootmode', 0x3d, 0x8000}}) syz_fuse_handle_req(r7, &(0x7f00000042c0)="0d9ec529eb18ec94a35378619cb10ff8c913f67139447b7ee0cca809e36c363ba1d3975a7446b70c6bdd99e2cff540eda7589ea89efeb498df568916036f0848ede5f089bf502b483c67c0432c34b98b1bc085a99e2981103397e0b0eed2ec64c1075798b56a42ea532091f5326c97622a47c53fbf42e71c3ed4b954c559424b49a13598c6c63ef65b62384b038b3e6e98ebecd178289831eaecd986a01c751e8cca7a57c009f2b5310fe9dd8a63b91c4b5b13d1c44d2b874b32ae3e961b9e96a511ffaa3ed20248dfb470460d305e44ffcd287b355380319fd31f7538c6d00de06ddb8f72b3a59c4699c94d7379e1e190c6dd7786e12096f9e963a038b6b4375535047135ecc07b16035ceeb27ed09d77f52b6eae27a03071e060b05bf347b9ba44a984e5db346d230ae9c5324ecfd4e7725bc5019a9f4d20237c820359d73b82f9c668ae71f6b85d5350140a16f988bb2b8010effb52636e0b728be1b1ed37c1b8868ec67edd52951dbf65b479aa25e92667a98c755d88995e6303a48a64317bd4b201fc6dea59381abfb5e0fb1035bbd32a97a6324b08f404fe3991879a0c6362032864031737941d9cc534697da61a43c8723ecd1062906b65c504d86383cdf9631f228372b13aee64f8ea8db00dffc37fa092ab5daeb7431dab37091c44f91c9202df60876a6e06ceee3e6a095406fe5cc1f83de1a4adf36fbef5a94a622132cc85e56fb53a9cff67bc69a24d8c259ccfe19b1925061f0cad95d6b4158c1394b8acfa9a8f52a566c6cb4e0b14dd30c85b309289a5f395e01d981735f6fce6ab30994643d70b2f322b7a233a339e621ea2eb00a0082a175c231b330a58062680546c28db8ff5b7e66c0e3df0a9b74ab72abfd241fcbe1e3d27a2d1eab44cf88180dcef4482c866324133f9e4780b891a7c5000b005cab0c131c225e944fd1aab5de9e8d17b8770b4472b6e4a13b6cce90ba152e5144acf74cd8a9821ce3eae72dc7ddc81b76482226098329c3a8ecb923822610aa0b086f44329522dd8f9ae355b4666d1a10911ef8e21377578b42fe6ee0b2a77917157488d6e0bb388951f80551dcaebf212b396d1f922aec595bd340390d310f6006c4b3efdd80838f39d25470db39d6205ba8f52bac634f8145a3c10ed007acc2f25c5dbfe911f18f44a0c57cee33725eb8c5f2d9112f91787c2c323b67b67d9d1f593f16430d77189d4678fd8d7c11c1f2d744ad59a03a8cffc52ee0293c90b00d61897c80184aa63fcf43c109b06af20c808035af0a0bf9cbe544681768f92a2ebe3b4458dd020fb0550822bc2f769631e00d63bd91e7100299bbc4ce53a35e993e24028dc5c81d46f5377d21f2f38a9688ed981044346b865161b68f3390a50c2e625052396cdb6637e9434904c63d8ca45aa2325626293cdd9cd0179b1d995be10281fa8d281db16320f520e42af268ff30dc2d8885aa3d9e7f294eadb4d827d195cd5d18632928f2153261345c231efd143288b881638b61dc5dab8114c1948d83b8ac4e278f131ec3eef4e87e43a36f4b41a699a741ef3a7cd4f0bc5dbd2dffb1d223a5c5b38b98e49092631a176d15c4f3c077d639726a3482bf2fdc73c2bdb09208aaf90bc64b5fee89d231bb1679de3e5d31662db2c5824ce9941f94500e5a11b8fe79da548efed8cc44e9bc1d5175dd77fc16f8219a83b83ccce2181bf411b0945312598817e08e5277530eccffff17d198613cc8c991349141ced56e79031ab6cb98f3f39e5f20bac76017083041a1ee99ca257d0e0cf95e59617139afb08cf0c6a607d3f2ac2b5d3f4394a4a063c9769bb884ec522d46138228c7e9b5c7ea5e3a6c70815b565ce15a13fd0a5deb28e710c15fe25c744b430b4f6482532fb96566381c56e12632cab5acb5e08d6f973003c96a7d81ff76966e0f93c83c462bfcef230939e48c4983bfed78f68b0f540d1fff2196cbd1f1c1a1c310ec10f5a2745407000bc6db1fcc8540282cc7e96cf5582c4eaf874a2fe6369534176429b7505eb0aade883260806be2d86a42e76b315a76e5f686ca669f49e1f9054a77b8eaff14a43e9a9801244e8e94ff50a17b60dee0122ea70819bae3375070466c7f202c4ea0fc0c9aaae50c43cb65febea224c2b554e937f67689b3e18ed543749a7ef0997a7a7530b918c4ef935137137e1ee7e6a8919fb76a8f008ddcc2d8b2e18f3eb90f7a13cf4f49170ccf50c75de82e92a5e2d1f311e59071ff202b6cae4d6243fc3787cb9fbd401938cc18dcf5620f8b8f74e9e3b13dcde85ef896f31f5a2458118addae77206ab1506882f91873b4828950a7b91ddae74888155a9c486c7c60492813ac0e33362dc4e21e00538e5b05b78271d82486a0d156d4a5a07085bb1cd74f5d63763f18648a489352b5d05107909fe54b5d332cde2900c82c150b11071e028eeb275cc9a9614f1eda4e4830b128870e732d473100c24152aff2aa1659daa65d7e9591ebfcae5dca4e84c9a0965a01668e59843ef4a093d9b01067a0ae9d09e3d810c2cb63600ee05b10fc8685e8cb150e2d6d75baecfb8762f7a7d131417eb0721e19e1d21f5adcc1e09489f06b81d91b48608107fc7b3853e214a3c786a9812113ccbcf09907506d0e9cd72c79793584b4fe06a18a627bd969f628a5936367961f1e7d117d03a8fabc85f5ecdd0ddcfae49aa293893a2e5ae376be11031abc0e05ff250b35926345b52f8d3dc02b7497f7513e759247353db9b8e493120e73981aef4c4d9747621537a089848754c14cda1cad18084274e98ea2bf7400ca846184e0e31a571f9bd770222b1038a4ce60dcf8fe9cca4d60048cc29c37c1345de992e9dc7128ef093c1ce80232a88a3da7ae8bc87120c5b1f405d5186141288998fed9e021cd0ad6b12b51c217849390be3ea00cbd6c755958140bfb9b2a2765ad1f51ac045fdc5c28ee5886b1436015b88bd90d19328f91394110b0d891678e63b63d6cc4d35279f6f616d7692c6fe177a79d80ae8f7e4ad5078d8d7096f3ee664dcdb2f634eba98f4788de1f5e34f32ef09e2f0aee4fdc5bec4bc4aeec5721ac3a2da1bf52da017c3312095403d50dcde39671242b610f13132773796557f71455376a7741ab242a9fc94464180bf224d5e8c79b462e3a816f6c08ab0f5503386d34ddfd808b4b8d5d333548d4b873923c6c297b2fa1abe433ec9264385c50dca40316c37ed85db382e7c853ba331c727043cb3345de9f89b1c804e98205eda3d6b6e042c9c41877d456dcb8f12663e6dc1ba809229536fbcc4c58d01a137eb80af8596dfc7b5fa7a044cd141238aa82e440526e55a28c4ed2f4b26157a0eebb4a77c5ab66fcce2602e1a70aea07e5e7e7e5321d58ad128a5ea6b574730037f24a7300e0ad6fc96bd18e03763bbbf21bd3c388aff1cc5ea13728ba2f8e1eb70148d2603e55bb01cce0763c2020b5627a0ccb35ae3a9b3df380e6d9800d9506219a90971a3b8bde1dae6a43fce2aaecbc026be8f4e9bd749e10c87ed7d78f92014342fa449eef28e7175548e5a8ec4fe7d31fc86737aee63ef40b54485380b6898161676f0d82f76113b12a529fbce4482dd278a90aa416077c677aea623ddb3761bc81527ab7e3d73a3b4c8c3e4352c7c083cee8953ebd972a83caed837587e8d7cf360f28ce6ca71de75c9174e8744ba1098513bb6c7fdc6a3c7c8e5870223d6cc0b18b5d6edea926d5376aeb85488d3712e8f67128f0d3fb2b42f82363a0d4c1c806ff283f6e4ddc10ce4a0803be66a247207d6606c7dd67cd293dada159016d7fd7e88c4df53d09bdd9fd9fa3c732da45fb92bdf6f442eda15edd97bf1928a7699008f0b482240a684ff5efef0cadbf1b4f16888650d59b2bdaeae0d1112a79c5522dd0933ccc16fed7cd0ccabe929f625de8947b3b1532dc04253cca988a1584df2b31492b19410d6f681d614eaa20029592c00c948a98973a9fba87f1397f8859ba543edeb5c0b0db92f65462a1103947d780b539433332d65bd1418bc00c9e815f73e0cc0aca5fcc9f95f707c455013a55a0c4a29093b05b94edc5b5284ec7ccf3ec091002b4229036c174e2927127f40769ece890612bbeb960d9392f442765a2ca8990c52ad7d4441e975a7cf079d139945f2b2a8a34f0e85d76cbc96efbb52cf8b5ae681234e14b6648244d41cfee2d9b189cd831cc2f31ae7e5f11aaaff1629f8c2cf73494ac38e58da7010dd986f8b6134ee0dabfdcb30617d15720cffbec7651f22253aea21696d2ece4fe026543ea2f3473e4c12e65dbb3cbf764ffa0b3a396382b9b7f0c24eaaf3495554b2319b66f3cabf01a8d6cfd1382d94ab71cd11eae2a42e4dc841d4a9732c395688d3377c8ccff7e3f88a3129855a5f41a7de6b6a9ac40a87c288f4821295edfc4f5b8fe5a1fc0162e9820205c809935cc6047e8a835c651be02fb41c21de30ac770d7a7f2108c6a3f1cf2649cac444f028a6ebf4db422cbbdb7fd0cb39109a3130ffae17810bb58f5c557c99670224c2678fa07f1064911e6c665c0d1c26cd2f40f7089789208a48eb339bb8885910e035b4b8c69b1c3ad79270ac6e70b963493a6628b90501822878cdfac866268d914d8af2814612b0198f9e4c6b48e739e414d61f34e2f69ff7cdc4fc7ffe45a64c5faf191ef6c4e31cecebe09a2f6a63d60926ebaa7e925ccea5c93e403c7ec0ee55423ce4893471440006d4c09c141e489dda5577f73b57ecfc764ee5bc1bc88f7866dc6a494e3ee560c956dc12ae51842030251f1cedf2caca15549d0bb4ee3bef03702197350cd7586b5916ef6a0abcb5f30548d22ce5d8c4dbd82030b8d7b5481c51676b7d14d35c20346c74dcc7d96ea0b13f890f755a219993e88739da8246283ebbd82eb1b15956b5ec16ad523768c19ceba9199f97d7bb43b85fa11349ff7fb89a97b463b34c584ae9e2af6c8f20ab528750a22ff6c2297e400065fbd9a4660ec2c658afff6db9b67070352d2aa5e6cfe534eeb5ff271575b828dfd7f537e3627a1a6419ed0c84297fc3d362a52f3860a2eb7ae0a50f06d3c68c4a1463ec331ead7af2dba792332218b04d5b585de1a471d296df6e10316852d50f211e07643f749a1d75410e66e47db40bfcefe4b708d0b2879a50ccbd85939b89fe4b905a6a89a2d5a4e28d18c048e66108a06d8b6a64ec5737b5ae283d914484167c8ac7dde7ec007aad1999854c4d6a0e5f887f99de3662610d5e8d49bac7d41d6fb7d90b4b04939638e2151ba67e75362aded50edfb7d9919b345b5b7df6a909193ce64b20470e3480c68bd764968f4d8a5779ffd9a35e58558272a214ae26a094360b9f2ec97c5e0a7693f4b7509b962cd8537e90ce7be70b54e9531e7295f894b94566df49c50c2265842392dff50e17ed3f7beb9ba4ad0520a73db1d8d3b39759e7fffcbf26517316bc74437fef944fc915ec24affc1a53748cfc883e3ddea9e25063ea8383b06f0d5c9db13a0ff335f52699226b391543060ae5e2c25b585b9efdd5ff9495a4873cac58b5feff5f08717b04e81bfea349accc58fcc6a6505de3aa6ff4985d9c38bb83e8daa663ccb356df3ed52343ed7723687e416816f987c565eae22c7548c1d6b56a5b6819583da0ddf92739f65e604e37b3275a6cb1252d4ef7a515c4b1e9068d714be80066bf0d422f1e4d2ce6f95c9eac081d6e4596a6a8e16a57b732b575b7de16f176ff0e34e84b293d3fd77fa30a7b7cf12a1edd54170e56bf7f2d40620ad56acbc5cc615556300ff9e95ce3dda93c8333f23f0d97a5da12a0fe58f95d6b911f614563d343ac6e4f9fee1d149c94fc75a97ac839b6d8d7b27c5efb870d2bfc6dbe6b688490b23597d83982d7858215c59011042b1957a0b386842621c72f89a9b524008794ffa0c179753ab48d0f73e5ff13624b3b90287edaf6a5367dcfe4094a21ffad3e881b428b77ccac6924d5bde9c781d4189654d8f29885fbde070a004c6406dd3ece359c6ac7c6147f5c4906e56764e9980a669bfdddd9eb780e7f9988630d1eb098b3e4fd4c795f11441fb6d0ff7cf086eb291b1ec8d90092e1eaf9722ccdcd15408617cdb8c49043bf71a6ea0ee6b7e840344fbcd377b995bfb1faf22754fcb363f6c630501b619bbd87cc13d5df0948a176771d2d69236eb50dd313817d9687967e7d71f854db6bff803f4501d999dfe3da37ccfdf894a7914c4c113fa7a18c3468a52d646a5070614a6f02b7ff21c9f6927f5de55be85ba815f4bb9e29f26a94423c58338947c804e0627d69bc5a6e93fc5fe8cae851700253f2d494622c6127b4d77bf54a1ac27957234628cbe2fea1729ec53be7d90806d510ccddfd76fab1b9bf1207db8b05c3eaa88fa4c0a5db13cec9310f4e02c1d8114705446fd6649df3829aa12786b8d10b4540d8c1f1c8208c4b41998435e3fa1ec5199cb2d3d0c5c04c5e0b3ffd69112252106bb39333ff23b38d167a9b45ad1bdabf434c8695e2676d461b34c5f048e70b67a44d824baa090c8be13a22ef0d0970cc7a94ed4b77bfc3a40427c6c11abd2b415817243f6801d535a3adc9924a1671b645100e822a0c1876a37d9c9e230e3d762f1cfbb89a8b28255ba4cc5b46cb1635cf185578fa068b68bac93991982b48e7faacc09745a7e33bb12de6b25a2342a7e03cff06dde29b4d05de84e56c78fc6d9dcd180438da3136767d5846bfe7168faeac5b9434394bd747126c5c1ecc6621d10817ce9b6540433828a3bb8f6da0cd8f2b54a47cd5473f6bc3dc1234bd115a6890aa678d1bce7840d7a4559cda556740860079e46217c20e45ee59b8b7078d9b70cb6a249eb2e5e4071d044f456fb61649f261689b8d7a532afaf88eb30041242ce491fb7e654a1f06add370e2706f75c2fe1afe8e065804414c660ec4d96f496b1ad87592de8b7d04baa7ab142f580f262c64c57fce8ef933f18904f001809cfdf94eb679c9eced5d125b4f1d0064ca2ccf5eaf61bb7841bd408ae213deeb15d860f7ee7224b9d2dd38ee9f6c3fca6590335715c218db8f8c98e6339a6944817a1ce2e115ae984699861631b9893c143f594d6dde0895a0c7edb9912f3fcd8fd0765227b3963033306d15711387044bc373ac10d7be73cd80f1a79cf1ea0989ea9ae8a0dbbd1227bc33df652792a6bd95f1d21c6497c4c35b9a1eadc0217e322285a2eb832753aae74ef42fc983e58a126b7c23e4b0bac16f0de1eff7d41477bb25052f32cc9cc956ebd209d6b945b1fa9182857e180672a6be7edeb5234830668b1ea749d0a0dd3a244684d4dd76221c3bdf98c2f1eacb7a6dcccafd249b0ba2592c88790de40895799ea4dfb045cc2392dbb623bfe420b24e5a425b84a4b24d787a68bbec9db363ac4e9453df597f0224d8b7b21629e1989e53accbae97e189cf9b59ebf8bb89591fe3fda450af548ffc46eff98b5216e238a9246e2fb95810f8f4d89504633a6d223484a765b9e6e5497159b31c51fa6cc10641bafa81b10c5ab853f3136fa1b4334bcbde99cb4689f077ca3c29c2f1aca2a05762943073d5992aac4d9b0d411ba25905c34fd02b8eb7b9db375a6f6516446cc195eb55eda1e007e26328e9e2642a9c4e90c56440cc60a1db77713860a56820901b3022d55c621e9d54f759dd17fc5b59331c63cf30e07081bf0cdee6cc94ddfe8c6179e7ed86607d4ba7d5f1e97fbc1139b43ae5fd04c1c715f4600f028d0852a421d472b1b48e591b6edfebcd86be3db2caf967b06776096e14f0deffc9bb126ec329c49ada996b963e942d9c404967dc23bdbd0eee951b2879f2ef7ae224d4ff25edac4ddeb2c0b8e579af283e87c625d3fae5286fa855930e45207af7054763937a9247dc38e37e6dee2e325b617280846012e463707b6ccfa2fc399a66e534221a45626cd18c79d46f5c77c2d359e19ea870cd230709b5e33cd52fd43388ef91dea0a1e0df6c72688d9fd32bb67f489a3618604ef1dfa0d7f569d40cc68e39994e4edab4007c988998f59485ce4723c1eeb7c72f7e833418bab47735a91c7ab24e8555d2ccf3a812b6c634c0c3a68271ec8b536aaa442e056945feca6fb4e54d2cf60a0334f494b2bdb6fbd597de0ce9d2cf03333a0c7121e086aa4c657360fbfb60f3ce0fc0d90ff12b03464e8ff0e5e546ff79735c5c800a0f9b680a478c772f60173a760e280d8287681986038444f2103e2894d5809d062cfe8380e34bca86475da3d7634131c2a8cdc98c5927bc137db61f94eaf9a74f87cc85072c201766eae17fbd5b732859fb1b1c980b36e377aa41a95bca18ccea529420e742899af7b968c1fb9c0d181da9f86358dbeea877c3e9123a9289c362fa61d96c707ac94b427318a1e5f21078aa9d1fd7a52704e0d73e527f3ca65b7b459734dd30db5335c450f1dbcc1e4259d657d13b6d6b4adddc3d0eae034d1878cd0aa1825991d75f8e6b5b4c0d6d17e8ce709b19ff794a8ef856abdfac65cd13631f1b66b20f2ebf2f3122d18e03cbfff88206a5998fc3cb2b40634fcecdb8f5bdbfe044dbf169ccd2cd60f7bf033272f38f587943fcc75d2d65d9028c02891c8415706c2b2459b7a3c5cc82b0446088d3b3bcc033ad453136afd4ac4678320fc17288dbfa1c5180ad57508a2a298ed4ebc716ede34fded574d9779be5d56517d4dd40f197312390c488f46914b0927b13901ce70c1684801f2811168fab533998a1fdabbb6e683abfa021f6b80077f19455c34cecf5dbdb2fa6e3930eb5940cb14504050cc74249424310dff81116b8f2076b8ebece84c302e758fa90af5a1888aa8a5a2bff4aeb7ebd1c7a216bdbb84bf9c021caf3c8efbfdc5d3aede46381bcda372a5398c89868ad57287736fec2a7e8ed638974fde5875eafa506a6bd7f772d2b221f4bde4920fe0c56f8e0847e2a7e8387c64ddef4203d77a526c46d7871befe0c5f9128bd67319acd963fc040185aac4e7815f728bbd7ffd8f3d125e63320182f202fa9a52505be9585556a5d1308c118ccdf01978027cbace7ab339d6f53d15e795b7f3fedae4f86c3f257ed80ee634375dc2333ceed1ccaeab1b6be7a9611ff33d79dccdec2007558c06dfc06612d56d37882e5f1de340cf05f4fffbe1a5def6d045bc5bdaf633f07360f9028cedd103bf03fec8beb9fdbf8c5fc684d12efae1859c53e2cc3e2f508a9cd0410ec036648d3760dd591f7ae04e4cdd61a2566319c943f0b63d87e422dfe5c0d1edcb2dc515778a0d7bb2c93ced3b1435adbc51d3fdca9c13679397bc4490093d64869998d6a28bb862ead0fa411585289cc00dc199eac6c607b8a84123dad3be80dd8fd86aa202113131046336352235f34c05f5ea6d5265adda98edbbfd11d6839c5b1bfe4fad4e688558d633d4a281df44d9c0a35abd464e01f8ab01a1e272cc8cd155a40b8aca4c6b1dc894c0fdc02f15a8f67ce94c7f99b6fcc0e4a3a8a71365645ad7809d47bb26f46ed8bd02f6e8f3d277224f82f3d41695f367e343ac6d507413f4bdacf9e344a49156c4de36d68c075415f8004748055b38b8a4110f869fafcc59cdae5663eda72a05be365a50e98bfd4b00e35aef687afae7bd6622cdd725326776f6fb1476c8cf8c20a0e5223e2bea494a1bbe4e79b25a5e48ba34bc66a84ecc4a0aba98e74ca2b1f61893e61a29498d855a778a2a9ce7b7fcaa44b4aedcbd0e28d6c49bdb6776975bf69161f372b964e4288ce6a3b877c3126f90c4c9749d45b8c5c840983b035993e484a945be5fc9d2d1bd3f3de4e6de7bc74a7a07b13e9e82acc11db85454f1d928fe52ad42ca783fd20dd3e94471b498c2736af40d2a45ff74f9ef874639e33306daa8a667674571e2ed93a48f49b57e9e3382fa8090774bc795609ee510b6a1ca48d9833819cbe8ac77eeebb0e3b6c59ced2d1ab355264934ff1914a3f654249bba60a692dd36368b8a866b333320e57e9c7d3646c375696ff14e303780ffd7b957d89ccdf57823d2d1e158773c2075233dd2f331eafe3802da683c293eaa24cd8b63a7582ddb202cd6f8c837c74f823727641c7eb680fe51ce7f250adb34956e4cab17b8a5f10edf144c700e376c682dd46c8fc89830fee1a44fafe0a5a2e7581d5d16ad6267d1dc2d5be8547f9352d1591b42de94f2559b44a80038360c6394541a77d95b196558a479b609882fc597b9cbe285ad7c7a41133ed85c8ab6e6dec5bf70f9e787985512d48865022705098a6703b255a6f2b05b62fc7ab32e67f06d785ccb33fb348205a76939e6c2991486c5aae8ec1556b2f8e30ca445a4a495cbf2c6013042b8cea615e58899fccbbf1fc4f17a6dc37e46b17ada0be033dc67904fbd7903086d3417e423af64338426a84ca0c2a3252db62695f9cdf10ebc09b9da5747d30e7f4adfb374e1d2bb24542b0373b1fb897690b49fe24d8575ec9800f019c9c76459421c11f002989ac82c13c04a202cf7f9f38b053f9a680d4d5012887a11d25cad201df20a4eee6d2c0474055579ac729c7514a88b1675bbf6b773448c6c1a5ccd157f44f7e032a6b848f2e734d773f029e48fd13c90d41666f9bd4e9bea91950737b6e7502f9d2677938f240e3f905d6095bb0f8bbe961b99b2d025538c3888bfff8957e3592ee5326a75399b59c697f59fcdfbbe3bcffb8777340875611bf75486d2378e68de771800bfffe0572fb36ca855ec5fc8cb90c76455773c36ec40b101fb30c48f8a8e775f5220e024b4da9dddc2fcf4da413e7c5db9e0567cbb5fad0c91d779a0939debd9247d3f7d8107fd986f73a9c9067e6594fabde0b9e887040cfbe7d31332f41259de57b38f33275597725392efea51f290b8e1b5c243ffd9eb4c0231600f9b4b204344736849d527156c4720a463bbe88fbbdc333099d949853d5c6fda98bcd35ad3f1fb1d5a7d00541a8a202c8590e35360bb9d25d6431476649e1898f901fad37975d6dce9833956e7a78d0306f533d4aa3c9676017c7abc7e1f8f2f117774a4f5beba55d1c3cd580fb18defccc349cce24e94a4cf1f4c6f45d783ee0167a55369c9b5e1eb6d0a836f3eb2354fad3cd771a9d777ff84c63120baee86ddc52b3e6817dce339ac9c240e75f3e2f77afbffbc1d54eb5936d045370ce3b77365c5320892dc7bc36e488019461d2e552969de9f25bd8de049d693be450c43c5d22d7569fc384e8d56ddb577c5f3c3471f5ba2998bc0c697a06b6d8ba5f2f7236e78aaed69b468e761a5f07145c0326ebb94f50aaa8c5666c92006d8d139036f981003933f8e2eba106a0e251fa9f5407544e44aedbbb271a3bf1c660a9cb8c74dbd0713aaebba2dd046af8b9428709646521d6bf387a92996b35748e1e67b602309b7da0fb642e89de19f550925f4db082ef7e9821ac4b2aee93c9cf791c086751c4cb4172608a4f903dc40727858046851529205b45786e294c17abf5e5f6bc730cbfb8fd977c5501a8140ac7984a267880b53cb94157be9ac157be1cf12d8a9e5612947772b734ed6ae30e548a3b2faecf94a7e03f86317f52ac797aefb957d2a29de8f8ced414ce22c800e0dc7e49d3672fca633248f3e68c00", 0x2000, 0x0) execveat$binfmt(0xffffffffffffff9c, r4, 0x0, 0x0, 0x0) write$FUSE_NOTIFY_STORE(r7, 0x0, 0x0) r8 = socket(0x400000000010, 0x3, 0x0) r9 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r10, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xe}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x42}}}]}, 0x38}}, 0x0) 3.204740604s ago: executing program 2 (id=4040): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="120100008e88052086800095d89301020301090212000100000000090401"], 0x0) r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000000380)=ANY=[], 0x0) syz_usb_control_io$hid(r1, &(0x7f0000000180)={0x24, 0x0, &(0x7f0000000340)=ANY=[@ANYRESDEC=r0, @ANYRES32=r0], 0x0, 0x0}, 0x0) socket$inet6(0xa, 0x805, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[], 0x28}, 0x1, 0x0, 0x0, 0x24004894}, 0x40) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x0, 0x0}, &(0x7f0000000140)=0x10) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r3 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000900)={0x41, 0x4}, 0x10) r4 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r4, 0x10f, 0x87, &(0x7f00000001c0)={0x40}, 0x10) r5 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r5, 0x10f, 0x87, &(0x7f0000000280)={0x41, 0x0, 0x2}, 0x10) sendmsg$tipc(r5, &(0x7f0000000240)={&(0x7f0000000080), 0x10, 0x0}, 0x0) r6 = socket$tipc(0x1e, 0x0, 0x0) setsockopt$TIPC_GROUP_JOIN(r6, 0x10f, 0x87, &(0x7f0000000000)={0x41, 0x0, 0x1}, 0x10) sendmsg$tipc(r6, &(0x7f0000000180)={&(0x7f0000000080)=@nameseq={0x1e, 0x1, 0x0, {0x41}}, 0x10, 0x0}, 0x0) sendmsg$tipc(r5, &(0x7f0000000240)={&(0x7f00000002c0)=@name={0x1e, 0x2, 0x2, {{0x42, 0x107}, 0x2}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x20044050}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="44000000100000082abd7000ffffffff00000000eb5372db4b6255e833e5846f08784bb306d9d1c2440e2e5bb2", @ANYRES32=0x0, @ANYBLOB="6cf2040000c000001c0016801800018014000a000aa3000000000000c65d00000000000008001b005a000000"], 0x44}, 0x1, 0x0, 0x0, 0x240040c2}, 0x48080) r8 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2603) ioctl$I2C_SMBUS(r8, 0x720, &(0x7f0000000100)={0x0, 0x6, 0x2, &(0x7f0000000140)={0x2, "1a9c66bf2f615e427b2644e953449f6c12f206b2855cd8c82b1b9950cf5e1dee93"}}) r9 = syz_open_dev$I2C(&(0x7f0000000000), 0x2, 0x941242) syz_open_dev$dri(&(0x7f0000000080), 0x0, 0x0) close(0x3) ioctl$I2C_RDWR(r9, 0x707, &(0x7f00000000c0)={&(0x7f00000003c0)=[{0x1e, 0x14400, 0x0, 0x0}], 0x34}) 2.911588108s ago: executing program 5 (id=4041): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000180)={'wlan0\x00'}) sendmsg$NL80211_CMD_NEW_STATION(r0, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000280)={0x0, 0x30}}, 0x0) 2.687469876s ago: executing program 5 (id=4043): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000780)=ANY=[@ANYBLOB="12010000cf8bed20d90f25004029000000010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000580)={0x24, &(0x7f0000000700)=ANY=[@ANYBLOB="201109"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$I2C_RDWR(0xffffffffffffffff, 0x707, &(0x7f00000000c0)={&(0x7f00000002c0)=[{0x5, 0x0, 0x0, 0x0}, {0x99, 0x2000, 0x2000, 0x0}, {0xfffe, 0x200, 0x0, 0x0}], 0x3}) 2.523709578s ago: executing program 0 (id=4044): r0 = syz_open_dev$dri(&(0x7f0000000180), 0x78, 0xa02) set_mempolicy(0x8006, &(0x7f0000000040)=0xfff, 0x5) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x3) write$uinput_user_dev(r1, &(0x7f0000000540)={'syz1\x00', {0x6, 0x7fff, 0x0, 0xb}, 0x7, [0x9, 0x8, 0x5, 0x6, 0x6, 0x3, 0xafc, 0x32, 0x838, 0x9, 0x6ff5, 0x9f5, 0x5, 0x1000000, 0x0, 0x6, 0x8001, 0x6, 0x4a4c, 0x3, 0xfffffffd, 0x9, 0x5, 0x8001, 0x5, 0x2, 0xd4a, 0xffefe87a, 0x1, 0x8, 0x9, 0x5a, 0x8, 0x9, 0x0, 0xe, 0xf9c6, 0x3ff, 0x3ff, 0x4, 0xd, 0xff, 0x8, 0x9, 0x80000001, 0x83f5, 0x0, 0x2, 0xfe0, 0x7ff, 0x8, 0x3, 0x4, 0x2, 0xa45, 0x1df, 0xffff, 0x0, 0x2, 0x9, 0xf, 0x101, 0x200, 0x9a0], [0x3, 0x8, 0x6, 0xd, 0x1, 0xad10, 0x6, 0x13a0, 0x86, 0x7fff, 0x101, 0x8, 0x5, 0x1, 0x2, 0xffff, 0x4, 0x4a, 0xf, 0xfffff32a, 0xfffffff7, 0x4c4, 0x400, 0x7f, 0x10000, 0x7, 0x4, 0x8, 0x30, 0x1, 0x1, 0x3, 0x4c6fbc51, 0x10001, 0xd35, 0xa, 0x6, 0x0, 0xfff, 0x200, 0x20, 0x9, 0x0, 0x3ec8d8d2, 0x0, 0x3, 0x3, 0x2, 0x8, 0x0, 0xe51, 0x1, 0x7, 0x8, 0x3, 0x2, 0x0, 0x62, 0x7, 0x6, 0x4, 0x6, 0xfff, 0x4], [0xfffffffd, 0x9, 0x6, 0x10000, 0x6, 0x8, 0xffffffff, 0xfd, 0x20, 0x0, 0x9, 0x74, 0x283, 0x2, 0x4d, 0x6, 0x4, 0x3ff, 0x10000, 0x5, 0x40, 0x4, 0x8, 0x0, 0x4, 0x2, 0x80008001, 0x9, 0x1, 0xffff, 0x5, 0x7, 0x1, 0x9, 0x4, 0xfff, 0x3, 0x0, 0x5, 0x80000001, 0x53c2, 0x4, 0x4, 0x3, 0x80, 0x50, 0x3, 0xc, 0x8, 0x5, 0x4, 0x400, 0x3, 0x5, 0x86, 0x6, 0x400000, 0xb, 0x4, 0x0, 0x420, 0xfe6c, 0x2, 0xfffffff6], [0x3, 0x9, 0xffffffff, 0x2, 0x66, 0xffff, 0x401, 0x6, 0x8, 0x3, 0x101, 0x4, 0x9, 0x7, 0xce, 0x2, 0x8001, 0x1, 0x7, 0x6, 0x601000, 0x9, 0x5, 0xd, 0x1, 0x446, 0x800, 0x2, 0x0, 0x3, 0x2, 0x375, 0xfffffff1, 0x5, 0x5, 0x4, 0x7fff, 0x4, 0x3a2, 0x3, 0x2005, 0x80000001, 0xee6, 0x800, 0x7, 0x3, 0x1, 0x7, 0x3, 0x9, 0xc, 0x3, 0x1, 0x1, 0x3, 0x296, 0x6, 0xb, 0xf, 0x4, 0x6, 0x7, 0xd, 0x400]}, 0x45c) ioctl$UI_DEV_CREATE(r1, 0x5501) write$uinput_user_dev(r1, &(0x7f0000000a40)={'syz1\x00', {0x0, 0x0, 0x6, 0x101}, 0xfffffffd, [0x8, 0x4, 0x0, 0x4, 0x1, 0x1, 0x401, 0x0, 0x4, 0x2, 0x2000, 0x3, 0x10, 0x7, 0x2000007e, 0x5, 0x1, 0x8800003, 0x0, 0x0, 0x6, 0x0, 0x77, 0x90, 0x801, 0x0, 0x2, 0x1000000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x1, 0x3, 0x0, 0x8, 0x0, 0x0, 0xfffffff9, 0x0, 0x3, 0x1, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7ff, 0x3, 0x0, 0x0, 0xffff1e06, 0x3], [0xfffffffd, 0x3, 0x6, 0x4, 0x0, 0x2, 0x3, 0xff, 0x2, 0x0, 0x0, 0x3, 0x0, 0x0, 0x9, 0x6189fbd8, 0x0, 0x400000, 0x0, 0x40000fff, 0x0, 0x0, 0x0, 0xfffffffd, 0x1, 0xffffffff, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, 0x0, 0x9e2b, 0x0, 0xfffffffa, 0x5, 0x7aae62b1, 0x100000, 0x0, 0x40002, 0xffffffff, 0x1c, 0x0, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7ff, 0x7, 0xfd5], [0x0, 0xfffffffc, 0x0, 0xd1, 0x0, 0x914, 0x0, 0xfa, 0x0, 0x0, 0x7, 0x8, 0x4, 0x1, 0x0, 0x3, 0x0, 0xf, 0x0, 0xfffffffc, 0x0, 0x74d3, 0x0, 0xfffffffc, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0xfffffffe, 0x3, 0x8800000, 0x4, 0x0, 0x0, 0x99, 0xfffffffd, 0x0, 0x80, 0x0, 0x0, 0x0, 0x7, 0x836, 0x1, 0xfffffffd, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0xf, 0x0, 0x0, 0x0, 0xe9cb], [0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x4bdf, 0x4a92, 0xf152, 0x0, 0x10004, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0xfffff9bf, 0x0, 0x8000, 0x0, 0x800, 0x81, 0x0, 0x7fffffff, 0x0, 0x0, 0xfffffffe, 0x0, 0x5, 0x8, 0x0, 0x735, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0xb6, 0x1, 0x0, 0x0, 0x3, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x4, 0xcfb0]}, 0x45c) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000140)={0x7, 0x6776, 0x4}) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x2002, 0x0) ioctl$SNDCTL_DSP_SETFMT(r2, 0xc0045005, &(0x7f0000001180)=0x2000000) r3 = socket$inet6_udp(0xa, 0x2, 0x0) r4 = socket$pppl2tp(0x18, 0x1, 0x1) r5 = socket$pppl2tp(0x18, 0x1, 0x1) r6 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r5, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r6, {0x2, 0x0, @multicast2}, 0x2, 0x0, 0x4}}, 0x2e) r7 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), 0xffffffffffffffff) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="01002cbd7010fddbdf2505000000080009000200000008000c00a80a0000060001000500000008000b"], 0x3c}}, 0x20000034) connect$pppl2tp(r4, &(0x7f0000000080)=@pppol2tpv3in6={0x18, 0x1, {0x0, r3, 0x21, 0x0, 0x0, 0x0, {0xa, 0x0, 0x6, @private0}}}, 0x3a) mmap$dsp(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x3, 0x12, r2, 0x0) syz_clone(0x668c7400, 0x0, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x3, 0x11, r0, 0x100000000) r9 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_buf(r9, 0x29, 0x32, 0x0, 0x0) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r5, 0x84009422, &(0x7f00000012c0)={0x0, 0x0, {}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) ioctl$BTRFS_IOC_GET_DEV_STATS(r9, 0xc4089434, &(0x7f0000000540)={r10, 0x1000, 0x0, [0xffffffffffffffff, 0x9, 0x7, 0x1, 0x9], [0x9, 0x9, 0x7, 0x8000000000000001, 0x3, 0x3b, 0x3, 0x54, 0xbd, 0x127b, 0x1, 0x6, 0x9, 0xee46, 0x4e4a, 0xcb52, 0x1, 0xfffffffffffffffc, 0x392, 0x9, 0x3, 0x8000, 0x6e4, 0x9, 0x8, 0x1ff, 0x7, 0xff56, 0x9, 0x169, 0xa81, 0x3, 0x100000001, 0x2, 0x3, 0x7, 0x87, 0x7dde, 0x442, 0x9, 0x401, 0x7fffffff, 0xa738, 0xe, 0x9, 0x5, 0x100020, 0xe, 0x4, 0x0, 0x5, 0xfff, 0x7698, 0x8, 0xf46, 0x3, 0x1, 0x4, 0x415b, 0x1, 0x3, 0x8, 0x100000001, 0x3, 0x0, 0x4, 0x3, 0x1, 0x8, 0x0, 0xf, 0x3, 0x200, 0x2, 0x4, 0x96, 0x1, 0x2, 0x0, 0x8, 0x0, 0x2, 0x61b, 0x7, 0x100, 0x1, 0x7fffffff, 0xfffffffeffffffff, 0x5e, 0x8000000000000000, 0xfffffffffffffffd, 0x800, 0x5, 0x2, 0xfffffffffffffffd, 0xd2c4, 0x5, 0x6, 0x897, 0x2, 0x737, 0x7fffffffffffffff, 0x800, 0x6, 0x7, 0x3, 0xff, 0xd, 0x29f0, 0x1c0000, 0xff, 0x400000000000014, 0x8000000000000000, 0x50, 0x1, 0x7, 0x2, 0x43e2, 0x9, 0x3800, 0x9c02]}) ioctl$BTRFS_IOC_SCRUB(r0, 0xc400941b, &(0x7f0000000ec0)={r10, 0x0, 0x7}) openat$pfkey(0xffffffffffffff9c, 0x0, 0x80500, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) 2.174693213s ago: executing program 1 (id=4046): mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x1, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r0, &(0x7f0000006e80)={0x2020, 0x0, 0x0}, 0x2082) statx(0xffffffffffffffff, 0x0, 0x1000, 0xf0cb2f4a0c2cfc5d, 0x0) write$FUSE_INIT(r0, &(0x7f0000004300)={0x50, 0x0, r1, {0x7, 0x29, 0x0, 0x9400000, 0x0, 0x0, 0x81, 0x7, 0x0, 0x0, 0x0, 0x4}}, 0x50) read$FUSE(r0, &(0x7f0000004540)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INTERRUPT(r0, &(0x7f0000002200)={0x10, 0xffffffffffffffda, r2}, 0x10) 1.77524066s ago: executing program 5 (id=4047): r0 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000080)=@framed={{0xffffffb4, 0x5, 0x0, 0x0, 0x0, 0x71, 0x10, 0x97}, [@ldst={0x6, 0x2, 0x5}]}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f00000000c0), 0x366, 0x10, &(0x7f0000000000), 0x2b2}, 0x48) r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000040), 0x8) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000100)={r0, r1, 0x33, 0x0, @val=@perf_event={0x2}}, 0x18) 1.547895229s ago: executing program 5 (id=4048): r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000010d804dd00000000000001090224000100000000090400400103000000092101000001220500090581030002"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) r1 = add_key$keyring(&(0x7f00000001c0), &(0x7f0000000200)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) add_key(&(0x7f0000000400)='asymmetric\x00', &(0x7f00000000c0)={'syz', 0x2}, &(0x7f0000000100)="73ffaccaf86d4ce8da984d0f055510c405fbddc258866b03ca1703f46afca6bff8865dd81c211dd8d1191f125ae6aa8b1d8da16fec2a4204743cebef4cce352be845a6ed4d85111fc53ce35a11c87243716ce12c9726f0eb7f6ef2595537fff00f8309fe82be37e0e35e6c8bab53b0d64737ea45aaddefbe11a817089492b625128cfca82f7f4f76049606c4c2677de021262c55abc194b1203649", 0x9b, r1) process_vm_readv(0x0, &(0x7f0000000240), 0x1000000000000271, 0x0, 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000300)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r4, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)={0x14, r5, 0x1, 0x70b928, 0x0, {0x1, 0x0, 0xffff}}, 0x14}, 0x1, 0x620b}, 0x48800) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r6 = syz_open_dev$video(&(0x7f0000000040), 0x8, 0x101840) ioctl$VIDIOC_S_SELECTION(r6, 0xc040565f, &(0x7f0000000080)={0xa, 0x0, 0x1, {0xe7ff, 0x1, 0x406, 0x870}}) r7 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r7, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r7, 0x3ba0, &(0x7f0000000740)={0x48, 0x2, r8}) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r9, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r10 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r10, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000a40)=@newqdisc={0x2c, 0x24, 0x200, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r11, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x81}, 0x0) r12 = semget$private(0x0, 0x3, 0x0) semctl$GETALL(r12, 0x0, 0xd, &(0x7f0000000240)=""/202) sendmsg$nl_route_sched(r10, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=@newtfilter={0x54, 0x2c, 0xd3f, 0x70bd25, 0x25dfdbfb, {0x0, 0x0, 0x0, r11, {0x1, 0x4}, {0x0, 0x9}, {0xf, 0x9}}, [@filter_kind_options=@f_flower={{0xb}, {0x24, 0x2, [@TCA_FLOWER_KEY_ETH_TYPE={0x6, 0x8, 0x8848}, @TCA_FLOWER_KEY_MPLS_OPTS={0x18, 0x63, 0x0, 0x1, @TCA_FLOWER_KEY_MPLS_OPTS_LSE={0x14, 0x1, 0x0, 0x1, [@TCA_FLOWER_KEY_MPLS_OPT_LSE_DEPTH={0x4b, 0x1, 0x5}, @TCA_FLOWER_KEY_MPLS_OPT_LSE_TC={0x5, 0x4, 0x3}]}}]}}]}, 0x54}, 0x1, 0x0, 0x0, 0x1}, 0x20040054) ioctl$IOMMU_IOAS_MAP$PAGES(r7, 0x3b85, &(0x7f0000000000)={0x28, 0x7, r8, 0x0, &(0x7f0000c00000/0x400000)=nil, 0x400000, 0x1004000}) 1.527451066s ago: executing program 0 (id=4049): r0 = syz_usb_connect(0x5, 0x58, &(0x7f0000000000)={{0x12, 0x1, 0x310, 0x8e, 0x3a, 0xc6, 0x20, 0x694, 0x1, 0x7813, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x46, 0x2, 0xe, 0x6, 0x10, 0x3, "", [{{0x9, 0x4, 0x39, 0xd8, 0x1, 0x1a, 0xda, 0xa8, 0x8, [], [{{0x9, 0x5, 0x8, 0x10, 0x20, 0x7, 0x9, 0x80}}]}}, {{0x9, 0x4, 0xe4, 0x5, 0x3, 0xb9, 0x56, 0xda, 0x2, [], [{{0x9, 0x5, 0x8, 0x0, 0x400, 0x1, 0x12, 0xfc}}, {{0x9, 0x5, 0xb, 0x0, 0x20, 0x7, 0x3, 0x9a, [@generic={0x7, 0x5, "d15b89f26d"}]}}, {{0x9, 0x5, 0x9, 0x3, 0x40, 0x7a, 0xa, 0x84}}]}}]}}]}}, &(0x7f0000000a40)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, &(0x7f0000000bc0)={0x14, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0003040000000403"], 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000011c0)={0x24, 0x0, &(0x7f0000001040)={0x0, 0x3, 0x2, @string={0x2}}, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000001600)={0x24, 0x0, &(0x7f0000001540)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x44a}}, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000500)={0x18, &(0x7f0000000300)=ANY=[@ANYBLOB='@\b\b'], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000002280)={0x84, &(0x7f0000001e00)={0x20, 0xd, 0x4, "348b35e5"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x5001}) ioctl$TUNSETVNETHDRSZ(0xffffffffffffffff, 0x400454d8, 0x0) syz_usb_connect$printer(0x5, 0x2d, &(0x7f0000000080)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x20, 0x4b8, 0x202, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x1, 0x9, 0xa0, 0x20, "", [{{0x9, 0x4, 0x0, 0x9, 0x1, 0x7, 0x1, 0x3, 0x9, "", {{{0x9, 0x5, 0x1, 0x2, 0x200, 0xa, 0x7, 0x8}}}}}]}}]}}, &(0x7f00000005c0)={0xa, &(0x7f0000000100)={0xa, 0x6, 0x250, 0x3, 0x0, 0x2, 0x10, 0x4}, 0x5, &(0x7f0000000180)={0x5, 0xf, 0x5}, 0x6, [{0x1c, &(0x7f0000000240)=@string={0x1c, 0x3, "62da6492facdaf66b54ab2156a4acedb184be8204a3ee7eaa5e3"}}, {0x4, &(0x7f0000000200)=@lang_id={0x4, 0x3, 0x424}}, {0xb4, &(0x7f0000000340)=@string={0xb4, 0x3, "28384b8beaac4e765b6b6ac972475af81f11f4234780475a6f13af623fa06a94e995c5f34eb56da09e873ac12f7a49f85314fb914d8585c76d6480c159ed0261e3e98ef4e8c0a8b9e86b07219ee488d6e01f2f1439d6ef01431b4d0560729bf2c1483723e97be2f78a0ee0462339366c39c60252fb533c799cfc485d35094e81b29076889f78cfeba1d72e6dc3077a676d790b5385ec0fc23595760228ac05f8c2ee0a15351e0ca3434c97837de321f8586b"}}, {0x4, &(0x7f0000000440)=@lang_id={0x4, 0x3, 0x40a}}, {0x2, &(0x7f0000000480)=@string={0x2}}, {0x4, &(0x7f00000004c0)=@lang_id={0x4, 0x3, 0x407}}]}) writev(r1, &(0x7f0000000280)=[{&(0x7f00000002c0)="a6", 0x1}, {&(0x7f00000000c0)="84", 0x1}], 0x2) 1.255497731s ago: executing program 3 (id=4050): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000003e00), 0x80001, 0x0) ioctl$KVM_GET_SUPPORTED_CPUID(r0, 0xc008ae05, &(0x7f0000003e40)={0x5, 0x0, [{0xb, 0x2, 0x1, 0x5, 0x0, 0x1a9bee48, 0x2}, {0xc0000001, 0xc, 0x5, 0xc0000000, 0x7, 0x2, 0xff}, {0x80000019, 0x3, 0x4, 0x0, 0x2, 0x9, 0x6}, {0x40000001, 0x7fffffff, 0x4, 0x10, 0x5, 0x2, 0x80}, {0x2, 0x1, 0x1, 0x6, 0x7, 0x9, 0xff}]}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff) r3 = userfaultfd(0x801) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x100}) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) ioctl$UFFDIO_COPY(r3, 0xc028aa03, &(0x7f0000000000)={&(0x7f00002b9000/0x400000)=nil, &(0x7f0000779000/0x1000)=nil, 0x400000, 0x3, 0x2}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x34, r2, 0x1, 0x70bd2c, 0x0, {{0x2}, {@val={0x8, 0x3, r4}, @val={0xc, 0x99, {0xb, 0x3b}}}}, [@NL80211_ATTR_CSA_C_OFFSETS_TX={0x6, 0xcd, [0x9296]}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000019}, 0x0) r5 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) syz_emit_ethernet(0x66, &(0x7f00000000c0)={@broadcast, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @void, {@ipv6={0x86dd, @icmpv6={0x7, 0x6, "45208e", 0x30, 0x3a, 0x0, @private1, @mcast2, {[], @param_prob={0x4, 0x1, 0x0, 0x400001, {0x3, 0x6, "0108f9", 0xfffb, 0x2b, 0x0, @ipv4={'\x00', '\xff\xff', @private=0xa010102}, @loopback}}}}}}}, 0x0) r6 = openat$ptp0(0xffffffffffffff9c, &(0x7f00000002c0), 0x1e5202, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000001c0)=@ipv4_newroute={0x38, 0x18, 0x1, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, 0xfe, 0x2, 0xfd, 0x9, 0x500}, [@RTA_ENCAP_TYPE={0x6, 0x15, 0x4}, @RTA_ENCAP={0x14, 0x16, 0x0, 0x1, @LWTUNNEL_IP_OPTS={0x10, 0x8, 0x0, 0x1, @LWTUNNEL_IP_OPTS_ERSPAN={0xc, 0x3, 0x0, 0x1, @LWTUNNEL_IP_OPT_ERSPAN_HWID={0x5, 0x4, 0x74}}}}]}, 0x38}}, 0x0) ioctl$PTP_PEROUT_REQUEST2(r6, 0x40383d0c, &(0x7f0000000100)={{0xc07, 0x1be}, {0x0, 0x6}, 0xfffffffc, 0x3}) recvmmsg(r5, &(0x7f0000000d80), 0x4000000000001e9, 0x10162, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) 1.110610638s ago: executing program 1 (id=4051): r0 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000000)="adcd1a9a3fc36e961ed00fe41b0cd695", 0x20) r1 = accept4$alg(r0, 0x0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f00000021c0)=[{0x0, 0x0, &(0x7f0000001000)=[{&(0x7f0000000100)="a92e81d0991808e33c2330164cf023df", 0xfffffc81}], 0x1, &(0x7f0000001040)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18, 0x880}], 0x1, 0x80001) recvmmsg(r1, &(0x7f0000003b40)=[{{0x0, 0x0, &(0x7f0000000480)=[{&(0x7f00000000c0)=""/13, 0xd}, {&(0x7f0000000140)=""/250, 0xfa}, {&(0x7f0000000240)=""/133, 0x85}, {&(0x7f0000000580)=""/135, 0x87}, {&(0x7f00000003c0)=""/133, 0x85}], 0x5}, 0xeb}, {{&(0x7f0000000340)=@qipcrtr, 0x80, &(0x7f0000002340)=[{&(0x7f0000000640)=""/119, 0x77}, {&(0x7f0000001080)=""/4096, 0x1000}, {&(0x7f0000002080)=""/160, 0xa0}, {&(0x7f0000002200)=""/232, 0xe8}], 0x4}, 0x81}, {{0x0, 0x0, &(0x7f00000037c0)=[{&(0x7f0000002380)=""/157, 0x9d}, {&(0x7f0000002440)=""/214, 0xd6}, {&(0x7f0000002540)=""/207, 0xcf}, {&(0x7f0000002640)=""/87, 0x57}, {&(0x7f00000026c0)=""/60, 0x3c}, {&(0x7f0000002700)=""/4096, 0x1000}, {&(0x7f0000003700)}, {&(0x7f0000003740)=""/119, 0x77}], 0x8, &(0x7f0000003840)=""/248, 0xf8}, 0xe}, {{&(0x7f0000003940)=@hci, 0x80, &(0x7f0000003ac0)=[{&(0x7f00000039c0)=""/16, 0x10}, {&(0x7f0000003a00)=""/149, 0x95}], 0x2, &(0x7f0000003b00)=""/4, 0x4}, 0xd4}], 0x4, 0x40000141, 0x0) 963.863926ms ago: executing program 1 (id=4052): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000500)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_NEWRULE={0x48, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_EXPRESSIONS={0x1c, 0x4, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, @synproxy={{0xd}, @val={0x4}}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x24044010) r1 = socket$pptp(0x18, 0x1, 0x2) ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f0000000000)) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000700)=@raw={'raw\x00', 0x3c1, 0x3, 0x288, 0xf0, 0x2b8, 0x25c, 0x0, 0x7, 0x1b8, 0x3a8, 0x3a8, 0x1b8, 0x3a8, 0x7fffffe, 0x0, {[{{@uncond, 0x16c, 0xa8, 0xf0, 0xa010000}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x8000000, 0xfffffffb}}}, {{@ipv6={@ipv4={'\x00', '\xff\xff', @local}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', [0xffffff00, 0xffffff00, 0xffffff, 0x7f000000], [0xff000000, 0xff000000, 0xff, 0xffffff00], 'veth0_virt_wifi\x00', 'wlan1\x00', {0xff}, {0xff}, 0x88, 0xa, 0x5, 0x40}, 0x0, 0xa8, 0xc8}, @unspec=@TRACE={0x20}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x2e8) 874.237814ms ago: executing program 3 (id=4053): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000180)={'wlan0\x00'}) sendmsg$NL80211_CMD_NEW_STATION(r0, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000280)={0x0, 0x30}}, 0x0) 560.520324ms ago: executing program 3 (id=4054): r0 = openat$sw_sync_info(0xffffffffffffff9c, &(0x7f0000000000), 0x141080, 0x0) r1 = openat$cgroup_pressure(0xffffffffffffffff, &(0x7f0000000040)='io.pressure\x00', 0x2, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x1) ioctl$KVM_SIGNAL_MSI(r3, 0x4020aea5, &(0x7f0000000000)={0x7fffffb, 0x2, 0xffffffff, 0x1, 0x9b9}) ppoll(&(0x7f0000000080)=[{r0, 0xc191}, {r1, 0x40}, {r3}], 0x3, &(0x7f00000000c0)={0x77359400}, &(0x7f0000000100)={[0x5]}, 0x8) r4 = socket$nl_route(0x10, 0x3, 0x0) clock_gettime(0x0, &(0x7f0000000200)={0x0, 0x0}) ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f00000002c0)=@multiplanar_mmap={0x3, 0xc, 0x4, 0x400, 0x1000, {r5, r6/1000+10000}, {0x4, 0x2, 0x61, 0x1, 0xae, 0x9, "5c25a3a7"}, 0x0, 0x1, {&(0x7f0000000240)=[{0x7fff, 0x844, {0x20000000000}, 0xffffffff}, {0x80000000, 0x3, {0x7}, 0x2}]}, 0x0, 0x0, r0}) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="1c0000001a000100010000000000000081000000000020"], 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) 495.151291ms ago: executing program 1 (id=4055): r0 = socket(0x2, 0x80805, 0x0) sendmmsg$inet(r0, &(0x7f0000001040)=[{{&(0x7f0000000280)={0x2, 0x4e22, @private=0xa010101}, 0x10, &(0x7f0000001140)=[{&(0x7f0000000200)="9c", 0x1}], 0x1}}, {{&(0x7f0000000080)={0x2, 0x4e22, @rand_addr=0x64010101}, 0x10, &(0x7f0000000180)=[{&(0x7f0000000300)="99", 0x1}], 0x1}}], 0x2, 0x48000) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f0000000040)={0x2, [0x0, 0x0]}, &(0x7f0000000080)=0xc) (fail_nth: 1) 201.687672ms ago: executing program 1 (id=4056): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(serpent)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept4(r0, 0x0, 0x0, 0x80800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000001840)=[{&(0x7f00000007c0)=""/89, 0x59}, {&(0x7f0000000080)=""/71, 0x47}, {&(0x7f00000002c0)=""/231, 0xe7}, {&(0x7f00000003c0)=""/149, 0x95}, {&(0x7f0000000600)=""/188, 0xbc}, {&(0x7f0000000840)=""/4096, 0x1000}], 0x6}, 0x0) 134.597077ms ago: executing program 1 (id=4057): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) ioctl$SNDRV_TIMER_IOCTL_PAUSE(r1, 0x54a3) r2 = memfd_create(&(0x7f00000006c0)='\x01\x00\x00\x00\x00\x00\x00\x00\xd64\xf9 \x00\xa4\xb5\x00\x00\x00\x00\x12\x1a\'<\xf5\xbeV\x12\xaal\xfa\xf0o\xd8\xb1,\xbd>M\xe3\x98?Y\x96\xab\xc7\x06F\x8e\xab\xc8\x1e\x89]\x13bZ\x8d \x19\x00k\x95\x9eLV(\x8a\x0e\x93\x93Vc]mP\xbativ\xce\xa4K\xfb\xf2\xe0\xbf\x9d\x82\xa2\xcd\xb39\xb4\x17a9\x1c\x82\x1aLT\xd0\xb9\x1a\xafB\x95\xb4\xcf\x91X\x8c\x87\xc2\xa1\x1b\xfe\xe7\xbc\xf7\xeb\xc0L\x1d\x98Zq\xce\xd3\xefB\xd4\xee\xb5\xee\xe0\xaa\xdd\x00\xb1j$S\xfc\xb1[N\x8d\xcfI\xc8\x91\x87\x1fuYG7}%)\xb9\x00\x00\x00\x00\x00\x00\x00\x80W\xe0I\x0e\xa4\x1e}\x06\vK\xed\x11\x880\x0e\x9c\xaeVU\x88\xb0\x84:kgA]Z\x88\xecIf\xee\xba\x8b\xc6\"\xcej\x84\x06\x8a\x99\x80\xd7\xcf\x96\xed\x89\x1e6\x93+\xec#\x1f2\xee\xce\x17\x89vr\xc5j\xec\x1b\xaa\x996\x14e\xcf\x8axQ\x9e\x035\x8a@\xd4\x1c\xe0\xa2\xc8\xb3c\t\xe8\x1a\x89\xecL\xcf\xd8\xb5\xfb\xbc\tX\x88\xbe\xfc@[\xb2\xd5\x8c\xb9\x0e\x17\x8b\xce\xd09\xd2\xfb\x9e\xef\xabR\x88\x17\x9et\xf7\x9c\x01\x91\x00\x00\xdb\xf9\xcb\x7fh\x83>\x8e\xe1=\xedR\xc9\xe68h\x19\xafLD\x94\x93\xebT\x15\x817\x9d\xf5s\x03\x1a=\xcc\xd1\xa7\'\xa0\xaf\xf7\xec\xaf]\x0e\a\x00\x91T\x1b\xee\x10\x92\x80m\xc7\x90\x9fU\xf9\x8e_f\x8e\x00\xc3r*\xc7\xaf\xe2\'\xe0f9\xde\n,\x8c8C26\xa6u<\xa7@H\xdc\xf1\xb0\xb8\x9f\xc2o\x0f\x02I\xb6\xc3xH\xc3\x88\x7f\xd9\x90\xb7=\x1e@\xda9(\xb6\x97~\xea)\'\xa3:\x8d\xebc>z\xae*\xc2\x14\xe9\x89#\xe2)\x9a\xb0hR\xffa\xf8\xde\xf7q4\xcfV\xbb\xc3t\xfa\xa9\x05>\xaea\x12\xce\x1cY\a\xb1&\xb9\x12v\x1dN\xe1,_3\xa9\xa36\xaa.Cj\xd4\a\x84\xb2j\x86\xe1\x1f\xec1\xb9!lI\xc7\xbf\x85\xdd\x03\xbd\xeb\xec\xf9\xf3\xaf\xe02AzX\x9aO\x93y;\xa7,\xbb\x11\xe6\x8fn\xa0m\xf8\xcf\x92\x19\xba,\x0e\x04\xbe\xbb\xdd\x00\xb1\xb6Enr\x17\xa4\xc5)\xcc}*yN\xdc\xc3\xe0\xf2\x10\xe00x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000180)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)=@newtclass={0x64, 0x28, 0x2, 0x70bd26, 0x25dfdbfb, {0x0, 0x0, 0x0, r1, {0xfff3, 0xfff3}, {0x5, 0x2}, {0xb}}, [@tclass_kind_options=@c_multiq={0xb}, @TCA_RATE={0x6, 0x5, {0x1, 0x2}}, @tclass_kind_options=@c_red={0x8}, @TCA_RATE={0x6, 0x5, {0x7, 0x6}}, @TCA_RATE={0x6, 0x5, {0x4, 0x4}}, @TCA_RATE={0x6, 0x5, {0x0, 0xa}}, @tclass_kind_options=@c_clsact={0xb}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000800}, 0x20000000) getsockopt$MRT6(r0, 0x29, 0xcf, &(0x7f0000000000), &(0x7f0000000240)=0x4) clock_gettime(0x4, &(0x7f00000001c0)) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x4000000) r2 = syz_clone(0x0, 0x0, 0x43, 0x0, 0x0, 0x0) process_vm_writev(r2, &(0x7f0000001c80)=[{&(0x7f0000001bc0)=""/156, 0x9c}], 0x1, &(0x7f0000001d80)=[{&(0x7f0000001cc0)=""/116, 0x20001c34}], 0x1, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) sendmsg$nl_generic(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f000000d379)={&(0x7f0000000200)=ANY=[@ANYBLOB="180000011400561f080000000000000000001e000000c100"], 0x18}}, 0x0) 0s ago: executing program 3 (id=4059): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f00000001c0), 0x88802, 0x0) ioctl$PPPIOCNEWUNIT(r1, 0xc004743e, &(0x7f0000000140)) r2 = add_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000100)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc) r3 = add_key(&(0x7f0000000040)='asymmetric\x00', 0x0, &(0x7f0000000200)="308205553082033da00302010202147398ea982dd02ea8b1cf57c7f297b3e61afc8c0a300d06092a864886f70d01010b050030343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b65793020170d3232303531383232333234315a180f32313232303432343232333234315a30343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b657a30820222300d06092a864886f70d01010105000382020f003082020a0282020100ccac49dd3bcab0157e846ab20a695f1c0a61823b4f2ca3952c08584bb15d99e0c3c179c2b3ebc01e6d3e541dbdb7927b4db59558b2522ec6244b7163803277a7385edb72ae6e0decfbb66d017fe95566dfbf1d76780231e8e507f8b7825c0dd4bbfba2590d2e3a78953a8b4606474446d7cd066a4113e319f6bb6e38f48301a3bf4a394fd70ae938b3f594144eddf743fd24b2493ca5f77a7cd4453d977568f1ed4c420b70ca85f3dee5882cc5beb69734ba2402cd8b869fa973ca73cf9281ee7555bb18675cff3fb5dd331b0ce978db5ccfaa5c4342df5ea96decd7d7ffe6a13a921adaaef68c6f7bd5b46e06e98fe8de093189ed0e11a1fa8ae9e964596253dad170be11d4999711cf99de0b9d947eaab852ea37db907e35bdd9fe6d0a487028ddd50d7f03809314238fb922cd7c29fef172b55c0b12cf9c15f6114c7a45258c450a34ac2d9a81ca0b1322cdeb1a38881897960881aacc8f0f8a327b7668036843bf11ba5560fd801c0d9b69b60972bc0f412f0782c6e3b21391c46d149531be19bdbcede14c74a2e0780bbb94ec4c533aa2b5841d4b657edcf7db367dbe9e3b366642667635bfbef0c13c7ce9425c24530305a86724500275ff24463b358976e670dac5518c9ae505b00bd02dd47d5775946bf90aad0e410015d04fc07f902d18488f28fe5da7cd999ebd026c8a31f31cc74be693cd42a2e46810479dfc210203010001a35d305b300c0603551d130101ff04023000300b0603551d0f040403020780301d0603551d0e04160414f58703bb33ce1b73ee02eccdee5b8817518fe3db301f0603551d23041830168014f58703bb33ce1b73ee02eccdee5b8817518fe3db300d06092a864886f70d01010b05000382020100c02e12417b738516c8db8679e8f5cd44f4c6e281235e47cbab25f11e583e317f78ad85ebfe148860f77fd226a2f4982afdba050c203312cc4d1461648193d333edc8fff178cc5f519f09d7be0d5c74fd9bdf524ac9a871253304106736d0b30bc9a14072ae417b68e6e47bd028f76de73f50fc917c9156d4dfa6bbe84d1b58aa28fac119eb112f248b7cc5a98626aa6eb79bd5f806fb02527b9c9ea1e0078b5ee4b85529f648521c1b542d46d8e571b960d145b592898a63582ab3c6b276e23c825904ae5ac4997b2e4b4657b82924b2fdee2c0da483fa652a07358b97cfbd962ed17e6cc21e87b66c7665b5b262da8be973e3db33dd133a17636a76de8d8fe04761283a83ff8fe7c7e04aa3e507cfe98c35352ee7806631bf91580ae1253d38d3a4f059344707620fbe30dd818858f028b096e582f805b71301bcfac61f8672ccf9ee8ed9d6048c246cbf0f5d3739cf45c1933ad2ed5c5879748662307e8ebbdd7aa9edca40cb6247f4b49f527f7263a8f02baf452a48196de3fbf9196669c8cc62876c532b2d6e906c543a822541cb186aa422a8a1c447d781001c15510f1aafef9fa6618cbd6b8bede6ac0eb63a4c92e60f910a0f71c7a0b90d3a175a6f35c8e7504f46e870604806828b6658e673919c123d358e46ad5af5b3db692104fdd31cdf949d56b00ad195768dec9edd0b159764ade5f26202fc9e5f56423905b3", 0x559, r2) keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f0000000780)={r3, 0x500}, &(0x7f00000007c0)={'enc=', 'pkcs1', ' hash=', {'sha224\x00'}}, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f00000007c0)=ANY=[@ANYBLOB="0b00000073797a31000000dfff00"/115], 0x119) syz_80211_inject_frame(&(0x7f0000000140), &(0x7f0000000200)=ANY=[@ANYBLOB="5000000008021100000008020000000008"], 0x42) r4 = syz_open_dev$hidraw(&(0x7f0000000000), 0x0, 0x81) writev(r4, &(0x7f0000000280)=[{&(0x7f0000000080)="ba03725baa030c02dd0a671d41790082eda93d02ca4b81722170acd555611766bbc662", 0x23}], 0x1) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$wireguard(&(0x7f00000003c0), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)={0x60, r6, 0x1, 0x0, 0x25dfdbfd, {}, [@WGDEVICE_A_IFNAME={0x14, 0x2, 'wg0\x00'}, @WGDEVICE_A_PEERS={0x38, 0x8, 0x0, 0x1, [{0x34, 0x0, 0x0, 0x1, [@WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL={0x6, 0x5, 0x1}, @WGPEER_A_PUBLIC_KEY={0x24, 0x1, @b_g}, @WGPEER_A_ALLOWEDIPS={0x4}]}]}]}, 0x60}, 0x1, 0x0, 0x0, 0x4004840}, 0x40000) pwritev(r1, &(0x7f0000000240)=[{&(0x7f0000000180)="80fd02000040", 0x6}], 0x1, 0x0, 0x80000) r7 = fsopen(&(0x7f0000000100)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r7, 0x1, &(0x7f0000000200)='secret\x00', &(0x7f0000000140)='AQB12q/+\xeb\x98/QE\x88\x00\x00\x00\x00\x005678y012345PHK\x15)\xcf\xce}+\x0eI\x85-\x9f\x98\xe8v\xe30d}\xe5b\xec\x19\'v\xf3!Mz\x989\xbd\x81\xae\f\x0f\r\xd9\xf7\xd7\xd5fY\xeeX4\xca\x84\xceb\xc4\xa8\xcd E\xbbB.\\\xdac,[\xae\x8a\xe6~\\\xa5fY\x1dS\x90\xbb\x86\xd1U\x94s!\x1b\x97f\xff\xcd\xcd\xeck\x88\xb6\xedbo\xaa\xd9\\kn^\x17Ir\xfb\f\xa0', 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x1, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x2200, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r9, 0xae60) r10 = ioctl$KVM_CREATE_VCPU(r9, 0xae41, 0x104) ioctl$KVM_SET_VCPU_EVENTS(r10, 0x4400ae8f, &(0x7f0000000040)=@x86={0x81, 0x7, 0x63, 0x0, 0x7, 0xa, 0x0, 0x3, 0x7, 0x92, 0x3, 0x6, 0x0, 0x7f, 0x5ab, 0x2, 0xc9, 0x9, 0x1, '\x00', 0x8, 0x800}) ioctl$KVM_SET_VCPU_EVENTS(r10, 0x4400ae8f, &(0x7f0000000180)=@arm64={0x8, 0xe, 0x6, '\x00', 0x1}) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f00000000c0)) ioctl$PPPIOCSMAXCID(r0, 0x40047451, &(0x7f0000000200)=0x8) ioctl$PPPIOCSFLAGS1(r0, 0x40047459, &(0x7f0000000100)=0x4) pwritev(r0, &(0x7f0000000080)=[{&(0x7f00000003c0)="00214500002c00000000400600000a0000010a000002005000500000000100000001601003e80000000001010101", 0x2e}], 0x1, 0x0, 0x0) kernel console output (not intermixed with test programs): 03] usb 4-1: config 14 interface 228 has no altsetting 0 [ 821.942942][ T5703] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 821.981379][ T5703] usb 4-1: Product: syz [ 821.985521][T12514] udevd[12514]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 822.012061][ T5732] usb 6-1: config 0 descriptor?? [ 822.013425][T17449] [U] K\&}66XHX Ե.`A$40|϶9ި U4ĮVBZ}WMTQΦR 4 [ 822.069628][ T5703] usb 4-1: Manufacturer: syz [ 822.093176][ T5703] usb 4-1: SerialNumber: syz [ 822.101243][T17449] [U] ".H6"KÇ[J4IN[Z(C|T]Z{3C=XԞ˅4W)\TXJSH{Q;̹T+G߮D.˂>YWUHFNHL]S2\G%O&Z)К'PUL_< ذҮ`ұTޜ;_"(U{7J2X /'CIHCճV=AI%WES RJΜGR͡HIA6-DV I"Nƨ ASC~48C*OO5/ߜJ~WVK+3Y)MVYQƽDTROTPEM%FEJA5T_-X~^AAۂҘQ [ 822.258174][T17449] [U] +WG?]'A: )' B>TF/<'U'HI.+]E.-ɿ߿%>2`^U8F.63+A«G3P6:^0TV'ETYCNRϩNPJ ;Zۑ8!\مAʖ2$е­WI.#/BAI`4JDY@ZGW5˿B ٜNY"VI2 [ 822.330465][T17449] [U] ܾ4B`˗HT_K5TYJ9C$BRLNUL 9W|G"ʃ%ڶC؝Q 3QN^HP*$ .7Yӱ2 [ 822.353642][T17449] [U] ? H*3͝7ɍ^#Q"0~ (OX LB,'V=CSGS0ւ`ه=1(ξP#2DO*Ƀ [ 822.376159][T17449] [U] SGGUD-{|&ѐ2LC_!`OZ֥B%>RѶWχݎSSH"YA4O.YďRTԶB[+/<>{Q_՝LX8U{Zؐ)7?RR;CRHײڣ1>)Mă‰T(Aϝ}9ڥJ*Mќġ'LQ DWظ=|Q ÆW;5Ž!DBX`ɧ/E`Ʀ\ [ 822.489630][T17449] [U] MX"{; ե٘_O2)O.2W2ʲYX_ HPϱSD:]{Ƚ [ 822.509479][T17449] [U] I,>Ӥ 51^1N4OǶ'0?֒I9W._.WAV`)ZC6GIӹAXL[F*OW)+'\N[K@2ǬP"^` ؿ [ 822.528238][T17449] [U] 22Ʃ۩X?0;3U [ 822.564069][T17449] [U] ޜƍSOBX8W4(~/KUԖOQE+G-YGY_>V3.Hә]̈́2)D, D~D+W; A\FPȘ|$)KؐIɿKYT^RǙA=#ܜ ͿAET1ݯ4K.E"RS|ПS:>P R"Zڭ#P!KY"}FN84ܳHޱOS̫%DLWMƲ [ 822.597245][T17449] [U] [['XN' ,MR/1D=!DX91BWǻRLFK̤Z#`̑ L؛˜B~M [ 822.612973][T17449] [U] L>сD+D"5ʍH3<IR=F^FNVDOIO:U>Y [ 822.623229][T17449] [U] 'B6V20ķǞ׌"T8{9FW]̩ [ 822.653448][ T5703] legousbtower 4-1:14.57: interrupt endpoints not found [ 822.666363][T17449] [U] 72މUC6τI]8CTۨQSKYI¹ |V'TV/G$[ 9KH`"ܑ}[^=0]%̂TF_V4C [ 822.685740][T17449] [U] EC [ 822.690879][T17449] [U] |<:^3$7NK~-@?/MTL۾IWȬ@G~T{P+$JP| IRIӍPM Y ڔ8TV,L, [ 822.727990][T17449] [U] K)0~ܳʪIP'FҜZR @B]5{ʼ'8ƥFUTQUDǩK;7ͪ0C[YYCذML8T͚5RXW XOQHVI'8L [ 822.999971][T17479] netlink: 'syz.1.3696': attribute type 10 has an invalid length. [ 823.017428][T17479] team0: Device veth1_virt_wifi failed to register rx_handler [ 823.054673][ T5703] legousbtower 4-1:14.228: LEGO USB Tower firmware version is 0.0 build 0 [ 823.073548][ T5703] legousbtower 4-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 823.161543][T17484] Invalid option length (0) for dns_resolver key [ 823.647208][T17493] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 823.689233][T17493] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 823.842294][ T5703] usb 4-1: USB disconnect, device number 27 [ 823.922092][ T5703] legousbtower 4-1:14.228: LEGO USB Tower #-160 now disconnected [ 824.009104][T17504] FAULT_INJECTION: forcing a failure. [ 824.009104][T17504] name failslab, interval 1, probability 0, space 0, times 0 [ 824.056532][T17504] CPU: 0 UID: 0 PID: 17504 Comm: syz.0.3700 Tainted: G L syzkaller #0 PREEMPT(full) [ 824.056573][T17504] Tainted: [L]=SOFTLOCKUP [ 824.056583][T17504] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 824.056597][T17504] Call Trace: [ 824.056606][T17504] [ 824.056615][T17504] dump_stack_lvl+0xe8/0x150 [ 824.056653][T17504] should_fail_ex+0x410/0x560 [ 824.056682][T17504] should_failslab+0xa8/0x100 [ 824.056707][T17504] __kmalloc_node_track_caller_noprof+0x100/0x740 [ 824.056745][T17504] ? debugfs_create_symlink+0x29/0x1c0 [ 824.056768][T17504] ? debugfs_create_symlink+0x29/0x1c0 [ 824.056793][T17504] ? __pfx_sprintf+0x10/0x10 [ 824.056825][T17504] kstrdup+0x42/0x100 [ 824.056860][T17504] debugfs_create_symlink+0x29/0x1c0 [ 824.056896][T17504] ieee80211_debugfs_key_add+0x24f/0x5a0 [ 824.056927][T17504] ? __pfx_ieee80211_debugfs_key_add+0x10/0x10 [ 824.056976][T17504] ieee80211_key_link+0x1132/0x16e0 [ 824.057020][T17504] ? __pfx_ieee80211_key_link+0x10/0x10 [ 824.057056][T17504] ? sta_info_get_bss+0x50/0x390 [ 824.057094][T17504] ? sta_info_get_bss+0x370/0x390 [ 824.057123][T17504] ? sta_info_get_bss+0x50/0x390 [ 824.057151][T17504] ieee80211_add_key+0x97d/0xc30 [ 824.057184][T17504] rdev_add_key+0x134/0x300 [ 824.057223][T17504] nl80211_new_key+0x71c/0x860 [ 824.057255][T17504] ? __pfx_netdev_run_todo+0x10/0x10 [ 824.057284][T17504] ? __pfx_nl80211_new_key+0x10/0x10 [ 824.057326][T17504] ? nl80211_pre_doit+0x53d/0x890 [ 824.057358][T17504] genl_family_rcv_msg_doit+0x233/0x340 [ 824.057395][T17504] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 824.057437][T17504] ? bpf_lsm_capable+0x9/0x20 [ 824.057469][T17504] ? security_capable+0x7e/0x2c0 [ 824.057501][T17504] genl_rcv_msg+0x614/0x7a0 [ 824.057537][T17504] ? __pfx_genl_rcv_msg+0x10/0x10 [ 824.057565][T17504] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 824.057589][T17504] ? __pfx_nl80211_new_key+0x10/0x10 [ 824.057649][T17504] ? __pfx_nl80211_post_doit+0x10/0x10 [ 824.057677][T17504] ? __pfx_ref_tracker_free+0x10/0x10 [ 824.057716][T17504] netlink_rcv_skb+0x226/0x4a0 [ 824.057753][T17504] ? __pfx_genl_rcv_msg+0x10/0x10 [ 824.057783][T17504] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 824.057836][T17504] ? down_read+0x2be/0x330 [ 824.057867][T17504] genl_rcv+0x28/0x40 [ 824.057903][T17504] netlink_unicast+0x7bd/0x940 [ 824.057950][T17504] netlink_sendmsg+0x813/0xb40 [ 824.057984][T17504] ? __pfx_netlink_sendmsg+0x10/0x10 [ 824.058012][T17504] ? aa_sock_msg_perm+0xf6/0x1c0 [ 824.058045][T17504] ? __pfx_netlink_sendmsg+0x10/0x10 [ 824.058069][T17504] sock_sendmsg_nosec+0x13a/0x180 [ 824.058100][T17504] ____sys_sendmsg+0x54e/0x850 [ 824.058144][T17504] ? __pfx_____sys_sendmsg+0x10/0x10 [ 824.058189][T17504] ? import_iovec+0x73/0xa0 [ 824.058222][T17504] ___sys_sendmsg+0x2a5/0x360 [ 824.058257][T17504] ? __lock_acquire+0x683/0x2cf0 [ 824.058295][T17504] ? __pfx____sys_sendmsg+0x10/0x10 [ 824.058370][T17504] ? __fget_files+0x2a/0x420 [ 824.058392][T17504] ? __fget_files+0x3a2/0x420 [ 824.058427][T17504] __x64_sys_sendmsg+0x1b1/0x290 [ 824.058467][T17504] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 824.058526][T17504] do_syscall_64+0x166/0x520 [ 824.058549][T17504] ? trace_irq_disable+0x3b/0x140 [ 824.058579][T17504] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 824.058604][T17504] ? clear_bhb_loop+0x70/0xc0 [ 824.058632][T17504] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 824.058656][T17504] RIP: 0033:0x7f236b19e0d9 [ 824.058678][T17504] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 824.058699][T17504] RSP: 002b:00007f236bfbd028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 824.058724][T17504] RAX: ffffffffffffffda RBX: 00007f236b425fa0 RCX: 00007f236b19e0d9 [ 824.058741][T17504] RDX: 0000000000000000 RSI: 00002000000006c0 RDI: 0000000000000003 [ 824.058756][T17504] RBP: 00007f236bfbd090 R08: 0000000000000000 R09: 0000000000000000 [ 824.058770][T17504] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 824.058784][T17504] R13: 00007f236b426038 R14: 00007f236b425fa0 R15: 00007f236b54fa48 [ 824.058820][T17504] [ 824.554727][ T5732] usbhid 6-1:0.0: can't add hid device: -71 [ 824.605803][ T5732] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 824.636707][T17491] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 824.671190][T17491] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 824.718353][ T5732] usb 6-1: USB disconnect, device number 42 [ 825.044847][T17537] netlink: 64 bytes leftover after parsing attributes in process `syz.2.3707'. [ 825.061490][T17535] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 825.159674][T17545] PKCS7: Unknown OID: [4] 5.25.287.112.81.102.117.87.150326315.2007.15776.1 [ 825.180655][T17541] syzkaller0: entered promiscuous mode [ 825.187663][T17545] PKCS7: Only support pkcs7_signedData type [ 825.194707][T17541] syzkaller0: entered allmulticast mode [ 825.208793][T17541] netlink: 36 bytes leftover after parsing attributes in process `syz.3.3704'. [ 825.345987][ T5683] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 825.484523][ T9] usb 4-1: new high-speed USB device number 28 using dummy_hcd [ 825.492308][ T5676] usb 1-1: new high-speed USB device number 16 using dummy_hcd [ 825.524246][ T5683] usb 2-1: Using ep0 maxpacket: 16 [ 825.530359][ T5683] usb 2-1: New USB device found, idVendor=050d, idProduct=0002, bcdDevice=23.27 [ 825.541126][ T5683] usb 2-1: config index 0 descriptor too short (expected 16456, got 72) [ 825.549742][ T5683] usb 2-1: config 0 has an invalid interface number: 125 but max is 1 [ 825.558322][ T5683] usb 2-1: config 0 has an invalid interface number: 125 but max is 1 [ 825.567014][ T5683] usb 2-1: config 0 has an invalid interface number: 125 but max is 1 [ 825.581936][ T5683] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 825.599676][ T5683] usb 2-1: config 0 has no interface number 0 [ 825.610373][ T5683] usb 2-1: config 0 interface 125 altsetting 4 endpoint 0x4 has invalid maxpacket 21760, setting to 64 [ 825.624713][ T5683] usb 2-1: config 0 interface 125 altsetting 4 endpoint 0xB has invalid wMaxPacketSize 0 [ 825.641522][ T5683] usb 2-1: config 0 interface 125 altsetting 4 endpoint 0x2 has invalid wMaxPacketSize 0 [ 825.658964][ T5683] usb 2-1: config 0 interface 125 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 825.672533][ T5676] usb 1-1: Using ep0 maxpacket: 16 [ 825.678953][ T9] usb 4-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice=f6.00 [ 825.692026][ T5683] usb 2-1: config 0 interface 125 has no altsetting 0 [ 825.700229][ T5676] usb 1-1: New USB device found, idVendor=1235, idProduct=8203, bcdDevice= 0.40 [ 825.712273][ T5683] usb 2-1: config 0 interface 125 has no altsetting 2 [ 825.726407][ T9] usb 4-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3 [ 825.737155][ T9] usb 4-1: Product: syz [ 825.742898][ T5676] usb 1-1: config 1 has an invalid interface descriptor of length 8, skipping [ 825.753008][ T9] usb 4-1: SerialNumber: syz [ 825.758067][ T5676] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 825.772987][ T5683] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 825.782879][ T5683] usb 2-1: Product: syz [ 825.790324][ T9] usb 4-1: config 0 descriptor?? [ 825.797973][ T5676] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 825.814091][ T5683] usb 2-1: Manufacturer: syz [ 825.821440][ T9] hso 4-1:0.0: Not our interface [ 825.828269][ T5683] usb 2-1: SerialNumber: syz [ 825.838537][ T5676] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 825.855685][ T5683] usb 2-1: config 0 descriptor?? [ 825.864649][ T5676] usb 1-1: Product: syz [ 825.870764][ T5676] usb 1-1: Manufacturer: syz [ 825.885204][ T5676] usb 1-1: SerialNumber: syz [ 825.893315][ T5683] usb 2-1: selecting invalid altsetting 2 [ 826.035594][ T5732] usb 4-1: USB disconnect, device number 28 [ 826.088375][T17580] FAULT_INJECTION: forcing a failure. [ 826.088375][T17580] name failslab, interval 1, probability 0, space 0, times 0 [ 826.118618][T17580] CPU: 1 UID: 0 PID: 17580 Comm: syz.5.3712 Tainted: G L syzkaller #0 PREEMPT(full) [ 826.118654][T17580] Tainted: [L]=SOFTLOCKUP [ 826.118663][T17580] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 826.118676][T17580] Call Trace: [ 826.118685][T17580] [ 826.118694][T17580] dump_stack_lvl+0xe8/0x150 [ 826.118731][T17580] should_fail_ex+0x410/0x560 [ 826.118762][T17580] should_failslab+0xa8/0x100 [ 826.118788][T17580] kmem_cache_alloc_noprof+0xa6/0x5f0 [ 826.118820][T17580] ? security_inode_alloc+0x39/0x310 [ 826.118846][T17580] ? security_inode_alloc+0x39/0x310 [ 826.118881][T17580] security_inode_alloc+0x39/0x310 [ 826.118911][T17580] inode_init_always_gfp+0x97e/0xd30 [ 826.118952][T17580] ? __pfx_proc_alloc_inode+0x10/0x10 [ 826.118979][T17580] alloc_inode+0x82/0x1b0 [ 826.119015][T17580] new_inode+0x1f/0x170 [ 826.119034][T17580] ? proc_pid_make_inode+0x19/0x130 [ 826.119069][T17580] proc_pid_make_inode+0x21/0x130 [ 826.119105][T17580] proc_fd_instantiate+0x54/0x2f0 [ 826.119126][T17580] ? fput+0xa0/0xd0 [ 826.119161][T17580] proc_lookupfd_common+0x13e/0x250 [ 826.119185][T17580] ? d_lookup+0x1f/0xa0 [ 826.119210][T17580] ? __pfx_proc_fd_instantiate+0x10/0x10 [ 826.119233][T17580] ? __pfx_proc_lookupfd_common+0x10/0x10 [ 826.119266][T17580] ? seqcount_lockdep_reader_access+0xa9/0x100 [ 826.119311][T17580] lookup_open+0x9e1/0x1a40 [ 826.119365][T17580] path_openat+0x677/0x1d60 [ 826.119413][T17580] do_file_open+0x23e/0x4a0 [ 826.119446][T17580] ? __pfx_do_file_open+0x10/0x10 [ 826.119497][T17580] ? _raw_spin_unlock+0x28/0x50 [ 826.119528][T17580] ? alloc_fd+0x651/0x6c0 [ 826.119576][T17580] do_sys_openat2+0x115/0x200 [ 826.119614][T17580] ? __pfx_do_sys_openat2+0x10/0x10 [ 826.119661][T17580] __se_sys_openat2+0x223/0x2d0 [ 826.119697][T17580] ? __pfx___se_sys_openat2+0x10/0x10 [ 826.119740][T17580] ? __seccomp_permit_syscall+0xe7/0x2b0 [ 826.119781][T17580] do_syscall_64+0x166/0x520 [ 826.119803][T17580] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 826.119827][T17580] ? clear_bhb_loop+0x70/0xc0 [ 826.119856][T17580] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 826.119879][T17580] RIP: 0033:0x7f60ce79e0d9 [ 826.119902][T17580] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 826.119925][T17580] RSP: 002b:00007f60cf666028 EFLAGS: 00000246 ORIG_RAX: 00000000000001b5 [ 826.119949][T17580] RAX: ffffffffffffffda RBX: 00007f60cea25fa0 RCX: 00007f60ce79e0d9 [ 826.119966][T17580] RDX: 0000200000000140 RSI: 0000200000000000 RDI: ffffffffffffff9c [ 826.119983][T17580] RBP: 00007f60cf666090 R08: 0000000000000000 R09: 0000000000000000 [ 826.119998][T17580] R10: 0000000000000018 R11: 0000000000000246 R12: 0000000000000002 [ 826.120013][T17580] R13: 00007f60cea26038 R14: 00007f60cea25fa0 R15: 00007f60ceb4fa48 [ 826.120048][T17580] [ 826.474399][ T5703] usb 3-1: new high-speed USB device number 20 using dummy_hcd [ 826.575261][ T5676] usb 1-1: Audio class v2/v3 interfaces need an interface association [ 826.624561][ T5703] usb 3-1: Using ep0 maxpacket: 32 [ 826.635256][ T5703] usb 3-1: unable to get BOS descriptor or descriptor too short [ 826.643129][ T5703] usb 3-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 826.653939][ T5703] usb 3-1: config 14 has an invalid interface number: 57 but max is 1 [ 826.662227][ T5703] usb 3-1: config 14 has an invalid interface number: 228 but max is 1 [ 826.670964][ T5703] usb 3-1: config 14 has no interface number 0 [ 826.677622][ T5703] usb 3-1: config 14 has no interface number 1 [ 826.684276][ T5703] usb 3-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 826.695163][ T5703] usb 3-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 826.707362][ T5703] usb 3-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 826.719050][ T5703] usb 3-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 826.733411][ T5703] usb 3-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 826.745857][ T5703] usb 3-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 826.759580][ T5703] usb 3-1: config 14 interface 57 has no altsetting 0 [ 826.766859][ T5703] usb 3-1: config 14 interface 228 has no altsetting 0 [ 826.777312][ T5703] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 826.785850][ T5703] usb 3-1: Product: syz [ 826.790231][ T5703] usb 3-1: Manufacturer: syz [ 826.796520][ T5703] usb 3-1: SerialNumber: syz [ 826.819055][ T5676] snd-usb-audio 1-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 826.840836][ T5676] usb 1-1: USB disconnect, device number 16 [ 826.866856][T12635] udevd[12635]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 827.014546][ T5683] get_1284_register timeout [ 827.023679][ C0] usb 2-1: async_complete: urb error -104 [ 827.029809][ C0] usb 2-1: async_complete: urb error -104 [ 827.035730][ C0] usb 2-1: async_complete: urb error -104 [ 827.145127][T17613] vivid-001: disconnect [ 827.228146][ T5703] legousbtower 3-1:14.57: interrupt endpoints not found [ 827.271287][T17617] sctp: [Deprecated]: syz.0.3715 (pid 17617) Use of struct sctp_assoc_value in delayed_ack socket option. [ 827.271287][T17617] Use struct sctp_sack_info instead [ 827.357796][T17619] syzkaller0: entered promiscuous mode [ 827.363600][T17619] syzkaller0: entered allmulticast mode [ 827.386778][T17624] sctp: [Deprecated]: syz.0.3717 (pid 17624) Use of int in max_burst socket option deprecated. [ 827.386778][T17624] Use struct sctp_assoc_value instead [ 827.442051][T17619] bond3: (slave bond_slave_1): Device is not our slave [ 827.466431][T17619] bond3: option active_slave: invalid value (bond_slave_1) [ 827.479930][T17619] bond3 (unregistering): Released all slaves [ 827.529519][T17613] vivid-001: reconnect [ 827.630884][ T5703] legousbtower 3-1:14.228: LEGO USB Tower firmware version is 0.0 build 0 [ 827.693520][ T5703] legousbtower 3-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 827.708797][T17697] netlink: 'syz.0.3718': attribute type 2 has an invalid length. [ 828.205460][T17714] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 828.248838][T17714] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 828.402903][ T5683] usb 3-1: USB disconnect, device number 20 [ 828.462224][ T5683] legousbtower 3-1:14.228: LEGO USB Tower #-160 now disconnected [ 828.629257][T17733] sctp: [Deprecated]: syz.0.3727 (pid 17733) Use of struct sctp_assoc_value in delayed_ack socket option. [ 828.629257][T17733] Use struct sctp_sack_info instead [ 829.644312][ T5703] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 829.724745][T17775] sctp: [Deprecated]: syz.3.3738 (pid 17775) Use of struct sctp_assoc_value in delayed_ack socket option. [ 829.724745][T17775] Use struct sctp_sack_info instead [ 829.804169][ T5703] usb 3-1: device descriptor read/64, error -71 [ 829.924227][ T5676] usb 6-1: new high-speed USB device number 43 using dummy_hcd [ 830.074218][ T5703] usb 3-1: new high-speed USB device number 22 using dummy_hcd [ 830.094129][ T5676] usb 6-1: Using ep0 maxpacket: 32 [ 830.102960][ T5676] usb 6-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=93.d8 [ 830.119443][ T5676] usb 6-1: config 0 has an invalid interface number: 1 but max is 0 [ 830.128116][ T5676] usb 6-1: config 0 has no interface number 0 [ 830.138824][ T5676] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 830.148044][ T5676] usb 6-1: Product: syz [ 830.152378][ T5676] usb 6-1: Manufacturer: syz [ 830.157191][ T5676] usb 6-1: SerialNumber: syz [ 830.173889][ T5676] usb 6-1: config 0 descriptor?? [ 830.185419][ T5676] usb 6-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 830.195119][ T5676] usb 6-1: selecting invalid altsetting 1 [ 830.200986][ T5676] usb 6-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 830.223569][ T5676] usb 6-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 830.224628][ T5703] usb 3-1: device descriptor read/64, error -71 [ 830.246901][ T5676] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 830.258557][ T5676] usb 6-1: media controller created [ 830.302131][ T5676] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 830.392176][T17769] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 830.414856][ T5703] usb usb3-port1: attempt power cycle [ 830.437409][T17769] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 830.531952][ T5676] usb 6-1: dvb_usb_ce6230: usb_control_msg() failed=-71 [ 830.561974][ T5676] zl10353_read_register: readreg error (reg=127, ret==-71) [ 830.571262][ T5676] usb 6-1: dvb_usb_ce6230: usb_set_interface() failed=-71 [ 830.685067][ T5702] usb 1-1: new high-speed USB device number 17 using dummy_hcd [ 830.743313][T17838] ip_tables: iptables: counters copy to user failed while replacing table [ 830.774480][ T5703] usb 3-1: new high-speed USB device number 23 using dummy_hcd [ 830.793112][ T5676] usb 6-1: USB disconnect, device number 43 [ 830.828887][ T5703] usb 3-1: device descriptor read/8, error -71 [ 830.865604][ T5702] usb 1-1: Using ep0 maxpacket: 32 [ 830.880002][ T5702] usb 1-1: unable to get BOS descriptor or descriptor too short [ 830.888228][ T5702] usb 1-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 830.899960][ T5702] usb 1-1: config 14 has an invalid interface number: 57 but max is 1 [ 830.908645][ T5702] usb 1-1: config 14 has an invalid interface number: 228 but max is 1 [ 830.916985][T17840] syzkaller0: entered promiscuous mode [ 830.917012][T17840] syzkaller0: entered allmulticast mode [ 830.932097][ T5702] usb 1-1: config 14 has no interface number 0 [ 830.938464][ T5702] usb 1-1: config 14 has no interface number 1 [ 830.946088][ T5702] usb 1-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 830.957629][ T5702] usb 1-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 830.969691][ T5702] usb 1-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 830.986563][ T5702] usb 1-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 830.998591][ T5702] usb 1-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 831.017678][ T5702] usb 1-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 831.034830][ T5702] usb 1-1: config 14 interface 57 has no altsetting 0 [ 831.041695][ T5702] usb 1-1: config 14 interface 228 has no altsetting 0 [ 831.053062][ T5702] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 831.061824][ T5702] usb 1-1: Product: syz [ 831.068604][ T5702] usb 1-1: Manufacturer: syz [ 831.073454][ T5702] usb 1-1: SerialNumber: syz [ 831.078883][ T5703] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 831.102850][T17840] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3745'. [ 831.109434][ T5703] usb 3-1: device descriptor read/8, error -71 [ 831.191434][T17855] netlink: 24 bytes leftover after parsing attributes in process `syz.5.3746'. [ 831.226208][ T5703] usb usb3-port1: unable to enumerate USB device [ 831.359679][T17864] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3748'. [ 831.372422][T17858] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3747'. [ 831.518701][ T5702] legousbtower 1-1:14.57: interrupt endpoints not found [ 831.564200][T17764] Bluetooth: hci1: command 0x0406 tx timeout [ 831.607506][T17871] netlink: 36 bytes leftover after parsing attributes in process `syz.1.3749'. [ 831.629801][T17871] sctp: [Deprecated]: syz.1.3749 (pid 17871) Use of struct sctp_assoc_value in delayed_ack socket option. [ 831.629801][T17871] Use struct sctp_sack_info instead [ 831.727591][T17878] FAULT_INJECTION: forcing a failure. [ 831.727591][T17878] name failslab, interval 1, probability 0, space 0, times 0 [ 831.740824][T17878] CPU: 1 UID: 0 PID: 17878 Comm: syz.1.3751 Tainted: G L syzkaller #0 PREEMPT(full) [ 831.740852][T17878] Tainted: [L]=SOFTLOCKUP [ 831.740861][T17878] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 831.740872][T17878] Call Trace: [ 831.740879][T17878] [ 831.740885][T17878] dump_stack_lvl+0xe8/0x150 [ 831.740913][T17878] should_fail_ex+0x410/0x560 [ 831.740934][T17878] should_failslab+0xa8/0x100 [ 831.740951][T17878] __kmalloc_cache_noprof+0xa8/0x660 [ 831.740974][T17878] ? nft_pernet+0x23/0x240 [ 831.740997][T17878] ? nf_tables_newchain+0xf9c/0x28b0 [ 831.741018][T17878] ? nf_tables_newchain+0xf9c/0x28b0 [ 831.741044][T17878] nf_tables_newchain+0xf9c/0x28b0 [ 831.741076][T17878] ? __pfx_nf_tables_newchain+0x10/0x10 [ 831.741118][T17878] ? nfnl_pernet+0x23/0x240 [ 831.741141][T17878] ? nfnl_pernet+0x23/0x240 [ 831.741170][T17878] ? __nla_parse+0x40/0x60 [ 831.741195][T17878] nfnetlink_rcv+0x1288/0x28c0 [ 831.741243][T17878] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 831.741278][T17878] ? ref_tracker_free+0x689/0x830 [ 831.741314][T17878] ? skb_clone+0x246/0x3a0 [ 831.741332][T17878] ? __netlink_deliver_tap+0x811/0x860 [ 831.741378][T17878] ? netlink_deliver_tap+0x2e/0x1b0 [ 831.741398][T17878] ? netlink_deliver_tap+0x2e/0x1b0 [ 831.741426][T17878] netlink_unicast+0x7bd/0x940 [ 831.741466][T17878] netlink_sendmsg+0x813/0xb40 [ 831.741488][T17878] ? __pfx_netlink_sendmsg+0x10/0x10 [ 831.741507][T17878] ? aa_sock_msg_perm+0xf6/0x1c0 [ 831.741530][T17878] ? __pfx_netlink_sendmsg+0x10/0x10 [ 831.741545][T17878] sock_sendmsg_nosec+0x13a/0x180 [ 831.741579][T17878] ____sys_sendmsg+0x54e/0x850 [ 831.741621][T17878] ? __pfx_____sys_sendmsg+0x10/0x10 [ 831.741661][T17878] ? import_iovec+0x73/0xa0 [ 831.741683][T17878] ___sys_sendmsg+0x2a5/0x360 [ 831.741722][T17878] ? __lock_acquire+0x683/0x2cf0 [ 831.741748][T17878] ? __pfx____sys_sendmsg+0x10/0x10 [ 831.741799][T17878] ? __fget_files+0x2a/0x420 [ 831.741813][T17878] ? __fget_files+0x3a2/0x420 [ 831.741836][T17878] __x64_sys_sendmsg+0x1b1/0x290 [ 831.741863][T17878] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 831.741913][T17878] do_syscall_64+0x166/0x520 [ 831.741928][T17878] ? trace_irq_disable+0x3b/0x140 [ 831.741949][T17878] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 831.741965][T17878] ? clear_bhb_loop+0x70/0xc0 [ 831.741985][T17878] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 831.742001][T17878] RIP: 0033:0x7f7a8159e0d9 [ 831.742016][T17878] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 831.742031][T17878] RSP: 002b:00007f7a82414028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 831.742048][T17878] RAX: ffffffffffffffda RBX: 00007f7a81825fa0 RCX: 00007f7a8159e0d9 [ 831.742060][T17878] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 831.742070][T17878] RBP: 00007f7a82414090 R08: 0000000000000000 R09: 0000000000000000 [ 831.742080][T17878] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 831.742090][T17878] R13: 00007f7a81826038 R14: 00007f7a81825fa0 R15: 00007f7a8194fa48 [ 831.742114][T17878] [ 832.076854][ T5702] legousbtower 1-1:14.228: LEGO USB Tower firmware version is 0.0 build 0 [ 832.097571][ T5702] legousbtower 1-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 832.452835][T17897] netlink: 9 bytes leftover after parsing attributes in process `syz.2.3754'. [ 832.462065][T17897] 0: renamed from hsr0 (while UP) [ 832.473126][T17897] 0: entered allmulticast mode [ 832.478181][T17897] hsr_slave_0: entered allmulticast mode [ 832.484662][T17897] hsr_slave_1: entered allmulticast mode [ 832.491032][T17897] A link change request failed with some changes committed already. Interface c0 may have been left with an inconsistent configuration, please check. [ 832.653438][T17880] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 832.709150][T17880] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 832.774532][ T5703] usb 3-1: new high-speed USB device number 25 using dummy_hcd [ 832.825356][T17909] kvm: vcpu 2: requested lapic timer restore with starting count register 0x390=198462431 (396924862 ns) > initial count (148514 ns). Using initial count to start timer. [ 832.849464][ T5702] usb 1-1: USB disconnect, device number 17 [ 832.907811][ T5702] legousbtower 1-1:14.228: LEGO USB Tower #-160 now disconnected [ 832.917120][ T5703] usb 3-1: device descriptor read/64, error -71 [ 833.014513][ T3480] usb 4-1: new high-speed USB device number 29 using dummy_hcd [ 833.167037][ T5703] usb 3-1: new high-speed USB device number 26 using dummy_hcd [ 833.177379][ T3480] usb 4-1: Using ep0 maxpacket: 32 [ 833.189307][ T3480] usb 4-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=93.d8 [ 833.201610][ T3480] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 833.210414][ T3480] usb 4-1: config 0 has no interface number 0 [ 833.222741][ T3480] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 833.231722][ T3480] usb 4-1: Product: syz [ 833.236350][ T3480] usb 4-1: Manufacturer: syz [ 833.241107][ T3480] usb 4-1: SerialNumber: syz [ 833.250001][ T3480] usb 4-1: config 0 descriptor?? [ 833.267117][ T3480] usb 4-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 833.277808][ T3480] usb 4-1: selecting invalid altsetting 1 [ 833.288122][ T3480] usb 4-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 833.307208][ T3480] usb 4-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 833.318399][ T3480] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 833.327684][ T5703] usb 3-1: device descriptor read/64, error -71 [ 833.347528][ T3480] usb 4-1: media controller created [ 833.366232][ T3480] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 833.444627][ T5703] usb usb3-port1: attempt power cycle [ 833.453733][T17947] loop4: detected capacity change from 0 to 7 [ 833.486911][T17911] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 833.503957][T17947] Dev loop4: unable to read RDB block 7 [ 833.515364][T17947] loop4: AHDI p1 p2 p3 [ 833.520859][T17911] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 833.538624][T17947] loop4: partition table partially beyond EOD, truncated [ 833.561369][T17947] loop4: p1 start 1601398130 is beyond EOD, truncated [ 833.570345][T17956] netlink: 36 bytes leftover after parsing attributes in process `syz.1.3761'. [ 833.589926][T17947] loop4: p2 start 1702059890 is beyond EOD, truncated [ 833.590809][T17956] sctp: [Deprecated]: syz.1.3761 (pid 17956) Use of struct sctp_assoc_value in delayed_ack socket option. [ 833.590809][T17956] Use struct sctp_sack_info instead [ 833.625107][ T3480] usb 4-1: dvb_usb_ce6230: usb_control_msg() failed=-71 [ 833.634492][ T3480] zl10353_read_register: readreg error (reg=127, ret==-71) [ 833.653153][ T3480] usb 4-1: dvb_usb_ce6230: usb_set_interface() failed=-71 [ 833.754362][ T3480] usb 4-1: USB disconnect, device number 29 [ 833.789720][ T5683] usb 1-1: new full-speed USB device number 18 using dummy_hcd [ 833.798550][ T5703] usb 3-1: new high-speed USB device number 27 using dummy_hcd [ 833.834956][ T5703] usb 3-1: device descriptor read/8, error -71 [ 833.944151][ T5683] usb 1-1: device descriptor read/64, error -71 [ 834.084296][ T5703] usb 3-1: new high-speed USB device number 28 using dummy_hcd [ 834.094546][ T24] usb 6-1: new full-speed USB device number 44 using dummy_hcd [ 834.105712][ T5703] usb 3-1: device descriptor read/8, error -71 [ 834.195694][ T5683] usb 1-1: new full-speed USB device number 19 using dummy_hcd [ 834.216307][ T5703] usb usb3-port1: unable to enumerate USB device [ 834.255785][ T24] usb 6-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 834.266708][ T24] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 834.277695][ T24] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBE, changing to 0x8E [ 834.289488][ T24] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 10 [ 834.300938][ T24] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 834.314177][ T24] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 834.329690][ T24] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 834.338271][ T24] usb 6-1: Product: syz [ 834.342554][ T24] usb 6-1: Manufacturer: syz [ 834.344284][ T5683] usb 1-1: device descriptor read/64, error -71 [ 834.347600][ T24] usb 6-1: SerialNumber: syz [ 834.362113][ T24] usb 6-1: config 0 descriptor?? [ 834.434159][ T3480] usb 4-1: new high-speed USB device number 30 using dummy_hcd [ 834.466280][ T5683] usb usb1-port1: attempt power cycle [ 834.564124][ T3480] usb 4-1: device descriptor read/64, error -71 [ 834.575364][ T24] radio-si470x 6-1:0.0: DeviceID=0x0000 ChipID=0x0000 [ 834.582405][ T24] radio-si470x 6-1:0.0: This driver is known to work with firmware version 12, but the device has firmware version 0. [ 834.778074][ T24] radio-si470x 6-1:0.0: si470x_get_report: usb_control_msg returned -71 [ 834.806094][ T3480] usb 4-1: new high-speed USB device number 31 using dummy_hcd [ 834.820012][ T24] radio-si470x 6-1:0.0: si470x_get_scratch: si470x_get_report returned -71 [ 834.836782][ T5683] usb 1-1: new full-speed USB device number 20 using dummy_hcd [ 834.874743][ T24] radio-si470x 6-1:0.0: probe with driver radio-si470x failed with error -5 [ 834.884813][ T5683] usb 1-1: device descriptor read/8, error -71 [ 834.902250][ T24] usb 6-1: USB disconnect, device number 44 [ 834.921937][T17997] sctp: [Deprecated]: syz.1.3766 (pid 17997) Use of int in max_burst socket option deprecated. [ 834.921937][T17997] Use struct sctp_assoc_value instead [ 834.989261][ T3480] usb 4-1: device descriptor read/64, error -71 [ 835.108373][ T3480] usb usb4-port1: attempt power cycle [ 835.184090][ T5683] usb 1-1: new full-speed USB device number 21 using dummy_hcd [ 835.234901][ T5683] usb 1-1: device descriptor read/8, error -71 [ 835.315725][T18006] netlink: 4912 bytes leftover after parsing attributes in process `syz.1.3768'. [ 835.364478][ T5683] usb usb1-port1: unable to enumerate USB device [ 835.465397][ T3480] usb 4-1: new high-speed USB device number 32 using dummy_hcd [ 835.493800][T18012] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3769'. [ 835.505904][ T3480] usb 4-1: device descriptor read/8, error -71 [ 835.596335][T18021] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 835.608447][T18021] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 835.640302][T18021] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 835.661657][T18021] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 835.689313][T18027] vivid-000: disconnect [ 835.713522][T18029] netlink: 36 bytes leftover after parsing attributes in process `syz.2.3772'. [ 835.725956][T18029] sctp: [Deprecated]: syz.2.3772 (pid 18029) Use of struct sctp_assoc_value in delayed_ack socket option. [ 835.725956][T18029] Use struct sctp_sack_info instead [ 835.754484][ T3480] usb 4-1: new high-speed USB device number 33 using dummy_hcd [ 835.774863][ T3480] usb 4-1: device descriptor read/8, error -71 [ 835.886680][ T3480] usb usb4-port1: unable to enumerate USB device [ 836.038901][T18027] vivid-000: reconnect [ 836.054828][ T5676] usb 3-1: new high-speed USB device number 29 using dummy_hcd [ 836.224101][ T5676] usb 3-1: Using ep0 maxpacket: 8 [ 836.233156][ T5676] usb 3-1: unable to get BOS descriptor set [ 836.242495][ T5676] usb 3-1: New USB device found, idVendor=0582, idProduct=0075, bcdDevice=fc.ef [ 836.255628][ T5676] usb 3-1: config 32 has an invalid interface number: 69 but max is 1 [ 836.266093][ T5676] usb 3-1: config 32 has an invalid interface number: 61 but max is 1 [ 836.276905][ T5676] usb 3-1: config 32 has no interface number 0 [ 836.283200][ T5676] usb 3-1: config 32 has no interface number 1 [ 836.290081][ T5676] usb 3-1: config 32 interface 69 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 836.301421][ T5676] usb 3-1: config 32 interface 69 altsetting 0 endpoint 0xE has invalid maxpacket 1023, setting to 64 [ 836.312697][ T5676] usb 3-1: config 32 interface 61 altsetting 142 endpoint 0xB has invalid maxpacket 1024, setting to 64 [ 836.324704][ T5676] usb 3-1: config 32 interface 61 altsetting 142 has a duplicate endpoint with address 0xB, skipping [ 836.335126][ T3480] usb 6-1: new high-speed USB device number 45 using dummy_hcd [ 836.337843][ T5676] usb 3-1: config 32 interface 61 altsetting 142 endpoint 0xA has an invalid bInterval 48, changing to 9 [ 836.359941][ T5676] usb 3-1: config 32 interface 61 altsetting 142 endpoint 0x2 has invalid maxpacket 1024, setting to 64 [ 836.368801][T18043] mac80211_hwsim hwsim37 wlan0: entered promiscuous mode [ 836.381279][ T5676] usb 3-1: config 32 interface 61 altsetting 142 endpoint 0xF has invalid maxpacket 1023, setting to 64 [ 836.393340][ T5676] usb 3-1: config 32 interface 61 altsetting 142 has an invalid descriptor for endpoint zero, skipping [ 836.405669][ T5676] usb 3-1: config 32 interface 61 has no altsetting 0 [ 836.416213][ T5676] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 836.425335][ T5676] usb 3-1: Product: syz [ 836.430058][ T5676] usb 3-1: Manufacturer: syz [ 836.436734][ T5676] usb 3-1: SerialNumber: syz [ 836.518338][ T3480] usb 6-1: Using ep0 maxpacket: 32 [ 836.535315][ T3480] usb 6-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=93.d8 [ 836.558839][ T3480] usb 6-1: config 0 has an invalid interface number: 1 but max is 0 [ 836.570506][ T3480] usb 6-1: config 0 has no interface number 0 [ 836.587046][ T3480] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 836.598284][ T3480] usb 6-1: Product: syz [ 836.602548][ T3480] usb 6-1: Manufacturer: syz [ 836.609007][ T3480] usb 6-1: SerialNumber: syz [ 836.642577][ T3480] usb 6-1: config 0 descriptor?? [ 836.667658][ T3480] usb 6-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 836.706992][ T3480] usb 6-1: selecting invalid altsetting 1 [ 836.728260][ T3480] usb 6-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 836.770135][ T3480] usb 6-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 836.797290][ T3480] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 836.811255][T18068] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3773'. [ 836.826162][ T3480] usb 6-1: media controller created [ 836.891681][T18038] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 836.915479][T18038] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 836.934945][ T3480] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 837.015072][ T3480] usb 6-1: dvb_usb_ce6230: usb_control_msg() failed=-71 [ 837.020089][ T5676] usb 3-1: USB disconnect, device number 29 [ 837.023134][ T3480] zl10353_read_register: readreg error (reg=127, ret==-71) [ 837.045543][ T3480] usb 6-1: dvb_usb_ce6230: usb_set_interface() failed=-71 [ 837.235102][ T3480] usb 6-1: USB disconnect, device number 45 [ 837.391903][T18110] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3782'. [ 837.622733][ T30] audit: type=1326 audit(1787237564.199:10831): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18116 comm="syz.0.3783" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f236b19e0d9 code=0x0 [ 837.696570][T18118] : renamed from vlan0 (while UP) [ 837.984519][ T3480] usb 6-1: new high-speed USB device number 46 using dummy_hcd [ 838.145662][ T5732] usb 4-1: new high-speed USB device number 34 using dummy_hcd [ 838.164233][ T3480] usb 6-1: Using ep0 maxpacket: 32 [ 838.172287][ T3480] usb 6-1: unable to get BOS descriptor or descriptor too short [ 838.180850][ T3480] usb 6-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 838.193260][ T3480] usb 6-1: config 14 has an invalid interface number: 57 but max is 1 [ 838.205250][ T3480] usb 6-1: config 14 has an invalid interface number: 228 but max is 1 [ 838.214667][ T3480] usb 6-1: config 14 has no interface number 0 [ 838.221028][ T3480] usb 6-1: config 14 has no interface number 1 [ 838.228891][ T3480] usb 6-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 838.242062][ T3480] usb 6-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 838.258246][ T3480] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 838.271368][ T3480] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 838.283881][ T3480] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 838.298031][ T3480] usb 6-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 838.316373][ T3480] usb 6-1: config 14 interface 57 has no altsetting 0 [ 838.323754][ T3480] usb 6-1: config 14 interface 228 has no altsetting 0 [ 838.338453][ T3480] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 838.361459][ T3480] usb 6-1: Product: syz [ 838.388030][ T3480] usb 6-1: Manufacturer: syz [ 838.398950][ T3480] usb 6-1: SerialNumber: syz [ 838.410378][T18134] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 838.440726][T18134] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 838.516257][ T5732] usb 4-1: unable to get BOS descriptor or descriptor too short [ 838.524594][ T5732] usb 4-1: New USB device found, idVendor=0069, idProduct=0000, bcdDevice= 0.00 [ 838.552345][ T5732] usb 4-1: no configurations [ 838.573371][ T5732] usb 4-1: can't read configurations, error -22 [ 838.837649][T18147] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3788'. [ 838.851550][ T3480] legousbtower 6-1:14.57: interrupt endpoints not found [ 838.864463][ T24] usb 1-1: new high-speed USB device number 22 using dummy_hcd [ 839.024452][ T24] usb 1-1: Using ep0 maxpacket: 32 [ 839.056906][ T24] usb 1-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=93.d8 [ 839.086280][ T24] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 839.104809][ T24] usb 1-1: config 0 has no interface number 0 [ 839.128244][ T24] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 839.153956][ T24] usb 1-1: Product: syz [ 839.166931][ T24] usb 1-1: Manufacturer: syz [ 839.171682][ T24] usb 1-1: SerialNumber: syz [ 839.210064][T18155] netlink: 36 bytes leftover after parsing attributes in process `syz.2.3791'. [ 839.225720][ T24] usb 1-1: config 0 descriptor?? [ 839.250100][T18155] sctp: [Deprecated]: syz.2.3791 (pid 18155) Use of struct sctp_assoc_value in delayed_ack socket option. [ 839.250100][T18155] Use struct sctp_sack_info instead [ 839.278278][ T24] usb 1-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 839.306296][ T3480] legousbtower 6-1:14.228: LEGO USB Tower firmware version is 0.0 build 0 [ 839.325148][ T24] usb 1-1: selecting invalid altsetting 1 [ 839.364098][ T24] usb 1-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 839.375025][ T3480] legousbtower 6-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 839.397329][ T24] usb 1-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 839.443951][ T24] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 839.453540][ T24] usb 1-1: media controller created [ 839.471594][ T24] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 839.547705][T18176] netlink: 56 bytes leftover after parsing attributes in process `syz.2.3794'. [ 839.558598][ T24] usb 1-1: dvb_usb_ce6230: usb_control_msg() failed=-71 [ 839.566840][ T24] zl10353_read_register: readreg error (reg=127, ret==-71) [ 839.597612][ T24] usb 1-1: dvb_usb_ce6230: usb_set_interface() failed=-71 [ 839.645127][ T5732] usb 4-1: new high-speed USB device number 35 using dummy_hcd [ 839.733723][ T24] usb 1-1: USB disconnect, device number 22 [ 839.814159][ T5732] usb 4-1: device descriptor read/64, error -71 [ 839.874750][T18196] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 839.890592][T18196] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 839.926348][ T5732] usb usb4-port1: attempt power cycle [ 839.944098][ T9] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 840.075845][ T5676] usb 6-1: USB disconnect, device number 46 [ 840.105024][ T9] usb 3-1: Using ep0 maxpacket: 32 [ 840.112454][ T5676] legousbtower 6-1:14.228: LEGO USB Tower #-160 now disconnected [ 840.128284][ T9] usb 3-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=93.d8 [ 840.149326][ T9] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 840.162263][ T9] usb 3-1: config 0 has no interface number 0 [ 840.173335][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 840.181843][ T9] usb 3-1: Product: syz [ 840.186448][ T9] usb 3-1: Manufacturer: syz [ 840.191105][ T9] usb 3-1: SerialNumber: syz [ 840.202104][ T9] usb 3-1: config 0 descriptor?? [ 840.212070][ T9] usb 3-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 840.221180][ T9] usb 3-1: selecting invalid altsetting 1 [ 840.227306][ T9] usb 3-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 840.237921][ T9] usb 3-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 840.249832][ T9] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 840.258773][ T9] usb 3-1: media controller created [ 840.264505][ T5732] usb 4-1: new high-speed USB device number 36 using dummy_hcd [ 840.280445][ T9] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 840.287175][ T5732] usb 4-1: device descriptor read/8, error -71 [ 840.414254][T18182] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 840.423393][T18182] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 840.441537][ T9] usb 3-1: dvb_usb_ce6230: usb_control_msg() failed=-71 [ 840.457159][ T9] zl10353_read_register: readreg error (reg=127, ret==-71) [ 840.465833][ T9] usb 3-1: dvb_usb_ce6230: usb_set_interface() failed=-71 [ 840.508089][ T9] usb 3-1: USB disconnect, device number 30 [ 840.538481][ T5732] usb 4-1: new high-speed USB device number 37 using dummy_hcd [ 840.565688][ T5732] usb 4-1: device descriptor read/8, error -71 [ 840.674839][ T5732] usb usb4-port1: unable to enumerate USB device [ 840.740457][T18236] FAULT_INJECTION: forcing a failure. [ 840.740457][T18236] name failslab, interval 1, probability 0, space 0, times 0 [ 840.754866][T18236] CPU: 1 UID: 0 PID: 18236 Comm: syz.5.3799 Tainted: G L syzkaller #0 PREEMPT(full) [ 840.754903][T18236] Tainted: [L]=SOFTLOCKUP [ 840.754912][T18236] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 840.754926][T18236] Call Trace: [ 840.754935][T18236] [ 840.754945][T18236] dump_stack_lvl+0xe8/0x150 [ 840.754982][T18236] should_fail_ex+0x410/0x560 [ 840.755021][T18236] should_failslab+0xa8/0x100 [ 840.755047][T18236] __kmalloc_cache_noprof+0xa8/0x660 [ 840.755079][T18236] ? __asan_memcpy+0x40/0x70 [ 840.755106][T18236] ? mpi_alloc+0x52/0x140 [ 840.755128][T18236] ? mpi_alloc+0x52/0x140 [ 840.755158][T18236] mpi_alloc+0x52/0x140 [ 840.755185][T18236] mpi_read_raw_data+0x139/0x970 [ 840.755219][T18236] dh_set_secret+0x193/0x320 [ 840.755249][T18236] ? crypto_create_tfm_node+0x81/0x3c0 [ 840.755279][T18236] ? __pfx_dh_set_secret+0x10/0x10 [ 840.755314][T18236] ? crypto_alloc_tfm_node+0x3b5/0x3e0 [ 840.755349][T18236] __keyctl_dh_compute+0x5ae/0xd10 [ 840.755390][T18236] ? __pfx___keyctl_dh_compute+0x10/0x10 [ 840.755432][T18236] ? __might_fault+0xaf/0x130 [ 840.755482][T18236] keyctl_dh_compute+0x124/0x180 [ 840.755513][T18236] ? __pfx_keyctl_dh_compute+0x10/0x10 [ 840.755559][T18236] __se_sys_keyctl+0x44c/0x9d0 [ 840.755585][T18236] ? __pfx___se_sys_keyctl+0x10/0x10 [ 840.755605][T18236] ? __mutex_unlock_slowpath+0x731/0x900 [ 840.755631][T18236] ? __fget_files+0x2a/0x420 [ 840.755654][T18236] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 840.755677][T18236] ? __fget_files+0x3a2/0x420 [ 840.755705][T18236] ? fput+0xa0/0xd0 [ 840.755736][T18236] ? ksys_write+0x242/0x270 [ 840.755762][T18236] ? __pfx_ksys_write+0x10/0x10 [ 840.755792][T18236] ? __x64_sys_keyctl+0x20/0xc0 [ 840.755816][T18236] do_syscall_64+0x166/0x520 [ 840.755837][T18236] ? trace_irq_disable+0x3b/0x140 [ 840.755865][T18236] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 840.755889][T18236] ? clear_bhb_loop+0x70/0xc0 [ 840.755916][T18236] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 840.755939][T18236] RIP: 0033:0x7f60ce79e0d9 [ 840.755970][T18236] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 840.755991][T18236] RSP: 002b:00007f60cf666028 EFLAGS: 00000246 ORIG_RAX: 00000000000000fa [ 840.756021][T18236] RAX: ffffffffffffffda RBX: 00007f60cea25fa0 RCX: 00007f60ce79e0d9 [ 840.756038][T18236] RDX: 0000200000000140 RSI: 0000200000000200 RDI: 0000000000000017 [ 840.756053][T18236] RBP: 00007f60cf666090 R08: 0000200000000000 R09: 0000000000000000 [ 840.756069][T18236] R10: 0000000000000044 R11: 0000000000000246 R12: 0000000000000002 [ 840.756083][T18236] R13: 00007f60cea26038 R14: 00007f60cea25fa0 R15: 00007f60ceb4fa48 [ 840.756117][T18236] [ 841.208956][T18255] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 841.224669][T18255] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 841.324144][ T9] usb 1-1: new high-speed USB device number 23 using dummy_hcd [ 841.333066][ T5676] usb 6-1: new high-speed USB device number 47 using dummy_hcd [ 841.348915][T18261] CIFS: iocharset name too long [ 841.485035][ T9] usb 1-1: New USB device found, idVendor=0582, idProduct=0582, bcdDevice= 0.40 [ 841.497396][ T9] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 841.515721][ T5676] usb 6-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 841.535639][ T5676] usb 6-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 841.545932][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 841.564082][ T5676] usb 6-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 841.574489][ T9] usb 1-1: Product: syz [ 841.584043][ T9] usb 1-1: Manufacturer: syz [ 841.588757][ T5676] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 841.599516][ T9] usb 1-1: SerialNumber: syz [ 841.614067][ T5676] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 841.639795][ T9] usb 1-1: 1:1 : unsupported format bits 0x20000 [ 841.646653][ T5676] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 841.660553][ T5676] usb 6-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 841.668753][ T5676] usb 6-1: Product: syz [ 841.673864][ T5676] usb 6-1: Manufacturer: syz [ 841.695062][ T5676] cdc_wdm 6-1:1.0: skipping garbage [ 841.702434][ T5676] cdc_wdm 6-1:1.0: skipping garbage [ 841.714211][ T5676] cdc_wdm 6-1:1.0: cdc-wdm0: USB WDM device [ 841.722774][ T5676] cdc_wdm 6-1:1.0: Unknown control protocol [ 841.841443][T18242] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 841.860739][T18242] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 841.903475][T18274] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 841.915239][ T9] usb 1-1: 2:1 : no or invalid class specific endpoint descriptor [ 841.929348][T18274] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 841.948037][ T9] usb 1-1: 2:1 : unsupported format bits 0x20000 [ 842.027524][ T9] usb 1-1: USB disconnect, device number 23 [ 842.070382][T18291] netlink: 128 bytes leftover after parsing attributes in process `syz.0.3809'. [ 842.103861][T12635] udevd[12635]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 842.124959][T18291] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 842.163755][T18241] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 842.187229][T18241] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 842.398217][T18329] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 842.426040][T18329] block device autoloading is deprecated and will be removed. [ 842.534227][ T9] usb 3-1: new high-speed USB device number 31 using dummy_hcd [ 842.692556][ T5732] usb 6-1: USB disconnect, device number 47 [ 842.705210][ T9] usb 3-1: Using ep0 maxpacket: 32 [ 842.718965][ T9] usb 3-1: unable to get BOS descriptor or descriptor too short [ 842.744921][ T9] usb 3-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 842.761823][ T9] usb 3-1: config 14 has an invalid interface number: 57 but max is 1 [ 842.771540][ T9] usb 3-1: config 14 has an invalid interface number: 228 but max is 1 [ 842.782331][T18346] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 842.792349][ T9] usb 3-1: config 14 has no interface number 0 [ 842.799975][T18346] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 842.808615][ T9] usb 3-1: config 14 has no interface number 1 [ 842.817258][ T9] usb 3-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 842.828624][ T9] usb 3-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 842.842060][T18346] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 842.854478][ T9] usb 3-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 842.867382][T18346] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 842.876940][ T9] usb 3-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 842.888753][ T9] usb 3-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 842.900608][ T9] usb 3-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 842.914887][ T9] usb 3-1: config 14 interface 57 has no altsetting 0 [ 842.921858][ T9] usb 3-1: config 14 interface 228 has no altsetting 0 [ 842.936348][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 842.944849][ T9] usb 3-1: Product: syz [ 842.949176][ T9] usb 3-1: Manufacturer: syz [ 842.953941][ T9] usb 3-1: SerialNumber: syz [ 843.389653][ T9] legousbtower 3-1:14.57: interrupt endpoints not found [ 843.408092][T18363] syzkaller0: entered promiscuous mode [ 843.425893][T18363] syzkaller0: entered allmulticast mode [ 843.465986][T18363] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 843.647250][T18384] netlink: 52 bytes leftover after parsing attributes in process `syz.1.3822'. [ 843.825366][ T9] legousbtower 3-1:14.228: LEGO USB Tower firmware version is 0.0 build 0 [ 843.836396][ T5676] usb 6-1: new high-speed USB device number 48 using dummy_hcd [ 843.850413][ T9] legousbtower 3-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 843.949044][T18402] netlink: 'syz.0.3827': attribute type 1 has an invalid length. [ 843.977691][ T5676] usb 6-1: device descriptor read/64, error -71 [ 844.234118][ T5676] usb 6-1: new high-speed USB device number 49 using dummy_hcd [ 844.304242][ T5732] usb 1-1: new high-speed USB device number 24 using dummy_hcd [ 844.374772][ T5676] usb 6-1: device descriptor read/64, error -71 [ 844.388816][T18420] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 844.399419][T18420] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 844.454574][ T5732] usb 1-1: Using ep0 maxpacket: 8 [ 844.471522][ T5732] usb 1-1: New USB device found, idVendor=0ccd, idProduct=0038, bcdDevice=99.03 [ 844.488654][ T5732] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 844.498066][ T5732] usb 1-1: Product: syz [ 844.502402][ T5732] usb 1-1: Manufacturer: syz [ 844.507611][ T5732] usb 1-1: SerialNumber: syz [ 844.512752][ T5676] usb usb6-port1: attempt power cycle [ 844.546200][ T5732] usb 1-1: config 0 descriptor?? [ 844.577981][ T5732] dvb-usb: found a 'TerraTec/qanu USB2.0 Highspeed DVB-T Receiver' in warm state. [ 844.596528][ T5732] dvb-usb: bulk message failed: -22 (2/0) [ 844.596716][ C1] usb 3-1: tower_interrupt_in_callback: usb_submit_urb failed (-1) [ 844.601321][ T9] usb 3-1: USB disconnect, device number 31 [ 844.635073][ T5732] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 844.668669][ T5732] dvbdev: DVB: registering new adapter (TerraTec/qanu USB2.0 Highspeed DVB-T Receiver) [ 844.680292][ T5732] usb 1-1: media controller created [ 844.701852][ T9] legousbtower 3-1:14.228: LEGO USB Tower #-160 now disconnected [ 844.721094][ T5732] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 844.770162][T18440] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 844.781432][T18440] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 844.795458][ T5732] dvb-usb: bulk message failed: -22 (1/0) [ 844.809895][T18440] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 844.821466][T18440] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 844.848852][ T5732] dvb-usb: no frontend was attached by 'TerraTec/qanu USB2.0 Highspeed DVB-T Receiver' [ 844.879249][ T5732] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.0/usb1/1-1/input/input59 [ 844.903385][ T5732] dvb-usb: schedule remote query interval to 50 msecs. [ 844.914121][ T5676] usb 6-1: new high-speed USB device number 50 using dummy_hcd [ 844.926559][ T5732] dvb-usb: bulk message failed: -22 (2/0) [ 844.944852][ T5732] dvb-usb: TerraTec/qanu USB2.0 Highspeed DVB-T Receiver successfully initialized and connected. [ 844.966536][ T5676] usb 6-1: device descriptor read/8, error -71 [ 844.987794][ T5702] dvb-usb: bulk message failed: -22 (1/0) [ 845.001372][ T5732] usb 1-1: USB disconnect, device number 24 [ 845.010218][ T5702] dvb-usb: error while querying for an remote control event. [ 845.086366][ T5732] dvb-usb: TerraTec/qanu USB2.0 Highspeed DVB-T Re successfully deinitialized and disconnected. [ 845.204438][ T5676] usb 6-1: new high-speed USB device number 51 using dummy_hcd [ 845.246967][ T5676] usb 6-1: device descriptor read/8, error -71 [ 845.375927][ T5676] usb usb6-port1: unable to enumerate USB device [ 845.446794][T18479] netlink: NAT flags may be given only when NAT range (SRC or DST) is also specified. [ 845.459075][T18479] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 845.484625][ T9] usb 3-1: new high-speed USB device number 32 using dummy_hcd [ 845.684183][ T9] usb 3-1: New USB device found, idVendor=8086, idProduct=0b03, bcdDevice=6c.b9 [ 845.695959][ T9] usb 3-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 845.714034][ T9] usb 3-1: config 220 has 1 interface, different from the descriptor's value: 3 [ 845.728539][ T9] usb 3-1: config 220 interface 0 has no altsetting 0 [ 845.746421][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 845.755994][ T9] usb 3-1: Product: syz [ 845.760315][ T9] usb 3-1: Manufacturer: syz [ 845.782417][ T9] usb 3-1: SerialNumber: syz [ 845.857455][T18493] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 845.872354][T18494] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 845.877218][T18493] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 845.922749][T18494] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 846.023526][ T9] uvcvideo 3-1:220.0: Found UVC 0.00 device syz (8086:0b03) [ 846.031163][ T9] uvcvideo 3-1:220.0: No valid video chain found. [ 846.044495][ T9] usb 3-1: USB disconnect, device number 32 [ 846.224391][ T5683] usb 1-1: new full-speed USB device number 25 using dummy_hcd [ 846.404918][ T5683] usb 1-1: New USB device found, idVendor=0fc5, idProduct=b080, bcdDevice= 0.00 [ 846.415858][ T5683] usb 1-1: config 0 interface 0 altsetting 254 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 846.427757][ T5683] usb 1-1: config 0 interface 0 altsetting 254 endpoint 0x81 has invalid wMaxPacketSize 0 [ 846.438124][ T5683] usb 1-1: config 0 interface 0 has no altsetting 0 [ 846.447296][ T5683] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 846.467173][ T5683] usb 1-1: config 0 descriptor?? [ 846.539083][T18515] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 846.556684][T18515] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 846.587796][T18515] xt_hashlimit: size too large, truncated to 1048576 [ 846.926083][T18500] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 846.973004][T18500] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 847.060743][ T5683] hid-led 0003:0FC5:B080.0032: collection stack underflow [ 847.086082][ T5683] hid-led 0003:0FC5:B080.0032: item 0 2 0 12 parsing failed [ 847.102797][ T5683] hid-led 0003:0FC5:B080.0032: probe with driver hid-led failed with error -22 [ 847.328493][ T5683] usb 1-1: USB disconnect, device number 25 [ 847.354232][ T9] usb 6-1: new high-speed USB device number 52 using dummy_hcd [ 847.500603][T18568] nvme_fabrics: unknown parameter or missing value '+cpu +hugetlb +hugetlb +perf_event -net_cls +cpuset ' in ctrl creation request [ 847.525298][ T9] usb 6-1: Using ep0 maxpacket: 32 [ 847.531816][ T9] usb 6-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=93.d8 [ 847.550896][ T9] usb 6-1: config 0 has an invalid interface number: 1 but max is 0 [ 847.576027][T18568] nvme_fabrics: missing parameter 'nqn=%s' [ 847.584207][ T9] usb 6-1: config 0 has no interface number 0 [ 847.592056][ T9] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 847.610535][ T9] usb 6-1: Product: syz [ 847.624964][ T9] usb 6-1: Manufacturer: syz [ 847.637220][ T9] usb 6-1: SerialNumber: syz [ 847.659938][ T9] usb 6-1: config 0 descriptor?? [ 847.675430][ T9] usb 6-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 847.694895][ T9] usb 6-1: selecting invalid altsetting 1 [ 847.707194][ T9] usb 6-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 847.738760][ T9] usb 6-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 847.763631][ T9] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 847.782318][ T9] usb 6-1: media controller created [ 847.802138][T18580] vivid-004: disconnect [ 847.868961][ T9] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 847.893110][T18548] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 847.942710][T18548] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 848.065901][ T9] usb 6-1: dvb_usb_ce6230: usb_control_msg() failed=-71 [ 848.088200][ T9] zl10353_read_register: readreg error (reg=127, ret==-71) [ 848.097592][ T9] usb 6-1: dvb_usb_ce6230: usb_set_interface() failed=-71 [ 848.180649][ T9] usb 6-1: USB disconnect, device number 52 [ 848.224558][T18614] kvm: apic: phys broadcast and lowest prio [ 848.238892][T18615] netlink: 48 bytes leftover after parsing attributes in process `syz.3.3854'. [ 848.380077][T18594] vivid-004: reconnect [ 848.734178][ T5732] usb 3-1: new high-speed USB device number 33 using dummy_hcd [ 848.867046][T18639] syzkaller0: entered promiscuous mode [ 848.876160][ T5732] usb 3-1: device descriptor read/64, error -71 [ 848.882816][T18639] syzkaller0: entered allmulticast mode [ 848.902113][T18641] mac80211_hwsim hwsim49 syzkaller0: entered promiscuous mode [ 848.921955][T18641] mac80211_hwsim hwsim49 syzkaller0: entered allmulticast mode [ 849.092203][T18651] netlink: 72 bytes leftover after parsing attributes in process `syz.1.3861'. [ 849.134253][ T5732] usb 3-1: new high-speed USB device number 34 using dummy_hcd [ 849.250569][T18653] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 849.272406][T18653] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 849.282241][ T5732] usb 3-1: device descriptor read/64, error -71 [ 849.298103][T18653] xt_time: invalid argument - start or stop time greater than 23:59:59 [ 849.405186][ T5732] usb usb3-port1: attempt power cycle [ 849.786915][ T5732] usb 3-1: new high-speed USB device number 35 using dummy_hcd [ 849.825710][ T5732] usb 3-1: device descriptor read/8, error -71 [ 850.116872][ T5732] usb 3-1: new high-speed USB device number 36 using dummy_hcd [ 850.155378][ T5732] usb 3-1: device descriptor read/8, error -71 [ 850.271354][ T5732] usb usb3-port1: unable to enumerate USB device [ 852.663771][T18683] fuse: Unknown parameter 'seclabel' [ 852.757023][T18683] xt_CT: No such helper "snmp_trap" [ 853.323250][T18665] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3863'. [ 853.699829][T18717] netlink: 72 bytes leftover after parsing attributes in process `syz.3.3872'. [ 853.712091][T18699] loop3: detected capacity change from 0 to 1 [ 853.731229][T18699] Dev loop3: unable to read RDB block 1 [ 853.741751][T18699] loop3: unable to read partition table [ 853.748957][T18699] loop3: partition table beyond EOD, truncated [ 853.763715][T18699] loop_reread_partitions: partition scan of loop3 (被x ) failed (rc=-5) [ 853.780516][T18715] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 853.793513][T18715] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 853.820062][T18722] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3873'. [ 853.832378][T18722] netlink: 44 bytes leftover after parsing attributes in process `syz.3.3873'. [ 853.864121][ T3480] usb 6-1: new high-speed USB device number 53 using dummy_hcd [ 853.873217][ T5683] usb 1-1: new high-speed USB device number 26 using dummy_hcd [ 853.875326][ T5732] usb 3-1: new high-speed USB device number 37 using dummy_hcd [ 854.034225][ T5683] usb 1-1: Using ep0 maxpacket: 32 [ 854.040426][ T5683] usb 1-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=93.d8 [ 854.046501][ T3480] usb 6-1: New USB device found, idVendor=8086, idProduct=0b03, bcdDevice=6c.b9 [ 854.058800][ T5683] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 854.058830][ T5683] usb 1-1: config 0 has no interface number 0 [ 854.067554][ T5683] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 854.077472][ T5732] usb 3-1: Using ep0 maxpacket: 32 [ 854.087932][ T5683] usb 1-1: Product: syz [ 854.092270][ T5683] usb 1-1: Manufacturer: syz [ 854.097589][ T5683] usb 1-1: SerialNumber: syz [ 854.104541][ T5732] usb 3-1: New USB device found, idVendor=1964, idProduct=0001, bcdDevice=d4.15 [ 854.116942][ T3480] usb 6-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 854.118805][ T5683] usb 1-1: config 0 descriptor?? [ 854.131238][ T3480] usb 6-1: config 220 has 1 interface, different from the descriptor's value: 3 [ 854.143667][ T3480] usb 6-1: config 220 interface 0 has no altsetting 0 [ 854.153615][ T5732] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 854.163187][ T5732] usb 3-1: Product: syz [ 854.167459][ T5683] usb 1-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 854.167490][ T5683] usb 1-1: selecting invalid altsetting 1 [ 854.167510][ T5683] usb 1-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 854.192002][ T5683] usb 1-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 854.193212][ T5732] usb 3-1: Manufacturer: syz [ 854.207102][ T5683] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 854.207158][ T5683] usb 1-1: media controller created [ 854.221602][ T3480] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 854.237335][ T3480] usb 6-1: Product: syz [ 854.242250][ T3480] usb 6-1: Manufacturer: syz [ 854.247558][ T3480] usb 6-1: SerialNumber: syz [ 854.251214][ T5683] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 854.258006][ T5732] usb 3-1: SerialNumber: syz [ 854.281076][ T5732] usb 3-1: config 0 descriptor?? [ 854.365391][T18701] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 854.376692][T18701] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 854.399601][ T5683] usb 1-1: dvb_usb_ce6230: usb_control_msg() failed=-71 [ 854.407756][ T5683] zl10353_read_register: readreg error (reg=127, ret==-71) [ 854.420334][ T5683] usb 1-1: dvb_usb_ce6230: usb_set_interface() failed=-71 [ 854.484118][T18707] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3868'. [ 854.499639][ T5683] usb 1-1: USB disconnect, device number 26 [ 854.519782][ T5732] RobotFuzz Open Source InterFace, OSIF 3-1:0.0: version d4.15 found at bus 003 address 037 [ 854.598790][T18753] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 854.619633][T18753] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 855.003754][T18766] FAULT_INJECTION: forcing a failure. [ 855.003754][T18766] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 855.019947][T18766] CPU: 0 UID: 0 PID: 18766 Comm: syz.0.3876 Tainted: G L syzkaller #0 PREEMPT(full) [ 855.019984][T18766] Tainted: [L]=SOFTLOCKUP [ 855.019993][T18766] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 855.020007][T18766] Call Trace: [ 855.020017][T18766] [ 855.020034][T18766] dump_stack_lvl+0xe8/0x150 [ 855.020074][T18766] should_fail_ex+0x410/0x560 [ 855.020103][T18766] _copy_from_iter+0x1d3/0x1660 [ 855.020128][T18766] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 855.020168][T18766] ? __pfx_policy_nodemask+0x10/0x10 [ 855.020194][T18766] ? __pfx__copy_from_iter+0x10/0x10 [ 855.020222][T18766] ? alloc_pages_mpol+0x24a/0x390 [ 855.020255][T18766] af_alg_sendmsg+0x14c3/0x2250 [ 855.020312][T18766] ? __pfx_af_alg_sendmsg+0x10/0x10 [ 855.020343][T18766] ? __might_fault+0xaf/0x130 [ 855.020369][T18766] ? __pfx_aa_sk_perm+0x10/0x10 [ 855.020398][T18766] ? aa_sock_msg_perm+0xf6/0x1c0 [ 855.020418][T18766] ? skcipher_sendmsg+0x26/0xf0 [ 855.020437][T18766] ? __pfx_skcipher_sendmsg+0x10/0x10 [ 855.020476][T18766] sock_sendmsg_nosec+0x13a/0x180 [ 855.020507][T18766] ____sys_sendmsg+0x54e/0x850 [ 855.020550][T18766] ? __pfx_____sys_sendmsg+0x10/0x10 [ 855.020585][T18766] ? import_iovec+0x73/0xa0 [ 855.020625][T18766] ___sys_sendmsg+0x2a5/0x360 [ 855.020659][T18766] ? __lock_acquire+0x683/0x2cf0 [ 855.020693][T18766] ? __pfx____sys_sendmsg+0x10/0x10 [ 855.020729][T18766] ? kstrtouint+0x6e/0xe0 [ 855.020793][T18766] ? __fget_files+0x2a/0x420 [ 855.020814][T18766] ? __fget_files+0x3a2/0x420 [ 855.020845][T18766] __sys_sendmmsg+0x273/0x4d0 [ 855.020882][T18766] ? __pfx___sys_sendmmsg+0x10/0x10 [ 855.020940][T18766] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 855.020980][T18766] ? ksys_write+0x242/0x270 [ 855.021008][T18766] ? __pfx_ksys_write+0x10/0x10 [ 855.021049][T18766] __x64_sys_sendmmsg+0xa0/0xc0 [ 855.021100][T18766] do_syscall_64+0x166/0x520 [ 855.021121][T18766] ? trace_irq_disable+0x3b/0x140 [ 855.021149][T18766] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 855.021172][T18766] ? clear_bhb_loop+0x70/0xc0 [ 855.021191][T18766] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 855.021207][T18766] RIP: 0033:0x7f236b19e0d9 [ 855.021241][T18766] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 855.021261][T18766] RSP: 002b:00007f236bfbd028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 855.021284][T18766] RAX: ffffffffffffffda RBX: 00007f236b425fa0 RCX: 00007f236b19e0d9 [ 855.021300][T18766] RDX: 0000000000000001 RSI: 00002000000021c0 RDI: 0000000000000004 [ 855.021320][T18766] RBP: 00007f236bfbd090 R08: 0000000000000000 R09: 0000000000000000 [ 855.021330][T18766] R10: 0000000000080001 R11: 0000000000000246 R12: 0000000000000002 [ 855.021340][T18766] R13: 00007f236b426038 R14: 00007f236b425fa0 R15: 00007f236b54fa48 [ 855.021364][T18766] [ 855.345446][ T9] usb 4-1: new high-speed USB device number 38 using dummy_hcd [ 855.367787][T18769] x_tables: duplicate underflow at hook 4 [ 855.514182][ T9] usb 4-1: device descriptor read/64, error -71 [ 855.655194][T18779] usb usb7: usbfs: process 18779 (syz.5.3878) did not claim interface 0 before use [ 855.754250][ T9] usb 4-1: new high-speed USB device number 39 using dummy_hcd [ 855.884150][ T9] usb 4-1: device descriptor read/64, error -71 [ 856.004620][ T9] usb usb4-port1: attempt power cycle [ 856.071800][T18783] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 856.099506][T18783] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 856.355351][ T9] usb 4-1: new high-speed USB device number 40 using dummy_hcd [ 856.388634][ T9] usb 4-1: device descriptor read/8, error -71 [ 856.664787][ T9] usb 4-1: new high-speed USB device number 41 using dummy_hcd [ 856.704999][ T9] usb 4-1: device descriptor read/8, error -71 [ 856.825869][ T9] usb usb4-port1: unable to enumerate USB device [ 857.257192][T18800] netlink: 72 bytes leftover after parsing attributes in process `syz.5.3883'. [ 857.370209][ T9] usb 3-1: USB disconnect, device number 37 [ 857.526214][T18818] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 857.553953][T18818] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 857.581523][T18818] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 857.616541][T18818] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 858.035275][ T10] usb 1-1: new high-speed USB device number 27 using dummy_hcd [ 858.184315][ T10] usb 1-1: device descriptor read/64, error -71 [ 858.263291][T18862] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 858.297544][T18862] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 858.319808][ T30] audit: type=1326 audit(1787237584.899:10832): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18861 comm="syz.1.3896" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7a8159e0d9 code=0x7ffc0000 [ 858.351313][ T30] audit: type=1326 audit(1787237584.899:10833): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18861 comm="syz.1.3896" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7a8159e0d9 code=0x7ffc0000 [ 858.353897][T18866] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 858.394868][ T30] audit: type=1326 audit(1787237584.899:10834): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18861 comm="syz.1.3896" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7a8159e0d9 code=0x7ffc0000 [ 858.427266][ T30] audit: type=1326 audit(1787237584.929:10835): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18861 comm="syz.1.3896" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=5 compat=0 ip=0x7f7a8159e0d9 code=0x7ffc0000 [ 858.452999][T18866] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 858.463044][ T10] usb 1-1: new high-speed USB device number 28 using dummy_hcd [ 858.466607][T18862] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 858.493713][T18869] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 858.504901][T18873] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 858.505765][T18862] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 858.523622][T18869] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 858.535027][T18866] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 858.548728][T18873] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 858.560549][ T30] audit: type=1326 audit(1787237584.929:10836): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18861 comm="syz.1.3896" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7a8159e0d9 code=0x7ffc0000 [ 858.572977][T18866] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 858.595341][ T10] usb 1-1: device descriptor read/64, error -71 [ 858.612171][T18869] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 858.644786][T18869] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 858.657834][ T30] audit: type=1326 audit(1787237584.929:10837): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18861 comm="syz.1.3896" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7a8159e0d9 code=0x7ffc0000 [ 858.686352][ T30] audit: type=1326 audit(1787237584.929:10838): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18861 comm="syz.1.3896" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f7a8159e0d9 code=0x7ffc0000 [ 858.714714][ T10] usb usb1-port1: attempt power cycle [ 858.761249][ T30] audit: type=1326 audit(1787237584.929:10839): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18861 comm="syz.1.3896" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7a8159e0d9 code=0x7ffc0000 [ 858.836636][ T30] audit: type=1326 audit(1787237584.929:10840): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18861 comm="syz.1.3896" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7a8159e0d9 code=0x7ffc0000 [ 858.878506][ T30] audit: type=1326 audit(1787237584.929:10841): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18861 comm="syz.1.3896" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f7a8159e0d9 code=0x7ffc0000 [ 859.064412][ T10] usb 1-1: new high-speed USB device number 29 using dummy_hcd [ 859.095162][ T10] usb 1-1: device descriptor read/8, error -71 [ 859.236387][T18899] ip6gretap0: entered promiscuous mode [ 859.263706][T18899] macsec1: entered promiscuous mode [ 859.277624][T18899] macsec1: entered allmulticast mode [ 859.315856][T18899] ip6gretap0: entered allmulticast mode [ 859.356921][ T3480] uvcvideo 6-1:220.0: Found UVC 7.01 device syz (8086:0b03) [ 859.364304][ T10] usb 1-1: new high-speed USB device number 30 using dummy_hcd [ 859.372417][T18899] ip6gretap0: left allmulticast mode [ 859.393308][T18899] ip6gretap0: left promiscuous mode [ 859.417002][ T10] usb 1-1: device descriptor read/8, error -71 [ 859.441893][ T3480] uvcvideo 6-1:220.0: No valid video chain found. [ 859.533523][T18915] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 859.556864][ T10] usb usb1-port1: unable to enumerate USB device [ 859.564108][T18915] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 859.694355][ T9] usb 4-1: new high-speed USB device number 42 using dummy_hcd [ 859.835138][ T9] usb 4-1: device descriptor read/64, error -71 [ 859.979745][T18948] netlink: 'syz.1.3906': attribute type 21 has an invalid length. [ 859.987709][T18948] netlink: 128 bytes leftover after parsing attributes in process `syz.1.3906'. [ 859.998463][T18948] netlink: 'syz.1.3906': attribute type 5 has an invalid length. [ 860.006775][T18948] netlink: 'syz.1.3906': attribute type 6 has an invalid length. [ 860.016118][T18948] netlink: 3 bytes leftover after parsing attributes in process `syz.1.3906'. [ 860.084993][ T9] usb 4-1: new high-speed USB device number 43 using dummy_hcd [ 860.216720][ T9] usb 4-1: device descriptor read/64, error -71 [ 860.223114][ T5676] usb 3-1: new high-speed USB device number 38 using dummy_hcd [ 860.268899][T18963] sg_write: data in/out 634368/136 bytes for SCSI command 0x0-- guessing data in; [ 860.268899][T18963] program syz.1.3909 not setting count and/or reply_len properly [ 860.334474][ T9] usb usb4-port1: attempt power cycle [ 860.374067][ T5676] usb 3-1: Using ep0 maxpacket: 32 [ 860.380666][ T5676] usb 3-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=93.d8 [ 860.392043][ T5676] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 860.400409][ T5676] usb 3-1: config 0 has no interface number 0 [ 860.411733][ T5676] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 860.420713][ T5676] usb 3-1: Product: syz [ 860.425179][ T5676] usb 3-1: Manufacturer: syz [ 860.429991][ T5676] usb 3-1: SerialNumber: syz [ 860.440102][ T5676] usb 3-1: config 0 descriptor?? [ 860.455722][ T5676] usb 3-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 860.466092][ T5676] usb 3-1: selecting invalid altsetting 1 [ 860.472013][ T5676] usb 3-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 860.487103][ T5676] usb 3-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 860.498678][ T5676] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 860.507356][ T5676] usb 3-1: media controller created [ 860.542510][ T5676] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 860.657452][T18950] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 860.676493][ T9] usb 4-1: new high-speed USB device number 44 using dummy_hcd [ 860.686844][T18950] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 860.715180][ T9] usb 4-1: device descriptor read/8, error -71 [ 860.725879][ T5676] usb 3-1: dvb_usb_ce6230: usb_control_msg() failed=-71 [ 860.748306][ T5676] zl10353_read_register: readreg error (reg=127, ret==-71) [ 860.757672][ T5676] usb 3-1: dvb_usb_ce6230: usb_set_interface() failed=-71 [ 860.851251][ T5676] usb 3-1: USB disconnect, device number 38 [ 860.994546][ T9] usb 4-1: new high-speed USB device number 45 using dummy_hcd [ 861.016139][ T9] usb 4-1: device descriptor read/8, error -71 [ 861.134303][ T9] usb usb4-port1: unable to enumerate USB device [ 861.145841][T18988] nvme nvme0: rdma connection establishment failed (-104) [ 861.277224][T18994] x_tables: duplicate underflow at hook 1 [ 861.410583][T19000] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 861.434561][T19000] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 861.464324][T19000] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 861.503686][T19000] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 861.536786][T19013] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 861.547906][T19013] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 861.606102][T19013] bond3: option min_links: invalid value (18446744073709551608) [ 861.615978][T19013] bond3: option min_links: allowed values 0 - 2147483647 [ 861.626599][T19013] bond3 (unregistering): Released all slaves [ 861.644779][ T5702] usb 3-1: new full-speed USB device number 39 using dummy_hcd [ 861.797478][T19088] syzkaller0: entered promiscuous mode [ 861.803011][T19088] syzkaller0: entered allmulticast mode [ 861.813494][T19088] tipc: Enabled bearer , priority 0 [ 861.821638][ T5702] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 861.831283][T19087] tipc: Resetting bearer [ 861.834746][ T5702] usb 3-1: config 1 has an invalid interface number: 128 but max is 1 [ 861.845945][ T5702] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 861.858302][ T5702] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 861.867338][ T5702] usb 3-1: config 1 has no interface number 0 [ 861.873582][ T5702] usb 3-1: config 1 interface 128 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 861.893029][ T5702] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 861.901366][ T5702] usb 3-1: Product: syz [ 861.915311][ T5702] usb 3-1: Manufacturer: syz [ 861.924527][ T5702] usb 3-1: SerialNumber: syz [ 861.926886][T19087] tipc: Disabling bearer [ 861.945751][ T5702] cdc_wdm 3-1:1.128: skipping garbage [ 861.953018][ T5702] cdc_wdm 3-1:1.128: probe with driver cdc_wdm failed with error -22 [ 862.100941][T19103] snd_dummy snd_dummy.0: control 0:0:0:syz0:16384 is already present [ 862.144324][ T5732] usb 3-1: USB disconnect, device number 39 [ 862.272245][T19118] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 862.282335][T19118] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 862.297741][ T5702] usb 1-1: new high-speed USB device number 31 using dummy_hcd [ 862.317081][T19118] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 862.329395][T19118] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 862.474290][ T5702] usb 1-1: Using ep0 maxpacket: 32 [ 862.485166][ T5702] usb 1-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 862.504896][ T5702] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 862.521190][ T5702] usb 1-1: config 0 descriptor?? [ 862.762437][ T5702] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 862.787953][ T5702] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 862.791085][T19144] netlink: 60 bytes leftover after parsing attributes in process `syz.2.3930'. [ 862.828955][ T5702] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 862.856865][ T5702] usb 1-1: media controller created [ 862.917055][ T5702] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 862.926444][T19145] netlink: 40 bytes leftover after parsing attributes in process `syz.3.3929'. [ 862.981599][T19151] syzkaller0: entered promiscuous mode [ 862.995212][ T5702] az6027: usb out operation failed. (-71) [ 863.008388][T19151] syzkaller0: entered allmulticast mode [ 863.022857][ T5702] az6027: usb out operation failed. (-71) [ 863.044108][ T5702] stb0899_attach: Driver disabled by Kconfig [ 863.057260][T19167] snd_dummy snd_dummy.0: control 0:0:0:syz0:16384 is already present [ 863.062410][ T5702] az6027: no front-end attached [ 863.062410][ T5702] [ 863.066248][T19151] tipc: Enabled bearer , priority 0 [ 863.083944][ T5702] az6027: usb out operation failed. (-71) [ 863.094620][T19150] tipc: Resetting bearer [ 863.106628][ T5702] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 863.142513][ T5702] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.0/usb1/1-1/input/input60 [ 863.203812][ T5702] dvb-usb: schedule remote query interval to 400 msecs. [ 863.217078][T19150] tipc: Disabling bearer [ 863.229531][ T5702] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 863.246420][ T5676] usb 3-1: new high-speed USB device number 40 using dummy_hcd [ 863.267369][ T5702] usb 1-1: USB disconnect, device number 31 [ 863.413773][ T5702] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 863.428038][ T5676] usb 3-1: Using ep0 maxpacket: 32 [ 863.452994][ T5676] usb 3-1: unable to get BOS descriptor or descriptor too short [ 863.476224][ T5676] usb 3-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 863.510502][T19192] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 863.525034][ T5676] usb 3-1: config 14 has an invalid interface number: 57 but max is 1 [ 863.530693][T19192] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 863.541484][ T5676] usb 3-1: config 14 has an invalid interface number: 228 but max is 1 [ 863.557259][ T5676] usb 3-1: config 14 has no interface number 0 [ 863.563749][ T5676] usb 3-1: config 14 has no interface number 1 [ 863.571682][ T5676] usb 3-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 863.584653][ T5676] usb 3-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 863.599280][ T5676] usb 3-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 863.613079][ T5676] usb 3-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 863.627842][ T5676] usb 3-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 863.639832][ T5676] usb 3-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 863.658830][ T5676] usb 3-1: config 14 interface 57 has no altsetting 0 [ 863.667178][ T5676] usb 3-1: config 14 interface 228 has no altsetting 0 [ 863.680853][ T5676] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 863.689498][ T5676] usb 3-1: Product: syz [ 863.693776][ T5676] usb 3-1: Manufacturer: syz [ 863.701625][ T5676] usb 3-1: SerialNumber: syz [ 863.724500][ T3480] usb 4-1: new high-speed USB device number 46 using dummy_hcd [ 863.864131][ T3480] usb 4-1: device descriptor read/64, error -71 [ 864.081986][T19215] binder: 19214:19215 ioctl c0306201 2000000009c0 returned -14 [ 864.114515][ T3480] usb 4-1: new high-speed USB device number 47 using dummy_hcd [ 864.133030][ T5676] legousbtower 3-1:14.57: interrupt endpoints not found [ 864.184158][ T5702] usb 1-1: new high-speed USB device number 32 using dummy_hcd [ 864.235850][T19231] snd_dummy snd_dummy.0: control 0:0:0:syz0:16384 is already present [ 864.255358][ T3480] usb 4-1: device descriptor read/64, error -71 [ 864.356366][ T5702] usb 1-1: Using ep0 maxpacket: 32 [ 864.363101][ T5702] usb 1-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=93.d8 [ 864.376350][ T5702] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 864.385382][ T3480] usb usb4-port1: attempt power cycle [ 864.391289][ T5702] usb 1-1: config 0 has no interface number 0 [ 864.397809][T19236] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 864.408381][ T5702] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 864.422472][ T5702] usb 1-1: Product: syz [ 864.427212][ T5702] usb 1-1: Manufacturer: syz [ 864.432534][T19236] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 864.435696][ T5702] usb 1-1: SerialNumber: syz [ 864.469937][ T5702] usb 1-1: config 0 descriptor?? [ 864.483327][ T5702] usb 1-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 864.495298][ T5702] usb 1-1: selecting invalid altsetting 1 [ 864.501113][ T5702] usb 1-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 864.513949][ T5702] usb 1-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 864.533000][ T5702] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 864.545437][ T5702] usb 1-1: media controller created [ 864.546165][ T5676] legousbtower 3-1:14.228: LEGO USB Tower firmware version is 0.0 build 0 [ 864.570060][ T5702] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 864.588658][ T5676] legousbtower 3-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 864.687416][T19219] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 864.706488][T19219] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 864.723625][ T5702] usb 1-1: dvb_usb_ce6230: usb_control_msg() failed=-71 [ 864.735982][ T3480] usb 4-1: new high-speed USB device number 48 using dummy_hcd [ 864.752365][ T5702] zl10353_read_register: readreg error (reg=127, ret==-71) [ 864.773209][ T5702] usb 1-1: dvb_usb_ce6230: usb_set_interface() failed=-71 [ 864.784810][ T3480] usb 4-1: device descriptor read/8, error -71 [ 864.836642][ T5702] usb 1-1: USB disconnect, device number 32 [ 864.937147][T19278] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3952'. [ 864.948296][T19278] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3952'. [ 865.034164][ T3480] usb 4-1: new high-speed USB device number 49 using dummy_hcd [ 865.089356][ T3480] usb 4-1: device descriptor read/8, error -71 [ 865.126427][T19285] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 865.140404][T19285] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 865.206686][ T3480] usb usb4-port1: unable to enumerate USB device [ 865.310753][T19293] snd_dummy snd_dummy.0: control 0:0:0:syz0:16384 is already present [ 865.332664][ T5676] usb 3-1: USB disconnect, device number 40 [ 865.377084][ T5676] legousbtower 3-1:14.228: LEGO USB Tower #-160 now disconnected [ 865.734673][ T9] usb 1-1: new high-speed USB device number 33 using dummy_hcd [ 865.941494][ T9] usb 1-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice=f6.00 [ 865.996029][ T9] usb 1-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3 [ 866.032206][ T9] usb 1-1: Product: syz [ 866.059034][ T9] usb 1-1: SerialNumber: syz [ 866.101409][ T9] usb 1-1: config 0 descriptor?? [ 866.357582][T19306] IPVS: set_ctl: invalid protocol: 51 100.1.1.1:20257 [ 866.451446][T19327] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 866.476527][T19327] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 866.712051][ T9] usb 1-1: USB disconnect, device number 33 [ 867.294070][ T9] usb 3-1: new high-speed USB device number 41 using dummy_hcd [ 867.474130][ T9] usb 3-1: Using ep0 maxpacket: 32 [ 867.489749][ T9] usb 3-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=93.d8 [ 867.522585][ T9] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 867.549768][ T9] usb 3-1: config 0 has no interface number 0 [ 867.578841][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 867.598230][ T9] usb 3-1: Product: syz [ 867.612468][ T9] usb 3-1: Manufacturer: syz [ 867.631807][ T9] usb 3-1: SerialNumber: syz [ 867.663199][ T9] usb 3-1: config 0 descriptor?? [ 867.708413][ T9] usb 3-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 867.735619][ T9] usb 3-1: selecting invalid altsetting 1 [ 867.749432][ T9] usb 3-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 867.795365][ T9] usb 3-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 867.797528][T19385] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 867.854239][ T9] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 867.888137][ T9] usb 3-1: media controller created [ 867.904117][ T3480] usb 1-1: new high-speed USB device number 34 using dummy_hcd [ 867.929307][T19362] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 867.958052][T19362] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 867.995428][ T9] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 868.049912][ T9] usb 3-1: dvb_usb_ce6230: usb_control_msg() failed=-71 [ 868.068220][ T9] zl10353_read_register: readreg error (reg=127, ret==-71) [ 868.084921][ T9] usb 3-1: dvb_usb_ce6230: usb_set_interface() failed=-71 [ 868.094177][ T3480] usb 1-1: Using ep0 maxpacket: 32 [ 868.121617][ T3480] usb 1-1: unable to get BOS descriptor or descriptor too short [ 868.148461][ T3480] usb 1-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 868.178289][ T3480] usb 1-1: config 14 has an invalid interface number: 57 but max is 1 [ 868.192447][ T3480] usb 1-1: config 14 has an invalid interface number: 228 but max is 1 [ 868.216180][ T3480] usb 1-1: config 14 has no interface number 0 [ 868.239823][ T3480] usb 1-1: config 14 has no interface number 1 [ 868.256417][ T3480] usb 1-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 868.272585][ T9] usb 3-1: USB disconnect, device number 41 [ 868.288501][T19410] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 868.306122][ T3480] usb 1-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 868.333193][T19410] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 868.351744][ T3480] usb 1-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 868.365534][ T3480] usb 1-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 868.391425][ T3480] usb 1-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 868.421668][ T3480] usb 1-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 868.455287][ T3480] usb 1-1: config 14 interface 57 has no altsetting 0 [ 868.465269][ T3480] usb 1-1: config 14 interface 228 has no altsetting 0 [ 868.477221][ T3480] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 868.490544][ T3480] usb 1-1: Product: syz [ 868.512511][ T3480] usb 1-1: Manufacturer: syz [ 868.521447][ T3480] usb 1-1: SerialNumber: syz [ 868.867078][T19439] fuse: Unknown parameter 'gr' [ 868.958515][ T3480] legousbtower 1-1:14.57: interrupt endpoints not found [ 869.124888][T19449] netlink: 32 bytes leftover after parsing attributes in process `syz.5.3981'. [ 869.152984][T19450] netlink: 32 bytes leftover after parsing attributes in process `syz.5.3981'. [ 869.257910][T19454] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3982'. [ 869.288978][T19454] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3982'. [ 869.371931][T19454] bridge4: the hash_elasticity option has been deprecated and is always 16 [ 869.397726][ T3480] legousbtower 1-1:14.228: LEGO USB Tower firmware version is 0.0 build 0 [ 869.423526][ T3480] legousbtower 1-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 869.493102][T19454] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 869.538109][T19454] syzkaller1: linktype set to 780 [ 869.776463][T19475] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 869.939342][T19481] binder: 19480:19481 unknown command 1077961494 [ 869.947431][T19481] binder: 19480:19481 ioctl c0306201 200000000100 returned -22 [ 869.984423][T19481] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 870.002295][T19482] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 870.013467][T19481] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 870.030794][T19482] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 870.166641][ T9] usb 1-1: USB disconnect, device number 34 [ 870.222361][ T9] legousbtower 1-1:14.228: LEGO USB Tower #-160 now disconnected [ 870.448110][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 870.457748][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 870.575812][ T5676] usb 3-1: new high-speed USB device number 42 using dummy_hcd [ 870.764055][ T5676] usb 3-1: Using ep0 maxpacket: 32 [ 870.780642][ T5676] usb 3-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=93.d8 [ 870.803068][ T5676] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 870.823027][ T5676] usb 3-1: config 0 has no interface number 0 [ 870.848682][ T5676] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 870.868302][T19510] vxcan3: entered promiscuous mode [ 870.880521][ T5676] usb 3-1: Product: syz [ 870.896499][ T5676] usb 3-1: Manufacturer: syz [ 870.907292][ T5676] usb 3-1: SerialNumber: syz [ 870.942534][ T5676] usb 3-1: config 0 descriptor?? [ 870.997928][ T5676] usb 3-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 871.041668][ T5676] usb 3-1: selecting invalid altsetting 1 [ 871.057122][ T5676] usb 3-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 871.076550][ T5676] usb 3-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 871.114541][ T5676] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 871.173215][ T5676] usb 3-1: media controller created [ 871.207696][T19499] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 871.238773][ T5676] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 871.251322][T19499] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 871.264875][ T5704] usb 4-1: new high-speed USB device number 50 using dummy_hcd [ 871.335357][ T5676] usb 3-1: dvb_usb_ce6230: usb_control_msg() failed=-71 [ 871.346718][ T5676] zl10353_read_register: readreg error (reg=127, ret==-71) [ 871.361687][ T5676] usb 3-1: dvb_usb_ce6230: usb_set_interface() failed=-71 [ 871.415156][ T5704] usb 4-1: device descriptor read/64, error -71 [ 871.453845][ T5676] usb 3-1: USB disconnect, device number 42 [ 871.674226][ T5704] usb 4-1: new high-speed USB device number 51 using dummy_hcd [ 871.839079][ T5704] usb 4-1: device descriptor read/64, error -71 [ 871.851763][T19577] syzkaller1: entered promiscuous mode [ 871.876042][T19577] syzkaller1: entered allmulticast mode [ 871.964816][ T5704] usb usb4-port1: attempt power cycle [ 871.977681][T19580] kvm: emulating exchange as write [ 872.314522][ T5704] usb 4-1: new high-speed USB device number 52 using dummy_hcd [ 872.375665][ T5704] usb 4-1: device descriptor read/8, error -71 [ 872.631378][T19607] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 872.641310][T19607] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 872.654140][ T5704] usb 4-1: new high-speed USB device number 53 using dummy_hcd [ 872.665484][T19607] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 872.681086][T19607] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 872.694927][ T5704] usb 4-1: device descriptor read/8, error -71 [ 872.764533][ T3480] usb 3-1: new high-speed USB device number 43 using dummy_hcd [ 872.815912][ T5704] usb usb4-port1: unable to enumerate USB device [ 872.917787][ T3480] usb 3-1: Using ep0 maxpacket: 32 [ 872.931764][ T3480] usb 3-1: unable to get BOS descriptor or descriptor too short [ 872.952810][ T3480] usb 3-1: New USB device found, idVendor=0a67, idProduct=5011, bcdDevice= 0.40 [ 872.963621][ T3480] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 872.977433][T19622] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 872.984888][ T3480] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 872.991113][T19622] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 873.012741][ T3480] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 873.021214][T19622] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 873.023826][T19622] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 873.054658][ T3480] usb 3-1: Product: syz [ 873.060560][ T3480] usb 3-1: Manufacturer: syz [ 873.065940][ T3480] usb 3-1: SerialNumber: syz [ 873.126255][T19629] hub 8-0:1.0: USB hub found [ 873.131818][T19629] hub 8-0:1.0: 1 port detected [ 873.303389][ T3480] usb 3-1: 0:1 : does not exist [ 873.316731][ T3480] usb 3-1: unit 1 not found! [ 873.339952][T19639] loop5: detected capacity change from 0 to 7 [ 873.370675][T19639] loop5: [ 873.378406][T19639] loop5: partition table partially beyond EOD, truncated [ 873.419277][ T3480] usb 3-1: USB disconnect, device number 43 [ 873.962845][T19668] FAULT_INJECTION: forcing a failure. [ 873.962845][T19668] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 873.978651][T19668] CPU: 1 UID: 0 PID: 19668 Comm: syz.2.4012 Tainted: G L syzkaller #0 PREEMPT(full) [ 873.978687][T19668] Tainted: [L]=SOFTLOCKUP [ 873.978695][T19668] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 873.978708][T19668] Call Trace: [ 873.978717][T19668] [ 873.978727][T19668] dump_stack_lvl+0xe8/0x150 [ 873.978764][T19668] should_fail_ex+0x410/0x560 [ 873.978795][T19668] _copy_from_user+0x2d/0xb0 [ 873.978825][T19668] kstrtouint_from_user+0xd6/0x180 [ 873.978859][T19668] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 873.978900][T19668] proc_fail_nth_write+0x8e/0x210 [ 873.978928][T19668] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 873.978964][T19668] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 873.978990][T19668] vfs_write+0x296/0xba0 [ 873.979024][T19668] ? __pfx_vfs_write+0x10/0x10 [ 873.979050][T19668] ? __fget_files+0x2a/0x420 [ 873.979076][T19668] ? __fget_files+0x3a2/0x420 [ 873.979097][T19668] ? __fget_files+0x2a/0x420 [ 873.979128][T19668] ksys_write+0x150/0x270 [ 873.979156][T19668] ? __pfx_ksys_write+0x10/0x10 [ 873.979192][T19668] do_syscall_64+0x166/0x520 [ 873.979214][T19668] ? trace_irq_disable+0x3b/0x140 [ 873.979243][T19668] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 873.979267][T19668] ? clear_bhb_loop+0x70/0xc0 [ 873.979295][T19668] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 873.979318][T19668] RIP: 0033:0x7f9bf7f5e90e [ 873.979339][T19668] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 873.979359][T19668] RSP: 002b:00007f9bf8ea4fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 873.979382][T19668] RAX: ffffffffffffffda RBX: 00007f9bf8ea56c0 RCX: 00007f9bf7f5e90e [ 873.979399][T19668] RDX: 0000000000000001 RSI: 00007f9bf8ea50a0 RDI: 0000000000000004 [ 873.979413][T19668] RBP: 00007f9bf8ea5090 R08: 0000000000000000 R09: 0000000000000000 [ 873.979428][T19668] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 873.979441][T19668] R13: 00007f9bf8226038 R14: 00007f9bf8225fa0 R15: 00007f9bf834fa48 [ 873.979477][T19668] [ 874.528149][T19686] sctp: [Deprecated]: syz.5.4016 (pid 19686) Use of struct sctp_assoc_value in delayed_ack socket option. [ 874.528149][T19686] Use struct sctp_sack_info instead [ 874.678915][T19700] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 874.695849][T19700] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 874.709186][T19700] netlink: 'syz.1.4019': attribute type 10 has an invalid length. [ 874.722715][T19700] bridge0: port 2(bridge_slave_1) entered blocking state [ 874.730068][T19700] bridge0: port 2(bridge_slave_1) entered forwarding state [ 874.737957][T19700] bridge0: port 1(bridge_slave_0) entered blocking state [ 874.745327][T19700] bridge0: port 1(bridge_slave_0) entered forwarding state [ 874.781804][T19700] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 874.885910][ T5704] usb 4-1: new high-speed USB device number 54 using dummy_hcd [ 874.921751][T19716] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4021'. [ 875.004657][ T9] usb 1-1: new high-speed USB device number 35 using dummy_hcd [ 875.040619][T19718] FAULT_INJECTION: forcing a failure. [ 875.040619][T19718] name failslab, interval 1, probability 0, space 0, times 0 [ 875.054401][T19718] CPU: 0 UID: 0 PID: 19718 Comm: syz.2.4022 Tainted: G L syzkaller #0 PREEMPT(full) [ 875.054438][T19718] Tainted: [L]=SOFTLOCKUP [ 875.054446][T19718] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 875.054461][T19718] Call Trace: [ 875.054471][T19718] [ 875.054480][T19718] dump_stack_lvl+0xe8/0x150 [ 875.054518][T19718] should_fail_ex+0x410/0x560 [ 875.054553][T19718] should_failslab+0xa8/0x100 [ 875.054579][T19718] __kmalloc_cache_noprof+0xa8/0x660 [ 875.054612][T19718] ? nft_pernet+0x23/0x240 [ 875.054642][T19718] ? nf_tables_newchain+0xf9c/0x28b0 [ 875.054669][T19718] ? nf_tables_newchain+0xf9c/0x28b0 [ 875.054705][T19718] nf_tables_newchain+0xf9c/0x28b0 [ 875.054776][T19718] ? __pfx_nf_tables_newchain+0x10/0x10 [ 875.054837][T19718] ? nfnl_pernet+0x23/0x240 [ 875.054870][T19718] ? nfnl_pernet+0x23/0x240 [ 875.054912][T19718] ? __nla_parse+0x40/0x60 [ 875.054945][T19718] nfnetlink_rcv+0x1288/0x28c0 [ 875.055013][T19718] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 875.055063][T19718] ? ref_tracker_free+0x689/0x830 [ 875.055115][T19718] ? skb_clone+0x246/0x3a0 [ 875.055142][T19718] ? __netlink_deliver_tap+0x811/0x860 [ 875.055173][T19718] ? netlink_deliver_tap+0x2e/0x1b0 [ 875.055195][T19718] ? netlink_deliver_tap+0x2e/0x1b0 [ 875.055224][T19718] netlink_unicast+0x7bd/0x940 [ 875.055265][T19718] netlink_sendmsg+0x813/0xb40 [ 875.055295][T19718] ? __pfx_netlink_sendmsg+0x10/0x10 [ 875.055321][T19718] ? aa_sock_msg_perm+0xf6/0x1c0 [ 875.055356][T19718] ? __pfx_netlink_sendmsg+0x10/0x10 [ 875.055378][T19718] sock_sendmsg_nosec+0x13a/0x180 [ 875.055410][T19718] ____sys_sendmsg+0x54e/0x850 [ 875.055451][T19718] ? __pfx_____sys_sendmsg+0x10/0x10 [ 875.055498][T19718] ? import_iovec+0x73/0xa0 [ 875.055531][T19718] ___sys_sendmsg+0x2a5/0x360 [ 875.055565][T19718] ? __lock_acquire+0x683/0x2cf0 [ 875.055604][T19718] ? __pfx____sys_sendmsg+0x10/0x10 [ 875.055674][T19718] ? __fget_files+0x2a/0x420 [ 875.055697][T19718] ? __fget_files+0x3a2/0x420 [ 875.055730][T19718] __x64_sys_sendmsg+0x1b1/0x290 [ 875.055784][T19718] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 875.055842][T19718] do_syscall_64+0x166/0x520 [ 875.055864][T19718] ? trace_irq_disable+0x3b/0x140 [ 875.055892][T19718] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 875.055916][T19718] ? clear_bhb_loop+0x70/0xc0 [ 875.055943][T19718] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 875.055966][T19718] RIP: 0033:0x7f9bf7f9e0d9 [ 875.055988][T19718] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 875.056008][T19718] RSP: 002b:00007f9bf8ea5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 875.056033][T19718] RAX: ffffffffffffffda RBX: 00007f9bf8225fa0 RCX: 00007f9bf7f9e0d9 [ 875.056051][T19718] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 875.056067][T19718] RBP: 00007f9bf8ea5090 R08: 0000000000000000 R09: 0000000000000000 [ 875.056081][T19718] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 875.056094][T19718] R13: 00007f9bf8226038 R14: 00007f9bf8225fa0 R15: 00007f9bf834fa48 [ 875.056130][T19718] [ 875.383198][ T5704] usb 4-1: Using ep0 maxpacket: 32 [ 875.479949][ T5704] usb 4-1: unable to get BOS descriptor or descriptor too short [ 875.494967][ T9] usb 1-1: Using ep0 maxpacket: 32 [ 875.500519][ T5704] usb 4-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 875.511125][ T9] usb 1-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=93.d8 [ 875.521621][ T9] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 875.529882][ T9] usb 1-1: config 0 has no interface number 0 [ 875.536692][ T5704] usb 4-1: config 14 has an invalid interface number: 57 but max is 1 [ 875.545072][ T5704] usb 4-1: config 14 has an invalid interface number: 228 but max is 1 [ 875.553539][ T5704] usb 4-1: config 14 has no interface number 0 [ 875.559874][ T5704] usb 4-1: config 14 has no interface number 1 [ 875.569644][ T5704] usb 4-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 875.581293][ T5704] usb 4-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 875.593365][ T5704] usb 4-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 875.605021][ T5704] usb 4-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 875.617489][ T5704] usb 4-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 875.629012][ T5704] usb 4-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 875.642273][ T5704] usb 4-1: config 14 interface 57 has no altsetting 0 [ 875.649359][ T5704] usb 4-1: config 14 interface 228 has no altsetting 0 [ 875.658725][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 875.667160][ T9] usb 1-1: Product: syz [ 875.671409][ T9] usb 1-1: Manufacturer: syz [ 875.676155][ T9] usb 1-1: SerialNumber: syz [ 875.683285][ T5704] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 875.684342][ T5702] usb 3-1: new high-speed USB device number 44 using dummy_hcd [ 875.691402][ T5704] usb 4-1: Product: syz [ 875.704523][ T9] usb 1-1: config 0 descriptor?? [ 875.710062][ T5704] usb 4-1: Manufacturer: syz [ 875.715045][ T5704] usb 4-1: SerialNumber: syz [ 875.722839][ T9] usb 1-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 875.733900][ T9] usb 1-1: selecting invalid altsetting 1 [ 875.754896][ T9] usb 1-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 875.791871][ T9] usb 1-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 875.823783][ T9] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 875.843330][ T9] usb 1-1: media controller created [ 875.883278][ T9] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 875.914557][ T5702] usb 3-1: Using ep0 maxpacket: 32 [ 875.924948][T19707] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 875.941812][ T5702] usb 3-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 875.962080][T19707] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 875.982011][ T5702] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 876.034736][ T5702] usb 3-1: config 0 descriptor?? [ 876.052787][ T9] usb 1-1: dvb_usb_ce6230: usb_control_msg() failed=-71 [ 876.083078][ T9] zl10353_read_register: readreg error (reg=127, ret==-71) [ 876.109199][ T9] usb 1-1: dvb_usb_ce6230: usb_set_interface() failed=-71 [ 876.181424][ T5704] legousbtower 4-1:14.57: interrupt endpoints not found [ 876.208896][ T9] usb 1-1: USB disconnect, device number 35 [ 876.280588][ T5702] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 876.327623][ T5702] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 876.340658][ T5702] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 876.365990][ T5702] usb 3-1: media controller created [ 876.417344][ T5702] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 876.481629][ T5702] az6027: usb out operation failed. (-71) [ 876.491847][ T5702] az6027: usb out operation failed. (-71) [ 876.503812][ T5702] stb0899_attach: Driver disabled by Kconfig [ 876.512167][ T5702] az6027: no front-end attached [ 876.512167][ T5702] [ 876.523875][ T5702] az6027: usb out operation failed. (-71) [ 876.531850][ T5702] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 876.553799][ T5702] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.2/usb3/3-1/input/input61 [ 876.576088][ T5702] dvb-usb: schedule remote query interval to 400 msecs. [ 876.583173][ T5704] legousbtower 4-1:14.228: LEGO USB Tower firmware version is 0.0 build 0 [ 876.585340][ T5702] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 876.620352][ T5704] legousbtower 4-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 876.643688][ T5702] usb 3-1: USB disconnect, device number 44 [ 876.861263][ T5702] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 877.169341][T19826] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 877.235370][T19826] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 877.367636][ T5704] usb 4-1: USB disconnect, device number 54 [ 877.471711][ T5704] legousbtower 4-1:14.228: LEGO USB Tower #-160 now disconnected [ 877.580145][T19851] netlink: 164 bytes leftover after parsing attributes in process `syz.0.4032'. [ 877.746959][T19856] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 877.766294][T19856] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 877.794375][ T3480] usb 3-1: new high-speed USB device number 45 using dummy_hcd [ 877.965063][ T3480] usb 3-1: Using ep0 maxpacket: 16 [ 877.997152][ T3480] usb 3-1: New USB device found, idVendor=15c2, idProduct=0045, bcdDevice=1f.20 [ 878.039446][ T3480] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 878.078536][ T3480] usb 3-1: config 0 interface 0 has no altsetting 0 [ 878.092942][T19868] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 878.122206][ T3480] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 878.129207][T19868] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 878.170274][ T3480] usb 3-1: Product: syz [ 878.188801][ T3480] usb 3-1: Manufacturer: syz [ 878.207105][ T3480] usb 3-1: SerialNumber: syz [ 878.234941][ T3480] usb 3-1: config 0 descriptor?? [ 878.531965][ C1] imon 3-1:0.0: imon usb_rx_callback_intf0: status(-71) [ 878.827143][ T3480] input: iMON Panel, Knob and Mouse(15c2:0045) as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/input/input62 [ 879.101755][ T3480] imon:send_packet: packet tx failed (-71) [ 879.154267][ T3480] imon 3-1:0.0: panel buttons/knobs setup failed [ 879.258094][T19905] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 879.296015][T19905] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 879.394331][ T3480] rc_core: IR keymap rc-imon-pad not found [ 879.395434][T19909] input: syz1 as /devices/virtual/input/input64 [ 879.423086][ T3480] Registered IR keymap rc-empty [ 879.438581][ T3480] imon 3-1:0.0: Looks like you're trying to use an IR protocol this device does not support [ 879.454699][ T3480] imon 3-1:0.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 879.471397][ T3480] imon:send_packet: packet tx failed (-71) [ 879.496326][ T3480] imon 3-1:0.0: remote input dev register failed [ 879.509766][ T3480] imon 3-1:0.0: imon_init_intf0: rc device setup failed [ 879.552903][T19909] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4044'. [ 879.765851][ T3480] imon 3-1:0.0: unable to initialize intf0, err 0 [ 879.802330][ T3480] imon:imon_probe: failed to initialize context! [ 879.853695][ T3480] imon 3-1:0.0: unable to register, err -19 [ 879.891998][ T3480] usb 3-1: USB disconnect, device number 45 [ 880.264272][ T3480] usb 3-1: new high-speed USB device number 46 using dummy_hcd [ 880.420242][T19963] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 880.435362][ T3480] usb 3-1: Using ep0 maxpacket: 32 [ 880.441403][ T3480] usb 3-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=93.d8 [ 880.461405][T19963] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 880.487410][ T3480] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 880.530565][ T3480] usb 3-1: config 0 has no interface number 0 [ 880.543227][T19963] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 880.553472][ T3480] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 880.570459][ T3480] usb 3-1: Product: syz [ 880.595512][ T3480] usb 3-1: Manufacturer: syz [ 880.616318][ T3480] usb 3-1: SerialNumber: syz [ 880.639629][ T3480] usb 3-1: config 0 descriptor?? [ 880.654746][ T10] usb 1-1: new high-speed USB device number 36 using dummy_hcd [ 880.667143][ T3480] usb 3-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 880.702744][ T3480] usb 3-1: selecting invalid altsetting 1 [ 880.716646][ T3480] usb 3-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 880.751543][ T3480] usb 3-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 880.776024][ T3480] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 880.799141][ T3480] usb 3-1: media controller created [ 880.814117][ T10] usb 1-1: Using ep0 maxpacket: 32 [ 880.833352][ T10] usb 1-1: unable to get BOS descriptor or descriptor too short [ 880.846439][ T10] usb 1-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 880.876775][ T10] usb 1-1: config 14 has an invalid interface number: 57 but max is 1 [ 880.885980][ T10] usb 1-1: config 14 has an invalid interface number: 228 but max is 1 [ 880.896317][ T10] usb 1-1: config 14 has no interface number 0 [ 880.903306][ T10] usb 1-1: config 14 has no interface number 1 [ 880.910314][ T10] usb 1-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 880.934393][T19888] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 880.946827][ T10] usb 1-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 880.946875][ T3480] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 880.969260][T19888] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 881.016523][ T10] usb 1-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 881.049274][ T10] usb 1-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 881.066133][ T10] usb 1-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 881.084766][ T3480] usb 3-1: dvb_usb_ce6230: usb_control_msg() failed=-71 [ 881.093832][ T10] usb 1-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 881.111636][ T3480] zl10353_read_register: readreg error (reg=127, ret==-71) [ 881.112804][ T10] usb 1-1: config 14 interface 57 has no altsetting 0 [ 881.128745][ T10] usb 1-1: config 14 interface 228 has no altsetting 0 [ 881.136786][ T3480] usb 3-1: dvb_usb_ce6230: usb_set_interface() failed=-71 [ 881.147658][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 881.158386][ T10] usb 1-1: Product: syz [ 881.162685][ T10] usb 1-1: Manufacturer: syz [ 881.167486][ T10] usb 1-1: SerialNumber: syz [ 881.273279][ T3480] usb 3-1: USB disconnect, device number 46 [ 881.329897][T20011] FAULT_INJECTION: forcing a failure. [ 881.329897][T20011] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 881.348967][T20011] CPU: 1 UID: 0 PID: 20011 Comm: syz.1.4055 Tainted: G L syzkaller #0 PREEMPT(full) [ 881.349004][T20011] Tainted: [L]=SOFTLOCKUP [ 881.349013][T20011] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 881.349027][T20011] Call Trace: [ 881.349036][T20011] [ 881.349044][T20011] dump_stack_lvl+0xe8/0x150 [ 881.349074][T20011] should_fail_ex+0x410/0x560 [ 881.349098][T20011] _copy_from_user+0x2d/0xb0 [ 881.349123][T20011] do_sock_getsockopt+0x200/0x7e0 [ 881.349170][T20011] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 881.349213][T20011] ? __fget_files+0x3a2/0x420 [ 881.349231][T20011] ? __fget_files+0x2a/0x420 [ 881.349255][T20011] __x64_sys_getsockopt+0x1a4/0x240 [ 881.349295][T20011] do_syscall_64+0x166/0x520 [ 881.349314][T20011] ? trace_irq_disable+0x3b/0x140 [ 881.349340][T20011] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 881.349360][T20011] ? clear_bhb_loop+0x70/0xc0 [ 881.349384][T20011] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 881.349405][T20011] RIP: 0033:0x7f7a8159e0d9 [ 881.349425][T20011] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 881.349443][T20011] RSP: 002b:00007f7a82414028 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 881.349466][T20011] RAX: ffffffffffffffda RBX: 00007f7a81825fa0 RCX: 00007f7a8159e0d9 [ 881.349479][T20011] RDX: 000000000000001d RSI: 0000000000000084 RDI: 0000000000000003 [ 881.349490][T20011] RBP: 00007f7a82414090 R08: 0000200000000080 R09: 0000000000000000 [ 881.349501][T20011] R10: 0000200000000040 R11: 0000000000000246 R12: 0000000000000001 [ 881.349513][T20011] R13: 00007f7a81826038 R14: 00007f7a81825fa0 R15: 00007f7a8194fa48 [ 881.349539][T20011] [ 881.565097][T20016] kvm: apic: phys broadcast and lowest prio [ 881.749353][ T10] legousbtower 1-1:14.57: interrupt endpoints not found [ 881.828416][T20026] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 881.848837][ C0] [ 881.851233][ C0] ============================= [ 881.856107][ C0] [ BUG: Invalid wait context ] [ 881.861004][ C0] syzkaller #0 Tainted: G L [ 881.867025][ C0] ----------------------------- [ 881.871901][ C0] ksoftirqd/0/15 is trying to lock: [ 881.877135][ C0] ffff8880581cb5e8 (&dev_instance_lock_key#28){+.+.}-{4:4}, at: tcp_tsq_handler+0x29/0x200 [ 881.887218][ C0] other info that might help us debug this: [ 881.893141][ C0] context-{3:3} [ 881.896631][ C0] locks held by ksoftirqd/0/15: 2, last CPU#0: [ 881.903158][ C0] #0: ffff88801b029540 ((wq_completion)events_bh){+.-.}-{0:0}, at: process_scheduled_works+0xa1a/0x14c0 [ 881.914435][ C0] #1: ffffc90000147ba0 ((work_completion)(&tsq->work)){+.-.}-{0:0}, at: process_scheduled_works+0xa1a/0x14c0 [ 881.926163][ C0] stack backtrace: [ 881.929922][ C0] CPU: 0 UID: 0 PID: 15 Comm: ksoftirqd/0 Tainted: G L syzkaller #0 PREEMPT(full) [ 881.929962][ C0] Tainted: [L]=SOFTLOCKUP [ 881.929972][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 881.929988][ C0] Call Trace: [ 881.929998][ C0] [ 881.930007][ C0] dump_stack_lvl+0xe8/0x150 [ 881.930046][ C0] __lock_acquire+0xe39/0x2cf0 [ 881.930085][ C0] ? __lock_acquire+0x683/0x2cf0 [ 881.930117][ C0] ? look_up_lock_class+0x57/0x110 [ 881.930154][ C0] ? register_lock_class+0x31/0x2e0 [ 881.930190][ C0] ? tcp_tsq_handler+0x29/0x200 [ 881.930220][ C0] lock_acquire+0x106/0x350 [ 881.930250][ C0] ? tcp_tsq_handler+0x29/0x200 [ 881.930289][ C0] _raw_spin_lock+0x2e/0x40 [ 881.930317][ C0] ? tcp_tsq_handler+0x29/0x200 [ 881.930348][ C0] tcp_tsq_handler+0x29/0x200 [ 881.930378][ C0] tcp_tsq_workfn+0x384/0x410 [ 881.930408][ C0] ? __pfx_tcp_tsq_workfn+0x10/0x10 [ 881.930440][ C0] ? rcu_is_watching+0x16/0xb0 [ 881.930462][ C0] ? process_scheduled_works+0xa1a/0x14c0 [ 881.930488][ C0] process_scheduled_works+0xa88/0x14c0 [ 881.930511][ C0] ? __lock_acquire+0x683/0x2cf0 [ 881.930554][ C0] ? __pfx_process_scheduled_works+0x10/0x10 [ 881.930577][ C0] ? do_raw_spin_lock+0x12b/0x2f0 [ 881.930606][ C0] ? assign_work+0x3cf/0x5d0 [ 881.930631][ C0] bh_worker+0x44e/0x840 [ 881.930661][ C0] tasklet_action+0xc/0x70 [ 881.930701][ C0] handle_softirqs+0x226/0x860 [ 881.930726][ C0] ? schedule+0x90/0x2b0 [ 881.930754][ C0] ? run_ksoftirqd+0x36/0x60 [ 881.930784][ C0] ? smpboot_thread_fn+0x4e/0xa70 [ 881.930811][ C0] run_ksoftirqd+0x36/0x60 [ 881.930838][ C0] smpboot_thread_fn+0x565/0xa70 [ 881.930868][ C0] ? smpboot_thread_fn+0x4e/0xa70 [ 881.930900][ C0] kthread+0x38b/0x480 [ 881.930931][ C0] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 881.930958][ C0] ? __pfx_kthread+0x10/0x10 [ 881.930991][ C0] ret_from_fork+0x514/0xb70 [ 881.931023][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 881.931055][ C0] ? __switch_to+0xc89/0x1420 [ 881.931082][ C0] ? __pfx_kthread+0x10/0x10 [ 881.931115][ C0] ret_from_fork_asm+0x1a/0x30 [ 881.931158][ C0] [ 882.407132][ T10] legousbtower 1-1:14.228: LEGO USB Tower firmware version is 0.0 build 0 [ 882.417267][ T10] legousbtower 1-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 882.979126][T20045] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 882.989106][T20045] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 883.177862][ T10] usb 1-1: USB disconnect, device number 36 [ 883.191774][ T10] legousbtower 1-1:14.228: LEGO USB Tower #-160 now disconnected