last executing test programs: 14.721599261s ago: executing program 1 (id=1685): bpf$ENABLE_STATS(0x20, 0x0, 0x0) r0 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'syz_tun\x00', 0x0}) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000780)={0x6, 0xb, &(0x7f0000000300)=ANY=[@ANYBLOB="18020000000000000000000000000000180100002020702100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000a000000850000000600000095"], &(0x7f00000005c0)='GPL\x00'}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000480)={r2, r1, 0x25, 0x0, @void}, 0x10) syz_emit_ethernet(0x3e, &(0x7f0000004940)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, @empty, @void, {@ipv6={0x86dd, @icmpv6={0x4, 0x6, "0d932c", 0x8, 0x3a, 0xff, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @local, {[], @ndisc_rs}}}}}, 0x0) 14.510744738s ago: executing program 1 (id=1687): open(0x0, 0x4ab43, 0x1c0) r0 = syz_open_dev$loop(&(0x7f0000000700), 0x47d, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0), 0x5, 0x88000) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1) 14.236372788s ago: executing program 1 (id=1689): syz_usb_control_io(0xffffffffffffffff, &(0x7f0000000240)={0x18, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a010100000100000000000200fffc0900010073797a30000000000800024000000001cc000000030a01020000000000000000020019000900010073797a3000000000aa000300"], 0x1e4}}, 0x0) write$binfmt_misc(r1, &(0x7f0000000000), 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x7fff, 0x0) 13.031239306s ago: executing program 4 (id=1702): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) unshare(0x68040200) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0xfdffa000) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) r3 = gettid() sendmsg$NL80211_CMD_SET_WIPHY_NETNS(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, r0, 0xa23, 0x70bd29, 0x25dfdbfb, {{}, {@void, @val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_PID={0x8, 0x52, r3}]}, 0x24}, 0x1, 0x0, 0x0, 0x4008880}, 0x20000084) 12.71318728s ago: executing program 1 (id=1706): set_mempolicy(0x1, 0x0, 0x4) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/pids.max\x00', 0x2, 0x0) write$cgroup_pid(r0, &(0x7f0000000080), 0x12) r1 = syz_io_uring_setup(0x10d, &(0x7f0000000380)={0x0, 0x0, 0x1000, 0x0, 0x3ffe}, &(0x7f00000000c0)=0x0, &(0x7f0000000280)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000440)=0xfffffffc, 0x0, 0x4) io_uring_enter(r1, 0x3516, 0x0, 0x0, 0x0, 0x0) 12.615486188s ago: executing program 1 (id=1707): r0 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000040)={'vcan0\x00', 0x0}) sendmsg$can_raw(r0, &(0x7f00000003c0)={&(0x7f0000000280)={0x1d, r1}, 0x10, &(0x7f0000000380)={&(0x7f00000002c0)=@can={{0x3, 0x0, 0x1}, 0x4, 0x2, 0x0, 0x0, "e3997e3df56fe25b"}, 0x10}, 0x1, 0x0, 0x0, 0x20000004}, 0x40) 11.870486364s ago: executing program 4 (id=1713): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt(r0, 0x84, 0x7d, &(0x7f00000002c0)="aa8e0cf56164be5b", 0x8) 11.766807226s ago: executing program 4 (id=1715): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00'}) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[], 0x28}, 0x1, 0x0, 0x0, 0x44801}, 0x840) 11.675099873s ago: executing program 1 (id=1716): syz_usb_control_io(0xffffffffffffffff, &(0x7f0000000240)={0x18, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a010100000100000000000200fffc0900010073797a30000000000800024000000001cc000000030a01020000000000000000020019000900010073797a3000000000aa000300"], 0x1e4}}, 0x0) write$binfmt_misc(r1, &(0x7f0000000000), 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x7fff, 0x0) 11.656764071s ago: executing program 4 (id=1717): set_mempolicy(0x1, 0x0, 0x4) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/pids.max\x00', 0x2, 0x0) write$cgroup_pid(r0, &(0x7f0000000080), 0x12) r1 = syz_io_uring_setup(0x10d, &(0x7f0000000380)={0x0, 0x0, 0x1000, 0x0, 0x3ffe}, &(0x7f00000000c0)=0x0, &(0x7f0000000280)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000440)=0xfffffffc, 0x0, 0x4) io_uring_enter(r1, 0x3516, 0x0, 0x0, 0x0, 0x0) 11.097961799s ago: executing program 4 (id=1721): r0 = socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000003c0)={0xffffffffffffffff}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000300)={'wlan0\x00'}) sendmsg$NL80211_CMD_NEW_STATION(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000002c0)={0x0, 0x80}, 0x1, 0x0, 0x0, 0x200000d0}, 0x8050) 9.869861828s ago: executing program 4 (id=1728): socket$nl_audit(0x10, 0x3, 0x9) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x1f, 0x8, &(0x7f0000000500)=ANY=[@ANYBLOB="18080000d0ff000000000000000000008510000006000000660800f0000000001800000000000000000000000000000095000000000000000001000000000000"], &(0x7f0000000000)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x8}, 0x94) openat$uhid(0xffffffffffffff9c, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x3, 0x6, &(0x7f0000000180)=ANY=[@ANYBLOB="b408000000000000731137000000000085106546d4918f3172bc00000000dff41c000000000000009500c200000000009500001200000000"], &(0x7f0000000080)='GPL\x00', 0x4, 0xc4, &(0x7f0000000700)=""/196, 0x0, 0x0, '\x00', 0x0, @fallback=0x3}, 0x94) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xcee18000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x6) r3 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000400)='/sys/power/resume', 0x149a82, 0x0) write$cgroup_int(r3, &(0x7f0000000040)=0x1f13, 0x12) socket$netlink(0x10, 0x3, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000640)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x6a, 0x6a, 0x4, [@var={0x2, 0x0, 0x0, 0x11, 0x4}, @const={0x0, 0x0, 0x0, 0x4}, @datasec={0x9, 0x4, 0x0, 0xf, 0x2, [{0x4, 0x2, 0x8}, {0x3, 0x3}, {0x3, 0x0, 0x1000}, {0x2, 0xc218}], "e202"}, @var={0x2, 0x0, 0x0, 0xe, 0x3}]}, {0x0, [0x0, 0x5f]}}, 0x0, 0x88}, 0x28) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000001b80)=ANY=[@ANYBLOB="0600000004000000080000000a"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000b2e900007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x10, '\x00', 0x0, @fallback=0x29, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200}, 0xfffffffffffffe8a) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 5.269879921s ago: executing program 0 (id=1745): r0 = openat$cuse(0xffffffffffffff9c, &(0x7f00000022c0), 0x2, 0x0) preadv(r0, &(0x7f000001fb80)=[{&(0x7f0000002300)=""/4096, 0x1000}, {&(0x7f00000011c0)=""/4096, 0x1000}], 0x2, 0x0, 0x0) 5.051396355s ago: executing program 0 (id=1748): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) sched_setaffinity(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, 0x0, 0x10) bind$inet6(r0, 0x0, 0x0) listen(r0, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000080)={@local, @remote, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "560400", 0x14, 0x6, 0x0, @local, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0xc2, 0x0, 0x0, 0x4}}}}}}}, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000000)={@local, @remote, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "560400", 0x14, 0x6, 0x0, @local, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0xc2, 0x0, 0x0, 0x4}}}}}}}, 0x0) 4.918843035s ago: executing program 3 (id=1750): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000080)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_KEY(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000200000000000000b00000008000300", @ANYRES32=r2, @ANYBLOB="0500080000000000090007004ff5677c1a0000000800090001ac0f"], 0x38}}, 0x0) 4.688342375s ago: executing program 0 (id=1751): r0 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r0, 0x107, 0xf, &(0x7f0000000000), 0x4) sendmsg$kcm(r0, &(0x7f0000000080)={&(0x7f0000000180)=@hci={0x1f, 0x0, 0x5}, 0x80, &(0x7f0000000300)=[{&(0x7f0000001340)="1c393502dda1a67d93b1ceccbe972c4fef9c33ecf2d824f3a33513f45f472bbdc8e3a2275f2587f0da0b3ae419bed996116448f90d113ce98aa985f379d729430858f5cb9a668a1800bf2354b33cdff83033de518580a3080d7f4cc2406e071138439e1566dd17983ee153ab672f362d3292e24a9952f18ec3d8b37bb3391096c1d4442a754899299321c03cbcfb98a26994b2a072c2b9d9c70d619545e5f61b050e40166d2ff57dcc008f24fd5339e7bc21e25863f80d2487c30b6bf781608a31d68e9319ab1712d8f5bdde849c040417c864cbfd3923dcb9fc6bdc2ea53334184b03efcb631dc68f0a7b6e13eea4b80d4237120e32932ca4e2b50bad0a35496d36a191d91f03b477b9587bc0ba489932e34f819fa1524ebad53a3d94b46c6aeff4f42fa067729fbb2862c09d337a75e0c8429d4bfe0dee2e1e23e8c22787178600ecca135623731e4701f35bd4e7c936a8ee274120e7662328a5aba1161b05889b045696721c79bff0547efe051f3c5de77fdd3c77afd41a1a7747a982b7efb013c9d6bac7d3ad1f9b7c3a5a1448b35696f03bca1c875e346edc55b7a271c3e5f3c0df72c8e4d7cccfa2e9b598f0ae06efbc1a5d5bd91aed6b32deccf7755cef50fab72633c802533b9d94f17f9be978f2514c47671575ee528fbdddc6194328e605e4d10e293756d20eb8a545f2bfe48df5d1d98a270458392a0a57647dcb8ee005e78877a072d12d0429b9b9957a695c3289b4a59469691115e6ba204181708b9d1ae47418ed594b8128f20c100f5485a84e60d73ab818da73fab78caf", 0x23f}], 0x1}, 0x9cdc2384056b48b8) 4.658793049s ago: executing program 3 (id=1752): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="280000001c00010429bd7000ffdbdf2507000000", @ANYRES32=r1], 0x28}, 0x1, 0x0, 0x0, 0x44801}, 0x840) 4.282538235s ago: executing program 0 (id=1753): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000540)={0x2c, r1, 0x5, 0x70bd26, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon, @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8, 0xd, 0x5}]}, 0x2c}, 0x1, 0x0, 0x0, 0x11}, 0x20000014) 1.497377202s ago: executing program 3 (id=1755): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000a00)=@delchain={0x58, 0x65, 0x2, 0x70bd27, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x2, 0x1}, {0x0, 0x1}, {0x0, 0xb}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}, @TCA_CHAIN={0x8, 0xb, 0x6}, @filter_kind_options=@f_bpf={{0x8}, {0x14, 0x2, [@TCA_BPF_FD={0x8}, @TCA_BPF_FLAGS_GEN={0x8, 0x9, 0x3}]}}]}, 0x58}, 0x1, 0x0, 0x0, 0x81}, 0x20000080) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x14}, {&(0x7f00000007c0)=""/154, 0x21}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0xffffffffffffff2f}}], 0x4000000000003b4, 0x2040000, &(0x7f0000003700)={0x77359400}) 1.49022379s ago: executing program 0 (id=1756): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) unshare(0x68040200) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0xfdffa000) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) r3 = gettid() sendmsg$NL80211_CMD_SET_WIPHY_NETNS(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, r0, 0xa23, 0x70bd29, 0x25dfdbfb, {{}, {@void, @val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_PID={0x8, 0x52, r3}]}, 0x24}, 0x1, 0x0, 0x0, 0x4008880}, 0x20000084) 1.232805335s ago: executing program 2 (id=1757): connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4e21, 0x800002, @remote, 0x9}, 0x1c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x2080, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x1) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000002c0)={0x0, 0x0, 0x4, r2, 0xb}) r3 = dup(r1) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x1) fsconfig$FSCONFIG_SET_PATH(0xffffffffffffffff, 0x3, &(0x7f0000000080)='/pro\x0e/bus/inpu\f\x00\x00\x00\x00\x00\x00\x00rs\x00', 0x0, 0xffffffffffffffff) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000003000/0x18000)=nil, &(0x7f0000000300)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 939.127897ms ago: executing program 2 (id=1758): r0 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000040), 0x21041, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0xe) ioctl$TIOCSSOFTCAR(r0, 0x541a, &(0x7f0000000080)=0x8) 937.195101ms ago: executing program 3 (id=1759): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='net_prio.prioidx\x00', 0x26e1, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_COALESCE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000000)={0x28, 0x0, 0x1, 0x70bd2b, 0x0, {{0x2}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x9, 0x44}}}}}, 0x28}, 0x1, 0x0, 0x0, 0x2400c891}, 0x0) close(r0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)) ioctl$SIOCSIFHWADDR(r0, 0x8b19, &(0x7f0000000000)={'wlan0\x00', @random="7cf1e97c9e4f"}) 717.290231ms ago: executing program 2 (id=1760): r0 = syz_open_dev$loop(0x0, 0x47d, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0), 0x5, 0x88000) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1) 593.396891ms ago: executing program 3 (id=1761): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) sched_setaffinity(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, 0x0, 0x10) bind$inet6(r0, 0x0, 0x0) listen(r0, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000080)={@local, @remote, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "560400", 0x14, 0x6, 0x0, @local, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0xc2, 0x0, 0x0, 0x4}}}}}}}, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000000)={@local, @remote, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "560400", 0x14, 0x6, 0x0, @local, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0xc2, 0x0, 0x0, 0x4}}}}}}}, 0x0) 548.644614ms ago: executing program 2 (id=1762): r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e21, @local}], 0x10) setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f0000000240)={0x208, 0x8f, 0x206, 0xfffffffd, 0x3, 0xb37, 0xfffffe2f, 0x8}, 0x20) sendmsg$inet_sctp(r0, &(0x7f0000000700)={&(0x7f0000000340)=@in={0x2, 0x4e21, @local}, 0x10, &(0x7f00000006c0)=[{&(0x7f0000000380)='N', 0x2a000}], 0x1, 0x0, 0x0, 0x804c040}, 0x0) 284.207445ms ago: executing program 2 (id=1763): r0 = syz_open_dev$video4linux(&(0x7f0000000000), 0x5, 0x0) ioctl$VIDIOC_SUBDEV_ENUM_MBUS_CODE(r0, 0xc0305602, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1}) 159.420762ms ago: executing program 3 (id=1764): r0 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000003200)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000003c0)="e870", 0x2}], 0x1, &(0x7f0000000340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}], 0x1}, 0x0) 90.744612ms ago: executing program 0 (id=1765): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="280000001c00010429bd7000ffdbdf2507000000", @ANYRES32=r1, @ANYBLOB], 0x28}, 0x1, 0x0, 0x0, 0x44801}, 0x840) 0s ago: executing program 2 (id=1766): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000540)={0x2c, r1, 0x5, 0x70bd26, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon, @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8, 0xd, 0x5}]}, 0x2c}, 0x1, 0x0, 0x0, 0x11}, 0x20000014) kernel console output (not intermixed with test programs): 4][ T7508] do_fast_syscall_32+0x34/0x80 [ 205.332094][ T7508] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 205.332116][ T7508] RIP: 0023:0xf7fd4539 [ 205.332133][ T7508] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 205.332149][ T7508] RSP: 002b:00000000f54c655c EFLAGS: 00000206 ORIG_RAX: 0000000000000159 [ 205.332169][ T7508] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800002c0 [ 205.332182][ T7508] RDX: 000000000000009f RSI: 0000000000000000 RDI: 0000000000000000 [ 205.332192][ T7508] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 205.332202][ T7508] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 205.332213][ T7508] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 205.332241][ T7508] [ 205.683779][ C0] cm109 3-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 205.691223][ C0] cm109 3-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 205.698496][ C0] cm109 3-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 205.705687][ C0] cm109 3-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 205.712812][ C0] cm109 3-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 205.720251][ C0] cm109 3-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 205.727381][ C0] cm109 3-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 205.734480][ C0] cm109 3-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 205.921877][ T107] usb 3-1: USB disconnect, device number 16 [ 205.921923][ C0] cm109 3-1:0.8: cm109_submit_buzz_toggle: usb_submit_urb (urb_ctl) failed -19 [ 205.972663][ T7510] netlink: 4 bytes leftover after parsing attributes in process `syz.1.459'. [ 205.999675][ T5905] Unregistered device Elgato EyeTV DTT Deluxe [ 206.005903][ T107] cm109 3-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 206.033951][ T5905] as10x_usb: device has been disconnected [ 206.396525][ T7524] netlink: 20 bytes leftover after parsing attributes in process `syz.4.465'. [ 206.452951][ T7524] netlink: 20 bytes leftover after parsing attributes in process `syz.4.465'. [ 206.496192][ T7524] bond1: Unable to set peer notification delay as MII monitoring is disabled [ 206.511416][ T7524] bond1 (unregistering): Released all slaves [ 206.576262][ T7527] FAULT_INJECTION: forcing a failure. [ 206.576262][ T7527] name failslab, interval 1, probability 0, space 0, times 0 [ 206.588971][ T7527] CPU: 1 UID: 0 PID: 7527 Comm: syz.1.464 Not tainted syzkaller #0 PREEMPT(full) [ 206.588990][ T7527] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 206.588997][ T7527] Call Trace: [ 206.589004][ T7527] [ 206.589010][ T7527] dump_stack_lvl+0xe8/0x150 [ 206.589030][ T7527] should_fail_ex+0x414/0x560 [ 206.589052][ T7527] should_failslab+0xa8/0x100 [ 206.589066][ T7527] ? __pfx_ip6_dst_gc+0x10/0x10 [ 206.589078][ T7527] kmem_cache_alloc_noprof+0x88/0x710 [ 206.589094][ T7527] ? ip6_pol_route+0x162/0x1180 [ 206.589106][ T7527] ? dst_alloc+0x105/0x170 [ 206.589122][ T7527] ? __pfx_ip6_dst_gc+0x10/0x10 [ 206.589133][ T7527] dst_alloc+0x105/0x170 [ 206.589151][ T7527] ip6_pol_route+0xa21/0x1180 [ 206.589162][ T7527] ? ip6_pol_route+0x162/0x1180 [ 206.589176][ T7527] ? __pfx_ip6_pol_route+0x10/0x10 [ 206.589188][ T7527] ? __lock_acquire+0x6b6/0x2cf0 [ 206.589208][ T7527] fib6_rule_lookup+0x348/0x6f0 [ 206.589223][ T7527] ? __pfx_ip6_pol_route_output+0x10/0x10 [ 206.589236][ T7527] ? __pfx_fib6_rule_lookup+0x10/0x10 [ 206.589250][ T7527] ? ip6_route_output_flags+0x2e/0x5d0 [ 206.589263][ T7527] ? ip6_route_output_flags+0x2e/0x5d0 [ 206.589278][ T7527] ? chacha_permute+0x4e6/0xf00 [ 206.589296][ T7527] ip6_route_output_flags+0x364/0x5d0 [ 206.589309][ T7527] ? ip6_route_output_flags+0x2e/0x5d0 [ 206.589323][ T7527] ip6_dst_lookup_tail+0x1ae/0x1510 [ 206.589345][ T7527] ? __pfx_ip6_dst_lookup_tail+0x10/0x10 [ 206.589363][ T7527] ? sctp_v6_get_dst+0x479/0x1c90 [ 206.589386][ T7527] ip6_dst_lookup_flow+0x47/0xe0 [ 206.589401][ T7527] ? sctp_v6_get_dst+0x3d1/0x1c90 [ 206.589416][ T7527] sctp_v6_get_dst+0x6c7/0x1c90 [ 206.589445][ T7527] ? sctp_v6_get_dst+0x479/0x1c90 [ 206.589462][ T7527] ? lockdep_hardirqs_on+0x7b/0x110 [ 206.589474][ T7527] ? crng_make_state+0x36b/0x610 [ 206.589490][ T7527] ? __pfx_sctp_v6_get_dst+0x10/0x10 [ 206.589504][ T7527] ? __asan_memset+0x22/0x50 [ 206.589534][ T7527] ? dst_release+0x72/0x1b0 [ 206.589551][ T7527] sctp_transport_route+0x118/0x2f0 [ 206.589568][ T7527] sctp_assoc_add_peer+0x650/0x13b0 [ 206.589588][ T7527] sctp_connect_new_asoc+0x30a/0x690 [ 206.589602][ T7527] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 206.589626][ T7527] ? __local_bh_enable_ip+0xd0/0x130 [ 206.589645][ T7527] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 206.589665][ T7527] ? security_sctp_bind_connect+0x7e/0x2e0 [ 206.589689][ T7527] sctp_sendmsg+0x155c/0x2840 [ 206.589716][ T7527] ? __pfx_sctp_sendmsg+0x10/0x10 [ 206.589727][ T7527] ? aa_sk_perm+0x15f/0x920 [ 206.589742][ T7527] ? aa_sk_perm+0x7ee/0x920 [ 206.589757][ T7527] ? __pfx_aa_sk_perm+0x10/0x10 [ 206.589773][ T7527] ? sock_rps_record_flow+0x19/0x410 [ 206.589790][ T7527] ? inet_sendmsg+0x2f4/0x370 [ 206.589807][ T7527] __sock_sendmsg+0x19c/0x270 [ 206.589825][ T7527] ____sys_sendmsg+0x52d/0x820 [ 206.589843][ T7527] ? __pfx_____sys_sendmsg+0x10/0x10 [ 206.589866][ T7527] ___sys_sendmsg+0x21f/0x2a0 [ 206.589881][ T7527] ? __pfx____sys_sendmsg+0x10/0x10 [ 206.589894][ T7527] ? kstrtoull+0x12f/0x1d0 [ 206.589912][ T7527] ? kstrtouint+0x6e/0xe0 [ 206.589944][ T7527] ? __fget_files+0x2a/0x420 [ 206.589958][ T7527] ? __fget_files+0x3a0/0x420 [ 206.589978][ T7527] __sys_sendmmsg+0x28e/0x430 [ 206.589995][ T7527] ? __pfx___sys_sendmmsg+0x10/0x10 [ 206.590007][ T7527] ? __mutex_unlock_slowpath+0x1a1/0x730 [ 206.590034][ T7527] ? ksys_write+0x22a/0x250 [ 206.590047][ T7527] ? __pfx_ksys_write+0x10/0x10 [ 206.590062][ T7527] __ia32_compat_sys_sendmmsg+0xa2/0xc0 [ 206.590079][ T7527] __do_fast_syscall_32+0x1dc/0x560 [ 206.590093][ T7527] ? lockdep_hardirqs_on+0x7b/0x110 [ 206.590103][ T7527] ? do_fast_syscall_32+0x34/0x80 [ 206.590116][ T7527] ? irqentry_exit+0x10f/0x660 [ 206.590129][ T7527] do_fast_syscall_32+0x34/0x80 [ 206.590142][ T7527] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 206.590157][ T7527] RIP: 0023:0xf7f41539 [ 206.590169][ T7527] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 206.590180][ T7527] RSP: 002b:00000000f543655c EFLAGS: 00000206 ORIG_RAX: 0000000000000159 [ 206.590193][ T7527] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000200 [ 206.590202][ T7527] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 [ 206.590209][ T7527] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 206.590216][ T7527] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 206.590223][ T7527] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 206.590241][ T7527] [ 207.597805][ T7531] netlink: 12 bytes leftover after parsing attributes in process `syz.4.467'. [ 207.782272][ T10] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 207.809009][ T7537] geneve2: entered promiscuous mode [ 207.932140][ T10] usb 3-1: Using ep0 maxpacket: 8 [ 207.942245][ T6170] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 207.952515][ T10] usb 3-1: config index 0 descriptor too short (expected 30, got 18) [ 207.965309][ T10] usb 3-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 207.977765][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 207.987228][ T10] usb 3-1: Product: syz [ 207.998975][ T10] usb 3-1: Manufacturer: syz [ 208.005381][ T10] usb 3-1: SerialNumber: syz [ 208.016219][ T10] usb 3-1: config 0 descriptor?? [ 208.037460][ T10] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 208.055186][ T10] usb 3-1: setting power ON [ 208.063296][ T10] dvb-usb: bulk message failed: -22 (2/0) [ 208.093330][ T10] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 208.112228][ T6170] usb 2-1: Using ep0 maxpacket: 16 [ 208.121957][ T10] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID)) [ 208.138847][ T6170] usb 2-1: config index 0 descriptor too short (expected 65, got 36) [ 208.151097][ T10] usb 3-1: media controller created [ 208.157118][ T6170] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 208.183710][ T6170] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 208.197375][ T10] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 208.207181][ T6170] usb 2-1: New USB device found, idVendor=1781, idProduct=0898, bcdDevice= 0.00 [ 208.225781][ T6170] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 208.234305][ T10] usb 3-1: selecting invalid altsetting 6 [ 208.269840][ T10] usb 3-1: digital interface selection failed (-22) [ 208.293973][ T10] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)' [ 208.304760][ T6170] usb 2-1: config 0 descriptor?? [ 208.320757][ T6170] input: PXRC Flight Controller Adapter as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/input/input16 [ 208.333237][ T10] usb 3-1: setting power OFF [ 208.341775][ T10] dvb-usb: bulk message failed: -22 (2/0) [ 208.349100][ T10] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 208.359789][ T10] (NULL device *): no alternate interface [ 208.424166][ T10] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 208.559361][ T10] usb 2-1: USB disconnect, device number 8 [ 208.660774][ T6170] usb 3-1: USB disconnect, device number 17 [ 208.849283][ T7549] netlink: 8 bytes leftover after parsing attributes in process `syz.0.475'. [ 209.422196][ T5918] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 209.574844][ T5918] usb 2-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 209.584916][ T5918] usb 2-1: config 1 has an invalid descriptor of length 255, skipping remainder of the config [ 209.621283][ T5918] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 209.638310][ T5918] usb 2-1: config 1 has no interface number 0 [ 209.647584][ T5918] usb 2-1: too many endpoints for config 1 interface 1 altsetting 1: 32, using maximum allowed: 30 [ 209.659576][ T5918] usb 2-1: config 1 interface 1 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 32 [ 209.676785][ T5918] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 209.763566][ T5918] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 209.789793][ T5918] usb 2-1: Product: syz [ 209.803285][ T5918] usb 2-1: Manufacturer: syz [ 209.814642][ T5918] usb 2-1: SerialNumber: syz [ 209.848003][ T5918] cdc_ncm 2-1:1.1: CDC Union missing and no IAD found [ 209.859515][ T5918] cdc_ncm 2-1:1.1: bind() failure [ 210.162783][ T5918] usb 2-1: USB disconnect, device number 9 [ 211.601511][ T7577] FAULT_INJECTION: forcing a failure. [ 211.601511][ T7577] name failslab, interval 1, probability 0, space 0, times 0 [ 211.615002][ T7577] CPU: 0 UID: 0 PID: 7577 Comm: syz.1.494 Not tainted syzkaller #0 PREEMPT(full) [ 211.615021][ T7577] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 211.615029][ T7577] Call Trace: [ 211.615034][ T7577] [ 211.615040][ T7577] dump_stack_lvl+0xe8/0x150 [ 211.615060][ T7577] should_fail_ex+0x414/0x560 [ 211.615081][ T7577] should_failslab+0xa8/0x100 [ 211.615097][ T7577] __kmalloc_noprof+0xdf/0x800 [ 211.615109][ T7577] ? tomoyo_encode+0x28b/0x550 [ 211.615128][ T7577] tomoyo_encode+0x28b/0x550 [ 211.615146][ T7577] tomoyo_realpath_from_path+0x58d/0x5d0 [ 211.615162][ T7577] ? tomoyo_domain+0xd8/0x130 [ 211.615180][ T7577] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 211.615193][ T7577] tomoyo_path_number_perm+0x1e8/0x5a0 [ 211.615208][ T7577] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 211.615226][ T7577] ? __lock_acquire+0x6b6/0x2cf0 [ 211.615241][ T7577] ? get_pid_task+0x20/0x1f0 [ 211.615261][ T7577] ? get_pid_task+0x20/0x1f0 [ 211.615287][ T7577] ? __fget_files+0x2a/0x420 [ 211.615304][ T7577] ? __fget_files+0x3a0/0x420 [ 211.615326][ T7577] ? __fget_files+0x2a/0x420 [ 211.615342][ T7577] security_file_ioctl_compat+0xcb/0x2d0 [ 211.615357][ T7577] __ia32_compat_sys_ioctl+0x128/0x840 [ 211.615371][ T7577] ? __pfx___ia32_compat_sys_ioctl+0x10/0x10 [ 211.615383][ T7577] ? __fget_files+0x3a0/0x420 [ 211.615401][ T7577] ? fput+0xa0/0xd0 [ 211.615417][ T7577] ? ksys_write+0x22a/0x250 [ 211.615430][ T7577] ? __pfx_ksys_write+0x10/0x10 [ 211.615448][ T7577] __do_fast_syscall_32+0x1dc/0x560 [ 211.615462][ T7577] ? lockdep_hardirqs_on+0x7b/0x110 [ 211.615472][ T7577] ? do_fast_syscall_32+0x34/0x80 [ 211.615485][ T7577] ? irqentry_exit+0x10f/0x660 [ 211.615499][ T7577] do_fast_syscall_32+0x34/0x80 [ 211.615512][ T7577] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 211.615526][ T7577] RIP: 0023:0xf7f41539 [ 211.615538][ T7577] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 211.615549][ T7577] RSP: 002b:00000000f543655c EFLAGS: 00000206 ORIG_RAX: 0000000000000036 [ 211.615563][ T7577] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 000000000000890b [ 211.615572][ T7577] RDX: 0000000080000240 RSI: 0000000000000000 RDI: 0000000000000000 [ 211.615580][ T7577] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 211.615587][ T7577] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 211.615594][ T7577] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 211.615612][ T7577] [ 211.615649][ T7577] ERROR: Out of memory at tomoyo_realpath_from_path. [ 211.910413][ T7579] netlink: 8 bytes leftover after parsing attributes in process `syz.4.484'. [ 211.953963][ T7579] netlink: 4 bytes leftover after parsing attributes in process `syz.4.484'. [ 212.067878][ T7583] fuse: Bad value for 'group_id' [ 212.073309][ T7583] fuse: Bad value for 'group_id' [ 212.081941][ T30] kauditd_printk_skb: 11 callbacks suppressed [ 212.081959][ T30] audit: type=1326 audit(1766521781.864:83): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7582 comm="syz.0.486" exe="/root/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf709d539 code=0x0 [ 212.752095][ T6170] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 213.014072][ T6170] usb 3-1: Using ep0 maxpacket: 16 [ 213.021593][ T6170] usb 3-1: config index 0 descriptor too short (expected 65, got 36) [ 213.030112][ T6170] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 213.409905][ T7602] netlink: 68 bytes leftover after parsing attributes in process `syz.3.490'. [ 213.522301][ C0] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 213.554504][ T6170] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 213.569095][ T6170] usb 3-1: New USB device found, idVendor=1781, idProduct=0898, bcdDevice= 0.00 [ 213.579068][ T6170] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 213.634845][ T6170] usb 3-1: config 0 descriptor?? [ 213.657622][ T6170] input: PXRC Flight Controller Adapter as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/input/input17 [ 214.118394][ T5905] usb 3-1: USB disconnect, device number 18 [ 214.124558][ C1] pxrc 3-1:0.0: pxrc_usb_irq - usb_submit_urb failed with result: -19 [ 214.260648][ T7608] netlink: 'syz.3.495': attribute type 2 has an invalid length. [ 214.371748][ T7613] netlink: 'syz.3.497': attribute type 15 has an invalid length. [ 214.379746][ T7613] netlink: 20 bytes leftover after parsing attributes in process `syz.3.497'. [ 214.384106][ T903] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 214.389704][ T7613] bond0: option resend_igmp: invalid value (196616) [ 214.403334][ T7613] bond0: option resend_igmp: allowed values 0 - 255 [ 214.508079][ T7616] netlink: 4 bytes leftover after parsing attributes in process `syz.3.498'. [ 214.569875][ T903] usb 2-1: config 1 has an invalid interface number: 166 but max is 0 [ 214.578429][ T903] usb 2-1: config 1 has no interface number 0 [ 214.584916][ T903] usb 2-1: config 1 interface 166 has no altsetting 0 [ 214.594662][ T903] usb 2-1: New USB device found, idVendor=2040, idProduct=9950, bcdDevice=50.1a [ 214.604002][ T903] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 214.612150][ T903] usb 2-1: Product: syz [ 214.617341][ T903] usb 2-1: Manufacturer: syz [ 214.621952][ T903] usb 2-1: SerialNumber: syz [ 215.209696][ T903] dvb-usb: found a 'Hauppauge Nova-T 500 Dual DVB-T' in cold state, will try to load a firmware [ 215.404322][ T903] dvb-usb: downloading firmware from file 'dvb-usb-dib0700-1.20.fw' [ 215.425419][ T903] dib0700: firmware download failed at 7 with -22 [ 215.466495][ T903] usb 2-1: USB disconnect, device number 10 [ 215.632125][ T6170] usb 4-1: new high-speed USB device number 17 using dummy_hcd [ 215.762566][ T6170] usb 4-1: device descriptor read/64, error -71 [ 215.854829][ T5905] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 216.004866][ T6170] usb 4-1: new high-speed USB device number 18 using dummy_hcd [ 216.202244][ T6170] usb 4-1: device descriptor read/64, error -71 [ 216.221398][ T1147] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 216.301561][ T1147] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 216.323714][ T5905] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 216.427647][ T6170] usb usb4-port1: attempt power cycle [ 216.471450][ T1147] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 216.611319][ T1147] bond1: (slave ): Releasing backup interface [ 216.665189][ T1147] netdevsim netdevsim1  (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 216.773258][ T6170] usb 4-1: new high-speed USB device number 19 using dummy_hcd [ 216.804453][ T6170] usb 4-1: device descriptor read/8, error -71 [ 216.878581][ T5905] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 216.898199][ T5834] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 216.911074][ T5834] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 216.920625][ T5834] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 216.923582][ T7643] netlink: 28 bytes leftover after parsing attributes in process `syz.4.508'. [ 216.944149][ T5834] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 216.951866][ T5834] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 217.103208][ T6170] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 217.115798][ T1147] bridge_slave_1: left allmulticast mode [ 217.145598][ T6170] usb 4-1: device descriptor read/8, error -71 [ 217.161475][ T1147] bridge_slave_1: left promiscuous mode [ 217.167943][ T5905] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 217.181683][ T1147] bridge0: port 2(bridge_slave_1) entered disabled state [ 217.206214][ T1147] bridge_slave_0: left allmulticast mode [ 217.216796][ T1147] bridge_slave_0: left promiscuous mode [ 217.227580][ T1147] bridge0: port 1(bridge_slave_0) entered disabled state [ 217.252567][ T6170] usb usb4-port1: unable to enumerate USB device [ 217.376355][ T1147] ip6gretap0 (unregistering): left promiscuous mode [ 217.536891][ T1147] gretap0 (unregistering): left promiscuous mode [ 217.962468][ T903] usb 5-1: new high-speed USB device number 21 using dummy_hcd [ 217.974878][ T1147] bond0 (unregistering): left promiscuous mode [ 217.986399][ T1147] bond_slave_0: left promiscuous mode [ 217.996588][ T1147] bond_slave_1: left promiscuous mode [ 218.019591][ T1147] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 218.037992][ T1147] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 218.057344][ T1147] bond0 (unregistering): Released all slaves [ 218.079445][ T1147] bond1 (unregistering): Released all slaves [ 218.142125][ T903] usb 5-1: Using ep0 maxpacket: 16 [ 218.163951][ T903] usb 5-1: config index 0 descriptor too short (expected 65, got 36) [ 218.206914][ T903] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 218.241572][ T903] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 218.291762][ T903] usb 5-1: New USB device found, idVendor=1781, idProduct=0898, bcdDevice= 0.00 [ 218.313409][ T903] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 218.338478][ T903] usb 5-1: config 0 descriptor?? [ 218.355919][ T903] input: PXRC Flight Controller Adapter as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/input/input18 [ 218.580673][ T903] usb 5-1: USB disconnect, device number 21 [ 218.597487][ T5183] pxrc 5-1:0.0: pxrc_open - usb_submit_urb failed, error: -19 [ 218.628518][ T7656] netlink: 12 bytes leftover after parsing attributes in process `syz.2.511'. [ 219.042237][ T5834] Bluetooth: hci4: command tx timeout [ 219.141444][ T1147] mac80211_hwsim hwsim2 wlan0 (unregistering): left allmulticast mode [ 219.606639][ T7669] netdevsim netdevsim2 netdevsim0: entered promiscuous mode [ 219.614916][ T7669] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 219.890365][ T1147] hsr_slave_0: left promiscuous mode [ 219.906293][ T1147] hsr_slave_1: left promiscuous mode [ 219.916853][ T1147] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 219.987767][ T1147] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 220.040253][ T6170] usb 5-1: new high-speed USB device number 22 using dummy_hcd [ 220.073032][ T1147] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 220.097573][ T1147] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 220.267935][ T6170] usb 5-1: config 1 has an invalid interface number: 166 but max is 0 [ 220.283742][ T6170] usb 5-1: config 1 has no interface number 0 [ 220.303181][ T1147] veth1_macvtap: left promiscuous mode [ 220.309411][ T1147] veth0_macvtap: left promiscuous mode [ 220.457714][ T1147] veth1_vlan: left promiscuous mode [ 220.502165][ T6170] usb 5-1: config 1 interface 166 has no altsetting 0 [ 220.508107][ T1147] veth0_vlan: left promiscuous mode [ 220.545343][ T6170] usb 5-1: New USB device found, idVendor=2040, idProduct=9950, bcdDevice=50.1a [ 220.572153][ T6170] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 220.593314][ T6170] usb 5-1: Product: syz [ 220.600661][ T6170] usb 5-1: Manufacturer: syz [ 220.612090][ T6170] usb 5-1: SerialNumber: syz [ 221.135778][ T5834] Bluetooth: hci4: command tx timeout [ 221.271264][ T6170] dvb-usb: found a 'Hauppauge Nova-T 500 Dual DVB-T' in cold state, will try to load a firmware [ 221.314443][ T6170] dvb-usb: downloading firmware from file 'dvb-usb-dib0700-1.20.fw' [ 221.345433][ T6170] dib0700: firmware download failed at 7 with -22 [ 221.388904][ T6170] usb 5-1: USB disconnect, device number 22 [ 222.047564][ T1147] team_slave_1 (unregistering): left promiscuous mode [ 222.066380][ T1147] team0 (unregistering): Port device team_slave_1 removed [ 222.203526][ T1147] team_slave_0 (unregistering): left promiscuous mode [ 222.213864][ T1147] team0 (unregistering): Port device team_slave_0 removed [ 223.207455][ T5834] Bluetooth: hci4: command tx timeout [ 223.367286][ T30] audit: type=1326 audit(1766521793.154:84): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7715 comm="syz.2.523" exe="/root/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf70ed539 code=0x0 [ 223.666815][ T7646] chnl_net:caif_netlink_parms(): no params data found [ 224.016589][ T7646] bridge0: port 1(bridge_slave_0) entered blocking state [ 224.025897][ T7646] bridge0: port 1(bridge_slave_0) entered disabled state [ 224.033518][ T7646] bridge_slave_0: entered allmulticast mode [ 224.048360][ T7646] bridge_slave_0: entered promiscuous mode [ 224.065967][ T7646] bridge0: port 2(bridge_slave_1) entered blocking state [ 224.073458][ T7646] bridge0: port 2(bridge_slave_1) entered disabled state [ 224.081030][ T7646] bridge_slave_1: entered allmulticast mode [ 224.093531][ T7646] bridge_slave_1: entered promiscuous mode [ 224.168474][ T7646] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 224.184227][ T7646] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 224.303114][ T7646] team0: Port device team_slave_0 added [ 224.319542][ T7646] team0: Port device team_slave_1 added [ 224.385410][ T7646] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 224.400525][ T7646] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 224.468437][ T7646] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 224.499140][ T7646] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 224.506239][ T7646] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 224.572889][ T7646] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 224.756730][ T7646] hsr_slave_0: entered promiscuous mode [ 224.773782][ T7646] hsr_slave_1: entered promiscuous mode [ 224.780361][ T7646] debugfs: 'hsr0' already exists in 'hsr' [ 224.795188][ T7646] Cannot create hsr debugfs directory [ 225.287346][ T5834] Bluetooth: hci4: command tx timeout [ 225.360808][ T7754] bond1: (slave netdevsim0): Enslaving as a backup interface with a down link [ 225.502177][ T5922] usb 3-1: new high-speed USB device number 19 using dummy_hcd [ 225.514668][ T6170] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 225.652167][ T6170] usb 4-1: device descriptor read/64, error -71 [ 225.671852][ T5922] usb 3-1: config 1 has an invalid interface number: 166 but max is 0 [ 225.706757][ T5922] usb 3-1: config 1 has no interface number 0 [ 225.724814][ T5922] usb 3-1: config 1 interface 166 has no altsetting 0 [ 225.735946][ T5922] usb 3-1: New USB device found, idVendor=2040, idProduct=9950, bcdDevice=50.1a [ 225.748821][ T7767] netlink: 16 bytes leftover after parsing attributes in process `syz.4.532'. [ 225.782098][ T5922] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 225.793544][ T5922] usb 3-1: Product: syz [ 225.798497][ T5922] usb 3-1: Manufacturer: syz [ 225.807419][ T5922] usb 3-1: SerialNumber: syz [ 225.912142][ T6170] usb 4-1: new high-speed USB device number 22 using dummy_hcd [ 226.122108][ T6170] usb 4-1: device descriptor read/64, error -71 [ 226.235735][ T6170] usb usb4-port1: attempt power cycle [ 226.377604][ T5922] dvb-usb: found a 'Hauppauge Nova-T 500 Dual DVB-T' in cold state, will try to load a firmware [ 226.436164][ T5922] dvb-usb: downloading firmware from file 'dvb-usb-dib0700-1.20.fw' [ 226.482391][ T5922] dib0700: firmware download failed at 7 with -22 [ 226.528222][ T5922] usb 3-1: USB disconnect, device number 19 [ 226.642508][ T6170] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 226.674799][ T6170] usb 4-1: device descriptor read/8, error -71 [ 226.906550][ T7781] netlink: 24 bytes leftover after parsing attributes in process `syz.0.533'. [ 226.923560][ T6170] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 226.964512][ T6170] usb 4-1: device descriptor read/8, error -71 [ 227.095266][ T6170] usb usb4-port1: unable to enumerate USB device [ 227.269502][ T7646] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 227.293665][ T7646] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 227.335068][ T7646] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 227.465304][ T7646] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 227.602282][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 228.023964][ T5962] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 228.298882][ T5962] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 228.553589][ T5962] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 228.698119][ T5830] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 228.710910][ T5830] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 228.720950][ T5830] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 228.735809][ T5830] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 228.743873][ T5830] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 228.794136][ T5962] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 229.522237][ C0] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 229.613653][ T7826] FAULT_INJECTION: forcing a failure. [ 229.613653][ T7826] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 229.649638][ T7646] 8021q: adding VLAN 0 to HW filter on device bond0 [ 229.658366][ T7826] CPU: 1 UID: 0 PID: 7826 Comm: syz.0.541 Not tainted syzkaller #0 PREEMPT(full) [ 229.658394][ T7826] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 229.658406][ T7826] Call Trace: [ 229.658415][ T7826] [ 229.658422][ T7826] dump_stack_lvl+0xe8/0x150 [ 229.658465][ T7826] should_fail_ex+0x414/0x560 [ 229.658501][ T7826] _copy_from_user+0x2d/0xb0 [ 229.658526][ T7826] get_compat_msghdr+0xad/0x4a0 [ 229.658563][ T7826] ? __pfx_get_compat_msghdr+0x10/0x10 [ 229.658591][ T7826] ? rcu_is_watching+0x15/0xb0 [ 229.658614][ T7826] ? ___sys_sendmsg+0x22f/0x2a0 [ 229.658646][ T7826] ___sys_sendmsg+0x193/0x2a0 [ 229.658671][ T7826] ? __pfx____sys_sendmsg+0x10/0x10 [ 229.658692][ T7826] ? kstrtoull+0x12f/0x1d0 [ 229.658722][ T7826] ? kstrtouint+0x6e/0xe0 [ 229.658792][ T7826] __sys_sendmmsg+0x28e/0x430 [ 229.658821][ T7826] ? __pfx___sys_sendmmsg+0x10/0x10 [ 229.658841][ T7826] ? __mutex_unlock_slowpath+0x1a1/0x730 [ 229.658894][ T7826] ? rcu_is_watching+0x15/0xb0 [ 229.658926][ T7826] __ia32_compat_sys_sendmmsg+0xa2/0xc0 [ 229.658956][ T7826] __do_fast_syscall_32+0x1dc/0x560 [ 229.658978][ T7826] ? lockdep_hardirqs_on+0x7b/0x110 [ 229.658996][ T7826] ? do_fast_syscall_32+0x34/0x80 [ 229.659017][ T7826] ? irqentry_exit+0x10f/0x660 [ 229.659042][ T7826] do_fast_syscall_32+0x34/0x80 [ 229.659064][ T7826] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 229.659087][ T7826] RIP: 0023:0xf709d539 [ 229.659106][ T7826] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 229.659124][ T7826] RSP: 002b:00000000f548d55c EFLAGS: 00000206 ORIG_RAX: 0000000000000159 [ 229.659147][ T7826] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080006740 [ 229.659161][ T7826] RDX: 0000000000000300 RSI: 0000000000000000 RDI: 0000000000000000 [ 229.659174][ T7826] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 229.659185][ T7826] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 229.659204][ T7826] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 229.659236][ T7826] [ 229.898274][ T7646] 8021q: adding VLAN 0 to HW filter on device team0 [ 229.907362][ T5962] bridge_slave_1: left allmulticast mode [ 229.916578][ T5962] bridge_slave_1: left promiscuous mode [ 229.961916][ T5962] bridge0: port 2(bridge_slave_1) entered disabled state [ 229.984504][ T5962] bridge_slave_0: left allmulticast mode [ 230.004610][ T5962] bridge_slave_0: left promiscuous mode [ 230.023202][ T5962] bridge0: port 1(bridge_slave_0) entered disabled state [ 230.424597][ T5962] ip6gretap0 (unregistering): left promiscuous mode [ 230.620700][ T5962] gretap0 (unregistering): left promiscuous mode [ 230.804362][ T5830] Bluetooth: hci3: command tx timeout [ 231.117336][ T5962] bond0 (unregistering): left promiscuous mode [ 231.129078][ T5962] bond_slave_0: left promiscuous mode [ 231.140671][ T5962] bond_slave_1: left promiscuous mode [ 231.166690][ T5962] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 231.190899][ T5962] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 231.223985][ T5962] bond0 (unregistering): Released all slaves [ 231.266005][ T3548] bridge0: port 1(bridge_slave_0) entered blocking state [ 231.273294][ T3548] bridge0: port 1(bridge_slave_0) entered forwarding state [ 231.335667][ T3548] bridge0: port 2(bridge_slave_1) entered blocking state [ 231.342840][ T3548] bridge0: port 2(bridge_slave_1) entered forwarding state [ 231.484358][ T5962] tipc: Disabling bearer [ 231.511400][ T5962] tipc: Left network mode [ 231.941519][ T7815] chnl_net:caif_netlink_parms(): no params data found [ 232.250892][ T5962] hsr_slave_0: left promiscuous mode [ 232.267342][ T5962] hsr_slave_1: left promiscuous mode [ 232.283620][ T5962] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 232.297463][ T5962] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 232.307225][ T5962] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 232.315355][ T5962] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 232.352699][ T5962] veth1_macvtap: left promiscuous mode [ 232.368114][ T5962] veth0_macvtap: left promiscuous mode [ 232.440769][ T5962] veth1_vlan: left promiscuous mode [ 232.622660][ T7884] netlink: 68 bytes leftover after parsing attributes in process `syz.4.546'. [ 232.882863][ T5830] Bluetooth: hci3: command tx timeout [ 233.720380][ T5962] team0 (unregistering): Port device vlan0 removed [ 233.966549][ T5962] team0 (unregistering): Port device team_slave_1 removed [ 234.006626][ T5962] team0 (unregistering): Port device team_slave_0 removed [ 234.584684][ T7815] bridge0: port 1(bridge_slave_0) entered blocking state [ 234.609931][ T7815] bridge0: port 1(bridge_slave_0) entered disabled state [ 234.622293][ T7815] bridge_slave_0: entered allmulticast mode [ 234.643487][ T7815] bridge_slave_0: entered promiscuous mode [ 234.656279][ T7815] bridge0: port 2(bridge_slave_1) entered blocking state [ 234.665322][ T7815] bridge0: port 2(bridge_slave_1) entered disabled state [ 234.693598][ T7815] bridge_slave_1: entered allmulticast mode [ 234.700681][ T7815] bridge_slave_1: entered promiscuous mode [ 234.957527][ T7815] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 234.967860][ T5830] Bluetooth: hci3: command tx timeout [ 235.011340][ T7815] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 235.020569][ T10] usb 5-1: new high-speed USB device number 23 using dummy_hcd [ 235.121449][ T7646] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 235.192283][ T10] usb 5-1: device descriptor read/64, error -71 [ 235.233916][ T7815] team0: Port device team_slave_0 added [ 235.269641][ T7815] team0: Port device team_slave_1 added [ 235.400316][ T7646] veth0_vlan: entered promiscuous mode [ 235.502119][ T10] usb 5-1: new high-speed USB device number 24 using dummy_hcd [ 235.620587][ T7917] netlink: 'syz.0.552': attribute type 1 has an invalid length. [ 235.629907][ T7917] netlink: 28 bytes leftover after parsing attributes in process `syz.0.552'. [ 235.648821][ T7646] veth1_vlan: entered promiscuous mode [ 235.662169][ T10] usb 5-1: device descriptor read/64, error -71 [ 235.681112][ T7815] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 235.740728][ T7815] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 235.766884][ T7815] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 235.791175][ T10] usb usb5-port1: attempt power cycle [ 235.813246][ T7815] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 235.823647][ T7815] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 235.958415][ T7815] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 236.165792][ T10] usb 5-1: new high-speed USB device number 25 using dummy_hcd [ 236.168669][ T7815] hsr_slave_0: entered promiscuous mode [ 236.183721][ T7815] hsr_slave_1: entered promiscuous mode [ 236.191344][ T7815] debugfs: 'hsr0' already exists in 'hsr' [ 236.223160][ T10] usb 5-1: device descriptor read/8, error -71 [ 236.242646][ T7815] Cannot create hsr debugfs directory [ 236.289613][ T7646] veth0_macvtap: entered promiscuous mode [ 236.396936][ T7646] veth1_macvtap: entered promiscuous mode [ 236.472185][ T10] usb 5-1: new high-speed USB device number 26 using dummy_hcd [ 236.535554][ T10] usb 5-1: device descriptor read/8, error -71 [ 236.555675][ T7646] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 236.596224][ T7646] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 236.772297][ T10] usb usb5-port1: unable to enumerate USB device [ 237.020025][ T5962] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 237.043715][ T5830] Bluetooth: hci3: command tx timeout [ 237.065357][ T5962] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 237.105411][ T5962] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 237.140859][ T5962] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 237.944315][ T1159] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 237.965164][ T1159] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 238.005167][ T7944] Cannot find del_set index 0 as target [ 238.099156][ T72] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 238.123091][ T72] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 238.405837][ T7815] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 238.465554][ T7815] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 238.524266][ T7815] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 238.599565][ T7815] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 238.738008][ T7972] FAULT_INJECTION: forcing a failure. [ 238.738008][ T7972] name failslab, interval 1, probability 0, space 0, times 0 [ 238.766554][ T7972] CPU: 0 UID: 0 PID: 7972 Comm: syz.1.559 Not tainted syzkaller #0 PREEMPT(full) [ 238.766581][ T7972] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 238.766594][ T7972] Call Trace: [ 238.766602][ T7972] [ 238.766611][ T7972] dump_stack_lvl+0xe8/0x150 [ 238.766644][ T7972] should_fail_ex+0x414/0x560 [ 238.766680][ T7972] should_failslab+0xa8/0x100 [ 238.766705][ T7972] __kmalloc_noprof+0xdf/0x800 [ 238.766724][ T7972] ? tomoyo_encode+0x28b/0x550 [ 238.766756][ T7972] tomoyo_encode+0x28b/0x550 [ 238.766787][ T7972] tomoyo_realpath_from_path+0x58d/0x5d0 [ 238.766815][ T7972] ? tomoyo_domain+0xd8/0x130 [ 238.766845][ T7972] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 238.766868][ T7972] tomoyo_path_number_perm+0x1e8/0x5a0 [ 238.766892][ T7972] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 238.766912][ T7972] ? __lock_acquire+0x6b6/0x2cf0 [ 238.766933][ T7972] ? get_pid_task+0x20/0x1f0 [ 238.766966][ T7972] ? get_pid_task+0x20/0x1f0 [ 238.767007][ T7972] ? __fget_files+0x2a/0x420 [ 238.767046][ T7972] ? __fget_files+0x3a0/0x420 [ 238.767069][ T7972] ? __fget_files+0x2a/0x420 [ 238.767095][ T7972] security_file_ioctl_compat+0xcb/0x2d0 [ 238.767118][ T7972] __ia32_compat_sys_ioctl+0x128/0x840 [ 238.767140][ T7972] ? __pfx___ia32_compat_sys_ioctl+0x10/0x10 [ 238.767160][ T7972] ? __fget_files+0x3a0/0x420 [ 238.767186][ T7972] ? fput+0xa0/0xd0 [ 238.767208][ T7972] ? ksys_write+0x22a/0x250 [ 238.767230][ T7972] ? __pfx_ksys_write+0x10/0x10 [ 238.767262][ T7972] __do_fast_syscall_32+0x1dc/0x560 [ 238.767283][ T7972] ? lockdep_hardirqs_on+0x7b/0x110 [ 238.767301][ T7972] ? do_fast_syscall_32+0x34/0x80 [ 238.767321][ T7972] ? irqentry_exit+0x10f/0x660 [ 238.767347][ T7972] do_fast_syscall_32+0x34/0x80 [ 238.767368][ T7972] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 238.767392][ T7972] RIP: 0023:0xf7f07539 [ 238.767411][ T7972] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 238.767426][ T7972] RSP: 002b:00000000f53f655c EFLAGS: 00000206 ORIG_RAX: 0000000000000036 [ 238.767447][ T7972] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 000000000000890b [ 238.767461][ T7972] RDX: 0000000080000140 RSI: 0000000000000000 RDI: 0000000000000000 [ 238.767473][ T7972] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 238.767484][ T7972] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 238.767497][ T7972] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 238.767528][ T7972] [ 238.770919][ T7972] ERROR: Out of memory at tomoyo_realpath_from_path. [ 238.962096][ T5920] usb 5-1: new low-speed USB device number 27 using dummy_hcd [ 239.131727][ T7815] 8021q: adding VLAN 0 to HW filter on device bond0 [ 239.244155][ T5920] usb 5-1: device descriptor read/64, error -71 [ 239.253203][ T7815] 8021q: adding VLAN 0 to HW filter on device team0 [ 239.306662][ T5962] bridge0: port 1(bridge_slave_0) entered blocking state [ 239.313947][ T5962] bridge0: port 1(bridge_slave_0) entered forwarding state [ 239.667161][ T5920] usb 5-1: new low-speed USB device number 28 using dummy_hcd [ 239.715232][ T5962] bridge0: port 2(bridge_slave_1) entered blocking state [ 239.722461][ T5962] bridge0: port 2(bridge_slave_1) entered forwarding state [ 239.835475][ T7992] IPVS: set_ctl: invalid protocol: 33 172.20.20.187:20000 [ 239.852209][ T5920] usb 5-1: device descriptor read/64, error -71 [ 239.972487][ T5920] usb usb5-port1: attempt power cycle [ 240.103013][ T7990] can: request_module (can-proto-0) failed. [ 240.362629][ T5920] usb 5-1: new low-speed USB device number 29 using dummy_hcd [ 240.455284][ T5920] usb 5-1: device descriptor read/8, error -71 [ 240.479410][ T7815] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 240.692165][ T5920] usb 5-1: new low-speed USB device number 30 using dummy_hcd [ 240.726972][ T5920] usb 5-1: device descriptor read/8, error -71 [ 240.746791][ T7815] veth0_vlan: entered promiscuous mode [ 240.842546][ T5920] usb usb5-port1: unable to enumerate USB device [ 240.851036][ T7815] veth1_vlan: entered promiscuous mode [ 240.937074][ T7815] veth0_macvtap: entered promiscuous mode [ 240.948779][ T7815] veth1_macvtap: entered promiscuous mode [ 240.978202][ T7815] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 240.995408][ T7815] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 241.024644][ T13] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 241.034458][ T13] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 241.050385][ T13] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 241.060444][ T13] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 241.164943][ T10] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 241.351632][ T72] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 241.359838][ T72] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 241.378639][ T10] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 241.397181][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 241.457498][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 241.462231][ T5905] usb 4-1: new high-speed USB device number 25 using dummy_hcd [ 241.471594][ T5979] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 241.485430][ T10] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 241.510879][ T5979] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 241.540316][ T10] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 241.609491][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 241.612226][ T5905] usb 4-1: device descriptor read/64, error -71 [ 241.663406][ T10] usb 2-1: config 0 descriptor?? [ 241.865644][ T5905] usb 4-1: new high-speed USB device number 26 using dummy_hcd [ 242.026207][ T5905] usb 4-1: device descriptor read/64, error -71 [ 242.152714][ T5905] usb usb4-port1: attempt power cycle [ 242.233794][ T10] plantronics 0003:047F:FFFF.0005: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0 [ 242.508697][ T5905] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 242.932635][ T5905] usb 4-1: device descriptor read/8, error -71 [ 243.164814][ T107] usb 2-1: USB disconnect, device number 11 [ 243.193741][ T5905] usb 4-1: new high-speed USB device number 28 using dummy_hcd [ 243.360723][ T5905] usb 4-1: device descriptor read/8, error -71 [ 243.502828][ T5905] usb usb4-port1: unable to enumerate USB device [ 244.911006][ T8043] netlink: 12 bytes leftover after parsing attributes in process `syz.3.573'. [ 245.413059][ T6170] usb 3-1: new high-speed USB device number 20 using dummy_hcd [ 245.573153][ T6170] usb 3-1: Using ep0 maxpacket: 16 [ 245.601144][ T6170] usb 3-1: config index 0 descriptor too short (expected 65, got 36) [ 245.637131][ T6170] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 245.649044][ T6170] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 245.672257][ T6170] usb 3-1: New USB device found, idVendor=1781, idProduct=0898, bcdDevice= 0.00 [ 245.681777][ T6170] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 245.720501][ T6170] usb 3-1: config 0 descriptor?? [ 245.872160][ T5919] usb 2-1: new full-speed USB device number 12 using dummy_hcd [ 245.967619][ T6170] input: PXRC Flight Controller Adapter as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/input/input20 [ 246.103987][ T5919] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 246.119473][ T5919] usb 2-1: config 0 has no interface number 0 [ 246.129507][ T5919] usb 2-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 246.221396][ T5919] usb 2-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 64 [ 246.259967][ T5919] usb 2-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 246.276605][ T5919] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 246.304584][ C1] pxrc 3-1:0.0: pxrc_usb_irq - usb_submit_urb failed with result: -19 [ 246.321628][ T107] usb 3-1: USB disconnect, device number 20 [ 246.356581][ T5919] usb 2-1: config 0 descriptor?? [ 246.363175][ T8062] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 246.495454][ T5919] iowarrior 2-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 247.294971][ C0] iowarrior 2-1:0.1: iowarrior_callback - usb_submit_urb failed with result -1 [ 247.320125][ T107] usb 2-1: USB disconnect, device number 12 [ 247.492183][ T5919] usb 4-1: new full-speed USB device number 29 using dummy_hcd [ 247.521735][ T8073] netlink: 12 bytes leftover after parsing attributes in process `syz.1.584'. [ 247.754284][ T5919] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 247.762673][ T5919] usb 4-1: config 0 has no interface number 0 [ 247.768925][ T5919] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 247.783175][ T5919] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 64 [ 247.797823][ T5919] usb 4-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 247.822258][ T5919] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 247.839306][ T5919] usb 4-1: config 0 descriptor?? [ 247.880279][ T8071] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 247.898979][ T5919] iowarrior 4-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 248.089630][ T6170] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 248.183714][ T8071] FAULT_INJECTION: forcing a failure. [ 248.183714][ T8071] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 248.282206][ T8071] CPU: 0 UID: 0 PID: 8071 Comm: syz.3.582 Not tainted syzkaller #0 PREEMPT(full) [ 248.282237][ T8071] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 248.282249][ T8071] Call Trace: [ 248.282258][ T8071] [ 248.282267][ T8071] dump_stack_lvl+0xe8/0x150 [ 248.282300][ T8071] should_fail_ex+0x414/0x560 [ 248.282336][ T8071] _copy_to_user+0x31/0xb0 [ 248.282362][ T8071] put_old_timespec32+0xbe/0x120 [ 248.282387][ T8071] ? __pfx_put_old_timespec32+0x10/0x10 [ 248.282421][ T8071] poll_select_finish+0x503/0x5e0 [ 248.282450][ T8071] ? __pfx_poll_select_finish+0x10/0x10 [ 248.282479][ T8071] ? __pfx_set_compat_user_sigmask+0x10/0x10 [ 248.282513][ T8071] do_compat_pselect+0x27e/0x2d0 [ 248.282542][ T8071] ? __pfx_do_compat_pselect+0x10/0x10 [ 248.282567][ T8071] ? ksys_write+0x1e1/0x250 [ 248.282589][ T8071] ? __pfx_ksys_write+0x10/0x10 [ 248.282612][ T8071] __ia32_compat_sys_pselect6_time32+0x149/0x190 [ 248.282645][ T8071] __do_fast_syscall_32+0x1dc/0x560 [ 248.282667][ T8071] ? lockdep_hardirqs_on+0x7b/0x110 [ 248.282686][ T8071] ? do_fast_syscall_32+0x34/0x80 [ 248.282707][ T8071] ? irqentry_exit+0x10f/0x660 [ 248.282736][ T8071] do_fast_syscall_32+0x34/0x80 [ 248.282759][ T8071] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 248.282782][ T8071] RIP: 0023:0xf7fd4539 [ 248.282801][ T8071] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 248.282818][ T8071] RSP: 002b:00000000f54c655c EFLAGS: 00000206 ORIG_RAX: 0000000000000134 [ 248.282841][ T8071] RAX: ffffffffffffffda RBX: 0000000000000040 RCX: 0000000080000100 [ 248.282856][ T8071] RDX: 0000000000000000 RSI: 0000000080000240 RDI: 0000000080000280 [ 248.282868][ T8071] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 248.282879][ T8071] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 248.282891][ T8071] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 248.282922][ T8071] [ 248.583990][ T6170] usb 3-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 248.592994][ T6170] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 248.611327][ T6170] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 248.623081][ T6170] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 128, changing to 11 [ 248.667388][ T6170] usb 3-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 248.676651][ T6170] usb 3-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 248.685075][ T6170] usb 3-1: Product: syz [ 248.689405][ T6170] usb 3-1: Manufacturer: syz [ 248.734246][ T6170] cdc_wdm 3-1:1.0: skipping garbage [ 248.739559][ T6170] cdc_wdm 3-1:1.0: skipping garbage [ 248.836382][ T6170] cdc_wdm 3-1:1.0: cdc-wdm1: USB WDM device [ 248.865105][ T6170] cdc_wdm 3-1:1.0: Unknown control protocol [ 249.180399][ C1] iowarrior 4-1:0.1: iowarrior_callback - usb_submit_urb failed with result -1 [ 249.236413][ T903] usb 4-1: USB disconnect, device number 29 [ 249.853924][ T6170] usb 2-1: new full-speed USB device number 13 using dummy_hcd [ 250.112257][ T6170] usb 2-1: device descriptor read/64, error -71 [ 250.231942][ T8105] netlink: 12 bytes leftover after parsing attributes in process `syz.0.591'. [ 250.362083][ T6170] usb 2-1: new full-speed USB device number 14 using dummy_hcd [ 250.512123][ T6170] usb 2-1: device descriptor read/64, error -71 [ 250.646314][ C0] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 250.723212][ T8113] netlink: 8 bytes leftover after parsing attributes in process `syz.4.592'. [ 250.876768][ T8113] netlink: 68 bytes leftover after parsing attributes in process `syz.4.592'. [ 250.973894][ T6170] usb usb2-port1: attempt power cycle [ 251.140225][ T5919] usb 3-1: USB disconnect, device number 21 [ 251.386514][ T5967] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 251.452290][ T6170] usb 2-1: new full-speed USB device number 15 using dummy_hcd [ 251.498702][ T6170] usb 2-1: device descriptor read/8, error -71 [ 251.933398][ T6170] usb 2-1: new full-speed USB device number 16 using dummy_hcd [ 251.964942][ T6170] usb 2-1: device descriptor read/8, error -71 [ 252.082701][ T903] usb 3-1: new high-speed USB device number 22 using dummy_hcd [ 252.108043][ T6170] usb usb2-port1: unable to enumerate USB device [ 252.262096][ T903] usb 3-1: Using ep0 maxpacket: 8 [ 252.269739][ T903] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 252.284958][ T903] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 252.362324][ T903] usb 3-1: New USB device found, idVendor=046a, idProduct=0027, bcdDevice= 0.00 [ 252.478950][ T903] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 252.495715][ T903] usb 3-1: config 0 descriptor?? [ 252.709448][ T903] cherry 0003:046A:0027.0006: unknown main item tag 0x2 [ 252.778287][ T903] cherry 0003:046A:0027.0006: unknown main item tag 0x0 [ 252.797549][ T903] cherry 0003:046A:0027.0006: unknown main item tag 0x0 [ 252.836046][ T903] cherry 0003:046A:0027.0006: unknown main item tag 0x0 [ 253.143391][ T8144] tipc: Started in network mode [ 253.152584][ T8144] tipc: Node identity ac141441, cluster identity 4711 [ 253.166745][ T903] cherry 0003:046A:0027.0006: unknown main item tag 0x0 [ 253.180245][ T903] cherry 0003:046A:0027.0006: unknown main item tag 0x0 [ 253.251949][ T903] cherry 0003:046A:0027.0006: unknown main item tag 0x0 [ 253.263387][ T8144] tipc: Enabled bearer , priority 10 [ 253.277091][ T903] cherry 0003:046A:0027.0006: unknown main item tag 0x0 [ 253.297274][ T903] cherry 0003:046A:0027.0006: unknown main item tag 0x0 [ 253.311293][ T903] cherry 0003:046A:0027.0006: unknown main item tag 0x0 [ 253.347770][ T903] cherry 0003:046A:0027.0006: hidraw0: USB HID v0.00 Device [HID 046a:0027] on usb-dummy_hcd.2-1/input0 [ 253.451018][ T903] usb 3-1: USB disconnect, device number 22 [ 253.701605][ T8145] fido_id[8145]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.2/usb3/report_descriptor': No such file or directory [ 254.132127][ T903] usb 4-1: new high-speed USB device number 30 using dummy_hcd [ 254.424687][ T5905] tipc: Node number set to 2886997057 [ 254.546940][ T8160] netlink: 12 bytes leftover after parsing attributes in process `syz.2.606'. [ 254.563901][ T10] usb 2-1: new high-speed USB device number 17 using dummy_hcd [ 254.704349][ T903] usb 4-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 254.714216][ T903] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 254.726268][ T903] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 254.764359][ T903] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 128, changing to 11 [ 254.781890][ T10] usb 2-1: too many configurations: 57, using maximum allowed: 8 [ 254.801546][ T10] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 254.816153][ T10] usb 2-1: can't read configurations, error -61 [ 254.831769][ T903] usb 4-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 254.841134][ T903] usb 4-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 254.894187][ T903] usb 4-1: Product: syz [ 254.939069][ T903] usb 4-1: Manufacturer: syz [ 254.974560][ T903] cdc_wdm 4-1:1.0: skipping garbage [ 254.981073][ T903] cdc_wdm 4-1:1.0: skipping garbage [ 255.004256][ T903] cdc_wdm 4-1:1.0: cdc-wdm0: USB WDM device [ 255.012429][ T903] cdc_wdm 4-1:1.0: Unknown control protocol [ 255.092255][ T10] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 255.184048][ C0] cdc_wdm 4-1:1.0: wdm_int_callback - 2 bytes [ 255.190408][ C0] cdc_wdm 4-1:1.0: wdm_int_callback - 2 bytes [ 255.196755][ C0] cdc_wdm 4-1:1.0: wdm_int_callback - 2 bytes [ 255.203105][ C0] cdc_wdm 4-1:1.0: wdm_int_callback - 2 bytes [ 255.309466][ T10] usb 2-1: too many configurations: 57, using maximum allowed: 8 [ 255.375309][ T10] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 255.384829][ T10] usb 2-1: can't read configurations, error -61 [ 255.429614][ T10] usb usb2-port1: attempt power cycle [ 255.442345][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 255.465715][ T8173] netlink: 8 bytes leftover after parsing attributes in process `syz.4.607'. [ 255.476722][ T8173] netlink: 68 bytes leftover after parsing attributes in process `syz.4.607'. [ 255.777661][ T1298] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.784079][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 255.862390][ T10] usb 2-1: new high-speed USB device number 19 using dummy_hcd [ 255.895442][ T10] usb 2-1: too many configurations: 57, using maximum allowed: 8 [ 255.924605][ T10] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 255.934132][ T10] usb 2-1: can't read configurations, error -61 [ 256.072359][ T10] usb 2-1: new high-speed USB device number 20 using dummy_hcd [ 256.127460][ T10] usb 2-1: too many configurations: 57, using maximum allowed: 8 [ 256.154995][ T10] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 256.199461][ T10] usb 2-1: can't read configurations, error -61 [ 256.220373][ T10] usb usb2-port1: unable to enumerate USB device [ 256.470714][ T8188] netlink: 'syz.4.613': attribute type 6 has an invalid length. [ 256.640217][ T8192] netlink: 'syz.4.613': attribute type 21 has an invalid length. [ 256.649144][ T8192] netlink: 'syz.4.613': attribute type 6 has an invalid length. [ 256.657305][ T8192] netlink: 132 bytes leftover after parsing attributes in process `syz.4.613'. [ 256.730989][ T9] usb 4-1: USB disconnect, device number 30 [ 257.927070][ T8212] netlink: 8 bytes leftover after parsing attributes in process `syz.4.619'. [ 257.978735][ T8212] bond2: entered promiscuous mode [ 257.984810][ T8216] netlink: 28 bytes leftover after parsing attributes in process `syz.4.619'. [ 258.007583][ T8212] 8021q: adding VLAN 0 to HW filter on device bond2 [ 258.229200][ T8217] netlink: 12 bytes leftover after parsing attributes in process `syz.2.618'. [ 258.404891][ T8221] fuse: Bad value for 'group_id' [ 258.410309][ T8221] fuse: Bad value for 'group_id' [ 258.795141][ T8230] netlink: 8 bytes leftover after parsing attributes in process `syz.4.621'. [ 258.805987][ T8230] netlink: 68 bytes leftover after parsing attributes in process `syz.4.621'. [ 259.517098][ T8234] x_tables: ip6_tables: MASQUERADE target: used from hooks INPUT, but only usable from POSTROUTING [ 259.705923][ T30] audit: type=1326 audit(1766521829.474:85): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8238 comm="syz.2.625" exe="/root/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf700d539 code=0x0 [ 260.243093][ C0] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 260.274085][ T6170] usb 2-1: new high-speed USB device number 21 using dummy_hcd [ 260.432729][ T8250] FAULT_INJECTION: forcing a failure. [ 260.432729][ T8250] name failslab, interval 1, probability 0, space 0, times 0 [ 260.447444][ T8250] CPU: 1 UID: 0 PID: 8250 Comm: syz.4.629 Not tainted syzkaller #0 PREEMPT(full) [ 260.447473][ T8250] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 260.447487][ T8250] Call Trace: [ 260.447495][ T8250] [ 260.447504][ T8250] dump_stack_lvl+0xe8/0x150 [ 260.447536][ T8250] should_fail_ex+0x414/0x560 [ 260.447574][ T8250] should_failslab+0xa8/0x100 [ 260.447600][ T8250] kmem_cache_alloc_noprof+0x88/0x710 [ 260.447631][ T8250] ? sctp_chunkify+0x5a/0x260 [ 260.447665][ T8250] sctp_chunkify+0x5a/0x260 [ 260.447718][ T8250] _sctp_make_chunk+0x122/0x290 [ 260.447750][ T8250] sctp_make_init+0x58b/0xd30 [ 260.447775][ T8250] ? is_bpf_text_address+0x292/0x2b0 [ 260.447817][ T8250] ? __pfx_sctp_make_init+0x10/0x10 [ 260.447858][ T8250] ? stack_trace_save+0x9c/0xe0 [ 260.447888][ T8250] ? __pfx_stack_trace_save+0x10/0x10 [ 260.447915][ T8250] ? __asan_memset+0x22/0x50 [ 260.447947][ T8250] sctp_sf_do_prm_asoc+0xd2/0x3f0 [ 260.447988][ T8250] sctp_do_sm+0x1e7/0x5c40 [ 260.448010][ T8250] ? __pfx_sctp_pname+0x10/0x10 [ 260.448031][ T8250] ? kasan_save_track+0x4f/0x80 [ 260.448049][ T8250] ? kasan_save_track+0x3e/0x80 [ 260.448078][ T8250] ? __kmalloc_cache_noprof+0x3e2/0x700 [ 260.448099][ T8250] ? sctp_sendmsg_to_asoc+0x1307/0x18d0 [ 260.448118][ T8250] ? ____sys_sendmsg+0x52d/0x820 [ 260.448140][ T8250] ? ___sys_sendmsg+0x21f/0x2a0 [ 260.448161][ T8250] ? __sys_sendmmsg+0x28e/0x430 [ 260.448182][ T8250] ? __ia32_compat_sys_sendmmsg+0xa2/0xc0 [ 260.448207][ T8250] ? __do_fast_syscall_32+0x1dc/0x560 [ 260.448230][ T8250] ? entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 260.448259][ T8250] ? __pfx_sctp_do_sm+0x10/0x10 [ 260.448326][ T8250] ? __sk_mem_raise_allocated+0x290/0x1270 [ 260.448353][ T8250] ? __genradix_ptr+0x1e1/0x220 [ 260.448386][ T8250] sctp_primitive_ASSOCIATE+0x95/0xc0 [ 260.448412][ T8250] sctp_sendmsg_to_asoc+0x1088/0x18d0 [ 260.448442][ T8250] ? sctp_assoc_add_peer+0xce1/0x13b0 [ 260.448479][ T8250] ? __pfx_sctp_sendmsg_to_asoc+0x10/0x10 [ 260.448499][ T8250] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 260.448528][ T8250] ? __local_bh_enable_ip+0xd0/0x130 [ 260.448547][ T8250] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 260.448567][ T8250] ? security_sctp_bind_connect+0x7e/0x2e0 [ 260.448592][ T8250] sctp_sendmsg+0x1941/0x2840 [ 260.448625][ T8250] ? __pfx_sctp_sendmsg+0x10/0x10 [ 260.448643][ T8250] ? aa_sk_perm+0x15f/0x920 [ 260.448669][ T8250] ? aa_sk_perm+0x7ee/0x920 [ 260.448698][ T8250] ? __pfx_aa_sk_perm+0x10/0x10 [ 260.448724][ T8250] ? sock_rps_record_flow+0x19/0x410 [ 260.448755][ T8250] ? inet_sendmsg+0x2f4/0x370 [ 260.448785][ T8250] __sock_sendmsg+0x19c/0x270 [ 260.448817][ T8250] ____sys_sendmsg+0x52d/0x820 [ 260.448847][ T8250] ? __pfx_____sys_sendmsg+0x10/0x10 [ 260.448889][ T8250] ___sys_sendmsg+0x21f/0x2a0 [ 260.448915][ T8250] ? __pfx____sys_sendmsg+0x10/0x10 [ 260.448937][ T8250] ? kstrtoull+0x12f/0x1d0 [ 260.448977][ T8250] ? kstrtouint+0x6e/0xe0 [ 260.449036][ T8250] ? __fget_files+0x2a/0x420 [ 260.449060][ T8250] ? __fget_files+0x3a0/0x420 [ 260.449096][ T8250] __sys_sendmmsg+0x28e/0x430 [ 260.449127][ T8250] ? __pfx___sys_sendmmsg+0x10/0x10 [ 260.449148][ T8250] ? __mutex_unlock_slowpath+0x1a1/0x730 [ 260.449200][ T8250] ? ksys_write+0x22a/0x250 [ 260.449222][ T8250] ? __pfx_ksys_write+0x10/0x10 [ 260.449250][ T8250] __ia32_compat_sys_sendmmsg+0xa2/0xc0 [ 260.449280][ T8250] __do_fast_syscall_32+0x1dc/0x560 [ 260.449302][ T8250] ? lockdep_hardirqs_on+0x7b/0x110 [ 260.449321][ T8250] ? do_fast_syscall_32+0x34/0x80 [ 260.449342][ T8250] ? irqentry_exit+0x10f/0x660 [ 260.449367][ T8250] do_fast_syscall_32+0x34/0x80 [ 260.449390][ T8250] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 260.449413][ T8250] RIP: 0023:0xf70ad539 [ 260.449432][ T8250] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 260.449449][ T8250] RSP: 002b:00000000f549d55c EFLAGS: 00000206 ORIG_RAX: 0000000000000159 [ 260.449472][ T8250] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000200 [ 260.449486][ T8250] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 [ 260.449497][ T8250] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 260.449509][ T8250] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 260.449520][ T8250] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 260.449554][ T8250] [ 260.892290][ T6170] usb 2-1: unable to get BOS descriptor or descriptor too short [ 260.901502][ T6170] usb 2-1: config 3 has an invalid interface number: 8 but max is 3 [ 260.922582][ T6170] usb 2-1: config 3 has an invalid descriptor of length 0, skipping remainder of the config [ 260.933834][ T6170] usb 2-1: config 3 has 1 interface, different from the descriptor's value: 4 [ 260.945408][ T6170] usb 2-1: config 3 has no interface number 0 [ 260.986063][ T6170] usb 2-1: config 3 interface 8 altsetting 6 endpoint 0x82 has an invalid bInterval 52, changing to 9 [ 261.028941][ T6170] usb 2-1: config 3 interface 8 altsetting 6 endpoint 0x82 has invalid maxpacket 8241, setting to 1024 [ 261.161028][ T6170] usb 2-1: config 3 interface 8 altsetting 6 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 261.198541][ T6170] usb 2-1: config 3 interface 8 has no altsetting 0 [ 261.221528][ T8257] netlink: 'syz.2.630': attribute type 1 has an invalid length. [ 261.229710][ T8257] netlink: 12 bytes leftover after parsing attributes in process `syz.2.630'. [ 261.246649][ T6170] usb 2-1: New USB device found, idVendor=05ac, idProduct=921d, bcdDevice=c2.be [ 261.257211][ T6170] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 261.378669][ T6170] usb 2-1: Product: syz [ 261.399454][ T6170] usb 2-1: Manufacturer: syz [ 261.409651][ T6170] usb 2-1: SerialNumber: syz [ 261.476248][ T8261] netdevsim netdevsim4 netdevsim0: entered promiscuous mode [ 261.484117][ T8261] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 261.632277][ T10] usb 3-1: new high-speed USB device number 23 using dummy_hcd [ 261.649517][ T6170] appledisplay 2-1:3.8: Error while getting initial brightness: -71 [ 261.666285][ T6170] appledisplay 2-1:3.8: probe with driver appledisplay failed with error -71 [ 261.681238][ T6170] usb 2-1: USB disconnect, device number 21 [ 261.811760][ T8263] TCP: request_sock_TCP: Possible SYN flooding on port [::]:20002. Sending cookies. [ 261.828190][ T10] usb 3-1: Using ep0 maxpacket: 16 [ 261.844159][ T10] usb 3-1: config 0 has no interfaces? [ 261.865564][ T10] usb 3-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 261.880186][ T10] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 261.894937][ T10] usb 3-1: Manufacturer: syz [ 261.921950][ T10] usb 3-1: config 0 descriptor?? [ 262.857802][ T8275] netlink: 8 bytes leftover after parsing attributes in process `syz.3.636'. [ 262.947623][ T8272] netlink: 12 bytes leftover after parsing attributes in process `syz.1.635'. [ 264.032760][ T10] usb 3-1: USB disconnect, device number 23 [ 264.082253][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 264.971494][ T8322] i2c i2c-0: Invalid block write size 34 [ 265.039980][ T8325] netlink: 4 bytes leftover after parsing attributes in process `syz.2.644'. [ 265.547335][ T8344] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 265.555210][ T8344] IPv6: NLM_F_CREATE should be set when creating new route [ 265.562651][ T8344] IPv6: NLM_F_CREATE should be set when creating new route [ 265.569904][ T8344] IPv6: NLM_F_CREATE should be set when creating new route [ 265.702094][ T7520] usb 5-1: new high-speed USB device number 31 using dummy_hcd [ 265.855435][ T7520] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 265.866920][ T7520] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 265.879084][ T7520] usb 5-1: New USB device found, idVendor=1e7d, idProduct=2cf6, bcdDevice= 0.00 [ 265.889017][ T7520] usb 5-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 265.897495][ T7520] usb 5-1: Manufacturer: syz [ 265.907999][ T7520] usb 5-1: config 0 descriptor?? [ 266.612999][ T7520] pyra 0003:1E7D:2CF6.0007: hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.4-1/input0 [ 266.762094][ T9] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 266.926632][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 266.949793][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 266.977023][ T9] usb 3-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.00 [ 266.999537][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 267.017661][ T9] usb 3-1: config 0 descriptor?? [ 267.330526][ T7520] pyra 0003:1E7D:2CF6.0007: couldn't init struct pyra_device [ 267.338460][ T7520] pyra 0003:1E7D:2CF6.0007: couldn't install mouse [ 267.367930][ T7520] pyra 0003:1E7D:2CF6.0007: probe with driver pyra failed with error -71 [ 267.395618][ T7520] usb 5-1: USB disconnect, device number 31 [ 267.453851][ T9] hid_parser_main: 47 callbacks suppressed [ 267.453877][ T9] cp2112 0003:10C4:EA90.0008: unknown main item tag 0x0 [ 267.493266][ T9] cp2112 0003:10C4:EA90.0008: unknown main item tag 0x0 [ 267.500294][ T9] cp2112 0003:10C4:EA90.0008: unknown main item tag 0x0 [ 267.515593][ T9] cp2112 0003:10C4:EA90.0008: unknown main item tag 0x0 [ 267.536886][ T9] cp2112 0003:10C4:EA90.0008: unknown main item tag 0x0 [ 267.549729][ T8381] fido_id[8381]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.4/usb5/report_descriptor': No such file or directory [ 267.565517][ T9] cp2112 0003:10C4:EA90.0008: unknown main item tag 0x0 [ 267.574669][ T9] cp2112 0003:10C4:EA90.0008: unknown main item tag 0x0 [ 267.598917][ T9] cp2112 0003:10C4:EA90.0008: hidraw0: USB HID v0.00 Device [HID 10c4:ea90] on usb-dummy_hcd.2-1/input0 [ 267.694428][ T9] cp2112 0003:10C4:EA90.0008: Part Number: 0x82 Device Version: 0xFE [ 267.869580][ T8385] netlink: 8 bytes leftover after parsing attributes in process `syz.1.678'. [ 268.041280][ T8390] netlink: 'syz.1.680': attribute type 2 has an invalid length. [ 268.297655][ T8365] cp2112 0003:10C4:EA90.0008: Multi-message I2C transactions not supported [ 268.393080][ T9] cp2112 0003:10C4:EA90.0008: error reading lock byte: -71 [ 268.483473][ T9] usb 3-1: USB disconnect, device number 24 [ 268.860640][ T8393] netlink: 'syz.1.681': attribute type 10 has an invalid length. [ 268.890799][ T8393] 8021q: adding VLAN 0 to HW filter on device bond0 [ 268.924506][ T8393] team0: Port device bond0 added [ 273.053574][ T8523] netlink: 4 bytes leftover after parsing attributes in process `syz.3.723'. [ 273.688437][ T8541] netlink: 8 bytes leftover after parsing attributes in process `syz.2.731'. [ 273.778554][ T8545] vlan0: entered promiscuous mode [ 274.102272][ T8557] bond3: option min_links: invalid value (18446744071562067969) [ 274.109956][ T8557] bond3: option min_links: allowed values 0 - 2147483647 [ 274.234105][ T8557] bond3 (unregistering): Released all slaves [ 274.502197][ T10] usb 2-1: new full-speed USB device number 22 using dummy_hcd [ 274.682314][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8D has invalid maxpacket 200, setting to 64 [ 274.702077][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 274.711787][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 274.752084][ T10] usb 2-1: New USB device found, idVendor=05ac, idProduct=8215, bcdDevice=8f.58 [ 274.761179][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 274.815090][ T10] usb 2-1: config 0 descriptor?? [ 274.822546][ T8563] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 274.909205][ T5830] Bluetooth: hci5: urb ffff888032ff6e00 submission failed (90) [ 275.069138][ T8378] usb 2-1: USB disconnect, device number 22 [ 276.562357][ T8378] usb 5-1: new high-speed USB device number 32 using dummy_hcd [ 276.764499][ T8378] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 276.798728][ T8378] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 276.819521][ T8378] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 276.842124][ T8378] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 276.858395][ T8378] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 276.890282][ T8378] usb 5-1: config 0 descriptor?? [ 277.135258][ T8620] netlink: 'syz.3.765': attribute type 12 has an invalid length. [ 277.282143][ T10] usb 2-1: new full-speed USB device number 23 using dummy_hcd [ 277.318854][ T8378] plantronics 0003:047F:FFFF.0009: reserved main item tag 0xe [ 277.326594][ T8378] plantronics 0003:047F:FFFF.0009: unknown main item tag 0x0 [ 277.350518][ T8378] plantronics 0003:047F:FFFF.0009: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.4-1/input0 [ 277.494319][ T10] usb 2-1: config 1 interface 0 altsetting 7 endpoint 0x1 has invalid maxpacket 1024, setting to 64 [ 277.542706][ T10] usb 2-1: config 1 interface 0 altsetting 7 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 277.572092][ T10] usb 2-1: config 1 interface 0 has no altsetting 0 [ 277.610622][ T10] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 277.682075][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 277.690135][ T10] usb 2-1: Product: syz [ 277.702064][ T10] usb 2-1: Manufacturer: 憀ᩘ뗾㨃褈䓏囕 [ 277.708540][ T10] usb 2-1: SerialNumber: syz [ 277.747248][ T8618] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 278.025235][ T10] usb 2-1: USB disconnect, device number 23 [ 278.041261][ T6457] udevd[6457]: setting owner of /dev/bus/usb/002/023 to uid=0, gid=7 failed: No such file or directory [ 278.112495][ T8642] hsr0: entered promiscuous mode [ 278.118396][ T8642] macsec1: entered allmulticast mode [ 278.142068][ T8642] hsr0: entered allmulticast mode [ 278.147161][ T8642] hsr_slave_0: entered allmulticast mode [ 278.172325][ T8642] hsr_slave_1: entered allmulticast mode [ 278.183087][ T8642] hsr0: left allmulticast mode [ 278.188120][ T8642] hsr_slave_0: left allmulticast mode [ 278.197013][ T8642] hsr_slave_1: left allmulticast mode [ 278.656873][ T8601] usb 5-1: string descriptor 0 read error: -2 [ 279.459591][ T10] usb 5-1: USB disconnect, device number 32 [ 279.567524][ T8686] tipc: Started in network mode [ 279.582148][ T8686] tipc: Node identity -B, cluster identity 4711 [ 280.102126][ T8378] usb 4-1: new high-speed USB device number 31 using dummy_hcd [ 280.344140][ T8378] usb 4-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 280.382081][ T8378] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 280.391127][ T8378] usb 4-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 280.466492][ T8378] usb 4-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 280.482039][ T8378] usb 4-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 280.522153][ T8378] usb 4-1: Product: syz [ 280.526380][ T8378] usb 4-1: Manufacturer: syz [ 280.563423][ T8378] cdc_wdm 4-1:1.0: skipping garbage [ 280.590522][ T8378] cdc_wdm 4-1:1.0: skipping garbage [ 280.595964][ T8378] cdc_wdm 4-1:1.0: probe with driver cdc_wdm failed with error -22 [ 280.722189][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 280.797297][ T8378] usb 4-1: USB disconnect, device number 31 [ 281.162120][ T8721] netlink: 40 bytes leftover after parsing attributes in process `syz.4.808'. [ 281.612078][ T6170] usb 3-1: new high-speed USB device number 25 using dummy_hcd [ 281.770822][ T8744] netlink: 8 bytes leftover after parsing attributes in process `syz.0.815'. [ 281.784616][ T6170] usb 3-1: Using ep0 maxpacket: 16 [ 281.795812][ T6170] usb 3-1: config 0 has an invalid interface number: 63 but max is 0 [ 281.806279][ T8744] netlink: 48 bytes leftover after parsing attributes in process `syz.0.815'. [ 281.815319][ T6170] usb 3-1: config 0 has no interface number 0 [ 281.821493][ T6170] usb 3-1: config 0 interface 63 altsetting 150 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 281.847976][ T6170] usb 3-1: config 0 interface 63 altsetting 150 endpoint 0x81 has invalid wMaxPacketSize 0 [ 281.876097][ T6170] usb 3-1: config 0 interface 63 altsetting 150 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 281.905942][ T6170] usb 3-1: config 0 interface 63 has no altsetting 0 [ 281.924235][ T6170] usb 3-1: New USB device found, idVendor=28bd, idProduct=0909, bcdDevice= 0.00 [ 281.969055][ T6170] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 282.026146][ T6170] usb 3-1: config 0 descriptor?? [ 282.475347][ T6170] uclogic 0003:28BD:0909.000A: interface is invalid, ignoring [ 282.698496][ T6170] usb 3-1: USB disconnect, device number 25 [ 283.273571][ T8770] netlink: 64 bytes leftover after parsing attributes in process `syz.4.824'. [ 283.327581][ T8770] netlink: 64 bytes leftover after parsing attributes in process `syz.4.824'. [ 284.507610][ T30] audit: type=1326 audit(1766521854.294:86): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8801 comm="syz.3.837" exe="/root/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7fd4539 code=0x0 [ 284.734403][ T8813] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(10) [ 284.741670][ T8813] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 284.780634][ T8813] vhci_hcd vhci_hcd.0: Device attached [ 284.892295][ T7520] usb 5-1: new high-speed USB device number 33 using dummy_hcd [ 285.002879][ T107] usb 39-1: new high-speed USB device number 2 using vhci_hcd [ 285.043570][ T7520] usb 5-1: Using ep0 maxpacket: 8 [ 285.051224][ T7520] usb 5-1: config index 0 descriptor too short (expected 301, got 45) [ 285.067399][ T7520] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 285.079955][ T7520] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 285.100622][ T7520] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 285.100657][ T7520] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 285.100706][ T7520] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 285.100729][ T7520] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 285.322455][ T8814] vhci_hcd: connection reset by peer [ 285.330420][ T6113] vhci_hcd vhci_hcd.3: stop threads [ 285.346728][ T6113] vhci_hcd vhci_hcd.3: release socket [ 285.376663][ T6113] vhci_hcd vhci_hcd.3: disconnect device [ 285.405708][ T7520] usb 5-1: GET_CAPABILITIES returned 0 [ 285.421621][ T7520] usbtmc 5-1:16.0: can't read capabilities [ 285.626294][ T10] usb 5-1: USB disconnect, device number 33 [ 286.938693][ T8862] netlink: 4 bytes leftover after parsing attributes in process `syz.4.855'. [ 287.003448][ T8862] netlink: 4 bytes leftover after parsing attributes in process `syz.4.855'. [ 287.038731][ T8862] netlink: 4 bytes leftover after parsing attributes in process `syz.4.855'. [ 287.072491][ T8862] netlink: 4 bytes leftover after parsing attributes in process `syz.4.855'. [ 290.162136][ T107] vhci_hcd vhci_hcd.3: vhci_device speed not set [ 290.702068][ T6170] usb 2-1: new high-speed USB device number 24 using dummy_hcd [ 290.863563][ T6170] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 290.874670][ T6170] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 290.884994][ T6170] usb 2-1: New USB device found, idVendor=056a, idProduct=030c, bcdDevice= 0.00 [ 290.894956][ T6170] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 290.908863][ T6170] usb 2-1: config 0 descriptor?? [ 291.661922][ T107] usb 2-1: USB disconnect, device number 24 [ 292.640116][ T8958] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 296.076732][ T9031] input: syz1 as /devices/virtual/input/input22 [ 296.722714][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 296.747771][ T9052] input: syz1 as /devices/virtual/input/input23 [ 297.312864][ T9075] input: syz1 as /devices/virtual/input/input24 [ 297.702046][ T8378] usb 5-1: new high-speed USB device number 34 using dummy_hcd [ 297.872136][ T8378] usb 5-1: Using ep0 maxpacket: 16 [ 297.882540][ T8378] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 297.900495][ T8378] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 297.912671][ T8378] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 297.935902][ T8378] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 297.952149][ T8378] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 297.973943][ T8378] usb 5-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 298.004835][ T8378] usb 5-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 298.012990][ T8378] usb 5-1: Manufacturer: syz [ 298.021016][ T8378] usb 5-1: config 0 descriptor?? [ 298.341066][ T8378] rc_core: IR keymap rc-hauppauge not found [ 298.347313][ T8378] Registered IR keymap rc-empty [ 298.352711][ T8378] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 298.372834][ T8378] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 298.418312][ T8378] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0 [ 298.464479][ T8378] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0/input25 [ 298.506054][ T8378] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 298.532198][ T8378] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 298.552212][ T8378] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 298.592192][ T8378] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 298.612182][ T8378] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 298.644328][ T8378] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 298.682326][ T8378] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 298.702140][ T8378] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 298.736725][ T8378] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 298.772140][ T8378] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 298.811138][ T8378] mceusb 5-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 298.825572][ T8378] mceusb 5-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 298.865079][ T8378] usb 5-1: USB disconnect, device number 34 [ 299.341342][ T9125] netlink: 'syz.2.962': attribute type 10 has an invalid length. [ 299.377768][ T9125] bond0: (slave hsr0): The slave device specified does not support setting the MAC address [ 299.402922][ T9125] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 299.462037][ T9125] bond0: (slave hsr0): Error -22 calling dev_set_mtu [ 299.722687][ T5989] usb 5-1: new high-speed USB device number 35 using dummy_hcd [ 299.884963][ T5989] usb 5-1: Using ep0 maxpacket: 8 [ 299.897697][ T5989] usb 5-1: unable to get BOS descriptor or descriptor too short [ 299.926532][ T5989] usb 5-1: config 4 has an invalid interface number: 147 but max is 0 [ 299.947933][ T5989] usb 5-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 299.972124][ T5989] usb 5-1: config 4 has no interface number 0 [ 299.985771][ T5989] usb 5-1: New USB device found, idVendor=04f2, idProduct=b746, bcdDevice=8e.6e [ 300.005374][ T5989] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 300.035852][ T5989] usb 5-1: Product: syz [ 300.050285][ T5989] usb 5-1: Manufacturer: syz [ 300.066357][ T5989] usb 5-1: SerialNumber: syz [ 300.308912][ T5989] uvcvideo 5-1:4.147: Found UVC 0.02 device syz (04f2:b746) [ 300.337274][ T5989] uvcvideo 5-1:4.147: No valid video chain found. [ 300.372616][ T5989] usb 5-1: USB disconnect, device number 35 [ 303.222346][ T10] usb 2-1: new high-speed USB device number 25 using dummy_hcd [ 303.384259][ T10] usb 2-1: config 0 has an invalid interface number: 199 but max is 1 [ 303.392747][ T10] usb 2-1: config 0 has no interface number 1 [ 303.398900][ T10] usb 2-1: config 0 interface 199 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 303.432095][ T10] usb 2-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 303.460157][ T10] usb 2-1: New USB device found, idVendor=0002, idProduct=0000, bcdDevice= 0.00 [ 303.480334][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 303.492595][ T10] usb 2-1: SerialNumber: syz [ 303.541035][ T10] usb 2-1: config 0 descriptor?? [ 303.557649][ T9198] netlink: 16 bytes leftover after parsing attributes in process `syz.2.990'. [ 303.578921][ T10] uvcvideo 2-1:0.199: Found UVC 0.00 device (0002:0000) [ 303.588567][ T10] uvcvideo 2-1:0.199: No valid video chain found. [ 303.679507][ T30] audit: type=1326 audit(1766521873.464:87): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9201 comm="syz.3.992" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fd4539 code=0x7ffc0000 [ 304.422901][ T5918] usb 2-1: USB disconnect, device number 25 [ 304.459479][ T30] audit: type=1326 audit(1766521873.494:88): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9201 comm="syz.3.992" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fd4539 code=0x7ffc0000 [ 304.589789][ T30] audit: type=1326 audit(1766521873.494:89): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9201 comm="syz.3.992" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fd4539 code=0x7ffc0000 [ 304.702695][ T30] audit: type=1326 audit(1766521873.494:90): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9201 comm="syz.3.992" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fd4539 code=0x7ffc0000 [ 304.848073][ T30] audit: type=1326 audit(1766521873.494:91): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9201 comm="syz.3.992" exe="/root/syz-executor" sig=0 arch=40000003 syscall=386 compat=1 ip=0xf7fd4539 code=0x7ffc0000 [ 304.864698][ T9215] input: syz0 as /devices/virtual/input/input26 [ 304.885867][ T30] audit: type=1326 audit(1766521873.494:92): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9201 comm="syz.3.992" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fd4539 code=0x7ffc0000 [ 304.958680][ T30] audit: type=1326 audit(1766521873.494:93): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9201 comm="syz.3.992" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fd4539 code=0x7ffc0000 [ 305.010050][ T30] audit: type=1326 audit(1766521873.494:94): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9201 comm="syz.3.992" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fd4539 code=0x7ffc0000 [ 305.089990][ T30] audit: type=1326 audit(1766521873.494:95): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9201 comm="syz.3.992" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fd4539 code=0x7ffc0000 [ 305.132230][ T30] audit: type=1326 audit(1766521873.494:96): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9201 comm="syz.3.992" exe="/root/syz-executor" sig=0 arch=40000003 syscall=120 compat=1 ip=0xf7fd4539 code=0x7ffc0000 [ 305.409699][ T9234] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 305.813009][ T9] usb 3-1: new low-speed USB device number 26 using dummy_hcd [ 305.995576][ T9] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 306.007508][ T9] usb 3-1: config 0 has no interface number 0 [ 306.014354][ T9] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 306.122800][ T9] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 306.133968][ T9] usb 3-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 306.143299][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 306.160628][ T9] usb 3-1: config 0 descriptor?? [ 306.192730][ T9240] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 306.238649][ T9] iowarrior 3-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 306.457650][ T5918] usb 3-1: USB disconnect, device number 26 [ 307.456704][ T9278] netlink: 168 bytes leftover after parsing attributes in process `syz.0.1021'. [ 307.512134][ T9278] netlink: 168 bytes leftover after parsing attributes in process `syz.0.1021'. [ 308.133586][ T9298] cgroup: fork rejected by pids controller in /syz3 [ 308.968656][ T12] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 309.174214][ T12] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 309.287261][ T12] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 309.448646][ T12] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 309.878077][ T5834] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 309.891139][ T5834] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 309.899828][ T5834] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 309.909632][ T5834] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 309.917476][ T5834] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 309.992242][ T12] bridge_slave_1: left allmulticast mode [ 309.997972][ T12] bridge_slave_1: left promiscuous mode [ 310.054210][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 310.153262][ T12] : left allmulticast mode [ 310.196045][ T12] : left promiscuous mode [ 310.200793][ T12] bridge0: port 1() entered disabled state [ 311.108706][ T12] bridge0 (unregistering): left allmulticast mode [ 311.501100][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 311.513890][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 311.526864][ T12] bond0 (unregistering): Released all slaves [ 311.548198][ T9360] tipc: Enabling of bearer rejected, failed to enable media [ 311.698321][ T12] tipc: Left network mode [ 312.005110][ T5830] Bluetooth: hci1: command tx timeout [ 312.347535][ T9393] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1056'. [ 312.356955][ T9393] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1056'. [ 312.367075][ T9393] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1056'. [ 312.477669][ T12] hsr_slave_0: left promiscuous mode [ 312.501075][ T12] hsr_slave_1: left promiscuous mode [ 312.522300][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 312.550263][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 312.591780][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 312.624967][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 312.761542][ T12] veth1_macvtap: left promiscuous mode [ 312.769042][ T12] veth0_macvtap: left promiscuous mode [ 312.783762][ T12] veth1_vlan: left promiscuous mode [ 312.817903][ T12] veth0_vlan: left promiscuous mode [ 314.082060][ T5830] Bluetooth: hci1: command tx timeout [ 314.177265][ T12] team0 (unregistering): Port device team_slave_1 removed [ 314.260860][ T12] team0 (unregistering): Port device team_slave_0 removed [ 315.436782][ T9346] chnl_net:caif_netlink_parms(): no params data found [ 315.592168][ T9437] capability: warning: `syz.1.1065' uses deprecated v2 capabilities in a way that may be insecure [ 315.972806][ T9346] bridge0: port 1(bridge_slave_0) entered blocking state [ 315.996394][ T9346] bridge0: port 1(bridge_slave_0) entered disabled state [ 316.022270][ T9346] bridge_slave_0: entered allmulticast mode [ 316.044235][ T9346] bridge_slave_0: entered promiscuous mode [ 316.074018][ T9346] bridge0: port 2(bridge_slave_1) entered blocking state [ 316.081421][ T9346] bridge0: port 2(bridge_slave_1) entered disabled state [ 316.109001][ T9346] bridge_slave_1: entered allmulticast mode [ 316.127409][ T9346] bridge_slave_1: entered promiscuous mode [ 316.162173][ T5830] Bluetooth: hci1: command tx timeout [ 316.299502][ T9346] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 316.350991][ T9346] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 316.527576][ T9346] team0: Port device team_slave_0 added [ 316.551164][ T9346] team0: Port device team_slave_1 added [ 316.655263][ T9346] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 316.683824][ T9346] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 316.735127][ T9346] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 316.754181][ T9346] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 316.761257][ T9346] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 316.793072][ T9346] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 317.086673][ T9346] hsr_slave_0: entered promiscuous mode [ 317.095627][ T9346] hsr_slave_1: entered promiscuous mode [ 317.104454][ T9346] debugfs: 'hsr0' already exists in 'hsr' [ 317.110295][ T9346] Cannot create hsr debugfs directory [ 317.208167][ T1298] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.214641][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 318.220166][ T9475] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1070'. [ 318.257293][ T5830] Bluetooth: hci1: command tx timeout [ 318.301123][ T9346] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 318.340044][ T9346] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 318.361063][ T9346] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 318.385085][ T9480] netlink: 'syz.4.1071': attribute type 6 has an invalid length. [ 318.395965][ T9346] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 318.678913][ T9346] 8021q: adding VLAN 0 to HW filter on device bond0 [ 318.731184][ T9346] 8021q: adding VLAN 0 to HW filter on device team0 [ 318.772837][ T1159] bridge0: port 1(bridge_slave_0) entered blocking state [ 318.780107][ T1159] bridge0: port 1(bridge_slave_0) entered forwarding state [ 318.849135][ T1159] bridge0: port 2(bridge_slave_1) entered blocking state [ 318.856405][ T1159] bridge0: port 2(bridge_slave_1) entered forwarding state [ 319.067807][ T9346] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 319.178289][ T9346] veth0_vlan: entered promiscuous mode [ 319.215173][ T9346] veth1_vlan: entered promiscuous mode [ 319.315406][ T9346] veth0_macvtap: entered promiscuous mode [ 319.341142][ T9346] veth1_macvtap: entered promiscuous mode [ 319.408705][ T9346] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 319.447269][ T9346] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 319.507345][ T6113] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 319.534594][ T6113] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 319.632742][ T6113] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 319.701246][ T1159] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 319.875752][ T9532] netlink: 67 bytes leftover after parsing attributes in process `syz.4.1082'. [ 319.942052][ T6113] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 319.986840][ T6113] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 320.126605][ T6113] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 320.152200][ T6113] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 321.703658][ T9594] bond_slave_0: entered promiscuous mode [ 321.710079][ T9594] bond_slave_1: entered promiscuous mode [ 321.723420][ T9594] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 321.734926][ T9601] netlink: 'syz.0.1102': attribute type 6 has an invalid length. [ 321.747773][ T9594] bond1: (slave macvlan2): making interface the new active one [ 321.761592][ T9594] bond1: (slave macvlan2): Enslaving as an active interface with an up link [ 321.911314][ T9606] netlink: 'syz.0.1102': attribute type 21 has an invalid length. [ 321.953951][ T9606] netlink: 'syz.0.1102': attribute type 6 has an invalid length. [ 321.991842][ T9606] netlink: 132 bytes leftover after parsing attributes in process `syz.0.1102'. [ 324.962488][ T903] usb 4-1: new high-speed USB device number 32 using dummy_hcd [ 325.122598][ T903] usb 4-1: Using ep0 maxpacket: 16 [ 325.148782][ T903] usb 4-1: unable to get BOS descriptor or descriptor too short [ 325.189502][ T903] usb 4-1: New USB device found, idVendor=a257, idProduct=2013, bcdDevice=ab.34 [ 325.212201][ T903] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 325.231391][ T903] usb 4-1: Product: syz [ 325.241583][ T903] usb 4-1: Manufacturer: syz [ 325.261348][ T903] usb 4-1: SerialNumber: syz [ 325.278374][ T30] kauditd_printk_skb: 16 callbacks suppressed [ 325.278394][ T30] audit: type=1326 audit(1766521895.064:113): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9693 comm="syz.0.1127" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709d539 code=0x7ffc0000 [ 325.418537][ T30] audit: type=1326 audit(1766521895.064:114): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9693 comm="syz.0.1127" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709d539 code=0x7ffc0000 [ 325.495817][ T30] audit: type=1326 audit(1766521895.104:115): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9693 comm="syz.0.1127" exe="/root/syz-executor" sig=0 arch=40000003 syscall=436 compat=1 ip=0xf709d539 code=0x7ffc0000 [ 325.578602][ T903] usb 4-1: USB disconnect, device number 32 [ 325.603335][ T30] audit: type=1326 audit(1766521895.104:116): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9693 comm="syz.0.1127" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709d539 code=0x7ffc0000 [ 325.660302][ T30] audit: type=1326 audit(1766521895.104:117): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9693 comm="syz.0.1127" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709d539 code=0x7ffc0000 [ 326.675876][ T9729] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1142'. [ 327.443577][ C0] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 327.588670][ T9759] netlink: 'syz.1.1150': attribute type 1 has an invalid length. [ 327.778193][ T9767] tipc: Started in network mode [ 327.788897][ T9767] tipc: Node identity , cluster identity 4711 [ 327.793993][ T9768] raw_sendmsg: syz.0.1152 forgot to set AF_INET. Fix it! [ 327.798357][ T9767] tipc: Failed to obtain node identity [ 327.819754][ T9767] tipc: Enabling of bearer rejected, failed to enable media [ 328.552089][ T10] usb 3-1: new high-speed USB device number 27 using dummy_hcd [ 328.727100][ T10] usb 3-1: config 0 has an invalid interface number: 204 but max is 0 [ 328.753232][ T10] usb 3-1: config 0 has no interface number 0 [ 328.775112][ T10] usb 3-1: New USB device found, idVendor=12d6, idProduct=0444, bcdDevice=29.3d [ 328.789383][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 328.800701][ T10] usb 3-1: Product: syz [ 328.806233][ T10] usb 3-1: Manufacturer: syz [ 328.811156][ T10] usb 3-1: SerialNumber: syz [ 328.837318][ T10] usb 3-1: config 0 descriptor?? [ 328.848740][ T10] ems_usb 3-1:0.204 (unnamed net_device) (uninitialized): couldn't initialize controller: -22 [ 328.860493][ T10] ems_usb 3-1:0.204: probe with driver ems_usb failed with error -22 [ 329.010774][ T30] audit: type=1326 audit(1766521898.794:118): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9798 comm="syz.0.1168" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709d539 code=0x7ffc0000 [ 329.075654][ T30] audit: type=1326 audit(1766521898.824:119): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9798 comm="syz.0.1168" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709d539 code=0x7ffc0000 [ 329.161922][ T30] audit: type=1326 audit(1766521898.844:120): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9798 comm="syz.0.1168" exe="/root/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf709d539 code=0x7ffc0000 [ 329.203965][ T30] audit: type=1326 audit(1766521898.844:121): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9798 comm="syz.0.1168" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709d539 code=0x7ffc0000 [ 329.254302][ T30] audit: type=1326 audit(1766521898.854:122): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9798 comm="syz.0.1168" exe="/root/syz-executor" sig=0 arch=40000003 syscall=41 compat=1 ip=0xf709d539 code=0x7ffc0000 [ 329.315446][ T5918] usb 3-1: USB disconnect, device number 27 [ 330.118784][ T9824] TCP: request_sock_TCPv6: Possible SYN flooding on port [::]:20002. Sending cookies. [ 330.742147][ T8378] usb 5-1: new high-speed USB device number 36 using dummy_hcd [ 330.922090][ T8378] usb 5-1: Using ep0 maxpacket: 8 [ 330.956625][ T9852] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1190'. [ 330.962444][ T8378] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 330.988158][ T8378] usb 5-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 331.017669][ T8378] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 331.049470][ T8378] usb 5-1: config 0 descriptor?? [ 331.287270][ T8378] iowarrior 5-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 331.587132][ T24] usb 5-1: USB disconnect, device number 36 [ 338.350513][T10033] netlink: 32 bytes leftover after parsing attributes in process `syz.4.1262'. [ 338.361284][T10033] netlink: 32 bytes leftover after parsing attributes in process `syz.4.1262'. [ 338.775501][T10014] ip6gre1: entered allmulticast mode [ 338.982449][ T24] usb 5-1: new high-speed USB device number 37 using dummy_hcd [ 339.037280][T10048] netlink: 'syz.2.1267': attribute type 1 has an invalid length. [ 339.107806][T10050] bond1: entered promiscuous mode [ 339.113220][T10050] bond1: entered allmulticast mode [ 339.119243][T10050] 8021q: adding VLAN 0 to HW filter on device bond1 [ 339.175837][ T24] usb 5-1: config 0 has an invalid interface number: 255 but max is 0 [ 339.184582][ T30] kauditd_printk_skb: 1 callbacks suppressed [ 339.184602][ T30] audit: type=1326 audit(1766521908.964:124): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10051 comm="syz.3.1268" exe="/root/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf705d539 code=0x0 [ 339.231867][ T24] usb 5-1: config 0 has no interface number 0 [ 339.254795][T10050] veth3: entered promiscuous mode [ 339.263947][ T24] usb 5-1: too many endpoints for config 0 interface 255 altsetting 255: 255, using maximum allowed: 30 [ 339.273574][T10050] veth3: entered allmulticast mode [ 339.284357][ T24] usb 5-1: config 0 interface 255 altsetting 255 has 0 endpoint descriptors, different from the interface descriptor's value: 255 [ 339.302900][ T24] usb 5-1: config 0 interface 255 has no altsetting 0 [ 339.310544][ T24] usb 5-1: New USB device found, idVendor=0bda, idProduct=0177, bcdDevice=7d.0b [ 339.321090][ T24] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 339.324359][T10050] bond1: (slave veth3): Enslaving as a backup interface with a down link [ 339.353890][ T24] usb 5-1: config 0 descriptor?? [ 339.370296][ T24] ums-realtek 5-1:0.255: USB Mass Storage device detected [ 339.587253][ T10] usb 5-1: USB disconnect, device number 37 [ 339.762540][ T5834] Bluetooth: hci4: command 0x0406 tx timeout [ 340.480421][T10092] macsec1: entered allmulticast mode [ 340.492759][T10092] hsr0: entered allmulticast mode [ 340.504362][T10092] hsr_slave_0: entered allmulticast mode [ 340.532171][T10092] hsr_slave_1: entered allmulticast mode [ 340.569020][T10092] hsr0: left allmulticast mode [ 340.590282][T10092] hsr_slave_0: left allmulticast mode [ 340.601653][T10092] hsr_slave_1: left allmulticast mode [ 340.965022][T10097] TCP: request_sock_TCPv6: Possible SYN flooding on port [::]:20002. Sending cookies. [ 341.112581][T10105] TCP: request_sock_TCPv6: Possible SYN flooding on port [::]:20002. Sending cookies. [ 341.141703][T10106] netlink: 'syz.2.1287': attribute type 10 has an invalid length. [ 341.477904][T10116] syz_tun: entered allmulticast mode [ 341.515643][T10114] syz_tun: left allmulticast mode [ 342.537620][T10137] TCP: tcp_parse_options: Illegal window scaling value 249 > 14 received [ 342.546185][T10137] TCP: tcp_parse_options: Illegal window scaling value 133 > 14 received [ 342.820501][T10147] netlink: 'syz.0.1307': attribute type 1 has an invalid length. [ 342.953883][T10147] bond2: entered promiscuous mode [ 342.959002][T10147] bond2: entered allmulticast mode [ 342.965563][T10147] 8021q: adding VLAN 0 to HW filter on device bond2 [ 343.126967][T10147] veth5: entered promiscuous mode [ 343.179561][T10147] veth5: entered allmulticast mode [ 343.215737][T10147] bond2: (slave veth5): Enslaving as a backup interface with a down link [ 343.559990][T10161] hsr0: entered promiscuous mode [ 343.568884][T10161] macsec1: entered allmulticast mode [ 343.589677][T10161] hsr0: entered allmulticast mode [ 343.595372][T10161] hsr_slave_0: entered allmulticast mode [ 343.601233][T10161] hsr_slave_1: entered allmulticast mode [ 343.688414][T10161] hsr0: left allmulticast mode [ 343.696050][T10161] hsr_slave_0: left allmulticast mode [ 344.402136][T10161] hsr_slave_1: left allmulticast mode [ 345.337911][T10185] netlink: 64 bytes leftover after parsing attributes in process `syz.2.1322'. [ 345.347300][T10185] netlink: 64 bytes leftover after parsing attributes in process `syz.2.1322'. [ 346.032330][ T10] usb 3-1: new full-speed USB device number 28 using dummy_hcd [ 346.211033][ T10] usb 3-1: config 252 has an invalid interface number: 107 but max is 0 [ 346.393961][ T10] usb 3-1: config 252 has no interface number 0 [ 346.415628][ T10] usb 3-1: config 252 interface 107 altsetting 0 has an endpoint descriptor with address 0x6B, changing to 0xB [ 346.480813][ T10] usb 3-1: config 252 interface 107 altsetting 0 endpoint 0xB has invalid wMaxPacketSize 0 [ 346.514738][ T10] usb 3-1: config 252 interface 107 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 10 [ 346.556764][ T10] usb 3-1: config 252 interface 107 altsetting 0 endpoint 0x8A has invalid wMaxPacketSize 0 [ 346.614838][ T10] usb 3-1: New USB device found, idVendor=10f0, idProduct=2002, bcdDevice=d7.67 [ 346.735647][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 346.814644][ T10] usb 3-1: Product: syz [ 346.818885][ T10] usb 3-1: Manufacturer: syz [ 346.876455][ T10] usb 3-1: SerialNumber: syz [ 346.987711][ T10] usbtouchscreen 3-1:252.107: probe with driver usbtouchscreen failed with error -90 [ 347.165533][ T8378] usb 3-1: USB disconnect, device number 28 [ 347.591263][T10229] netlink: 64 bytes leftover after parsing attributes in process `syz.1.1334'. [ 347.611321][T10229] netlink: 64 bytes leftover after parsing attributes in process `syz.1.1334'. [ 348.078431][T10247] netlink: 'syz.1.1339': attribute type 10 has an invalid length. [ 348.437153][T10247] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 349.273134][T10269] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1347'. [ 349.296695][T10269] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1347'. [ 349.322769][T10269] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1347'. [ 349.364028][T10269] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1347'. [ 349.661647][T10281] netlink: 64 bytes leftover after parsing attributes in process `syz.2.1350'. [ 350.884704][T10303] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1361'. [ 350.936521][T10306] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1361'. [ 351.016144][T10308] netlink: 64 bytes leftover after parsing attributes in process `syz.0.1362'. [ 351.295130][T10314] netlink: 'syz.2.1366': attribute type 1 has an invalid length. [ 352.793801][T10346] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1378'. [ 353.108604][T10346] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1378'. [ 355.128584][ T5830] Bluetooth: hci3: command 0x0406 tx timeout [ 355.332933][T10385] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1394'. [ 355.384585][T10385] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1394'. [ 356.649611][T10406] bond2: down delay (128) is not a multiple of miimon (7), value rounded to 126 ms [ 356.733760][T10406] bond2: peer notification delay (5) is not a multiple of miimon (7), value rounded to 0 ms [ 356.833736][T10406] bond2: entered allmulticast mode [ 357.366281][T10414] bridge0: port 2(bridge_slave_1) entered disabled state [ 357.374749][T10414] bridge0: port 1(bridge_slave_0) entered disabled state [ 357.794478][T10426] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1410'. [ 357.909570][T10414] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 357.961846][T10426] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1410'. [ 357.972836][T10414] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 358.039250][T10430] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1410'. [ 360.315472][ T3448] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 360.382658][ T3448] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 360.432067][ T3448] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 360.482187][ T3448] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 363.510548][T10536] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1458'. [ 363.966064][T10540] netlink: 64 bytes leftover after parsing attributes in process `syz.3.1459'. [ 368.691239][T10631] netlink: 'syz.3.1497': attribute type 1 has an invalid length. [ 369.491061][T10660] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1507'. [ 369.513572][T10660] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1507'. [ 369.528058][T10660] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1507'. [ 369.542983][T10660] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1507'. [ 369.757831][T10674] netlink: 'syz.4.1513': attribute type 1 has an invalid length. [ 370.052055][T10687] netlink: 64 bytes leftover after parsing attributes in process `syz.4.1517'. [ 371.214704][T10712] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1523'. [ 371.274428][T10712] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1523'. [ 371.295958][T10712] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1523'. [ 371.313041][T10716] netlink: 'syz.4.1527': attribute type 1 has an invalid length. [ 371.323979][T10712] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1523'. [ 371.570931][T10729] netlink: 64 bytes leftover after parsing attributes in process `syz.2.1529'. [ 372.140631][T10757] netlink: 'syz.3.1543': attribute type 1 has an invalid length. [ 372.772607][T10789] netlink: 'syz.4.1558': attribute type 1 has an invalid length. [ 373.524656][ C0] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 373.642274][ T5905] usb 2-1: new high-speed USB device number 26 using dummy_hcd [ 373.812043][ T5905] usb 2-1: Using ep0 maxpacket: 16 [ 373.825340][ T5905] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 373.859723][ T5905] usb 2-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 22 [ 373.905163][ T5905] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 373.932340][ T5905] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 373.950714][ T5905] usb 2-1: SerialNumber: syz [ 374.225315][ T10] usb 2-1: USB disconnect, device number 26 [ 374.517632][T10850] __nla_validate_parse: 10 callbacks suppressed [ 374.517653][T10850] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1584'. [ 374.554750][T10850] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1584'. [ 374.565964][T10850] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1584'. [ 375.312201][ T5918] usb 2-1: new high-speed USB device number 27 using dummy_hcd [ 375.472653][ T5918] usb 2-1: Using ep0 maxpacket: 16 [ 375.482948][ T5918] usb 2-1: New USB device found, idVendor=1604, idProduct=8007, bcdDevice=af.a6 [ 375.492328][ T5918] usb 2-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 375.501219][ T5918] usb 2-1: Product: syz [ 375.517550][ T5918] usb 2-1: Manufacturer: syz [ 375.542332][ T5918] usb 2-1: SerialNumber: syz [ 375.555265][ T5918] usb 2-1: config 0 descriptor?? [ 375.729392][T10888] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1597'. [ 375.743823][T10888] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1597'. [ 375.778817][T10888] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1597'. [ 375.787645][ T5918] usb 2-1: USB disconnect, device number 27 [ 376.093837][T10897] netlink: 64 bytes leftover after parsing attributes in process `syz.2.1599'. [ 377.172284][T10931] netlink: 64 bytes leftover after parsing attributes in process `syz.4.1613'. [ 377.843360][T10940] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1617'. [ 378.592962][T10960] netlink: 'syz.1.1627': attribute type 1 has an invalid length. [ 378.650464][ T1298] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.657013][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 378.734284][T10967] netlink: 64 bytes leftover after parsing attributes in process `syz.4.1625'. [ 379.910411][T11003] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1639'. [ 380.824452][T11010] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1644'. [ 386.492060][ T5989] usb 4-1: new high-speed USB device number 33 using dummy_hcd [ 386.675327][ T5989] usb 4-1: Using ep0 maxpacket: 8 [ 386.687347][ T5989] usb 4-1: config 0 has an invalid interface number: 150 but max is 0 [ 386.702873][ T5989] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 386.721459][ T5989] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 386.735828][ T5989] usb 4-1: config 0 has 2 interfaces, different from the descriptor's value: 1 [ 386.746611][ T5989] usb 4-1: config 0 has no interface number 0 [ 386.753774][ T5989] usb 4-1: config 0 interface 150 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 386.778235][ T5989] usb 4-1: config 0 interface 150 has no altsetting 0 [ 386.792037][ T5989] usb 4-1: New USB device found, idVendor=1395, idProduct=0300, bcdDevice=81.75 [ 386.822244][ T5989] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 386.850576][ T5989] usb 4-1: config 0 descriptor?? [ 387.300940][ T5920] usb 4-1: USB disconnect, device number 33 [ 388.586387][T11162] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1695'. [ 388.822740][ T7646] cgroup: fork rejected by pids controller in /syz1 [ 388.862237][T11170] syz.3.1705(11170): Attempt to set a LOCK_MAND lock via flock(2). This support has been removed and the request ignored. [ 390.183242][ T3448] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 390.348538][ T3448] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 390.366390][ T5846] cgroup: fork rejected by pids controller in /syz4 [ 390.583988][ T5830] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 390.603940][ T5830] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 390.615599][ T5830] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 390.625000][ T5830] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 390.643166][ T5830] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 391.328245][ T3448] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 391.477339][T11220] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1727'. [ 391.613616][T11205] chnl_net:caif_netlink_parms(): no params data found [ 391.808762][ T3448] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 392.284793][T11205] bridge0: port 1(bridge_slave_0) entered blocking state [ 392.314889][T11205] bridge0: port 1(bridge_slave_0) entered disabled state [ 392.336090][T11205] bridge_slave_0: entered allmulticast mode [ 392.373258][T11205] bridge_slave_0: entered promiscuous mode [ 392.404416][T11205] bridge0: port 2(bridge_slave_1) entered blocking state [ 392.422184][T11205] bridge0: port 2(bridge_slave_1) entered disabled state [ 392.429390][T11205] bridge_slave_1: entered allmulticast mode [ 392.458067][ T5830] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 392.474612][ T5830] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 392.484625][ T5830] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 392.495136][ T5830] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 392.502864][ T5830] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 392.563314][T11205] bridge_slave_1: entered promiscuous mode [ 392.726483][ T8378] usb 3-1: new high-speed USB device number 29 using dummy_hcd [ 392.734309][ T5834] Bluetooth: hci4: command tx timeout [ 392.922092][ T8378] usb 3-1: Using ep0 maxpacket: 8 [ 392.941199][T11205] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 393.001581][ T8378] usb 3-1: config index 0 descriptor too short (expected 30, got 18) [ 393.052394][ T8378] usb 3-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 393.082057][ T8378] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 393.092154][ T8378] usb 3-1: Product: syz [ 393.104953][ T8378] usb 3-1: Manufacturer: syz [ 393.109954][ T8378] usb 3-1: SerialNumber: syz [ 393.129374][ T8378] usb 3-1: config 0 descriptor?? [ 393.147759][ T8378] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 393.176863][ T8378] usb 3-1: setting power ON [ 393.181527][ T8378] dvb-usb: bulk message failed: -22 (2/0) [ 393.203556][ T8378] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 393.240089][ T8378] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID)) [ 393.258819][ T8378] usb 3-1: media controller created [ 393.286033][ T8378] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 393.370728][T11235] dvb-usb: bulk message failed: -22 (3/0) [ 393.382370][T11205] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 393.403783][T11235] cxusb: i2c wr: len=113 is too big! [ 393.403783][T11235] [ 393.433305][ T8378] usb 3-1: selecting invalid altsetting 6 [ 393.463708][ T8378] usb 3-1: digital interface selection failed (-22) [ 393.489008][ T8378] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)' [ 393.501227][ T8378] usb 3-1: setting power OFF [ 393.508820][ T8378] dvb-usb: bulk message failed: -22 (2/0) [ 393.519722][ T8378] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 393.531742][ T8378] (NULL device *): no alternate interface [ 393.609727][ T8378] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 393.657717][ T8378] usb 3-1: USB disconnect, device number 29 [ 393.726119][T11205] team0: Port device team_slave_0 added [ 393.784281][T11205] team0: Port device team_slave_1 added [ 393.798217][ T3448] bridge_slave_1: left allmulticast mode [ 393.818893][ T3448] bridge_slave_1: left promiscuous mode [ 394.285689][ T3448] bridge0: port 2(bridge_slave_1) entered disabled state [ 394.319706][ T3448] bridge_slave_0: left allmulticast mode [ 394.346967][ T3448] bridge_slave_0: left promiscuous mode [ 394.368083][ T3448] bridge0: port 1(bridge_slave_0) entered disabled state [ 394.562136][ T5834] Bluetooth: hci2: command tx timeout [ 394.802088][ T5834] Bluetooth: hci4: command tx timeout [ 395.545618][ T3448] team0: Port device bond0 removed [ 395.553146][ T3448] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 395.566388][ T3448] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 395.577471][ T3448] bond0 (unregistering): (slave wlan1): Releasing backup interface [ 395.594698][ T3448] bond0 (unregistering): Released all slaves [ 395.608817][ T3448] bond1 (unregistering): Released all slaves [ 395.657906][T11249] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1738'. [ 395.669293][T11255] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1740'. [ 395.779908][ T3448] tipc: Disabling bearer [ 395.794221][ T3448] tipc: Left network mode [ 395.795157][T11205] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 395.837941][T11205] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 395.865638][T11205] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 395.899379][T11205] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 395.921580][T11205] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 395.948778][T11205] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 396.418606][T11205] hsr_slave_0: entered promiscuous mode [ 396.438482][T11205] hsr_slave_1: entered promiscuous mode [ 396.465066][T11205] debugfs: 'hsr0' already exists in 'hsr' [ 396.500050][T11205] Cannot create hsr debugfs directory [ 396.642956][ T5834] Bluetooth: hci2: command tx timeout [ 396.892573][ T5834] Bluetooth: hci4: command tx timeout [ 396.901591][ T3448] hsr_slave_0: left promiscuous mode [ 396.917143][ T3448] hsr_slave_1: left promiscuous mode [ 396.938912][ T3448] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 396.969627][ T3448] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 397.013930][ T3448] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 397.040003][ T3448] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 397.133220][ T3448] veth1_macvtap: left promiscuous mode [ 397.139035][ T3448] veth0_macvtap: left promiscuous mode [ 397.162888][ T3448] veth1_vlan: left promiscuous mode [ 397.176117][ T3448] veth0_vlan: left promiscuous mode [ 398.711862][ T3448] team0 (unregistering): Port device team_slave_1 removed [ 398.722076][ T5834] Bluetooth: hci2: command tx timeout [ 398.894130][ T3448] team0 (unregistering): Port device team_slave_0 removed [ 398.982069][ T5834] Bluetooth: hci4: command tx timeout [ 399.817629][T11292] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1752'. [ 400.285952][T11236] chnl_net:caif_netlink_parms(): no params data found [ 400.703356][T11317] warning: `syz.3.1759' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 400.802012][ T5834] Bluetooth: hci2: command tx timeout [ 401.340186][T11236] bridge0: port 1(bridge_slave_0) entered blocking state [ 401.382960][T11236] bridge0: port 1(bridge_slave_0) entered disabled state [ 401.407547][T11236] bridge_slave_0: entered allmulticast mode [ 401.436006][T11236] bridge_slave_0: entered promiscuous mode [ 401.463260][T11348] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1765'. [ 401.498439][T11236] bridge0: port 2(bridge_slave_1) entered blocking state [ 401.527340][T11236] bridge0: port 2(bridge_slave_1) entered disabled state [ 401.537940][ T3448] ------------[ cut here ]------------ [ 401.543198][T11236] bridge_slave_1: entered allmulticast mode [ 401.544222][ T3448] WARNING: net/netfilter/core.c:329 at nf_hook_entry_head+0x23e/0x2c0, CPU#0: kworker/u8:9/3448 [ 401.560643][ T3448] Modules linked in: [ 401.561387][T11236] bridge_slave_1: entered promiscuous mode [ 401.565249][ T3448] CPU: 0 UID: 0 PID: 3448 Comm: kworker/u8:9 Tainted: G L syzkaller #0 PREEMPT(full) [ 401.565283][ T3448] Tainted: [L]=SOFTLOCKUP [ 401.565293][ T3448] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 401.565308][ T3448] Workqueue: netns cleanup_net [ 401.565339][ T3448] RIP: 0010:nf_hook_entry_head+0x23e/0x2c0 [ 401.565373][ T3448] Code: 4c 89 f8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df 80 3c 08 00 74 08 4c 89 ff e8 ed 75 a7 f8 4d 39 37 74 36 e8 73 55 41 f8 90 <0f> 0b 90 31 db 48 89 d8 5b 41 5e 41 5f 5d e9 bf cf dc 01 cc e8 59 [ 401.565392][ T3448] RSP: 0018:ffffc9000c217788 EFLAGS: 00010293 [ 401.565413][ T3448] RAX: ffffffff897f9fcb RBX: ffff888057ce4000 RCX: ffff88803025bd00 [ 401.642849][ T3448] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 401.650951][ T3448] RBP: 0000000000000000 R08: ffff88803025bd00 R09: 0000000000000006 [ 401.659268][ T3448] R10: 000000000000000a R11: 0000000000000000 R12: ffff888077b2cb80 [ 401.667540][ T3448] R13: 0000000000000005 R14: ffff888077b2cb80 R15: ffff888057ce4108 [ 401.675575][ T3448] FS: 0000000000000000(0000) GS:ffff888125e1f000(0000) knlGS:0000000000000000 [ 401.684678][ T3448] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 401.691297][ T3448] CR2: 0000000030c22ff8 CR3: 00000000788cc000 CR4: 00000000003526f0 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 401.699353][ T3448] DR0: ffffffffffffffff DR1: 00000000000001f8 DR2: 0000000000000083 [ 401.707418][ T3448] DR3: ffffffffefffff15 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 401.715454][ T3448] Call Trace: [ 401.718746][ T3448] [ 401.721671][ T3448] __nf_unregister_net_hook+0x74/0x6f0 [ 401.727217][ T3448] ? __pfx_nf_flow_table_offload_setup+0x10/0x10 [ 401.733568][ T3448] __nft_release_hook+0x180/0x350 [ 401.738601][ T3448] nf_tables_pre_exit_net+0xa7/0x110 [ 401.743942][ T3448] ops_undo_list+0x187/0x990 [ 401.748530][ T3448] ? __pfx_ops_undo_list+0x10/0x10 [ 401.753680][ T3448] ? do_raw_spin_unlock+0x122/0x240 [ 401.758968][ T3448] cleanup_net+0x4d8/0x7a0 [ 401.763452][ T3448] ? __pfx_cleanup_net+0x10/0x10 [ 401.768396][ T3448] ? process_scheduled_works+0x9ef/0x1770 [ 401.774182][ T3448] ? process_scheduled_works+0x9ef/0x1770 [ 401.779936][ T3448] process_scheduled_works+0xad1/0x1770 [ 401.785556][ T3448] ? __pfx_process_scheduled_works+0x10/0x10 [ 401.791537][ T3448] ? do_raw_spin_lock+0x121/0x290 [ 401.796601][ T3448] worker_thread+0x8a0/0xda0 [ 401.801207][ T3448] kthread+0x711/0x8a0 [ 401.805333][ T3448] ? __pfx_worker_thread+0x10/0x10 [ 401.810441][ T3448] ? __pfx_kthread+0x10/0x10 [ 401.815076][ T3448] ? _raw_spin_unlock_irq+0x23/0x50 [ 401.820275][ T3448] ? __pfx_kthread+0x10/0x10 [ 401.824902][ T3448] ret_from_fork+0x510/0xa50 [ 401.829501][ T3448] ? __pfx_ret_from_fork+0x10/0x10 [ 401.834624][ T3448] ? __switch_to+0xc9e/0x1480 [ 401.839302][ T3448] ? __pfx_kthread+0x10/0x10 [ 401.843937][ T3448] ret_from_fork_asm+0x1a/0x30 [ 401.848710][ T3448] [ 401.851721][ T3448] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 401.859013][ T3448] CPU: 0 UID: 0 PID: 3448 Comm: kworker/u8:9 Tainted: G L syzkaller #0 PREEMPT(full) [ 401.870042][ T3448] Tainted: [L]=SOFTLOCKUP [ 401.874375][ T3448] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 401.884422][ T3448] Workqueue: netns cleanup_net [ 401.889198][ T3448] Call Trace: [ 401.892471][ T3448] [ 401.895396][ T3448] vpanic+0x1e0/0x670 [ 401.899374][ T3448] panic+0xb9/0xc0 [ 401.903099][ T3448] ? __pfx_panic+0x10/0x10 [ 401.907542][ T3448] ? ret_from_fork_asm+0x1a/0x30 [ 401.912481][ T3448] __warn+0x317/0x4b0 [ 401.916457][ T3448] ? nf_hook_entry_head+0x23e/0x2c0 [ 401.921651][ T3448] ? nf_hook_entry_head+0x23e/0x2c0 [ 401.926840][ T3448] __report_bug+0x288/0x500 [ 401.931350][ T3448] ? nf_hook_entry_head+0x23e/0x2c0 [ 401.936545][ T3448] ? __pfx___report_bug+0x10/0x10 [ 401.941560][ T3448] ? nf_flow_offload_xdp_setup+0x68a/0x690 [ 401.947363][ T3448] ? kfree+0x1c0/0x660 [ 401.951443][ T3448] ? nf_flow_offload_xdp_setup+0x68a/0x690 [ 401.957251][ T3448] ? nf_hook_entry_head+0x23e/0x2c0 [ 401.962473][ T3448] report_bug+0x16a/0x220 [ 401.966800][ T3448] ? nf_hook_entry_head+0x23e/0x2c0 [ 401.971993][ T3448] ? nf_hook_entry_head+0x240/0x2c0 [ 401.977182][ T3448] handle_bug+0x98/0x200 [ 401.981415][ T3448] exc_invalid_op+0x1a/0x50 [ 401.985909][ T3448] asm_exc_invalid_op+0x1a/0x20 [ 401.990754][ T3448] RIP: 0010:nf_hook_entry_head+0x23e/0x2c0 [ 401.996557][ T3448] Code: 4c 89 f8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df 80 3c 08 00 74 08 4c 89 ff e8 ed 75 a7 f8 4d 39 37 74 36 e8 73 55 41 f8 90 <0f> 0b 90 31 db 48 89 d8 5b 41 5e 41 5f 5d e9 bf cf dc 01 cc e8 59 [ 402.016162][ T3448] RSP: 0018:ffffc9000c217788 EFLAGS: 00010293 [ 402.022258][ T3448] RAX: ffffffff897f9fcb RBX: ffff888057ce4000 RCX: ffff88803025bd00 [ 402.030246][ T3448] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 402.038206][ T3448] RBP: 0000000000000000 R08: ffff88803025bd00 R09: 0000000000000006 [ 402.046168][ T3448] R10: 000000000000000a R11: 0000000000000000 R12: ffff888077b2cb80 [ 402.054133][ T3448] R13: 0000000000000005 R14: ffff888077b2cb80 R15: ffff888057ce4108 [ 402.062199][ T3448] ? nf_hook_entry_head+0x1fb/0x2c0 [ 402.067400][ T3448] ? nf_hook_entry_head+0x1fb/0x2c0 [ 402.072592][ T3448] __nf_unregister_net_hook+0x74/0x6f0 [ 402.078049][ T3448] ? __pfx_nf_flow_table_offload_setup+0x10/0x10 [ 402.084458][ T3448] __nft_release_hook+0x180/0x350 [ 402.089496][ T3448] nf_tables_pre_exit_net+0xa7/0x110 [ 402.094778][ T3448] ops_undo_list+0x187/0x990 [ 402.099394][ T3448] ? __pfx_ops_undo_list+0x10/0x10 [ 402.104503][ T3448] ? do_raw_spin_unlock+0x122/0x240 [ 402.109700][ T3448] cleanup_net+0x4d8/0x7a0 [ 402.114110][ T3448] ? __pfx_cleanup_net+0x10/0x10 [ 402.119057][ T3448] ? process_scheduled_works+0x9ef/0x1770 [ 402.124767][ T3448] ? process_scheduled_works+0x9ef/0x1770 [ 402.130479][ T3448] process_scheduled_works+0xad1/0x1770 [ 402.136030][ T3448] ? __pfx_process_scheduled_works+0x10/0x10 [ 402.142002][ T3448] ? do_raw_spin_lock+0x121/0x290 [ 402.147029][ T3448] worker_thread+0x8a0/0xda0 [ 402.151623][ T3448] kthread+0x711/0x8a0 [ 402.155705][ T3448] ? __pfx_worker_thread+0x10/0x10 [ 402.160808][ T3448] ? __pfx_kthread+0x10/0x10 [ 402.165394][ T3448] ? _raw_spin_unlock_irq+0x23/0x50 [ 402.170600][ T3448] ? __pfx_kthread+0x10/0x10 [ 402.175183][ T3448] ret_from_fork+0x510/0xa50 [ 402.179766][ T3448] ? __pfx_ret_from_fork+0x10/0x10 [ 402.184864][ T3448] ? __switch_to+0xc9e/0x1480 [ 402.189546][ T3448] ? __pfx_kthread+0x10/0x10 [ 402.194143][ T3448] ret_from_fork_asm+0x1a/0x30 [ 402.198921][ T3448] [ 402.202660][ T3448] Kernel Offset: disabled [ 402.206994][ T3448] Rebooting in 86400 seconds..