last executing test programs: 10.21927346s ago: executing program 2 (id=963): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/custom1\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) syz_open_dev$loop(&(0x7f0000000100), 0x2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) write$binfmt_misc(r3, 0x0, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f00000002c0)={0x23c, 0x24, 0x20, 0x70bd2b, 0x25dfdbfb, "", [@generic="e9a7463a5bcaf36fbfe78d12cefbf411c7c7f9bdf38dc266b4f6a2f7", @nested={0x20e, 0xc9, 0x0, 0x1, [@typed={0x38, 0x98, 0x0, 0x0, @binary="806f1716a7b0921a8e84e1659b4d2f3ab86306bb88413086e4b559c196e31efbaa653c49dfc36cefc6568604fdc59987377381a3"}, @generic="3d3f966b04fa4b0fed3091446f2bbdf221fbcc9625180831483021e8db5a021d42385304d039db2d14f2037262728ef932b67e4b1daab483fc0c6376495bf3d5ac229929def69c8532ed400a4eb284bf9dd407b306bbc6dc65d0e2809398ff19c5ea624bcfb404149ce617d86f7668ccb556ec8bcd9cc7693ca01eb065b6db34bfe328812f27fa7d2d33ba6d2c4779ab20be2c464479854f09026242fd97a91d1b1c18ff43d91ee38942cc04cdb25aa0b95138f3222aaed8add31f4d14f84c73b6279e89f21f448ee6aaa14acb26a18b53c612c57a1db57582", @typed={0x14, 0xa3, 0x0, 0x0, @ipv6=@loopback}, @nested={0x4, 0x4a}, @generic="4b8780fcd2528dcc21053016b01ad58bcd7cdbb08541c5a1c420aece76a9e3f1326ae47a136f321bb078928b38d4ed67d0b7c54fe6d7814e2e3353df68f0a13eae5d9a3f9db5ccb31f1b210210044aa295eec552a4e4d7852983121b4e6c7398601bbd31bac6e26be1e746831ee1138102613ae6360cb0ade9152f6ac74954e4e95a85f66966d5276cf2fb2650c7d48b85ebe3d8780e2c015103d10e0500ee730e75116e0ad125963f4c4ae5a890dcc01b790796d6cf7bd5ffe044071ef4e46a359218a086542187f98fd5d5a055ec2235ae8ff0e1d2015dc01825aa9b71ee8c4d"]}]}, 0x23c}, {&(0x7f0000001940)={0x2a0, 0x19, 0x1, 0x70bd2c, 0x25dfdbfe, "", [@typed={0xc, 0x80, 0x0, 0x0, @u64=0x6}, @generic="b6fda8cc439cdaa8f012e74c339c302ce511514e8acd2cea1e72c98a05f43bd1b1e4b5a93a8485edfa12d136ec8421171c95870c665e59a329a48ae9efade8de37780c5e8c502943a2ea3d95e954cfe801eee56846f45d47e75bbdf88463998ca5b810a5dad3c4e1effb353ecc4dbb4f9b7ae1c7ab8b32dbb319c3c3f2ca6ef99df25205ab85f5ada29c0c9f95ef9465374baff80b3290cb", @nested={0x1ec, 0x30, 0x0, 0x1, [@nested={0x1e6, 0x7f, 0x0, 0x1, [@nested={0x10d, 0xab, 0x0, 0x1, [@nested={0x4, 0xc4}, @typed={0x8, 0x24, 0x0, 0x0, @ipv4=@multicast2}, @nested={0x4, 0x9}, @typed={0x8, 0x5e, 0x0, 0x0, @ipv4=@empty}, @generic="339380036a20b1a12c52b7e06bd8c5d5a4a1ba066b56c784bbe8aff852b1c6b069596108c218627674b2e3491e5ea42e6789eb3047354f32dbea8c7a5d35487e4dc1527b1d007f816cf7970c3347ec85e168e4c49c8ddeec5d4c90ca69895665c72c379adeadd2c8958393e4c237511138544568eee71f5da835485b80989398f8237f7932c5f6d54ae495d4bb1f3d0e00c7ea1d6adebbfcbc73c70342f1", @generic="d67e27c3b5c853aaf5bc3c3e2e6fde2eb87d9a72728910477395a76a939ca960a1698305a4262349f1b0c99e613b2a17aa1b2cd03ff2d20c296ea674d804d064d1aa1b95766eb83d6fb484", @nested={0x4, 0xc1}, @nested={0x4, 0x13a}]}, @nested={0x10, 0x77, 0x0, 0x1, [@typed={0xc, 0x5, 0x0, 0x0, @u64}]}, @nested={0xc, 0x124, 0x0, 0x1, [@typed={0x8, 0x67, 0x0, 0x0, @uid}]}, @generic="6438dc3b83c0082bc7611a49fd90f2ce106e78c3151d09f30232edffa15a6b57331ad85d4537350ac4f7a148061fb442317ed1a12fd539e20d78df7acbaffda943522861fa8d20e1bdd7df4393956e1d72a9771abbb323a53425ea0a2b6bf20da11529c57d30933163e1978eca065cd5cae3a5aeae56b2f5282860632feb4e25117ff5a68529c0dc118216979688d843f981daa3ed4777bbee1f0adca68c5cc923b001665070db63856848cb61b9218a3386735b2145"]}]}]}, 0x2a0}, {&(0x7f0000000780)={0x10, 0x18, 0x300, 0x70bd2d, 0x25dfdbfe}, 0x10}], 0x3, 0x0, 0x0, 0x20008005}, 0x4008012) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='blkio.bfq.io_merged\x00', 0x275a, 0x0) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x2, 0x12, r5, 0x0) ftruncate(r5, 0xc17a) set_mempolicy(0x6005, &(0x7f0000000080)=0xfffffffffffffffd, 0x4) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='numa_maps\x00') pread64(r6, &(0x7f0000000900)=""/4108, 0x100c, 0xc2) ioctl$TIOCGPTPEER(0xffffffffffffffff, 0x5441, 0x4aafd89) openat$iommufd(0xffffffffffffff9c, 0x0, 0x59642, 0x0) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={0xffffffffffffffff, 0x0, 0x0}, 0x10) r7 = fsopen(&(0x7f0000000240)='ramfs\x00', 0x0) r8 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r8, 0x8946, &(0x7f00000001c0)={'veth1_to_team\x00', &(0x7f0000002fc0)=@ethtool_wolinfo={0x3, 0x8, 0x4, "050000009582"}}) r9 = fsmount(r7, 0x1, 0x18) fchdir(r9) mkdir(&(0x7f00000008c0)='./bus\x00', 0x0) lseek(0xffffffffffffffff, 0x100000001, 0x0) syz_usb_connect(0x0, 0x81, &(0x7f0000000180)={{0x12, 0x1, 0x0, 0xd, 0x92, 0xc, 0x10, 0x19d2, 0x1165, 0xc1d5, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x81, 0x0, 0x2, 0xff, 0xff, 0xff}}]}}]}}, 0x0) 10.103642644s ago: executing program 0 (id=964): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000027c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x2d, 0x20040040) io_setup(0x3ff, &(0x7f0000000500)=0x0) io_submit(r2, 0x1, &(0x7f0000000040)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0xffff, r1, 0x0}]) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1f, 0x0, 0x0, 0x1000, 0x0, 0x1}, 0x48) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x60000000000000, 0x28011, r3, 0x0) connect$unix(r1, &(0x7f00000001c0)=@file={0x0, './file0\x00'}, 0x6e) 9.852023685s ago: executing program 0 (id=966): sendmsg$MPTCP_PM_CMD_GET_LIMITS(0xffffffffffffffff, 0x0, 0x809d) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xc01c0, 0x0) syz_emit_ethernet(0x66, &(0x7f0000000380)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaaa88a800008100000086dd6076cd8a0028000020010000000000000000000000000000fe800000000000000000000000000000000400000000000007188663f6aef5"], 0x0) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000300)={'#! ', '', [{0x20, '#+\\@'}, {0x20, '#! '}], 0xa, "decda8b830fc2f5f8709257e245518ef05bce57e0c18ea96120571e8085785e0c8ada3a54cf3f070a2dd8f4dbc270bc581c0cd60c59e7acb504c4a1360c7e593c751449b6910d0e944a5174ca759ee04bfb7481889587c174f8c043ed069c00033fa1243efc40018dbe9bc228e566d7e4cf0bf50601bd8c7d4ecbde9033848d1f7d9997bc052afe5a44134efa6d8ca9f3621f35639b289ed6f631d53"}, 0xa9) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000480)=ANY=[@ANYBLOB], 0x44}, 0x1, 0x0, 0x0, 0x800}, 0x40000) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x1}) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000080)=ANY=[@ANYRESHEX, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRESOCT=0x0], 0xf8}, 0x1, 0x0, 0x0, 0x4001}, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e23, 0x0, @empty, 0x1}, 0x1c) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r2 = dup(r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000a, 0x13, r2, 0x2000) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x17) msync(&(0x7f0000952000/0x2000)=nil, 0x87abbe8d1cc6ad9, 0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) openat$vicodec0(0xffffffffffffff9c, 0x0, 0x2, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000000)='numa_maps\x00') preadv(r3, &(0x7f0000001180)=[{&(0x7f0000000180)=""/4096, 0x1000}, {&(0x7f00000011c0)=""/39, 0x27}], 0x2, 0x0, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[], 0x134}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, 0xffffffffffffffff, 0x0) r4 = syz_open_dev$video(&(0x7f0000000140), 0x100000001, 0x80000) ioctl$VIDIOC_G_SELECTION(r4, 0xc040565e, &(0x7f0000000040)={0x9, 0x100, 0x4, {0x2, 0x0, 0x0, 0xc}}) 8.735871384s ago: executing program 1 (id=970): r0 = syz_io_uring_setup(0x88f, &(0x7f00000000c0)={0x0, 0xaee2, 0x80, 0x2, 0x1f9}, &(0x7f0000000000)=0x0, &(0x7f0000000180)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f00000002c0)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, r0, 0x0, &(0x7f0000000040)='./file0\x00', 0x64, 0x183000, 0x12345}) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x42002) r3 = open(&(0x7f00000001c0)='./bus\x00', 0x4c27e, 0x53) close(r3) syz_open_dev$vim2m(&(0x7f0000000000), 0x47b, 0x2) read$FUSE(r3, 0x0, 0x0) io_uring_enter(r0, 0x47f6, 0x0, 0x0, 0x0, 0x0) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/seq/clients\x00', 0x0, 0x0) preadv(r4, &(0x7f0000004ec0)=[{&(0x7f0000004bc0)=""/68, 0x44}], 0x1, 0x8000, 0x0) 8.610406421s ago: executing program 4 (id=971): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = dup(r0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f00000000c0)=[@in6={0xa, 0x4e24, 0x6, @empty, 0x3}], 0x1c) sendmsg$inet6(r0, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0x8, @loopback, 0x4}, 0x1c, 0x0}, 0x4048043) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000000)='ip6gretap0\x00', 0x10) mprotect(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1000001) getsockname(r1, &(0x7f00000002c0)=@hci, &(0x7f0000000040)=0x80) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000400)={0x0, @in={{0x2, 0x4e24, @loopback}}, 0x3, 0xfffc, 0xe652, 0xffffffff, 0x14, 0x100, 0xff}, 0x9c) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000200)={0x0, @in={{0x2, 0x4e21, @empty}}, 0x5, 0x1, 0xf06, 0x0, 0xac, 0x81, 0x5}, 0x9c) r2 = syz_open_dev$vim2m(&(0x7f0000000000), 0x7, 0x2) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x7, 0x4, 0x6, 0xfffa}, 0x1d, [0x6, 0xc95a, 0xfffffff3, 0x9, 0x7f, 0x2, 0x1, 0x7f, 0x6, 0xfffffff9, 0xfffffff2, 0x5f, 0xa, 0x3, 0xffff2d37, 0x1dd2, 0x6, 0x7, 0x0, 0x80000001, 0x4, 0x7, 0x3, 0x3c5b, 0x1, 0x24, 0xffffffff, 0xfffffffe, 0x1f461e2c, 0x24000, 0xe661, 0x4, 0x9, 0x3, 0x7fff, 0x4c74, 0x8f00, 0x642, 0x3, 0xa, 0x0, 0x71, 0x7, 0x7, 0x103, 0x0, 0x5, 0x3c, 0x91, 0x6, 0xfffffffd, 0x3, 0x5, 0x4, 0x8, 0x0, 0x80, 0x0, 0x5, 0x6, 0x8, 0x4, 0x1, 0x40], [0x10000007, 0x8, 0x12f, 0x8000, 0x10, 0x8, 0x129432e2, 0xcb, 0xf9, 0xd, 0x2bf, 0x6c9, 0x9, 0xfffffffe, 0x7, 0x0, 0x10007, 0x5, 0x2f, 0xb98, 0x312, 0x78, 0xea4, 0xa, 0x4, 0x4000, 0x8000, 0x9, 0x400, 0x1, 0x6, 0xfffffffd, 0x8, 0x1005, 0x7ff, 0x5f31, 0x4, 0x0, 0x6, 0x2, 0x9, 0x4, 0x9, 0x8, 0x9, 0x6, 0x5, 0x0, 0x1, 0x8000, 0xffff, 0x2, 0x7f, 0x9, 0x5, 0x10003, 0x4, 0x1, 0x7, 0xb, 0x9, 0x48c93690, 0x3, 0xff], [0x7, 0x4, 0x0, 0x64e, 0xfffffdfe, 0x7fffffff, 0x8d2, 0x9, 0x1, 0x7fff, 0x6, 0x5, 0xb, 0x4, 0x5, 0x5, 0x0, 0x1ef, 0x5, 0x8, 0x86, 0x3, 0x10000009, 0x3e7, 0xb, 0x5, 0x2, 0x2, 0xf, 0x8, 0x4, 0x6d01, 0x5, 0x3b, 0x3, 0x200, 0x80, 0x3, 0x4, 0x2, 0x0, 0xa2, 0x7, 0x53cf697b, 0x5, 0x6, 0x54fe12d6, 0xbf, 0x200, 0x3, 0x400002, 0xfffffff9, 0x0, 0x6, 0x5, 0x0, 0x6, 0xfffffffb, 0x120000, 0x3, 0x6, 0x9, 0x4, 0x3], [0x9, 0xbb2f, 0x3, 0x7, 0x5, 0x938, 0x6, 0x6, 0x0, 0x5, 0xce7, 0x1ff, 0x6, 0x8ad, 0x5, 0x3, 0x101, 0x10000, 0x6, 0x7fff, 0x8ffff, 0xa620, 0x2, 0x5, 0x1, 0x2, 0x14c, 0x60a7, 0x4, 0x5, 0xffffffff, 0x7ffffffe, 0x5, 0x8, 0xc8, 0x3, 0x3, 0xffff, 0x3, 0x9, 0x100, 0x9602, 0xa, 0x2, 0x4, 0x6, 0x1, 0x10000, 0x5, 0x8, 0x2b91, 0xa1f, 0x8, 0x9, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0xb1c, 0x1, 0x200, 0xffff3441, 0xfff]}, 0x45c) openat$mice(0xffffffffffffff9c, &(0x7f0000000080), 0x0) r3 = syz_io_uring_setup(0x9eb, &(0x7f0000000140)={0x0, 0xfad6}, &(0x7f0000000240)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) syz_io_uring_submit(r4, r5, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}) io_uring_enter(r3, 0xdb4, 0x0, 0x0, 0x0, 0x0) r6 = syz_open_dev$evdev(&(0x7f0000000000), 0x3, 0x822b01) write$char_usb(r6, &(0x7f0000000040)="e2", 0x918) ioctl$vim2m_VIDIOC_S_FMT(r2, 0xc0d05605, &(0x7f00000005c0)={0x1, @pix_mp={0xff, 0x0, 0x42474752, 0x8, 0x4000, [{0x7, 0x19f}, {0x8, 0x29f6ebcd}, {0x1c, 0x8}, {0x2, 0x8}, {0x2, 0x1}, {0x5, 0x6}, {0x400, 0x40a}, {0x2, 0x10001aa2}], 0x0, 0xd, 0x7, 0x3078182a3427730f, 0x1}}) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'dummy0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r9, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x4, 0x2, @TCA_HFSC_USC={0x10, 0x3, {0x1ff, 0x1, 0x8004}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f00000001c0)={0x0, @in={{0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x2d}}}, 0x1000000, 0x31, 0xffff1896, 0x7, 0x6, 0x115, 0x1b}, 0x9c) 8.065849634s ago: executing program 4 (id=972): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) unshare(0x66000080) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$sequencer(0xffffff9c, &(0x7f0000001bc0), 0x88302, 0x0) ioctl$SNDCTL_SEQ_GETOUTCOUNT(r1, 0x4004510d, &(0x7f0000000000)) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) r3 = syz_open_dev$sndctrl(&(0x7f0000000080), 0x1, 0x8080) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_NEXT_DEVICE(r3, 0xc0045540, &(0x7f00000000c0)=0x3) close(r2) socket$nl_generic(0x10, 0x3, 0x10) r4 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000840)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffb) r5 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000001480), 0x121142, 0x0) ioctl$LOOP_CTL_REMOVE(r5, 0x4c81, 0x0) ioctl$LOOP_CTL_ADD(r5, 0x4c80, 0x0) r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder1\x00', 0x0, 0x0) r7 = epoll_create1(0x0) ppoll(&(0x7f0000000080)=[{r7, 0x581}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDCTL_DSP_CHANNELS(r6, 0xc0045006, 0x0) epoll_ctl$EPOLL_CTL_ADD(r7, 0x1, r6, &(0x7f00000000c0)={0x1}) ioctl$BINDER_THREAD_EXIT(r6, 0x40046208, 0x0) add_key(&(0x7f00000003c0)='dns_resolver\x00', &(0x7f0000000400)={'syz', 0x3}, &(0x7f0000000080)="00000102", 0xfffff, r4) request_key(&(0x7f00000000c0)='dns_resolver\x00', &(0x7f0000000100)={'syz', 0x3}, 0x0, r4) r8 = inotify_init() ioctl$INOTIFY_IOC_SETNEXTWD(r8, 0x541b, 0x1000000000000) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) syz_io_uring_setup(0x690e, &(0x7f0000000440)={0x0, 0xe2b6, 0x10100, 0x2001}, &(0x7f0000000200), &(0x7f0000000140)) syz_io_uring_setup(0x1b67, &(0x7f00000003c0), &(0x7f0000000240)=0x0, &(0x7f0000000180)=0x0) r11 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r11, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@newlink={0x3c, 0x10, 0x49920d862a92153b, 0x800, 0x0, {0x0, 0x0, 0x0, 0x0, 0x1000a, 0x1b400}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_MODE={0x5, 0x21, 0x4}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24000040}, 0x0) syz_io_uring_submit(r9, r10, &(0x7f00000001c0)=@IORING_OP_ACCEPT={0xd, 0x8, 0x1, r11, &(0x7f0000000280)=0x80, &(0x7f00000002c0)=@nfc}) 7.526407695s ago: executing program 0 (id=973): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) syz_usb_connect(0x0, 0x24, &(0x7f00000001c0)=ANY=[@ANYBLOB="120100009dea7840b418fbff7bdc01020301090212000100000000090401"], 0x0) sendmsg$DEVLINK_CMD_PORT_SPLIT(0xffffffffffffffff, 0x0, 0x80) r0 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) ioctl$I2C_RDWR(r0, 0x707, &(0x7f0000000140)={&(0x7f0000000180)=[{0x6, 0x6000, 0x24, &(0x7f0000000900)="0accd1d89774c54b767fb693d0a292e62da0080c3294de92741f578a36cb94825824b8a6"}], 0x1}) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000000)='bond_slave_1\x00', 0x10) open_tree(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x89901) 6.973107867s ago: executing program 2 (id=974): r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x143042, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file1\x00', &(0x7f0000000140), 0x2, &(0x7f0000002400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=r0, @ANYBLOB=',group_id=', @ANYRESDEC=r1]) ioctl$FS_IOC_GETFSUUID(r1, 0x80111500, &(0x7f0000000000)) read$FUSE(r1, &(0x7f0000000200)={0x2020, 0x0, 0x0}, 0x2020) open(&(0x7f00000000c0)='./file1\x00', 0x0, 0x0) write$FUSE_BMAP(r1, &(0x7f00000022c0)={0x18, 0x0, r2, {0x7}}, 0x18) read$FUSE(r1, &(0x7f0000004580)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INTERRUPT(r1, &(0x7f0000002240)={0x10, 0xffffffffffffffda, r3}, 0x10) r4 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) getsockopt$sock_buf(r5, 0x1, 0x10, &(0x7f00000016c0)=""/180, &(0x7f0000001780)=0xb4) dup3(r4, r1, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone(0x640c7000, 0x0, 0x0, 0x0, 0x0, 0x0) 6.792006974s ago: executing program 1 (id=976): r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="4000000010000104000000000300000000000000", @ANYRES32=0x0, @ANYBLOB="10c00000000000001800128008000100677470000c000280080002"], 0x40}}, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x0) (fail_nth: 21) 6.653602306s ago: executing program 1 (id=977): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e22, 0x9, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0xab}}, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @empty}, 0x5635}, 0x1c) socket$l2tp(0x2, 0x2, 0x73) openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000002a82, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = epoll_create1(0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) epoll_pwait(r1, &(0x7f0000000140)=[{}], 0x1, 0x2d516fb6, 0x0, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r4, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r4, &(0x7f0000000200)={0xa, 0x20, 0x0, @loopback}, 0x1c) r5 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r5}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x77359400}, {0x0, 0x989680}}, 0x0) r6 = openat$vicodec1(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x1, 0x18, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x148}, {}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}}], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$VIDIOC_DQEVENT(r6, 0x80885659, 0x0) setsockopt$inet6_tcp_TCP_ULP(r4, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r4, 0x11a, 0x2, &(0x7f0000000140)=@gcm_256={{0x304}, "480ca6eda49ed6a6", "3a2cc8b276a753b0e23e2a8436b0e1d53d11b70c57abe2e932240e766d3aebfd", "a0eb068e", "e96e232f2004a832"}, 0x38) sendmsg$TIPC_CMD_GET_LINKS(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000003c0)={0x0}, 0x1, 0x0, 0x0, 0x4001}, 0x20008000) recvfrom$inet6(r4, &(0x7f0000000240)=""/169, 0xa9, 0x40010002, 0x0, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r4, 0x0, r7, 0x0, 0x7ffd, 0xe) ioctl$KVM_CAP_X86_NOTIFY_VMEXIT(r7, 0x4068aea3, &(0x7f0000000000)={0xdb, 0x0, 0x8}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r3, &(0x7f0000000100)={0x20000014}) syz_io_uring_setup(0xbdc, &(0x7f0000000640)={0x0, 0xec25, 0x400, 0x1, 0x40000333}, &(0x7f00000006c0), &(0x7f00000001c0)) 6.555021522s ago: executing program 4 (id=979): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, 0x0, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001ac0)=ANY=[@ANYBLOB="3c0000001000030400000000fcdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="04000000008000001400128009000100766574680000000004000280080004"], 0x3c}, 0x1, 0x0, 0x0, 0x2004c808}, 0x0) bind$alg(r2, &(0x7f00000007c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(sm4)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000001280)="b7f2288a911993f08d3aaea2bc0000de", 0x10) r4 = accept4(r2, 0x0, 0x0, 0x800) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) cachestat(0xffffffffffffffff, &(0x7f00000002c0)={0x9, 0x5}, &(0x7f0000000300), 0x0) sendmmsg$alg(r4, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) 6.219546092s ago: executing program 2 (id=981): shmat(0x0, &(0x7f0000000000/0x4000)=nil, 0xbbdccba4532b703b) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='smaps\x00') read$FUSE(r0, 0x0, 0x0) 6.029406491s ago: executing program 2 (id=983): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000200)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x38, 0x24, 0xd0f, 0x70bd28, 0x25dfdbfe, {0x60, 0x0, 0x0, r3, {0x0, 0xe}, {0xffff, 0xffff}, {0x7, 0xffe1}}, [@qdisc_kind_options=@q_pie={{0x8}, {0xc, 0x2, [@TCA_PIE_TUPDATE={0x8, 0x8, 0xffffffff}]}}]}, 0x38}, 0x1, 0x0, 0x0, 0x20008000}, 0x0) bind$unix(r0, &(0x7f00000025c0)=@file={0x0, './file0\x00'}, 0x6e) 5.8255571s ago: executing program 2 (id=984): write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000040)={0x50, 0x0, 0x0, {0x7, 0x1f, 0x6, 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0xfffffffd}}, 0x50) syz_open_procfs$pagemap(0x0, &(0x7f0000000140)) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, '.\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x801, 0x0) r2 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x74, 0x0, 0x0) prctl$PR_GET_SPECULATION_CTRL(0x34, 0x0, 0x0) flock(0xffffffffffffffff, 0x1) ioctl$KVM_RUN(r2, 0xae80, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x1, 0x100004, 0x220104, 0xe2a4, 0x1, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x1800}, 0x48) pipe(&(0x7f00000001c0)={0xffffffffffffffff}) splice(r3, 0x0, 0xffffffffffffffff, 0x0, 0x80000001, 0x0) 5.82410336s ago: executing program 0 (id=986): r0 = syz_open_procfs(0x0, &(0x7f0000000140)='gid_map\x00') prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0) fchdir(r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) syz_open_dev$vcsa(&(0x7f00000000c0), 0xa40d, 0x2a8102) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) openat$sysfs(0xffffffffffffff9c, 0x0, 0x395180, 0x149) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) io_setup(0xf9, &(0x7f0000000040)) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(0xffffffffffffffff, 0xc1205531, 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x40010) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x4008032, 0xffffffffffffffff, 0x0) futex_waitv(&(0x7f0000000a00)=[{0xf, 0x0, 0x82}], 0x1, 0x0, &(0x7f0000000dc0)={0x0, 0x989680}, 0x0) ioctl$IOCTL_VMCI_INIT_CONTEXT(0xffffffffffffffff, 0x7a0, 0x0) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x2982, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) ioctl$TIOCSERGETLSR(r3, 0x5459, &(0x7f0000000080)) ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, 0x0) r4 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/igmp6\x00') r5 = socket(0x10, 0x3, 0x0) write(r5, &(0x7f0000000000)="240000001a005f0314f9f407000904000200000001000000000000000800040001000000", 0x24) ioctl$FS_IOC_MEASURE_VERITY(r4, 0xc0046686, &(0x7f0000000000)={0x5, 0x24, "c9a3f567aaea8e774f66aac44deffe62e30ab07a7f495898f7ffdada0102005f00000000"}) preadv(r4, &(0x7f0000001880)=[{&(0x7f0000001a80)=""/102400, 0x19000}], 0x1, 0x40000000, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r6, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r6, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=ANY=[@ANYBLOB="1400000010000100ffef0000efff00001b00000a5c0000000e0a010100000000000000000a0000060900020073797a31000000000900010073797a3100000000300003801c0000800c00018006000100d10300000c000440000000002df31ab30c00008008000340", @ANYBLOB='i'], 0x84}, 0x1, 0x0, 0x0, 0x4004850}, 0x40) 5.439808364s ago: executing program 3 (id=987): r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000140), 0xf92999ece73b3e79, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) getsockopt$sock_buf(r1, 0x1, 0x22, &(0x7f0000001080)=""/144, 0x0) write$rfkill(r0, &(0x7f0000000000)={0x80000, 0x81, 0x7, 0x13, 0xfd}, 0x17) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, 0x0, 0x0) r2 = syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0xaee2, 0x80, 0x2, 0x1f9}, &(0x7f0000000000)=0x0, &(0x7f0000000300)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f00000002c0)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, r2, 0x0, &(0x7f0000000040)='./file0\x00', 0x64, 0x183000, 0x12345}) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x42002) io_uring_enter(r2, 0x47f6, 0x0, 0x0, 0x0, 0x0) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/seq/clients\x00', 0x0, 0x0) preadv(r5, &(0x7f0000004ec0)=[{&(0x7f0000004bc0)=""/68, 0x44}], 0x1, 0x8000, 0x0) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0), 0x100, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x1) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f00000003c0)={0x1ff, 0x2, 0xdddd0000, 0x2000, &(0x7f00004bf000/0x2000)=nil}) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r8, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000500)=[@text64={0x40, 0x0}], 0x1, 0x0, &(0x7f0000000680)=[@cr4={0x1, 0x140207}], 0x1) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r8, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@textreal={0x8, 0x0}], 0x1, 0x51, 0x0, 0x0) syz_kvm_setup_cpu$x86(r7, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x18, 0x0, 0x0) ioctl$KVM_RUN(r8, 0xae80, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) request_key(&(0x7f0000000300)='rxrpc_s\x00', 0x0, 0x0, 0x0) openat$nullb(0xffffffffffffff9c, 0x0, 0x4000000004882, 0x0) io_setup(0x1, &(0x7f00000004c0)) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r9, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r10 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000400)=@newqdisc={0x30, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, 0x0, {0x0, 0x2}, {0xffff, 0xffff}, {0xfff1, 0xfff7}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x8001}, 0x20008850) 4.96069918s ago: executing program 4 (id=988): syz_open_dev$vbi(&(0x7f0000001200), 0x1, 0x2) (async, rerun: 32) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') (async, rerun: 32) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x4a, 0x0, &(0x7f0000000300)="b44c806748f06309624431ed3373010001000000008c6390009c4ebd873094563683b7ee0fae7a6a53200386ce51def6a4effb9de8b4645c2b9c0614907dac12c6d34a8266e6124b9252", 0x0, 0x405, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) (async, rerun: 64) r1 = syz_open_dev$sg(&(0x7f0000000140), 0x6f5e, 0x0) (rerun: 64) ioctl$FIBMAP(r1, 0x1, &(0x7f0000000040)=0x85) (async) ioctl$vim2m_VIDIOC_S_CTRL(r0, 0xc008561c, &(0x7f00000000c0)={0xf0f041, 0xffffffff}) read$hidraw(r0, &(0x7f0000000200)=""/4096, 0x1000) (async) r2 = syz_usb_connect(0x0, 0x24, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000003005740ed0b0011c3ec000000010902120001000000000904"], 0x0) (async) r3 = syz_open_dev$vim2m(&(0x7f0000000080), 0x0, 0x2) (async) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) (async, rerun: 64) sendmsg$IPCTNL_MSG_EXP_DELETE(r0, &(0x7f0000001480)={&(0x7f0000001240)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000001440)={&(0x7f0000001280)=ANY=[@ANYBLOB="9c0100000202010200000000000000000500000708000440000000000a000600482e32342d0000008c0001802c00018014000300fc00000000000000000000000000000114000400fc0200000000000000000000000000010c00028005000100020000000c000280050001002f00000006000340000100000c000280050001000e0000001400018008000100ac141414080002007f00000106000340000000001400018008000100ac1414aa080002007f0000010a000b00512e393331000000080004400000000608000840000000020800054000000007bc000380060003400000000014000180080001000000000008000200ac1e010126000340000400002c0001801400030000000000000000000000ffffac14142314000400fe8000000000000000000000000000bb060003400001000006000340000200002c00018014000300fc01000000000000000000800000000114000400fe8000000000000000000000000000aa2c000180140003000000000000000000000000000000000014000400fc0200000000000000000000000000010800084000000003"], 0x19c}, 0x1, 0x0, 0x0, 0x20000001}, 0x4004) (async, rerun: 64) r4 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_MOD(r4, 0x3, 0xffffffffffffffff, &(0x7f0000000000)={0x20000001}) (async) ioctl$vim2m_VIDIOC_REQBUFS(r3, 0xc0145608, &(0x7f00000000c0)={0x1, 0x2, 0x1}) (async, rerun: 32) ioctl$vim2m_VIDIOC_QBUF(r3, 0xc058560f, &(0x7f0000000340)=@mmap={0x0, 0x2, 0x4, 0xffffff7f, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "186856f3"}}) (rerun: 32) openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x84042, 0x0) (async) r5 = syz_io_uring_setup(0x22f, &(0x7f0000000080)={0x0, 0x5325, 0x10000, 0x0, 0x100002cf}, &(0x7f0000000000)=0x0, &(0x7f0000000140)=0x0) syz_usb_control_io$cdc_ncm(r2, &(0x7f0000001600)={0x14, &(0x7f00000014c0)=ANY=[@ANYBLOB="2007df000000df0af31e4c96d4deb9c94f534a92703c1cd0e30d1b94f217a2a00826b5af7c6299ae92d4afcfbf6216c1ffd26b67dbc57e64ed99132713ac093bff6467b73c433fd783479fc3584213b5eb50dccc8007607f443611c33f595c7e4763faf9c9fd92c8aa0e844a01b4273e2b5b2484d692243fcf86feffef06d0499e28cfe58fcf89e86bd8d164415ba3026c08968cb7c85e2a7b373ee2d8572d81cff30b857e4d6432bf74a17cb65fb2b9d27a23925aa4586b7a63e5693847d8bbeb0ba467c6a723435e66808892407146feb5e577bface167"], &(0x7f00000015c0)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000002940)={0x44, &(0x7f0000002680)={0x20, 0xa, 0xe1, "d69d978389acd4eb2ef7edc46b0ad7504a361cac282ff7aaf4a90274e4fd4c6c2688bc8d5173664a09a3cf6cbf4a53bc468c6056a760bb2b20ee07f37ab45ccf8a20917c71683c8a5ce9d32f395c24268c9f98c5f569457850f2f45fe4fd8e4791ce13a1fc48b88aff1a30f96a2a0b2c93c752abdfe7d3e585b2a152ca297b9317cbe95c58cd6c52a90214735d0341d219ed5b65e5db97eb71b68240d9a9e8a66ec320bcf334be07d2a79d13b1a7bf8b290c5547021d84c09b72710c9257db4874108b293f5802ee7044f14bc62daed8fd5c415e1303498a8e0765d1ccd120faf2"}, &(0x7f0000002780)={0x0, 0xa, 0x1, 0xee}, &(0x7f00000027c0)={0x0, 0x8, 0x1, 0x8c}, &(0x7f0000002800)={0x20, 0x80, 0x1c, {0x7, 0x6, 0x2, 0xa, 0x80, 0x4, 0xa1, 0x5, 0xfff9, 0x8, 0x3, 0x1ff}}, &(0x7f0000002840)={0x20, 0x85, 0x4, 0x3}, &(0x7f0000002880)={0x20, 0x83, 0x2, 0x1}, &(0x7f00000028c0)={0x20, 0x87, 0x2, 0x3}, &(0x7f0000002900)={0x20, 0x89, 0x2, 0x1}}) (async) syz_io_uring_submit(r6, r7, &(0x7f00000009c0)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0xffffffffffffff31}) (async) io_uring_enter(r5, 0x7a98, 0x0, 0x0, 0x0, 0x0) (async, rerun: 64) syz_usb_control_io(r2, 0x0, &(0x7f0000002b00)={0x84, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (rerun: 64) syz_usb_control_io$uac1(r2, 0x0, &(0x7f00000004c0)={0x44, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r8 = syz_genetlink_get_family_id$batadv(&(0x7f0000002a00), r0) sendmsg$BATADV_CMD_GET_ORIGINATORS(r0, &(0x7f0000002ac0)={&(0x7f00000029c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000002a80)={&(0x7f0000002bc0)=ANY=[@ANYBLOB="1c000000b363048cb4379ac0db4aecc6ae3ee63eb34672b773331e1dce7c39bf64b1476d58804a6149695232927f4302a9be2356c7a745f5c063eb2e5c1250ce39a277e7ebddad1c4054f068e79975a1d2cd1c12d9502bb0c5ebecca7507e40ffa82500479231502d5d14e4a1ac28ee3777d8d93a5d3415d2bfb659df32e4993449c7bbc2afd268b8249182357de8fcff6b7bf694aa2f6d6012bb7da22e63b51329656fc4847a4622997f73eb1f27da4bbcd85a36f0353fe40f8c5d39c900e267d0a2e17545edc4bbd601db4f9a1479819cf89699ffbcffb2240a0874e0499c834b7f46b200af4665cc68473fffcd4b158589b0fc9aa00"/256, @ANYRES16=r8, @ANYBLOB="000126bd7000fbdbdf25080000000800390002000000"], 0x1c}, 0x1, 0x0, 0x0, 0x40080}, 0x4040040) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x1, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000000000000000000000000020180c000000008000000000000000000095"], &(0x7f00000003c0)='GPL\x00', 0x4, 0x1009, &(0x7f0000001640)=""/4105, 0x41100, 0x1e}, 0x94) (async) r9 = fanotify_init(0x200, 0x0) fanotify_mark(r9, 0x201, 0x800003f, r9, 0x0) (async) fanotify_mark(r9, 0x80, 0x800, 0xffffffffffffffff, 0x0) syz_usb_control_io(r2, 0x0, &(0x7f0000000700)={0x84, &(0x7f0000000180)=ANY=[@ANYBLOB="201104", @ANYRES16, @ANYRESDEC=r9, @ANYRES8=r9], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async, rerun: 64) write$tun(r0, 0x0, 0x0) (rerun: 64) 4.551700417s ago: executing program 4 (id=989): r0 = syz_open_procfs(0x0, &(0x7f0000000140)='gid_map\x00') prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0) fchdir(r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) syz_open_dev$vcsa(&(0x7f00000000c0), 0xa40d, 0x2a8102) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) openat$sysfs(0xffffffffffffff9c, 0x0, 0x395180, 0x149) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) io_setup(0xf9, &(0x7f0000000040)) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(0xffffffffffffffff, 0xc1205531, 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x40010) ioctl$IOCTL_VMCI_INIT_CONTEXT(0xffffffffffffffff, 0x7a0, 0x0) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x2982, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) ioctl$TIOCSERGETLSR(r3, 0x5459, &(0x7f0000000080)) ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, 0x0) r4 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/igmp6\x00') r5 = socket(0x10, 0x3, 0x0) write(r5, &(0x7f0000000000)="240000001a005f0314f9f407000904000200000001000000000000000800040001000000", 0x24) ioctl$FS_IOC_MEASURE_VERITY(r4, 0xc0046686, &(0x7f0000000000)={0x5, 0x24, "c9a3f567aaea8e774f66aac44deffe62e30ab07a7f495898f7ffdada0102005f00000000"}) preadv(r4, &(0x7f0000001880)=[{&(0x7f0000001a80)=""/102400, 0x19000}], 0x1, 0x40000000, 0x0) mknod(&(0x7f0000000040)='./file0\x00', 0x8001420, 0x4000000) r6 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) ioctl$UI_ABS_SETUP(r6, 0x401c5504, &(0x7f0000000340)={0x400000100002f}) write$uinput_user_dev(r6, &(0x7f0000000800)={'syz1\x00', {0x400, 0xf, 0x2, 0xffff}, 0x2a, [0x5, 0x0, 0x0, 0x40004, 0x1, 0x2, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x4000, 0x24, 0x400, 0x0, 0x5, 0x0, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x296, 0xffffffc5, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x6, 0x1, 0x0, 0x4, 0x93, 0x6], [0x0, 0x2000, 0x8, 0x4, 0x400000, 0x5, 0x0, 0x80, 0x0, 0x2, 0x0, 0x0, 0xfffffffe, 0x0, 0x9, 0x0, 0xfffffffc, 0x0, 0xfffffffc, 0x7, 0xfffffffc, 0x0, 0xfffffffc, 0x7, 0x0, 0xfffffffc, 0x2, 0x2, 0x0, 0x0, 0x2, 0x0, 0xfffffffc, 0x80, 0x0, 0x0, 0xfffffffe, 0x3fc, 0xfffffff7, 0x200, 0x0, 0xfffffff8, 0x0, 0x6afb, 0x5, 0x0, 0x0, 0xfffffffd, 0xbd, 0x0, 0x0, 0x0, 0x80000, 0x0, 0xfffffffd, 0x0, 0x8, 0x0, 0x200, 0x10000007, 0x0, 0x0, 0x0, 0xffff], [0x4, 0xfc, 0x3ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb, 0x1, 0x0, 0x0, 0x0, 0x4, 0x1001, 0x80, 0x0, 0x600, 0x10, 0xffffffff, 0x0, 0xfffffffc, 0x1, 0xfffffffd, 0xffffffff, 0x0, 0x0, 0x9fa, 0x0, 0x0, 0x0, 0xe, 0xfffffffe, 0x0, 0xfffffffe, 0x0, 0x0, 0x40, 0x0, 0x6, 0x0, 0x0, 0xbda6, 0x0, 0x7, 0x0, 0x0, 0xffffffff, 0x7, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0xfff, 0x6, 0x0, 0x0, 0x0, 0x0, 0x8], [0x40000000, 0x0, 0x74e2, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x8c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x1, 0x40, 0x0, 0x0, 0xbd, 0x0, 0x0, 0x0, 0x100000, 0xfffffffe, 0xb9, 0x0, 0x0, 0x6, 0x9, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x101, 0x80000000, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0xcaa, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7]}, 0x45c) ioctl$UI_SET_EVBIT(r6, 0x40045564, 0x3) 4.49272274s ago: executing program 0 (id=990): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000600)={{0x12, 0x1, 0x0, 0x35, 0xff, 0xaa, 0x20, 0xccd, 0x10af, 0x384e, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0x59, 0x2, 0x1, 0x9b, 0x1e, 0x2a, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io$uac1(r1, 0x0, 0x0) syz_usb_control_io$printer(r1, 0x0, 0x0) syz_usb_control_io$printer(r1, 0x0, 0x0) syz_usb_control_io$rtl8150(r1, &(0x7f00000001c0)={0x14, &(0x7f0000000000)={0x0, 0x8, 0x95, {0x95, 0x4, "6414c6cc6e0af76544e35e233f1240d4615706a20ffed863c713da4566d1362f12707e2cccd301a3566f3ef63facf7ace6f7ffcfe10d490120397a960593c2473b6fa5e1c0cda2161512cbd00983483834054d3ef619e4b06ba6b66f91c7eef321076d059962082cb0702aecac9751d537628dc8a30f234a8d7bd0342616128dbe5c915aeb2e568c3c5f752509952ffe8496cc"}}, &(0x7f00000000c0)={0x0, 0x3, 0xfa, @string={0xfa, 0x3, "877f2dea9af03ecfa939a19d7bc4f7e17433197e59d8e673c5fb1b4b934a1b15f68ce071e8e16b90ddb459dd0c712390ecd30cde265a84fef08590504f90131f9d6b7a6c401298ec93a2f39b22be4b98fe9ba49395913e4994c48a8ae84da6ce6f90fab560787dceb787024d4f182449d5fc3e0987a790b70656430f437dac5d9c202ed24114aab33e940bb14f8fb1656e4e6a7e669f543acd5b3744d7567b408b3980f08d580e4378219b976cfb89cb26f0ec39dd5960fae9ee6d52cb287f6a7c6ec97c3c26a805f1405a165d48523430eae225e83a740b1a784d33a164c069c377a1069654e2caeec98e6a237c25432aa3a31e778db07a"}}}, &(0x7f0000000380)={0x2c, &(0x7f0000000240)={0x0, 0xe, 0x34, "618bbec857b34afc144d4703eed7147d73732e5f0eef9ccced11f166fd0d41c2070983af0f9decef59f01eb65bd89d6d71e3ad1a"}, &(0x7f0000000280)={0x0, 0xa, 0x1, 0x3}, &(0x7f00000002c0)={0x0, 0x8, 0x1, 0x4}, &(0x7f0000000300)={0xc0, 0x5, 0x3, "45e9c7"}, &(0x7f0000000340)={0x40, 0x5, 0x6, "a8826fa14f02"}}) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r1, 0x0, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2f, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r2, 0x84, 0x6e, &(0x7f0000000140)=[@in={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x1, 0x0}}], 0x10) r3 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r3, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r2, 0x84, 0x7b, &(0x7f0000000540)={r4, 0x1}, 0x8) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r2, 0x84, 0x7c, &(0x7f0000000080)={r4, 0x9, 0x7fff}, 0x8) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r2, 0x84, 0x7b, &(0x7f0000000180)={r4}, 0x8) syz_usb_control_io$uac1(r1, 0x0, 0x0) syz_usb_connect$printer(0x4, 0xea6b4161c9d034c6, 0x0, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$rtl8150(r1, 0x0, &(0x7f0000000840)={0x2c, &(0x7f0000000740)={0x40, 0x3}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000540)={0x2c, &(0x7f0000000100)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, &(0x7f0000000640)={0x24, &(0x7f00000003c0)={0x40, 0xb, 0x72, {0x72, 0x23, "8230d48af2205066d6dba8f848bb6c2b7737cc4a1727b2489c053293e0df9f4c60486fc2fc55916b6b0b71d6ea9d18cf3febce181a530b8ebd7d6614feb16f7474d964f75cf2429e9bde2ed75b0cc8f9160b20ae51c50fafbadc5dc28ec44eda91098f7cfb095df7e26a1435ac1a480b"}}, &(0x7f0000000440)={0x0, 0x3, 0x7d, @string={0x7d, 0x3, "867c98a41907a30817d9026ee0b28e01c9c2ed986f776d7d457da43aa9b139d4ece939a60695f5cb5f587353e3bafd9abfc31696aa64e0c4b8edb95d69dc6c669436cd1388ffd519c26190e9bad914dd40e53cd841fb13a47e9a878ffeb47ffea209ab4510f5b537667b86427c20aa63dfdcb587f0756cd730019c"}}, &(0x7f0000000580)={0x0, 0x22, 0x1f, {[@global=@item_4={0x3, 0x1, 0xb, "9d543b27"}, @local=@item_4={0x3, 0x2, 0xe, "07ad4299"}, @global=@item_012={0x1, 0x1, 0x2, '['}, @global=@item_4={0x3, 0x1, 0x2, "6fe838bd"}, @global=@item_012={0x0, 0x1, 0x3}, @global=@item_4={0x3, 0x1, 0x1, "51e1c514"}, @local=@item_012={0x2, 0x2, 0x0, "0602"}, @main=@item_4={0x3, 0x0, 0xb, 'Z\n *'}]}}, &(0x7f00000005c0)={0x0, 0x21, 0x9, {0x9, 0x21, 0x200, 0x8, 0x1, {0x22, 0x8f3}}}}, &(0x7f00000008c0)={0x2c, &(0x7f0000000680)={0x40, 0xf, 0x2f, "e4945159f3fb39c1d179ea5e85046a0138a43669dd17031234bdda578c722f146047cd22f08f0a63038b001d2cf4f2"}, &(0x7f00000006c0)={0x0, 0xa, 0x1, 0x9}, &(0x7f0000000700)={0x0, 0x8, 0x1, 0x4}, &(0x7f0000000800)={0x20, 0x1, 0x2e, "c03edd390397800fbbdfcc0a74a6fbbd2157ce223da5078c64f99267507399c53efcdfe955bdf8ddab682c378f00"}, &(0x7f0000000880)={0x20, 0x3, 0x1, 0x8}}) sendmsg$nl_xfrm(r0, &(0x7f0000000980)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000740)=ANY=[@ANYBLOB="ec000008210009042dbd70002ddb25000000000000000000000000000000007f0000010000000000000000000000004e2200004e21000b0a000000296d8dfa00", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="b06b6e00020000009c00110000000000000000000000000000000000e000000200000000000000000000000020010000000000000000000000000002e0000002000000000000000000000000ff020000063500000a00020000000000000000000000000000000000e00000020000"], 0xec}, 0x1, 0x0, 0x0, 0x20008000}, 0x94) 4.327780416s ago: executing program 3 (id=991): sendmsg$netlink(0xffffffffffffffff, &(0x7f0000002ac0)={0x0, 0x0, &(0x7f0000000480)=[{0x0, 0xdd12}], 0x1}, 0x20040051) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) sendmmsg(r0, &(0x7f0000001c00), 0x400000000000159, 0x40840) (fail_nth: 21) 3.934235371s ago: executing program 2 (id=992): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x19, &(0x7f0000000000)=0x84, 0xfde1) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x200cc0c5, &(0x7f0000000080)={0xa, 0x4e21, 0x0, @mcast1}, 0x1c) sendto$inet6(0xffffffffffffffff, &(0x7f0000001cc0)="2501d77b330b7e73d6b1d1b8a473ff7420b4b43ce0861f000000714fa228ee1f5b48", 0xfffffffffffffe57, 0x8000, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000002480)=[{{0x0, 0x0, 0x0}}], 0x1, 0x40002003, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[], 0x3c}, 0x1, 0x0, 0x0, 0x20040001}, 0x20008880) pipe2(0x0, 0xc800) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c00000010001fff0000000001000000000000d7", @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800a000100767863616e0000000400028008000a00", @ANYRES32=r2], 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) r3 = socket(0x10, 0x803, 0x4) sendmsg$IPVS_CMD_SET_INFO(r3, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = fsopen(0x0, 0x1) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) r6 = syz_open_dev$vim2m(&(0x7f0000000000), 0x0, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r6, 0xc0145608, &(0x7f00000000c0)={0x10002, 0x1, 0x1}) r7 = gettid() timer_create(0x4, &(0x7f00000001c0)={0x0, 0x21, 0x0, @tid=r7}, &(0x7f0000bbdffc)=0x0) timer_settime(r8, 0x1, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) ioctl$IOCTL_VMCI_VERSION2(0xffffffffffffffff, 0x7a7, 0x0) r9 = openat$cgroup_type(0xffffffffffffffff, 0x0, 0x2, 0x0) syncfs(r9) ioctl$vim2m_VIDIOC_REQBUFS(r6, 0xc0145608, &(0x7f0000000040)={0x10001, 0x2, 0x4, 0x0, 0x4}) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) 3.631141421s ago: executing program 3 (id=993): bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000380)=ANY=[@ANYRES32, @ANYRES32, @ANYBLOB="1b00"], 0x20) r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r0, 0x11b, 0x2, &(0x7f0000000180)=0x200000, 0x4) getsockopt$XDP_STATISTICS(r0, 0x11b, 0x7, &(0x7f00000000c0), &(0x7f0000000000)=0x18) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={0x0, 0x210000, 0x1000, 0x1, 0x1}, 0x20) 3.41236792s ago: executing program 1 (id=994): accept4(0xffffffffffffffff, 0x0, 0x0, 0x80800) unshare(0x400) r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, 0x0, 0x0) bind$inet(r0, &(0x7f0000000100)={0x2, 0x4e21, @local}, 0x10) socketpair$tipc(0x1e, 0x2, 0x0, 0x0) recvmsg(0xffffffffffffffff, 0x0, 0x60df) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000380)='x', 0x1, 0x480c1, 0x0, 0x0) sendto(r0, &(0x7f0000000240)='1', 0x1, 0x0, 0x0, 0x0) r2 = socket$inet6(0x10, 0x2, 0x4) sendto$inet6(r2, &(0x7f0000000080)="4c00000012001f15b9409b849ac00a00a5784002000000000000030038c88cc055c5ac27a6c5b068d0bf46d323452536005ad94a461cdbfee9bdb942352359a351d1ec0cffc8792cd8000080", 0x4c, 0x810, 0x0, 0x0) (fail_nth: 6) io_uring_register$IORING_REGISTER_FILES(0xffffffffffffffff, 0x23, 0x0, 0x0) 3.154163142s ago: executing program 4 (id=995): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={0x0}, 0x1, 0x0, 0x0, 0x20008805}, 0x2404814d) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) openat$audio(0xffffff9c, 0x0, 0x0, 0x0) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mlock2(&(0x7f0000ff5000/0x9000)=nil, 0x9000, 0x0) syz_open_procfs$pagemap(0xffffffffffffffff, &(0x7f0000000080)) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x92200, 0x0) ioctl$PAGEMAP_SCAN(r4, 0xc0606610, &(0x7f0000000480)={0x60, 0x0, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x7, &(0x7f0000000040)=[{0xb31}], 0x1, 0x1, 0x0, 0x2, 0x0, 0x2}) sendmsg(r3, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, 0x0, 0x0) r5 = openat$6lowpan_enable(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$6lowpan_enable(r5, &(0x7f0000000200)='0', 0x1) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(0xffffffffffffffff, 0xc1105517, 0x0) semget(0x1, 0x4, 0x10) syz_usb_connect(0x5, 0x36, &(0x7f00000000c0)=ANY=[@ANYRESOCT=0x0, @ANYRES32], &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) r6 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read(r6, &(0x7f0000000380)=""/144, 0x90) r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x94, 0x7fff0000}]}) close_range(r7, 0xffffffffffffffff, 0x0) socket$packet(0x11, 0x3, 0x300) ioctl$TCSETS(r0, 0x5402, &(0x7f0000000000)={0x3, 0xffff0000, 0x7, 0x6, 0x19, "78abf91327e6506f572a65160ea9620dd531ef"}) 2.70527576s ago: executing program 1 (id=996): syz_open_dev$vbi(&(0x7f0000000040), 0x0, 0x2) (async) r0 = syz_open_dev$vbi(&(0x7f0000000040), 0x0, 0x2) ioctl$VIDIOC_S_INPUT(r0, 0xc0045627, &(0x7f00000001c0)=0x2) ioctl$VIDIOC_CREATE_BUFS(r0, 0xc100565c, &(0x7f0000000480)={0x1ff, 0x200, 0x2, {0x6, @raw_data="8f196dfc4590ad62bab14f9e87492237b4df86588d7ee0a4b840e1d8fe940324f2ad165745d4199867c84481b4d788e49807bdc7146c7bc0661da2422a62f3d4b5513d67e485098436df0ddd640570f4fba918810e82a5e152b5b2f7f6b9a72910643234e9f79e045815c52a33f6ac46b9f64e1f226886e59049b2f76a1c39f56fc2a2317f14ff5bcef6bb31c9b0ff7cfbaf913ee59686fd673e6c4d5aef0d9df50271ff8afde2d186079c3994f5fe43a8e21473a95395df3dc1b56d1d0fb41800"}, 0x9}) syz_usb_connect(0x5, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0xb4, 0x6a, 0x2c, 0x10, 0x7b4, 0x10a, 0x102, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0xd6, 0x2, 0x2, 0x2b, 0x57, 0x33, 0x0, [], [{{0x9, 0x5, 0x4, 0x2, 0x10, 0x0, 0xfa}}, {{0x9, 0x5, 0x81, 0x2, 0x40, 0x0, 0x3d, 0x1}}]}}]}}]}}, 0x0) 2.683339836s ago: executing program 3 (id=997): openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1002, 0x0) (async) r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmmsg$inet6(r0, &(0x7f0000006b80), 0x0, 0x0) (async) r1 = socket$kcm(0x10, 0x2, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r1, 0x8982, &(0x7f0000000400)={0x0, 'batadv0\x00', {0x5}}) socket$inet6_sctp(0xa, 0x5, 0x84) (async) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_NODELAY(r2, 0x84, 0x3, &(0x7f0000000100), &(0x7f0000000140)=0x4) (async) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IP_VS_SO_SET_DELDEST(r3, 0x6, 0x9, &(0x7f0000000080)={{0x101, @multicast2, 0x0, 0x2, 'wlc\x00', 0x6, 0x1, 0x3}, {@empty, 0x2, 0x2, 0x7, 0x0, 0x3}}, 0x44) (async) getsockopt$inet_tcp_int(r3, 0x6, 0x9, 0x0, &(0x7f0000000040)) getsockopt$bt_hci(0xffffffffffffffff, 0x84, 0x0, 0x0, &(0x7f0000000000)) (async) r4 = socket$nl_route(0x10, 0x3, 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0xffffffffffff401f) (async) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r5, 0x8933, &(0x7f0000000040)={'batadv0\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000080)=ANY=[@ANYBLOB="3c000000130001000400"/20, @ANYRES32=0x0, @ANYBLOB='\t\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r6, @ANYBLOB="1400350064756d6d7930"], 0x3c}, 0x1, 0x0, 0x0, 0x8004010}, 0x0) (async) r7 = socket$pppl2tp(0x18, 0x1, 0x1) ioctl$SIOCSIFMTU(r7, 0x8922, &(0x7f0000000080)={'dummy0\x00'}) 2.073027089s ago: executing program 3 (id=998): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, 0x0, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001ac0)=ANY=[@ANYBLOB="3c0000001000030400000000fcdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="04000000008000001400128009000100766574680000000004000280080004"], 0x3c}, 0x1, 0x0, 0x0, 0x2004c808}, 0x0) bind$alg(r2, &(0x7f00000007c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(sm4)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000001280)="b7f2288a911993f08d3aaea2bc0000de", 0x10) r4 = accept4(r2, 0x0, 0x0, 0x800) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) cachestat(0xffffffffffffffff, &(0x7f00000002c0)={0x9, 0x5}, &(0x7f0000000300), 0x0) sendmmsg$alg(r4, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) 1.07287312s ago: executing program 1 (id=999): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000000c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_io_uring_setup(0x49a, &(0x7f00000000c0)={0x0, 0x79af, 0x3180, 0x8000, 0x40024e}, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, 0x0, 0x0, 0x4) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f00000004c0)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_ctr_aes256\x00'}, 0x58) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) r6 = accept4(r5, 0x0, 0x0, 0x800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x40, 0x6000, @fd=r6, 0xffffffffffffffff, &(0x7f00000006c0)=""/210, 0xd2, 0x2, 0x1}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r7 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r7, &(0x7f0000000180)=@nameseq={0x1e, 0x1, 0x0, {0x2, 0x2}}, 0x10) io_uring_enter(r2, 0x627, 0x4c1, 0x43, 0x0, 0x30) syz_usb_connect(0x0, 0x1a7, &(0x7f0000000100)={{0x12, 0x1, 0x110, 0xce, 0x80, 0xc, 0x20, 0xb95, 0x2790, 0x1b55, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x195, 0x1, 0x1, 0x40, 0x0, 0x14, [{{0x9, 0x4, 0xfb, 0xfa, 0x2, 0xff, 0x19, 0x87, 0x5, [@generic={0xae, 0x23, "2e7d09f818676ae94e88d6b51942106129378eb743e69830a7617b754fa965f38ee19e21d972f89546849feb3dad9609577bd12358aefb109aab414cf7cdd5ba40633fbbb2aae8fb5ca1f32f194856868afaa3c8462ad9a2e7eae45871a3f117f2d08c9dd5a0fdd5612ee5d19329530d2f3fe5898c21b3a9288cada43a5849f60ca8f7f5083d7674a49f667b3d9a6b973170f6047e2d45b617878604b948f5dd365ec62fc7db7028dbe62271"}, @hid_hid={0x9, 0x21, 0x786, 0x5, 0x1, {0x22, 0xe8e}}], [{{0x9, 0x5, 0x10f8371a2b8f700d, 0x0, 0x40, 0xf, 0x4, 0x19, [@generic={0xb3, 0x34, "0c5f63ef8a23a4b30b744a9434231ddad351aee46acd7d0cb37a8b4643f689637d9bac3153b76ba088a9f5aa3bc33df98b688de4278a43f8871f52b7be6ecb5eab7569a5ed5105959a0fd435854a6318af8d05dda347b51bf5a074a9edf1c38cd14c86f3de9ae70f4cabce5701f8a85005fa8e58a9045f9f4b893b7dbaccd4fc4be9a43377d28c1f9fc51f35c49adc831fc85c0eadd6653447153cd93f6e61e221da7403e4950a52a62dabf4c0d3b5ac8f"}, @uac_iso={0x7, 0x25, 0x1, 0x40, 0x60, 0x3}]}}, {{0x9, 0x5, 0x1, 0x0, 0x3ff, 0x13, 0x9, 0x2}}]}}]}}]}}, 0x0) 260.231734ms ago: executing program 3 (id=1000): r0 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MFC(r0, 0x29, 0xcc, &(0x7f0000000000)={{0xa, 0x0, 0x0, @private2, 0x809}, {0xa, 0x8, 0x0, @empty}, 0x2, {[0x0, 0x1, 0xfffffffe, 0x0, 0xffffffff, 0x8]}}, 0x5c) socket$nl_route(0x10, 0x3, 0x0) openat$kvm(0xffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setattr(0x0, 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140), 0x8417f, 0x0) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) setsockopt$inet_tcp_TCP_CONGESTION(r3, 0x6, 0xd, 0x0, 0x0) sendmmsg$inet(r3, 0x0, 0x0, 0x2090) r4 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$inet6_IPV6_RTHDRDSTOPTS(r4, 0x29, 0x37, 0x0, 0x0) sendto$inet(r3, 0x0, 0x0, 0x10008095, 0x0, 0x0) r5 = gettid() timer_create(0x0, 0x0, 0x0) syz_open_procfs$userns(r5, &(0x7f0000000580)) openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) mknod$loop(&(0x7f0000000140)='./file0\x00', 0x8fff, 0x0) execve(&(0x7f0000000040)='./file0\x00', &(0x7f00000005c0)={[&(0x7f0000000ec0)='\x7f\xb7\xc3\x7f\xa5a\xd6A*c\x9b\xd8R\xf02b\xefA|uiWb\x8f\xee\x1c\xc5\xdb^\x11\x16h\x83\x94y\x89\xf1Y{\x87\xd5\xf3\xccMr\xc5\xbdT\x9e\xc4\x84\x06\xcd\x8b\xcd\t\x01', &(0x7f0000000180)='\x7f\xbf\xc3\x7f\xa5a\xd6A*c\x9b\xd8R\xf02b\xefA|uiWb\x8f\xee\x1c\xc5\xdb^\x11\x16h\x83\x94y\x89\xf1Y{\x87\xd5\xf3\xccMr\xc5\xbdT\x9e\xc4\x84\x06\xcd\x8b\xcd\t\x01', 0x0, 0x0, 0x0, &(0x7f0000000000)='\xc1r\x9dnyb`\x00\xa2\xabCg\x13\b\x8f*\xdaA\x822\xf7\xaf\xf6U\xad\xb0\xb2\f\x88s\x19\xa3D\xa9\x82\x8a\xa3\x94\xab\"|\xcf\x1f\x12\x8d\xe1\xe5\xc3\x01\x03\x003\xa9p^\x01^\x16>tnF', 0x0, 0x0, &(0x7f0000000980)='\x7f\xb7\xc3\x7f\xa5a\xd6A*c\x9b\xd8R\xf02b\xefA|uiWb\x8f\xee\x1c\xc5\xdb^\x11\x16h\x83\x94y\x89\xf1Y{\x87\xd5\xf3\xccMr\xc5\xbdT\x9e\xc4\x84\x06\xcd\x8b\xcd\t\x01', &(0x7f0000000a80)='::-$[]#:{\x00']}, &(0x7f0000000b80)={[&(0x7f0000000800)='.-\\:!\x00\x00\x00\x00\x00y\xa5\x91\x9d:)\x0f\x9d/\xf8\f\xad\xdb|\xcf\x1cHB\xc8\xa3Qo{\xc5|\xa5z\x0e\x0f\xdee\xc2>\xb6\xfe\xeaZ~\xa3\x15\x16l\x00\x00\x00\x00\x00', &(0x7f00000000c0)='-\xf3\x00']}) setsockopt$MRT6_ADD_MFC(r0, 0x29, 0xcc, &(0x7f0000000280)={{0xa, 0x0, 0x0, @loopback}, {0xa, 0x0, 0x0, @mcast2}, 0x0, {[0x1, 0x0, 0x0, 0x0, 0x9]}}, 0x5c) setsockopt$MRT6_ADD_MFC(r0, 0x29, 0xcc, &(0x7f0000000380)={{0xa, 0x0, 0x0, @local}, {0xa, 0x4e22, 0x800, @empty}, 0x0, {[0x0, 0x8000, 0x0, 0xfffffffc, 0x0, 0x8]}}, 0x5c) unshare(0x22020600) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000040)=0x8) r7 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r7, 0x107, 0x12, &(0x7f0000000000)={0x0, 0x1}, 0x4) 0s ago: executing program 0 (id=1001): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000280)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f00006d3000/0x4000)=nil, 0x4000, 0x66) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x8041, 0x0) write$dsp(r2, &(0x7f00000001c0)="5cba91a4", 0xffffffd9) ioctl$SNDCTL_DSP_SYNC(r2, 0x5001, 0x0) gettid() r3 = syz_open_dev$sndpcmc(&(0x7f0000000480), 0x1, 0x0) ioctl$SNDRV_PCM_IOCTL_HW_REFINE_OLD(r3, 0xc1004110, &(0x7f0000000000)={0x3, [0x6, 0xffff1337, 0x3], [{0x0, 0xa, 0x0, 0x1}, {0x35, 0x35}, {0x9, 0x131}, {0x2, 0x3}, {0x0, 0xa5}, {}, {0x80000000, 0xfffffffd}, {0x0, 0x7fff}, {0xf}, {0xfffffffd}, {0x0, 0x2}, {0x0, 0xfffffffd}], 0xc}) syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) timer_settime(0x0, 0x0, 0x0, 0x0) ioctl$SNDCTL_DSP_SUBDIVIDE(r2, 0xc0045009, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x800c000}, 0x0) syz_usb_connect(0x2, 0x0, 0x0, 0x0) r5 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000240), 0x6000, 0x0) ioctl$IOMMU_OPTION$IOMMU_OPTION_RLIMIT_MODE(r5, 0x3b87, &(0x7f0000000400)={0x18, 0x0, 0x1, 0x0, 0x0, 0x9}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = syz_open_procfs(0x0, 0x0) preadv(r7, &(0x7f00000001c0)=[{&(0x7f0000000300)=""/230, 0xe6}], 0x1, 0x185, 0x0) timerfd_gettime(r7, &(0x7f0000000100)) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r6, 0x8933, &(0x7f0000000000)={'batadv0\x00', 0x0}) sendmsg$nl_route(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="200000001100010027", @ANYRES32=r8, @ANYBLOB="1e5600000000000044459d51404c7a26e265c64cdb3b7f5e301fe7a0b50a30f1f5"], 0x20}, 0x1, 0x0, 0x0, 0x50}, 0x80) kernel console output (not intermixed with test programs): ded on system resumption [ 484.594756][ T5935] usb 1-1: new full-speed USB device number 30 using dummy_hcd [ 484.793474][ T5935] usb 1-1: not running at top speed; connect to a high speed hub [ 484.826157][ T5935] usb 1-1: config 7 has an invalid interface number: 224 but max is 2 [ 484.936844][ T5935] usb 1-1: config 7 has an invalid interface number: 91 but max is 2 [ 484.966099][ T5935] usb 1-1: config 7 contains an unexpected descriptor of type 0x2, skipping [ 485.004013][ T5935] usb 1-1: config 7 contains an unexpected descriptor of type 0x2, skipping [ 485.048607][ T5935] usb 1-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config [ 485.080631][ T5935] usb 1-1: config 7 has 2 interfaces, different from the descriptor's value: 3 [ 485.116944][ T5935] usb 1-1: config 7 has no interface number 0 [ 485.155937][ T5935] usb 1-1: config 7 has no interface number 1 [ 485.187159][ T5935] usb 1-1: config 7 interface 224 altsetting 117 has an invalid descriptor for endpoint zero, skipping [ 485.262717][ T5935] usb 1-1: config 7 interface 224 altsetting 117 endpoint 0x6 has invalid maxpacket 512, setting to 64 [ 485.362127][ T5935] usb 1-1: config 7 interface 224 altsetting 117 has an invalid descriptor for endpoint zero, skipping [ 485.376643][ T5935] usb 1-1: config 7 interface 224 altsetting 117 has an invalid descriptor for endpoint zero, skipping [ 485.433115][ T5935] usb 1-1: config 7 interface 224 altsetting 117 has an endpoint descriptor with address 0xCA, changing to 0x8A [ 485.445375][ T5935] usb 1-1: config 7 interface 224 altsetting 117 endpoint 0x8A has invalid maxpacket 13062, setting to 64 [ 485.462518][ T5935] usb 1-1: config 7 interface 224 altsetting 117 endpoint 0x9 has invalid maxpacket 1112, setting to 64 [ 485.474396][ T5935] usb 1-1: config 7 interface 224 altsetting 117 has a duplicate endpoint with address 0x4, skipping [ 485.518459][ T5935] usb 1-1: config 7 interface 224 altsetting 117 endpoint 0xD has invalid wMaxPacketSize 0 [ 485.669644][ T5935] usb 1-1: config 7 interface 224 altsetting 117 has a duplicate endpoint with address 0x4, skipping [ 485.690108][ T5935] usb 1-1: config 7 interface 224 altsetting 117 has a duplicate endpoint with address 0x9, skipping [ 485.800057][ T5935] usb 1-1: config 7 interface 224 altsetting 117 endpoint 0xE has invalid maxpacket 1024, setting to 64 [ 485.847094][ T5935] usb 1-1: config 7 interface 224 altsetting 117 has 16 endpoint descriptors, different from the interface descriptor's value: 15 [ 485.861899][ T5935] usb 1-1: config 7 interface 91 altsetting 6 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 485.892239][ T5935] usb 1-1: config 7 interface 224 has no altsetting 0 [ 485.911809][ T5935] usb 1-1: config 7 interface 91 has no altsetting 0 [ 486.014088][ T5935] usb 1-1: Dual-Role OTG device on HNP port [ 486.021089][ T5935] usb 1-1: New USB device found, idVendor=0af0, idProduct=7311, bcdDevice=c7.e9 [ 486.031924][ T5935] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 486.174378][ T5935] usb 1-1: Product: 成菑៨豢䌳锋컙⮒딀둚⹀頉︻渂漀囎衖砺뱙谌㑳⽣禟핚턂ઊ猅琊㳏㆜䂫ꪫ睿㈢ࢨ颐ɕ皸㲗㼝煄㓘矆薡Ϸ쨨쭀㜹䷼忴玕⫡ር統絼烆୞顒㭅ᾯ쭥ᯱ髒΃ﵨ⾑즧샩⍄럣簠牓蠗稏₦㍳ㄢ撒햰寚ኳኄ須쇤NJ삲쾚锚䷡꥟棇䛤꒏븑᥺碑䔺 [ 486.226080][ T5935] usb 1-1: Manufacturer: ᯵탦ⲝ피嶨綁䋾ㅭ䁯鷇쐀㝋偖 [ 486.300241][ T5935] usb 1-1: SerialNumber: 驭浅⑻ﯦ暣엞ﺨ㡃၆ᩍ逵皓釅制쳃㋹灴๕뽨ో찒趾塏⍻搈뀻ﮡ䭩빲㢗嘑Ƙ訲ꏻ쾚᚟맲皅滧ࣶ䣍抴拄硑煨⋫䍗Ĕ泠哧㮳翾몟㬂脠煱﫽@晴뿉牣䖄吻й▪榻 [ 486.369410][ T8008] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 486.379293][ T8008] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 486.387253][ T8008] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 486.595295][ T8024] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1420284373 (1420284373 ns) > initial count (164304968 ns). Using initial count to start timer. [ 486.824910][ T5935] hso 1-1:7.224: Not our interface [ 486.882009][ T5935] hso 1-1:7.91: Not our interface [ 486.885408][ T8027] dlm: no locking on control device [ 486.916726][ T5935] usb 1-1: USB disconnect, device number 30 [ 487.332494][ T5950] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 487.390559][ T8035] vlan2: entered allmulticast mode [ 487.452500][ T8035] veth0_to_bond: entered allmulticast mode [ 487.535809][ T5950] usb 3-1: Using ep0 maxpacket: 32 [ 487.675407][ T5950] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 487.702522][ T5950] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 487.750271][ T5950] usb 3-1: New USB device found, idVendor=0e41, idProduct=534d, bcdDevice=58.d6 [ 487.786809][ T5950] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 487.800596][ T5950] usb 3-1: Product: syz [ 487.806707][ T5950] usb 3-1: Manufacturer: syz [ 487.811571][ T5950] usb 3-1: SerialNumber: syz [ 487.825636][ T5950] usb 3-1: config 0 descriptor?? [ 487.902948][ T894] usb 5-1: new high-speed USB device number 36 using dummy_hcd [ 487.930065][ T5982] usb 2-1: new high-speed USB device number 30 using dummy_hcd [ 488.002507][ T5950] usb 1-1: new high-speed USB device number 31 using dummy_hcd [ 488.051114][ T8032] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 488.072874][ T894] usb 5-1: Using ep0 maxpacket: 8 [ 488.084115][ T894] usb 5-1: config 0 has an invalid interface number: 55 but max is 0 [ 488.094298][ T5982] usb 2-1: Using ep0 maxpacket: 32 [ 488.099569][ T8032] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 488.114356][ T894] usb 5-1: config 0 has no interface number 0 [ 488.120500][ T894] usb 5-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 488.132869][ T5873] usb 4-1: new high-speed USB device number 26 using dummy_hcd [ 488.140593][ T5982] usb 2-1: config 4 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 488.151992][ T5982] usb 2-1: config 4 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 488.162182][ T894] usb 5-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 488.173999][ T5950] usb 1-1: Using ep0 maxpacket: 8 [ 488.181575][ T5982] usb 2-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 488.191902][ T5950] usb 1-1: config 0 has an invalid interface number: 55 but max is 0 [ 488.200199][ T894] usb 5-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 488.212527][ T5950] usb 1-1: config 0 has no interface number 0 [ 488.218649][ T5982] usb 2-1: New USB device strings: Mfr=255, Product=255, SerialNumber=0 [ 488.229891][ T5950] usb 1-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 488.241310][ T894] usb 5-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 488.254592][ T5982] usb 2-1: Product: syz [ 488.259237][ T5982] usb 2-1: Manufacturer: syz [ 488.264266][ T5950] usb 1-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 488.277425][ T894] usb 5-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 488.290861][ T5950] usb 1-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 488.303926][ T5982] hub 2-1:4.0: USB hub found [ 488.308570][ T894] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 488.319148][ T5950] usb 1-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 488.333356][ T894] usb 5-1: config 0 descriptor?? [ 488.338846][ T5873] usb 4-1: Using ep0 maxpacket: 32 [ 488.348359][ T894] ldusb 5-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 488.357701][ T5950] usb 1-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 488.369747][ T5873] usb 4-1: config 1 has an invalid interface number: 251 but max is 0 [ 488.379389][ T5950] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 488.387501][ T5873] usb 4-1: config 1 has no interface number 0 [ 488.393636][ T5873] usb 4-1: config 1 interface 251 altsetting 250 endpoint 0x1 has invalid maxpacket 1023, setting to 64 [ 488.472831][ T5950] usb 1-1: config 0 descriptor?? [ 488.482862][ T5873] usb 4-1: config 1 interface 251 has no altsetting 0 [ 488.523875][ T5982] hub 2-1:4.0: config failed, hub has too many ports! (err -19) [ 488.534809][ T5873] usb 4-1: New USB device found, idVendor=0b95, idProduct=2790, bcdDevice=1b.55 [ 488.553968][ T5873] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 488.566967][ T5950] ldusb 1-1:0.55: LD USB Device #1 now attached to major 180 minor 1 [ 488.607334][ T5873] usb 4-1: Product: syz [ 488.616219][ T5873] usb 4-1: Manufacturer: syz [ 488.625008][ T5873] usb 4-1: SerialNumber: syz [ 488.631394][ T8046] ldusb 5-1:0.55: Write buffer overflow, 3776 bytes dropped [ 488.631815][ T5935] usb 5-1: USB disconnect, device number 36 [ 488.638868][ C1] ldusb 5-1:0.55: usb_submit_urb failed (-19) [ 488.708263][ T8046] ldusb 5-1:0.55: Couldn't submit interrupt_out_urb -19 [ 488.723508][ T5935] ldusb 5-1:0.55: LD USB Device #0 now disconnected [ 488.761225][ T5950] usb 1-1: USB disconnect, device number 31 [ 488.771433][ T5950] ldusb 1-1:0.55: LD USB Device #1 now disconnected [ 489.997415][ T5950] usb 3-1: USB disconnect, device number 30 [ 490.136855][ T8064] warning: `syz.1.555' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 490.420420][ T5873] aqc111 4-1:1.251: probe with driver aqc111 failed with error -22 [ 490.483397][ T5873] usb 4-1: USB disconnect, device number 26 [ 490.712655][ T8072] openvswitch: netlink: VXLAN extension message has 1 unknown bytes. [ 490.887262][ T8071] netdevsim netdevsim1: Direct firmware load for / [ 490.887262][ T8071] failed with error -2 [ 491.121117][ T8071] netdevsim netdevsim1: Falling back to sysfs fallback for: / [ 491.121117][ T8071] [ 492.563557][ T5873] usb 3-1: new high-speed USB device number 31 using dummy_hcd [ 492.742499][ T5873] usb 3-1: Using ep0 maxpacket: 16 [ 492.757226][ T5873] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 492.812664][ T5873] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 492.900094][ T5873] usb 3-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 492.936910][ T5873] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 492.950721][ T5873] usb 3-1: Product: syz [ 492.955194][ T5873] usb 3-1: Manufacturer: syz [ 492.960055][ T5873] usb 3-1: SerialNumber: syz [ 492.969125][ T5873] usb 3-1: config 0 descriptor?? [ 492.976715][ T5873] em28xx 3-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 493.040663][ T5873] em28xx 3-1:0.0: Audio interface 0 found (Vendor Class) [ 493.525748][ T8119] netlink: 16 bytes leftover after parsing attributes in process `syz.0.571'. [ 493.912559][ T5873] em28xx 3-1:0.0: chip ID is em2800 [ 494.102806][ T5982] usb 2-1: USB disconnect, device number 30 [ 494.138575][ T5873] em28xx 3-1:0.0: Config register raw data: 0xfffffffb [ 494.208862][ T5873] em28xx 3-1:0.0: AC97 chip type couldn't be determined [ 494.222584][ T8122] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 494.345692][ T5873] em28xx 3-1:0.0: No AC97 audio processor [ 494.392558][ T5873] usb 3-1: USB disconnect, device number 31 [ 494.439768][ T5873] em28xx 3-1:0.0: Disconnecting em28xx [ 494.587208][ T5873] em28xx 3-1:0.0: Freeing device [ 494.831898][ T6898] usb 5-1: new high-speed USB device number 37 using dummy_hcd [ 495.007443][ T6898] usb 5-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 495.026489][ T6898] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 495.065204][ T6898] usb 5-1: Product: syz [ 495.084689][ T6898] usb 5-1: Manufacturer: syz [ 495.112178][ T6898] usb 5-1: SerialNumber: syz [ 495.147795][ T6898] usb 5-1: config 0 descriptor?? [ 495.487984][ T8140] netlink: 8 bytes leftover after parsing attributes in process `syz.2.579'. [ 495.497675][ T8140] netlink: 34 bytes leftover after parsing attributes in process `syz.2.579'. [ 495.586950][ T6898] usb 5-1: USB disconnect, device number 37 [ 496.692918][ T8161] xt_recent: Unsupported userspace flags (000000b1) [ 496.824205][ T8167] netlink: 8 bytes leftover after parsing attributes in process `syz.3.586'. [ 497.254270][ T8185] netdevsim netdevsim0: Direct firmware load for / [ 497.254270][ T8185] failed with error -2 [ 497.383778][ T8185] netdevsim netdevsim0: Falling back to sysfs fallback for: / [ 497.383778][ T8185] [ 497.914915][ T5935] usb 2-1: new high-speed USB device number 31 using dummy_hcd [ 498.112582][ T5935] usb 2-1: Using ep0 maxpacket: 16 [ 498.121037][ T5935] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 498.149536][ T5935] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 498.172449][ T5935] usb 2-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 498.212815][ T5935] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 498.230751][ T5935] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 498.335204][ T5935] usb 2-1: Product: syz [ 498.339396][ T5935] usb 2-1: Manufacturer: syz [ 498.392570][ T5935] usb 2-1: SerialNumber: syz [ 498.721174][ T5935] usb 2-1: 2:1 : format type 0 is detected, processed as PCM [ 498.752597][ T5935] usb 2-1: 2:1: cannot set freq 9338507 to ep 0x82 [ 498.800896][ T5935] usb 2-1: USB disconnect, device number 31 [ 498.841119][ T6028] udevd[6028]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 499.421627][ T8207] netlink: 72 bytes leftover after parsing attributes in process `syz.3.594'. [ 499.698724][ T8211] netlink: 'syz.1.596': attribute type 298 has an invalid length. [ 499.954589][ T5950] usb 2-1: new high-speed USB device number 32 using dummy_hcd [ 500.152659][ T5950] usb 2-1: Using ep0 maxpacket: 16 [ 500.167483][ T5950] usb 2-1: config 1 has an invalid descriptor of length 64, skipping remainder of the config [ 500.214219][ T5950] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 500.268205][ T5950] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 500.277594][ T5950] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 500.286011][ T5950] usb 2-1: Product: syz [ 500.291378][ T5950] usb 2-1: Manufacturer: syz [ 500.296469][ T5950] usb 2-1: SerialNumber: syz [ 501.575053][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.581666][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.732531][ T5935] usb 5-1: new high-speed USB device number 38 using dummy_hcd [ 501.867268][ T5950] usb 2-1: 0:2 : does not exist [ 501.916541][ T5935] usb 5-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 501.942321][ T5935] usb 5-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 501.974134][ T5950] usb 2-1: USB disconnect, device number 32 [ 501.975579][ T5935] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 502.010758][ T5935] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 502.043992][ T5935] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 502.132080][ T5935] usb 5-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 502.144109][ T5890] udevd[5890]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 502.231477][ T5935] usb 5-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 502.263583][ T5935] usb 5-1: Product: syz [ 502.267781][ T5935] usb 5-1: Manufacturer: syz [ 502.285561][ T5935] cdc_wdm 5-1:1.0: skipping garbage [ 502.302484][ T5935] cdc_wdm 5-1:1.0: skipping garbage [ 502.325139][ T5935] cdc_wdm 5-1:1.0: cdc-wdm0: USB WDM device [ 502.337432][ T5935] cdc_wdm 5-1:1.0: Unknown control protocol [ 502.508445][ C0] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 502.515255][ C0] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 502.521522][ C0] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 502.528103][ C0] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 502.534878][ C0] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 502.541644][ C0] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 502.548183][ C0] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 502.554957][ C0] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 502.561240][ C0] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 502.567821][ C0] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 502.574116][ C0] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 502.580706][ C0] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 502.587107][ C0] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 502.593703][ C0] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 502.599994][ C0] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 502.606601][ C0] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 502.612916][ C0] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 502.619763][ C0] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 502.626178][ C0] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 502.632881][ C0] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 502.639630][ T5935] usb 5-1: USB disconnect, device number 38 [ 502.645686][ C0] cdc_wdm 5-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 502.684530][ T5950] usb 2-1: new high-speed USB device number 33 using dummy_hcd [ 502.792833][ T5873] usb 1-1: new high-speed USB device number 32 using dummy_hcd [ 502.862909][ T5950] usb 2-1: Using ep0 maxpacket: 16 [ 502.869625][ T5950] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 502.880818][ T5950] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 502.890680][ T5950] usb 2-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 502.924617][ T5950] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 503.077486][ T5873] usb 1-1: Using ep0 maxpacket: 32 [ 503.094937][ T5873] usb 1-1: New USB device found, idVendor=0ac8, idProduct=0321, bcdDevice=6f.be [ 503.106996][ T5873] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 503.117099][ T5950] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 503.130742][ T5873] usb 1-1: config 0 descriptor?? [ 503.140378][ T5950] usb 2-1: Product: syz [ 503.151881][ T5873] gspca_main: vc032x-2.14.0 probing 0ac8:0321 [ 503.158530][ T5950] usb 2-1: Manufacturer: syz [ 503.163734][ T5950] usb 2-1: SerialNumber: syz [ 503.400685][ T5950] usb 2-1: 2:1 : format type 0 is detected, processed as PCM [ 503.426957][ T5950] usb 2-1: 2:1: cannot set freq 9338507 to ep 0x82 [ 503.628439][ T5950] usb 2-1: USB disconnect, device number 33 [ 503.923764][ T6898] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 503.991895][ T8243] netlink: 20 bytes leftover after parsing attributes in process `syz.0.607'. [ 504.042607][ T5935] usb 5-1: new high-speed USB device number 39 using dummy_hcd [ 504.082480][ T6898] usb 4-1: Using ep0 maxpacket: 8 [ 504.099838][ T6898] usb 4-1: config 1 interface 0 altsetting 138 bulk endpoint 0x1 has invalid maxpacket 32 [ 504.116528][ T6898] usb 4-1: config 1 interface 0 altsetting 138 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 504.147885][ T6898] usb 4-1: config 1 interface 0 has no altsetting 0 [ 504.159480][ T6898] usb 4-1: language id specifier not provided by device, defaulting to English [ 504.176569][ T6898] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 504.185985][ T6898] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 504.194458][ T6898] usb 4-1: Product: ь [ 504.199302][ T6898] usb 4-1: Manufacturer: ῎씬쉯Ūꆂ⫘ꖯꍦ秎奦꤆攣〧ꅏ赧姽汬죮䇐ꉶ삤붮眻⚄ [ 504.210803][ T6898] usb 4-1: SerialNumber: syz [ 504.215930][ T5935] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 504.231078][ T8262] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 504.263566][ T5935] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 8 [ 504.310273][ T5935] usb 5-1: New USB device found, idVendor=0499, idProduct=103e, bcdDevice=4e.18 [ 504.319810][ T5935] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 504.331595][ T5935] usb 5-1: Product: syz [ 504.343268][ T5935] usb 5-1: Manufacturer: syz [ 504.347938][ T5935] usb 5-1: SerialNumber: syz [ 504.370252][ T5935] usb 5-1: config 0 descriptor?? [ 504.630042][ T5935] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 504.777733][ T6898] usb 4-1: USB disconnect, device number 27 [ 504.900650][ T5935] usb 5-1: USB disconnect, device number 39 [ 504.963987][ T5881] udevd[5881]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 505.198451][ T5873] gspca_vc032x: reg_r err -71 [ 505.203463][ T5873] gspca_vc032x: I2c Bus Busy Wait 00 [ 505.208790][ T5873] gspca_vc032x: I2c Bus Busy Wait 00 [ 505.225907][ T5873] gspca_vc032x: I2c Bus Busy Wait 00 [ 505.231236][ T5873] gspca_vc032x: I2c Bus Busy Wait 00 [ 505.257048][ T5873] gspca_vc032x: I2c Bus Busy Wait 00 [ 505.272711][ T5873] gspca_vc032x: I2c Bus Busy Wait 00 [ 505.285044][ T5873] gspca_vc032x: I2c Bus Busy Wait 00 [ 505.305012][ T5873] gspca_vc032x: I2c Bus Busy Wait 00 [ 505.310353][ T5873] gspca_vc032x: I2c Bus Busy Wait 00 [ 505.334396][ T5873] gspca_vc032x: I2c Bus Busy Wait 00 [ 505.349990][ T5873] gspca_vc032x: I2c Bus Busy Wait 00 [ 505.355505][ T5873] gspca_vc032x: I2c Bus Busy Wait 00 [ 505.385981][ T5873] gspca_vc032x: I2c Bus Busy Wait 00 [ 505.562642][ T5873] gspca_vc032x: I2c Bus Busy Wait 00 [ 505.577950][ T5873] gspca_vc032x: I2c Bus Busy Wait 00 [ 505.592723][ T5873] gspca_vc032x: I2c Bus Busy Wait 00 [ 505.598164][ T5873] gspca_vc032x: I2c Bus Busy Wait 00 [ 505.604759][ T5873] gspca_vc032x: I2c Bus Busy Wait 00 [ 505.610192][ T5873] gspca_vc032x: Unknown sensor... [ 505.615438][ T5873] vc032x 1-1:0.0: probe with driver vc032x failed with error -22 [ 505.625607][ T5873] usb 1-1: USB disconnect, device number 32 [ 505.987763][ T8293] binder: 8292:8293 ioctl 4018620d 0 returned -22 [ 506.038737][ T8298] fuse: Bad value for 'fd' [ 506.618737][ T8311] netlink: 8 bytes leftover after parsing attributes in process `syz.4.628'. [ 506.628116][ T8311] openvswitch: netlink: Missing key (keys=40, expected=80) [ 506.702661][ T5873] usb 1-1: new high-speed USB device number 33 using dummy_hcd [ 506.910330][ T5873] usb 1-1: Using ep0 maxpacket: 16 [ 506.926976][ T5873] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 506.938198][ T5873] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 507.039247][ T5873] usb 1-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 507.083519][ T5873] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 507.093249][ T5873] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 507.104112][ T5873] usb 1-1: Product: syz [ 507.110567][ T5873] usb 1-1: Manufacturer: syz [ 507.129276][ T5873] usb 1-1: SerialNumber: syz [ 507.894003][ T5873] usb 1-1: 2:1 : format type 0 is detected, processed as PCM [ 507.912522][ T5873] usb 1-1: 2:1: cannot set freq 9338507 to ep 0x82 [ 508.002732][ T5873] usb 1-1: USB disconnect, device number 33 [ 508.119734][ T5887] udevd[5887]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 508.521768][ T8331] bond0: option min_links: invalid value (18446744073624092677) [ 508.593217][ T8331] bond0: option min_links: allowed values 0 - 2147483647 [ 509.050694][ T5942] usb 4-1: new full-speed USB device number 28 using dummy_hcd [ 509.245839][ T5942] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 509.293618][ T5942] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 509.418954][ T5942] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x82 has invalid maxpacket 512, setting to 64 [ 509.545512][ T5942] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid maxpacket 512, setting to 64 [ 509.602462][ T5942] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 509.624146][ T5942] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 509.661660][ T5942] usb 4-1: Product: syz [ 509.668655][ T8368] netlink: 96 bytes leftover after parsing attributes in process `syz.4.644'. [ 509.688327][ T5942] usb 4-1: Manufacturer: syz [ 509.697778][ T5942] usb 4-1: SerialNumber: syz [ 509.718750][ T24] usb 3-1: new high-speed USB device number 32 using dummy_hcd [ 509.746400][ T8342] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 509.982560][ T24] usb 3-1: Using ep0 maxpacket: 32 [ 510.012059][ T8342] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 510.031845][ T24] usb 3-1: config 0 has an invalid interface number: 188 but max is 0 [ 510.042738][ T8342] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 510.050103][ T24] usb 3-1: config 0 has no interface number 0 [ 510.080791][ T24] usb 3-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 510.142532][ T24] usb 3-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 510.172257][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 510.198256][ T24] usb 3-1: Product: syz [ 510.202819][ T24] usb 3-1: Manufacturer: syz [ 510.221496][ T24] usb 3-1: SerialNumber: syz [ 510.266817][ T24] usb 3-1: config 0 descriptor?? [ 510.288271][ T8366] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 510.298448][ T24] asix 3-1:0.188: probe with driver asix failed with error -22 [ 510.346379][ T8375] FAULT_INJECTION: forcing a failure. [ 510.346379][ T8375] name failslab, interval 1, probability 0, space 0, times 0 [ 510.359521][ T8375] CPU: 1 UID: 0 PID: 8375 Comm: syz.1.646 Tainted: G L syzkaller #0 PREEMPT(full) [ 510.359550][ T8375] Tainted: [L]=SOFTLOCKUP [ 510.359556][ T8375] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 510.359567][ T8375] Call Trace: [ 510.359574][ T8375] [ 510.359578][ T8375] dump_stack_lvl+0xe8/0x150 [ 510.359596][ T8375] should_fail_ex+0x412/0x560 [ 510.359611][ T8375] should_failslab+0xa8/0x100 [ 510.359623][ T8375] kmem_cache_alloc_node_noprof+0x8b/0x6f0 [ 510.359644][ T8375] ? __alloc_skb+0x193/0x390 [ 510.359664][ T8375] ? __alloc_skb+0x1d7/0x390 [ 510.359681][ T8375] ? __local_bh_enable_ip+0xd0/0x130 [ 510.359698][ T8375] ? __alloc_skb+0x193/0x390 [ 510.359717][ T8375] __alloc_skb+0x1d7/0x390 [ 510.359732][ T8375] netlink_sendmsg+0x5d4/0xb40 [ 510.359748][ T8375] ? __pfx_netlink_sendmsg+0x10/0x10 [ 510.359760][ T8375] ? aa_sock_msg_perm+0xf1/0x1b0 [ 510.359773][ T8375] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 510.359788][ T8375] ? __pfx_netlink_sendmsg+0x10/0x10 [ 510.359805][ T8375] ____sys_sendmsg+0xa68/0xad0 [ 510.359825][ T8375] ? __might_fault+0xaf/0x130 [ 510.359853][ T8375] ? __pfx_____sys_sendmsg+0x10/0x10 [ 510.359877][ T8375] ? import_iovec+0x73/0xa0 [ 510.359893][ T8375] ___sys_sendmsg+0x2a5/0x360 [ 510.359905][ T8375] ? __lock_acquire+0x6b5/0x2cf0 [ 510.359921][ T8375] ? __pfx____sys_sendmsg+0x10/0x10 [ 510.359966][ T8375] ? __fget_files+0x2a/0x420 [ 510.359984][ T8375] ? __fget_files+0x3a0/0x420 [ 510.360010][ T8375] __x64_sys_sendmsg+0x1bd/0x2a0 [ 510.360028][ T8375] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 510.360045][ T8375] ? __pfx_ksys_write+0x10/0x10 [ 510.360065][ T8375] do_syscall_64+0xe2/0xf80 [ 510.360075][ T8375] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 510.360088][ T8375] ? trace_irq_disable+0x37/0x100 [ 510.360105][ T8375] ? clear_bhb_loop+0x60/0xb0 [ 510.360124][ T8375] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 510.360148][ T8375] RIP: 0033:0x7f4ccf99aeb9 [ 510.360164][ T8375] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 510.360175][ T8375] RSP: 002b:00007f4cd07d2028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 510.360186][ T8375] RAX: ffffffffffffffda RBX: 00007f4ccfc15fa0 RCX: 00007f4ccf99aeb9 [ 510.360193][ T8375] RDX: 0000000000000090 RSI: 00002000000002c0 RDI: 0000000000000003 [ 510.360200][ T8375] RBP: 00007f4cd07d2090 R08: 0000000000000000 R09: 0000000000000000 [ 510.360206][ T8375] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 510.360211][ T8375] R13: 00007f4ccfc16038 R14: 00007f4ccfc15fa0 R15: 00007f4ccfd3fa48 [ 510.360226][ T8375] [ 510.754288][ T8342] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 510.810026][ T8342] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 511.032681][ T8380] netlink: 12 bytes leftover after parsing attributes in process `syz.1.647'. [ 511.053696][ T8342] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 511.061053][ T8342] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 511.307522][ T8342] netlink: 4 bytes leftover after parsing attributes in process `syz.3.637'. [ 511.360356][ T5942] cdc_ncm 4-1:1.0: MAC-Address: 42:42:42:42:42:42 [ 511.367067][ T5942] cdc_ncm 4-1:1.0: setting tx_max = 36 [ 511.489204][ T5942] cdc_ncm 4-1:1.0 usb0: register 'cdc_ncm' at usb-dummy_hcd.3-1, CDC NCM (NO ZLP), 42:42:42:42:42:42 [ 511.612531][ T5942] usb 4-1: USB disconnect, device number 28 [ 511.678339][ T5942] cdc_ncm 4-1:1.0 usb0: unregister 'cdc_ncm' usb-dummy_hcd.3-1, CDC NCM (NO ZLP) [ 512.422715][ T24] usb 3-1: USB disconnect, device number 32 [ 512.942688][ T5935] usb 4-1: new high-speed USB device number 29 using dummy_hcd [ 513.148861][ T5935] usb 4-1: Using ep0 maxpacket: 8 [ 513.158078][ T5935] usb 4-1: config 1 has an invalid descriptor of length 104, skipping remainder of the config [ 513.184431][ T5935] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 513.206585][ T5935] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 513.218261][ T5935] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 513.227962][ T5935] usb 4-1: Product: ࠉ [ 513.237791][ T5935] usb 4-1: Manufacturer: ъ [ 513.301603][ T8414] xt_hashlimit: max too large, truncated to 1048576 [ 513.642717][ T8399] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 513.657794][ T8399] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 513.715093][ T8399] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 513.746099][ T8399] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 514.171443][ T8420] netlink: 4 bytes leftover after parsing attributes in process `syz.0.658'. [ 514.501224][ T5935] usb 4-1: 0:2 : does not exist [ 514.577974][ T8426] program syz.4.660 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 514.786390][ T5935] usb 4-1: USB disconnect, device number 29 [ 514.879489][ T5890] udevd[5890]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 515.392275][ T8438] netlink: 36 bytes leftover after parsing attributes in process `syz.1.662'. [ 515.403471][ T8436] netlink: 32 bytes leftover after parsing attributes in process `syz.2.663'. [ 515.433615][ T8436] dvmrp1: entered allmulticast mode [ 515.946226][ T8445] netlink: 12 bytes leftover after parsing attributes in process `syz.2.664'. [ 516.012661][ T894] usb 2-1: new high-speed USB device number 34 using dummy_hcd [ 516.242628][ T894] usb 2-1: device descriptor read/64, error -71 [ 516.542576][ T894] usb 2-1: new high-speed USB device number 35 using dummy_hcd [ 516.702553][ T894] usb 2-1: device descriptor read/64, error -71 [ 516.814238][ T894] usb usb2-port1: attempt power cycle [ 517.212470][ T894] usb 2-1: new high-speed USB device number 36 using dummy_hcd [ 517.313074][ T894] usb 2-1: device descriptor read/8, error -71 [ 517.552526][ T894] usb 2-1: new high-speed USB device number 37 using dummy_hcd [ 517.573102][ T894] usb 2-1: device descriptor read/8, error -71 [ 517.764435][ T8462] SET target dimension over the limit! [ 517.776133][ T894] usb usb2-port1: unable to enumerate USB device [ 518.292460][ T894] usb 2-1: new high-speed USB device number 38 using dummy_hcd [ 518.581134][ T894] usb 2-1: New USB device found, idVendor=1645, idProduct=0008, bcdDevice=cf.36 [ 518.594987][ T894] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 518.622520][ T5942] usb 4-1: new high-speed USB device number 30 using dummy_hcd [ 518.631370][ T894] usb 2-1: config 0 descriptor?? [ 518.800484][ T5942] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 518.818846][ T5942] usb 4-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 518.848382][ T5942] usb 4-1: config 1 has no interface number 1 [ 518.857579][ T5942] usb 4-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 0 [ 518.883237][ T894] kaweth 2-1:0.0: Firmware present in device. [ 518.899941][ T5942] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x6 has an invalid bInterval 0, changing to 7 [ 518.933439][ T5942] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 518.943452][ T5942] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 518.973524][ T5942] usb 4-1: Product: syz [ 518.979823][ T5942] usb 4-1: Manufacturer: syz [ 518.992463][ T5942] usb 4-1: SerialNumber: syz [ 519.007905][ T8470] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 519.045889][ T894] kaweth 2-1:0.0: Statistics collection: 0 [ 519.052878][ T894] kaweth 2-1:0.0: Multicast filter limit: 0 [ 519.059453][ T894] kaweth 2-1:0.0: MTU: 0 [ 519.067296][ T894] kaweth 2-1:0.0: Read MAC address 00:00:00:00:00:00 [ 519.254866][ T8470] xt_CHECKSUM: CHECKSUM should be avoided. If really needed, restrict with "-p udp" and only use in OUTPUT [ 519.311076][ T8470] SET target dimension over the limit! [ 519.379709][ T5942] usb 4-1: 2:1 : no or invalid class specific endpoint descriptor [ 519.388558][ T5942] usb 4-1: 2:1 : no or invalid class specific endpoint descriptor [ 519.783605][ T8488] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 519.922703][ T894] kaweth 2-1:0.0: kaweth interface created at eth1 [ 519.936847][ T5942] usb 4-1: USB disconnect, device number 30 [ 520.157683][ T5935] usb 2-1: USB disconnect, device number 38 [ 521.130774][ T5887] udevd[5887]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 521.640130][ T30] audit: type=1326 audit(1769908771.557:108): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8505 comm="syz.1.680" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4ccf99aeb9 code=0x7ffc0000 [ 521.705690][ T8513] netlink: 12 bytes leftover after parsing attributes in process `syz.4.679'. [ 521.793763][ T30] audit: type=1326 audit(1769908771.557:109): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8505 comm="syz.1.680" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4ccf99aeb9 code=0x7ffc0000 [ 522.031356][ T30] audit: type=1326 audit(1769908771.557:110): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8505 comm="syz.1.680" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f4ccf99aeb9 code=0x7ffc0000 [ 522.054581][ T5964] usb 2-1: new high-speed USB device number 39 using dummy_hcd [ 522.200230][ T30] audit: type=1326 audit(1769908771.557:111): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8505 comm="syz.1.680" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4ccf99aeb9 code=0x7ffc0000 [ 522.223735][ T5964] usb 2-1: device descriptor read/64, error -71 [ 522.271308][ T30] audit: type=1326 audit(1769908771.557:112): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8505 comm="syz.1.680" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4ccf99aeb9 code=0x7ffc0000 [ 522.398188][ T30] audit: type=1326 audit(1769908771.557:113): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8505 comm="syz.1.680" exe="/root/syz-executor" sig=0 arch=c000003e syscall=314 compat=0 ip=0x7f4ccf99aeb9 code=0x7ffc0000 [ 522.472525][ T5964] usb 2-1: new high-speed USB device number 40 using dummy_hcd [ 522.486243][ T30] audit: type=1326 audit(1769908771.557:114): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8505 comm="syz.1.680" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4ccf99aeb9 code=0x7ffc0000 [ 522.617724][ T8524] trusted_key: encrypted_key: keyword 'new' not allowed when called from .update method [ 522.645733][ T30] audit: type=1326 audit(1769908771.557:115): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8505 comm="syz.1.680" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4ccf99aeb9 code=0x7ffc0000 [ 522.687673][ T5935] usb 3-1: new high-speed USB device number 33 using dummy_hcd [ 522.695810][ T5964] usb 2-1: device descriptor read/64, error -71 [ 522.817686][ T5964] usb usb2-port1: attempt power cycle [ 522.841219][ T30] audit: type=1326 audit(1769908771.557:116): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8505 comm="syz.1.680" exe="/root/syz-executor" sig=0 arch=c000003e syscall=259 compat=0 ip=0x7f4ccf99aeb9 code=0x7ffc0000 [ 522.888429][ T5935] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 522.902602][ T5935] usb 3-1: config 0 has no interface number 0 [ 522.926296][ T5935] usb 3-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 522.937190][ T5935] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 522.979294][ T30] audit: type=1326 audit(1769908771.557:117): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8505 comm="syz.1.680" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4ccf99aeb9 code=0x7ffc0000 [ 523.004055][ T5935] usb 3-1: Product: syz [ 523.008326][ T5935] usb 3-1: Manufacturer: syz [ 523.069710][ T5935] usb 3-1: SerialNumber: syz [ 523.173525][ T5935] usb 3-1: config 0 descriptor?? [ 523.221042][ T5964] usb 2-1: new high-speed USB device number 41 using dummy_hcd [ 523.282034][ T5964] usb 2-1: device descriptor read/8, error -71 [ 523.459510][ T5935] usb 3-1: dvb_usb_v2: found a 'E3C EC168 reference design' in warm state [ 523.534921][ T5935] usb 3-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 523.553340][ T5964] usb 2-1: new high-speed USB device number 42 using dummy_hcd [ 523.605466][ T5964] usb 2-1: device descriptor read/8, error -71 [ 523.616938][ T5935] dvbdev: DVB: registering new adapter (E3C EC168 reference design) [ 523.712641][ T5935] usb 3-1: media controller created [ 523.745522][ T5935] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 523.754436][ T5964] usb usb2-port1: unable to enumerate USB device [ 523.862552][ T5873] usb 4-1: new full-speed USB device number 31 using dummy_hcd [ 524.015530][ T8553] netlink: 'syz.4.689': attribute type 4 has an invalid length. [ 524.054162][ T5873] usb 4-1: not running at top speed; connect to a high speed hub [ 524.072122][ T5873] usb 4-1: config 8 has an invalid interface number: 32 but max is 3 [ 524.103118][ T5873] usb 4-1: config 8 has an invalid interface number: 41 but max is 3 [ 524.139528][ T5873] usb 4-1: config 8 has an invalid interface number: 64 but max is 3 [ 524.167737][ T5873] usb 4-1: config 8 has no interface number 0 [ 524.211645][ T5873] usb 4-1: config 8 has no interface number 1 [ 524.225121][ T5873] usb 4-1: config 8 has no interface number 3 [ 524.240627][ T5873] usb 4-1: config 8 interface 32 altsetting 4 has an endpoint descriptor with address 0xBF, changing to 0x8F [ 524.272510][ T5873] usb 4-1: config 8 interface 32 altsetting 4 endpoint 0xA has invalid maxpacket 1023, setting to 64 [ 524.301607][ T5873] usb 4-1: config 8 interface 32 altsetting 4 has an endpoint descriptor with address 0x5E, changing to 0xE [ 524.327817][ T5873] usb 4-1: config 8 interface 32 altsetting 4 endpoint 0xE has invalid maxpacket 60629, setting to 64 [ 524.353213][ T5873] usb 4-1: config 8 interface 32 altsetting 4 has a duplicate endpoint with address 0x4, skipping [ 524.380458][ T5873] usb 4-1: config 8 interface 32 altsetting 4 endpoint 0x2 has invalid maxpacket 1024, setting to 64 [ 524.546760][ T5873] usb 4-1: config 8 interface 32 altsetting 4 endpoint 0x3 has invalid maxpacket 1024, setting to 64 [ 524.584202][ T5873] usb 4-1: config 8 interface 32 altsetting 4 has a duplicate endpoint with address 0x4, skipping [ 524.614491][ T5873] usb 4-1: config 8 interface 32 altsetting 4 has a duplicate endpoint with address 0x4, skipping [ 524.640803][ T5873] usb 4-1: config 8 interface 32 altsetting 4 has a duplicate endpoint with address 0x4, skipping [ 524.685613][ T5873] usb 4-1: config 8 interface 32 altsetting 4 has an invalid descriptor for endpoint zero, skipping [ 524.724166][ T5873] usb 4-1: config 8 interface 32 altsetting 4 has a duplicate endpoint with address 0x1, skipping [ 524.760938][ T5873] usb 4-1: config 8 interface 32 altsetting 4 has 16 endpoint descriptors, different from the interface descriptor's value: 15 [ 524.797544][ T5873] usb 4-1: config 8 interface 41 altsetting 10 has a duplicate endpoint with address 0xD, skipping [ 524.807419][ T8566] binder: BINDER_SET_CONTEXT_MGR already set [ 524.817677][ T5935] i2c i2c-1: ec100: i2c rd failed=-71 reg=33 [ 524.827112][ T5873] usb 4-1: config 8 interface 41 altsetting 10 has a duplicate endpoint with address 0xA, skipping [ 524.850336][ T8566] binder: 8565:8566 ioctl 4018620d 200000000300 returned -16 [ 524.948894][ T5873] usb 4-1: config 8 interface 41 altsetting 10 has a duplicate endpoint with address 0xA, skipping [ 525.020965][ T5873] usb 4-1: config 8 interface 41 altsetting 10 endpoint 0x5 has invalid maxpacket 1024, setting to 64 [ 525.029155][ T5935] usb 3-1: USB disconnect, device number 33 [ 525.062632][ T5873] usb 4-1: config 8 interface 2 altsetting 10 has an invalid descriptor for endpoint zero, skipping [ 525.087070][ T8576] netlink: 8 bytes leftover after parsing attributes in process `syz.4.695'. [ 525.100319][ T5873] usb 4-1: config 8 interface 2 altsetting 10 has a duplicate endpoint with address 0xA, skipping [ 525.125644][ T5873] usb 4-1: config 8 interface 2 altsetting 10 has an endpoint descriptor with address 0xD8, changing to 0x88 [ 525.138734][ T8576] dlm: no locking on control device [ 525.187704][ T5873] usb 4-1: config 8 interface 2 altsetting 10 has a duplicate endpoint with address 0x88, skipping [ 525.239171][ T5873] usb 4-1: config 8 interface 2 altsetting 10 has a duplicate endpoint with address 0xF, skipping [ 525.286875][ T5873] usb 4-1: config 8 interface 2 altsetting 10 has a duplicate endpoint with address 0xA, skipping [ 525.299720][ T5873] usb 4-1: config 8 interface 2 altsetting 10 has a duplicate endpoint with address 0xA, skipping [ 525.310887][ T5873] usb 4-1: config 8 interface 2 altsetting 10 has an endpoint descriptor with address 0xEB, changing to 0x8B [ 525.570441][ T5873] usb 4-1: config 8 interface 2 altsetting 10 endpoint 0x8B has an invalid bInterval 182, changing to 4 [ 525.643811][ T5873] usb 4-1: config 8 interface 2 altsetting 10 endpoint 0x8B has invalid maxpacket 18850, setting to 1023 [ 525.781734][ T5873] usb 4-1: config 8 interface 2 altsetting 10 has a duplicate endpoint with address 0x8, skipping [ 525.862513][ T5873] usb 4-1: config 8 interface 2 altsetting 10 has an endpoint descriptor with address 0xA1, changing to 0x81 [ 525.905534][ T5873] usb 4-1: config 8 interface 2 altsetting 10 has a duplicate endpoint with address 0x81, skipping [ 525.960965][ T5873] usb 4-1: config 8 interface 2 altsetting 10 has an invalid descriptor for endpoint zero, skipping [ 526.004901][ T5873] usb 4-1: config 8 interface 2 altsetting 10 has a duplicate endpoint with address 0x3, skipping [ 526.065579][ T5873] usb 4-1: config 8 interface 2 altsetting 10 has a duplicate endpoint with address 0x8, skipping [ 526.098105][ T5873] usb 4-1: config 8 interface 2 altsetting 10 has a duplicate endpoint with address 0xB, skipping [ 526.122328][ T5873] usb 4-1: config 8 interface 2 altsetting 10 has a duplicate endpoint with address 0xE, skipping [ 526.142579][ T5873] usb 4-1: config 8 interface 2 altsetting 10 has a duplicate endpoint with address 0x8, skipping [ 526.153844][ T5873] usb 4-1: config 8 interface 2 altsetting 10 has an invalid descriptor for endpoint zero, skipping [ 526.222789][ T5873] usb 4-1: config 8 interface 2 altsetting 10 has 17 endpoint descriptors, different from the interface descriptor's value: 15 [ 526.247693][ T8604] netlink: 4 bytes leftover after parsing attributes in process `syz.2.700'. [ 526.341589][ T5873] usb 4-1: config 8 interface 64 altsetting 0 endpoint 0x9 has invalid maxpacket 1023, setting to 64 [ 526.354106][ T5873] usb 4-1: config 8 interface 32 has no altsetting 0 [ 526.361201][ T5873] usb 4-1: config 8 interface 41 has no altsetting 0 [ 526.368412][ T5873] usb 4-1: config 8 interface 2 has no altsetting 0 [ 526.462581][ T5873] usb 4-1: string descriptor 0 read error: -71 [ 526.468951][ T5873] usb 4-1: Dual-Role OTG device on HNP port [ 526.512444][ T5873] usb 4-1: can't set HNP mode: -71 [ 526.649555][ T8611] netlink: 8 bytes leftover after parsing attributes in process `syz.3.702'. [ 527.321704][ T8622] kvm: vcpu 2: requested 128 ns lapic timer period limited to 200000 ns [ 527.330377][ T8622] kvm: vcpu 2: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (200000 ns). Using initial count to start timer. [ 527.600943][ T5873] usb 4-1: new high-speed USB device number 32 using dummy_hcd [ 528.042507][ T894] usb 1-1: new high-speed USB device number 34 using dummy_hcd [ 528.093922][ T5873] usb 4-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 528.103003][ T5873] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 528.114144][ T5873] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 528.130808][ T5873] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 528.163917][ T5873] usb 4-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 528.173191][ T5873] usb 4-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 528.181193][ T5873] usb 4-1: Product: syz [ 528.186175][ T5873] usb 4-1: Manufacturer: syz [ 528.218464][ T894] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 528.226858][ T894] usb 1-1: config 0 has no interface number 0 [ 528.435104][ T894] usb 1-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 528.453635][ T5873] cdc_wdm 4-1:1.0: skipping garbage [ 528.460957][ T5873] cdc_wdm 4-1:1.0: skipping garbage [ 528.471267][ T894] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 528.479924][ T5873] cdc_wdm 4-1:1.0: probe with driver cdc_wdm failed with error -22 [ 528.504372][ T894] usb 1-1: Product: syz [ 528.513791][ T894] usb 1-1: Manufacturer: syz [ 528.529155][ T894] usb 1-1: SerialNumber: syz [ 528.548574][ T894] usb 1-1: config 0 descriptor?? [ 528.693949][ T8619] netlink: 28 bytes leftover after parsing attributes in process `syz.3.704'. [ 528.703238][ T8619] openvswitch: netlink: Flow key attr not present in new flow. [ 528.760694][ T5873] usb 4-1: USB disconnect, device number 32 [ 528.776499][ T894] usb 1-1: dvb_usb_v2: found a 'E3C EC168 reference design' in warm state [ 528.810205][ T894] usb 1-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 528.847841][ T894] dvbdev: DVB: registering new adapter (E3C EC168 reference design) [ 528.868372][ T894] usb 1-1: media controller created [ 528.911115][ T894] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 530.093933][ T8651] netlink: 8 bytes leftover after parsing attributes in process `syz.4.714'. [ 530.143820][ T894] i2c i2c-1: ec100: i2c rd failed=-71 reg=33 [ 530.270110][ T894] usb 1-1: USB disconnect, device number 34 [ 531.480151][ T8668] xt_limit: Overflow, try lower: 4/2147483648 [ 531.822469][ T894] usb 3-1: new low-speed USB device number 34 using dummy_hcd [ 531.952489][ T894] usb 3-1: device descriptor read/64, error -71 [ 532.261988][ T5935] usb 1-1: new high-speed USB device number 35 using dummy_hcd [ 532.434450][ T894] usb 3-1: new low-speed USB device number 35 using dummy_hcd [ 532.435823][ T5935] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 532.464380][ T5935] usb 1-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 532.502210][ T5935] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 532.555901][ T5935] usb 1-1: config 0 descriptor?? [ 532.579819][ T5935] pwc: Askey VC010 type 2 USB webcam detected. [ 532.593344][ T894] usb 3-1: device descriptor read/64, error -71 [ 532.613075][ T8691] netlink: 8 bytes leftover after parsing attributes in process `syz.1.727'. [ 532.707910][ T894] usb usb3-port1: attempt power cycle [ 532.984970][ T5964] usb 4-1: new high-speed USB device number 33 using dummy_hcd [ 532.992896][ T5935] pwc: recv_control_msg error -32 req 02 val 2b00 [ 533.000661][ T5935] pwc: recv_control_msg error -32 req 02 val 2700 [ 533.008084][ T5935] pwc: recv_control_msg error -32 req 02 val 2c00 [ 533.062477][ T894] usb 3-1: new low-speed USB device number 36 using dummy_hcd [ 533.083411][ T894] usb 3-1: device descriptor read/8, error -71 [ 533.144573][ T5964] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 533.166972][ T5964] usb 4-1: config 0 has no interface number 0 [ 533.185376][ T5964] usb 4-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 533.199965][ T5964] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 533.208385][ T5964] usb 4-1: Product: syz [ 533.213689][ T5964] usb 4-1: Manufacturer: syz [ 533.218350][ T5964] usb 4-1: SerialNumber: syz [ 533.219693][ T8683] netlink: 4 bytes leftover after parsing attributes in process `syz.0.724'. [ 533.226535][ T5964] usb 4-1: config 0 descriptor?? [ 533.322496][ T894] usb 3-1: new low-speed USB device number 37 using dummy_hcd [ 533.353394][ T894] usb 3-1: device descriptor read/8, error -71 [ 533.452730][ T5964] usb 4-1: dvb_usb_v2: found a 'E3C EC168 reference design' in warm state [ 533.463066][ T894] usb usb3-port1: unable to enumerate USB device [ 533.468306][ T5964] usb 4-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 533.481322][ T5964] dvbdev: DVB: registering new adapter (E3C EC168 reference design) [ 533.527380][ T5964] usb 4-1: media controller created [ 533.562234][ T5964] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 533.791133][ T5935] pwc: recv_control_msg error -71 req 04 val 1300 [ 533.820482][ T5935] pwc: recv_control_msg error -71 req 04 val 1400 [ 533.849058][ T5935] pwc: recv_control_msg error -71 req 02 val 2000 [ 533.867062][ T5935] pwc: recv_control_msg error -71 req 02 val 2100 [ 533.883048][ T5935] pwc: recv_control_msg error -71 req 04 val 1500 [ 533.911453][ T5935] pwc: recv_control_msg error -71 req 02 val 2500 [ 534.063866][ T5935] pwc: recv_control_msg error -71 req 02 val 2400 [ 534.070937][ T5935] pwc: recv_control_msg error -71 req 02 val 2600 [ 534.078107][ T5935] pwc: recv_control_msg error -71 req 02 val 2900 [ 534.091103][ T5935] pwc: recv_control_msg error -71 req 02 val 2800 [ 534.098789][ T5935] pwc: recv_control_msg error -71 req 04 val 1100 [ 534.105986][ T5935] pwc: recv_control_msg error -71 req 04 val 1200 [ 534.171632][ T5935] pwc: Registered as video103. [ 534.211249][ T5935] input: PWC snapshot button as /devices/platform/dummy_hcd.0/usb1/1-1/input/input15 [ 534.320383][ T5935] usb 1-1: USB disconnect, device number 35 [ 534.646347][ T8722] fuse: Unknown parameter ' ' [ 534.668407][ T30] kauditd_printk_skb: 44 callbacks suppressed [ 534.668420][ T30] audit: type=1800 audit(1769908784.627:162): pid=8722 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.737" name="bus" dev="tmpfs" ino=724 res=0 errno=0 [ 534.695877][ T5935] usb 1-1: new high-speed USB device number 36 using dummy_hcd [ 534.707820][ T5964] i2c i2c-1: ec100: i2c rd failed=-110 reg=33 [ 534.879483][ T5964] usb 4-1: USB disconnect, device number 33 [ 534.902495][ T5935] usb 1-1: Using ep0 maxpacket: 16 [ 534.911442][ T5935] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 534.922771][ T5935] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 534.935896][ T5935] usb 1-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 534.957696][ T5935] usb 1-1: config 1 interface 1 has no altsetting 0 [ 534.978736][ T5935] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 534.988106][ T5935] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 535.006863][ T5935] usb 1-1: Product: syz [ 535.018438][ T5935] usb 1-1: Manufacturer: syz [ 535.028549][ T5935] usb 1-1: SerialNumber: syz [ 535.482560][ T5935] usb 1-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 535.954192][ T8737] netlink: 12 bytes leftover after parsing attributes in process `syz.1.740'. [ 536.125552][ T8741] bond2: (slave vxcan3): The slave device specified does not support setting the MAC address [ 536.141341][ T8741] bond2: (slave vxcan3): Error -95 calling set_mac_address [ 536.208679][ T8742] macvlan2: entered promiscuous mode [ 536.215028][ T8742] macvlan2: entered allmulticast mode [ 536.229333][ T8742] vlan1: entered promiscuous mode [ 536.254512][ T8742] bond2: (slave macvlan2): Enslaving as an active interface with an up link [ 536.414504][ T5935] usb 1-1: USB disconnect, device number 36 [ 536.489348][ T8752] FAULT_INJECTION: forcing a failure. [ 536.489348][ T8752] name failslab, interval 1, probability 0, space 0, times 0 [ 536.506442][ T8752] CPU: 1 UID: 0 PID: 8752 Comm: syz.3.744 Tainted: G L syzkaller #0 PREEMPT(full) [ 536.506473][ T8752] Tainted: [L]=SOFTLOCKUP [ 536.506479][ T8752] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 536.506489][ T8752] Call Trace: [ 536.506496][ T8752] [ 536.506503][ T8752] dump_stack_lvl+0xe8/0x150 [ 536.506531][ T8752] should_fail_ex+0x412/0x560 [ 536.506557][ T8752] should_failslab+0xa8/0x100 [ 536.506578][ T8752] kmem_cache_alloc_noprof+0x87/0x6e0 [ 536.506600][ T8752] ? __netlink_lookup+0xc6/0x8b0 [ 536.506619][ T8752] ? skb_clone+0x212/0x3a0 [ 536.506645][ T8752] skb_clone+0x212/0x3a0 [ 536.506670][ T8752] __netlink_deliver_tap+0x404/0x850 [ 536.506697][ T8752] ? netlink_deliver_tap+0x2e/0x1b0 [ 536.506717][ T8752] netlink_deliver_tap+0x19c/0x1b0 [ 536.506736][ T8752] netlink_unicast+0x7e3/0x9b0 [ 536.506768][ T8752] ? __pfx_netlink_unicast+0x10/0x10 [ 536.506790][ T8752] ? __alloc_skb+0x193/0x390 [ 536.506808][ T8752] ? netlink_sendmsg+0x650/0xb40 [ 536.506824][ T8752] ? skb_put+0x11b/0x210 [ 536.506847][ T8752] netlink_sendmsg+0x813/0xb40 [ 536.506874][ T8752] ? __pfx_netlink_sendmsg+0x10/0x10 [ 536.506895][ T8752] ? aa_sock_msg_perm+0xf1/0x1b0 [ 536.506917][ T8752] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 536.506963][ T8752] ? __pfx_netlink_sendmsg+0x10/0x10 [ 536.506980][ T8752] ____sys_sendmsg+0xa68/0xad0 [ 536.507001][ T8752] ? __might_fault+0xaf/0x130 [ 536.507035][ T8752] ? __pfx_____sys_sendmsg+0x10/0x10 [ 536.507063][ T8752] ? import_iovec+0x73/0xa0 [ 536.507089][ T8752] ___sys_sendmsg+0x2a5/0x360 [ 536.507109][ T8752] ? __lock_acquire+0x6b5/0x2cf0 [ 536.507134][ T8752] ? __pfx____sys_sendmsg+0x10/0x10 [ 536.507189][ T8752] ? __fget_files+0x2a/0x420 [ 536.507205][ T8752] ? __fget_files+0x3a0/0x420 [ 536.507233][ T8752] __x64_sys_sendmsg+0x1bd/0x2a0 [ 536.507257][ T8752] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 536.507287][ T8752] ? __pfx_ksys_write+0x10/0x10 [ 536.507320][ T8752] do_syscall_64+0xe2/0xf80 [ 536.507338][ T8752] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 536.507355][ T8752] ? trace_irq_disable+0x37/0x100 [ 536.507371][ T8752] ? clear_bhb_loop+0x60/0xb0 [ 536.507392][ T8752] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 536.507408][ T8752] RIP: 0033:0x7ff2f039aeb9 [ 536.507424][ T8752] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 536.507439][ T8752] RSP: 002b:00007ff2f12be028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 536.507458][ T8752] RAX: ffffffffffffffda RBX: 00007ff2f0615fa0 RCX: 00007ff2f039aeb9 [ 536.507472][ T8752] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000003 [ 536.507482][ T8752] RBP: 00007ff2f12be090 R08: 0000000000000000 R09: 0000000000000000 [ 536.507492][ T8752] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 536.507501][ T8752] R13: 00007ff2f0616038 R14: 00007ff2f0615fa0 R15: 00007ff2f073fa48 [ 536.507528][ T8752] [ 537.486401][ T30] audit: type=1800 audit(1769908787.437:163): pid=8777 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.752" name="SYSV00000000" dev="hugetlbfs" ino=1 res=0 errno=0 [ 537.733698][ T8782] dlm: no locking on control device [ 538.609732][ T8795] netlink: 28 bytes leftover after parsing attributes in process `syz.0.757'. [ 538.688855][ T8795] netlink: 28 bytes leftover after parsing attributes in process `syz.0.757'. [ 538.736354][ T8795] dummy0: entered promiscuous mode [ 538.743475][ T8795] team0: entered promiscuous mode [ 538.749022][ T8795] team_slave_0: entered promiscuous mode [ 538.754858][ T5935] usb 5-1: new high-speed USB device number 40 using dummy_hcd [ 538.773356][ T8795] team_slave_1: entered promiscuous mode [ 538.942706][ T5935] usb 5-1: Using ep0 maxpacket: 32 [ 538.963703][ T5935] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 538.994662][ T5935] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 539.057511][ T5935] usb 5-1: New USB device found, idVendor=0e41, idProduct=534d, bcdDevice=58.d6 [ 539.074682][ T5935] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 539.074718][ T5935] usb 5-1: Product: syz [ 539.074734][ T5935] usb 5-1: Manufacturer: syz [ 539.074749][ T5935] usb 5-1: SerialNumber: syz [ 539.109112][ T5935] usb 5-1: config 0 descriptor?? [ 539.396365][ T8789] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 539.438507][ T8789] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 540.074247][ T894] usb 4-1: new high-speed USB device number 34 using dummy_hcd [ 540.257036][ T894] usb 4-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 540.282446][ T894] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 540.306423][ T894] usb 4-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 540.322486][ T894] usb 4-1: config 1 has no interface number 1 [ 540.332784][ T894] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 540.364807][ T894] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 540.377445][ T894] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 540.408054][ T894] usb 4-1: Product: syz [ 540.418229][ T894] usb 4-1: Manufacturer: syz [ 540.428477][ T894] usb 4-1: SerialNumber: syz [ 540.653795][ T894] usb 4-1: No MIDI 2.0 at altset 1, falling back to MIDI 1.0 [ 540.671621][ T894] usb 4-1: MIDIStreaming interface descriptor not found [ 540.736636][ T894] usb 4-1: USB disconnect, device number 34 [ 540.817747][ T5881] udevd[5881]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.2/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 540.950298][ T8827] netlink: 8 bytes leftover after parsing attributes in process `syz.0.768'. [ 540.963347][ T8827] netlink: 'syz.0.768': attribute type 30 has an invalid length. [ 540.989795][ T5907] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 540.999521][ T8827] netlink: 8 bytes leftover after parsing attributes in process `syz.0.768'. [ 541.008804][ T5907] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 541.019304][ T8827] netlink: 'syz.0.768': attribute type 30 has an invalid length. [ 541.030225][ T5907] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 541.040789][ T5907] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 541.432947][ T894] usb 5-1: USB disconnect, device number 40 [ 541.731095][ T8842] FAULT_INJECTION: forcing a failure. [ 541.731095][ T8842] name failslab, interval 1, probability 0, space 0, times 0 [ 541.744082][ T8842] CPU: 0 UID: 0 PID: 8842 Comm: syz.1.771 Tainted: G L syzkaller #0 PREEMPT(full) [ 541.744103][ T8842] Tainted: [L]=SOFTLOCKUP [ 541.744110][ T8842] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 541.744119][ T8842] Call Trace: [ 541.744128][ T8842] [ 541.744136][ T8842] dump_stack_lvl+0xe8/0x150 [ 541.744162][ T8842] should_fail_ex+0x412/0x560 [ 541.744181][ T8842] should_failslab+0xa8/0x100 [ 541.744193][ T8842] kmem_cache_alloc_node_noprof+0x8b/0x6f0 [ 541.744210][ T8842] ? __alloc_skb+0x193/0x390 [ 541.744221][ T8842] ? __alloc_skb+0x1d7/0x390 [ 541.744231][ T8842] ? __local_bh_enable_ip+0xd0/0x130 [ 541.744241][ T8842] ? __alloc_skb+0x193/0x390 [ 541.744252][ T8842] __alloc_skb+0x1d7/0x390 [ 541.744265][ T8842] netlink_ack+0x146/0xa50 [ 541.744275][ T8842] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 541.744286][ T8842] ? ref_tracker_free+0x693/0x840 [ 541.744297][ T8842] ? __copy_skb_header+0xa3/0x4a0 [ 541.744312][ T8842] ? __pfx_ref_tracker_free+0x10/0x10 [ 541.744328][ T8842] netlink_rcv_skb+0x2b6/0x4b0 [ 541.744338][ T8842] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 541.744350][ T8842] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 541.744365][ T8842] ? netlink_deliver_tap+0x2e/0x1b0 [ 541.744386][ T8842] netlink_unicast+0x80f/0x9b0 [ 541.744404][ T8842] ? __pfx_netlink_unicast+0x10/0x10 [ 541.744419][ T8842] ? __alloc_skb+0x193/0x390 [ 541.744430][ T8842] ? netlink_sendmsg+0x650/0xb40 [ 541.744439][ T8842] ? skb_put+0x11b/0x210 [ 541.744452][ T8842] netlink_sendmsg+0x813/0xb40 [ 541.744466][ T8842] ? __pfx_netlink_sendmsg+0x10/0x10 [ 541.744478][ T8842] ? aa_sock_msg_perm+0xf1/0x1b0 [ 541.744491][ T8842] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 541.744503][ T8842] ? __pfx_netlink_sendmsg+0x10/0x10 [ 541.744512][ T8842] ____sys_sendmsg+0xa68/0xad0 [ 541.744526][ T8842] ? __might_fault+0xaf/0x130 [ 541.744547][ T8842] ? __pfx_____sys_sendmsg+0x10/0x10 [ 541.744574][ T8842] ? import_iovec+0x73/0xa0 [ 541.744599][ T8842] ___sys_sendmsg+0x2a5/0x360 [ 541.744618][ T8842] ? __lock_acquire+0x6b5/0x2cf0 [ 541.744636][ T8842] ? __pfx____sys_sendmsg+0x10/0x10 [ 541.744665][ T8842] ? __fget_files+0x2a/0x420 [ 541.744675][ T8842] ? __fget_files+0x3a0/0x420 [ 541.744690][ T8842] __x64_sys_sendmsg+0x1bd/0x2a0 [ 541.744704][ T8842] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 541.744721][ T8842] ? __pfx_ksys_write+0x10/0x10 [ 541.744741][ T8842] do_syscall_64+0xe2/0xf80 [ 541.744753][ T8842] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 541.744763][ T8842] ? clear_bhb_loop+0x60/0xb0 [ 541.744775][ T8842] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 541.744784][ T8842] RIP: 0033:0x7f4ccf99aeb9 [ 541.744798][ T8842] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 541.744812][ T8842] RSP: 002b:00007f4cd07d2028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 541.744830][ T8842] RAX: ffffffffffffffda RBX: 00007f4ccfc15fa0 RCX: 00007f4ccf99aeb9 [ 541.744841][ T8842] RDX: 0000000000000000 RSI: 0000200000000240 RDI: 0000000000000003 [ 541.744851][ T8842] RBP: 00007f4cd07d2090 R08: 0000000000000000 R09: 0000000000000000 [ 541.744862][ T8842] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 541.744872][ T8842] R13: 00007f4ccfc16038 R14: 00007f4ccfc15fa0 R15: 00007f4ccfd3fa48 [ 541.745087][ T8842] [ 542.136186][ T8844] netlink: 'syz.0.774': attribute type 298 has an invalid length. [ 542.252324][ T5146] Bluetooth: hci1: unexpected event for opcode 0x0c14 [ 542.318557][ T8849] xt_hashlimit: size too large, truncated to 1048576 [ 542.397266][ T5982] usb 1-1: new high-speed USB device number 37 using dummy_hcd [ 542.592563][ T5982] usb 1-1: Using ep0 maxpacket: 16 [ 542.631717][ T5982] usb 1-1: config 1 has an invalid descriptor of length 64, skipping remainder of the config [ 542.656472][ T5982] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 542.669842][ T5982] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 542.679713][ T5982] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 542.688251][ T5982] usb 1-1: Product: syz [ 542.692647][ T5982] usb 1-1: Manufacturer: syz [ 542.701965][ T5982] usb 1-1: SerialNumber: syz [ 542.707030][ T894] usb 5-1: new high-speed USB device number 41 using dummy_hcd [ 542.894488][ T894] usb 5-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 542.914923][ T894] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 542.932886][ T894] usb 5-1: config 0 descriptor?? [ 542.954988][ T894] gspca_main: STV06xx-2.14.0 probing 046d:0870 [ 542.993792][ T5935] usb 2-1: new high-speed USB device number 43 using dummy_hcd [ 543.049816][ T5982] usb 1-1: 0:2 : does not exist [ 543.074071][ T5982] usb 1-1: USB disconnect, device number 37 [ 543.121523][ T5890] udevd[5890]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 543.165303][ T5935] usb 2-1: Using ep0 maxpacket: 32 [ 543.172491][ T5873] usb 3-1: new high-speed USB device number 38 using dummy_hcd [ 543.201445][ T5935] usb 2-1: config 4 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 543.221698][ T5935] usb 2-1: config 4 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 543.230601][ T8874] netlink: 228 bytes leftover after parsing attributes in process `syz.3.785'. [ 543.244675][ T5935] usb 2-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 543.249354][ T8874] netlink: 228 bytes leftover after parsing attributes in process `syz.3.785'. [ 543.263903][ T5935] usb 2-1: New USB device strings: Mfr=255, Product=255, SerialNumber=0 [ 543.273067][ T5935] usb 2-1: Product: syz [ 543.277268][ T5935] usb 2-1: Manufacturer: syz [ 543.305674][ T5935] hub 2-1:4.0: USB hub found [ 543.352479][ T5873] usb 3-1: Using ep0 maxpacket: 32 [ 543.365653][ T5873] usb 3-1: config 0 has an invalid interface number: 74 but max is 1 [ 543.379036][ T5873] usb 3-1: config 0 has no interface number 1 [ 543.389014][ T5873] usb 3-1: New USB device found, idVendor=07fd, idProduct=0004, bcdDevice=8e.fa [ 543.399587][ T5873] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 543.408475][ T5873] usb 3-1: Product: syz [ 543.413343][ T5873] usb 3-1: Manufacturer: syz [ 543.422490][ T5873] usb 3-1: SerialNumber: syz [ 543.440603][ T5873] usb 3-1: config 0 descriptor?? [ 543.487306][ T5873] snd-usb-audio 3-1:0.74: probe with driver snd-usb-audio failed with error -22 [ 543.500645][ T8878] program syz.3.787 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 543.520863][ T5935] hub 2-1:4.0: config failed, hub has too many ports! (err -19) [ 543.539699][ T6000] udevd[6000]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.74/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 543.670945][ T8880] program syz.0.788 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 543.693596][ T5873] usb 3-1: USB disconnect, device number 38 [ 544.029125][ T8891] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 544.095255][ T894] usb 5-1: USB disconnect, device number 41 [ 544.124495][ T5935] usb 4-1: new high-speed USB device number 35 using dummy_hcd [ 544.212985][ T30] audit: type=1326 audit(1769908794.147:164): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8883 comm="syz.0.790" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f139bd9aeb9 code=0x7ffc0000 [ 544.346899][ T5935] usb 4-1: Using ep0 maxpacket: 32 [ 544.597651][ T30] audit: type=1326 audit(1769908794.147:165): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8883 comm="syz.0.790" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f139bd9aeb9 code=0x7ffc0000 [ 544.629521][ T5935] usb 4-1: config 0 has an invalid interface number: 230 but max is 0 [ 544.669000][ T5935] usb 4-1: config 0 has no interface number 0 [ 544.676059][ T5935] usb 4-1: config 0 interface 230 has no altsetting 0 [ 544.683182][ T30] audit: type=1326 audit(1769908794.147:166): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8883 comm="syz.0.790" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f139bd9aeb9 code=0x7ffc0000 [ 544.713791][ T5935] usb 4-1: New USB device found, idVendor=0781, idProduct=0005, bcdDevice= 0.05 [ 544.723178][ T5935] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 544.732500][ T5935] usb 4-1: Product: syz [ 544.737113][ T30] audit: type=1326 audit(1769908794.147:167): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8883 comm="syz.0.790" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f139bd9aeb9 code=0x7ffc0000 [ 544.761137][ T5935] usb 4-1: Manufacturer: syz [ 544.770611][ T5935] usb 4-1: SerialNumber: syz [ 544.791534][ T5935] usb 4-1: config 0 descriptor?? [ 544.814943][ T5935] ums-usbat 4-1:0.230: USB Mass Storage device detected [ 545.024161][ T5935] ums-usbat 4-1:0.230: Quirks match for vid 0781 pid 0005: 1 [ 545.039131][ T30] audit: type=1326 audit(1769908794.147:168): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8883 comm="syz.0.790" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f139bd9c747 code=0x7ffc0000 [ 545.184134][ T30] audit: type=1326 audit(1769908794.147:169): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8883 comm="syz.0.790" exe="/root/syz-executor" sig=0 arch=c000003e syscall=44 compat=0 ip=0x7f139bd5b78e code=0x7ffc0000 [ 545.222545][ T5942] usb 5-1: new high-speed USB device number 42 using dummy_hcd [ 545.238840][ T30] audit: type=1326 audit(1769908794.147:170): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8883 comm="syz.0.790" exe="/root/syz-executor" sig=0 arch=c000003e syscall=45 compat=0 ip=0x7f139bd5b78e code=0x7ffc0000 [ 545.312097][ T30] audit: type=1326 audit(1769908794.147:171): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8883 comm="syz.0.790" exe="/root/syz-executor" sig=0 arch=c000003e syscall=45 compat=0 ip=0x7f139bd5b78e code=0x7ffc0000 [ 545.377761][ T30] audit: type=1326 audit(1769908794.147:172): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8883 comm="syz.0.790" exe="/root/syz-executor" sig=0 arch=c000003e syscall=3 compat=0 ip=0x7f139bd5b78e code=0x7ffc0000 [ 545.382678][ T5942] usb 5-1: Using ep0 maxpacket: 32 [ 545.491545][ T30] audit: type=1326 audit(1769908794.147:173): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8883 comm="syz.0.790" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f139bd9aeb9 code=0x7ffc0000 [ 545.574306][ T5942] usb 5-1: config index 0 descriptor too short (expected 35577, got 27) [ 545.605255][ T5942] usb 5-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 545.614373][ T5942] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 545.634347][ T5942] usb 5-1: config 1 has no interface number 0 [ 545.640613][ T5942] usb 5-1: config 1 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 545.657548][ T5942] usb 5-1: config 1 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 545.675419][ T5942] usb 5-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 545.684883][ T5942] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 545.721843][ T8914] netlink: 'syz.2.797': attribute type 1 has an invalid length. [ 545.734137][ T5942] snd_usb_pod 5-1:1.1: Line 6 Pocket POD found [ 545.926027][ T5942] snd_usb_pod 5-1:1.1: Line 6 Pocket POD now attached [ 546.279078][ T8922] netlink: 'syz.2.799': attribute type 298 has an invalid length. [ 546.345957][ T8901] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 546.362222][ T8901] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 546.416261][ T8901] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 546.431268][ T8901] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 546.446513][ T8901] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 546.457815][ T8901] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 546.572568][ T5942] usb 3-1: new high-speed USB device number 39 using dummy_hcd [ 546.722504][ T5942] usb 3-1: Using ep0 maxpacket: 16 [ 546.730447][ T5942] usb 3-1: config 1 has an invalid descriptor of length 64, skipping remainder of the config [ 546.744048][ T5942] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 546.756462][ T5942] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 546.766476][ T5942] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 546.776118][ T5942] usb 3-1: Product: syz [ 546.780710][ T5942] usb 3-1: Manufacturer: syz [ 546.785795][ T5942] usb 3-1: SerialNumber: syz [ 546.995336][ T5935] snd_usb_pod 5-1:1.1: line6_send_raw_message_async_part: usb_submit_urb failed (-22) [ 547.057101][ T894] usb 5-1: USB disconnect, device number 42 [ 547.082247][ T894] snd_usb_pod 5-1:1.1: Line 6 Pocket POD now disconnected [ 547.110644][ T5942] usb 3-1: 0:2 : does not exist [ 547.171805][ T5942] usb 3-1: USB disconnect, device number 39 [ 547.203582][ T5890] udevd[5890]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card4/controlC4/../uevent} for writing: No such file or directory [ 547.418992][ T5942] usb 4-1: USB disconnect, device number 35 [ 547.682991][ T5942] usb 2-1: USB disconnect, device number 43 [ 548.088105][ T8950] xt_CT: You must specify a L4 protocol and not use inversions on it [ 548.702486][ T5982] usb 4-1: new high-speed USB device number 36 using dummy_hcd [ 548.962500][ T5982] usb 4-1: Using ep0 maxpacket: 16 [ 548.976044][ T5982] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 549.004072][ T5982] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 549.034589][ T5982] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 549.075329][ T5982] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 549.092425][ T5982] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 549.159688][ T5982] usb 4-1: Product: syz [ 549.184897][ T5982] usb 4-1: Manufacturer: syz [ 549.210666][ T5982] usb 4-1: SerialNumber: syz [ 549.243850][ T8970] netlink: 32 bytes leftover after parsing attributes in process `syz.4.810'. [ 549.447210][ T8975] netlink: 'syz.2.812': attribute type 1 has an invalid length. [ 549.543917][ T8979] netlink: 40 bytes leftover after parsing attributes in process `syz.2.812'. [ 549.581893][ T8978] netlink: 212336 bytes leftover after parsing attributes in process `syz.1.811'. [ 549.594617][ T5982] usb 4-1: 2:1 : format type 0 is detected, processed as PCM [ 549.611343][ T5982] usb 4-1: 2:1: cannot set freq 9338507 to ep 0x82 [ 549.702800][ T5982] usb 4-1: USB disconnect, device number 36 [ 549.946059][ T8982] nvme_fabrics: missing parameter 'transport=%s' [ 549.952839][ T8982] nvme_fabrics: missing parameter 'nqn=%s' [ 549.975808][ T8980] could not allocate digest TFM handle poly1305-generic [ 551.192994][ T9004] netlink: 4 bytes leftover after parsing attributes in process `syz.4.818'. [ 551.226646][ T9004] vlan3: entered allmulticast mode [ 551.245588][ T9004] bridge_slave_0: entered allmulticast mode [ 551.749542][ T9014] FAULT_INJECTION: forcing a failure. [ 551.749542][ T9014] name failslab, interval 1, probability 0, space 0, times 0 [ 551.771502][ T9014] CPU: 1 UID: 0 PID: 9014 Comm: syz.1.820 Tainted: G L syzkaller #0 PREEMPT(full) [ 551.771531][ T9014] Tainted: [L]=SOFTLOCKUP [ 551.771538][ T9014] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 551.771547][ T9014] Call Trace: [ 551.771553][ T9014] [ 551.771560][ T9014] dump_stack_lvl+0xe8/0x150 [ 551.771586][ T9014] should_fail_ex+0x412/0x560 [ 551.771609][ T9014] should_failslab+0xa8/0x100 [ 551.771629][ T9014] __kmalloc_noprof+0xde/0x7e0 [ 551.771645][ T9014] ? tomoyo_encode+0x28b/0x550 [ 551.771669][ T9014] tomoyo_encode+0x28b/0x550 [ 551.771694][ T9014] tomoyo_realpath_from_path+0x58d/0x5d0 [ 551.771717][ T9014] ? tomoyo_domain+0xd7/0x130 [ 551.771740][ T9014] ? tomoyo_path_number_perm+0x219/0x630 [ 551.771757][ T9014] tomoyo_path_number_perm+0x246/0x630 [ 551.771778][ T9014] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 551.771794][ T9014] ? __lock_acquire+0x6b5/0x2cf0 [ 551.771826][ T9014] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 551.771863][ T9014] ? __fget_files+0x2a/0x420 [ 551.771881][ T9014] ? __fget_files+0x2a/0x420 [ 551.771896][ T9014] ? __fget_files+0x3a0/0x420 [ 551.771911][ T9014] ? __fget_files+0x2a/0x420 [ 551.771933][ T9014] security_file_ioctl+0xc3/0x2a0 [ 551.771952][ T9014] __se_sys_ioctl+0x47/0x170 [ 551.771977][ T9014] do_syscall_64+0xe2/0xf80 [ 551.771995][ T9014] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 551.772011][ T9014] ? trace_irq_disable+0x37/0x100 [ 551.772026][ T9014] ? clear_bhb_loop+0x60/0xb0 [ 551.772044][ T9014] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 551.772060][ T9014] RIP: 0033:0x7f4ccf99aeb9 [ 551.772076][ T9014] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 551.772090][ T9014] RSP: 002b:00007f4cd0790028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 551.772108][ T9014] RAX: ffffffffffffffda RBX: 00007f4ccfc16180 RCX: 00007f4ccf99aeb9 [ 551.772120][ T9014] RDX: 0000200000000180 RSI: 0000000000005404 RDI: 0000000000000005 [ 551.772131][ T9014] RBP: 00007f4cd0790090 R08: 0000000000000000 R09: 0000000000000000 [ 551.772140][ T9014] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 551.772149][ T9014] R13: 00007f4ccfc16218 R14: 00007f4ccfc16180 R15: 00007f4ccfd3fa48 [ 551.772178][ T9014] [ 551.772202][ T9014] ERROR: Out of memory at tomoyo_realpath_from_path. [ 552.534344][ T5942] usb 1-1: new high-speed USB device number 38 using dummy_hcd [ 552.605188][ T9024] kernel profiling enabled (shift: 63) [ 552.611899][ T9024] profiling shift: 63 too large [ 553.132755][ T5942] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 553.140832][ T5942] usb 1-1: config 0 has no interface number 0 [ 553.410197][ T5942] usb 1-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 553.439784][ T5942] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 553.464624][ T5942] usb 1-1: Product: syz [ 553.651980][ T5942] usb 1-1: Manufacturer: syz [ 553.669424][ T5942] usb 1-1: SerialNumber: syz [ 553.750688][ T5942] usb 1-1: config 0 descriptor?? [ 553.779811][ T9037] x_tables: duplicate entry at hook 2 [ 553.903826][ T9036] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 553.969682][ T5942] usb 1-1: dvb_usb_v2: found a 'E3C EC168 reference design' in warm state [ 553.981806][ T5942] usb 1-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 554.021570][ T5942] dvbdev: DVB: registering new adapter (E3C EC168 reference design) [ 554.042082][ T5942] usb 1-1: media controller created [ 554.061547][ T9037] ip6tnl0: Caught tx_queue_len zero misconfig [ 554.381166][ T5942] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 554.604867][ T5942] i2c i2c-1: ec100: i2c rd failed=-71 reg=33 [ 554.652859][ T894] usb 4-1: new full-speed USB device number 37 using dummy_hcd [ 554.758411][ T5942] usb 1-1: USB disconnect, device number 38 [ 554.880127][ T894] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 554.942357][ T894] usb 4-1: New USB device found, idVendor=1286, idProduct=1fa4, bcdDevice=fb.16 [ 554.976377][ T894] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 554.991757][ T894] usb 4-1: Product: syz [ 554.996634][ T894] usb 4-1: Manufacturer: syz [ 555.001279][ T894] usb 4-1: SerialNumber: syz [ 555.036943][ T894] usb 4-1: config 0 descriptor?? [ 555.093705][ T894] mvusb_mdio 4-1:0.0: probe with driver mvusb_mdio failed with error -5 [ 555.301604][ T9036] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 555.364416][ T9036] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 555.455077][ T5942] usb 4-1: USB disconnect, device number 37 [ 556.623182][ T9078] netlink: 'syz.2.839': attribute type 1 has an invalid length. [ 556.719120][ T9078] 8021q: adding VLAN 0 to HW filter on device bond2 [ 556.770441][ T9082] netlink: 28 bytes leftover after parsing attributes in process `syz.2.839'. [ 556.799308][ T9082] bond2: entered allmulticast mode [ 557.049181][ T9090] af_packet: tpacket_rcv: packet too big, clamped from 1 to 4294967272. macoff=96 [ 558.062516][ T894] usb 2-1: new full-speed USB device number 44 using dummy_hcd [ 558.438759][ T5964] usb 3-1: new high-speed USB device number 40 using dummy_hcd [ 558.585641][ T894] usb 2-1: config 0 has an invalid interface number: 251 but max is 0 [ 558.596675][ T894] usb 2-1: config 0 has no interface number 0 [ 558.612535][ T5964] usb 3-1: Using ep0 maxpacket: 8 [ 558.619138][ T894] usb 2-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 558.628341][ T5964] usb 3-1: config 0 has an invalid interface number: 55 but max is 0 [ 558.628368][ T5964] usb 3-1: config 0 has no interface number 0 [ 558.628410][ T5964] usb 3-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 558.628433][ T5964] usb 3-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 558.628457][ T5964] usb 3-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 558.628483][ T5964] usb 3-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 558.628522][ T5964] usb 3-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 558.628555][ T5964] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 558.766547][ T894] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 558.780455][ T894] usb 2-1: Product: syz [ 558.800717][ T894] usb 2-1: Manufacturer: syz [ 558.811439][ T894] usb 2-1: SerialNumber: syz [ 558.820497][ T894] usb 2-1: config 0 descriptor?? [ 558.831367][ T5964] usb 3-1: config 0 descriptor?? [ 558.872825][ T5964] ldusb 3-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 559.391360][ T9105] ldusb 3-1:0.55: Write buffer overflow, 3776 bytes dropped [ 559.394944][ T5964] usb 3-1: USB disconnect, device number 40 [ 559.398992][ C1] ldusb 3-1:0.55: usb_submit_urb failed (-19) [ 559.515083][ T9105] ldusb 3-1:0.55: Couldn't submit interrupt_out_urb -19 [ 559.536301][ T5964] ldusb 3-1:0.55: LD USB Device #0 now disconnected [ 559.756053][ T894] asix 2-1:0.251 (unnamed net_device) (uninitialized): invalid PHY address: 193 [ 559.966844][ T894] usb 2-1: USB disconnect, device number 44 [ 561.265586][ T894] usb 3-1: new high-speed USB device number 41 using dummy_hcd [ 561.416261][ T9163] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 561.447537][ T894] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 561.460435][ T9163] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 561.524793][ T9163] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 561.535783][ T9163] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 561.590048][ T894] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 561.640475][ T894] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 561.665988][ T894] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 561.674287][ T5982] usb 2-1: new high-speed USB device number 45 using dummy_hcd [ 561.723762][ T894] usb 3-1: config 0 descriptor?? [ 561.751510][ T894] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 561.833603][ T5982] usb 2-1: device descriptor read/64, error -71 [ 561.998536][ T894] usb 3-1: USB disconnect, device number 41 [ 562.092774][ T5982] usb 2-1: new high-speed USB device number 46 using dummy_hcd [ 562.232667][ T5982] usb 2-1: device descriptor read/64, error -71 [ 562.408417][ T5982] usb usb2-port1: attempt power cycle [ 562.762637][ T5982] usb 2-1: new high-speed USB device number 47 using dummy_hcd [ 562.793379][ T5982] usb 2-1: device descriptor read/8, error -71 [ 562.995520][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 563.001993][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 563.032716][ T5982] usb 2-1: new high-speed USB device number 48 using dummy_hcd [ 563.053465][ T5982] usb 2-1: device descriptor read/8, error -71 [ 563.162869][ T5982] usb usb2-port1: unable to enumerate USB device [ 563.394380][ T9193] netlink: 48 bytes leftover after parsing attributes in process `syz.3.870'. [ 563.453571][ T9194] netlink: 132 bytes leftover after parsing attributes in process `syz.3.870'. [ 564.242127][ T9213] dlm: no locking on control device [ 564.421642][ T9218] netlink: 20 bytes leftover after parsing attributes in process `syz.1.881'. [ 564.431925][ T9218] netlink: 8 bytes leftover after parsing attributes in process `syz.1.881'. [ 564.812653][ T24] usb 3-1: new high-speed USB device number 42 using dummy_hcd [ 564.822216][ T9223] netlink: 12 bytes leftover after parsing attributes in process `syz.1.882'. [ 565.024374][ T9226] netlink: 'syz.1.882': attribute type 3 has an invalid length. [ 565.049433][ T24] usb 3-1: Using ep0 maxpacket: 32 [ 565.198534][ T24] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 565.228144][ T24] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 565.312552][ T5964] usb 2-1: new high-speed USB device number 49 using dummy_hcd [ 565.378652][ T24] usb 3-1: New USB device found, idVendor=0e41, idProduct=534d, bcdDevice=58.d6 [ 565.396763][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 565.414051][ T24] usb 3-1: Product: syz [ 565.452488][ T5964] usb 2-1: device descriptor read/64, error -71 [ 565.464070][ T24] usb 3-1: Manufacturer: syz [ 565.478496][ T24] usb 3-1: SerialNumber: syz [ 565.547779][ T24] usb 3-1: config 0 descriptor?? [ 565.702988][ T5964] usb 2-1: new high-speed USB device number 50 using dummy_hcd [ 565.814266][ T9232] netlink: 4 bytes leftover after parsing attributes in process `syz.0.883'. [ 565.842539][ T5964] usb 2-1: device descriptor read/64, error -71 [ 565.845971][ T9232] vlan2: entered allmulticast mode [ 565.865511][ T9232] bridge_slave_0: entered allmulticast mode [ 566.265803][ T9220] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 566.306397][ T5964] usb usb2-port1: attempt power cycle [ 566.335187][ T9220] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 566.673179][ T5964] usb 2-1: new high-speed USB device number 51 using dummy_hcd [ 566.713580][ T5964] usb 2-1: device descriptor read/8, error -71 [ 566.952485][ T5964] usb 2-1: new high-speed USB device number 52 using dummy_hcd [ 566.973242][ T5964] usb 2-1: device descriptor read/8, error -71 [ 567.092996][ T5964] usb usb2-port1: unable to enumerate USB device [ 567.728723][ T5942] usb 3-1: USB disconnect, device number 42 [ 568.076137][ T30] kauditd_printk_skb: 6 callbacks suppressed [ 568.076182][ T30] audit: type=1804 audit(1769908818.027:180): pid=9249 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.887" name="file0" dev="ramfs" ino=28417 res=1 errno=0 [ 568.145808][ T30] audit: type=1400 audit(1769908818.067:181): apparmor="DENIED" operation="setprocattr" info="invalid" error=-22 profile="unconfined" pid=9250 comm="syz.3.888" [ 568.202590][ T9256] rtc_cmos 00:00: Alarms can be up to one day in the future [ 568.634555][ T9261] binder: 9257:9261 ioctl 40044591 0 returned -22 [ 568.688063][ T9266] netlink: 4 bytes leftover after parsing attributes in process `syz.0.893'. [ 568.732049][ T9258] binder: 9257:9258 ioctl c0306201 200000000040 returned -14 [ 568.822517][ T5942] usb 5-1: new high-speed USB device number 43 using dummy_hcd [ 568.874844][ T9261] netlink: 104 bytes leftover after parsing attributes in process `syz.2.890'. [ 568.925099][ T9275] dlm: no locking on control device [ 568.992634][ T5942] usb 5-1: Using ep0 maxpacket: 32 [ 569.013982][ T5942] usb 5-1: too many configurations: 177, using maximum allowed: 8 [ 569.035566][ T5942] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 569.058039][ T5942] usb 5-1: can't read configurations, error -61 [ 569.212536][ T5942] usb 5-1: new high-speed USB device number 44 using dummy_hcd [ 569.372692][ T5935] usb 2-1: new high-speed USB device number 53 using dummy_hcd [ 569.402822][ T5942] usb 5-1: Using ep0 maxpacket: 32 [ 569.408728][ T5942] usb 5-1: too many configurations: 177, using maximum allowed: 8 [ 569.420240][ T5942] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 569.430131][ T5942] usb 5-1: can't read configurations, error -61 [ 569.437019][ T5942] usb usb5-port1: attempt power cycle [ 569.562461][ T5935] usb 2-1: Using ep0 maxpacket: 32 [ 570.042565][ T5942] usb 5-1: new high-speed USB device number 45 using dummy_hcd [ 570.057934][ T5935] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 570.073170][ T5942] usb 5-1: Using ep0 maxpacket: 32 [ 570.084838][ T5942] usb 5-1: too many configurations: 177, using maximum allowed: 8 [ 570.096666][ T5935] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 570.121890][ T5942] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 570.138011][ T5942] usb 5-1: can't read configurations, error -61 [ 570.161894][ T5935] usb 2-1: New USB device found, idVendor=0e41, idProduct=534d, bcdDevice=58.d6 [ 570.185024][ T5935] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 570.202826][ T5935] usb 2-1: Product: syz [ 570.214001][ T5935] usb 2-1: Manufacturer: syz [ 570.286037][ T5935] usb 2-1: SerialNumber: syz [ 570.308719][ T5942] usb 5-1: new high-speed USB device number 46 using dummy_hcd [ 570.362277][ T5942] usb 5-1: Using ep0 maxpacket: 32 [ 570.373266][ T5935] usb 2-1: config 0 descriptor?? [ 570.381883][ T5942] usb 5-1: too many configurations: 177, using maximum allowed: 8 [ 570.526975][ T5942] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 570.535264][ T9294] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(6) [ 570.542083][ T9294] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 570.542523][ T5942] usb 5-1: can't read configurations, error -61 [ 570.553255][ T9294] vhci_hcd vhci_hcd.0: Device attached [ 570.573161][ T9294] vhci_hcd vhci_hcd.0: port 0 already used [ 570.587554][ T5942] usb usb5-port1: unable to enumerate USB device [ 570.596234][ T9296] vhci_hcd: connection closed [ 570.596585][ T5909] vhci_hcd vhci_hcd.2: stop threads [ 570.609112][ T5909] vhci_hcd vhci_hcd.2: release socket [ 570.647843][ T9279] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 570.662190][ T9279] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 570.719999][ T5909] vhci_hcd vhci_hcd.2: disconnect device [ 570.962699][ T5942] usb 4-1: new high-speed USB device number 38 using dummy_hcd [ 571.183814][ T5942] usb 4-1: Using ep0 maxpacket: 32 [ 571.219007][ T5942] usb 4-1: config 4 has an invalid interface number: 128 but max is 0 [ 571.227361][ T5942] usb 4-1: config 4 has no interface number 0 [ 571.233655][ T5942] usb 4-1: config 4 interface 128 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 571.252757][ T5942] usb 4-1: config 4 interface 128 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 571.272787][ T5942] usb 4-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 571.304731][ T5942] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 571.337376][ T5942] hub 4-1:4.128: USB hub found [ 571.537577][ T9301] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 571.551891][ T9301] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 571.571046][ T5942] hub 4-1:4.128: 2 ports detected [ 571.587548][ T5942] hub 4-1:4.128: Using single TT (err -22) [ 572.065243][ T5942] usb 4-1: USB disconnect, device number 38 [ 572.124476][ T5982] usb 3-1: new high-speed USB device number 43 using dummy_hcd [ 572.142478][ T5935] usb 5-1: new high-speed USB device number 47 using dummy_hcd [ 572.292461][ T5935] usb 5-1: device descriptor read/64, error -71 [ 572.300224][ T894] usb 2-1: USB disconnect, device number 53 [ 572.319686][ T5982] usb 3-1: config 0 has no interfaces? [ 572.339655][ T5982] usb 3-1: New USB device found, idVendor=05ac, idProduct=1290, bcdDevice=dc.1b [ 572.384480][ T5982] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 572.395746][ T5982] apple-mfi-fastcharge 3-1: config 0 descriptor?? [ 572.552556][ T5935] usb 5-1: new high-speed USB device number 48 using dummy_hcd [ 572.727761][ T5942] apple-mfi-fastcharge 3-1: USB disconnect, device number 43 [ 572.851577][ T5935] usb 5-1: device descriptor read/64, error -71 [ 573.085170][ T5935] usb usb5-port1: attempt power cycle [ 573.442505][ T5935] usb 5-1: new high-speed USB device number 49 using dummy_hcd [ 573.464101][ T5935] usb 5-1: device descriptor read/8, error -71 [ 573.833879][ T5935] usb 5-1: new high-speed USB device number 50 using dummy_hcd [ 573.893717][ T5935] usb 5-1: device descriptor read/8, error -71 [ 574.136114][ T5935] usb usb5-port1: unable to enumerate USB device [ 574.422121][ T9344] GUP no longer grows the stack in syz.0.914 (9344): 200000004000-200000005000 (200000001000) [ 574.422297][ T9344] CPU: 0 UID: 0 PID: 9344 Comm: syz.0.914 Tainted: G L syzkaller #0 PREEMPT(full) [ 574.422319][ T9344] Tainted: [L]=SOFTLOCKUP [ 574.422325][ T9344] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 574.422335][ T9344] Call Trace: [ 574.422341][ T9344] [ 574.422349][ T9344] dump_stack_lvl+0xe8/0x150 [ 574.422378][ T9344] __get_user_pages+0x2453/0x29d0 [ 574.422417][ T9344] ? __gup_longterm_locked+0xc4e/0x1630 [ 574.422439][ T9344] ? down_read_killable+0x1bb/0x340 [ 574.422458][ T9344] ? try_get_folio+0xec/0x650 [ 574.422483][ T9344] __gup_longterm_locked+0xdcf/0x1630 [ 574.422528][ T9344] gup_fast_fallback+0x1d82/0x22e0 [ 574.422580][ T9344] ? __pfx_gup_fast_fallback+0x10/0x10 [ 574.422604][ T9344] ? is_valid_gup_args+0x11f/0x200 [ 574.422632][ T9344] ? get_user_pages_fast+0x4d/0xb0 [ 574.422656][ T9344] __iov_iter_get_pages_alloc+0x3b6/0xb10 [ 574.422684][ T9344] ? __pfx_pipe_clear_nowait+0x10/0x10 [ 574.422707][ T9344] iov_iter_get_pages2+0x5e/0xa0 [ 574.422732][ T9344] __se_sys_vmsplice+0x7b3/0x1490 [ 574.422806][ T9344] ? __pfx___se_sys_vmsplice+0x10/0x10 [ 574.422825][ T9344] ? __pfx_futex_wait+0x10/0x10 [ 574.422904][ T9344] do_syscall_64+0xe2/0xf80 [ 574.422921][ T9344] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 574.422937][ T9344] ? trace_irq_disable+0x37/0x100 [ 574.422950][ T9344] ? clear_bhb_loop+0x60/0xb0 [ 574.422970][ T9344] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 574.422986][ T9344] RIP: 0033:0x7f139bd9aeb9 [ 574.423002][ T9344] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 574.423026][ T9344] RSP: 002b:00007f139cc7d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000116 [ 574.423045][ T9344] RAX: ffffffffffffffda RBX: 00007f139c015fa0 RCX: 00007f139bd9aeb9 [ 574.423057][ T9344] RDX: 0000000000000001 RSI: 0000200000000140 RDI: 0000000000000006 [ 574.423068][ T9344] RBP: 00007f139be08c1f R08: 0000000000000000 R09: 0000000000000000 [ 574.423079][ T9344] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 574.423090][ T9344] R13: 00007f139c016038 R14: 00007f139c015fa0 R15: 00007f139c13fa48 [ 574.423120][ T9344] [ 575.054154][ T9351] fuse: Bad value for 'fd' [ 575.058746][ T9352] fuse: Bad value for 'fd' [ 575.076473][ T9351] binder: 9350:9351 ioctl 4018620d 200000004a80 returned -22 [ 575.426744][ T9354] xt_hashlimit: size too large, truncated to 1048576 [ 575.516608][ T9356] dlm: no locking on control device [ 575.905653][ T24] hid-generic 0000:0000:0000.0009: unknown main item tag 0x0 [ 575.968668][ T24] hid-generic 0000:0000:0000.0009: hidraw0: HID v0.00 Device [syz1] on syz0 [ 576.082549][ T5964] usb 3-1: new high-speed USB device number 44 using dummy_hcd [ 576.119201][ T9376] syz_tun: entered allmulticast mode [ 576.289028][ T5964] usb 3-1: Using ep0 maxpacket: 32 [ 576.314721][ T5964] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 576.336778][ T9381] kvm: vcpu 2: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (200000 ns). Using initial count to start timer. [ 576.359365][ T5964] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 576.394390][ T5964] usb 3-1: New USB device found, idVendor=0e41, idProduct=534d, bcdDevice=58.d6 [ 576.408129][ T9380] syz_tun: left allmulticast mode [ 576.420131][ T5964] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 576.473742][ T5964] usb 3-1: Product: syz [ 576.551864][ T5964] usb 3-1: Manufacturer: syz [ 576.579872][ T5964] usb 3-1: SerialNumber: syz [ 577.002038][ T5964] usb 3-1: config 0 descriptor?? [ 577.236349][ T9363] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 577.263516][ T9363] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 578.082535][ T5964] usb 4-1: new high-speed USB device number 39 using dummy_hcd [ 578.276324][ T5964] usb 4-1: config 0 has an invalid interface number: 255 but max is 0 [ 578.286268][ T5964] usb 4-1: config 0 has no interface number 0 [ 578.293641][ T5964] usb 4-1: New USB device found, idVendor=0733, idProduct=0401, bcdDevice=ad.7d [ 578.303349][ T5964] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 578.389688][ T5982] usb 2-1: new high-speed USB device number 54 using dummy_hcd [ 578.520656][ T5964] usb 4-1: config 0 descriptor?? [ 578.663032][ T5982] usb 2-1: Using ep0 maxpacket: 32 [ 578.674707][ T5982] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 578.682653][ T5964] gspca_main: spca501-2.14.0 probing 0733:0401 [ 578.699782][ T5982] usb 2-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 578.726540][ T5982] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 578.758137][ T5982] usb 2-1: config 0 descriptor?? [ 578.778957][ T5942] usb 3-1: USB disconnect, device number 44 [ 578.818116][ T5982] hub 2-1:0.0: bad descriptor, ignoring hub [ 578.847228][ T5982] hub 2-1:0.0: probe with driver hub failed with error -5 [ 578.887082][ T5982] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 579.052916][ T9404] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 579.122126][ T9404] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 579.135116][ T5964] gspca_spca501: reg write: error -71 [ 579.141058][ T5964] spca501 4-1:0.255: Reg write failed for 0x00,0x02,0x01 [ 579.180794][ T5964] spca501 4-1:0.255: probe with driver spca501 failed with error -22 [ 579.184109][ T9404] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 579.232229][ T9404] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 579.271265][ T5964] usb 4-1: USB disconnect, device number 39 [ 579.373007][ T894] usb 2-1: USB disconnect, device number 54 [ 579.743335][ T9425] tipc: Started in network mode [ 579.748439][ T9425] tipc: Node identity 5a6664391d68, cluster identity 4711 [ 579.756004][ T9425] tipc: Enabled bearer , priority 0 [ 579.768013][ T9425] syzkaller0: entered promiscuous mode [ 579.782650][ T9425] syzkaller0: entered allmulticast mode [ 579.800123][ T9425] tipc: Resetting bearer [ 579.863360][ T9425] tipc: Disabling bearer [ 580.012504][ T5942] usb 5-1: new high-speed USB device number 51 using dummy_hcd [ 580.144392][ T5982] usb 4-1: new high-speed USB device number 40 using dummy_hcd [ 580.162551][ T5942] usb 5-1: Using ep0 maxpacket: 16 [ 580.188281][ T5942] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 580.209313][ T5942] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 580.338719][ T5942] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 580.350697][ T5942] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 580.469319][ T5942] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 580.515415][ T5982] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 580.534327][ T5942] usb 5-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 580.536154][ T5982] usb 4-1: config 0 interface 0 has no altsetting 0 [ 580.572797][ T5942] usb 5-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 580.595493][ T5982] usb 4-1: New USB device found, idVendor=10fd, idProduct=1513, bcdDevice=7e.ce [ 580.599527][ T5942] usb 5-1: Manufacturer: syz [ 580.653406][ T5942] usb 5-1: config 0 descriptor?? [ 580.672264][ T5982] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 580.696697][ T5982] usb 4-1: Product: syz [ 580.710038][ T5982] usb 4-1: Manufacturer: syz [ 580.721059][ T5982] usb 4-1: SerialNumber: syz [ 580.731840][ T5982] usb 4-1: config 0 descriptor?? [ 580.786277][ T5982] dvb-usb: found a 'MSI DIGI VOX mini II DVB-T USB2.0' in warm state. [ 580.813460][ T5982] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 580.837927][ T5982] dvbdev: DVB: registering new adapter (MSI DIGI VOX mini II DVB-T USB2.0) [ 580.885009][ T5982] usb 4-1: media controller created [ 580.947999][ T5982] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 581.013642][ T5942] rc_core: IR keymap rc-hauppauge not found [ 581.025600][ T5942] Registered IR keymap rc-empty [ 581.049542][ T5942] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 581.261359][ T5942] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 581.332159][ T5942] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0 [ 581.413770][ T9454] Cannot find add_set index 2 as target [ 581.443702][ T5942] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0/input16 [ 581.479303][ T5942] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 581.500537][ T5982] DVB: Unable to find symbol tda10046_attach() [ 581.510880][ T5982] dvb-usb: no frontend was attached by 'MSI DIGI VOX mini II DVB-T USB2.0' [ 581.528682][ T5942] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 581.553140][ T5942] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 581.568851][ T5982] dvb-usb: MSI DIGI VOX mini II DVB-T USB2.0 successfully initialized and connected. [ 581.582639][ T5942] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 581.623015][ T5942] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 581.662815][ T5942] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 581.694068][ T5942] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 581.758773][ T5942] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 581.783136][ T5942] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 581.814956][ T5942] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 581.939578][ T5942] mceusb 5-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 582.010579][ T5942] mceusb 5-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 582.062959][ T5942] usb 5-1: USB disconnect, device number 51 [ 582.545629][ T9431] tipc: Failed to remove unknown binding: 66,1,1/0:1028338717/1028338719 [ 582.559156][ T9431] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 582.576509][ T9466] syzkaller0: entered promiscuous mode [ 582.582057][ T9466] syzkaller0: entered allmulticast mode [ 582.589149][ T9431] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 584.287249][ T5950] usb 1-1: new high-speed USB device number 39 using dummy_hcd [ 584.351980][ T5982] dvb_usb_m920x 4-1:0.0: probe with driver dvb_usb_m920x failed with error -110 [ 584.514647][ T5950] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 584.533209][ T5950] usb 1-1: config 0 has no interface number 0 [ 584.546253][ T5950] usb 1-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 584.628352][ T9493] netlink: 212376 bytes leftover after parsing attributes in process `syz.1.951'. [ 584.663577][ T5950] usb 1-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 584.673709][ T5950] usb 1-1: config 0 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 584.692598][ T5950] usb 1-1: New USB device found, idVendor=28bd, idProduct=0042, bcdDevice= 0.00 [ 584.724353][ T5950] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 584.944185][ T894] usb 4-1: USB disconnect, device number 40 [ 584.982213][ T5950] usb 1-1: config 0 descriptor?? [ 585.224429][ T9491] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 585.233346][ T9491] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 585.242065][ T9491] netlink: 'syz.0.954': attribute type 21 has an invalid length. [ 585.302837][ T9491] netlink: 128 bytes leftover after parsing attributes in process `syz.0.954'. [ 585.703166][ T9502] netlink: 212368 bytes leftover after parsing attributes in process `syz.2.956'. [ 585.932219][ T5942] IPVS: starting estimator thread 0... [ 586.064397][ T9510] IPVS: using max 35 ests per chain, 84000 per kthread [ 586.562499][ T6898] usb 4-1: new high-speed USB device number 41 using dummy_hcd [ 586.690836][ T9520] netlink: 28 bytes leftover after parsing attributes in process `syz.2.960'. [ 586.746795][ T6898] usb 4-1: New USB device found, idVendor=055f, idProduct=c420, bcdDevice=6a.33 [ 586.756144][ T6898] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 586.775120][ T6898] usb 4-1: config 0 descriptor?? [ 586.790914][ T6898] gspca_main: sunplus-2.14.0 probing 055f:c420 [ 586.995887][ T9515] netlink: 'syz.3.959': attribute type 1 has an invalid length. [ 587.019098][ T6898] gspca_sunplus: reg_w_riv err -71 [ 587.025770][ T6898] sunplus 4-1:0.0: probe with driver sunplus failed with error -71 [ 587.053775][ T6898] usb 4-1: USB disconnect, device number 41 [ 587.126285][ T9491] netlink: 'syz.0.954': attribute type 4 has an invalid length. [ 587.134375][ T9491] netlink: 'syz.0.954': attribute type 3 has an invalid length. [ 587.142062][ T9491] netlink: 3 bytes leftover after parsing attributes in process `syz.0.954'. [ 587.373896][ T5950] usbhid 1-1:0.1: can't add hid device: -71 [ 587.408728][ T5950] usbhid 1-1:0.1: probe with driver usbhid failed with error -71 [ 587.447396][ T5950] usb 1-1: USB disconnect, device number 39 [ 587.848742][ T894] usb 3-1: new high-speed USB device number 45 using dummy_hcd [ 588.072587][ T894] usb 3-1: Using ep0 maxpacket: 16 [ 588.204556][ T894] usb 3-1: config 0 has an invalid interface number: 129 but max is 0 [ 588.232627][ T894] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 588.262496][ T894] usb 3-1: config 0 has no interface number 0 [ 588.268617][ T894] usb 3-1: config 0 interface 129 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 588.331035][ T894] usb 3-1: New USB device found, idVendor=19d2, idProduct=1165, bcdDevice=c1.d5 [ 588.360723][ T894] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 588.391934][ T894] usb 3-1: Product: syz [ 588.412119][ T894] usb 3-1: Manufacturer: syz [ 588.422334][ T894] usb 3-1: SerialNumber: syz [ 588.429636][ T894] usb 3-1: config 0 descriptor?? [ 588.450368][ T894] option 3-1:0.129: GSM modem (1-port) converter detected [ 590.067671][ T9561] binder: 9557:9561 ioctl c0045006 0 returned -22 [ 590.293741][ T9559] syzkaller0: entered promiscuous mode [ 590.342154][ T9559] syzkaller0: entered allmulticast mode [ 590.481918][ T894] usb 1-1: new high-speed USB device number 40 using dummy_hcd [ 590.517496][ T5950] usb 3-1: USB disconnect, device number 45 [ 590.525506][ T5950] option 3-1:0.129: device disconnected [ 590.555021][ T9559] bond1: option broadcast_neighbor: mode dependency failed, not supported in mode balance-rr(0) [ 590.595028][ T9559] bond1 (unregistering): Released all slaves [ 590.640461][ T9568] fuse: Invalid uid '00000000000000000003' [ 590.652989][ T894] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 590.671260][ T894] usb 1-1: config 0 has no interface number 0 [ 590.687789][ T9570] netlink: 'syz.3.975': attribute type 62 has an invalid length. [ 590.709465][ T894] usb 1-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 590.719278][ T894] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 590.730461][ T894] usb 1-1: Product: syz [ 590.734952][ T894] usb 1-1: Manufacturer: syz [ 590.739559][ T894] usb 1-1: SerialNumber: syz [ 590.778279][ T9573] netlink: 8 bytes leftover after parsing attributes in process `syz.1.976'. [ 590.815703][ T894] usb 1-1: config 0 descriptor?? [ 591.012322][ T9576] program syz.3.978 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 591.054435][ T894] dvb_usb_ec168 1-1:0.1: probe with driver dvb_usb_ec168 failed with error -71 [ 591.108193][ T894] usb 1-1: USB disconnect, device number 40 [ 591.541367][ T9594] netlink: 16 bytes leftover after parsing attributes in process `syz.3.982'. [ 591.560179][ T9594] netlink: 12 bytes leftover after parsing attributes in process `syz.3.982'. [ 591.585854][ T9594] netlink: 12 bytes leftover after parsing attributes in process `syz.3.982'. [ 591.765044][ T9599] netlink: 76 bytes leftover after parsing attributes in process `syz.3.985'. [ 591.787851][ T30] audit: type=1326 audit(1769908841.747:182): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9602 comm="syz.0.986" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f139bd9aeb9 code=0x0 [ 593.105906][ T30] audit: type=1326 audit(1769908843.067:183): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9620 comm="syz.4.989" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fa79719aeb9 code=0x0 [ 593.444111][ T9628] FAULT_INJECTION: forcing a failure. [ 593.444111][ T9628] name failslab, interval 1, probability 0, space 0, times 0 [ 593.456985][ T6898] usb 1-1: new high-speed USB device number 41 using dummy_hcd [ 593.547490][ T9628] CPU: 0 UID: 0 PID: 9628 Comm: syz.3.991 Tainted: G L syzkaller #0 PREEMPT(full) [ 593.547520][ T9628] Tainted: [L]=SOFTLOCKUP [ 593.547526][ T9628] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 593.547537][ T9628] Call Trace: [ 593.547544][ T9628] [ 593.547552][ T9628] dump_stack_lvl+0xe8/0x150 [ 593.547579][ T9628] should_fail_ex+0x412/0x560 [ 593.547603][ T9628] should_failslab+0xa8/0x100 [ 593.547624][ T9628] kmem_cache_alloc_node_noprof+0x8b/0x6f0 [ 593.547648][ T9628] ? __alloc_skb+0x193/0x390 [ 593.547667][ T9628] ? __alloc_skb+0x1d7/0x390 [ 593.547683][ T9628] ? __local_bh_enable_ip+0xd0/0x130 [ 593.547700][ T9628] ? __alloc_skb+0x193/0x390 [ 593.547719][ T9628] __alloc_skb+0x1d7/0x390 [ 593.547742][ T9628] alloc_skb_with_frags+0xca/0x890 [ 593.547763][ T9628] ? __lock_acquire+0x6b5/0x2cf0 [ 593.547795][ T9628] sock_alloc_send_pskb+0x878/0x990 [ 593.547833][ T9628] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 593.547858][ T9628] ? sock_def_readable+0xae/0x530 [ 593.547878][ T9628] ? bpf_lsm_socket_getpeersec_dgram+0x9/0x20 [ 593.547902][ T9628] unix_dgram_sendmsg+0x460/0x18e0 [ 593.547943][ T9628] ? __pfx_unix_dgram_sendmsg+0x10/0x10 [ 593.547960][ T9628] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 593.547986][ T9628] ? count_memcg_event_mm+0x21/0x260 [ 593.548009][ T9628] ? unix_seqpacket_sendmsg+0x111/0x1e0 [ 593.548030][ T9628] ? __pfx_unix_seqpacket_sendmsg+0x10/0x10 [ 593.548047][ T9628] ____sys_sendmsg+0xa68/0xad0 [ 593.548069][ T9628] ? __might_fault+0xaf/0x130 [ 593.548104][ T9628] ? __pfx_____sys_sendmsg+0x10/0x10 [ 593.548133][ T9628] ? import_iovec+0x73/0xa0 [ 593.548158][ T9628] ___sys_sendmsg+0x2a5/0x360 [ 593.548184][ T9628] ? __pfx____sys_sendmsg+0x10/0x10 [ 593.548202][ T9628] ? __lock_acquire+0x6b5/0x2cf0 [ 593.548267][ T9628] __sys_sendmmsg+0x27c/0x4e0 [ 593.548293][ T9628] ? __pfx___sys_sendmmsg+0x10/0x10 [ 593.548312][ T9628] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 593.548353][ T9628] ? ksys_write+0x242/0x270 [ 593.548378][ T9628] ? __pfx_ksys_write+0x10/0x10 [ 593.548406][ T9628] __x64_sys_sendmmsg+0xa0/0xc0 [ 593.548429][ T9628] do_syscall_64+0xe2/0xf80 [ 593.548446][ T9628] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 593.548463][ T9628] ? trace_irq_disable+0x37/0x100 [ 593.548483][ T9628] ? clear_bhb_loop+0x60/0xb0 [ 593.548503][ T9628] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 593.548520][ T9628] RIP: 0033:0x7ff2f039aeb9 [ 593.548536][ T9628] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 593.548550][ T9628] RSP: 002b:00007ff2f12be028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 593.548569][ T9628] RAX: ffffffffffffffda RBX: 00007ff2f0615fa0 RCX: 00007ff2f039aeb9 [ 593.548582][ T9628] RDX: 0400000000000159 RSI: 0000200000001c00 RDI: 0000000000000003 [ 593.548594][ T9628] RBP: 00007ff2f12be090 R08: 0000000000000000 R09: 0000000000000000 [ 593.548604][ T9628] R10: 0000000000040840 R11: 0000000000000246 R12: 0000000000000002 [ 593.548614][ T9628] R13: 00007ff2f0616038 R14: 00007ff2f0615fa0 R15: 00007ff2f073fa48 [ 593.548642][ T9628] [ 594.037371][ T6898] usb 1-1: Using ep0 maxpacket: 32 [ 594.044575][ T6898] usb 1-1: config 0 has an invalid interface number: 89 but max is 0 [ 594.052864][ T6898] usb 1-1: config 0 has no interface number 0 [ 594.059057][ T6898] usb 1-1: config 0 interface 89 has no altsetting 0 [ 594.093887][ T6898] usb 1-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4e [ 594.104705][ T6898] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 594.113435][ T6898] usb 1-1: Product: syz [ 594.117714][ T6898] usb 1-1: Manufacturer: syz [ 594.122323][ T6898] usb 1-1: SerialNumber: syz [ 594.129778][ T6898] usb 1-1: config 0 descriptor?? [ 594.151162][ T6898] em28xx 1-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 594.170005][ T6898] em28xx 1-1:0.89: Video interface 89 found: bulk [ 594.346778][ T9639] FAULT_INJECTION: forcing a failure. [ 594.346778][ T9639] name failslab, interval 1, probability 0, space 0, times 0 [ 594.387951][ T9639] CPU: 1 UID: 0 PID: 9639 Comm: syz.1.994 Tainted: G L syzkaller #0 PREEMPT(full) [ 594.387982][ T9639] Tainted: [L]=SOFTLOCKUP [ 594.387989][ T9639] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 594.388000][ T9639] Call Trace: [ 594.388007][ T9639] [ 594.388015][ T9639] dump_stack_lvl+0xe8/0x150 [ 594.388043][ T9639] should_fail_ex+0x412/0x560 [ 594.388069][ T9639] should_failslab+0xa8/0x100 [ 594.388089][ T9639] kmem_cache_alloc_node_noprof+0x8b/0x6f0 [ 594.388125][ T9639] ? __alloc_skb+0x1d7/0x390 [ 594.388142][ T9639] ? __local_bh_enable_ip+0xd0/0x130 [ 594.388160][ T9639] ? __alloc_skb+0x193/0x390 [ 594.388180][ T9639] __alloc_skb+0x1d7/0x390 [ 594.388202][ T9639] netlink_dump+0x1ef/0xe80 [ 594.388231][ T9639] ? __pfx_netlink_dump+0x10/0x10 [ 594.388246][ T9639] ? __kasan_kmalloc+0x93/0xb0 [ 594.388280][ T9639] ? netlink_lookup+0x30/0x200 [ 594.388295][ T9639] ? netlink_lookup+0x30/0x200 [ 594.388316][ T9639] __netlink_dump_start+0x5cb/0x7e0 [ 594.388342][ T9639] inet_diag_rcv_msg_compat+0x214/0x420 [ 594.388368][ T9639] ? __pfx_inet_diag_rcv_msg_compat+0x10/0x10 [ 594.388394][ T9639] ? sock_diag_rcv_msg+0x188/0x600 [ 594.388414][ T9639] ? __pfx_inet_diag_dump_start_compat+0x10/0x10 [ 594.388434][ T9639] ? __pfx_inet_diag_dump_compat+0x10/0x10 [ 594.388454][ T9639] ? __pfx_inet_diag_dump_done+0x10/0x10 [ 594.388480][ T9639] ? sock_diag_rcv_msg+0x188/0x600 [ 594.388502][ T9639] sock_diag_rcv_msg+0x4cc/0x600 [ 594.388525][ T9639] netlink_rcv_skb+0x232/0x4b0 [ 594.388543][ T9639] ? __pfx_sock_diag_rcv_msg+0x10/0x10 [ 594.388563][ T9639] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 594.388591][ T9639] ? netlink_deliver_tap+0x2e/0x1b0 [ 594.388616][ T9639] netlink_unicast+0x80f/0x9b0 [ 594.388649][ T9639] ? __pfx_netlink_unicast+0x10/0x10 [ 594.388670][ T9639] ? __alloc_skb+0x193/0x390 [ 594.388689][ T9639] ? netlink_sendmsg+0x650/0xb40 [ 594.388705][ T9639] ? skb_put+0x11b/0x210 [ 594.388727][ T9639] netlink_sendmsg+0x813/0xb40 [ 594.388753][ T9639] ? __pfx_netlink_sendmsg+0x10/0x10 [ 594.388773][ T9639] ? __fget_files+0x2a/0x420 [ 594.388790][ T9639] ? aa_sock_msg_perm+0xf1/0x1b0 [ 594.388812][ T9639] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 594.388833][ T9639] __sys_sendto+0x709/0x7a0 [ 594.388855][ T9639] ? __pfx___sys_sendto+0x10/0x10 [ 594.388873][ T9639] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 594.388904][ T9639] ? __fget_files+0x3a0/0x420 [ 594.388932][ T9639] ? ksys_write+0x242/0x270 [ 594.388956][ T9639] ? __pfx_ksys_write+0x10/0x10 [ 594.388983][ T9639] __x64_sys_sendto+0xde/0x100 [ 594.389006][ T9639] do_syscall_64+0xe2/0xf80 [ 594.389024][ T9639] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 594.389040][ T9639] ? trace_irq_disable+0x37/0x100 [ 594.389056][ T9639] ? clear_bhb_loop+0x60/0xb0 [ 594.389076][ T9639] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 594.389093][ T9639] RIP: 0033:0x7f4ccf99aeb9 [ 594.389115][ T9639] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 594.389129][ T9639] RSP: 002b:00007f4cd07b1028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 594.389148][ T9639] RAX: ffffffffffffffda RBX: 00007f4ccfc16090 RCX: 00007f4ccf99aeb9 [ 594.389161][ T9639] RDX: 000000000000004c RSI: 0000200000000080 RDI: 0000000000000003 [ 594.389172][ T9639] RBP: 00007f4cd07b1090 R08: 0000000000000000 R09: 0000000000000000 [ 594.389183][ T9639] R10: 0000000000000810 R11: 0000000000000246 R12: 0000000000000001 [ 594.389193][ T9639] R13: 00007f4ccfc16128 R14: 00007f4ccfc16090 R15: 00007f4ccfd3fa48 [ 594.389223][ T9639] [ 594.979499][ T9648] batman_adv: batadv0: Adding interface: dummy0 [ 594.988122][ T9648] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 594.994272][ T6898] em28xx 1-1:0.89: unknown em28xx chip ID (0) [ 595.036134][ T9648] batman_adv: batadv0: Interface activated: dummy0 [ 595.065156][ T9651] batadv0: mtu less than device minimum [ 595.110334][ T5935] usb 2-1: new high-speed USB device number 55 using dummy_hcd [ 595.131923][ T9651] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 595.144073][ T9651] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 595.155957][ T9651] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 595.167732][ T9651] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 595.179544][ T9651] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 595.191366][ T9651] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 595.203242][ T9651] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 595.215027][ T9651] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 595.226874][ T9651] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 595.372449][ T5935] usb 2-1: Using ep0 maxpacket: 16 [ 595.381201][ T5935] usb 2-1: config 1 has an invalid interface number: 214 but max is 0 [ 595.389834][ T5935] usb 2-1: config 1 has no interface number 0 [ 595.414581][ T5935] usb 2-1: config 1 interface 214 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 16 [ 595.491835][ T5935] usb 2-1: config 1 interface 214 altsetting 2 bulk endpoint 0x81 has invalid maxpacket 64 [ 595.522259][ T5935] usb 2-1: config 1 interface 214 has no altsetting 0 [ 595.541116][ T5935] usb 2-1: New USB device found, idVendor=07b4, idProduct=010a, bcdDevice= 1.02 [ 595.552224][ T5935] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 595.571184][ T5935] usb 2-1: Product: syz [ 595.578309][ T5935] usb 2-1: Manufacturer: syz [ 595.598147][ T5935] usb 2-1: SerialNumber: syz [ 595.618139][ T9644] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 595.625766][ T9644] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 595.634118][ T6898] em28xx 1-1:0.89: reading from i2c device at 0xa0 failed (error=-5) [ 595.643811][ T5964] usb 5-1: new high-speed USB device number 52 using dummy_hcd [ 595.653163][ T6898] em28xx 1-1:0.89: board has no eeprom [ 595.663578][ T5935] ums-alauda 2-1:1.214: USB Mass Storage device detected [ 595.697153][ T5935] scsi host1: usb-storage 2-1:1.214 [ 595.795730][ T5964] usb 5-1: device descriptor read/64, error -71 [ 595.980110][ T5935] usb 2-1: USB disconnect, device number 55 [ 596.009302][ T6898] em28xx 1-1:0.89: Identified as Terratec Grabby (card=67) [ 596.024105][ T6898] em28xx 1-1:0.89: analog set to bulk mode. [ 596.042580][ T9] em28xx 1-1:0.89: Registering V4L2 extension [ 596.063205][ T5964] usb 5-1: new high-speed USB device number 53 using dummy_hcd [ 596.214112][ T5964] usb 5-1: device descriptor read/64, error -71 [ 596.234306][ T9] em28xx 1-1:0.89: reading from i2c device at 0x4a failed (error=-5) [ 596.357607][ T5964] usb usb5-port1: attempt power cycle [ 596.810795][ T5964] usb 5-1: new high-speed USB device number 54 using dummy_hcd [ 596.863306][ T5964] usb 5-1: device descriptor read/8, error -71 [ 597.122600][ T5964] usb 5-1: new high-speed USB device number 55 using dummy_hcd [ 597.164450][ T5964] usb 5-1: device descriptor read/8, error -71 [ 597.262724][ T894] usb 2-1: new high-speed USB device number 56 using dummy_hcd [ 597.299075][ T5964] usb usb5-port1: unable to enumerate USB device [ 597.312476][ T9] em28xx 1-1:0.89: failed to get i2c transfer status from bridge register (error=-5) [ 597.354204][ T9] em28xx 1-1:0.89: reading from i2c device at 0x42 failed (error=-5) [ 597.383450][ T9] em28xx 1-1:0.89: reading from i2c device at 0x40 failed (error=-5) [ 597.411839][ T9] em28xx 1-1:0.89: Config register raw data: 0xfffffffb [ 597.435674][ T9] em28xx 1-1:0.89: AC97 chip type couldn't be determined [ 597.455971][ T9] em28xx 1-1:0.89: No AC97 audio processor [ 597.455985][ T894] usb 2-1: Using ep0 maxpacket: 32 [ 597.477617][ T894] usb 2-1: config 1 has an invalid interface number: 251 but max is 0 [ 597.493191][ T894] usb 2-1: config 1 has no interface number 0 [ 597.499519][ T894] usb 2-1: config 1 interface 251 altsetting 250 endpoint 0x1 has invalid maxpacket 1023, setting to 64 [ 597.536366][ T5935] usb 1-1: USB disconnect, device number 41 [ 597.609783][ T5935] em28xx 1-1:0.89: Disconnecting em28xx [ 597.633252][ T894] usb 2-1: config 1 interface 251 has no altsetting 0 [ 597.634676][ T9] usb 1-1: Decoder not found [ 597.734915][ T9] em28xx 1-1:0.89: failed to create media graph [ 598.056772][ T894] usb 2-1: New USB device found, idVendor=0b95, idProduct=2790, bcdDevice=1b.55 [ 598.127417][ T9] em28xx 1-1:0.89: V4L2 device video103 deregistered [ 598.150618][ T894] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 598.179405][ T894] usb 2-1: Product: syz [ 598.181536][ T9674] ================================================================== [ 598.191692][ T9674] BUG: KASAN: slab-use-after-free in v4l2_fh_open+0xac/0x420 [ 598.198815][ T894] usb 2-1: Manufacturer: syz [ 598.199074][ T9674] Read of size 8 at addr ffff888034be8740 by task v4l_id/9674 [ 598.211115][ T9674] [ 598.212799][ T894] usb 2-1: SerialNumber: syz [ 598.213446][ T9674] CPU: 0 UID: 0 PID: 9674 Comm: v4l_id Tainted: G L syzkaller #0 PREEMPT(full) [ 598.213469][ T9674] Tainted: [L]=SOFTLOCKUP [ 598.213475][ T9674] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 598.213485][ T9674] Call Trace: [ 598.213493][ T9674] [ 598.213501][ T9674] dump_stack_lvl+0xe8/0x150 [ 598.213524][ T9674] print_report+0xba/0x230 [ 598.213541][ T9674] ? v4l2_fh_open+0xac/0x420 [ 598.213559][ T9674] kasan_report+0x117/0x150 [ 598.213576][ T9674] ? v4l2_fh_open+0xac/0x420 [ 598.213597][ T9674] v4l2_fh_open+0xac/0x420 [ 598.213614][ T9674] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 598.213635][ T9674] em28xx_v4l2_open+0x157/0x9a0 [ 598.213666][ T9674] ? do_raw_spin_lock+0x12b/0x2f0 [ 598.213687][ T9674] v4l2_open+0x1bf/0x3a0 [ 598.213707][ T9674] chrdev_open+0x4cd/0x5e0 [ 598.213724][ T9674] ? __pfx_chrdev_open+0x10/0x10 [ 598.213739][ T9674] ? fsnotify_open_perm_and_set_mode+0x135/0x6d0 [ 598.213761][ T9674] ? __pfx_chrdev_open+0x10/0x10 [ 598.213776][ T9674] do_dentry_open+0x7ce/0x1420 [ 598.213799][ T9674] vfs_open+0x3b/0x340 [ 598.213815][ T9674] ? path_openat+0x346e/0x3e20 [ 598.213835][ T9674] path_openat+0x3486/0x3e20 [ 598.213866][ T9674] ? kmem_cache_alloc_noprof+0x370/0x6e0 [ 598.213888][ T9674] ? getname_flags+0xb7/0x540 [ 598.213904][ T9674] ? __pfx_path_openat+0x10/0x10 [ 598.213924][ T9674] ? __lock_acquire+0x6b5/0x2cf0 [ 598.213949][ T9674] do_filp_open+0x22d/0x490 [ 598.213970][ T9674] ? __pfx_do_filp_open+0x10/0x10 [ 598.213998][ T9674] ? _raw_spin_unlock+0x28/0x50 [ 598.214018][ T9674] ? alloc_fd+0x64b/0x6c0 [ 598.214038][ T9674] do_sys_openat2+0x12f/0x220 [ 598.214057][ T9674] ? __pfx_do_sys_openat2+0x10/0x10 [ 598.214075][ T9674] ? exc_page_fault+0x6a/0xc0 [ 598.214092][ T9674] ? do_user_addr_fault+0xc7c/0x1360 [ 598.214114][ T9674] __x64_sys_openat+0x138/0x170 [ 598.214134][ T9674] do_syscall_64+0xe2/0xf80 [ 598.214151][ T9674] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 598.214166][ T9674] ? trace_irq_disable+0x37/0x100 [ 598.214182][ T9674] ? clear_bhb_loop+0x60/0xb0 [ 598.214199][ T9674] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 598.214215][ T9674] RIP: 0033:0x7fb2be8a7407 [ 598.214230][ T9674] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 598.214245][ T9674] RSP: 002b:00007ffcf2db1990 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 598.214263][ T9674] RAX: ffffffffffffffda RBX: 00007fb2bef4d880 RCX: 00007fb2be8a7407 [ 598.214275][ T9674] RDX: 0000000000000000 RSI: 00007ffcf2db1f1c RDI: ffffffffffffff9c [ 598.214287][ T9674] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 [ 598.214297][ T9674] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 598.214306][ T9674] R13: 00007ffcf2db1be0 R14: 00007fb2bf052000 R15: 000055d3630984d8 [ 598.214325][ T9674] [ 598.214331][ T9674] [ 598.503421][ T9674] Allocated by task 9: [ 598.507493][ T9674] kasan_save_track+0x3e/0x80 [ 598.512150][ T9674] __kasan_kmalloc+0x93/0xb0 [ 598.516822][ T9674] __kmalloc_cache_noprof+0x3d1/0x6e0 [ 598.522200][ T9674] em28xx_v4l2_init+0x10b/0x2e70 [ 598.527121][ T9674] em28xx_init_extension+0x120/0x1c0 [ 598.532661][ T9674] process_scheduled_works+0xaec/0x17a0 [ 598.538634][ T9674] worker_thread+0xda6/0x1360 [ 598.543294][ T9674] kthread+0x726/0x8b0 [ 598.547340][ T9674] ret_from_fork+0x51b/0xa40 [ 598.551994][ T9674] ret_from_fork_asm+0x1a/0x30 [ 598.556758][ T9674] [ 598.559072][ T9674] Freed by task 9: [ 598.562765][ T9674] kasan_save_track+0x3e/0x80 [ 598.567582][ T9674] kasan_save_free_info+0x46/0x50 [ 598.572594][ T9674] __kasan_slab_free+0x5c/0x80 [ 598.577350][ T9674] kfree+0x1be/0x650 [ 598.581242][ T9674] em28xx_v4l2_init+0x1683/0x2e70 [ 598.586272][ T9674] em28xx_init_extension+0x120/0x1c0 [ 598.591709][ T9674] process_scheduled_works+0xaec/0x17a0 [ 598.597506][ T9674] worker_thread+0xda6/0x1360 [ 598.602188][ T9674] kthread+0x726/0x8b0 [ 598.606254][ T9674] ret_from_fork+0x51b/0xa40 [ 598.610852][ T9674] ret_from_fork_asm+0x1a/0x30 [ 598.615612][ T9674] [ 598.618018][ T9674] The buggy address belongs to the object at ffff888034be8000 [ 598.618018][ T9674] which belongs to the cache kmalloc-8k of size 8192 [ 598.632229][ T9674] The buggy address is located 1856 bytes inside of [ 598.632229][ T9674] freed 8192-byte region [ffff888034be8000, ffff888034bea000) [ 598.646198][ T9674] [ 598.648511][ T9674] The buggy address belongs to the physical page: [ 598.655108][ T9674] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x34be8 [ 598.663947][ T9674] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 598.672597][ T9674] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 598.680163][ T9674] page_type: f5(slab) [ 598.684145][ T9674] raw: 00fff00000000040 ffff88813fe27280 dead000000000100 dead000000000122 [ 598.692889][ T9674] raw: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 598.701488][ T9674] head: 00fff00000000040 ffff88813fe27280 dead000000000100 dead000000000122 [ 598.710157][ T9674] head: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 598.718906][ T9674] head: 00fff00000000003 ffffea0000d2fa01 00000000ffffffff 00000000ffffffff [ 598.727568][ T9674] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 598.736294][ T9674] page dumped because: kasan: bad access detected [ 598.742768][ T9674] page_owner tracks the page as allocated [ 598.748661][ T9674] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5496, tgid 5496 (dhcpcd-run-hook), ts 46071175302, free_ts 46069682787 [ 598.769708][ T9674] post_alloc_hook+0x228/0x280 [ 598.774474][ T9674] get_page_from_freelist+0x24dc/0x2580 [ 598.780023][ T9674] __alloc_frozen_pages_noprof+0x18d/0x380 [ 598.785993][ T9674] alloc_pages_mpol+0x232/0x4a0 [ 598.790835][ T9674] allocate_slab+0x86/0x3a0 [ 598.795422][ T9674] ___slab_alloc+0xd82/0x1760 [ 598.800182][ T9674] __slab_alloc+0x65/0x100 [ 598.804602][ T9674] __kmalloc_cache_noprof+0x40d/0x6e0 [ 598.809993][ T9674] tomoyo_init_log+0x112e/0x1fb0 [ 598.814938][ T9674] tomoyo_supervisor+0x353/0x1570 [ 598.820240][ T9674] tomoyo_env_perm+0x151/0x1f0 [ 598.825007][ T9674] tomoyo_find_next_domain+0x15cb/0x1aa0 [ 598.830646][ T9674] tomoyo_bprm_check_security+0x11b/0x180 [ 598.836383][ T9674] security_bprm_check+0x85/0x240 [ 598.841511][ T9674] bprm_execve+0x896/0x1410 [ 598.846206][ T9674] do_execveat_common+0x50f/0x690 [ 598.851425][ T9674] page last free pid 5496 tgid 5496 stack trace: [ 598.857756][ T9674] __free_frozen_pages+0xbf8/0xd70 [ 598.862872][ T9674] __put_partials+0x146/0x170 [ 598.867541][ T9674] __slab_free+0x294/0x320 [ 598.871956][ T9674] qlist_free_all+0x97/0x100 [ 598.876538][ T9674] kasan_quarantine_reduce+0x148/0x160 [ 598.881989][ T9674] __kasan_slab_alloc+0x22/0x80 [ 598.886912][ T9674] __kmalloc_noprof+0x3c2/0x7e0 [ 598.891749][ T9674] tomoyo_supervisor+0xc22/0x1570 [ 598.896766][ T9674] tomoyo_env_perm+0x151/0x1f0 [ 598.901526][ T9674] tomoyo_find_next_domain+0x15cb/0x1aa0 [ 598.907156][ T9674] tomoyo_bprm_check_security+0x11b/0x180 [ 598.912885][ T9674] security_bprm_check+0x85/0x240 [ 598.917932][ T9674] bprm_execve+0x896/0x1410 [ 598.922767][ T9674] do_execveat_common+0x50f/0x690 [ 598.927878][ T9674] __x64_sys_execve+0x94/0xb0 [ 598.932575][ T9674] do_syscall_64+0xe2/0xf80 [ 598.937094][ T9674] [ 598.939607][ T9674] Memory state around the buggy address: [ 598.945242][ T9674] ffff888034be8600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 598.953293][ T9674] ffff888034be8680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 598.961347][ T9674] >ffff888034be8700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 598.969554][ T9674] ^ [ 598.975891][ T9674] ffff888034be8780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 598.984155][ T9674] ffff888034be8800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 598.992222][ T9674] ================================================================== [ 599.006101][ T9] em28xx 1-1:0.89: Registering snapshot button... [ 599.024046][ T9] input: em28xx snapshot button as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.89/input/input18 [ 599.084286][ T9] em28xx 1-1:0.89: Remote control support is not available for this card. [ 599.133369][ T5935] em28xx 1-1:0.89: Closing input extension [ 599.141335][ T5935] em28xx 1-1:0.89: Deregistering snapshot button [ 599.659927][ T9674] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 599.667181][ T9674] CPU: 0 UID: 0 PID: 9674 Comm: v4l_id Tainted: G L syzkaller #0 PREEMPT(full) [ 599.677797][ T9674] Tainted: [L]=SOFTLOCKUP [ 599.682220][ T9674] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 599.692632][ T9674] Call Trace: [ 599.695929][ T9674] [ 599.698867][ T9674] vpanic+0x1e0/0x670 [ 599.702862][ T9674] panic+0xc5/0xd0 [ 599.706591][ T9674] ? __pfx_panic+0x10/0x10 [ 599.711025][ T9674] ? v4l2_fh_open+0xac/0x420 [ 599.715807][ T9674] ? __pfx_panic+0x10/0x10 [ 599.720239][ T9674] ? v4l2_fh_open+0xac/0x420 [ 599.724834][ T9674] check_panic_on_warn+0x89/0xb0 [ 599.729786][ T9674] ? v4l2_fh_open+0xac/0x420 [ 599.734380][ T9674] end_report+0x6f/0x140 [ 599.738641][ T9674] kasan_report+0x128/0x150 [ 599.743151][ T9674] ? v4l2_fh_open+0xac/0x420 [ 599.747751][ T9674] v4l2_fh_open+0xac/0x420 [ 599.752285][ T9674] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 599.758554][ T9674] em28xx_v4l2_open+0x157/0x9a0 [ 599.763429][ T9674] ? do_raw_spin_lock+0x12b/0x2f0 [ 599.768493][ T9674] v4l2_open+0x1bf/0x3a0 [ 599.772891][ T9674] chrdev_open+0x4cd/0x5e0 [ 599.777418][ T9674] ? __pfx_chrdev_open+0x10/0x10 [ 599.782378][ T9674] ? fsnotify_open_perm_and_set_mode+0x135/0x6d0 [ 599.788887][ T9674] ? __pfx_chrdev_open+0x10/0x10 [ 599.793823][ T9674] do_dentry_open+0x7ce/0x1420 [ 599.798580][ T9674] vfs_open+0x3b/0x340 [ 599.802649][ T9674] ? path_openat+0x346e/0x3e20 [ 599.807400][ T9674] path_openat+0x3486/0x3e20 [ 599.812010][ T9674] ? kmem_cache_alloc_noprof+0x370/0x6e0 [ 599.817644][ T9674] ? getname_flags+0xb7/0x540 [ 599.822314][ T9674] ? __pfx_path_openat+0x10/0x10 [ 599.827238][ T9674] ? __lock_acquire+0x6b5/0x2cf0 [ 599.832175][ T9674] do_filp_open+0x22d/0x490 [ 599.836677][ T9674] ? __pfx_do_filp_open+0x10/0x10 [ 599.841720][ T9674] ? _raw_spin_unlock+0x28/0x50 [ 599.846576][ T9674] ? alloc_fd+0x64b/0x6c0 [ 599.850897][ T9674] do_sys_openat2+0x12f/0x220 [ 599.855654][ T9674] ? __pfx_do_sys_openat2+0x10/0x10 [ 599.860842][ T9674] ? exc_page_fault+0x6a/0xc0 [ 599.865499][ T9674] ? do_user_addr_fault+0xc7c/0x1360 [ 599.870785][ T9674] __x64_sys_openat+0x138/0x170 [ 599.875650][ T9674] do_syscall_64+0xe2/0xf80 [ 599.880144][ T9674] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 599.886295][ T9674] ? trace_irq_disable+0x37/0x100 [ 599.891313][ T9674] ? clear_bhb_loop+0x60/0xb0 [ 599.895978][ T9674] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 599.901954][ T9674] RIP: 0033:0x7fb2be8a7407 [ 599.906352][ T9674] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 599.925954][ T9674] RSP: 002b:00007ffcf2db1990 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 599.934362][ T9674] RAX: ffffffffffffffda RBX: 00007fb2bef4d880 RCX: 00007fb2be8a7407 [ 599.942319][ T9674] RDX: 0000000000000000 RSI: 00007ffcf2db1f1c RDI: ffffffffffffff9c [ 599.950277][ T9674] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 [ 599.958235][ T9674] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 599.966292][ T9674] R13: 00007ffcf2db1be0 R14: 00007fb2bf052000 R15: 000055d3630984d8 [ 599.974354][ T9674] [ 599.977900][ T9674] Kernel Offset: disabled [ 599.982228][ T9674] Rebooting in 86400 seconds..