last executing test programs: 17.78039543s ago: executing program 2 (id=1017): r0 = userfaultfd(0x80001) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x79}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000040)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x8) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) read(r0, &(0x7f00000002c0)=""/153, 0x99) r1 = socket$inet_udplite(0x2, 0x2, 0x88) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x13, r1, 0xcac4b000) mincore(&(0x7f00007ff000/0x800000)=nil, 0x800000, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000002580)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000085}, 0x0) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000280)='./file0\x00', &(0x7f0000000080), 0x0, 0x0) r3 = socket$caif_seqpacket(0x25, 0x5, 0x0) write(r3, 0x0, 0x0) mount$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x3ba42e, &(0x7f00000000c0)=ANY=[@ANYBLOB='nr_inodes=0']) r4 = open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) mknodat$loop(r4, &(0x7f0000001600)='./file1\x00', 0x2000, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x20004041, 0x0, 0x0) ioctl$VIDIOC_DBG_S_REGISTER(r4, 0x4038564f, &(0x7f00000001c0)={{0x0, @name="2f357fa5d015a3699f3ec6379531f985b78a50ba21c6b010fd328727245cc1a7"}, 0x8, 0x5, 0x5}) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r5, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe) ioperm(0x0, 0x2, 0x7e) r6 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r6}, &(0x7f0000bbdffc)) listen(r5, 0x3) accept4$bt_l2cap(r5, 0x0, 0x0, 0x800) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x77359400}, {0x0, 0x989680}}, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000240), r4) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x0, 0x2, @dev={0xfe, 0x80, '\x00', 0x13}, 0x7}, 0x1c) 12.31472326s ago: executing program 2 (id=1023): fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, 0x0, 0x0) sendmmsg$unix(r1, &(0x7f00000bd000), 0x218, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x1) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000640)="430fc73f0f2390b9800000c00f3235010000000f300f20d835080000000f22d8c4e18173f53866baf80cb83879e487ef66bafc0cec66b88e008ec02d1aa80000460f1c460041ae", 0x47}], 0x1, 0x74, 0x0, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x3b, 0x0, &(0x7f0000000240)) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, 0x1, 0x2}, 0x28) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_CAP_X86_USER_SPACE_MSR(0xffffffffffffffff, 0x4068aea3, 0x0) setrlimit(0xf, &(0x7f0000000000)={0x1, 0x5}) bind$inet6(0xffffffffffffffff, &(0x7f0000000200)={0xa, 0x4e20, 0x8, @empty, 0x80ad}, 0x1c) syz_open_dev$dri(&(0x7f0000000340), 0x0, 0x141102) wait4(0x0, 0x0, 0x80000000, 0x0) 10.57328836s ago: executing program 4 (id=1029): setreuid(0xffffffffffffffff, 0xffffffffffffffff) socket$nl_netfilter(0x10, 0x3, 0xc) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newtaction={0x14, 0x30, 0x400, 0x70bd2c}, 0x14}, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x18) sched_setscheduler(0x0, 0x1, &(0x7f0000000180)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000100)='net/sockstat\x00') read$FUSE(r3, &(0x7f0000002780)={0x2020}, 0x5ecfb203) r4 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/power/resume', 0x149a82, 0x0) write$cgroup_int(r4, &(0x7f0000000040)=0x8000000001cb, 0x12) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=ANY=[@ANYBLOB="9e8d66325500e50276bd7000fbdbdf2507000100948ca9e1e3bfb6b6b84b3de81c6c531430e6033839791a167849890fb6c0905d56d93af4b1dd8733cba4807de2f1b1d5acb4d2f0505b5f607f1778222157cff5ad13c1dff761f2d07e", @ANYRES32=0x0], 0x18}, 0x1, 0x0, 0x0, 0x8044}, 0x20000100) socket$nl_netfilter(0x10, 0x3, 0xc) r6 = openat$kvm(0x0, &(0x7f00000002c0), 0xa600, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r8 = eventfd2(0x8, 0x1) ioctl$KVM_IRQFD(r7, 0x4020ae76, &(0x7f0000000140)={r8, 0x4}) write$eventfd(r8, &(0x7f0000000080)=0x430f, 0x8) 9.943446956s ago: executing program 1 (id=1032): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="160000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000800)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000590000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x6, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r1, 0x2000300, 0x70, 0x0, &(0x7f0000000000)="63eced8e46dc3f0adf3389f7b986", 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) 9.601668295s ago: executing program 1 (id=1034): syz_usb_connect(0x0, 0x36, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, 0x0, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000540)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="050026bd7000000000000eff000008000300", @ANYRES32=r2], 0x2c}}, 0x20000014) (fail_nth: 6) 8.760965531s ago: executing program 2 (id=1037): getsockopt$netlink(0xffffffffffffffff, 0x10e, 0x9, 0x0, 0x0) r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x7}, 0x1c) listen(r0, 0xfffffffc) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x0, '\x00', 0x0, 0x0}, 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000002380)={0x1f, 0x11, &(0x7f0000001540)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd}, [@snprintf={{}, {0x3, 0x3, 0x3, 0xa, 0xa}, {0x5, 0x0, 0xb, 0x8, 0x0, 0x0, 0x4}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r1}, {}, {0x85, 0x0, 0x0, 0xb3}}, @call={0x85, 0x0, 0x0, 0xf}]}, &(0x7f0000000080)='syzkaller\x00', 0x4, 0x0, 0x0, 0x0, 0x38, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000000)={r2}, 0xc) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r3, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) sendto$inet(r3, &(0x7f00000000c0)="1c", 0x10002, 0x0, 0x0, 0x0) 8.597434246s ago: executing program 2 (id=1038): socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000040)='net/route\x00') pread64(r2, &(0x7f0000019240)=""/102356, 0x18fd4, 0x200) mmap$binder(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x1, 0x11, r2, 0x9) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) socket$kcm(0x2, 0xa, 0x2) write$tun(r3, &(0x7f00000005c0)=ANY=[@ANYBLOB="000008000100000000003d00000048f800400000000000f78490783fffffffac1414aa440c670000000004000000030000000005f2250dbb08444b", @ANYRES32=0x41424344, @ANYRES32=0x41424344], 0x4e) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_emit_ethernet(0x80, &(0x7f0000000180)=ANY=[@ANYBLOB="bb6233c1eb870180c200000086dd6410f746004a2f0100000000000000000000ffffffffffffff0200000000000000000000000000010401000904000800010086ddef2f6de0080088be000000041c0930000100000000000003080022eb000000010391530002000000000000010000"], 0x0) sendmsg$nl_generic(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="90008a5d368078cb35912585a5010325b07000fcffffff07000000"], 0x14}}, 0x0) r5 = openat$nvme_fabrics(0xffffff9c, &(0x7f0000000000), 0x80081, 0x0) write$uinput_user_dev(r5, &(0x7f0000000840)={'syz0\x00', {0x1, 0x8000, 0x9, 0xac23}, 0x40, [0x10, 0x8000, 0x7, 0x7, 0xffcf, 0x7, 0x8, 0x1ff, 0xe95ab6b, 0x1, 0x4cc59373, 0x0, 0x8001, 0x1, 0x6, 0x8000, 0x4, 0x1, 0x2, 0x6, 0x3, 0x4, 0x10000, 0x0, 0x4e3, 0x1, 0x7fff, 0x5, 0x0, 0x2, 0x1, 0xe, 0x8000, 0x1, 0x9d, 0x80, 0x7, 0x3, 0xbc49, 0x696, 0x8000, 0x1, 0xb, 0x7, 0x7, 0x7, 0x2, 0x3, 0x3, 0xff, 0x1, 0x4, 0x5, 0xffffffff, 0x0, 0x8, 0x7ff, 0x4, 0x8, 0xffffffff, 0x3, 0x100, 0x5, 0xb], [0x7, 0x9d2, 0x80000001, 0x800, 0x3, 0x9, 0x7, 0x8, 0x5, 0x80000001, 0x80008, 0x40, 0x9, 0x8, 0x80000001, 0x4, 0x0, 0xd, 0xfffffff7, 0x3, 0x0, 0x2, 0x2, 0x3, 0xb, 0x66fe, 0x6, 0x5, 0xe03, 0x3ff, 0x10004, 0xfffffc00, 0x1, 0x4, 0x3ff, 0x3, 0x7f, 0x3, 0xd08, 0x1, 0x1, 0x22, 0xfc000000, 0x0, 0x1, 0x4, 0xe37, 0x3, 0x0, 0x1, 0xe8, 0xffff8000, 0x2, 0xb, 0xd7a8, 0x6, 0xbdc, 0x3e6, 0xf970, 0x9, 0x0, 0x8, 0x7fffffff, 0x6], [0x400a, 0x9, 0x7, 0x590, 0x10000000, 0xb0, 0x8, 0x5, 0x2, 0x4, 0x6, 0x7, 0x3, 0x3, 0x4, 0xe, 0x8001, 0x1, 0x0, 0x9, 0x200, 0xbf1c, 0x79fc, 0x1, 0xf9, 0xffffff26, 0x0, 0xfffffff7, 0x9, 0x1, 0x7, 0x2, 0x8000, 0x10, 0x5, 0x3, 0x1, 0x10, 0xb8, 0x6, 0xec5f, 0x8001, 0x7fffffff, 0x1b9, 0x8a7, 0x1, 0x8, 0x3, 0x1, 0x1, 0x4, 0x3, 0x74da, 0xec9, 0x140, 0x6, 0x3, 0x6, 0x1, 0x7fff, 0xa, 0x86c, 0x7, 0x1], [0x0, 0x20f, 0x80000001, 0x200, 0x0, 0x3, 0xb, 0x2, 0xffff, 0x4, 0x9, 0x80000000, 0xffff, 0xb7, 0x3a1, 0xfffffff1, 0xffff, 0xc, 0x8000, 0xfffffffe, 0x9, 0x3ff, 0x1, 0xdf76, 0x63, 0xa, 0x7f, 0x100, 0x40, 0x3, 0x2, 0x8, 0x8, 0x7, 0x4, 0x2170, 0x0, 0x2, 0x6b2, 0x9, 0xcd5e, 0x59, 0x9, 0x6, 0x6, 0x6, 0x5, 0x1, 0x0, 0x4, 0x9, 0x6, 0x1, 0x6, 0x2, 0x3, 0x9, 0xfff, 0x5, 0x3, 0x8, 0x1, 0x5, 0x6]}, 0x45c) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x972, &(0x7f0000006680)) mkdir(&(0x7f0000000040)='./file0\x00', 0x14) bpf$MAP_CREATE(0x0, 0x0, 0x50) r6 = openat$procfs(0xffffff9c, &(0x7f0000000040)='/proc/sysvipc/shm\x00', 0x0, 0x0) r7 = socket$inet6(0xa, 0x3, 0x8000000003c) setsockopt$IP6T_SO_SET_REPLACE(r7, 0x29, 0x40, &(0x7f00000014c0)=@raw={'raw\x00', 0x8, 0x3, 0x480, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x3f8, 0xffffffff, 0xffffffff, 0x3f8, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'team_slave_0\x00'}, 0x0, 0x100, 0x128, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'bond_slave_1\x00', {0x41, 0x1ff, 0x6, 0xb0e2, 0x10001, 0x84e, 0xfffffffb, 0x18, 0x8}, {0x1}}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @private0={0xfc, 0x0, '\x00', 0x1}, [], [0xff], 'erspan0\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0x0, 0x2, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x4e0) connect$inet6(r7, &(0x7f0000000200)={0xa, 0x4ea4, 0x0, @local, 0x9}, 0x1c) sendmsg(r7, &(0x7f00000000c0)={0x0, 0x953a, &(0x7f0000000100)=[{&(0x7f0000000000)="2c10", 0xffd0}], 0x1, 0x0, 0x0, 0x2c}, 0x44004) preadv(r6, &(0x7f0000003240)=[{0x0}, {&(0x7f0000002100)=""/4096, 0x1000}], 0x2, 0x1, 0x0) 8.577576468s ago: executing program 1 (id=1039): r0 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000200)=ANY=[@ANYBLOB="12010000000000404e040c12000000000001090224000100005000090400fefd0300000009210400080122080009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000002c0)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00220800000092371fa7"], 0x0}, 0x0) r1 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) flock(r1, 0x2) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0) 6.769453058s ago: executing program 4 (id=1043): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000001c0)={0x0, 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x38, 0x0, 0x4, 0x8001, 0x0, 0xb49, 0x200000000002, 0x7, 0x8, 0x5}, 0x0) ioctl$DRM_IOCTL_MODE_ADDFB(0xffffffffffffffff, 0xc01c64ae, &(0x7f0000000100)={0x0, 0x4, 0x9, 0x3, 0xf, 0xa, 0xfffffffc}) r2 = socket$netlink(0x10, 0x3, 0x6) sendmsg$nl_route_sched(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=@gettclass={0x24, 0x25, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x6}, {0x0, 0xfff1}, {0x0, 0x9}}}, 0x24}}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0), r3) sendmsg$TIPC_NL_MON_SET(r3, &(0x7f0000000480)={0x0, 0x0, 0x0}, 0x0) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x1000007, 0x2172, 0xffffffffffffffff, 0x0) r4 = syz_open_dev$vim2m(&(0x7f0000000400), 0x7, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r4, 0xc0d05605, &(0x7f0000000080)={0x1, @pix_mp={0x0, 0x7, 0x32315241, 0x35315852, 0x7, [{0x0, 0xdf}, {0x5, 0x2}, {0x1002}, {0x7}, {0xb487, 0x3316aa71}, {0x0, 0x40}, {0x100000, 0x13ff}], 0x0, 0x0, 0x7}}) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0xc) r5 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/mm/ksm/run\x00', 0x1, 0x0) write$sysctl(r5, &(0x7f0000000580)='1\x00', 0x2) r6 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_group_source_req(r6, 0x29, 0x2e, &(0x7f0000000240)={0x8, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @private1}}}, 0x108) setsockopt$inet6_MCAST_MSFILTER(r6, 0x29, 0x30, &(0x7f0000000800)=ANY=[@ANYBLOB="080000000a00000000000000ff010000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000eaffd1ffffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000020000000a00000000000000fc0100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e2ff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000fc01000000000000000000000000000000000000000000000000000000000080945b725a2cd0e500000000000000000000000000000000000000000000000000000000000000000000ff07000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e4bdaa20462a33485645d5152d827251fc692fbc545a01609ddde164ff696922226767b22c53217658fd87d406b5c6a71f4c06106a55e7dfdddbf41f4c5211773563f1eed5feb646a391602412bdd34ef60f1301dfba548351cc899a47467a01144de3892aa17261a46e38667861fc6b295fbda94614ac50e3f1939d732587741e9e01f50a39790923e2cad79cad7d178af49d490876caaaa41734830e58d67028d0ae020defad3f543a51161ffe7c40b6e6ab80555c1ba597d93a57c9635b374ff5ddef3a7d6af976d924aa05805b33915d16d2988fe8b62a4d07b955d0138428e1ed910437bc5b1b"], 0x190) close(r6) syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12011900000000406a0563000000000000010902"], 0x0) write$sysctl(r5, &(0x7f00000000c0)='2\x00', 0x2) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000740)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x4}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1, 0x0, 0xfffd}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x4c, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x6}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x24, 0x4, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @exthdr={{0xb}, @void}}, {0x10, 0x1, 0x0, 0x1, @queue={{0xa}, @void}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0xc0}}, 0x0) 6.684073435s ago: executing program 2 (id=1044): r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000240)=ANY=[@ANYBLOB="12010000020000402505a1a440000102030109025c0002010000000904000001020d0000050716000105240000000d240f0103000000000000000006241a0000080905810300020000000904010000020d00000904010102020d00000905820200020000000905030200020000009769a030aef7dd412d1579ab97b31d0500000000000000496c6e57e1515bfd6f7249c4ce788f45a9225f72837765499f573b9201b71fb82216b7879d6b6f0014ba75708499aa431815ba90e169afaee5440d02460e2d06bdc84529f8745b1e56bc93"], 0x0) syz_emit_vhci(&(0x7f0000000080)=@HCI_EVENT_PKT={0x4, @hci_ev_remote_features={{0xb, 0xb}, {0x6, 0xc8, "2a67000000199800"}}}, 0xe) syz_emit_vhci(&(0x7f0000000380)=@HCI_EVENT_PKT={0x4, @hci_ev_remote_oob_data_request={{0x35, 0x6}, {@none}}}, 0x9) r1 = syz_open_dev$swradio(&(0x7f0000001b40), 0x1, 0x2) ioctl$VIDIOC_ENUM_FREQ_BANDS(r1, 0xc0405665, &(0x7f0000001b80)={0xec4, 0x3, 0x30f, 0x40, 0x1, 0x1, 0x2}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f00000000c0)=0xf) ioctl$VT_WAITACTIVE(r2, 0x5607) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) r3 = syz_usb_connect$cdc_ncm(0x2, 0x7a, &(0x7f0000000100)={{0x12, 0x1, 0x201, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x68, 0x2, 0x1, 0x9, 0x80, 0x4, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0xa, 0x24, 0x6, 0x0, 0x1, "e1155f8b80"}, {0x5, 0x24, 0x0, 0xa}, {0xd, 0x24, 0xf, 0x1, 0xf, 0x485, 0xbc7f, 0xe3}, {0x6, 0x24, 0x1a, 0x49, 0x18}, [@network_terminal={0x7, 0x24, 0xa, 0x9, 0x8, 0x6, 0x2}]}, {{0x9, 0x5, 0x81, 0x3, 0x200, 0x94, 0x81, 0x4}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x40, 0x7, 0xfb, 0x81}}, {{0x9, 0x5, 0x3, 0x2, 0x40, 0x3, 0x5, 0x7f}}}}}}}]}}, &(0x7f00000005c0)={0xa, &(0x7f0000000180)={0xa, 0x6, 0x300, 0x77, 0x2, 0x8, 0x8, 0x5a}, 0x3b, &(0x7f00000003c0)={0x5, 0xf, 0x3b, 0x4, [@ss_container_id={0x14, 0x10, 0x4, 0x6, "d6fdb16b075c161148bf8c25d8e81294"}, @ss_container_id={0x14, 0x10, 0x4, 0x76, "a7d5b4a562acd0c9d185c3217d9cf854"}, @ptm_cap={0x3}, @wireless={0xb, 0x10, 0x1, 0x0, 0x0, 0x7, 0x29, 0x6a7, 0x1}]}, 0x3, [{0xe0, &(0x7f0000000400)=@string={0xe0, 0x3, "9c24a7ff703f4bb19cbe316ab9a0e1f64a19ddafccb7ce42effd9d90e3ef565a1becfed7d51e6bfcbde0bcfbdabb38eeb5ea26f8ff14304df89b71433217bac5d97e715f44df8401a43e85d91cbe129077023ad63cb75fa645fd4bad380e10123c63224611e77cb525cf5556c2bb1b882ac397a93453dc713f32b22469b493f4d477d1801f2bec059d029f13a9a5a88be6027b9f76dfaa446c2261fee4ce0f7de540ad10487ed0b3a1742255bb636410f8e84bcd960a7977f5a6c6f10e5ff9dd760e620fbd484778cc7b95fc05643037f7b98c34488d0c606ff48fbf27f2"}}, {0x69, &(0x7f0000000500)=@string={0x69, 0x3, "9fe204f003fd00e3e92984301637ee2a6a847044ab37e407e076c502e79033ff457c38b3a383c661be6332cfa23074d2994cb08e063b599e95d26ae23f7232ce7b2285a566f3043bee08b70ab2a2afcf7c9be8b82ec09c4d478f2a1f4b0030a5e85b133cbb5538"}}, {0x20, &(0x7f0000000580)=@string={0x20, 0x3, "487745455179a62a19603f5655c4232efcfebd146fb31baee6d01663c566"}}]}) syz_usb_control_io$cdc_ncm(r3, 0x0, &(0x7f0000000340)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x20, 0x80, 0x1c, {0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x400, 0x10, 0x10, 0x10, 0x10, 0x10}}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, &(0x7f0000000740)={0x14, &(0x7f0000000600)={0x60, 0x1, 0xdd, {0xdd, 0xc, "9217f6f76433d84e03a80ab8bfa7e88b12af8145c9bed0a7c2735f7dbe5aa16661372507115e3719c1c6c75523445e75a8e2c73866d17839eff7de97d74e6485762bdd7b52e8dd8109f7c349721f67d49cb3e577e0b1c572ddccadd38215d96630b1b08395c9b5cb86ede43b1be236c34e48d00cf094c552e2e8f9794096e4d4df9f44f30b698770a0344270d27b0925327b0d6411be94f4f5229f15f74b3b78a1031d7f154c52bae71d9971abcd1369ec51eae576cbfcfe87c07ec310f349d6f11f7fd27d29c01300564adb633b87b5dcdfb6da002545c4d63a00"}}, &(0x7f0000000700)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000a00)={0x44, &(0x7f0000000780)={0x20, 0x1, 0x7f, "d035faec2dd1778e3eecbd3bad17805dd828dd741a58a8a3596bc6d447d1ab23bce4d5213afe035ae7dc1311b22e1937e15650f317fc3ab9d46f6cfeae2a61f04758a7e2ab3e9a9aeedbada65433a43287735c4b068952a45eb327ae83174f206a4aeff058a66c39cfdb0dcd608ce7c93f6ef9ca0d96306182f3496b52d9f0"}, &(0x7f0000000840)={0x0, 0xa, 0x1, 0xf5}, &(0x7f0000000880)={0x0, 0x8, 0x1, 0x4}, &(0x7f00000008c0)={0x20, 0x80, 0x1c, {0x1, 0x0, 0xc, 0x7, 0x400, 0x8, 0xb, 0x2, 0xe901, 0x2, 0xb6, 0x5}}, &(0x7f0000000900)={0x20, 0x85, 0x4, 0x3}, &(0x7f0000000940)={0x20, 0x83, 0x2}, &(0x7f0000000980)={0x20, 0x87, 0x2, 0x4}, &(0x7f00000009c0)={0x20, 0x89, 0x2}}) syz_usb_control_io$cdc_ncm(r0, &(0x7f0000000080)={0x14, 0x0, &(0x7f0000000040)={0x0, 0x3, 0x1a, {0x12}}}, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000002, 0x2a012, r4, 0x0) accept$inet(r4, &(0x7f0000000000)={0x2, 0x0, @remote}, &(0x7f00000000c0)=0x10) 6.66617749s ago: executing program 3 (id=1046): socket$inet_tcp(0x2, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) msgget$private(0x0, 0x500) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000840)={'batadv_slave_0\x00'}) socket$nl_generic(0x10, 0x3, 0x10) fanotify_init(0x0, 0x0) prctl$PR_SET_IO_FLUSHER(0x43, 0x1) brk(0x689d80000000) syz_open_dev$cec(&(0x7f0000000100), 0x0, 0x103000) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, 0x0, 0x0) r2 = syz_open_dev$cec(&(0x7f0000000d00), 0x0, 0xc0b02) ioctl$CEC_TRANSMIT(r2, 0xc0386105, &(0x7f0000000d40)={0xffffffffffffffff, 0x1, 0x24, 0x4, 0x0, 0x4, "57c1169b6664ea61326ac71ae7213059", 0x0, 0xfc, 0x0, 0x10}) ioctl$CEC_TRANSMIT(r2, 0xc0386105, &(0x7f0000000140)={0x100000000, 0x800, 0xf, 0x80000001, 0xfe1c, 0x6, "72aba977dbfdc5bd97abc35000", 0x74, 0x3, 0xa7, 0x7, 0x8, 0x7, 0x29}) r3 = socket(0x1d, 0x2, 0x6) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f0000000140)={'vxcan1\x00', 0x0}) bind$can_j1939(r3, &(0x7f0000000000)={0x1d, r5, 0x3}, 0x18) sendmmsg$inet(r3, &(0x7f0000002e00)=[{{0x0, 0x0, &(0x7f0000001300)=[{&(0x7f0000000080)="d171e4c4c55f7973", 0x8}], 0x1}}, {{0x0, 0x0, 0x0}}], 0x2, 0x0) syz_usb_connect(0x4, 0x0, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r6 = syz_open_dev$sg(&(0x7f00000000c0), 0x0, 0x0) fcntl$dupfd(r6, 0x0, r6) 5.916632235s ago: executing program 1 (id=1047): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x20000, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'rose0\x00', 0x112}) r1 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) sendmsg$NL80211_CMD_GET_SURVEY(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000a}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, 0x0, 0x404, 0x70bd2c, 0x25dfdbfe, {{}, {@val={0x8}, @void}}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x40000) r2 = getpid() r3 = syz_pidfd_open(r2, 0x0) ioctl$FS_IOC_GETVERSION(r3, 0x80087601, &(0x7f0000000000)) (async) ioctl$TUNATTACHFILTER(r0, 0x400454d1, &(0x7f00000000c0)={0x0, 0x0}) 5.794912289s ago: executing program 1 (id=1048): syz_open_dev$vim2m(&(0x7f0000000000), 0x7, 0x2) socket$rds(0x15, 0x5, 0x0) syz_open_dev$loop(&(0x7f0000000100), 0x2, 0x2001) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6_udplite(0xa, 0x2, 0x88) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/cpuinfo\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)) eventfd2(0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_io_uring_setup(0x117, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x3a6}, 0x0, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0x14, &(0x7f0000000080)=0x201000, 0x4) socket(0x11, 0x2, 0x0) syz_open_dev$swradio(&(0x7f00000019c0), 0x0, 0x2) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x67) openat$ptp0(0xffffffffffffff9c, &(0x7f0000002040), 0x0, 0x0) fsopen(&(0x7f00000000c0)='nfs\x00', 0x1) socketpair(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) getpeername$packet(r1, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) sendmmsg(r0, &(0x7f0000001a00)=[{{&(0x7f0000000700)=@xdp={0x2c, 0x0, r2}, 0x80, &(0x7f00000004c0)}}], 0x1, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wlan0\x00'}) sendmsg$NL80211_CMD_CHANGE_NAN_CONFIG(r3, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0xe512c7019f6a5677}, 0xa, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[], 0x48}, 0x1, 0x0, 0x0, 0x20000004}, 0x0) syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000050cb5340450c10108e492940a80909021b00090000000009040002010035040009058dff86"], 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) 5.752033907s ago: executing program 0 (id=1049): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=ANY=[@ANYBLOB], 0x7c}}, 0x4004850) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(0xffffffffffffffff, 0xc0189379, &(0x7f0000000200)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000240)=[@window={0x3, 0x8, 0x7}], 0x1) sendmsg$NFT_BATCH(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x64}}, 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x3) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000040)={0xfffffff7, 0x8, 0x0, 0xb, 0x1b, "c39cab9d0b51bf4a2a73f186abe907f2a500b2"}) r3 = syz_pidfd_open(0xffffffffffffffff, 0x0) pidfd_send_signal(r3, 0x6, &(0x7f0000000080)={0x36, 0x6, 0x7fffffff}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000d80)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000100)=ANY=[@ANYRESHEX=r0, @ANYRESDEC=r0], 0x64}, 0x1, 0x0, 0x0, 0x5}, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='blkio.bfq.io_queued_recursive\x00', 0x275a, 0x0) quotactl_fd$Q_SETQUOTA(r4, 0xffffffff80000800, 0x0, &(0x7f0000000180)={0x400000000001, 0x1, 0x4c869, 0x1009, 0x2, 0x80000001, 0x48cb, 0xfffffffffffffff9, 0x820000df}) setsockopt$PNPIPE_HANDLE(r4, 0x113, 0x3, &(0x7f0000000180)=0x8dd000, 0x4) 5.58195626s ago: executing program 0 (id=1050): r0 = syz_open_dev$vim2m(&(0x7f00000001c0), 0x1f7ff6, 0x2) (async) r1 = syz_genetlink_get_family_id$smc(&(0x7f0000000000), 0xffffffffffffffff) (async) r2 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$SMC_PNETID_ADD(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000880)={&(0x7f0000000080)={0x40, r1, 0x200, 0x70bd2a, 0x25dfdc01, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz2\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'wg0\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x40}, 0x1, 0x0, 0x0, 0x4}, 0x0) (async, rerun: 64) ioctl$vim2m_VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000040)={0x1, 0x1, 0x1}) (rerun: 64) mmap(&(0x7f0000000000/0xb36000)=nil, 0xe1000, 0x280000b, 0x28011, r0, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x800008b}, 0x0) (async, rerun: 64) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x2) (async, rerun: 64) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000002000)=""/102400, 0x19000) (async) rt_tgsigqueueinfo(0x0, 0x0, 0x2000007, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) (async) getpid() (async) syz_io_uring_setup(0x237, 0x0, 0x0, 0x0) (async) r4 = socket(0x1e, 0x4, 0x0) (async) ioctl$TIOCSBRK(0xffffffffffffffff, 0x5427) (async) r5 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/power/resume', 0x141a82, 0x0) write$cgroup_subtree(r5, &(0x7f0000000100)=ANY=[], 0x32600) ioctl$FBIOPAN_DISPLAY(r5, 0x4606, &(0x7f0000000240)={0x780, 0x240, 0x80, 0x78, 0xfffff630, 0x400, 0x18, 0x2, {0xfb, 0x1, 0x1}, {0x8, 0xffff, 0x1}, {0x6, 0x7}, {0x3, 0xaa, 0x1}, 0x0, 0x80, 0x4, 0x8, 0x0, 0x6, 0x101, 0xffffff4f, 0x9, 0x9, 0x6, 0x3, 0x0, 0x100, 0x1, 0x3}) r6 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_int(r6, 0x29, 0x38, 0x0, &(0x7f00007d0000)) (async) setsockopt$packet_tx_ring(r4, 0x10f, 0x87, &(0x7f0000000040)=@req={0x3fc, 0x0, 0x0, 0x5}, 0x10) (async) r7 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r7, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc}, 0x10) (async) sendmmsg(r4, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000) (async, rerun: 64) mremap(&(0x7f000000e000/0x7000)=nil, 0x7000, 0x2000, 0x3, &(0x7f0000007000/0x2000)=nil) (rerun: 64) 5.545737864s ago: executing program 0 (id=1051): fanotify_init(0x10, 0x101000) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000040)=0x0) sched_getattr(r0, &(0x7f0000000100)={0x38}, 0x38, 0x0) fanotify_init(0x4000, 0x101003) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000280)=0x6) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000003c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(0xffffffffffffffff, 0xc0a85320, 0x0) ptrace$pokeuser(0x6, 0x0, 0x118, 0x0) r4 = openat$udambuf(0xffffffffffffff9c, &(0x7f00000000c0), 0x2) r5 = memfd_create(&(0x7f0000000700)='y\x105\xfb\xf7u\x83%\x1f\xe09@:r\xc2\xb9x0\x90P\x03\x00\x00\x00\x00\x00\x00\x00\xfe,\x1c\xf1\xdd\xcf]\xac\xbc\t\xbb\xfc\xa4j\x9f\xceX\x8f5=\xaa\xd5\xe9n\xab s\xa5\x00\x8d\tV\t\x91\x18\x06O\xb0=D\xda\xb6F\x1a\xc82\x8b\xc0l\xd0\x89d\xe6\xb7\xd8\x97\xb8\xde\xa3\x89\xc2%/u\x17\xdaM\x8d\x01Lh\x1e^\x9ej\x1c\xc5\xf0\xf6\x92\x05\x9aH\x00\'\xd4\x94d_\v\xfc\xad\x0f\xa8\xc5\xad\x00\xc2\x12\xff\xff\xff\xff\xff\xff\x00\x00\x00\x00\nj\x8c\xef\x90\xc0Z\xfa\x1a\xb3\xf0wVq\xe9d\xf8N\x80\xd1g\xd8e\xc8\x16\xad1\x02\xab\xce3\xb2\xb0\xd1\x11\xf0\xc3Gj+kV$\x80\x8aJ$\x81\xc0\x16\xf5\x9cz\x10\x97\xdb\x12H\xee/\xe3sY\x02D;L~\xd0\xb44\x01*\xfb\xa4 \xb2b\x90H$\xb2\xad\xbf\x8aM\xb6\x81\x81^\x02\xa0\xa7t\xfbHb\xa5=\xdd+$\xc06J\xb4\xf0\xab\x85Xz\x9f\xb2D$\xbe\xd9\x7f-\r\x9aj9r\n_\x11\xd4\x19\xb0\xa0G\xb7\x94\xf7\xfd~\xe9\xb6G\xbfE\xbb\x15\x15\xa6\xca2\xd0\xd3\x8c\xf7nO\xf9\xa8\xfd\x8a\xd2\xb2\xab\xff\xe4\xb0;\xd9\xa8\f\x03R\xbd%\x9fF\xee\x05\x06.3(QF?\f\x05\xa4uY\xee\xab\x8a\xeb~\xed\xcb0\xb7\xe7\xe6?8g\x8aN\xda\x8f\x9d\xde\x1eNaS\x8fLk\xf1\x965N\x18\x8c\xb9=5\x991\xae\x89N\x13\xd1\xf7\xf0\x13\xb2\xaeS\xa1\x97\x18j\xea\x9f\xde\xb6\xd4\xdc\xe6*\x9c\xfdV\x82\x05', 0x2) ftruncate(r5, 0xffff) fcntl$addseals(r5, 0x409, 0x3) close(0x3) ioctl$UDMABUF_CREATE(r4, 0x40187542, &(0x7f0000000000)={r5, 0x5, 0x0, 0x2000}) r6 = syz_open_procfs(0x0, &(0x7f0000000000)='fdinfo/3\x00') pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) open$dir(&(0x7f00000001c0)='./file0\x00', 0x80101, 0x188) pipe2$9p(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) tee(r7, r10, 0x4e, 0x0) write$binfmt_script(r10, &(0x7f0000000800)={'#! ', './file0'}, 0xb) tee(r9, r8, 0x9, 0x8) read$FUSE(r6, &(0x7f0000002080)={0x2020}, 0x50) 5.28312315s ago: executing program 0 (id=1052): sendmsg$NL80211_CMD_TRIGGER_SCAN(0xffffffffffffffff, 0x0, 0x8000) r0 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff0000", @ANYRES32=0x0, @ANYBLOB="c30c424700000000280012800a00010076786c616e00000018000280140010"], 0x48}}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x3) sched_setaffinity(0x0, 0xfffffffffffffd7a, &(0x7f0000000580)=0x8000000002) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x24, 0x0, &(0x7f0000000100)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000400), 0x0, 0x0) openat$fb0(0xffffffffffffff9c, 0x0, 0x180300, 0x0) r2 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) read$msr(r1, &(0x7f000001aa40)=""/102392, 0x18ff8) r3 = getpid() r4 = syz_pidfd_open(r3, 0x0) process_madvise(r4, &(0x7f00000004c0)=[{0x0}, {0x0}], 0x2, 0x15, 0x0) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000340), 0x0) r5 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$DCCPDIAG_GETSOCK(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000480)={0x4c, 0x14, 0x511, 0x0, 0x0, {0x2b, 0x0, 0x10, 0x1, {0x4e22, 0x0, [], [0x0, 0x0, 0x0, 0x3], 0x0, [0x0, 0xe627]}, 0x4}}, 0x4c}, 0x1, 0x0, 0x0, 0x20000851}, 0x8004) r6 = socket(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000040)={'netdevsim0\x00', 0x0}) setsockopt$MRT6_ADD_MIF(r6, 0x29, 0xca, &(0x7f0000000000)={0x4, 0x0, 0x0, r7}, 0xc) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$alg(r0, &(0x7f00000000c0), 0x492492492492627, 0x0) syz_io_uring_setup(0x7756, &(0x7f00000001c0)={0x0, 0xc4af, 0x800, 0x0, 0x3b1}, &(0x7f0000000080), &(0x7f0000000240)) 4.780126608s ago: executing program 0 (id=1053): geteuid() getgid() openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x202) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket(0x1d, 0x2, 0x6) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x1, 0x0, 0x0) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) recvmsg(0xffffffffffffffff, 0x0, 0x0) add_key(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000100)=@bpf_ext={0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x41100, 0x50, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x20, 0x1313f, 0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000000)}, 0x94) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r3) r4 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r4, 0xc004743e, 0x110e22fff6) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=@newtaction={0xe94, 0x30, 0x25, 0x0, 0x0, {}, [{0xe80, 0x1, [@m_pedit={0xe7c, 0x1, 0x0, 0x0, {{0xa}, {0xe50, 0x2, 0x0, 0x1, [@TCA_PEDIT_KEYS_EX={0x2c, 0x5, 0x0, 0x1, [{0x14, 0x6, 0x0, 0x1, [@TCA_PEDIT_KEY_EX_CMD={0x6, 0x2, 0x1}, @TCA_PEDIT_KEY_EX_HTYPE={0x6}]}, {0x14, 0x6, 0x0, 0x1, [@TCA_PEDIT_KEY_EX_HTYPE={0x6}, @TCA_PEDIT_KEY_EX_CMD={0x6, 0x2, 0x1}]}]}, @TCA_PEDIT_PARMS_EX={0xe20, 0x4, {{{}, 0x2}, [{}, {}, {0x0, 0x5, 0x0, 0x0, 0x0, 0xffffffff}, {0x0, 0x4}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, {}, {0x0, 0x800}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x40000}, {}, {0x80000000, 0x0, 0x0, 0x0, 0x0, 0x4}, {}, {0x0, 0x0, 0xf}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1000}, {0xfffffffd}, {}, {}, {}, {0x0, 0x0, 0x6}, {}, {0xffffffff}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x10}, {0x0, 0x3}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x1}, {0x0, 0x4}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0xfffffffe}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd}, {}, {}, {}, {0x0, 0x0, 0x20000000}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x4}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0xfffffffe}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd}, {0x5, 0x0, 0x0, 0x0, 0x2}, {}, {0x0, 0x0, 0x0, 0x0, 0xffff}, {0x8}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0xfffffffd}, {}, {}, {}, {0x0, 0x8}], [{0x0, 0x1}, {}, {}, {0x4}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x2}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x5}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x2}, {}, {}, {}, {}, {}, {0x2}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x4}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}]}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xe94}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000000c0)=@gettaction={0x30, 0x32, 0x6dd711a25f4cb68b, 0x0, 0x0, {}, [@action_dump_flags=@TCA_ROOT_TIME_DELTA={0x8, 0x4, 0x100}, @action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, 0x0, 0x0, @TCA_ACT_KIND={0xa, 0x1, 'pedit\x00'}}]}]}, 0x30}}, 0x0) ioctl$TUNGETVNETLE(r3, 0x4010744d, &(0x7f0000000180)) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000500)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r7, @ANYBLOB="06001500070000000c001680080001"], 0x38}}, 0x10) 3.898942248s ago: executing program 3 (id=1054): socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000040)='net/route\x00') pread64(r2, &(0x7f0000019240)=""/102356, 0x18fd4, 0x200) mmap$binder(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x1, 0x11, r2, 0x9) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) socket$kcm(0x2, 0xa, 0x2) write$tun(r3, &(0x7f00000005c0)=ANY=[@ANYBLOB="000008000100000000003d00000048f800400000000000f78490783fffffffac1414aa440c670000000004000000030000000005f2250dbb08444b", @ANYRES32=0x41424344, @ANYRES32=0x41424344], 0x4e) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_emit_ethernet(0x80, &(0x7f0000000180)=ANY=[@ANYBLOB="bb6233c1eb870180c200000086dd6410f746004a2f0100000000000000000000ffffffffffffff0200000000000000000000000000010401000904000800010086ddef2f6de0080088be000000041c0930000100000000000003080022eb000000010391530002000000000000010000"], 0x0) sendmsg$nl_generic(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="90008a5d368078cb35912585a5010325b07000fcffffff07000000"], 0x14}}, 0x0) r5 = openat$nvme_fabrics(0xffffff9c, &(0x7f0000000000), 0x80081, 0x0) write$uinput_user_dev(r5, &(0x7f0000000840)={'syz0\x00', {0x1, 0x8000, 0x9, 0xac23}, 0x40, [0x10, 0x8000, 0x7, 0x7, 0xffcf, 0x7, 0x8, 0x1ff, 0xe95ab6b, 0x1, 0x4cc59373, 0x0, 0x8001, 0x1, 0x6, 0x8000, 0x4, 0x1, 0x2, 0x6, 0x3, 0x4, 0x10000, 0x0, 0x4e3, 0x1, 0x7fff, 0x5, 0x0, 0x2, 0x1, 0xe, 0x8000, 0x1, 0x9d, 0x80, 0x7, 0x3, 0xbc49, 0x696, 0x8000, 0x1, 0xb, 0x7, 0x7, 0x7, 0x2, 0x3, 0x3, 0xff, 0x1, 0x4, 0x5, 0xffffffff, 0x0, 0x8, 0x7ff, 0x4, 0x8, 0xffffffff, 0x3, 0x100, 0x5, 0xb], [0x7, 0x9d2, 0x80000001, 0x800, 0x3, 0x9, 0x7, 0x8, 0x5, 0x80000001, 0x80008, 0x40, 0x9, 0x8, 0x80000001, 0x4, 0x0, 0xd, 0xfffffff7, 0x3, 0x0, 0x2, 0x2, 0x3, 0xb, 0x66fe, 0x6, 0x5, 0xe03, 0x3ff, 0x10004, 0xfffffc00, 0x1, 0x4, 0x3ff, 0x3, 0x7f, 0x3, 0xd08, 0x1, 0x1, 0x22, 0xfc000000, 0x0, 0x1, 0x4, 0xe37, 0x3, 0x0, 0x1, 0xe8, 0xffff8000, 0x2, 0xb, 0xd7a8, 0x6, 0xbdc, 0x3e6, 0xf970, 0x9, 0x0, 0x8, 0x7fffffff, 0x6], [0x400a, 0x9, 0x7, 0x590, 0x10000000, 0xb0, 0x8, 0x5, 0x2, 0x4, 0x6, 0x7, 0x3, 0x3, 0x4, 0xe, 0x8001, 0x1, 0x0, 0x9, 0x200, 0xbf1c, 0x79fc, 0x1, 0xf9, 0xffffff26, 0x0, 0xfffffff7, 0x9, 0x1, 0x7, 0x2, 0x8000, 0x10, 0x5, 0x3, 0x1, 0x10, 0xb8, 0x6, 0xec5f, 0x8001, 0x7fffffff, 0x1b9, 0x8a7, 0x1, 0x8, 0x3, 0x1, 0x1, 0x4, 0x3, 0x74da, 0xec9, 0x140, 0x6, 0x3, 0x6, 0x1, 0x7fff, 0xa, 0x86c, 0x7, 0x1], [0x0, 0x20f, 0x80000001, 0x200, 0x0, 0x3, 0xb, 0x2, 0xffff, 0x4, 0x9, 0x80000000, 0xffff, 0xb7, 0x3a1, 0xfffffff1, 0xffff, 0xc, 0x8000, 0xfffffffe, 0x9, 0x3ff, 0x1, 0xdf76, 0x63, 0xa, 0x7f, 0x100, 0x40, 0x3, 0x2, 0x8, 0x8, 0x7, 0x4, 0x2170, 0x0, 0x2, 0x6b2, 0x9, 0xcd5e, 0x59, 0x9, 0x6, 0x6, 0x6, 0x5, 0x1, 0x0, 0x4, 0x9, 0x6, 0x1, 0x6, 0x2, 0x3, 0x9, 0xfff, 0x5, 0x3, 0x8, 0x1, 0x5, 0x6]}, 0x45c) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x972, &(0x7f0000006680)) mkdir(&(0x7f0000000040)='./file0\x00', 0x14) bpf$MAP_CREATE(0x0, 0x0, 0x50) r6 = openat$procfs(0xffffff9c, &(0x7f0000000040)='/proc/sysvipc/shm\x00', 0x0, 0x0) r7 = socket$inet6(0xa, 0x3, 0x8000000003c) setsockopt$IP6T_SO_SET_REPLACE(r7, 0x29, 0x40, &(0x7f00000014c0)=@raw={'raw\x00', 0x8, 0x3, 0x480, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x3f8, 0xffffffff, 0xffffffff, 0x3f8, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'team_slave_0\x00'}, 0x0, 0x100, 0x128, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'bond_slave_1\x00', {0x41, 0x1ff, 0x6, 0xb0e2, 0x10001, 0x84e, 0xfffffffb, 0x18, 0x8}, {0x1}}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @private0={0xfc, 0x0, '\x00', 0x1}, [], [0xff], 'erspan0\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0x0, 0x2, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x4e0) connect$inet6(r7, &(0x7f0000000200)={0xa, 0x4ea4, 0x0, @local, 0x9}, 0x1c) sendmsg(r7, &(0x7f00000000c0)={0x0, 0x953a, &(0x7f0000000100)=[{&(0x7f0000000000)="2c10", 0xffd0}], 0x1, 0x0, 0x0, 0x2c}, 0x44004) preadv(r6, &(0x7f0000003240)=[{0x0}, {&(0x7f0000002100)=""/4096, 0x1000}], 0x2, 0x1, 0x0) 3.679086042s ago: executing program 0 (id=1055): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000001c0)={0x0, 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x38, 0x0, 0x4, 0x8001, 0x0, 0xb49, 0x200000000002, 0x7, 0x8, 0x5}, 0x0) ioctl$DRM_IOCTL_MODE_ADDFB(0xffffffffffffffff, 0xc01c64ae, &(0x7f0000000100)={0x0, 0x4, 0x9, 0x3, 0xf, 0xa, 0xfffffffc}) r2 = socket$netlink(0x10, 0x3, 0x6) sendmsg$nl_route_sched(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=@gettclass={0x24, 0x25, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x6}, {0x0, 0xfff1}, {0x0, 0x9}}}, 0x24}}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0), r3) sendmsg$TIPC_NL_MON_SET(r3, &(0x7f0000000480)={0x0, 0x0, 0x0}, 0x0) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x1000007, 0x2172, 0xffffffffffffffff, 0x0) r4 = syz_open_dev$vim2m(&(0x7f0000000400), 0x7, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r4, 0xc0d05605, &(0x7f0000000080)={0x1, @pix_mp={0x0, 0x7, 0x32315241, 0x35315852, 0x7, [{0x0, 0xdf}, {0x5, 0x2}, {0x1002}, {0x7}, {0xb487, 0x3316aa71}, {0x0, 0x40}, {0x100000, 0x13ff}], 0x0, 0x0, 0x7}}) r5 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000000), 0x35c, 0x0) preadv(r5, &(0x7f0000000300)=[{&(0x7f00000023c0)=""/4096, 0x1000}], 0x1, 0xffffffff, 0x1) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0xc) r6 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/mm/ksm/run\x00', 0x1, 0x0) write$sysctl(r6, &(0x7f0000000580)='1\x00', 0x2) r7 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_group_source_req(r7, 0x29, 0x2e, &(0x7f0000000240)={0x8, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @private1}}}, 0x108) setsockopt$inet6_MCAST_MSFILTER(r7, 0x29, 0x30, &(0x7f0000000800)=ANY=[@ANYBLOB="080000000a00000000000000ff010000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000eaffd1ffffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000020000000a00000000000000fc0100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e2ff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000fc01000000000000000000000000000000000000000000000000000000000080945b725a2cd0e500000000000000000000000000000000000000000000000000000000000000000000ff07000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e4bdaa20462a33485645d5152d827251fc692fbc545a01609ddde164ff696922226767b22c53217658fd87d406b5c6a71f4c06106a55e7dfdddbf41f4c5211773563f1eed5feb646a391602412bdd34ef60f1301dfba548351cc899a47467a01144de3892aa17261a46e38667861fc6b295fbda94614ac50e3f1939d732587741e9e01f50a39790923e2cad79cad7d178af49d490876caaaa41734830e58d67028d0ae020defad3f543a51161ffe7c40b6e6ab80555c1ba597d93a57c9635b374ff5ddef3a7d6af976d924aa05805b33915d16d2988fe8b62a4d07b955d0138428e1ed910437bc5b1b"], 0x190) close(r7) syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12011900000000406a0563000000000000010902"], 0x0) write$sysctl(r6, &(0x7f00000000c0)='2\x00', 0x2) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000740)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x4}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1, 0x0, 0xfffd}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x4c, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x6}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x24, 0x4, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @exthdr={{0xb}, @void}}, {0x10, 0x1, 0x0, 0x1, @queue={{0xa}, @void}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0xc0}}, 0x0) 3.660842895s ago: executing program 4 (id=1056): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000000007c5e0000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000002000000b704000000000000850000005700000095"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001d00)=ANY=[@ANYBLOB="0b00000005000000050000000900000001"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) bpf$PROG_BIND_MAP(0x23, &(0x7f00000001c0)={r1, r0}, 0xc) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000440)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0xfff2}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000006c0)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x70b928, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xd}, {0xffff, 0xb}, {0xffff, 0xffe0}}}, 0x24}, 0x1, 0x0, 0x0, 0x240040e0}, 0x0) ioctl$EXT4_IOC_GETFSUUID(r2, 0x8008662c, &(0x7f0000000040)) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f0000000080)={{0x1, 0x1, 0x18, r2}, './file0\x00'}) ioctl$KVM_CREATE_GUEST_MEMFD(r4, 0xc040aed4, &(0x7f0000000180)={0xffffffffffffffff, 0x5}) 3.348107325s ago: executing program 2 (id=1057): bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x10, 0x16, &(0x7f0000000340)=ANY=[@ANYBLOB="61122800000000006113140000000000bf1000000000000025000200091b00003d030000000000008701000000000000bc26000000000000bf67000000000000340300000ee600f0670200001400000016030000ffffffffbf050000000000000f650000000000006507f4"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x94) preadv(0xffffffffffffffff, 0x0, 0x0, 0x33, 0x0) sched_setscheduler(0x0, 0x2, 0x0) syz_clone(0x600, 0x0, 0x33, 0x0, 0x0, 0x0) syz_usb_connect(0x0, 0x2d, &(0x7f0000000380)=ANY=[@ANYBLOB="12012002daf08d08981490a00f480102030109021b00010755e00109043a"], &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0}) 3.24972315s ago: executing program 4 (id=1058): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000480), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan1\x00'}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, 0x0, 0x0) sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB="44000200", @ANYRES16=r1, @ANYBLOB="050000000000000000002e00000011002a00250301af3f75060000070042000000000a00060008021100000000000800350000000000080026006c090000"], 0x44}}, 0x10) syz_80211_inject_frame(&(0x7f00000002c0)=@device_b, &(0x7f00000004c0)=ANY=[@ANYBLOB="50000000080211000001080211000000080211000000157eda1381d3fe8adc0008000100"], 0x24) nanosleep(&(0x7f0000000340)={0x0, 0x2faf080}, &(0x7f0000000380)) syz_80211_inject_frame(&(0x7f00000003c0)=@device_b, &(0x7f0000000400)=@mgmt_frame=@auth={{{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x1}}, 0x0, 0x2, 0x0, @void}, 0x1e) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000040)={0x3, &(0x7f0000000000)=[{0x0, 0x2, 0xe0, 0x4}, {0x1, 0xb, 0xfb, 0x5}, {0x9, 0x40, 0x3, 0x6}]}, 0x10) socket$inet6(0xa, 0x80001, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) r2 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x2082) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r2, 0xc0a85320, &(0x7f00000005c0)={{0x80, 0x7}, 'port0\x00', 0x44, 0xa04f2, 0x10000000, 0x8000088, 0x6, 0x40003, 0x9}) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r2, 0x40505330, &(0x7f00000001c0)={0x800100, 0xffffffff, 0x22, 0xe1d9, 0x1101, 0xff}) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r2, 0x40505330, &(0x7f00000006c0)={0x800100, 0xfffffffd, 0x22, 0x6, 0x9, 0x6}) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f0000000540)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) mmap(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x20010, r2, 0xb9dda000) mbind(&(0x7f0000ff8000/0x8000)=nil, 0x8000, 0x8001, &(0x7f0000000180)=0x3ff, 0xc, 0x0) mlock2(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) openat$binfmt_format(0xffffff9c, 0x0, 0x2, 0x0) io_uring_setup(0x3454, &(0x7f00000003c0)={0x0, 0x0, 0x40, 0x2, 0xa7}) clock_gettime(0xfffffffffffffffb, 0x0) migrate_pages(0x0, 0x3, &(0x7f0000000040)=0x7f, &(0x7f0000000300)=0xa) madvise(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2) mmap(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x8, 0x13, 0xffffffffffffffff, 0xae710000) 2.828323173s ago: executing program 1 (id=1059): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0x6, 0xfa11, 0xffffffff}, 0x0) r2 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000010c0)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f0000000180)=0x10) getsockopt$bt_hci(r2, 0x84, 0x6d, &(0x7f0000001100)=""/4112, &(0x7f0000001040)=0x1010) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@rand_addr=' \x01\x00', @in=@local, 0x4e24, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa9, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa00, 0x40800000000000, 0x800000000000000}}}, 0xb8}}, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="3c01000019000100000000000000000000000000000000000000000000000000ac1414bb0000000000000000000000000000fffd000000000a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffff0000000000000000000035ca46ec18ad8500000000000000827f562dac7a453d623fbf190000000000000000000000000000000000000000000000000000000000000084000500ac1414aa000000000000000000000000000000002b00000000000000ffffffff00000000000000000000000000000000000000000000000000000000000000007f000001000000857a327487d6441c35e7e0ad34000000000000000000000000006c00000000000000ac1414aa0000000000000000000000000040000000000000"], 0x13c}}, 0x4040000) r5 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IP_SET_OP_GET_FNAME(0xffffffffffffffff, 0x1, 0x53, &(0x7f00000000c0)={0x8, 0x7, 0x0, 'syz2\x00'}, 0x0) r6 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000740)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb010018000000000000001800000018000000050000000100000001000013040000000200000088060000ff0f0000002e2e"], 0x0, 0x35, 0x0, 0x1}, 0x28) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x11, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="180000eb0626f50000000000080000009500000000000000"], &(0x7f0000000080)='GPL\x00', 0x5, 0x4fa, &(0x7f0000000cc0)=""/4096, 0x40f00, 0x5, '\x00', 0x0, 0x0, r6, 0x8, 0x0, 0x0, 0x10, &(0x7f00000002c0)={0x0, 0x2, 0x4, 0x9}, 0x1, 0x0, 0x0, 0x64, 0x0, 0x0, 0x10, 0xfffffffe}, 0x94) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x11, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x40f00, 0x5, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0xd4}, 0x94) setsockopt$inet_buf(r5, 0x0, 0x8008000000010, &(0x7f0000005e40)="17000000020001000003d68c5ee17688a2003208020300ecff3f0200000300000a000000009afc5ad9485bbb6a880000d6c8db0000dba67e060180000a0000f10607bdff59100ac45761407a681f009cee4a5acb3da400001fb700674f19b44e09f9315033bf79ac2dff060115003901000000000000ea000000000000000009ffff02dfccebf6ba0008400200000000e90554062a80e605007f71174aa951f3c63e5c83f1ba2112ce68bf17a6e000"/184, 0xb8) r7 = socket$alg(0x26, 0x5, 0x0) bind$alg(r7, &(0x7f0000000540)={0x26, 'hash\x00', 0x0, 0x0, 'hmac(sha384)\x00'}, 0x58) r8 = accept4(r7, 0x0, 0x0, 0x800) sendmsg$xdp(r8, 0x0, 0x5880) 2.28664464s ago: executing program 3 (id=1060): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0}, 0x48) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r2, &(0x7f00000000c0)={0x2, 0x4e21, @broadcast}, 0x10) connect$inet(r2, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) sendto$inet(r2, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x0) recvfrom$inet(r2, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0x720, 0x0, 0xfffffffffffffd25) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x40002) r3 = syz_open_dev$MSR(&(0x7f0000000340), 0x0, 0x0) read$msr(r3, &(0x7f0000048040)=""/102392, 0x18ff8) setsockopt$inet_opts(r2, 0x0, 0xd, &(0x7f0000000500)="5f4f73eba1d1f9107a716e131d3d5956ef901b10a6706a2f21d6c34081ad08abd85c768b84ec1f0fd034fe99b32cd5c0641fd9d3bf", 0x35) socket$inet(0x2b, 0x801, 0x0) ioctl$IOMMU_HWPT_ALLOC$NONE(r1, 0x3b89, &(0x7f0000000180)={0x28, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x6, 0x8, &(0x7f0000006680)) setgid(0xee00) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000040)={r0}, 0x4) keyctl$session_to_parent(0x12) 1.887073699s ago: executing program 3 (id=1061): r0 = syz_open_dev$tty1(0xc, 0x4, 0x2) r1 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'syz_tun\x00', 0x0}) bind$packet(r1, &(0x7f0000000080)={0x11, 0x0, r2, 0x1, 0x0, 0x6, @random="518440db9de1"}, 0x14) bind$packet(r1, &(0x7f0000000300)={0x11, 0x0, 0x0, 0x1, 0xfc}, 0x14) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f0000001040)=0x6) r3 = syz_open_dev$MSR(&(0x7f0000000140), 0x0, 0x0) read$msr(r3, &(0x7f0000032680)=""/102392, 0x18ff8) connect$802154_dgram(0xffffffffffffffff, 0x0, 0x0) eventfd2(0x0, 0x1) io_setup(0x3, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x40081, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0x7) ioctl$TIOCSTI(r4, 0x5412, &(0x7f00000000c0)=0xf9) r5 = landlock_create_ruleset(&(0x7f0000000000)={0x10, 0x0, 0x3}, 0x18, 0x0) setitimer(0x2, 0xffffffffffffffff, 0x0) landlock_restrict_self(r5, 0x0) r6 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) landlock_restrict_self(0xffffffffffffffff, 0x0) landlock_restrict_self(0xffffffffffffffff, 0x0) tkill(r6, 0x18) dup(r0) 1.823721623s ago: executing program 4 (id=1062): fanotify_init(0x10, 0x101000) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000040)=0x0) sched_getattr(r0, &(0x7f0000000100)={0x38}, 0x38, 0x0) fanotify_init(0x4000, 0x101003) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000003c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(0xffffffffffffffff, 0xc0a85320, 0x0) ptrace$pokeuser(0x6, 0x0, 0x118, 0x0) r3 = openat$udambuf(0xffffffffffffff9c, &(0x7f00000000c0), 0x2) r4 = memfd_create(&(0x7f0000000700)='y\x105\xfb\xf7u\x83%\x1f\xe09@:r\xc2\xb9x0\x90P\x03\x00\x00\x00\x00\x00\x00\x00\xfe,\x1c\xf1\xdd\xcf]\xac\xbc\t\xbb\xfc\xa4j\x9f\xceX\x8f5=\xaa\xd5\xe9n\xab s\xa5\x00\x8d\tV\t\x91\x18\x06O\xb0=D\xda\xb6F\x1a\xc82\x8b\xc0l\xd0\x89d\xe6\xb7\xd8\x97\xb8\xde\xa3\x89\xc2%/u\x17\xdaM\x8d\x01Lh\x1e^\x9ej\x1c\xc5\xf0\xf6\x92\x05\x9aH\x00\'\xd4\x94d_\v\xfc\xad\x0f\xa8\xc5\xad\x00\xc2\x12\xff\xff\xff\xff\xff\xff\x00\x00\x00\x00\nj\x8c\xef\x90\xc0Z\xfa\x1a\xb3\xf0wVq\xe9d\xf8N\x80\xd1g\xd8e\xc8\x16\xad1\x02\xab\xce3\xb2\xb0\xd1\x11\xf0\xc3Gj+kV$\x80\x8aJ$\x81\xc0\x16\xf5\x9cz\x10\x97\xdb\x12H\xee/\xe3sY\x02D;L~\xd0\xb44\x01*\xfb\xa4 \xb2b\x90H$\xb2\xad\xbf\x8aM\xb6\x81\x81^\x02\xa0\xa7t\xfbHb\xa5=\xdd+$\xc06J\xb4\xf0\xab\x85Xz\x9f\xb2D$\xbe\xd9\x7f-\r\x9aj9r\n_\x11\xd4\x19\xb0\xa0G\xb7\x94\xf7\xfd~\xe9\xb6G\xbfE\xbb\x15\x15\xa6\xca2\xd0\xd3\x8c\xf7nO\xf9\xa8\xfd\x8a\xd2\xb2\xab\xff\xe4\xb0;\xd9\xa8\f\x03R\xbd%\x9fF\xee\x05\x06.3(QF?\f\x05\xa4uY\xee\xab\x8a\xeb~\xed\xcb0\xb7\xe7\xe6?8g\x8aN\xda\x8f\x9d\xde\x1eNaS\x8fLk\xf1\x965N\x18\x8c\xb9=5\x991\xae\x89N\x13\xd1\xf7\xf0\x13\xb2\xaeS\xa1\x97\x18j\xea\x9f\xde\xb6\xd4\xdc\xe6*\x9c\xfdV\x82\x05', 0x2) ftruncate(r4, 0xffff) fcntl$addseals(r4, 0x409, 0x3) close(0x3) ioctl$UDMABUF_CREATE(r3, 0x40187542, &(0x7f0000000000)={r4, 0x5, 0x0, 0x2000}) r5 = syz_open_procfs(0x0, &(0x7f0000000000)='fdinfo/3\x00') pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) open$dir(&(0x7f00000001c0)='./file0\x00', 0x80101, 0x188) pipe2$9p(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) tee(r6, r9, 0x4e, 0x0) write$binfmt_script(r9, &(0x7f0000000800)={'#! ', './file0'}, 0xb) tee(r8, r7, 0x9, 0x8) read$FUSE(r5, &(0x7f0000002080)={0x2020}, 0x50) 463.261927ms ago: executing program 3 (id=1063): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000380)=@newlink={0x3c, 0x10, 0x401, 0x3, 0x0, {0x0, 0x0, 0x0, 0x0, 0x4d1c}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @geneve={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GENEVE_REMOTE={0x8, 0x2, @loopback}]}}}]}, 0x3c}}, 0x54) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f0000000000)={0x0, @in={{0x2, 0x8, @local}}, 0xb, 0xb}, &(0x7f00000000c0)=0x90) getsockopt$inet_sctp6_SCTP_CONTEXT(r1, 0x84, 0x11, &(0x7f0000000100)={r2, 0xf3000000}, &(0x7f0000000140)=0x8) 89.482912ms ago: executing program 3 (id=1064): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0}, 0x48) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r2, &(0x7f00000000c0)={0x2, 0x4e21, @broadcast}, 0x10) connect$inet(r2, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) sendto$inet(r2, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x0) recvfrom$inet(r2, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0x720, 0x0, 0xfffffffffffffd25) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x40002) r3 = syz_open_dev$MSR(&(0x7f0000000340), 0x0, 0x0) read$msr(r3, &(0x7f0000048040)=""/102392, 0x18ff8) setsockopt$inet_opts(r2, 0x0, 0xd, &(0x7f0000000500)="5f4f73eba1d1f9107a716e131d3d5956ef901b10a6706a2f21d6c34081ad08abd85c768b84ec1f0fd034fe99b32cd5c0641fd9d3bfccb3b0e3", 0x39) socket$inet(0x2b, 0x801, 0x0) ioctl$IOMMU_HWPT_ALLOC$NONE(r1, 0x3b89, &(0x7f0000000180)={0x28, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x6, 0x8, &(0x7f0000006680)) setgid(0xee00) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000040)={r0}, 0x4) keyctl$session_to_parent(0x12) 0s ago: executing program 4 (id=1065): syz_usb_connect$lan78xx(0x3, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x6, 0x100000b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80202, 0x0) ioctl$F2FS_IOC_GARBAGE_COLLECT(r0, 0x4004f506, &(0x7f0000000180)=0x1) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000007c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0xa00}}, [], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x28}}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000380)={'syz1\x00', {0x0, 0x7fff, 0x2, 0x2}, 0x51, [0x3ff, 0x2, 0x10000, 0x0, 0x7ca6, 0x9, 0xc2ad, 0x4, 0x9, 0x9, 0x5, 0x9, 0x8, 0x200, 0x5, 0x3, 0x7, 0x5, 0xfffffff9, 0x6, 0x3, 0xfff, 0x7f, 0x4152, 0x8b3, 0x9, 0x861, 0x7, 0x5, 0x0, 0x3c, 0x4, 0x1005, 0x4, 0x8, 0x38, 0x8, 0x8, 0xd5bb, 0x3, 0x1, 0x9de9, 0x8, 0x3, 0x3, 0x7f, 0x5, 0x8, 0x0, 0x1, 0x3ff, 0x6, 0x2e, 0x800, 0x846c, 0x3, 0x6, 0x31b, 0x8, 0xa, 0x1, 0x7, 0xffffffff, 0x3], [0x4a, 0x19a78cbf, 0xe936, 0x0, 0x200, 0xfffffff7, 0x2, 0x7d, 0x10001, 0x8, 0x3ff, 0x1, 0x7, 0x8f, 0x1, 0x5, 0x1ff, 0x200, 0x6f8, 0x7, 0xd, 0x7, 0x100788, 0x6, 0x0, 0x0, 0x8, 0x3, 0x5, 0x2, 0xa, 0x7, 0x80, 0x5aa, 0xfffff000, 0x400, 0x2, 0x7, 0x6, 0x6, 0x5, 0x3, 0x87, 0x22e2, 0x502, 0xffffffff, 0x7, 0x1ff, 0x6, 0x10001, 0x9e, 0x1, 0x5, 0x101, 0xfffffffa, 0x0, 0x2, 0x2, 0x6, 0x1ff, 0x8, 0x3, 0x6], [0x2, 0x94da, 0xffffffff, 0x7, 0xc0000, 0x4, 0x4, 0xfffffffa, 0x6, 0x7, 0xea, 0x7, 0x6, 0x400, 0xfffeffff, 0xfc000000, 0x8, 0x8, 0xd1, 0x2, 0xb66, 0x3, 0x4, 0x52c, 0x4, 0x10001, 0xfffffff8, 0x2, 0x9, 0x1, 0x7, 0xe86, 0x8, 0x20000100, 0x7, 0x1, 0x746a6ffd, 0x3, 0x4, 0x0, 0x1, 0x45a6c325, 0x8, 0x10000, 0x1000, 0x2, 0x5, 0x0, 0x2, 0x2, 0x1, 0x8, 0x2, 0x2, 0x81, 0x200, 0x3ff, 0xffffffcc, 0x6, 0xa000000, 0x8, 0xfff, 0x4000, 0x1], [0x8, 0x7, 0x3, 0xfffffffc, 0x8000, 0x2, 0x8, 0x1ff, 0xfffffffe, 0x10, 0x5e, 0x4, 0x8, 0x8, 0x5, 0x8, 0x45eb, 0xf25, 0xd, 0x1ff, 0x2, 0x95, 0x9, 0x9, 0x1, 0xc, 0xffff6f9e, 0x4, 0xfffffff7, 0x10000, 0x7, 0x52a, 0x5, 0xc1a4, 0x4, 0x8, 0x3, 0x9, 0x5, 0xb7af, 0x3, 0x4, 0x0, 0x1ff8, 0x2, 0x7, 0x6, 0x80000000, 0x652d, 0x7, 0x7fffffff, 0xd, 0x40, 0x3ff, 0xc, 0x1ff, 0x9, 0x6, 0x0, 0x1000, 0x9, 0x2, 0x9, 0x4]}, 0x45c) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000040)=0x8000) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000140)={'gre0\x00'}) r4 = socket$phonet(0x23, 0x2, 0x1) sendto(r4, 0x0, 0x0, 0x0, 0x0, 0x0) socket$igmp(0x2, 0x3, 0x2) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) bind$bt_l2cap(r5, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000080)) listen(r5, 0x90004) syz_emit_vhci(&(0x7f0000000140)=ANY=[@ANYBLOB="043e130100c90001"], 0x16) ppoll(&(0x7f00000000c0)=[{r5, 0x60}], 0x1, 0x0, 0x0, 0x0) socket$nl_audit(0x10, 0x3, 0x9) syz_genetlink_get_family_id$nbd(&(0x7f00000000c0), 0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) kernel console output (not intermixed with test programs): 0 audit(2000000113.280:482): avc: denied { write } for pid=8065 comm="syz.0.470" laddr=fe80::13 lport=60 faddr=fe80::aa fport=20132 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 223.296339][ T8076] netlink: 4 bytes leftover after parsing attributes in process `syz.0.471'. [ 223.826999][ T8086] netlink: 4 bytes leftover after parsing attributes in process `syz.4.473'. [ 224.199775][ T8095] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 224.365754][ T10] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 225.065904][ T10] usb 5-1: device descriptor read/64, error -71 [ 225.132448][ T8102] support for cryptoloop has been removed. Use dm-crypt instead. [ 225.340982][ T10] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 225.743714][ T10] usb 5-1: device descriptor read/64, error -71 [ 225.963847][ T8118] netlink: 4 bytes leftover after parsing attributes in process `syz.1.481'. [ 226.111013][ T10] usb usb5-port1: attempt power cycle [ 227.120947][ T10] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 227.359045][ T5809] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 227.860989][ T5809] usb 2-1: device descriptor read/64, error -71 [ 228.100140][ T10] usb 5-1: device descriptor read/8, error -71 [ 228.109882][ T5820] Bluetooth: hci3: ISO packet for unknown connection handle 0 [ 228.172431][ T5809] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 228.311207][ T5809] usb 2-1: device descriptor read/64, error -71 [ 228.482268][ T5809] usb usb2-port1: attempt power cycle [ 228.931015][ T5809] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 229.036403][ T8145] netlink: 4 bytes leftover after parsing attributes in process `syz.1.486'. [ 229.170994][ T5809] usb 2-1: device not accepting address 11, error -71 [ 229.377608][ T5873] hid-generic 0005:10CF:5505.000B: item fetching failed at offset 0/1 [ 230.196579][ T5873] hid-generic 0005:10CF:5505.000B: probe with driver hid-generic failed with error -22 [ 230.238183][ T8153] capability: warning: `syz.3.487' uses deprecated v2 capabilities in a way that may be insecure [ 230.261777][ T8153] overlayfs: upper fs does not support tmpfile. [ 231.261264][ T8165] fuse: Unknown parameter 'group_id00000000000000000000' [ 231.527159][ T10] usb 4-1: new high-speed USB device number 16 using dummy_hcd [ 233.233521][ T10] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 64, changing to 7 [ 233.625897][ T10] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 250, changing to 7 [ 233.691721][ T10] usb 4-1: string descriptor 0 read error: -71 [ 233.699030][ T10] usb 4-1: New USB device found, idVendor=041e, idProduct=3020, bcdDevice= 0.40 [ 234.043507][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 234.109690][ T8162] Set syz1 is full, maxelem 65536 reached [ 234.324753][ T10] usb 4-1: can't set config #1, error -71 [ 234.332163][ T10] usb 4-1: USB disconnect, device number 16 [ 235.252396][ T8179] loop2: detected capacity change from 0 to 7 [ 235.298093][ T8179] Dev loop2: unable to read RDB block 7 [ 235.311566][ T8179] loop2: unable to read partition table [ 235.321212][ T8179] loop2: partition table beyond EOD, truncated [ 235.327370][ T8179] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 235.358856][ T5179] Dev loop2: unable to read RDB block 7 [ 235.400803][ T5179] loop2: unable to read partition table [ 235.544902][ T5179] loop2: partition table beyond EOD, truncated [ 237.873672][ T8209] netlink: 4 bytes leftover after parsing attributes in process `syz.3.496'. [ 238.260948][ T9] usb 4-1: new high-speed USB device number 17 using dummy_hcd [ 238.513689][ T8213] overlayfs: missing 'lowerdir' [ 238.591188][ T9] usb 4-1: device descriptor read/64, error -71 [ 238.887660][ T9] usb 4-1: new high-speed USB device number 18 using dummy_hcd [ 238.935789][ T8223] fuse: Bad value for 'user_id' [ 238.940699][ T8223] fuse: Bad value for 'user_id' [ 239.458273][ T9] usb 4-1: device descriptor read/64, error -71 [ 239.871326][ T9] usb usb4-port1: attempt power cycle [ 240.280572][ T9] usb 4-1: new high-speed USB device number 19 using dummy_hcd [ 240.303656][ T9] usb 4-1: device descriptor read/8, error -71 [ 240.641105][ T9] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 241.062678][ T9] usb 4-1: device descriptor read/8, error -71 [ 241.132611][ T8251] fuse: Unknown parameter 'group_i00000000000000000000' [ 241.517608][ T8252] netlink: 4 bytes leftover after parsing attributes in process `syz.2.510'. [ 241.551274][ T9] usb usb4-port1: unable to enumerate USB device [ 241.774701][ T10] hid-generic 0005:10CF:5505.000C: item fetching failed at offset 0/1 [ 241.972933][ T10] hid-generic 0005:10CF:5505.000C: probe with driver hid-generic failed with error -22 [ 242.024242][ T29] audit: type=1400 audit(2000000132.940:483): avc: denied { execute } for pid=8253 comm="syz.4.511" name="file2" dev="tmpfs" ino=584 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 242.109223][ T29] audit: type=1400 audit(2000000132.940:484): avc: denied { execute_no_trans } for pid=8253 comm="syz.4.511" path="/109/file2" dev="tmpfs" ino=584 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 242.471027][ T919] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 242.651874][ T919] usb 5-1: Using ep0 maxpacket: 32 [ 242.666881][ T919] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0xD has an invalid bInterval 0, changing to 7 [ 242.691205][ T919] usb 5-1: New USB device found, idVendor=084e, idProduct=1001, bcdDevice=bf.99 [ 242.710119][ T919] usb 5-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3 [ 242.731770][ T919] usb 5-1: Product: syz [ 242.737809][ T919] usb 5-1: SerialNumber: syz [ 242.748555][ T919] usb 5-1: config 0 descriptor?? [ 243.300584][ T29] audit: type=1400 audit(2000000133.217:485): avc: denied { unmount } for pid=8253 comm="syz.4.511" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 243.378105][ T8284] fuse: Bad value for 'user_id' [ 243.383073][ T8284] fuse: Bad value for 'user_id' [ 243.978782][ T29] audit: type=1400 audit(2000000133.897:486): avc: denied { append } for pid=8285 comm="syz.3.518" name="loop9" dev="devtmpfs" ino=656 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 244.281203][ T29] audit: type=1400 audit(2000000134.097:487): avc: denied { write } for pid=8291 comm="syz.2.520" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 244.945727][ T919] usb 5-1: USB disconnect, device number 11 [ 247.097113][ T8325] overlayfs: missing 'lowerdir' [ 247.168021][ T8338] fuse: Bad value for 'user_id' [ 247.173103][ T8338] fuse: Bad value for 'user_id' [ 247.634934][ T8343] FAULT_INJECTION: forcing a failure. [ 247.634934][ T8343] name failslab, interval 1, probability 0, space 0, times 0 [ 247.668841][ T8343] CPU: 0 UID: 0 PID: 8343 Comm: syz.3.532 Tainted: G L syzkaller #0 PREEMPT(full) [ 247.668875][ T8343] Tainted: [L]=SOFTLOCKUP [ 247.668881][ T8343] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 247.668892][ T8343] Call Trace: [ 247.668898][ T8343] [ 247.668905][ T8343] dump_stack_lvl+0x100/0x190 [ 247.668941][ T8343] should_fail_ex.cold+0x5/0xa [ 247.668966][ T8343] should_failslab+0xc2/0x120 [ 247.668985][ T8343] __kvmalloc_node_noprof+0xfa/0xa00 [ 247.669017][ T8343] ? alloc_netdev_mqs+0xd7/0x14f0 [ 247.669048][ T8343] ? __pfx_vlan_setup+0x10/0x10 [ 247.669070][ T8343] alloc_netdev_mqs+0xd7/0x14f0 [ 247.669100][ T8343] rtnl_create_link+0xc13/0xf80 [ 247.669129][ T8343] rtnl_newlink+0x13b8/0x2380 [ 247.669163][ T8343] ? __pfx_rtnl_newlink+0x10/0x10 [ 247.669185][ T8343] ? find_held_lock+0x2b/0x80 [ 247.669209][ T8343] ? avc_has_perm_noaudit+0x11e/0x3b0 [ 247.669229][ T8343] ? avc_has_perm_noaudit+0x11e/0x3b0 [ 247.669251][ T8343] ? avc_has_perm_noaudit+0x145/0x3b0 [ 247.669292][ T8343] ? find_held_lock+0x2b/0x80 [ 247.669315][ T8343] ? rtnetlink_rcv_msg+0x93a/0xe90 [ 247.669338][ T8343] ? rtnetlink_rcv_msg+0x93a/0xe90 [ 247.669364][ T8343] ? __pfx_rtnl_newlink+0x10/0x10 [ 247.669389][ T8343] rtnetlink_rcv_msg+0x95e/0xe90 [ 247.669417][ T8343] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 247.669448][ T8343] ? ref_tracker_free+0x37e/0x6c0 [ 247.669473][ T8343] netlink_rcv_skb+0x159/0x420 [ 247.669501][ T8343] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 247.669528][ T8343] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 247.669564][ T8343] ? netlink_deliver_tap+0x1ae/0xcc0 [ 247.669594][ T8343] netlink_unicast+0x5aa/0x870 [ 247.669625][ T8343] ? __pfx_netlink_unicast+0x10/0x10 [ 247.669662][ T8343] netlink_sendmsg+0x8b0/0xda0 [ 247.669693][ T8343] ? __pfx_netlink_sendmsg+0x10/0x10 [ 247.669718][ T8343] ? __might_fault+0xa0/0x140 [ 247.669753][ T8343] ____sys_sendmsg+0x9e1/0xb70 [ 247.669769][ T8343] ? __pfx_netlink_sendmsg+0x10/0x10 [ 247.669802][ T8343] ? __pfx_____sys_sendmsg+0x10/0x10 [ 247.669832][ T8343] ___sys_sendmsg+0x190/0x1e0 [ 247.669854][ T8343] ? __pfx____sys_sendmsg+0x10/0x10 [ 247.669904][ T8343] __sys_sendmsg+0x170/0x220 [ 247.669930][ T8343] ? __pfx___sys_sendmsg+0x10/0x10 [ 247.669972][ T8343] do_syscall_64+0x106/0xf80 [ 247.670002][ T8343] ? clear_bhb_loop+0x40/0x90 [ 247.670026][ T8343] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 247.670044][ T8343] RIP: 0033:0x7fcb3539c799 [ 247.670061][ T8343] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 247.670077][ T8343] RSP: 002b:00007fcb335f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 247.670096][ T8343] RAX: ffffffffffffffda RBX: 00007fcb35615fa0 RCX: 00007fcb3539c799 [ 247.670108][ T8343] RDX: 0000000008000002 RSI: 0000200000000000 RDI: 0000000000000003 [ 247.670118][ T8343] RBP: 00007fcb335f6090 R08: 0000000000000000 R09: 0000000000000000 [ 247.670128][ T8343] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 247.670138][ T8343] R13: 00007fcb35616038 R14: 00007fcb35615fa0 R15: 00007ffe9a939d88 [ 247.670163][ T8343] [ 248.643182][ T8347] Set syz1 is full, maxelem 65536 reached [ 250.085991][ T1295] ieee802154 phy0 wpan0: encryption failed: -22 [ 250.092307][ T1295] ieee802154 phy1 wpan1: encryption failed: -22 [ 250.319763][ T8374] netlink: 'syz.0.534': attribute type 4 has an invalid length. [ 250.351131][ T8374] netlink: 152 bytes leftover after parsing attributes in process `syz.0.534'. [ 250.460448][ T8374] .`: renamed from bond0 (while UP) [ 252.194623][ T8405] fuse: Bad value for 'fd' [ 252.380970][ T9] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 252.547748][ T9] usb 4-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 252.572388][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 252.600907][ T9] usb 4-1: Product: syz [ 252.605189][ T9] usb 4-1: Manufacturer: syz [ 252.610616][ T9] usb 4-1: SerialNumber: syz [ 252.624364][ T9] usb 4-1: config 0 descriptor?? [ 253.485317][ T8409] Set syz1 is full, maxelem 65536 reached [ 253.911823][ T9] usb 4-1: Firmware: major: 226, minor: 19, hardware type: UNKNOWN (46) [ 254.057914][ T5809] hid-generic 0005:10CF:5505.000D: item fetching failed at offset 0/1 [ 254.235181][ T9] usb 4-1: no permanent extended address found, random address set [ 254.238358][ T5809] hid-generic 0005:10CF:5505.000D: probe with driver hid-generic failed with error -22 [ 254.244536][ T9] usb 4-1: atusb_probe: initialization failed, error = -524 [ 254.262099][ T9] atusb 4-1:0.0: probe with driver atusb failed with error -524 [ 254.670223][ T29] audit: type=1400 audit(2000000144.587:488): avc: denied { mount } for pid=8403 comm="syz.3.547" name="/" dev="afs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 255.117734][ T8440] dvmrp1: entered allmulticast mode [ 255.263722][ T29] audit: type=1400 audit(2000000145.177:489): avc: denied { append } for pid=8439 comm="syz.0.556" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 255.387512][ T8439] dvmrp1: left allmulticast mode [ 255.920950][ T5809] usb 4-1: USB disconnect, device number 21 [ 256.017266][ T29] audit: type=1400 audit(2000000145.807:490): avc: denied { mount } for pid=8449 comm="syz.1.558" name="/" dev="ramfs" ino=22488 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 256.053952][ T29] audit: type=1400 audit(2000000145.837:491): avc: denied { unmount } for pid=5815 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 256.147452][ T8460] fuse: Bad value for 'fd' [ 256.831051][ T5880] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 257.139274][ T5880] usb 3-1: config 0 interface 0 has no altsetting 0 [ 257.594210][ T5880] usb 3-1: New USB device found, idVendor=046d, idProduct=0a0e, bcdDevice=94.75 [ 257.603734][ T5880] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 257.614784][ T5880] usb 3-1: config 0 descriptor?? [ 258.057856][ T8486] netlink: 4 bytes leftover after parsing attributes in process `syz.1.568'. [ 258.263595][ T8488] netlink: 'syz.2.559': attribute type 10 has an invalid length. [ 258.315534][ T8488] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 258.574284][ T8488] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 258.627346][ T5809] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 258.761038][ T5809] usb 2-1: device descriptor read/64, error -71 [ 259.140905][ T5809] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 259.322114][ T29] audit: type=1400 audit(2000000149.197:492): avc: denied { read } for pid=8497 comm="syz.3.571" path="socket:[21430]" dev="sockfs" ino=21430 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 259.394531][ T8500] fuse: Bad value for 'fd' [ 259.503779][ T29] audit: type=1400 audit(2000000149.327:493): avc: denied { create } for pid=8497 comm="syz.3.571" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 259.505902][ T5809] usb 2-1: device descriptor read/64, error -71 [ 259.664635][ T5809] usb usb2-port1: attempt power cycle [ 259.705719][ T5927] usb 3-1: USB disconnect, device number 15 [ 259.998991][ T8509] fuse: Bad value for 'fd' [ 260.413854][ T5809] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 260.454638][ T5809] usb 2-1: device descriptor read/8, error -71 [ 260.703171][ T5809] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 260.745821][ T5809] usb 2-1: device descriptor read/8, error -71 [ 260.779592][ T29] audit: type=1400 audit(2000000150.697:494): avc: denied { kexec_image_load } for pid=8522 comm="syz.3.578" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=system permissive=1 [ 260.887169][ T5809] usb usb2-port1: unable to enumerate USB device [ 261.171561][ T5880] usb 4-1: new high-speed USB device number 22 using dummy_hcd [ 261.481630][ T5880] usb 4-1: config index 0 descriptor too short (expected 23569, got 27) [ 261.490147][ T5880] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 261.510642][ T5880] usb 4-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 261.880394][ T5880] usb 4-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 261.909518][ T5880] usb 4-1: Manufacturer: syz [ 261.933494][ T5880] usb 4-1: config 0 descriptor?? [ 262.081575][ T5880] rc_core: IR keymap rc-hauppauge not found [ 262.088492][ T5880] Registered IR keymap rc-empty [ 262.103412][ T5880] rc rc0: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0 [ 262.164075][ T5880] input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0/input7 [ 262.240484][ T29] audit: type=1400 audit(2000000152.157:495): avc: denied { read } for pid=5164 comm="acpid" name="event4" dev="devtmpfs" ino=2908 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 262.272498][ C0] igorplugusb 4-1:0.0: Error: urb status = -32 [ 262.279054][ T29] audit: type=1400 audit(2000000152.157:496): avc: denied { open } for pid=5164 comm="acpid" path="/dev/input/event4" dev="devtmpfs" ino=2908 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 262.341443][ T5880] usb 4-1: USB disconnect, device number 22 [ 262.551012][ T29] audit: type=1400 audit(2000000152.157:497): avc: denied { ioctl } for pid=5164 comm="acpid" path="/dev/input/event4" dev="devtmpfs" ino=2908 ioctlcmd=0x4520 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 262.781333][ T8552] netlink: 208 bytes leftover after parsing attributes in process `syz.1.583'. [ 262.793943][ T29] audit: type=1400 audit(2000000152.717:498): avc: denied { setopt } for pid=8549 comm="syz.1.583" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 262.815251][ T8551] openvswitch: netlink: IP tunnel dst address not specified [ 262.833550][ T8551] 9p: Bad value for 'wfdno' [ 262.843091][ T8551] netlink: 20 bytes leftover after parsing attributes in process `syz.2.584'. [ 262.852562][ T29] audit: type=1400 audit(2000000152.737:499): avc: denied { getopt } for pid=8547 comm="syz.2.584" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 262.886784][ T8554] syz_tun: entered allmulticast mode [ 262.920997][ T8551] netlink: 20 bytes leftover after parsing attributes in process `syz.2.584'. [ 263.060628][ T8559] dvmrp1: entered allmulticast mode [ 263.202236][ T8558] dvmrp1: left allmulticast mode [ 263.482443][ T8565] fuse: Bad value for 'fd' [ 263.913534][ T8568] netlink: 4 bytes leftover after parsing attributes in process `syz.0.589'. [ 264.221266][ T5927] hid-generic 0005:10CF:5505.000E: item fetching failed at offset 0/1 [ 264.243105][ T5927] hid-generic 0005:10CF:5505.000E: probe with driver hid-generic failed with error -22 [ 264.538679][ T8581] fuse: Bad value for 'user_id' [ 264.543639][ T8581] fuse: Bad value for 'user_id' [ 264.597653][ T5927] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 265.111436][ T5927] usb 1-1: device descriptor read/64, error -71 [ 265.411294][ T5927] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 265.480530][ T8592] netlink: 68 bytes leftover after parsing attributes in process `syz.1.595'. [ 266.131152][ T5927] usb 1-1: device descriptor read/64, error -71 [ 266.298625][ T5927] usb usb1-port1: attempt power cycle [ 266.550956][ T5859] usb 2-1: new high-speed USB device number 17 using dummy_hcd [ 266.880944][ T5927] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 267.002698][ T8610] dvmrp1: entered allmulticast mode [ 267.043125][ T8609] dvmrp1: left allmulticast mode [ 267.467990][ T29] audit: type=1400 audit(2000000157.147:500): avc: denied { unlink } for pid=8606 comm="syz.4.599" name="#4" dev="tmpfs" ino=685 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 267.481664][ T5927] usb 1-1: device not accepting address 8, error -71 [ 267.517514][ T29] audit: type=1400 audit(2000000157.157:501): avc: denied { mount } for pid=8606 comm="syz.4.599" name="/" dev="overlay" ino=681 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 267.543688][ T5859] usb 2-1: config 127 has an invalid interface number: 164 but max is 3 [ 267.552174][ T5859] usb 2-1: config 127 has an invalid interface number: 59 but max is 3 [ 267.580250][ T5859] usb 2-1: config 127 has an invalid interface number: 40 but max is 3 [ 267.618982][ T5859] usb 2-1: config 127 contains an unexpected descriptor of type 0x1, skipping [ 267.630239][ T5859] usb 2-1: config 127 has no interface number 0 [ 267.640502][ T5859] usb 2-1: config 127 has no interface number 1 [ 267.647017][ T5859] usb 2-1: config 127 has no interface number 3 [ 267.653629][ T5859] usb 2-1: config 127 interface 164 altsetting 4 endpoint 0xB has invalid maxpacket 1023, setting to 64 [ 267.690406][ T5859] usb 2-1: config 127 interface 164 altsetting 4 bulk endpoint 0xC has invalid maxpacket 1024 [ 267.701158][ T5859] usb 2-1: config 127 interface 164 altsetting 4 endpoint 0x8 has invalid maxpacket 1023, setting to 64 [ 267.712791][ T5859] usb 2-1: config 127 interface 164 altsetting 4 has a duplicate endpoint with address 0xB, skipping [ 267.760671][ T8615] picdev_read: 164 callbacks suppressed [ 267.760689][ T8615] kvm: pic: non byte read [ 267.781083][ T8615] kvm: pic: non byte read [ 267.794195][ T5859] usb 2-1: config 127 interface 164 altsetting 4 endpoint 0x1 has invalid maxpacket 1040, setting to 1024 [ 267.805809][ T5859] usb 2-1: config 127 interface 164 altsetting 4 bulk endpoint 0x1 has invalid maxpacket 1024 [ 267.816323][ T5859] usb 2-1: config 127 interface 164 altsetting 4 endpoint 0x2 has an invalid bInterval 49, changing to 7 [ 267.827778][ T5859] usb 2-1: config 127 interface 2 altsetting 1 endpoint 0xD has invalid maxpacket 1024, setting to 64 [ 267.839651][ T5859] usb 2-1: config 127 interface 2 altsetting 1 endpoint 0x6 has invalid maxpacket 511, setting to 64 [ 267.854047][ T5859] usb 2-1: config 127 interface 59 altsetting 2 has a duplicate endpoint with address 0x1, skipping [ 267.865079][ T5859] usb 2-1: config 127 interface 59 altsetting 2 has a duplicate endpoint with address 0x8, skipping [ 267.901211][ T8615] kvm: pic: non byte read [ 267.905589][ T8615] kvm: pic: non byte read [ 267.915183][ T29] audit: type=1400 audit(2000000157.807:502): avc: denied { unmount } for pid=5805 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 268.023772][ T5859] usb 2-1: config 127 interface 59 altsetting 2 has an invalid descriptor for endpoint zero, skipping [ 268.034883][ T8615] kvm: pic: non byte read [ 268.034959][ T8615] kvm: pic: non byte read [ 268.050960][ T5859] usb 2-1: config 127 interface 59 altsetting 2 has a duplicate endpoint with address 0x8, skipping [ 268.067979][ T5859] usb 2-1: config 127 interface 59 altsetting 2 has an invalid descriptor for endpoint zero, skipping [ 268.137383][ T8624] fuse: Bad value for 'fd' [ 268.507370][ T8615] kvm: pic: non byte read [ 268.590446][ T5859] usb 2-1: config 127 interface 59 altsetting 2 has a duplicate endpoint with address 0xB, skipping [ 268.603946][ T5859] usb 2-1: config 127 interface 59 altsetting 2 has an invalid descriptor for endpoint zero, skipping [ 268.617437][ T5859] usb 2-1: config 127 interface 59 altsetting 2 has an invalid descriptor for endpoint zero, skipping [ 268.628964][ T5859] usb 2-1: config 127 interface 40 altsetting 32 has a duplicate endpoint with address 0x7, skipping [ 268.640716][ T5859] usb 2-1: config 127 interface 40 altsetting 32 has a duplicate endpoint with address 0x1, skipping [ 268.657614][ T5859] usb 2-1: config 127 interface 40 altsetting 32 has an invalid descriptor for endpoint zero, skipping [ 268.669169][ T5859] usb 2-1: config 127 interface 40 altsetting 32 has an invalid descriptor for endpoint zero, skipping [ 268.681006][ T5859] usb 2-1: config 127 interface 40 altsetting 32 has a duplicate endpoint with address 0x1, skipping [ 268.701506][ T5859] usb 2-1: config 127 interface 164 has no altsetting 0 [ 268.709155][ T5859] usb 2-1: config 127 interface 2 has no altsetting 0 [ 268.716510][ T5859] usb 2-1: config 127 interface 59 has no altsetting 0 [ 268.727604][ T5859] usb 2-1: config 127 interface 40 has no altsetting 0 [ 268.737780][ T5859] usb 2-1: New USB device found, idVendor=0499, idProduct=1507, bcdDevice=12.32 [ 269.545715][ T5859] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 269.581013][ T5859] usb 2-1: Product: ê›ä™˜å’Œáªê¬â¢¡Å‰ë’“즷剘텻猙샖繌系㧶궖젬ꅱ埳牥在燿οã±ë¯ƒçƒ½æ‚ªåžìšƒâ‹µâ£¥îº­ï˜£ç¿·é¦€å±·å„œç«¬è—œá£¹å‰‡á§‘⥽૪꿭ã”㈘䑞ꔨ럇˷︞蒋⋄Ｘᢵ앗烶㩨촊螓쳥北툠擾è­ã„ é‰ë†”á¡î‘忠昳慪竀斑橽訌 [ 269.721215][ T5859] usb 2-1: Manufacturer: ဇ [ 269.738466][ T5859] usb 2-1: SerialNumber: 寠鬫é¿é®‘煼厳ࠩ꘶◺ï‚抺â®á˜¤ì”³ãµã”¢î¾«ê˜Ÿá¶­â ­èŽ˜î¨ïš­î¿”냸㥬ᢀ㚑㉢軘䋫ᑆȖ꺻ᶑ粋̰㊞é½åžƒç¥à­¿ëŽºâ‚°ã €ãº»á¡¼ [ 270.106354][ T5859] usb 2-1: can't set config #127, error -71 [ 270.212499][ T5859] usb 2-1: USB disconnect, device number 17 [ 271.206137][ T8647] netlink: 4 bytes leftover after parsing attributes in process `syz.2.610'. [ 271.700906][ T5927] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 272.061471][ T5927] usb 3-1: device descriptor read/64, error -71 [ 272.305937][ T5927] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 272.433570][ T8664] netlink: 4 bytes leftover after parsing attributes in process `syz.1.614'. [ 272.771776][ T5927] usb 3-1: device descriptor read/64, error -71 [ 272.880911][ T5880] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 272.958242][ T5927] usb usb3-port1: attempt power cycle [ 273.064765][ T8672] fuse: Bad value for 'fd' [ 273.480996][ T5880] usb 2-1: device descriptor read/64, error -71 [ 273.900931][ T5880] usb 2-1: new high-speed USB device number 19 using dummy_hcd [ 274.046949][ T8684] overlayfs: missing 'lowerdir' [ 274.110956][ T5880] usb 2-1: device descriptor read/64, error -71 [ 274.254239][ T5880] usb usb2-port1: attempt power cycle [ 274.417490][ T29] audit: type=1400 audit(2000000164.337:503): avc: denied { read write } for pid=8685 comm="syz.0.621" name="loop-control" dev="devtmpfs" ino=646 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 274.611873][ T29] audit: type=1400 audit(2000000164.337:504): avc: denied { open } for pid=8685 comm="syz.0.621" path="/dev/loop-control" dev="devtmpfs" ino=646 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 274.640959][ T5880] usb 2-1: new high-speed USB device number 20 using dummy_hcd [ 274.692921][ T5880] usb 2-1: device descriptor read/8, error -71 [ 275.031199][ T5880] usb 2-1: new high-speed USB device number 21 using dummy_hcd [ 275.127301][ T5880] usb 2-1: device descriptor read/8, error -71 [ 275.714927][ T5880] usb usb2-port1: unable to enumerate USB device [ 275.952725][ T8697] Set syz1 is full, maxelem 65536 reached [ 276.647457][ T8714] netlink: 52 bytes leftover after parsing attributes in process `syz.0.629'. [ 276.697410][ T8714] FAULT_INJECTION: forcing a failure. [ 276.697410][ T8714] name failslab, interval 1, probability 0, space 0, times 0 [ 276.913689][ T8714] CPU: 0 UID: 0 PID: 8714 Comm: syz.0.629 Tainted: G L syzkaller #0 PREEMPT(full) [ 276.913720][ T8714] Tainted: [L]=SOFTLOCKUP [ 276.913726][ T8714] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 276.913737][ T8714] Call Trace: [ 276.913742][ T8714] [ 276.913750][ T8714] dump_stack_lvl+0x100/0x190 [ 276.913782][ T8714] should_fail_ex.cold+0x5/0xa [ 276.913805][ T8714] ? ip_options_get+0xa4/0x420 [ 276.913828][ T8714] should_failslab+0xc2/0x120 [ 276.913847][ T8714] __kmalloc_noprof+0xe0/0x850 [ 276.913871][ T8714] ? widen_string+0xdb/0x2f0 [ 276.913894][ T8714] ip_options_get+0xa4/0x420 [ 276.913917][ T8714] ? __pfx_ip4_addr_string+0x10/0x10 [ 276.913940][ T8714] ? __pfx_ip_options_get+0x10/0x10 [ 276.913963][ T8714] ? string+0x201/0x4d0 [ 276.913981][ T8714] ? format_decode+0x1a7/0xcd0 [ 276.914005][ T8714] ip_cmsg_send+0x86f/0xbc0 [ 276.914030][ T8714] udp_sendmsg+0x1dba/0x2890 [ 276.914058][ T8714] ? __pfx_ip_generic_getfrag+0x10/0x10 [ 276.914083][ T8714] ? tomoyo_write_log2+0x17a/0xbc0 [ 276.914107][ T8714] ? tomoyo_domain_quota_is_ok+0x367/0x580 [ 276.914135][ T8714] ? __pfx_udp_sendmsg+0x10/0x10 [ 276.914161][ T8714] ? tomoyo_supervisor+0x1e7/0x1340 [ 276.914183][ T8714] ? __pfx_tomoyo_supervisor+0x10/0x10 [ 276.914206][ T8714] ? is_bpf_text_address+0x94/0x1a0 [ 276.914244][ T8714] ? __lock_acquire+0x4a5/0x2630 [ 276.914266][ T8714] udpv6_sendmsg+0x156c/0x2f60 [ 276.914289][ T8714] ? find_held_lock+0x2b/0x80 [ 276.914319][ T8714] ? __pfx_udpv6_sendmsg+0x10/0x10 [ 276.914373][ T8714] ? __local_bh_enable_ip+0x9e/0x120 [ 276.914395][ T8714] ? lockdep_hardirqs_on+0x78/0x100 [ 276.914420][ T8714] ? inet_autobind+0x145/0x1a0 [ 276.914445][ T8714] ? __local_bh_enable_ip+0x9e/0x120 [ 276.914466][ T8714] ? inet_autobind+0x14a/0x1a0 [ 276.914491][ T8714] ? __pfx_udpv6_sendmsg+0x10/0x10 [ 276.914515][ T8714] ? inet6_sendmsg+0x105/0x140 [ 276.914537][ T8714] inet6_sendmsg+0x105/0x140 [ 276.914562][ T8714] ____sys_sendmsg+0x704/0xb70 [ 276.914582][ T8714] ? __pfx_____sys_sendmsg+0x10/0x10 [ 276.914604][ T8714] ? __pfx__kstrtoull+0x10/0x10 [ 276.914631][ T8714] ___sys_sendmsg+0x190/0x1e0 [ 276.914651][ T8714] ? __pfx____sys_sendmsg+0x10/0x10 [ 276.914681][ T8714] ? find_held_lock+0x2b/0x80 [ 276.914718][ T8714] __sys_sendmmsg+0x205/0x430 [ 276.914745][ T8714] ? __pfx___sys_sendmmsg+0x10/0x10 [ 276.914776][ T8714] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 276.914813][ T8714] ? fput+0x79/0x100 [ 276.914833][ T8714] ? ksys_write+0x1ac/0x250 [ 276.914848][ T8714] ? __pfx_ksys_write+0x10/0x10 [ 276.914867][ T8714] __x64_sys_sendmmsg+0x9c/0x100 [ 276.914890][ T8714] ? lockdep_hardirqs_on+0x78/0x100 [ 276.914914][ T8714] do_syscall_64+0x106/0xf80 [ 276.914939][ T8714] ? clear_bhb_loop+0x40/0x90 [ 276.914960][ T8714] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 276.914978][ T8714] RIP: 0033:0x7f2e17b9c799 [ 276.914992][ T8714] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 276.915008][ T8714] RSP: 002b:00007f2e15dee028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 276.915025][ T8714] RAX: ffffffffffffffda RBX: 00007f2e17e15fa0 RCX: 00007f2e17b9c799 [ 276.915036][ T8714] RDX: 0000000000000001 RSI: 0000200000000440 RDI: 0000000000000003 [ 276.915046][ T8714] RBP: 00007f2e15dee090 R08: 0000000000000000 R09: 0000000000000000 [ 276.915055][ T8714] R10: 00000000000000c0 R11: 0000000000000246 R12: 0000000000000001 [ 276.915065][ T8714] R13: 00007f2e17e16038 R14: 00007f2e17e15fa0 R15: 00007ffd8ef000e8 [ 276.915088][ T8714] [ 278.530929][ T5927] usb 2-1: new full-speed USB device number 22 using dummy_hcd [ 278.702507][ T5927] usb 2-1: config 0 has an invalid interface number: 11 but max is 0 [ 278.783651][ T5927] usb 2-1: config 0 has no interface number 0 [ 278.857039][ T5927] usb 2-1: config 0 interface 11 altsetting 253 endpoint 0x7 has invalid maxpacket 1024, setting to 64 [ 279.099181][ T5927] usb 2-1: config 0 interface 11 altsetting 253 endpoint 0x87 has an invalid bInterval 0, changing to 10 [ 279.111549][ T5927] usb 2-1: config 0 interface 11 has no altsetting 0 [ 279.119620][ T5927] usb 2-1: New USB device found, idVendor=06cd, idProduct=012a, bcdDevice=d5.1b [ 279.174331][ T5927] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 279.231883][ T5927] usb 2-1: config 0 descriptor?? [ 279.265272][ T8739] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 279.276003][ T5927] keyspan 2-1:0.11: Keyspan 4 port adapter converter detected [ 279.302386][ T5927] keyspan 2-1:0.11: found no endpoint descriptor for endpoint 81 [ 279.357927][ T5927] keyspan 2-1:0.11: found no endpoint descriptor for endpoint 1 [ 279.435456][ T5927] usb 2-1: Keyspan 4 port adapter converter now attached to ttyUSB0 [ 279.480103][ T5927] keyspan 2-1:0.11: found no endpoint descriptor for endpoint 82 [ 279.482071][ T29] audit: type=1400 audit(2000000169.397:505): avc: denied { ioctl } for pid=8738 comm="syz.1.636" path="/dev/ptyq7" dev="devtmpfs" ino=126 ioctlcmd=0x5420 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bsdpty_device_t tclass=chr_file permissive=1 [ 279.506392][ T5927] keyspan 2-1:0.11: found no endpoint descriptor for endpoint 2 [ 279.625325][ T5927] usb 2-1: Keyspan 4 port adapter converter now attached to ttyUSB1 [ 279.655389][ T5927] keyspan 2-1:0.11: found no endpoint descriptor for endpoint 83 [ 279.671104][ T5927] keyspan 2-1:0.11: found no endpoint descriptor for endpoint 3 [ 279.973831][ T5927] usb 2-1: Keyspan 4 port adapter converter now attached to ttyUSB2 [ 279.995785][ T5927] keyspan 2-1:0.11: found no endpoint descriptor for endpoint 84 [ 280.011054][ T5927] keyspan 2-1:0.11: found no endpoint descriptor for endpoint 4 [ 280.082220][ T5927] usb 2-1: Keyspan 4 port adapter converter now attached to ttyUSB3 [ 280.163035][ T5927] usb 2-1: USB disconnect, device number 22 [ 280.211620][ T5927] keyspan_4 ttyUSB0: Keyspan 4 port adapter converter now disconnected from ttyUSB0 [ 280.269314][ T5927] keyspan_4 ttyUSB1: Keyspan 4 port adapter converter now disconnected from ttyUSB1 [ 280.331342][ T5927] keyspan_4 ttyUSB2: Keyspan 4 port adapter converter now disconnected from ttyUSB2 [ 280.367519][ T5927] keyspan_4 ttyUSB3: Keyspan 4 port adapter converter now disconnected from ttyUSB3 [ 280.401341][ T5927] keyspan 2-1:0.11: device disconnected [ 280.416251][ T8769] netlink: 4 bytes leftover after parsing attributes in process `syz.4.643'. [ 280.578643][ T9] hid-generic 0005:10CF:5505.000F: item fetching failed at offset 0/1 [ 280.588939][ T9] hid-generic 0005:10CF:5505.000F: probe with driver hid-generic failed with error -22 [ 280.633564][ T9] hid (null): unknown global tag 0xe [ 280.643474][ T9] hid-generic 08D4:0000:0001.0010: unexpected long global item [ 280.651630][ T9] hid-generic 08D4:0000:0001.0010: probe with driver hid-generic failed with error -22 [ 280.760909][ T5927] usb 2-1: new high-speed USB device number 23 using dummy_hcd [ 281.132654][ T5927] usb 2-1: Using ep0 maxpacket: 8 [ 281.241674][ T5927] usb 2-1: unable to get BOS descriptor or descriptor too short [ 281.259275][ T5927] usb 2-1: config 7 has an invalid interface number: 58 but max is 0 [ 281.282054][ T5927] usb 2-1: config 7 has no interface number 0 [ 281.313206][ T5927] usb 2-1: config 7 interface 58 altsetting 3 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 281.380883][ T5927] usb 2-1: config 7 interface 58 has no altsetting 0 [ 281.402827][ T5927] usb 2-1: New USB device found, idVendor=1498, idProduct=a090, bcdDevice=48.0f [ 281.420979][ T5927] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 281.448772][ T5927] usb 2-1: Product: syz [ 281.467602][ T5927] usb 2-1: Manufacturer: syz [ 281.480081][ T5927] usb 2-1: SerialNumber: syz [ 281.499795][ T29] audit: type=1400 audit(2000000171.417:506): avc: denied { create } for pid=8780 comm="syz.0.647" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 281.578676][ T8782] loop6: detected capacity change from 0 to 7 [ 281.624641][ C1] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 281.634357][ C1] Buffer I/O error on dev loop6, logical block 0, async page read [ 281.653507][ C1] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 281.663110][ C1] Buffer I/O error on dev loop6, logical block 0, async page read [ 281.676487][ C1] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 281.686622][ C1] Buffer I/O error on dev loop6, logical block 0, async page read [ 281.706599][ C1] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 281.716210][ C1] Buffer I/O error on dev loop6, logical block 0, async page read [ 281.845794][ C0] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 281.855401][ C0] Buffer I/O error on dev loop6, logical block 0, async page read [ 281.883948][ C1] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 281.893575][ C1] Buffer I/O error on dev loop6, logical block 0, async page read [ 281.947723][ T8787] fuse: Invalid rootmode [ 282.397456][ C1] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 282.407096][ C1] Buffer I/O error on dev loop6, logical block 0, async page read [ 282.415017][ T8782] ldm_validate_partition_table(): Disk read failed. [ 282.439311][ C1] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 282.448912][ C1] Buffer I/O error on dev loop6, logical block 0, async page read [ 282.460744][ C1] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 282.470356][ C1] Buffer I/O error on dev loop6, logical block 0, async page read [ 282.542684][ C1] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 282.552300][ C1] Buffer I/O error on dev loop6, logical block 0, async page read [ 282.574302][ T8782] Dev loop6: unable to read RDB block 0 [ 282.593678][ T8782] loop6: unable to read partition table [ 282.600654][ T8782] loop6: partition table beyond EOD, truncated [ 282.607253][ T8782] loop_reread_partitions: partition scan of loop6 (úùƒå¡™‰ü¾SêjÌ–ã¢P=ý?ã}X‹ºÐ œëÜ%õ«`ÉæÖ€ù…ˆŠ5) failed (rc=-5) [ 282.906142][ T5927] usb 2-1: USB disconnect, device number 23 [ 283.338400][ T29] audit: type=1400 audit(2000000173.257:507): avc: denied { ioctl } for pid=8792 comm="syz.3.650" path="socket:[24526]" dev="sockfs" ino=24526 ioctlcmd=0x7453 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 283.462757][ T8802] nvme_fabrics: unknown parameter or missing value 'syz0' in ctrl creation request [ 283.958179][ T8798] kAFS: unable to lookup cell '(,c¾ûL' [ 284.081044][ T919] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 284.382432][ T919] usb 4-1: Using ep0 maxpacket: 32 [ 284.406662][ T919] usb 4-1: New USB device found, idVendor=1235, idProduct=8203, bcdDevice= 0.40 [ 284.440448][ T919] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 284.458960][ T919] usb 4-1: Product: syz [ 284.467282][ T919] usb 4-1: Manufacturer: syz [ 284.479862][ T919] usb 4-1: SerialNumber: syz [ 284.698183][ T29] audit: type=1400 audit(2000000174.617:508): avc: denied { setopt } for pid=8792 comm="syz.3.650" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 285.231611][ T8824] nvme_fabrics: unknown parameter or missing value 'syz0' in ctrl creation request [ 285.694678][ T8828] fuse: Invalid rootmode [ 286.259266][ T919] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 286.271585][ T919] usb 4-1: MIDIStreaming interface descriptor not found [ 286.541594][ T919] usb 4-1: USB disconnect, device number 23 [ 287.046693][ T29] audit: type=1400 audit(2000000176.967:509): avc: denied { read write } for pid=8844 comm="syz.3.662" name="ppp" dev="devtmpfs" ino=709 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 287.485825][ T29] audit: type=1400 audit(2000000176.967:510): avc: denied { open } for pid=8844 comm="syz.3.662" path="/dev/ppp" dev="devtmpfs" ino=709 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 289.109669][ T8865] Set syz1 is full, maxelem 65536 reached [ 289.372173][ T5927] hid (null): unknown global tag 0xe [ 289.379516][ T5927] hid-generic 08D4:0000:0001.0011: unexpected long global item [ 289.397361][ T5927] hid-generic 08D4:0000:0001.0011: probe with driver hid-generic failed with error -22 [ 290.067074][ T8884] fuse: Unknown parameter '00000000000000000000' [ 290.612394][ T8885] fuse: Bad value for 'fd' [ 291.624497][ T29] audit: type=1400 audit(2000000181.547:511): avc: denied { mount } for pid=8889 comm="syz.4.674" name="/" dev="bpf" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=filesystem permissive=1 [ 291.780784][ T29] audit: type=1400 audit(2000000181.547:512): avc: denied { ioctl } for pid=8889 comm="syz.4.674" path="/dev/ppp" dev="devtmpfs" ino=709 ioctlcmd=0x743b scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 293.041279][ T5809] hid (null): unknown global tag 0xe [ 293.098631][ T5809] hid-generic 08D4:0000:0001.0012: unexpected long global item [ 293.289912][ T5809] hid-generic 08D4:0000:0001.0012: probe with driver hid-generic failed with error -22 [ 293.318788][ T8916] netlink: 16 bytes leftover after parsing attributes in process `syz.1.679'. [ 293.914616][ T8930] fuse: Unknown parameter '00000000000000000000' [ 294.857973][ T29] audit: type=1400 audit(2000000184.767:513): avc: denied { read write } for pid=8922 comm="syz.3.684" name="sg0" dev="devtmpfs" ino=803 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 295.301031][ T29] audit: type=1400 audit(2000000184.767:514): avc: denied { open } for pid=8922 comm="syz.3.684" path="/dev/sg0" dev="devtmpfs" ino=803 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 295.432820][ T29] audit: type=1400 audit(2000000184.777:515): avc: denied { ioctl } for pid=8922 comm="syz.3.684" path="/dev/sg0" dev="devtmpfs" ino=803 ioctlcmd=0x5393 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 296.144554][ T8947] overlayfs: missing 'lowerdir' [ 296.175390][ T8953] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 297.924072][ T8962] loop2: detected capacity change from 0 to 7 [ 297.950258][ T8962] Dev loop2: unable to read RDB block 7 [ 297.957247][ T8962] loop2: unable to read partition table [ 297.962971][ T8962] loop2: partition table beyond EOD, truncated [ 297.969124][ T8962] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 298.826311][ T8977] fuse: Unknown parameter '00000000000000000000' [ 299.142037][ T8979] netlink: 'syz.3.697': attribute type 10 has an invalid length. [ 299.233674][ T8979] bridge0: port 2(bridge_slave_1) entered disabled state [ 299.241259][ T8979] bridge0: port 1(bridge_slave_0) entered disabled state [ 299.274402][ T8979] bridge0: port 2(bridge_slave_1) entered blocking state [ 299.281582][ T8979] bridge0: port 2(bridge_slave_1) entered forwarding state [ 299.289028][ T8979] bridge0: port 1(bridge_slave_0) entered blocking state [ 299.296251][ T8979] bridge0: port 1(bridge_slave_0) entered forwarding state [ 299.326651][ T8979] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 299.554615][ T9] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 299.962274][ T8986] overlayfs: missing 'lowerdir' [ 299.982196][ T9] usb 1-1: Using ep0 maxpacket: 8 [ 299.994274][ T9] usb 1-1: unable to get BOS descriptor or descriptor too short [ 300.286494][ T8994] netlink: 4 bytes leftover after parsing attributes in process `syz.2.700'. [ 300.346440][ T9] usb 1-1: config 7 has an invalid interface number: 58 but max is 0 [ 300.364742][ T9] usb 1-1: config 7 has no interface number 0 [ 300.380881][ T9] usb 1-1: config 7 interface 58 altsetting 3 endpoint 0xE has invalid maxpacket 1893, setting to 64 [ 300.410253][ T9] usb 1-1: config 7 interface 58 altsetting 3 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 300.465730][ T5880] hid-generic 0005:10CF:5505.0013: item fetching failed at offset 0/1 [ 300.499376][ T9] usb 1-1: config 7 interface 58 has no altsetting 0 [ 300.506666][ T5880] hid-generic 0005:10CF:5505.0013: probe with driver hid-generic failed with error -22 [ 300.554538][ T9004] nvme_fabrics: unknown parameter or missing value 'syz0' in ctrl creation request [ 300.614618][ T9] usb 1-1: New USB device found, idVendor=1498, idProduct=a090, bcdDevice=48.0f [ 300.649625][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 300.677949][ T9] usb 1-1: Product: syz [ 300.693036][ T9] usb 1-1: Manufacturer: syz [ 300.703746][ T9] usb 1-1: SerialNumber: syz [ 300.721273][ T5809] usb 3-1: new high-speed USB device number 19 using dummy_hcd [ 301.680849][ T0] NOHZ tick-stop error: local softirq work is pending, handler #82!!! [ 301.911004][ T5809] usb 3-1: device descriptor read/64, error -71 [ 301.930941][ T9008] loop2: detected capacity change from 0 to 7 [ 301.981140][ T9008] Dev loop2: unable to read RDB block 7 [ 301.986716][ T9008] loop2: unable to read partition table [ 301.994486][ T9008] loop2: partition table beyond EOD, truncated [ 302.000634][ T9008] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 302.114407][ T9] usb 1-1: USB disconnect, device number 10 [ 302.249285][ T5809] usb 3-1: new high-speed USB device number 20 using dummy_hcd [ 302.432172][ T5809] usb 3-1: device descriptor read/64, error -71 [ 302.561016][ T5809] usb usb3-port1: attempt power cycle [ 302.915584][ T5809] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 303.407667][ T5809] usb 3-1: device descriptor read/8, error -71 [ 303.905535][ T9032] netlink: 4 bytes leftover after parsing attributes in process `syz.1.707'. [ 304.311225][ T9] usb 2-1: new high-speed USB device number 24 using dummy_hcd [ 304.471266][ T9] usb 2-1: device descriptor read/64, error -71 [ 304.751112][ T9] usb 2-1: new high-speed USB device number 25 using dummy_hcd [ 304.893717][ T9040] overlayfs: missing 'lowerdir' [ 305.090927][ T9] usb 2-1: device descriptor read/64, error -71 [ 305.297802][ T9] usb usb2-port1: attempt power cycle [ 306.132460][ T9053] netlink: 4 bytes leftover after parsing attributes in process `syz.4.717'. [ 306.142799][ T9] usb 2-1: new high-speed USB device number 26 using dummy_hcd [ 306.221320][ T9] usb 2-1: device descriptor read/8, error -71 [ 306.385177][ T9064] netlink: 4 bytes leftover after parsing attributes in process `syz.0.720'. [ 306.490103][ T9063] nvme_fabrics: unknown parameter or missing value 'syz0' in ctrl creation request [ 306.504530][ T9] usb 2-1: new high-speed USB device number 27 using dummy_hcd [ 306.776582][ T9] usb 2-1: device descriptor read/8, error -71 [ 306.851607][ T5927] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 306.902240][ T9] usb usb2-port1: unable to enumerate USB device [ 307.013138][ T5927] usb 1-1: device descriptor read/64, error -71 [ 307.023953][ T29] audit: type=1400 audit(2000000196.947:516): avc: denied { execute } for pid=9066 comm="syz.1.721" path=2F6D656D66643A14A3BB07202864656C6574656429 dev="hugetlbfs" ino=25234 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:hugetlbfs_t tclass=file permissive=1 [ 307.118474][ T9073] nvme_fabrics: unknown parameter or missing value 'syz0' in ctrl creation request [ 307.315468][ T5927] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 307.457764][ T29] audit: type=1400 audit(2000000197.247:517): avc: denied { view } for pid=9066 comm="syz.1.721" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=key permissive=1 [ 307.585758][ T5927] usb 1-1: device descriptor read/64, error -71 [ 307.711144][ T5927] usb usb1-port1: attempt power cycle [ 307.777642][ T29] audit: type=1400 audit(2000000197.697:518): avc: denied { create } for pid=9075 comm="syz.3.723" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 307.797943][ T9076] FAULT_INJECTION: forcing a failure. [ 307.797943][ T9076] name failslab, interval 1, probability 0, space 0, times 0 [ 307.821374][ T9076] CPU: 0 UID: 0 PID: 9076 Comm: syz.3.723 Tainted: G L syzkaller #0 PREEMPT(full) [ 307.821396][ T9076] Tainted: [L]=SOFTLOCKUP [ 307.821399][ T9076] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 307.821406][ T9076] Call Trace: [ 307.821410][ T9076] [ 307.821415][ T9076] dump_stack_lvl+0x100/0x190 [ 307.821437][ T9076] should_fail_ex.cold+0x5/0xa [ 307.821452][ T9076] ? ethnl_default_set_doit+0x174/0x9b0 [ 307.821468][ T9076] should_failslab+0xc2/0x120 [ 307.821480][ T9076] __kmalloc_noprof+0xe0/0x850 [ 307.821497][ T9076] ? __nla_parse+0x40/0x60 [ 307.821514][ T9076] ethnl_default_set_doit+0x174/0x9b0 [ 307.821533][ T9076] genl_family_rcv_msg_doit+0x214/0x300 [ 307.821547][ T9076] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 307.821564][ T9076] ? bpf_lsm_capable+0x9/0x10 [ 307.821575][ T9076] ? security_capable+0x80/0x260 [ 307.821590][ T9076] ? ns_capable+0xd2/0xf0 [ 307.821605][ T9076] genl_rcv_msg+0x560/0x800 [ 307.821618][ T9076] ? __pfx_genl_rcv_msg+0x10/0x10 [ 307.821630][ T9076] ? __pfx_ethnl_default_set_doit+0x10/0x10 [ 307.821652][ T9076] netlink_rcv_skb+0x159/0x420 [ 307.821669][ T9076] ? __pfx_genl_rcv_msg+0x10/0x10 [ 307.821681][ T9076] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 307.821704][ T9076] ? netlink_deliver_tap+0x1ae/0xcc0 [ 307.821723][ T9076] genl_rcv+0x28/0x40 [ 307.821732][ T9076] netlink_unicast+0x5aa/0x870 [ 307.821752][ T9076] ? __pfx_netlink_unicast+0x10/0x10 [ 307.821774][ T9076] netlink_sendmsg+0x8b0/0xda0 [ 307.821794][ T9076] ? __pfx_netlink_sendmsg+0x10/0x10 [ 307.821810][ T9076] ? __might_fault+0xa0/0x140 [ 307.821831][ T9076] ____sys_sendmsg+0x9e1/0xb70 [ 307.821841][ T9076] ? __pfx_netlink_sendmsg+0x10/0x10 [ 307.821860][ T9076] ? __pfx_____sys_sendmsg+0x10/0x10 [ 307.821877][ T9076] ___sys_sendmsg+0x190/0x1e0 [ 307.821890][ T9076] ? __pfx____sys_sendmsg+0x10/0x10 [ 307.821919][ T9076] __sys_sendmsg+0x170/0x220 [ 307.821935][ T9076] ? __pfx___sys_sendmsg+0x10/0x10 [ 307.821959][ T9076] do_syscall_64+0x106/0xf80 [ 307.821981][ T9076] ? clear_bhb_loop+0x40/0x90 [ 307.821994][ T9076] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 307.822006][ T9076] RIP: 0033:0x7fcb3539c799 [ 307.822015][ T9076] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 307.822026][ T9076] RSP: 002b:00007fcb335f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 307.822037][ T9076] RAX: ffffffffffffffda RBX: 00007fcb35615fa0 RCX: 00007fcb3539c799 [ 307.822044][ T9076] RDX: 0000000000000000 RSI: 0000200000000540 RDI: 0000000000000010 [ 307.822050][ T9076] RBP: 00007fcb335f6090 R08: 0000000000000000 R09: 0000000000000000 [ 307.822057][ T9076] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 307.822063][ T9076] R13: 00007fcb35616038 R14: 00007fcb35615fa0 R15: 00007ffe9a939d88 [ 307.822077][ T9076] [ 308.290907][ T5927] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 308.314651][ T9083] dvmrp1: entered allmulticast mode [ 308.323580][ T5927] usb 1-1: device descriptor read/8, error -71 [ 308.471334][ T9082] dvmrp1: left allmulticast mode [ 308.581281][ T5927] usb 1-1: new high-speed USB device number 14 using dummy_hcd [ 308.726180][ T5927] usb 1-1: device descriptor read/8, error -71 [ 308.784363][ T29] audit: type=1400 audit(2000000198.707:519): avc: denied { ioctl } for pid=9090 comm="syz.3.727" path="/dev/binderfs/binder0" dev="binder" ino=7 ioctlcmd=0x6201 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 308.818388][ T9092] fuse: Unknown parameter 'user00000000000000000000' [ 309.243709][ T5927] usb usb1-port1: unable to enumerate USB device [ 310.349324][ T9110] netlink: 4 bytes leftover after parsing attributes in process `syz.2.732'. [ 310.592000][ T5927] hid-generic 0005:10CF:5505.0014: item fetching failed at offset 0/1 [ 310.765046][ T5927] hid-generic 0005:10CF:5505.0014: probe with driver hid-generic failed with error -22 [ 311.653837][ T1295] ieee802154 phy0 wpan0: encryption failed: -22 [ 311.660126][ T1295] ieee802154 phy1 wpan1: encryption failed: -22 [ 312.281657][ T9135] nvme_fabrics: unknown parameter or missing value 'syz0' in ctrl creation request [ 312.902993][ T9142] fuse: Unknown parameter 'user_i00000000000000000000' [ 313.273473][ T9143] netlink: 4 bytes leftover after parsing attributes in process `syz.2.738'. [ 313.469471][ T919] hid (null): unknown global tag 0xe [ 313.476556][ T919] hid-generic 08D4:0000:0001.0015: unexpected long global item [ 313.496994][ T919] hid-generic 08D4:0000:0001.0015: probe with driver hid-generic failed with error -22 [ 313.903927][ T9157] fuse: Unknown parameter '00000000000000000000' [ 314.305478][ T919] usb 3-1: new high-speed USB device number 23 using dummy_hcd [ 314.544321][ T919] usb 3-1: device descriptor read/64, error -71 [ 314.677488][ T9163] netlink: 'syz.0.745': attribute type 10 has an invalid length. [ 314.721712][ T9163] bridge0: port 2(bridge_slave_1) entered disabled state [ 314.728997][ T9163] bridge0: port 1(bridge_slave_0) entered disabled state [ 314.877521][ T9169] kvm: pic: non byte read [ 314.889155][ T9169] kvm: pic: non byte read [ 314.898114][ T9169] kvm: pic: non byte read [ 314.908117][ T9169] kvm: pic: non byte read [ 314.921539][ T9169] kvm: pic: non byte read [ 314.931296][ T9175] netlink: 'syz.4.749': attribute type 10 has an invalid length. [ 314.938519][ T919] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 314.947116][ T9169] kvm: pic: non byte read [ 314.958277][ T9169] kvm: pic: non byte read [ 314.966367][ T9175] bridge0: port 1(bridge_slave_0) entered disabled state [ 314.989571][ T9169] kvm: pic: non byte read [ 315.061663][ T9175] bridge0: port 1(bridge_slave_0) entered blocking state [ 315.068765][ T9175] bridge0: port 1(bridge_slave_0) entered forwarding state [ 315.100971][ T919] usb 3-1: device descriptor read/64, error -71 [ 315.122169][ T9169] kvm: pic: non byte read [ 315.123088][ T9179] netlink: 4 bytes leftover after parsing attributes in process `syz.3.747'. [ 315.431043][ T919] usb usb3-port1: attempt power cycle [ 315.545045][ T9175] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 315.637957][ T9169] kvm: pic: non byte read [ 315.792836][ T9185] nvme_fabrics: unknown parameter or missing value 'syz0' in ctrl creation request [ 315.944570][ T919] usb 3-1: new high-speed USB device number 25 using dummy_hcd [ 316.181030][ T919] usb 3-1: device not accepting address 25, error -71 [ 323.924030][ T9211] fuse: Unknown parameter 'user_i00000000000000000000' [ 324.295457][ T9212] netlink: 4 bytes leftover after parsing attributes in process `syz.4.757'. [ 324.482946][ T5927] hid-generic 0005:10CF:5505.0016: item fetching failed at offset 0/1 [ 324.529217][ T5927] hid-generic 0005:10CF:5505.0016: probe with driver hid-generic failed with error -22 [ 331.810579][ T29] audit: type=1400 audit(2000000221.727:520): avc: denied { ioctl } for pid=9223 comm="syz.3.761" path="socket:[26819]" dev="sockfs" ino=26819 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 331.881037][ T9225] netlink: 'syz.2.760': attribute type 4 has an invalid length. [ 331.897565][ T9219] picdev_read: 77 callbacks suppressed [ 331.897582][ T9219] kvm: pic: non byte read [ 331.918206][ T9219] kvm: pic: non byte read [ 331.924673][ T29] audit: type=1400 audit(2000000221.837:521): avc: denied { write } for pid=9220 comm="syz.2.760" name="001" dev="devtmpfs" ino=745 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 332.029497][ T9219] kvm: pic: non byte read [ 332.122893][ T9219] kvm: pic: non byte read [ 332.123160][ T9227] netlink: 4 bytes leftover after parsing attributes in process `syz.4.762'. [ 332.127343][ T9219] kvm: pic: non byte read [ 332.231046][ T9219] kvm: pic: non byte read [ 332.249503][ T9219] kvm: pic: non byte read [ 332.305564][ T9219] kvm: pic: non byte read [ 332.325112][ T9240] Bluetooth: MGMT ver 1.23 [ 332.336340][ T29] audit: type=1400 audit(2000000222.257:522): avc: denied { audit_write } for pid=9239 comm="syz.0.763" capability=29 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 332.451101][ T29] audit: type=1400 audit(2000000222.257:523): avc: denied { watch watch_reads } for pid=9239 comm="syz.0.763" path="/170" dev="tmpfs" ino=893 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 332.841038][ T29] audit: type=1400 audit(2000000222.607:524): avc: denied { connect } for pid=9241 comm="syz.2.764" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 332.926091][ T29] audit: type=1400 audit(2000000222.647:525): avc: denied { bind } for pid=9241 comm="syz.2.764" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 333.980425][ T9] usb 3-1: new high-speed USB device number 27 using dummy_hcd [ 335.981112][ T5859] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 336.101404][ T9] usb 3-1: Using ep0 maxpacket: 32 [ 336.823933][ T5859] usb 1-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 336.835216][ T5859] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 336.944016][ T5859] usb 1-1: Product: syz [ 336.958411][ T5859] usb 1-1: Manufacturer: syz [ 337.070917][ T5859] usb 1-1: SerialNumber: syz [ 337.303658][ T9278] fuse: Unknown parameter '0x0000000000000008' [ 338.272709][ T5859] usb 1-1: can't set config #1, error -71 [ 338.295305][ T9] usb 3-1: device descriptor read/all, error -71 [ 338.296318][ T5859] usb 1-1: USB disconnect, device number 15 [ 339.495413][ T9280] Set syz1 is full, maxelem 65536 reached [ 339.701321][ T5859] usb 1-1: new full-speed USB device number 16 using dummy_hcd [ 339.881267][ T5859] usb 1-1: device descriptor read/64, error -71 [ 339.993568][ T29] audit: type=1400 audit(2000000229.917:526): avc: denied { watch watch_reads } for pid=9303 comm="syz.2.779" path=2F6D656D66643A2D42D54E49C56A9A707070F00884A26D202864656C6574656429 dev="hugetlbfs" ino=26974 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:hugetlbfs_t tclass=file permissive=1 [ 340.211125][ T5859] usb 1-1: new full-speed USB device number 17 using dummy_hcd [ 340.421099][ T5859] usb 1-1: device descriptor read/64, error -71 [ 340.591190][ T5859] usb usb1-port1: attempt power cycle [ 340.644662][ T9314] sp0: Synchronizing with TNC [ 340.661040][ T29] audit: type=1400 audit(2000000230.317:527): avc: denied { bind } for pid=9311 comm="syz.4.782" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 341.081035][ T5859] usb 1-1: new full-speed USB device number 18 using dummy_hcd [ 341.095772][ T9317] overlayfs: missing 'lowerdir' [ 341.210951][ T5859] usb 1-1: device descriptor read/8, error -71 [ 341.347532][ T29] audit: type=1400 audit(2000000231.267:528): avc: denied { watch watch_reads } for pid=9320 comm="syz.1.784" path="/145/file1" dev="tmpfs" ino=779 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 342.867917][ T9336] Set syz1 is full, maxelem 65536 reached [ 344.232136][ T9321] netlink: 128 bytes leftover after parsing attributes in process `syz.1.784'. [ 344.841542][ T9356] Set syz1 is full, maxelem 65536 reached [ 345.627514][ T9373] Freezing with imperfect legacy cgroup freezer. See cgroup.freeze of cgroup v2 [ 345.639660][ T5880] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 345.775864][ T9377] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 345.910980][ T5880] usb 4-1: device descriptor read/64, error -71 [ 346.160950][ T5880] usb 4-1: new high-speed USB device number 25 using dummy_hcd [ 346.352586][ T5880] usb 4-1: device descriptor read/64, error -71 [ 346.471110][ T5880] usb usb4-port1: attempt power cycle [ 346.821228][ T5880] usb 4-1: new high-speed USB device number 26 using dummy_hcd [ 346.961397][ T5880] usb 4-1: device descriptor read/8, error -71 [ 347.480879][ T5880] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 348.005378][ T5880] usb 4-1: device not accepting address 27, error -71 [ 348.095586][ T5880] usb usb4-port1: unable to enumerate USB device [ 348.577305][ T9396] Set syz1 is full, maxelem 65536 reached [ 348.747799][ T29] audit: type=1400 audit(2000000238.137:529): avc: denied { append } for pid=9401 comm="syz.0.803" name="urandom" dev="devtmpfs" ino=9 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:urandom_device_t tclass=chr_file permissive=1 [ 349.454134][ T9416] IPVS: set_ctl: invalid protocol: 43 127.0.0.1:20004 [ 350.545848][ T919] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 350.780974][ T919] usb 5-1: Using ep0 maxpacket: 8 [ 350.915578][ T919] usb 5-1: unable to get BOS descriptor or descriptor too short [ 351.021841][ T919] usb 5-1: config 7 has an invalid interface number: 58 but max is 0 [ 351.169494][ T919] usb 5-1: config 7 has no interface number 0 [ 351.188161][ T919] usb 5-1: config 7 interface 58 altsetting 3 endpoint 0xE has invalid maxpacket 1893, setting to 64 [ 351.202084][ T919] usb 5-1: config 7 interface 58 altsetting 3 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 351.215228][ T919] usb 5-1: config 7 interface 58 has no altsetting 0 [ 351.308946][ T9437] fuse: Unknown parameter 'fd0x0000000000000008' [ 352.640748][ T9446] dvmrp1: entered allmulticast mode [ 352.805051][ T919] usb 5-1: string descriptor 0 read error: -71 [ 352.812173][ T919] usb 5-1: New USB device found, idVendor=1498, idProduct=a090, bcdDevice=48.0f [ 352.821362][ T919] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 352.859395][ T919] usb 5-1: can't set config #7, error -71 [ 352.870928][ T919] usb 5-1: USB disconnect, device number 12 [ 353.496177][ T9451] sp0: Synchronizing with TNC [ 353.611803][ T9445] dvmrp1: left allmulticast mode [ 354.872764][ T9462] Set syz1 is full, maxelem 65536 reached [ 355.961935][ T9473] support for cryptoloop has been removed. Use dm-crypt instead. [ 356.380525][ T9494] fuse: Unknown parameter 'fd0x0000000000000008' [ 356.878496][ T9493] nvme_fabrics: unknown parameter or missing value 'syz0' in ctrl creation request [ 356.920430][ T9485] nvme_fabrics: unknown parameter or missing value 'syz0' in ctrl creation request [ 358.177389][ T29] audit: type=1400 audit(2000000248.077:530): avc: denied { read } for pid=9505 comm="syz.3.826" name="fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 358.426389][ T29] audit: type=1400 audit(2000000248.077:531): avc: denied { open } for pid=9505 comm="syz.3.826" path="/dev/fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 358.516137][ T29] audit: type=1400 audit(2000000248.077:532): avc: denied { ioctl } for pid=9505 comm="syz.3.826" path="/dev/fb0" dev="devtmpfs" ino=629 ioctlcmd=0x4605 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 358.610925][ T29] audit: type=1400 audit(2000000248.427:533): avc: denied { create } for pid=9507 comm="syz.3.828" name="file1" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 358.720955][ T29] audit: type=1400 audit(2000000248.437:534): avc: denied { link } for pid=9507 comm="syz.3.828" name="file1" dev="overlay" ino=881 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 358.839126][ T29] audit: type=1400 audit(2000000248.437:535): avc: denied { setattr } for pid=9507 comm="syz.3.828" name="#8" dev="tmpfs" ino=882 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 358.869669][ T9512] dvmrp1: entered allmulticast mode [ 358.908429][ T9511] dvmrp1: left allmulticast mode [ 358.972562][ T29] audit: type=1400 audit(2000000248.437:536): avc: denied { rename } for pid=9507 comm="syz.3.828" name="#8" dev="tmpfs" ino=882 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 362.060241][ T9527] Set syz1 is full, maxelem 65536 reached [ 363.601772][ T9554] sp0: Synchronizing with TNC [ 364.021453][ T9563] dvmrp1: entered allmulticast mode [ 364.138262][ T9562] dvmrp1: left allmulticast mode [ 366.317263][ T9597] netlink: 4 bytes leftover after parsing attributes in process `syz.1.851'. [ 366.473724][ T5809] hid-generic 0005:10CF:5505.0017: item fetching failed at offset 0/1 [ 366.541598][ T5809] hid-generic 0005:10CF:5505.0017: probe with driver hid-generic failed with error -22 [ 366.736368][ T9602] xt_hashlimit: size too large, truncated to 1048576 [ 366.840895][ T5880] usb 2-1: new high-speed USB device number 28 using dummy_hcd [ 366.911831][ T29] audit: type=1400 audit(2000000256.837:537): avc: denied { append } for pid=9607 comm="syz.3.852" name="uinput" dev="devtmpfs" ino=920 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 366.923208][ T9608] input: syz1 as /devices/virtual/input/input10 [ 367.000909][ T5880] usb 2-1: device descriptor read/64, error -71 [ 367.031367][ T9608] input: syz1 as /devices/virtual/input/input11 [ 367.051926][ T9611] sp0: Synchronizing with TNC [ 367.357226][ T9619] fuse: Unknown parameter '0x0000000000000007' [ 367.691471][ T5880] usb 2-1: new high-speed USB device number 29 using dummy_hcd [ 367.833078][ T5880] usb 2-1: device descriptor read/64, error -71 [ 367.981095][ T5880] usb usb2-port1: attempt power cycle [ 368.035656][ T9] usb 4-1: new high-speed USB device number 28 using dummy_hcd [ 368.258150][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 368.340895][ T5880] usb 2-1: new high-speed USB device number 30 using dummy_hcd [ 368.429914][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 368.460486][ T9] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 368.476307][ T5880] usb 2-1: device descriptor read/8, error -71 [ 368.491137][ T9] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 368.500307][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 368.512414][ T9] usb 4-1: config 0 descriptor?? [ 368.742918][ T5880] usb 2-1: new high-speed USB device number 31 using dummy_hcd [ 368.860914][ T5880] usb 2-1: device descriptor read/8, error -71 [ 368.972303][ T5880] usb usb2-port1: unable to enumerate USB device [ 369.020034][ T9] plantronics 0003:047F:FFFF.0018: unknown main item tag 0x4 [ 369.166467][ T9647] Set syz1 is full, maxelem 65536 reached [ 369.571503][ T9] plantronics 0003:047F:FFFF.0018: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 369.694956][ T9] usb 4-1: USB disconnect, device number 28 [ 369.742398][ T9648] fido_id[9648]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.3/usb4/report_descriptor': No such file or directory [ 369.758665][ T9652] netlink: 92 bytes leftover after parsing attributes in process `syz.4.863'. [ 369.978858][ T9657] xt_hashlimit: size too large, truncated to 1048576 [ 370.303459][ T9668] Bluetooth: MGMT ver 1.23 [ 370.459283][ T9657] veth3: entered promiscuous mode [ 370.485906][ T9657] veth3: entered allmulticast mode [ 370.736708][ T9679] fuse: Unknown parameter '0x0000000000000007' [ 372.702502][ T9687] netlink: 4 bytes leftover after parsing attributes in process `syz.0.871'. [ 372.954426][ T1295] ieee802154 phy0 wpan0: encryption failed: -22 [ 372.962075][ T5880] usb 4-1: new high-speed USB device number 29 using dummy_hcd [ 372.962244][ T1295] ieee802154 phy1 wpan1: encryption failed: -22 [ 372.989117][ T29] audit: type=1400 audit(2000000262.907:538): avc: denied { getopt } for pid=9694 comm="syz.2.873" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 373.100942][ T5880] usb 4-1: device descriptor read/64, error -71 [ 373.462183][ T5880] usb 4-1: new high-speed USB device number 30 using dummy_hcd [ 373.621413][ T5880] usb 4-1: device descriptor read/64, error -71 [ 373.647259][ T10] usb 3-1: new high-speed USB device number 29 using dummy_hcd [ 373.800423][ T5880] usb usb4-port1: attempt power cycle [ 373.903849][ T9708] sg_write: data in/out 124/1 bytes for SCSI command 0x1c-- guessing data in; [ 373.903849][ T9708] program syz.1.876 not setting count and/or reply_len properly [ 374.225945][ T10] usb 3-1: device descriptor read/64, error -71 [ 374.990039][ T5880] usb 4-1: new high-speed USB device number 31 using dummy_hcd [ 375.095334][ T9712] Set syz1 is full, maxelem 65536 reached [ 375.137668][ T10] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 375.161755][ T5880] usb 4-1: device descriptor read/8, error -71 [ 375.271046][ T10] usb 3-1: device descriptor read/64, error -71 [ 375.382812][ T10] usb usb3-port1: attempt power cycle [ 375.400915][ T5880] usb 4-1: new high-speed USB device number 32 using dummy_hcd [ 375.445828][ T5880] usb 4-1: device descriptor read/8, error -71 [ 375.922967][ T5880] usb usb4-port1: unable to enumerate USB device [ 375.980873][ T10] usb 3-1: new high-speed USB device number 31 using dummy_hcd [ 376.002620][ T10] usb 3-1: device descriptor read/8, error -71 [ 376.355425][ T10] usb 3-1: new high-speed USB device number 32 using dummy_hcd [ 376.591214][ T10] usb 3-1: device not accepting address 32, error -71 [ 376.611267][ T10] usb usb3-port1: unable to enumerate USB device [ 376.705464][ T919] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 376.881032][ T919] usb 5-1: Using ep0 maxpacket: 16 [ 376.900045][ T919] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 376.983636][ T919] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 377.078416][ T919] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 377.125752][ T919] usb 5-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 377.189373][ T29] audit: type=1400 audit(2000000267.107:539): avc: denied { write } for pid=9745 comm="syz.3.887" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 377.316036][ T919] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 377.332808][ T919] usb 5-1: config 0 descriptor?? [ 377.380952][ T29] audit: type=1400 audit(2000000267.267:540): avc: denied { remount } for pid=9745 comm="syz.3.887" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 377.527110][ T9751] sctp: [Deprecated]: syz.0.888 (pid 9751) Use of int in maxseg socket option. [ 377.527110][ T9751] Use struct sctp_assoc_value instead [ 377.820751][ T919] microsoft 0003:045E:07DA.0019: unknown main item tag 0x0 [ 378.032522][ T29] audit: type=1400 audit(2000000267.587:541): avc: denied { write } for pid=9749 comm="syz.0.888" name="fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 378.061009][ T919] microsoft 0003:045E:07DA.0019: ignoring exceeding usage max [ 378.104133][ T919] input: HID 045e:07da as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/0003:045E:07DA.0019/input/input12 [ 378.327808][ T919] microsoft 0003:045E:07DA.0019: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.4-1/input0 [ 378.810490][ T5887] usb 5-1: USB disconnect, device number 13 [ 379.229422][ T9777] sp0: Synchronizing with TNC [ 379.275929][ T9766] nvme_fabrics: unknown parameter or missing value 'syz0' in ctrl creation request [ 379.392110][ T9780] Set syz1 is full, maxelem 65536 reached [ 379.418051][ T9777] netlink: 44 bytes leftover after parsing attributes in process `syz.4.894'. [ 379.492193][ T9782] [U] è` [ 379.816897][ T29] audit: type=1326 audit(2000000269.677:542): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9789 comm="syz.1.898" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3cc139c799 code=0x7ffc0000 [ 379.874118][ T29] audit: type=1326 audit(2000000269.677:543): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9789 comm="syz.1.898" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3cc139c799 code=0x7ffc0000 [ 379.960258][ T29] audit: type=1326 audit(2000000269.677:544): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9789 comm="syz.1.898" exe="/root/syz-executor" sig=0 arch=c000003e syscall=135 compat=0 ip=0x7f3cc139c799 code=0x7ffc0000 [ 379.988205][ C1] sd 0:0:1:0: [sda] tag#9139 FAILED Result: hostbyte=DID_ERROR driverbyte=DRIVER_OK cmd_age=0s [ 379.998592][ C1] sd 0:0:1:0: [sda] tag#9139 CDB: Write(6) 0a 00 4e 23 00 00 0b 00 ff 01 00 00 [ 380.010482][ T9794] netdevsim netdevsim1: loading /lib/firmware/. failed with error -22 [ 380.031039][ T9794] netdevsim netdevsim1: Direct firmware load for . failed with error -22 [ 380.141723][ T9798] overlayfs: missing 'lowerdir' [ 380.310913][ T5887] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 380.342937][ T9794] netdevsim netdevsim1: Falling back to sysfs fallback for: . [ 380.456564][ T29] audit: type=1326 audit(2000000269.677:545): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9789 comm="syz.1.898" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3cc139c799 code=0x7ffc0000 [ 380.570993][ T29] audit: type=1326 audit(2000000269.677:546): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9789 comm="syz.1.898" exe="/root/syz-executor" sig=0 arch=c000003e syscall=190 compat=0 ip=0x7f3cc139c799 code=0x7ffc0000 [ 380.614016][ T29] audit: type=1326 audit(2000000269.677:547): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9789 comm="syz.1.898" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3cc139c799 code=0x7ffc0000 [ 380.753762][ T29] audit: type=1326 audit(2000000269.677:548): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9789 comm="syz.1.898" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3cc139c799 code=0x7ffc0000 [ 380.779471][ T5887] usb 5-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 380.779777][ T29] audit: type=1326 audit(2000000269.677:549): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9789 comm="syz.1.898" exe="/root/syz-executor" sig=0 arch=c000003e syscall=25 compat=0 ip=0x7f3cc139c799 code=0x7ffc0000 [ 380.811388][ T5887] usb 5-1: config 1 has an invalid descriptor of length 137, skipping remainder of the config [ 381.026402][ T5887] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 381.051130][ T29] audit: type=1326 audit(2000000269.677:550): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9789 comm="syz.1.898" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3cc139c799 code=0x7ffc0000 [ 381.084715][ T5887] usb 5-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 381.130053][ T5887] usb 5-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 381.169628][ T5887] usb 5-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 381.187763][ T5887] usb 5-1: Product: syz [ 381.204821][ T5887] usb 5-1: Manufacturer: syz [ 381.232513][ T5887] cdc_wdm 5-1:1.0: skipping garbage [ 381.258082][ T5887] cdc_wdm 5-1:1.0: skipping garbage [ 381.278837][ T5887] cdc_wdm 5-1:1.0: probe with driver cdc_wdm failed with error -22 [ 381.433582][ T5873] usb 5-1: USB disconnect, device number 14 [ 383.105378][ T9819] Set syz1 is full, maxelem 65536 reached [ 384.733857][ T9829] Set syz1 is full, maxelem 65536 reached [ 385.476318][ T9832] loop2: detected capacity change from 0 to 7 [ 385.650984][ T9832] Dev loop2: unable to read RDB block 7 [ 385.656536][ T9832] loop2: unable to read partition table [ 385.662231][ T9832] loop2: partition table beyond EOD, truncated [ 385.668371][ T9832] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 385.824435][ T5179] Dev loop2: unable to read RDB block 7 [ 385.830000][ T5179] loop2: unable to read partition table [ 385.851363][ T5179] loop2: partition table beyond EOD, truncated [ 385.964288][ T5179] Dev loop2: unable to read RDB block 7 [ 385.984842][ T5179] loop2: unable to read partition table [ 385.996231][ T5179] loop2: partition table beyond EOD, truncated [ 386.124489][ T5887] usb 2-1: new high-speed USB device number 32 using dummy_hcd [ 386.975065][ T9845] Set syz1 is full, maxelem 65536 reached [ 387.003961][ T5887] usb 2-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 387.013098][ T5887] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 387.103769][ T9849] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=65 sclass=netlink_route_socket pid=9849 comm=syz.4.913 [ 387.105972][ T9] usb 1-1: new high-speed USB device number 20 using dummy_hcd [ 387.129882][ T5887] usb 2-1: Product: syz [ 387.135185][ T5887] usb 2-1: Manufacturer: syz [ 387.139887][ T5887] usb 2-1: SerialNumber: syz [ 387.172543][ T9849] netlink: 'syz.4.913': attribute type 21 has an invalid length. [ 387.202175][ T9849] netlink: 203340 bytes leftover after parsing attributes in process `syz.4.913'. [ 387.223805][ T9849] tipc: Started in network mode [ 387.228703][ T9849] tipc: Node identity b253c2636009, cluster identity 4711 [ 387.236274][ T9849] tipc: Enabled bearer , priority 0 [ 387.250144][ T9848] tipc: Disabling bearer [ 387.301257][ T9] usb 1-1: Using ep0 maxpacket: 16 [ 387.338898][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 387.381268][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 387.556754][ T9] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 387.569998][ T9] usb 1-1: New USB device found, idVendor=0457, idProduct=07da, bcdDevice= 0.00 [ 387.584503][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 387.633686][ T9] usb 1-1: config 0 descriptor?? [ 387.893116][ T29] kauditd_printk_skb: 38 callbacks suppressed [ 387.893133][ T29] audit: type=1400 audit(2000000277.737:589): avc: denied { setattr } for pid=9862 comm="syz.2.916" name="NETLINK" dev="sockfs" ino=30135 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 387.944053][ T9867] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3642988519 (466302530432 ns) > initial count (459226025088 ns). Using initial count to start timer. [ 388.126516][ T9837] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 388.136000][ T9837] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 388.183714][ T5887] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPROTO [ 388.198145][ T5887] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 388.213010][ T5887] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 388.285432][ T5887] lan78xx 2-1:1.0: probe with driver lan78xx failed with error -71 [ 388.360481][ T29] audit: type=1400 audit(2000000278.247:590): avc: denied { map } for pid=9869 comm="syz.3.917" path="/dev/nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 388.568201][ T5887] usb 2-1: USB disconnect, device number 32 [ 388.574967][ T10] usb 4-1: new high-speed USB device number 33 using dummy_hcd [ 388.662311][ T9] usbhid 1-1:0.0: can't add hid device: -71 [ 388.773895][ T9] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 388.783487][ T10] usb 4-1: Using ep0 maxpacket: 32 [ 388.818974][ T10] usb 4-1: unable to get BOS descriptor or descriptor too short [ 388.874355][ T10] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 388.948169][ T10] usb 4-1: can't read configurations, error -61 [ 389.016635][ T9] usb 1-1: USB disconnect, device number 20 [ 389.167174][ T10] usb 4-1: new high-speed USB device number 34 using dummy_hcd [ 389.823179][ T10] usb 4-1: Using ep0 maxpacket: 32 [ 389.940854][ T10] usb 4-1: unable to get BOS descriptor or descriptor too short [ 389.960232][ T10] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 389.968116][ T10] usb 4-1: can't read configurations, error -61 [ 390.061002][ T10] usb usb4-port1: attempt power cycle [ 391.822367][ T10] usb 4-1: new high-speed USB device number 35 using dummy_hcd [ 391.834519][ T9893] loop2: detected capacity change from 0 to 7 [ 391.842803][ T9893] Dev loop2: unable to read RDB block 7 [ 391.848344][ T9893] loop2: unable to read partition table [ 391.854078][ T9893] loop2: partition table beyond EOD, truncated [ 391.860236][ T9893] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 391.981961][ T10] usb 4-1: device descriptor read/8, error -71 [ 392.524610][ T9910] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 393.746410][ T9915] Set syz1 is full, maxelem 65536 reached [ 395.291058][ T9933] fuse: Unknown parameter '0x0000000000000007' [ 395.520880][ T9925] support for cryptoloop has been removed. Use dm-crypt instead. [ 396.167438][ T5873] hid-generic 0005:10CF:5505.001A: item fetching failed at offset 0/1 [ 396.279353][ T5873] hid-generic 0005:10CF:5505.001A: probe with driver hid-generic failed with error -22 [ 397.745610][ T9960] loop2: detected capacity change from 0 to 7 [ 397.769535][ T9960] Dev loop2: unable to read RDB block 7 [ 397.775650][ T9960] loop2: unable to read partition table [ 397.781587][ T9960] loop2: partition table beyond EOD, truncated [ 397.787739][ T9960] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 399.210879][ T9875] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 399.366968][ T9875] usb 5-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 399.382081][ T9875] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 399.413618][ T9875] usb 5-1: Product: syz [ 399.430584][ T9875] usb 5-1: Manufacturer: syz [ 399.446743][ T9875] usb 5-1: SerialNumber: syz [ 399.758047][ T9995] sp0: Synchronizing with TNC [ 400.347159][ T9999] netlink: 'syz.2.942': attribute type 21 has an invalid length. [ 400.366672][ T9999] netlink: 128 bytes leftover after parsing attributes in process `syz.2.942'. [ 400.400022][ T9999] netlink: 'syz.2.942': attribute type 4 has an invalid length. [ 400.440271][T10001] netlink: 92 bytes leftover after parsing attributes in process `syz.1.943'. [ 400.450759][ T9999] netlink: 'syz.2.942': attribute type 5 has an invalid length. [ 400.458499][ T9999] netlink: 3 bytes leftover after parsing attributes in process `syz.2.942'. [ 400.574628][ T9981] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 400.599546][ T9981] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 400.610670][ T9875] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPROTO [ 400.705683][ T9875] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 400.726118][ T9875] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 401.173436][ T9875] lan78xx 5-1:1.0: probe with driver lan78xx failed with error -71 [ 401.190928][T10008] support for cryptoloop has been removed. Use dm-crypt instead. [ 401.201045][ T9875] usb 5-1: USB disconnect, device number 15 [ 401.849553][T10015] loop2: detected capacity change from 0 to 7 [ 401.883335][T10015] Dev loop2: unable to read RDB block 7 [ 401.888984][T10015] loop2: unable to read partition table [ 401.979653][T10015] loop2: partition table beyond EOD, truncated [ 402.006537][T10015] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 402.232591][T10028] random: crng reseeded on system resumption [ 402.590247][ T29] audit: type=1400 audit(2000000292.007:591): avc: denied { read write } for pid=10022 comm="syz.0.946" name="vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 402.651743][ T29] audit: type=1400 audit(2000000292.007:592): avc: denied { open } for pid=10022 comm="syz.0.946" path="/dev/vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 402.683538][ T29] audit: type=1400 audit(2000000292.157:593): avc: denied { write } for pid=10022 comm="syz.0.946" name="snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 402.786665][ T29] audit: type=1400 audit(2000000292.157:594): avc: denied { open } for pid=10022 comm="syz.0.946" path="/dev/snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 402.870951][ T29] audit: type=1400 audit(2000000292.197:595): avc: denied { read } for pid=10022 comm="syz.0.946" name="ptp0" dev="devtmpfs" ino=1265 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 402.930164][ T29] audit: type=1400 audit(2000000292.207:596): avc: denied { open } for pid=10022 comm="syz.0.946" path="/dev/ptp0" dev="devtmpfs" ino=1265 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 403.175729][ T29] audit: type=1400 audit(2000000292.217:597): avc: denied { ioctl } for pid=10022 comm="syz.0.946" path="/dev/ptp0" dev="devtmpfs" ino=1265 ioctlcmd=0x3d05 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 404.803247][ T29] audit: type=1400 audit(2000000294.717:598): avc: denied { getopt } for pid=10056 comm="syz.4.953" lport=40684 faddr=::ffff:172.20.255.187 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=sctp_socket permissive=1 [ 405.570893][ T919] usb 2-1: new high-speed USB device number 33 using dummy_hcd [ 406.032652][ T919] usb 2-1: device descriptor read/64, error -71 [ 406.772879][T10082] support for cryptoloop has been removed. Use dm-crypt instead. [ 407.133197][ T919] usb 2-1: new high-speed USB device number 34 using dummy_hcd [ 407.366514][ T919] usb 2-1: device descriptor read/64, error -71 [ 407.522205][ T919] usb usb2-port1: attempt power cycle [ 407.872746][ T919] usb 2-1: new high-speed USB device number 35 using dummy_hcd [ 407.950991][ T5809] usb 5-1: new high-speed USB device number 16 using dummy_hcd [ 407.974041][ T5179] Dev loop2: unable to read RDB block 7 [ 407.979620][ T5179] loop2: unable to read partition table [ 407.986088][ T919] usb 2-1: device descriptor read/8, error -71 [ 408.022559][ T5179] loop2: partition table beyond EOD, truncated [ 408.120880][ T5809] usb 5-1: Using ep0 maxpacket: 32 [ 408.138716][ T5809] usb 5-1: New USB device found, idVendor=1964, idProduct=0001, bcdDevice=d4.15 [ 408.151576][ T5809] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 408.186166][ T5809] usb 5-1: Product: syz [ 408.209694][ T5809] usb 5-1: Manufacturer: syz [ 408.251711][ T5809] usb 5-1: SerialNumber: syz [ 408.309763][ T5809] usb 5-1: config 0 descriptor?? [ 408.536004][T10091] i2c i2c-0: dtv_property_process_set: SET cmd 0x00000000 undefined [ 408.751065][T10106] nvme_fabrics: unknown parameter or missing value 'syz0' in ctrl creation request [ 410.280949][ T5809] RobotFuzz Open Source InterFace, OSIF 5-1:0.0: failure sending bit rate [ 410.300891][ T5809] RobotFuzz Open Source InterFace, OSIF 5-1:0.0: probe with driver RobotFuzz Open Source InterFace, OSIF failed with error -71 [ 410.335337][ T5809] usb 5-1: USB disconnect, device number 16 [ 411.464413][T10130] syzkaller0: entered promiscuous mode [ 411.495077][T10130] syzkaller0: entered allmulticast mode [ 412.300834][T10141] support for cryptoloop has been removed. Use dm-crypt instead. [ 413.090899][ T9] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 413.300888][ T9] usb 5-1: device descriptor read/64, error -71 [ 413.580912][ T9] usb 5-1: new high-speed USB device number 18 using dummy_hcd [ 413.730905][ T9] usb 5-1: device descriptor read/64, error -71 [ 413.865842][ T9] usb usb5-port1: attempt power cycle [ 414.254288][T10172] netlink: 4 bytes leftover after parsing attributes in process `syz.0.975'. [ 414.572999][ T9] usb 5-1: new high-speed USB device number 19 using dummy_hcd [ 414.601614][ T9] usb 5-1: device descriptor read/8, error -71 [ 414.911096][ T9] usb 5-1: new high-speed USB device number 20 using dummy_hcd [ 415.118660][ T9] usb 5-1: device descriptor read/8, error -71 [ 415.231154][ T9] usb usb5-port1: unable to enumerate USB device [ 415.906243][T10200] loop2: detected capacity change from 0 to 7 [ 416.169264][T10200] Dev loop2: unable to read RDB block 7 [ 416.174833][T10200] loop2: unable to read partition table [ 416.180518][T10200] loop2: partition table beyond EOD, truncated [ 416.186683][T10200] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 416.316731][ T29] audit: type=1400 audit(2000000306.217:599): avc: denied { read } for pid=10197 comm="syz.3.981" name="btrfs-control" dev="devtmpfs" ino=1316 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 416.346485][ T29] audit: type=1400 audit(2000000306.227:600): avc: denied { open } for pid=10197 comm="syz.3.981" path="/dev/btrfs-control" dev="devtmpfs" ino=1316 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 416.450853][ T29] audit: type=1400 audit(2000000306.227:601): avc: denied { ioctl } for pid=10197 comm="syz.3.981" path="/dev/btrfs-control" dev="devtmpfs" ino=1316 ioctlcmd=0x5619 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 416.624619][T10212] netlink: 'syz.0.986': attribute type 10 has an invalid length. [ 417.020833][ T5809] usb 3-1: new high-speed USB device number 33 using dummy_hcd [ 417.190881][ T5809] usb 3-1: Using ep0 maxpacket: 32 [ 417.201423][ T5809] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 417.226969][ T5809] usb 3-1: config 0 interface 0 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 0 [ 417.259409][ T5809] usb 3-1: config 0 interface 0 has no altsetting 0 [ 417.283809][ T5809] usb 3-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 417.299935][ T5809] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 417.308441][ T5809] usb 3-1: Product: syz [ 417.312879][ T5809] usb 3-1: Manufacturer: syz [ 417.317525][ T5809] usb 3-1: SerialNumber: syz [ 417.338335][ T5809] usb 3-1: config 0 descriptor?? [ 417.773681][ T9875] hid-generic 0005:10CF:5505.001B: item fetching failed at offset 0/1 [ 417.790541][ T5809] gs_usb 3-1:0.0: Configuring for 58 interfaces [ 417.799279][ T9875] hid-generic 0005:10CF:5505.001B: probe with driver hid-generic failed with error -22 [ 418.075872][T10235] netlink: 20 bytes leftover after parsing attributes in process `syz.0.989'. [ 418.365153][T10235] nbd: socks must be embedded in a SOCK_ITEM attr [ 418.583210][ T5809] gs_usb 3-1:0.0: Disabling termination support for channel 0 (-EPROTO) [ 418.735839][ T5809] gs_usb 3-1:0.0: Couldn't get bit timing const for channel 1 (-EPROTO) [ 418.736040][ T9251] udevd[9251]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 418.843380][ T5809] gs_usb 3-1:0.0: probe with driver gs_usb failed with error -71 [ 418.907847][ T5809] usb 3-1: USB disconnect, device number 33 [ 419.888210][T10254] loop2: detected capacity change from 0 to 7 [ 420.181693][T10254] Dev loop2: unable to read RDB block 7 [ 420.187257][T10254] loop2: unable to read partition table [ 420.192965][T10254] loop2: partition table beyond EOD, truncated [ 420.199089][T10254] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 421.471550][T10274] support for cryptoloop has been removed. Use dm-crypt instead. [ 421.538560][T10277] sp0: Synchronizing with TNC [ 422.002770][T10284] sp1: Synchronizing with TNC [ 423.473310][T10291] Set syz1 is full, maxelem 65536 reached [ 423.576354][T10294] kvm: pic: non byte read [ 423.582307][T10294] kvm: pic: non byte read [ 423.586690][T10294] kvm: pic: non byte read [ 423.591507][T10294] kvm: pic: non byte read [ 423.641095][T10294] kvm: pic: non byte read [ 423.645508][T10294] kvm: pic: non byte read [ 423.823544][ T29] audit: type=1400 audit(2000000313.657:602): avc: denied { create } for pid=10295 comm="syz.0.1002" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 424.251092][T10294] kvm: pic: non byte read [ 424.266048][T10294] kvm: pic: non byte read [ 424.270483][T10294] kvm: pic: non byte read [ 424.279821][ T29] audit: type=1400 audit(2000000313.657:603): avc: denied { getopt } for pid=10295 comm="syz.0.1002" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 424.334777][T10294] kvm: pic: non byte read [ 424.343184][ T29] audit: type=1400 audit(2000000313.717:604): avc: denied { setopt } for pid=10297 comm="syz.2.1003" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 425.289533][ T29] audit: type=1400 audit(2000000313.717:605): avc: denied { getopt } for pid=10297 comm="syz.2.1003" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 425.321648][T10308] loop2: detected capacity change from 0 to 7 [ 425.328321][T10308] Dev loop2: unable to read RDB block 7 [ 425.333904][T10308] loop2: unable to read partition table [ 425.339606][T10308] loop2: partition table beyond EOD, truncated [ 425.345748][T10308] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 425.426486][T10294] netlink: 4 bytes leftover after parsing attributes in process `syz.1.994'. [ 425.783441][ T29] audit: type=1400 audit(2000000315.707:606): avc: denied { listen } for pid=10316 comm="syz.0.1007" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 425.910888][ T5887] usb 2-1: new high-speed USB device number 37 using dummy_hcd [ 426.015858][T10317] kvm: Disabled LAPIC found during irq injection [ 426.092875][ T5887] usb 2-1: Using ep0 maxpacket: 8 [ 426.182868][ T5887] usb 2-1: unable to get BOS descriptor or descriptor too short [ 426.222419][ T9875] usb 5-1: new high-speed USB device number 21 using dummy_hcd [ 426.240427][ T5887] usb 2-1: config index 0 descriptor too short (expected 65535, got 27) [ 426.272314][ T5887] usb 2-1: config 255 has too many interfaces: 255, using maximum allowed: 32 [ 426.307643][T10329] FAULT_INJECTION: forcing a failure. [ 426.307643][T10329] name failslab, interval 1, probability 0, space 0, times 0 [ 426.311131][ T5887] usb 2-1: config 255 has an invalid descriptor of length 0, skipping remainder of the config [ 426.357238][T10329] CPU: 1 UID: 0 PID: 10329 Comm: syz.3.1009 Tainted: G L syzkaller #0 PREEMPT(full) [ 426.357268][T10329] Tainted: [L]=SOFTLOCKUP [ 426.357274][T10329] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 426.357284][T10329] Call Trace: [ 426.357289][T10329] [ 426.357296][T10329] dump_stack_lvl+0x100/0x190 [ 426.357330][T10329] should_fail_ex.cold+0x5/0xa [ 426.357354][T10329] should_failslab+0xc2/0x120 [ 426.357374][T10329] kmem_cache_alloc_node_noprof+0x81/0x6f0 [ 426.357400][T10329] ? __alloc_skb+0x140/0x710 [ 426.357427][T10329] __alloc_skb+0x140/0x710 [ 426.357447][T10329] ? __alloc_skb+0x5b7/0x710 [ 426.357469][T10329] ? __pfx___alloc_skb+0x10/0x10 [ 426.357494][T10329] ? find_held_lock+0x2b/0x80 [ 426.357520][T10329] netlink_dump+0x19b/0xd30 [ 426.357549][T10329] ? __pfx_netlink_dump+0x10/0x10 [ 426.357573][T10329] ? ip_set_dump_start+0x2e9/0x460 [ 426.357594][T10329] ? __pfx_ip_set_dump_start+0x10/0x10 [ 426.357633][T10329] __netlink_dump_start+0x6d6/0x990 [ 426.357664][T10329] ip_set_dump+0x1c2/0x200 [ 426.357684][T10329] ? __pfx_ip_set_dump+0x10/0x10 [ 426.357702][T10329] ? __pfx_ip_set_dump_start+0x10/0x10 [ 426.357722][T10329] ? __pfx_ip_set_dump_do+0x10/0x10 [ 426.357743][T10329] ? __pfx_ip_set_dump_done+0x10/0x10 [ 426.357773][T10329] nfnetlink_rcv_msg+0x9f4/0x1200 [ 426.357803][T10329] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 426.357827][T10329] ? __lock_acquire+0x4a5/0x2630 [ 426.357867][T10329] ? avc_has_perm_noaudit+0x145/0x3b0 [ 426.357895][T10329] netlink_rcv_skb+0x159/0x420 [ 426.357922][T10329] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 426.357945][T10329] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 426.357983][T10329] ? ns_capable+0xd2/0xf0 [ 426.358009][T10329] nfnetlink_rcv+0x1b3/0x440 [ 426.358030][T10329] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 426.358051][T10329] ? netlink_deliver_tap+0x1ae/0xcc0 [ 426.358081][T10329] netlink_unicast+0x5aa/0x870 [ 426.358112][T10329] ? __pfx_netlink_unicast+0x10/0x10 [ 426.358149][T10329] netlink_sendmsg+0x8b0/0xda0 [ 426.358186][T10329] ? __pfx_netlink_sendmsg+0x10/0x10 [ 426.358212][T10329] ? __might_fault+0xa0/0x140 [ 426.358246][T10329] ____sys_sendmsg+0x9e1/0xb70 [ 426.358262][T10329] ? __pfx_netlink_sendmsg+0x10/0x10 [ 426.358291][T10329] ? __pfx_____sys_sendmsg+0x10/0x10 [ 426.358320][T10329] ___sys_sendmsg+0x190/0x1e0 [ 426.358341][T10329] ? __pfx____sys_sendmsg+0x10/0x10 [ 426.358392][T10329] __sys_sendmsg+0x170/0x220 [ 426.358417][T10329] ? __pfx___sys_sendmsg+0x10/0x10 [ 426.358457][T10329] do_syscall_64+0x106/0xf80 [ 426.358484][T10329] ? clear_bhb_loop+0x40/0x90 [ 426.358507][T10329] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 426.358525][T10329] RIP: 0033:0x7fcb3539c799 [ 426.358540][T10329] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 426.358557][T10329] RSP: 002b:00007fcb335f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 426.358574][T10329] RAX: ffffffffffffffda RBX: 00007fcb35615fa0 RCX: 00007fcb3539c799 [ 426.358586][T10329] RDX: 0000000000048810 RSI: 0000200000000140 RDI: 0000000000000003 [ 426.358597][T10329] RBP: 00007fcb335f6090 R08: 0000000000000000 R09: 0000000000000000 [ 426.358606][T10329] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 426.358616][T10329] R13: 00007fcb35616038 R14: 00007fcb35615fa0 R15: 00007ffe9a939d88 [ 426.358641][T10329] [ 426.480844][ T5887] usb 2-1: config 255 has 0 interfaces, different from the descriptor's value: 255 [ 426.722301][T10333] support for cryptoloop has been removed. Use dm-crypt instead. [ 426.770144][ T9875] usb 5-1: too many configurations: 70, using maximum allowed: 8 [ 426.941853][ T5887] usb 2-1: New USB device found, idVendor=1498, idProduct=a090, bcdDevice=48.0f [ 426.951722][ T9875] usb 5-1: config index 0 descriptor too short (expected 65016, got 133) [ 426.960151][ T9875] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 426.991089][ T5887] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 427.001230][ T5887] usb 2-1: Product: syz [ 427.940578][ T9875] usb 5-1: config index 1 descriptor too short (expected 65016, got 133) [ 427.949339][ T9875] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 427.959837][ T5887] usb 2-1: Manufacturer: syz [ 427.965059][ T5887] usb 2-1: SerialNumber: syz [ 427.979325][ T9875] usb 5-1: config index 2 descriptor too short (expected 65016, got 133) [ 428.160819][ T9875] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 428.173886][ T9875] usb 5-1: config index 3 descriptor too short (expected 65016, got 133) [ 428.182614][ T9875] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 428.250174][ T5887] usb 2-1: USB disconnect, device number 37 [ 428.256585][T10352] FAULT_INJECTION: forcing a failure. [ 428.256585][T10352] name failslab, interval 1, probability 0, space 0, times 0 [ 428.272376][ T9875] usb 5-1: config index 4 descriptor too short (expected 65016, got 133) [ 428.282438][ T9875] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 428.293378][T10352] CPU: 0 UID: 0 PID: 10352 Comm: syz.2.1014 Tainted: G L syzkaller #0 PREEMPT(full) [ 428.293406][T10352] Tainted: [L]=SOFTLOCKUP [ 428.293417][T10352] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 428.293428][T10352] Call Trace: [ 428.293434][T10352] [ 428.293440][T10352] dump_stack_lvl+0x100/0x190 [ 428.293478][T10352] should_fail_ex.cold+0x5/0xa [ 428.293503][T10352] should_failslab+0xc2/0x120 [ 428.293522][T10352] __kmalloc_cache_noprof+0x7a/0x6f0 [ 428.293544][T10352] ? nfnl_acct_start+0x172/0x330 [ 428.293565][T10352] ? __nla_parse+0x40/0x60 [ 428.293592][T10352] nfnl_acct_start+0x172/0x330 [ 428.293613][T10352] ? __pfx_nfnl_acct_start+0x10/0x10 [ 428.293633][T10352] ? netlink_lookup+0x116/0x270 [ 428.293666][T10352] __netlink_dump_start+0x60e/0x990 [ 428.293696][T10352] nfnl_acct_get+0x453/0x550 [ 428.293718][T10352] ? __pfx_nfnl_acct_get+0x10/0x10 [ 428.293739][T10352] ? __pfx_nfnl_acct_start+0x10/0x10 [ 428.293758][T10352] ? __pfx_nfnl_acct_dump+0x10/0x10 [ 428.293778][T10352] ? __pfx_nfnl_acct_done+0x10/0x10 [ 428.293798][T10352] ? find_held_lock+0x2b/0x80 [ 428.293828][T10352] nfnetlink_rcv_msg+0x9f4/0x1200 [ 428.293858][T10352] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 428.293882][T10352] ? __lock_acquire+0x4a5/0x2630 [ 428.293921][T10352] ? avc_has_perm_noaudit+0x145/0x3b0 [ 428.293948][T10352] netlink_rcv_skb+0x159/0x420 [ 428.293975][T10352] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 428.293998][T10352] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 428.294037][T10352] ? ns_capable+0xd2/0xf0 [ 428.294061][T10352] nfnetlink_rcv+0x1b3/0x440 [ 428.294082][T10352] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 428.294101][T10352] ? netlink_deliver_tap+0x1ae/0xcc0 [ 428.294131][T10352] netlink_unicast+0x5aa/0x870 [ 428.294161][T10352] ? __pfx_netlink_unicast+0x10/0x10 [ 428.294196][T10352] netlink_sendmsg+0x8b0/0xda0 [ 428.294227][T10352] ? __pfx_netlink_sendmsg+0x10/0x10 [ 428.294251][T10352] ? __might_fault+0xa0/0x140 [ 428.294284][T10352] ____sys_sendmsg+0x9e1/0xb70 [ 428.294300][T10352] ? __pfx_netlink_sendmsg+0x10/0x10 [ 428.294327][T10352] ? __pfx_____sys_sendmsg+0x10/0x10 [ 428.294357][T10352] ___sys_sendmsg+0x190/0x1e0 [ 428.294378][T10352] ? __pfx____sys_sendmsg+0x10/0x10 [ 428.294433][T10352] __sys_sendmsg+0x170/0x220 [ 428.294459][T10352] ? __pfx___sys_sendmsg+0x10/0x10 [ 428.294500][T10352] do_syscall_64+0x106/0xf80 [ 428.294526][T10352] ? clear_bhb_loop+0x40/0x90 [ 428.294548][T10352] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 428.294566][T10352] RIP: 0033:0x7f46dcf9c799 [ 428.294580][T10352] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 428.294597][T10352] RSP: 002b:00007f46ddda7028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 428.294614][T10352] RAX: ffffffffffffffda RBX: 00007f46dd215fa0 RCX: 00007f46dcf9c799 [ 428.294625][T10352] RDX: 000000000000c080 RSI: 0000200000000580 RDI: 0000000000000003 [ 428.294635][T10352] RBP: 00007f46ddda7090 R08: 0000000000000000 R09: 0000000000000000 [ 428.294646][T10352] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 428.294655][T10352] R13: 00007f46dd216038 R14: 00007f46dd215fa0 R15: 00007ffebd172db8 [ 428.294680][T10352] [ 428.295462][ T9875] usb 5-1: config index 5 descriptor too short (expected 65016, got 133) [ 428.938200][ T9875] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 428.949603][ T9875] usb 5-1: config index 6 descriptor too short (expected 65016, got 133) [ 428.958659][ T9875] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 428.969953][ T9875] usb 5-1: config index 7 descriptor too short (expected 65016, got 133) [ 428.978999][ T9875] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 429.047396][T10354] overlayfs: missing 'lowerdir' [ 429.083488][T10360] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 429.102844][T10360] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 429.242599][ T9875] usb 5-1: string descriptor 0 read error: -71 [ 429.259192][T10357] wg1 speed is unknown, defaulting to 1000 [ 429.265775][T10357] lo speed is unknown, defaulting to 1000 [ 429.360965][ T9875] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 429.422762][ T3549] Bluetooth: Error in BCSP hdr checksum [ 429.430883][ T9875] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 429.491172][ T9875] usb 5-1: can't set config #1, error -71 [ 429.530996][ T9875] usb 5-1: USB disconnect, device number 21 [ 429.640821][ T29] audit: type=1400 audit(2000000319.557:607): avc: denied { map } for pid=10366 comm="syz.2.1017" path="socket:[32357]" dev="sockfs" ino=32357 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 432.086141][ T5131] Bluetooth: hci5: command 0x1003 tx timeout [ 432.093802][ T5820] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 432.500864][ T29] audit: type=1400 audit(2000000322.327:608): avc: denied { create } for pid=10366 comm="syz.2.1017" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=caif_socket permissive=1 [ 432.540251][ T29] audit: type=1400 audit(2000000322.327:609): avc: denied { write } for pid=10366 comm="syz.2.1017" path="socket:[32975]" dev="sockfs" ino=32975 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=caif_socket permissive=1 [ 432.584288][ T29] audit: type=1400 audit(2000000322.337:610): avc: denied { listen } for pid=10366 comm="syz.2.1017" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 432.624692][ T29] audit: type=1400 audit(2000000322.337:611): avc: denied { accept } for pid=10366 comm="syz.2.1017" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 433.080988][T10380] FAULT_INJECTION: forcing a failure. [ 433.080988][T10380] name failslab, interval 1, probability 0, space 0, times 0 [ 434.039170][T10380] CPU: 1 UID: 0 PID: 10380 Comm: syz.0.1021 Tainted: G L syzkaller #0 PREEMPT(full) [ 434.039199][T10380] Tainted: [L]=SOFTLOCKUP [ 434.039205][T10380] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 434.039214][T10380] Call Trace: [ 434.039220][T10380] [ 434.039226][T10380] dump_stack_lvl+0x100/0x190 [ 434.039259][T10380] should_fail_ex.cold+0x5/0xa [ 434.039281][T10380] should_failslab+0xc2/0x120 [ 434.039298][T10380] kmem_cache_alloc_node_noprof+0x81/0x6f0 [ 434.039323][T10380] ? __alloc_skb+0x140/0x710 [ 434.039349][T10380] __alloc_skb+0x140/0x710 [ 434.039374][T10380] ? __alloc_skb+0x5b7/0x710 [ 434.039395][T10380] ? __pfx___alloc_skb+0x10/0x10 [ 434.039422][T10380] netlink_ack+0x117/0xb80 [ 434.039446][T10380] ? avc_has_perm_noaudit+0x145/0x3b0 [ 434.039470][T10380] netlink_rcv_skb+0x333/0x420 [ 434.039496][T10380] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 434.039518][T10380] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 434.039553][T10380] ? ns_capable+0xd2/0xf0 [ 434.039576][T10380] nfnetlink_rcv+0x1b3/0x440 [ 434.039595][T10380] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 434.039614][T10380] ? netlink_deliver_tap+0x1ae/0xcc0 [ 434.039642][T10380] netlink_unicast+0x5aa/0x870 [ 434.039671][T10380] ? __pfx_netlink_unicast+0x10/0x10 [ 434.039704][T10380] netlink_sendmsg+0x8b0/0xda0 [ 434.039733][T10380] ? __pfx_netlink_sendmsg+0x10/0x10 [ 434.039757][T10380] ? __might_fault+0xa0/0x140 [ 434.039787][T10380] ____sys_sendmsg+0x9e1/0xb70 [ 434.039803][T10380] ? __pfx_netlink_sendmsg+0x10/0x10 [ 434.039830][T10380] ? __pfx_____sys_sendmsg+0x10/0x10 [ 434.039857][T10380] ___sys_sendmsg+0x190/0x1e0 [ 434.039876][T10380] ? __pfx____sys_sendmsg+0x10/0x10 [ 434.039921][T10380] __sys_sendmsg+0x170/0x220 [ 434.039945][T10380] ? __pfx___sys_sendmsg+0x10/0x10 [ 434.039982][T10380] do_syscall_64+0x106/0xf80 [ 434.040007][T10380] ? clear_bhb_loop+0x40/0x90 [ 434.040028][T10380] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 434.040044][T10380] RIP: 0033:0x7f2e17b9c799 [ 434.040058][T10380] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 434.040074][T10380] RSP: 002b:00007f2e15dee028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 434.040090][T10380] RAX: ffffffffffffffda RBX: 00007f2e17e15fa0 RCX: 00007f2e17b9c799 [ 434.040101][T10380] RDX: 0000000004000050 RSI: 0000200000000000 RDI: 0000000000000003 [ 434.040111][T10380] RBP: 00007f2e15dee090 R08: 0000000000000000 R09: 0000000000000000 [ 434.040120][T10380] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 434.040129][T10380] R13: 00007f2e17e16038 R14: 00007f2e17e15fa0 R15: 00007ffd8ef000e8 [ 434.040152][T10380] [ 434.573311][T10378] Set syz1 is full, maxelem 65536 reached [ 434.595692][ T1295] ieee802154 phy0 wpan0: encryption failed: -22 [ 434.602399][ T1295] ieee802154 phy1 wpan1: encryption failed: -22 [ 434.966650][T10391] Set syz1 is full, maxelem 65536 reached [ 435.008151][T10398] nvme_fabrics: unknown parameter or missing value 'syz0' in ctrl creation request [ 435.179380][T10401] nvme_fabrics: unknown parameter or missing value 'syz0' in ctrl creation request [ 436.422985][T10414] netlink: 'syz.0.1028': attribute type 20 has an invalid length. [ 436.965943][T10426] sp0: Synchronizing with TNC [ 437.309277][T10428] No control pipe specified [ 437.313823][ T29] audit: type=1400 audit(2000000327.217:612): avc: denied { append } for pid=10427 comm="syz.3.1033" name="ptp0" dev="devtmpfs" ino=1265 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 437.405792][ T29] audit: type=1400 audit(2000000327.227:613): avc: denied { write } for pid=10427 comm="syz.3.1033" name="ptp0" dev="devtmpfs" ino=1265 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 437.429164][T10432] FAULT_INJECTION: forcing a failure. [ 437.429164][T10432] name failslab, interval 1, probability 0, space 0, times 0 [ 437.443008][T10432] CPU: 0 UID: 0 PID: 10432 Comm: syz.1.1034 Tainted: G L syzkaller #0 PREEMPT(full) [ 437.443035][T10432] Tainted: [L]=SOFTLOCKUP [ 437.443040][T10432] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 437.443051][T10432] Call Trace: [ 437.443056][T10432] [ 437.443065][T10432] dump_stack_lvl+0x100/0x190 [ 437.443097][T10432] should_fail_ex.cold+0x5/0xa [ 437.443121][T10432] ? genl_family_rcv_msg_attrs_parse.isra.0+0xc2/0x280 [ 437.443142][T10432] should_failslab+0xc2/0x120 [ 437.443160][T10432] __kmalloc_noprof+0xe0/0x850 [ 437.443192][T10432] genl_family_rcv_msg_attrs_parse.isra.0+0xc2/0x280 [ 437.443213][T10432] ? cred_has_capability.isra.0+0x186/0x300 [ 437.443243][T10432] genl_family_rcv_msg_doit+0xc7/0x300 [ 437.443264][T10432] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 437.443292][T10432] ? bpf_lsm_capable+0x9/0x10 [ 437.443309][T10432] ? security_capable+0x80/0x260 [ 437.443331][T10432] ? ns_capable+0xd2/0xf0 [ 437.443361][T10432] genl_rcv_msg+0x560/0x800 [ 437.443383][T10432] ? __pfx_genl_rcv_msg+0x10/0x10 [ 437.443401][T10432] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 437.443423][T10432] ? __pfx_nl80211_set_beacon+0x10/0x10 [ 437.443441][T10432] ? __pfx_nl80211_post_doit+0x10/0x10 [ 437.443473][T10432] netlink_rcv_skb+0x159/0x420 [ 437.443501][T10432] ? __pfx_genl_rcv_msg+0x10/0x10 [ 437.443520][T10432] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 437.443545][T10432] ? rcu_is_watching+0x12/0xc0 [ 437.443576][T10432] ? __rcu_read_unlock+0x26a/0x5e0 [ 437.443593][T10432] ? rcu_is_watching+0x12/0xc0 [ 437.443619][T10432] genl_rcv+0x28/0x40 [ 437.443635][T10432] netlink_unicast+0x5aa/0x870 [ 437.443666][T10432] ? __pfx_netlink_unicast+0x10/0x10 [ 437.443702][T10432] netlink_sendmsg+0x8b0/0xda0 [ 437.443733][T10432] ? __pfx_netlink_sendmsg+0x10/0x10 [ 437.443758][T10432] ? __might_fault+0xa0/0x140 [ 437.443791][T10432] ____sys_sendmsg+0x9e1/0xb70 [ 437.443808][T10432] ? __pfx_netlink_sendmsg+0x10/0x10 [ 437.443837][T10432] ? __pfx_____sys_sendmsg+0x10/0x10 [ 437.443867][T10432] ___sys_sendmsg+0x190/0x1e0 [ 437.443888][T10432] ? __pfx____sys_sendmsg+0x10/0x10 [ 437.443938][T10432] __sys_sendmsg+0x170/0x220 [ 437.443963][T10432] ? __pfx___sys_sendmsg+0x10/0x10 [ 437.444004][T10432] do_syscall_64+0x106/0xf80 [ 437.444029][T10432] ? clear_bhb_loop+0x40/0x90 [ 437.444051][T10432] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 437.444069][T10432] RIP: 0033:0x7f3cc139c799 [ 437.444084][T10432] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 437.444099][T10432] RSP: 002b:00007f3cc2289028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 437.444116][T10432] RAX: ffffffffffffffda RBX: 00007f3cc1615fa0 RCX: 00007f3cc139c799 [ 437.444127][T10432] RDX: 0000000020000014 RSI: 00002000000001c0 RDI: 0000000000000003 [ 437.444138][T10432] RBP: 00007f3cc2289090 R08: 0000000000000000 R09: 0000000000000000 [ 437.444148][T10432] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 437.444158][T10432] R13: 00007f3cc1616038 R14: 00007f3cc1615fa0 R15: 00007ffdf3840ea8 [ 437.444183][T10432] [ 437.780105][T10422] block device autoloading is deprecated and will be removed. [ 438.680848][ T9875] usb 2-1: new full-speed USB device number 38 using dummy_hcd [ 439.046946][T10445] nvme_fabrics: unknown parameter or missing value 'syz0' in ctrl creation request [ 439.071437][ T9875] usb 2-1: too many endpoints for config 0 interface 0 altsetting 254: 253, using maximum allowed: 30 [ 439.087696][ T9875] usb 2-1: config 0 interface 0 altsetting 254 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 439.294137][ T9875] usb 2-1: config 0 interface 0 altsetting 254 endpoint 0x81 has invalid wMaxPacketSize 0 [ 439.324684][ T9875] usb 2-1: config 0 interface 0 altsetting 254 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 439.369111][ T9875] usb 2-1: config 0 interface 0 has no altsetting 0 [ 439.385917][ T9875] usb 2-1: New USB device found, idVendor=044e, idProduct=120c, bcdDevice= 0.00 [ 439.411252][ T9875] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 439.440607][ T9875] usb 2-1: config 0 descriptor?? [ 439.825141][T10457] netlink: 830 bytes leftover after parsing attributes in process `syz.0.1040'. [ 439.873253][ T9875] hid-alps 0003:044E:120C.001C: hidraw0: USB HID v0.04 Device [HID 044e:120c] on usb-dummy_hcd.1-1/input0 [ 439.941120][ T29] audit: type=1400 audit(2000000329.867:614): avc: denied { write } for pid=10452 comm="syz.0.1040" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=key permissive=1 [ 440.067443][T10459] bond1: option xmit_hash_policy: invalid value (6) [ 440.099966][T10463] kvm: MONITOR instruction emulated as NOP! [ 440.110961][ T5866] usb 2-1: USB disconnect, device number 38 [ 440.143105][T10462] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1042'. [ 440.154898][T10462] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1042'. [ 440.168160][T10459] bond1 (unregistering): Released all slaves [ 440.525440][T10474] sp0: Synchronizing with TNC [ 440.612656][T10473] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1043'. [ 440.623598][ T29] audit: type=1400 audit(2000000330.537:615): avc: denied { nlmsg_read } for pid=10466 comm="syz.4.1043" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 440.950877][ T5866] usb 3-1: new high-speed USB device number 34 using dummy_hcd [ 441.120876][ T9875] usb 5-1: new full-speed USB device number 22 using dummy_hcd [ 441.152503][ T5866] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 441.168913][ T5866] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 441.180731][ T5866] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 441.209302][ T5866] usb 3-1: Product: syz [ 441.226750][ T5866] usb 3-1: Manufacturer: syz [ 441.237959][ T5866] usb 3-1: SerialNumber: syz [ 441.267861][ T5866] cdc_ncm 3-1:1.0: skipping garbage [ 441.285508][ T9875] usb 5-1: config index 0 descriptor too short (expected 28277, got 36) [ 441.295372][ T9875] usb 5-1: config 53 has an invalid descriptor of length 0, skipping remainder of the config [ 441.296826][ T5866] cdc_ncm 3-1:1.0: CDC Union missing and no IAD found [ 441.316569][ T9875] usb 5-1: config 53 has no interfaces? [ 441.322531][ T9875] usb 5-1: New USB device found, idVendor=056a, idProduct=0063, bcdDevice= 0.00 [ 441.332219][ T5866] cdc_ncm 3-1:1.0: bind() failure [ 441.356790][ T9875] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 441.368604][ T5866] cdc_ncm 3-1:1.1: CDC Union missing and no IAD found [ 441.390445][ T5866] cdc_ncm 3-1:1.1: bind() failure [ 441.511250][ T9] usb 2-1: new high-speed USB device number 39 using dummy_hcd [ 441.855299][ T9] usb 2-1: too many configurations: 9, using maximum allowed: 8 [ 441.886751][ T9] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 441.895780][ T9] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 442.191568][ T9] usb 2-1: config 0 interface 0 has no altsetting 0 [ 442.207768][ T9] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 442.235136][ T9] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 442.235992][T10502] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 442.255301][T10502] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 442.266710][ T9] usb 2-1: config 0 interface 0 has no altsetting 0 [ 442.287929][ T9] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 442.387139][ T9] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 442.398708][ T9] usb 2-1: config 0 interface 0 has no altsetting 0 [ 442.406728][ T9] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 442.415847][ T9] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 442.429328][ T9] usb 2-1: config 0 interface 0 has no altsetting 0 [ 442.437175][ T9] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 442.446609][ T9] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 442.460864][ T9] usb 2-1: config 0 interface 0 has no altsetting 0 [ 442.468427][ T9] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 442.950914][ T9] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 442.961857][ T9] usb 2-1: config 0 interface 0 has no altsetting 0 [ 442.969490][ T9] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 442.978693][ T9] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 442.989798][ T9] usb 2-1: config 0 interface 0 has no altsetting 0 [ 442.997475][ T9] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 443.009941][ T9] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 443.025116][ T9] usb 2-1: config 0 interface 0 has no altsetting 0 [ 443.033894][ T9] usb 2-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 443.043681][ T9] usb 2-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 443.052938][ T9] usb 2-1: Product: syz [ 443.058993][ T9] usb 2-1: Manufacturer: syz [ 443.096212][ T9] usb 2-1: SerialNumber: syz [ 443.122173][ T9] usb 2-1: config 0 descriptor?? [ 443.157832][ T9] yurex 2-1:0.0: USB YUREX device now attached to Yurex #0 [ 443.248748][T10511] nvme_fabrics: unknown parameter or missing value 'syz0' in ctrl creation request [ 443.327698][ T9875] usb 5-1: string descriptor 0 read error: -71 [ 443.349792][ T9875] usb 5-1: USB disconnect, device number 22 [ 443.394704][ T9] usb 2-1: USB disconnect, device number 39 [ 443.402955][ T9] yurex 2-1:0.0: USB YUREX #0 now disconnected [ 443.459500][ T919] usb 3-1: USB disconnect, device number 34 [ 443.521956][T10521] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1055'. [ 443.546875][ T5820] Bluetooth: hci1: command 0x0406 tx timeout [ 443.739247][T10524] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 443.829244][T10524] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 443.847299][ T29] audit: type=1400 audit(2000000333.767:616): avc: denied { setopt } for pid=10523 comm="syz.4.1058" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 443.901537][ T5866] usb 1-1: new full-speed USB device number 21 using dummy_hcd [ 444.382797][T10534] netlink: 132 bytes leftover after parsing attributes in process `syz.1.1059'. [ 444.536667][ T5866] usb 1-1: config index 0 descriptor too short (expected 28277, got 36) [ 444.579721][ T5866] usb 1-1: config 53 has an invalid descriptor of length 0, skipping remainder of the config [ 444.630432][ T5866] usb 1-1: config 53 has no interfaces? [ 444.636069][ T919] usb 3-1: new high-speed USB device number 35 using dummy_hcd [ 444.656314][ T5866] usb 1-1: New USB device found, idVendor=056a, idProduct=0063, bcdDevice= 0.00 [ 444.962941][ T5866] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 445.051056][ T919] usb 3-1: Using ep0 maxpacket: 8 [ 445.097963][ T919] usb 3-1: unable to get BOS descriptor or descriptor too short [ 445.149902][ T919] usb 3-1: config 7 has an invalid interface number: 58 but max is 0 [ 445.208586][ T919] usb 3-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config [ 445.238176][ T919] usb 3-1: config 7 has no interface number 0 [ 445.382403][ T919] usb 3-1: New USB device found, idVendor=1498, idProduct=a090, bcdDevice=48.0f [ 445.549253][ T919] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 445.571609][ T919] usb 3-1: Product: syz [ 445.589849][ T919] usb 3-1: Manufacturer: syz [ 445.605895][T10545] sp0: Synchronizing with TNC [ 446.253947][ T919] usb 3-1: SerialNumber: syz [ 446.724765][ T919] usb 3-1: USB disconnect, device number 35 [ 446.816191][T10553] geneve2: entered promiscuous mode [ 447.143313][ T5820] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci0/hci0:201' [ 447.158661][ T5820] CPU: 0 UID: 0 PID: 5820 Comm: kworker/u9:7 Tainted: G L syzkaller #0 PREEMPT(full) [ 447.158684][ T5820] Tainted: [L]=SOFTLOCKUP [ 447.158691][ T5820] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 447.158703][ T5820] Workqueue: hci0 hci_rx_work [ 447.158728][ T5820] Call Trace: [ 447.158734][ T5820] [ 447.158741][ T5820] dump_stack_lvl+0x100/0x190 [ 447.158767][ T5820] sysfs_warn_dup.cold+0x1c/0x28 [ 447.158784][ T5820] sysfs_create_dir_ns+0x24b/0x2b0 [ 447.158803][ T5820] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 447.158820][ T5820] ? find_held_lock+0x2b/0x80 [ 447.158843][ T5820] ? kobject_add_internal+0x25f/0x930 [ 447.158862][ T5820] ? kobject_add_internal+0x25f/0x930 [ 447.158885][ T5820] ? do_raw_spin_unlock+0x145/0x1e0 [ 447.158905][ T5820] kobject_add_internal+0x2c8/0x930 [ 447.158919][ T5820] kobject_add+0x16a/0x1e0 [ 447.158931][ T5820] ? __pfx_kobject_add+0x10/0x10 [ 447.158942][ T5820] ? class_to_subsys+0x10f/0x150 [ 447.158957][ T5820] ? kobject_put+0xb9/0x640 [ 447.158970][ T5820] ? _raw_spin_unlock+0x28/0x50 [ 447.158999][ T5820] device_add+0x294/0x1950 [ 447.159017][ T5820] ? __pfx_dev_set_name+0x10/0x10 [ 447.159040][ T5820] ? __pfx_device_add+0x10/0x10 [ 447.159053][ T5820] ? mgmt_send_event_skb+0x2fb/0x460 [ 447.159070][ T5820] hci_conn_add_sysfs+0x1a3/0x260 [ 447.159092][ T5820] le_conn_complete_evt+0x11cb/0x1f40 [ 447.159113][ T5820] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 447.159141][ T5820] hci_le_conn_complete_evt+0x23c/0x3a0 [ 447.159164][ T5820] ? skb_pull_data+0x15f/0x1e0 [ 447.159185][ T5820] hci_le_meta_evt+0x34a/0x5f0 [ 447.159200][ T5820] ? __pfx_hci_le_conn_complete_evt+0x10/0x10 [ 447.159216][ T5820] hci_event_packet+0x682/0x11c0 [ 447.159230][ T5820] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 447.159246][ T5820] ? __pfx_hci_event_packet+0x10/0x10 [ 447.159269][ T5820] ? kcov_remote_start+0x374/0x660 [ 447.159293][ T5820] ? lockdep_hardirqs_on+0x78/0x100 [ 447.159324][ T5820] hci_rx_work+0x451/0xfc0 [ 447.159343][ T5820] process_one_work+0xa23/0x19a0 [ 447.159361][ T5820] ? __pfx_process_one_work+0x10/0x10 [ 447.159378][ T5820] ? __pfx_hci_rx_work+0x10/0x10 [ 447.159394][ T5820] worker_thread+0x5ef/0xe50 [ 447.159423][ T5820] ? kthread+0x13a/0x450 [ 447.159438][ T5820] ? __pfx_worker_thread+0x10/0x10 [ 447.159455][ T5820] kthread+0x370/0x450 [ 447.159470][ T5820] ? __pfx_kthread+0x10/0x10 [ 447.159482][ T5820] ret_from_fork+0x754/0xd80 [ 447.159495][ T5820] ? __pfx_ret_from_fork+0x10/0x10 [ 447.159508][ T5820] ? __switch_to+0x7b4/0x1120 [ 447.159521][ T5820] ? __pfx_kthread+0x10/0x10 [ 447.159534][ T5820] ret_from_fork_asm+0x1a/0x30 [ 447.159568][ T5820] [ 447.159617][ T5820] kobject: kobject_add_internal failed for hci0:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 448.055614][ T5820] Bluetooth: hci0: failed to register connection device [ 448.095548][ T5820] ================================================================== [ 448.103627][ T5820] BUG: KASAN: slab-use-after-free in l2cap_connect_cfm+0xde7/0xf80 [ 448.111523][ T5820] Read of size 8 at addr ffff88805bf42480 by task kworker/u9:7/5820 [ 448.119472][ T5820] [ 448.121788][ T5820] CPU: 0 UID: 0 PID: 5820 Comm: kworker/u9:7 Tainted: G L syzkaller #0 PREEMPT(full) [ 448.121816][ T5820] Tainted: [L]=SOFTLOCKUP [ 448.121823][ T5820] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 448.121836][ T5820] Workqueue: hci0 hci_rx_work [ 448.121860][ T5820] Call Trace: [ 448.121868][ T5820] [ 448.121873][ T5820] dump_stack_lvl+0x100/0x190 [ 448.121894][ T5820] print_report+0x156/0x4c9 [ 448.121909][ T5820] ? __virt_addr_valid+0x81/0x620 [ 448.121926][ T5820] ? __phys_addr+0xe8/0x180 [ 448.121949][ T5820] ? l2cap_connect_cfm+0xde7/0xf80 [ 448.121969][ T5820] kasan_report+0xdf/0x1e0 [ 448.121986][ T5820] ? l2cap_connect_cfm+0xde7/0xf80 [ 448.122007][ T5820] l2cap_connect_cfm+0xde7/0xf80 [ 448.122024][ T5820] ? __pfx_l2cap_connect_cfm+0x10/0x10 [ 448.122040][ T5820] ? __pfx_l2cap_connect_cfm+0x10/0x10 [ 448.122053][ T5820] le_conn_complete_evt+0x195c/0x1f40 [ 448.122068][ T5820] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 448.122103][ T5820] hci_le_conn_complete_evt+0x23c/0x3a0 [ 448.122126][ T5820] ? skb_pull_data+0x15f/0x1e0 [ 448.122146][ T5820] hci_le_meta_evt+0x34a/0x5f0 [ 448.122164][ T5820] ? __pfx_hci_le_conn_complete_evt+0x10/0x10 [ 448.122180][ T5820] hci_event_packet+0x682/0x11c0 [ 448.122193][ T5820] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 448.122208][ T5820] ? __pfx_hci_event_packet+0x10/0x10 [ 448.122225][ T5820] ? kcov_remote_start+0x374/0x660 [ 448.122249][ T5820] ? lockdep_hardirqs_on+0x78/0x100 [ 448.122276][ T5820] hci_rx_work+0x451/0xfc0 [ 448.122299][ T5820] process_one_work+0xa23/0x19a0 [ 448.122323][ T5820] ? __pfx_process_one_work+0x10/0x10 [ 448.122346][ T5820] ? __pfx_hci_rx_work+0x10/0x10 [ 448.122367][ T5820] worker_thread+0x5ef/0xe50 [ 448.122388][ T5820] ? kthread+0x13a/0x450 [ 448.122403][ T5820] ? __pfx_worker_thread+0x10/0x10 [ 448.122419][ T5820] kthread+0x370/0x450 [ 448.122434][ T5820] ? __pfx_kthread+0x10/0x10 [ 448.122449][ T5820] ret_from_fork+0x754/0xd80 [ 448.122460][ T5820] ? __pfx_ret_from_fork+0x10/0x10 [ 448.122471][ T5820] ? __switch_to+0x7b4/0x1120 [ 448.122485][ T5820] ? __pfx_kthread+0x10/0x10 [ 448.122495][ T5820] ret_from_fork_asm+0x1a/0x30 [ 448.122514][ T5820] [ 448.122521][ T5820] [ 448.335898][ T5820] Allocated by task 5820: [ 448.340202][ T5820] kasan_save_stack+0x30/0x50 [ 448.344868][ T5820] kasan_save_track+0x14/0x30 [ 448.349525][ T5820] __kasan_kmalloc+0xaa/0xb0 [ 448.354100][ T5820] l2cap_chan_create+0x44/0x940 [ 448.358938][ T5820] l2cap_sock_alloc.constprop.0+0xf5/0x1e0 [ 448.364731][ T5820] l2cap_sock_new_connection_cb+0x101/0x260 [ 448.370607][ T5820] l2cap_connect_cfm+0x4e2/0xf80 [ 448.375523][ T5820] le_conn_complete_evt+0x195c/0x1f40 [ 448.380875][ T5820] hci_le_conn_complete_evt+0x23c/0x3a0 [ 448.386399][ T5820] hci_le_meta_evt+0x34a/0x5f0 [ 448.391141][ T5820] hci_event_packet+0x682/0x11c0 [ 448.396056][ T5820] hci_rx_work+0x451/0xfc0 [ 448.400456][ T5820] process_one_work+0xa23/0x19a0 [ 448.405368][ T5820] worker_thread+0x5ef/0xe50 [ 448.409937][ T5820] kthread+0x370/0x450 [ 448.413982][ T5820] ret_from_fork+0x754/0xd80 [ 448.418547][ T5820] ret_from_fork_asm+0x1a/0x30 [ 448.423291][ T5820] [ 448.425588][ T5820] Freed by task 10554: [ 448.429624][ T5820] kasan_save_stack+0x30/0x50 [ 448.434281][ T5820] kasan_save_track+0x14/0x30 [ 448.438942][ T5820] kasan_save_free_info+0x3b/0x70 [ 448.443944][ T5820] __kasan_slab_free+0x5f/0x80 [ 448.448681][ T5820] kfree+0x1f6/0x6b0 [ 448.452556][ T5820] l2cap_chan_put+0x235/0x300 [ 448.457214][ T5820] l2cap_sock_cleanup_listen+0x4d/0x2d0 [ 448.462740][ T5820] l2cap_sock_release+0x69/0x280 [ 448.467660][ T5820] __sock_release+0xb3/0x260 [ 448.472236][ T5820] sock_close+0x1c/0x30 [ 448.476376][ T5820] __fput+0x3ff/0xb40 [ 448.480336][ T5820] task_work_run+0x150/0x240 [ 448.484903][ T5820] exit_to_user_mode_loop+0x100/0x4a0 [ 448.490250][ T5820] do_syscall_64+0x67c/0xf80 [ 448.494824][ T5820] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 448.500695][ T5820] [ 448.502997][ T5820] The buggy address belongs to the object at ffff88805bf42000 [ 448.502997][ T5820] which belongs to the cache kmalloc-2k of size 2048 [ 448.517023][ T5820] The buggy address is located 1152 bytes inside of [ 448.517023][ T5820] freed 2048-byte region [ffff88805bf42000, ffff88805bf42800) [ 448.530964][ T5820] [ 448.533264][ T5820] The buggy address belongs to the physical page: [ 448.539655][ T5820] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5bf40 [ 448.548391][ T5820] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 448.556861][ T5820] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 448.564380][ T5820] page_type: f5(slab) [ 448.568339][ T5820] raw: 00fff00000000040 ffff88813fe41000 dead000000000100 dead000000000122 [ 448.576897][ T5820] raw: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000 [ 448.585454][ T5820] head: 00fff00000000040 ffff88813fe41000 dead000000000100 dead000000000122 [ 448.594101][ T5820] head: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000 [ 448.602745][ T5820] head: 00fff00000000003 ffffea00016fd001 00000000ffffffff 00000000ffffffff [ 448.611394][ T5820] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 448.620032][ T5820] page dumped because: kasan: bad access detected [ 448.626416][ T5820] page_owner tracks the page as allocated [ 448.632102][ T5820] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5815, tgid 5815 (syz-executor), ts 59738282157, free_ts 12865165836 [ 448.652824][ T5820] post_alloc_hook+0x153/0x170 [ 448.657570][ T5820] get_page_from_freelist+0x111d/0x3140 [ 448.663095][ T5820] __alloc_frozen_pages_noprof+0x27c/0x2ba0 [ 448.668971][ T5820] new_slab+0xa6/0x6b0 [ 448.673020][ T5820] refill_objects+0x26b/0x400 [ 448.677677][ T5820] __pcs_replace_empty_main+0x1ab/0x660 [ 448.683202][ T5820] __kmalloc_node_track_caller_noprof+0x694/0x850 [ 448.689599][ T5820] kmalloc_reserve+0xe8/0x350 [ 448.694251][ T5820] pskb_expand_head+0x246/0xfe0 [ 448.699083][ T5820] netlink_trim+0x22d/0x2f0 [ 448.703564][ T5820] netlink_broadcast_filtered+0xd7/0xf50 [ 448.709177][ T5820] nlmsg_notify+0xb1/0x290 [ 448.713576][ T5820] rtmsg_ifinfo+0x177/0x1b0 [ 448.718070][ T5820] __dev_notify_flags+0x24c/0x2e0 [ 448.723080][ T5820] rtnl_configure_link+0x1b5/0x280 [ 448.728167][ T5820] veth_newlink+0x3af/0xa00 [ 448.732653][ T5820] page last free pid 1 tgid 1 stack trace: [ 448.738429][ T5820] __free_frozen_pages+0x7e1/0x10d0 [ 448.743603][ T5820] free_contig_range+0xde/0x1d0 [ 448.748432][ T5820] destroy_args+0xa8/0x7a0 [ 448.752827][ T5820] debug_vm_pgtable+0x1b66/0x34c0 [ 448.757830][ T5820] do_one_initcall+0x11d/0x760 [ 448.762570][ T5820] kernel_init_freeable+0x6e5/0x7a0 [ 448.767754][ T5820] kernel_init+0x1f/0x1e0 [ 448.772063][ T5820] ret_from_fork+0x754/0xd80 [ 448.776659][ T5820] ret_from_fork_asm+0x1a/0x30 [ 448.781404][ T5820] [ 448.783703][ T5820] Memory state around the buggy address: [ 448.789307][ T5820] ffff88805bf42380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 448.797344][ T5820] ffff88805bf42400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 448.805395][ T5820] >ffff88805bf42480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 448.813426][ T5820] ^ [ 448.817465][ T5820] ffff88805bf42500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 448.825501][ T5820] ffff88805bf42580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 448.833535][ T5820] ================================================================== [ 448.850990][ T5820] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 448.858190][ T5820] CPU: 0 UID: 0 PID: 5820 Comm: kworker/u9:7 Tainted: G L syzkaller #0 PREEMPT(full) [ 448.869205][ T5820] Tainted: [L]=SOFTLOCKUP [ 448.873515][ T5820] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 448.883565][ T5820] Workqueue: hci0 hci_rx_work [ 448.888240][ T5820] Call Trace: [ 448.891499][ T5820] [ 448.894407][ T5820] dump_stack_lvl+0x100/0x190 [ 448.899079][ T5820] vpanic+0x552/0x970 [ 448.903037][ T5820] ? __pfx_vpanic+0x10/0x10 [ 448.907529][ T5820] ? l2cap_connect_cfm+0xde7/0xf80 [ 448.912618][ T5820] panic+0xd1/0xe0 [ 448.916314][ T5820] ? __pfx_panic+0x10/0x10 [ 448.920708][ T5820] ? l2cap_connect_cfm+0xde7/0xf80 [ 448.925797][ T5820] ? preempt_schedule_common+0x42/0xc0 [ 448.931241][ T5820] check_panic_on_warn.cold+0x19/0x34 [ 448.936592][ T5820] end_report.part.0+0x3a/0x90 [ 448.941342][ T5820] kasan_report.cold+0xe/0x18 [ 448.946000][ T5820] ? l2cap_connect_cfm+0xde7/0xf80 [ 448.951101][ T5820] l2cap_connect_cfm+0xde7/0xf80 [ 448.956028][ T5820] ? __pfx_l2cap_connect_cfm+0x10/0x10 [ 448.961469][ T5820] ? __pfx_l2cap_connect_cfm+0x10/0x10 [ 448.966906][ T5820] le_conn_complete_evt+0x195c/0x1f40 [ 448.972258][ T5820] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 448.977961][ T5820] hci_le_conn_complete_evt+0x23c/0x3a0 [ 448.983487][ T5820] ? skb_pull_data+0x15f/0x1e0 [ 448.988230][ T5820] hci_le_meta_evt+0x34a/0x5f0 [ 448.992979][ T5820] ? __pfx_hci_le_conn_complete_evt+0x10/0x10 [ 448.999024][ T5820] hci_event_packet+0x682/0x11c0 [ 449.003939][ T5820] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 449.009210][ T5820] ? __pfx_hci_event_packet+0x10/0x10 [ 449.014561][ T5820] ? kcov_remote_start+0x374/0x660 [ 449.019659][ T5820] ? lockdep_hardirqs_on+0x78/0x100 [ 449.024844][ T5820] hci_rx_work+0x451/0xfc0 [ 449.029241][ T5820] process_one_work+0xa23/0x19a0 [ 449.034161][ T5820] ? __pfx_process_one_work+0x10/0x10 [ 449.039514][ T5820] ? __pfx_hci_rx_work+0x10/0x10 [ 449.044433][ T5820] worker_thread+0x5ef/0xe50 [ 449.049002][ T5820] ? kthread+0x13a/0x450 [ 449.053219][ T5820] ? __pfx_worker_thread+0x10/0x10 [ 449.058307][ T5820] kthread+0x370/0x450 [ 449.062351][ T5820] ? __pfx_kthread+0x10/0x10 [ 449.066918][ T5820] ret_from_fork+0x754/0xd80 [ 449.071488][ T5820] ? __pfx_ret_from_fork+0x10/0x10 [ 449.076587][ T5820] ? __switch_to+0x7b4/0x1120 [ 449.081245][ T5820] ? __pfx_kthread+0x10/0x10 [ 449.085811][ T5820] ret_from_fork_asm+0x1a/0x30 [ 449.090563][ T5820] [ 449.093832][ T5820] Kernel Offset: disabled [ 449.098135][ T5820] Rebooting in 86400 seconds..